From a19da46a591df9cfce4f3475962970c25388f3a5 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 28 Sep 2026 21:58:35 +0000
Subject: [PATCH 1/6] Pin the #257 oracle sweeps with golden digests

The randomized equivalence sweeps that compare the blocking-pool
crawlers and single-pass rewriters with their pre-#257 oracles now
also record, per case, a digest of the generated input and of the
output both implementations agreed on, in
crates/socket-patch-core/tests/equivalence/*.golden. The oracles
still run, so every recorded output is proven equal to the oracle's.
The next commit deletes the oracles and keeps the goldens.

The crawler goldens were blessed on Linux as a non-root user: the
sweeps strip permissions and plant symlinks, so they replay only
there (other platforms and root still run the sweeps, without the
golden comparison).

Also moves the crawler sweeps' xorshift test RNG to
crate::test_rng, and renames crawlers::oracle_support to
crawlers::test_tree.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N9YdJqaGiT9Jf5LN1hDFhB
---
 .../src/crawlers/cargo_crawler.rs             |  24 +-
 .../src/crawlers/composer_crawler.rs          |  23 +-
 .../src/crawlers/go_crawler.rs                |  40 +-
 .../src/crawlers/maven_crawler.rs             |  57 ++-
 .../crawlers/maven_pom_equivalence_tests.rs   |  21 +-
 crates/socket-patch-core/src/crawlers/mod.rs  |   4 +-
 .../src/crawlers/npm_crawler/oracle.rs        |  54 +++
 .../src/crawlers/nuget_crawler.rs             |  35 +-
 .../src/crawlers/python_crawler.rs            |  35 +-
 .../src/crawlers/ruby_crawler.rs              |   3 +-
 .../{oracle_support.rs => test_tree.rs}       | 137 +++++--
 crates/socket-patch-core/src/golden.rs        | 209 ++++++++++
 crates/socket-patch-core/src/lib.rs           |   5 +
 .../redirect/cargo_lock_equivalence_tests.rs  |  57 ++-
 .../redirect/composer_equivalence_tests.rs    |   9 +-
 .../redirect/golang_equivalence_tests.rs      |  27 +-
 .../redirect/lock_index_equivalence_tests.rs  |  18 +
 .../src/patch/redirect/mod.rs                 |   5 +
 .../patch/redirect/pnpm_equivalence_tests.rs  |  21 ++
 .../redirect/python_lock_equivalence_tests.rs |  14 +
 crates/socket-patch-core/src/test_rng.rs      |  35 ++
 crates/socket-patch-core/src/vex/verify.rs    |   3 +-
 .../cargo_lock_hand_written.golden            |  34 ++
 .../tests/equivalence/cargo_lock_large.golden |  28 ++
 .../equivalence/cargo_lock_random.golden      | 260 +++++++++++++
 .../equivalence/composer_lock_rewrite.golden  | 302 +++++++++++++++
 .../equivalence/crawl_cargo_sources.golden    |  66 ++++
 .../equivalence/crawl_cargo_vendor.golden     |   3 +
 .../equivalence/crawl_composer_vendor.golden  |  66 ++++
 .../equivalence/crawl_go_absent_root.golden   |   3 +
 .../equivalence/crawl_go_module_cache.golden  |  50 +++
 .../equivalence/crawl_maven_consistent.golden |  66 ++++
 .../equivalence/crawl_maven_misrooted.golden  | 357 ++++++++++++++++++
 .../equivalence/crawl_maven_no_pool.golden    |  18 +
 .../crawl_maven_parse_chunks.golden           |  98 +++++
 .../equivalence/crawl_maven_repos.golden      |  66 ++++
 .../crawl_npm_foreign_identity.golden         |   3 +
 .../equivalence/crawl_npm_kitchen_sink.golden |   3 +
 .../equivalence/crawl_npm_no_pool.golden      |  18 +
 .../tests/equivalence/crawl_npm_trees.golden  |  66 ++++
 .../crawl_nuget_legacy_fallback.golden        |   3 +
 .../equivalence/crawl_nuget_packages.golden   |  66 ++++
 .../crawl_python_site_packages.golden         |  66 ++++
 .../tests/equivalence/golang_rewrite.golden   | 302 +++++++++++++++
 .../equivalence/maven_pom_project.golden      | 202 ++++++++++
 .../tests/equivalence/maven_pom_random.golden | 202 ++++++++++
 .../tests/equivalence/npm_lock_rewrite.golden | 202 ++++++++++
 .../equivalence/pnpm_depscan_sized.golden     |   3 +
 .../pnpm_duplicate_override.golden            |   4 +
 .../equivalence/pnpm_peer_suffixed.golden     |   3 +
 .../tests/equivalence/pnpm_random.golden      | 302 +++++++++++++++
 .../equivalence/python_lock_refusal.golden    |   6 +
 .../equivalence/python_lock_rewrite.golden    | 302 +++++++++++++++
 .../equivalence/yarn_classic_rewrite.golden   | 202 ++++++++++
 54 files changed, 4137 insertions(+), 71 deletions(-)
 rename crates/socket-patch-core/src/crawlers/{oracle_support.rs => test_tree.rs} (53%)
 create mode 100644 crates/socket-patch-core/src/golden.rs
 create mode 100644 crates/socket-patch-core/src/test_rng.rs
 create mode 100644 crates/socket-patch-core/tests/equivalence/cargo_lock_hand_written.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/cargo_lock_large.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/cargo_lock_random.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/composer_lock_rewrite.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/crawl_cargo_sources.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/crawl_cargo_vendor.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/crawl_composer_vendor.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/crawl_go_absent_root.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/crawl_go_module_cache.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/crawl_maven_consistent.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/crawl_maven_misrooted.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/crawl_maven_no_pool.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/crawl_maven_parse_chunks.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/crawl_maven_repos.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/crawl_npm_foreign_identity.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/crawl_npm_kitchen_sink.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/crawl_npm_no_pool.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/crawl_npm_trees.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/crawl_nuget_legacy_fallback.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/crawl_nuget_packages.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/crawl_python_site_packages.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/golang_rewrite.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/maven_pom_project.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/maven_pom_random.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/npm_lock_rewrite.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/pnpm_depscan_sized.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/pnpm_duplicate_override.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/pnpm_peer_suffixed.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/pnpm_random.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/python_lock_refusal.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/python_lock_rewrite.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/yarn_classic_rewrite.golden

diff --git a/crates/socket-patch-core/src/crawlers/cargo_crawler.rs b/crates/socket-patch-core/src/crawlers/cargo_crawler.rs
index 808876b76..b9db123cc 100644
--- a/crates/socket-patch-core/src/crawlers/cargo_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/cargo_crawler.rs
@@ -1131,7 +1131,11 @@ version = "fake"
     mod equivalence {
         use super::super::oracle::LegacyCargoCrawler;
         use super::*;
-        use crate::crawlers::oracle_support::{mkdir, rows, symlink, write, PermGuard, Rng};
+        use crate::crawlers::test_tree::{
+            crawl_goldens_apply, mkdir, rel_rows, rows, symlink, tree_listing, write, PermGuard,
+        };
+        use crate::golden::Golden;
+        use crate::test_rng::Rng;
 
         const NAMES: &[&str] = &["serde", "serde-json", "sha-1", "tokio", "dup", "a_b"];
         const VERSIONS: &[&str] = &["1.0.0", "1.0.0-rc.1", "0.2.3", "5", "1.0.0+build"];
@@ -1186,12 +1190,17 @@ version = "fake"
         #[tokio::test]
         async fn randomized_sources_match_the_async_oracle() {
             let mut total = 0;
+            let mut g = Golden::new(
+                "crawl_cargo_sources",
+                "One seeded crate source tree, crawled.",
+            );
             for seed in 0..64u64 {
                 let tmp = tempfile::tempdir().unwrap();
                 let mut perms = PermGuard::default();
                 let mut rng = Rng::new(seed);
                 let root = tmp.path().join("src");
                 tree(&mut rng, &root, &tmp.path().join("outside"), &mut perms);
+                let input = (tree_listing(tmp.path()), perms.planned(tmp.path()));
                 perms.apply();
                 let options = CrawlerOptions {
                     cwd: tmp.path().to_path_buf(),
@@ -1201,9 +1210,13 @@ version = "fake"
                 let new = CargoCrawler::new().crawl_all(&options).await;
                 let old = LegacyCargoCrawler::crawl_all(&options).await;
                 assert_eq!(rows(&new), rows(&old), "seed {seed}");
+                g.case(seed, &input, &rel_rows(tmp.path(), &new));
                 total += old.len();
             }
             assert!(total > 200, "vacuous fixtures: {total}");
+            if crawl_goldens_apply(true) {
+                g.finish();
+            }
         }
 
         /// Local mode: a Cargo project with a `vendor/` tree.
@@ -1219,6 +1232,7 @@ version = "fake"
                 &tmp.path().join("outside"),
                 &mut perms,
             );
+            let input = (tree_listing(tmp.path()), perms.planned(tmp.path()));
             perms.apply();
             let options = CrawlerOptions {
                 cwd: tmp.path().to_path_buf(),
@@ -1229,6 +1243,14 @@ version = "fake"
             let old = LegacyCargoCrawler::crawl_all(&options).await;
             assert!(!old.is_empty());
             assert_eq!(rows(&new), rows(&old));
+            let mut g = Golden::new(
+                "crawl_cargo_vendor",
+                "A seeded Cargo project vendor/ tree, crawled locally.",
+            );
+            g.case(7, &input, &rel_rows(tmp.path(), &new));
+            if crawl_goldens_apply(true) {
+                g.finish();
+            }
         }
     }
 }
diff --git a/crates/socket-patch-core/src/crawlers/composer_crawler.rs b/crates/socket-patch-core/src/crawlers/composer_crawler.rs
index 38d060184..5e3ce537b 100644
--- a/crates/socket-patch-core/src/crawlers/composer_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/composer_crawler.rs
@@ -1734,7 +1734,12 @@ mod tests {
     mod equivalence {
         use super::super::oracle::LegacyComposerCrawler;
         use super::*;
-        use crate::crawlers::oracle_support::{map_rows, mkdir, rows, symlink, write, Rng};
+        use crate::crawlers::test_tree::{
+            crawl_goldens_apply, map_rows, mkdir, rel_map_rows, rel_rows, rows, symlink,
+            tree_listing, write,
+        };
+        use crate::golden::Golden;
+        use crate::test_rng::Rng;
 
         const NAMES: &[&str] = &[
             "monolog/monolog",
@@ -1794,11 +1799,16 @@ mod tests {
         #[tokio::test]
         async fn randomized_vendor_trees_match_the_async_oracle() {
             let (mut crawled, mut found) = (0, 0);
+            let mut g = Golden::new(
+                "crawl_composer_vendor",
+                "One seeded vendor/composer tree: crawl_all, then find_by_purls.",
+            );
             for seed in 0..64u64 {
                 let mut rng = Rng::new(seed);
                 let tmp = tempfile::tempdir().unwrap();
                 let root = tmp.path().join("proj");
                 let packages = project(&mut rng, &root);
+                let input = tree_listing(tmp.path());
                 let options = CrawlerOptions {
                     cwd: root.clone(),
                     global: false,
@@ -1828,6 +1838,14 @@ mod tests {
                     map_rows(&old_found),
                     "seed {seed}: find_by_purls"
                 );
+                g.case(
+                    seed,
+                    &input,
+                    &(
+                        rel_rows(tmp.path(), &new),
+                        rel_map_rows(tmp.path(), &new_found),
+                    ),
+                );
                 crawled += old.len();
                 found += old_found.len();
             }
@@ -1835,6 +1853,9 @@ mod tests {
                 crawled > 50 && found > 50,
                 "vacuous fixtures: {crawled}/{found}"
             );
+            if crawl_goldens_apply(false) {
+                g.finish();
+            }
         }
 
         /// The `composer global config home` memo re-runs only when the
diff --git a/crates/socket-patch-core/src/crawlers/go_crawler.rs b/crates/socket-patch-core/src/crawlers/go_crawler.rs
index fd1aaa66d..3b545a924 100644
--- a/crates/socket-patch-core/src/crawlers/go_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/go_crawler.rs
@@ -1373,9 +1373,12 @@ mod tests {
     mod equivalence {
         use super::super::oracle::LegacyGoCrawler;
         use super::*;
-        use crate::crawlers::oracle_support::{
-            map_rows, mkdir, rows, symlink, write, PermGuard, Rng,
+        use crate::crawlers::test_tree::{
+            crawl_goldens_apply, map_rows, mkdir, rel_map_rows, rel_rows, rows, symlink,
+            tree_listing, write, PermGuard,
         };
+        use crate::golden::Golden;
+        use crate::test_rng::Rng;
 
         const NAMES: &[&str] = &[
             "github.com",
@@ -1488,7 +1491,12 @@ mod tests {
 
         /// Returns (packages crawled, PURLs found) so the caller can check
         /// the fixtures are not vacuous.
-        async fn assert_equivalent(gen: &Gen, label: &str) -> (usize, usize) {
+        async fn assert_equivalent(
+            g: &mut Golden,
+            input: &impl serde::Serialize,
+            gen: &Gen,
+            label: &str,
+        ) -> (usize, usize) {
             let options = CrawlerOptions {
                 cwd: gen.root.clone(),
                 global: false,
@@ -1509,12 +1517,22 @@ mod tests {
                 map_rows(&old_found),
                 "{label}: find_by_purls"
             );
+            let base = gen.root.parent().unwrap();
+            g.case(
+                label.replace(' ', "_"),
+                input,
+                &(rel_rows(base, &new), rel_map_rows(base, &new_found)),
+            );
             (old.len(), old_found.len())
         }
 
         #[tokio::test]
         async fn randomized_caches_match_the_async_oracle() {
             let (mut crawled, mut found) = (0, 0);
+            let mut g = Golden::new(
+                "crawl_go_module_cache",
+                "One seeded GOMODCACHE tree: crawl_all, then find_by_purls.",
+            );
             // At least 48 seeds, and more until the fixtures clear the
             // non-vacuity bar below: a case-insensitive filesystem folds
             // `Azure`/`!azure`-style siblings together and Windows ignores
@@ -1532,8 +1550,13 @@ mod tests {
                 };
                 let root = gen.root.clone();
                 gen.dir(&root, 0);
+                let input = (
+                    tree_listing(tmp.path()),
+                    gen.perms.planned(tmp.path()),
+                    gen.versioned.clone(),
+                );
                 gen.perms.apply();
-                let (c, f) = assert_equivalent(&gen, &format!("seed {seed}")).await;
+                let (c, f) = assert_equivalent(&mut g, &input, &gen, &format!("seed {seed}")).await;
                 crawled += c;
                 found += f;
                 seed += 1;
@@ -1542,6 +1565,9 @@ mod tests {
                 crawled > 100 && found > 100,
                 "vacuous fixtures: {crawled}/{found}"
             );
+            if crawl_goldens_apply(true) {
+                g.finish();
+            }
         }
 
         #[tokio::test]
@@ -1554,7 +1580,11 @@ mod tests {
                 perms: PermGuard::default(),
                 versioned: vec!["mod@v1.0.0".to_string()],
             };
-            assert_equivalent(&gen, "absent root").await;
+            let mut g = Golden::new("crawl_go_absent_root", "An absent GOMODCACHE root.");
+            assert_equivalent(&mut g, &(), &gen, "absent root").await;
+            if crawl_goldens_apply(false) {
+                g.finish();
+            }
         }
     }
 }
diff --git a/crates/socket-patch-core/src/crawlers/maven_crawler.rs b/crates/socket-patch-core/src/crawlers/maven_crawler.rs
index da2a15846..e83819d2c 100644
--- a/crates/socket-patch-core/src/crawlers/maven_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/maven_crawler.rs
@@ -2170,9 +2170,12 @@ mod tests {
     mod equivalence {
         use super::super::oracle::LegacyMavenCrawler;
         use super::*;
-        use crate::crawlers::oracle_support::{
-            mkdir, rows, symlink, write, write_bytes, PermGuard, Rng,
+        use crate::crawlers::test_tree::{
+            crawl_goldens_apply, mkdir, rel, rel_rows, rows, symlink, tree_listing, write,
+            write_bytes, PermGuard,
         };
+        use crate::golden::Golden;
+        use crate::test_rng::Rng;
 
         const GROUPS: &[&str] = &["org/apache/commons", "com/google/guava", "io/netty"];
         const ARTIFACTS: &[&str] = &["commons-lang3", "guava", "netty-all", "dup"];
@@ -2248,6 +2251,10 @@ mod tests {
         /// across a chunk boundary.
         #[tokio::test]
         async fn every_parse_chunk_size_matches_the_serial_oracle() {
+            let mut g = Golden::new(
+                "crawl_maven_parse_chunks",
+                "One seeded ~/.m2 repository, scanned at one parse chunk size.",
+            );
             let mut total = 0;
             for seed in 0..16u64 {
                 let tmp = tempfile::tempdir().unwrap();
@@ -2255,6 +2262,7 @@ mod tests {
                 let mut rng = Rng::new(seed);
                 let root = tmp.path().join("repository");
                 repo(&mut rng, &root, &tmp.path().join("outside"), &mut perms);
+                let input = (tree_listing(tmp.path()), perms.planned(tmp.path()));
                 perms.apply();
                 let options = CrawlerOptions {
                     cwd: tmp.path().to_path_buf(),
@@ -2266,10 +2274,18 @@ mod tests {
                     let mut seen = HashSet::new();
                     let found = MavenCrawler.scan_maven_repo_chunked(&root, &mut seen, chunk);
                     assert_eq!(rows(&found), rows(&old), "seed {seed}, chunk {chunk}");
+                    g.case(
+                        format!("{seed}/{chunk}"),
+                        &input,
+                        &rel_rows(tmp.path(), &found),
+                    );
                 }
                 total += old.len();
             }
             assert!(total > 50, "vacuous fixtures: {total}");
+            if crawl_goldens_apply(true) {
+                g.finish();
+            }
         }
 
         /// The no-walk-pool fallback (the OS refused even one walk thread,
@@ -2280,6 +2296,10 @@ mod tests {
         /// cannot get them — where the serial scan simply finished.
         #[tokio::test]
         async fn no_pool_repos_match_the_serial_oracle() {
+            let mut g = Golden::new(
+                "crawl_maven_no_pool",
+                "One seeded ~/.m2 repository, crawled with no walk pool.",
+            );
             let _off = crate::crawlers::walk_pool::test_hooks::DisablePool::new();
             let mut total = 0;
             for seed in 0..16u64 {
@@ -2288,6 +2308,7 @@ mod tests {
                 let mut rng = Rng::new(seed);
                 let root = tmp.path().join("repository");
                 repo(&mut rng, &root, &tmp.path().join("outside"), &mut perms);
+                let input = (tree_listing(tmp.path()), perms.planned(tmp.path()));
                 perms.apply();
                 let options = CrawlerOptions {
                     cwd: tmp.path().to_path_buf(),
@@ -2297,9 +2318,13 @@ mod tests {
                 let new = MavenCrawler::new().crawl_all(&options).await;
                 let old = LegacyMavenCrawler::crawl_all(&options).await;
                 assert_eq!(rows(&new), rows(&old), "no pool, seed {seed}");
+                g.case(seed, &input, &rel_rows(tmp.path(), &new));
                 total += old.len();
             }
             assert!(total > 50, "vacuous fixtures: {total}");
+            if crawl_goldens_apply(true) {
+                g.finish();
+            }
         }
 
         /// MVN-1 changes nothing on a repository whose canonically placed
@@ -2310,6 +2335,10 @@ mod tests {
         /// and comment-only POMs).
         #[tokio::test]
         async fn consistent_repos_match_the_content_first_scan() {
+            let mut g = Golden::new(
+                "crawl_maven_consistent",
+                "One seeded ~/.m2 repository whose POMs agree with their dirs, crawled.",
+            );
             let mut total = 0;
             for seed in 0..64u64 {
                 let tmp = tempfile::tempdir().unwrap();
@@ -2323,6 +2352,7 @@ mod tests {
                     &mut perms,
                     true,
                 );
+                let input = (tree_listing(tmp.path()), perms.planned(tmp.path()));
                 perms.apply();
                 let options = CrawlerOptions {
                     cwd: tmp.path().to_path_buf(),
@@ -2332,9 +2362,13 @@ mod tests {
                 let new = MavenCrawler::new().crawl_all(&options).await;
                 let old = super::super::oracle::crawl_all_content_first(&options).await;
                 assert_eq!(rows(&new), rows(&old), "seed {seed}");
+                g.case(seed, &input, &rel_rows(tmp.path(), &new));
                 total += old.len();
             }
             assert!(total > 200, "vacuous fixtures: {total}");
+            if crawl_goldens_apply(true) {
+                g.finish();
+            }
         }
 
         /// The path-first step is only as right as the scan root: from a
@@ -2345,6 +2379,10 @@ mod tests {
         /// path-rescue arms included.
         #[tokio::test]
         async fn misrooted_repos_match_the_content_first_scan() {
+            let mut g = Golden::new(
+                "crawl_maven_misrooted",
+                "One seeded ~/.m2 repository, crawled from a misplaced root.",
+            );
             let mut total = 0;
             for seed in 0..64u64 {
                 let tmp = tempfile::tempdir().unwrap();
@@ -2358,6 +2396,7 @@ mod tests {
                     &mut perms,
                     true,
                 );
+                let input = (tree_listing(tmp.path()), perms.planned(tmp.path()));
                 perms.apply();
                 let mut misroots = vec![tmp.path().to_path_buf()];
                 misroots.extend(
@@ -2375,14 +2414,23 @@ mod tests {
                     let new = MavenCrawler::new().crawl_all(&options).await;
                     let old = super::super::oracle::crawl_all_content_first(&options).await;
                     assert_eq!(rows(&new), rows(&old), "seed {seed}, {}", misroot.display());
+                    g.case(
+                        format!("{seed}/{}", rel(tmp.path(), &misroot)),
+                        &input,
+                        &rel_rows(tmp.path(), &new),
+                    );
                     total += old.len();
                 }
             }
             assert!(total > 400, "vacuous fixtures: {total}");
+            if crawl_goldens_apply(true) {
+                g.finish();
+            }
         }
 
         #[tokio::test]
         async fn randomized_repos_match_the_serial_oracle() {
+            let mut g = Golden::new("crawl_maven_repos", "One seeded ~/.m2 repository, crawled.");
             let mut total = 0;
             for seed in 0..64u64 {
                 let tmp = tempfile::tempdir().unwrap();
@@ -2390,6 +2438,7 @@ mod tests {
                 let mut rng = Rng::new(seed);
                 let root = tmp.path().join("repository");
                 repo(&mut rng, &root, &tmp.path().join("outside"), &mut perms);
+                let input = (tree_listing(tmp.path()), perms.planned(tmp.path()));
                 perms.apply();
                 let options = CrawlerOptions {
                     cwd: tmp.path().to_path_buf(),
@@ -2399,9 +2448,13 @@ mod tests {
                 let new = MavenCrawler::new().crawl_all(&options).await;
                 let old = LegacyMavenCrawler::crawl_all(&options).await;
                 assert_eq!(rows(&new), rows(&old), "seed {seed}");
+                g.case(seed, &input, &rel_rows(tmp.path(), &new));
                 total += old.len();
             }
             assert!(total > 200, "vacuous fixtures: {total}");
+            if crawl_goldens_apply(true) {
+                g.finish();
+            }
         }
     }
 }
diff --git a/crates/socket-patch-core/src/crawlers/maven_pom_equivalence_tests.rs b/crates/socket-patch-core/src/crawlers/maven_pom_equivalence_tests.rs
index 3eb33b61a..1e72dc5b2 100644
--- a/crates/socket-patch-core/src/crawlers/maven_pom_equivalence_tests.rs
+++ b/crates/socket-patch-core/src/crawlers/maven_pom_equivalence_tests.rs
@@ -363,21 +363,30 @@ fn synth_pom(rng: &mut Rng) -> String {
 
 #[test]
 fn parser_matches_reference_on_random_poms() {
+    let mut g = crate::golden::Golden::new(
+        "maven_pom_random",
+        "One seeded POM fragment soup, parsed for its coordinates.",
+    )
+    .chunked(100);
     let mut rng = Rng(0xA076_1D64_78BD_642F);
     for case in 0..20_000 {
         let pom = synth_pom(&mut rng);
-        assert_eq!(
-            parse_pom_group_artifact_version(&pom),
-            reference_parse_pom(&pom),
-            "case {case}: {pom:?}"
-        );
+        let got = parse_pom_group_artifact_version(&pom);
+        assert_eq!(got, reference_parse_pom(&pom), "case {case}: {pom:?}");
+        g.next(&pom, &got);
     }
+    g.finish();
 }
 
 /// Well-formed project poms with the coordinates placed before, between and
 /// after the noisy sections — the shapes the early exit stops on.
 #[test]
 fn parser_matches_reference_on_project_shaped_poms() {
+    let mut g = crate::golden::Golden::new(
+        "maven_pom_project",
+        "One seeded project-shaped POM, parsed for its coordinates.",
+    )
+    .chunked(25);
     let mut rng = Rng(0xE703_7ED1_A0B4_28DB);
     let mut resolved = 0;
     for case in 0..5_000 {
@@ -407,6 +416,8 @@ fn parser_matches_reference_on_project_shaped_poms() {
             want,
             "case {case}: {pom:?}"
         );
+        g.next(&pom, &want);
     }
     assert!(resolved > 1_000, "the corpus exercises the resolving path");
+    g.finish();
 }
diff --git a/crates/socket-patch-core/src/crawlers/mod.rs b/crates/socket-patch-core/src/crawlers/mod.rs
index b0c257f50..7ce56ed2e 100644
--- a/crates/socket-patch-core/src/crawlers/mod.rs
+++ b/crates/socket-patch-core/src/crawlers/mod.rs
@@ -9,11 +9,11 @@ pub mod maven_crawler;
 mod maven_pom_equivalence_tests;
 pub mod npm_crawler;
 pub mod nuget_crawler;
-#[cfg(test)]
-pub(crate) mod oracle_support;
 pub mod pkg_managers;
 pub mod python_crawler;
 pub mod ruby_crawler;
+#[cfg(test)]
+pub(crate) mod test_tree;
 pub mod types;
 pub mod walk_pool;
 
diff --git a/crates/socket-patch-core/src/crawlers/npm_crawler/oracle.rs b/crates/socket-patch-core/src/crawlers/npm_crawler/oracle.rs
index d71a02127..414e5fa61 100644
--- a/crates/socket-patch-core/src/crawlers/npm_crawler/oracle.rs
+++ b/crates/socket-patch-core/src/crawlers/npm_crawler/oracle.rs
@@ -1467,6 +1467,14 @@ mod tests {
     }
 
     async fn assert_equivalent(root: &Path, label: &str) {
+        let base = root.parent().unwrap();
+        let rel = |p: &Path| crate::crawlers::test_tree::rel(base, p);
+        let rel_rows = |pkgs: &[CrawledPackage]| crate::crawlers::test_tree::rel_rows(base, pkgs);
+        let rel_pairs = |v: &[(String, PathBuf)]| -> Vec<(String, String)> {
+            v.iter().map(|(k, p)| (k.clone(), rel(p))).collect()
+        };
+        let input = crate::crawlers::test_tree::tree_listing(base);
+        let mut per_nm = Vec::new();
         let options = CrawlerOptions {
             cwd: root.to_path_buf(),
             global: false,
@@ -1520,11 +1528,33 @@ mod tests {
                 new_nested, old_nested,
                 "{label}: nested store entries differ"
             );
+            let found: BTreeMap<String, Vec<_>> = new_found
+                .iter()
+                .map(|(k, v)| (k.clone(), rel_rows(v)))
+                .collect();
+            let vlt: Vec<(String, String)> = NpmCrawler::list_vlt_store_entries(&vlt)
+                .await
+                .iter()
+                .map(|(k, p)| (k.to_string_lossy().into_owned(), rel(p)))
+                .collect();
+            per_nm.push((
+                rel(nm),
+                found,
+                rel_pairs(&NpmCrawler::list_pnpm_store_entries(&store).await),
+                vlt,
+                rel_pairs(&new_nested),
+            ));
         }
+        let paths: Vec<String> = new_paths.iter().map(|p| rel(p)).collect();
+        crate::golden::record(&input, &(paths, rel_rows(&new_pkgs), per_nm));
     }
 
     #[tokio::test(flavor = "multi_thread")]
     async fn randomized_trees_match_the_sequential_oracle() {
+        let sweep = crate::golden::Sweep::start(
+            "crawl_npm_trees",
+            "One seeded project tree: node_modules roots, crawl_all, find_by_purls and store listings.",
+        );
         let mut nonempty = 0;
         for seed in 0..64u64 {
             let tmp = tempfile::tempdir().unwrap();
@@ -1548,6 +1578,9 @@ mod tests {
         // The generator must actually produce packages most of the time,
         // or the comparison above is vacuous.
         assert!(nonempty > 32, "only {nonempty} non-empty trees");
+        if crate::crawlers::test_tree::crawl_goldens_apply(true) {
+            sweep.finish();
+        }
     }
 
     /// A store entry whose own child's package.json disagrees with the
@@ -1596,7 +1629,14 @@ mod tests {
             "7.7.7",
         );
 
+        let sweep = crate::golden::Sweep::start(
+            "crawl_npm_foreign_identity",
+            "A pnpm store entry whose child names a foreign identity.",
+        );
         assert_equivalent(&root, "foreign identity").await;
+        if crate::crawlers::test_tree::crawl_goldens_apply(false) {
+            sweep.finish();
+        }
 
         let options = CrawlerOptions {
             cwd: root.clone(),
@@ -1634,6 +1674,10 @@ mod tests {
     #[tokio::test]
     async fn walk_without_a_pool_matches_the_sequential_oracle() {
         let _off = crate::crawlers::walk_pool::test_hooks::DisablePool::new();
+        let sweep = crate::golden::Sweep::start(
+            "crawl_npm_no_pool",
+            "One seeded project tree, walked with no walk pool.",
+        );
         for seed in 0..16u64 {
             let tmp = tempfile::tempdir().unwrap();
             let mut guard = PermGuard(Vec::new());
@@ -1644,6 +1688,9 @@ mod tests {
             assert_equivalent(&root, &format!("no pool, seed {seed}")).await;
             drop(guard);
         }
+        if crate::crawlers::test_tree::crawl_goldens_apply(true) {
+            sweep.finish();
+        }
     }
 
     /// Hand-built tree with one of every tricky shape (so each is covered
@@ -1807,7 +1854,14 @@ mod tests {
             tmp_guard = PermGuard(Vec::new());
         }
 
+        let sweep = crate::golden::Sweep::start(
+            "crawl_npm_kitchen_sink",
+            "A hand-built project tree with one of every tricky shape.",
+        );
         assert_equivalent(&root, "kitchen sink").await;
+        if crate::crawlers::test_tree::crawl_goldens_apply(true) {
+            sweep.finish();
+        }
 
         let options = CrawlerOptions {
             cwd: root.clone(),
diff --git a/crates/socket-patch-core/src/crawlers/nuget_crawler.rs b/crates/socket-patch-core/src/crawlers/nuget_crawler.rs
index 582277309..7293a9c9e 100644
--- a/crates/socket-patch-core/src/crawlers/nuget_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/nuget_crawler.rs
@@ -1294,9 +1294,12 @@ mod tests {
     mod equivalence {
         use super::super::oracle::LegacyNuGetCrawler;
         use super::*;
-        use crate::crawlers::oracle_support::{
-            map_rows, mkdir, rows, symlink, write, PermGuard, Rng,
+        use crate::crawlers::test_tree::{
+            crawl_goldens_apply, map_rows, mkdir, rel_map_rows, rel_rows, rows, symlink,
+            tree_listing, write, PermGuard,
         };
+        use crate::golden::Golden;
+        use crate::test_rng::Rng;
 
         const IDS: &[&str] = &["Newtonsoft.Json", "xunit", "System.Text.Json", "Dup", "dup"];
         const VERSIONS: &[&str] = &["13.0.3", "2.0.0-RC1", "8.0.0", "1.0.0"];
@@ -1434,6 +1437,18 @@ mod tests {
             let old = LegacyNuGetCrawler::find_by_purls(&root, &purls).await;
             assert_eq!(map_rows(&new), map_rows(&old));
             assert_eq!(new.len(), 2, "{new:?}");
+            let mut g = Golden::new(
+                "crawl_nuget_legacy_fallback",
+                "A legacy packages/ root probed by case-variant PURLs.",
+            );
+            g.case(
+                0,
+                &tree_listing(tmp.path()),
+                &rel_map_rows(tmp.path(), &new),
+            );
+            if crawl_goldens_apply(false) {
+                g.finish();
+            }
             for purl in [
                 "pkg:nuget/NEWTONSOFT.JSON@13.0.3",
                 "pkg:nuget/SeriLog@2.12.0",
@@ -1477,12 +1492,17 @@ mod tests {
         #[tokio::test]
         async fn randomized_package_dirs_match_the_async_oracle() {
             let (mut crawled, mut found) = (0, 0);
+            let mut g = Golden::new(
+                "crawl_nuget_packages",
+                "One seeded NuGet packages root: crawl_all, then find_by_purls.",
+            );
             for seed in 0..64u64 {
                 let tmp = tempfile::tempdir().unwrap();
                 let mut perms = PermGuard::default();
                 let mut rng = Rng::new(seed);
                 let root = tmp.path().join("packages");
                 tree(&mut rng, &root, &tmp.path().join("outside"), &mut perms);
+                let input = (tree_listing(tmp.path()), perms.planned(tmp.path()));
                 perms.apply();
                 let options = CrawlerOptions {
                     cwd: tmp.path().to_path_buf(),
@@ -1504,6 +1524,14 @@ mod tests {
                     map_rows(&old_found),
                     "seed {seed}: find_by_purls"
                 );
+                g.case(
+                    seed,
+                    &(input, &purls),
+                    &(
+                        rel_rows(tmp.path(), &new),
+                        rel_map_rows(tmp.path(), &new_found),
+                    ),
+                );
                 crawled += old.len();
                 found += old_found.len();
             }
@@ -1511,6 +1539,9 @@ mod tests {
                 crawled > 100 && found > 100,
                 "vacuous fixtures: {crawled}/{found}"
             );
+            if crawl_goldens_apply(true) {
+                g.finish();
+            }
         }
     }
 }
diff --git a/crates/socket-patch-core/src/crawlers/python_crawler.rs b/crates/socket-patch-core/src/crawlers/python_crawler.rs
index 03814ab23..e0406026c 100644
--- a/crates/socket-patch-core/src/crawlers/python_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/python_crawler.rs
@@ -2737,9 +2737,12 @@ mod tests {
     mod equivalence {
         use super::super::oracle::{self, LegacyPythonCrawler};
         use super::*;
-        use crate::crawlers::oracle_support::{
-            fifo, map_rows, mkdir, rows, symlink, write, write_bytes, PermGuard, Rng,
+        use crate::crawlers::test_tree::{
+            crawl_goldens_apply, fifo, map_rows, mkdir, rel_map_rows, rel_rows, rows, symlink,
+            tree_listing, write, write_bytes, PermGuard,
         };
+        use crate::golden::Golden;
+        use crate::test_rng::Rng;
 
         const NAMES: &[&str] = &["requests", "Flask_Cors", "zope.interface", "dup", "Dup"];
         const VERSIONS: &[&str] = &["1.0", "2.31.0", "1.0+local", "3.0a1"];
@@ -2785,16 +2788,22 @@ mod tests {
         #[tokio::test]
         async fn randomized_site_packages_match_the_async_oracle() {
             let (mut crawled, mut found) = (0, 0);
+            let mut g = Golden::new(
+                "crawl_python_site_packages",
+                "One seeded site-packages: the dist-info listing, crawl_all, find_by_purls and find_each_by_purl.",
+            );
             for seed in 0..64u64 {
                 let tmp = tempfile::tempdir().unwrap();
                 let mut perms = PermGuard::default();
                 let mut rng = Rng::new(seed);
                 let root = tmp.path().join("site-packages");
                 site(&mut rng, &root, &tmp.path().join("outside"), &mut perms);
+                let input = (tree_listing(tmp.path()), perms.planned(tmp.path()));
                 perms.apply();
 
+                let listing = list_dist_info_packages(&root).await;
                 assert_eq!(
-                    list_dist_info_packages(&root).await,
+                    listing,
                     oracle::list_dist_info_packages(&root).await,
                     "seed {seed}: listing"
                 );
@@ -2830,6 +2839,23 @@ mod tests {
                         "seed {seed}: find_each_by_purl {purl}"
                     );
                 }
+                let each_rows: Vec<_> = each
+                    .iter()
+                    .map(|p| {
+                        p.as_ref()
+                            .map(|p| rel_rows(tmp.path(), std::slice::from_ref(p)))
+                    })
+                    .collect();
+                g.case(
+                    seed,
+                    &input,
+                    &(
+                        &listing,
+                        rel_rows(tmp.path(), &new),
+                        rel_map_rows(tmp.path(), &found_new),
+                        each_rows,
+                    ),
+                );
                 crawled += old.len();
                 found += found_new.len();
             }
@@ -2837,6 +2863,9 @@ mod tests {
                 crawled > 100 && found > 100,
                 "vacuous fixtures: {crawled}/{found}"
             );
+            if crawl_goldens_apply(true) {
+                g.finish();
+            }
         }
     }
 
diff --git a/crates/socket-patch-core/src/crawlers/ruby_crawler.rs b/crates/socket-patch-core/src/crawlers/ruby_crawler.rs
index 8c2a1744e..9ab81569f 100644
--- a/crates/socket-patch-core/src/crawlers/ruby_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/ruby_crawler.rs
@@ -2815,7 +2815,8 @@ mod tests {
 
     #[tokio::test]
     async fn find_each_by_purl_matches_per_purl_find_by_purls() {
-        use crate::crawlers::oracle_support::{mkdir, symlink, write, PermGuard, Rng};
+        use crate::crawlers::test_tree::{mkdir, symlink, write, PermGuard};
+        use crate::test_rng::Rng;
 
         const GEMS: &[&str] = &["rails", "nokogiri", "rack", "rails-html"];
         const VERSIONS: &[&str] = &["7.1.0", "1.16.5", "3.0.0"];
diff --git a/crates/socket-patch-core/src/crawlers/oracle_support.rs b/crates/socket-patch-core/src/crawlers/test_tree.rs
similarity index 53%
rename from crates/socket-patch-core/src/crawlers/oracle_support.rs
rename to crates/socket-patch-core/src/crawlers/test_tree.rs
index bc62a0256..424a1dc24 100644
--- a/crates/socket-patch-core/src/crawlers/oracle_support.rs
+++ b/crates/socket-patch-core/src/crawlers/test_tree.rs
@@ -1,42 +1,11 @@
-//! Test-only scaffolding shared by the crawler equivalence tests: each
-//! crawler whose async walk moved onto the blocking pool keeps its previous
-//! implementation as a `#[cfg(test)]` oracle, and randomized fixture trees
-//! built with these helpers assert both produce identical output.
+//! Test-only scaffolding for the randomized crawler sweeps: generators build
+//! fixture trees with these helpers, and the crawl output is pinned by a
+//! golden snapshot (see [`crate::golden`]).
 
 use std::path::{Path, PathBuf};
 
 use super::types::CrawledPackage;
 
-/// Deterministic xorshift64* generator (no `rand` dependency).
-pub(crate) struct Rng(u64);
-
-impl Rng {
-    pub(crate) fn new(seed: u64) -> Self {
-        Self(seed.wrapping_mul(0x9E37_79B9_7F4A_7C15) | 1)
-    }
-
-    pub(crate) fn next(&mut self) -> u64 {
-        let mut x = self.0;
-        x ^= x >> 12;
-        x ^= x << 25;
-        x ^= x >> 27;
-        self.0 = x;
-        x.wrapping_mul(0x2545_F491_4F6C_DD1D)
-    }
-
-    pub(crate) fn below(&mut self, n: usize) -> usize {
-        (self.next() % n as u64) as usize
-    }
-
-    pub(crate) fn chance(&mut self, pct: usize) -> bool {
-        self.below(100) < pct
-    }
-
-    pub(crate) fn pick<'a>(&mut self, items: &[&'a str]) -> &'a str {
-        items[self.below(items.len())]
-    }
-}
-
 /// Restores permissions a generator stripped before the tempdir is removed
 /// (declare it AFTER the tempdir so it drops first). Only Unix strips
 /// permissions; everywhere else the plan is recorded and ignored.
@@ -50,6 +19,11 @@ impl PermGuard {
         self.0.push((dir.to_path_buf(), mode));
     }
 
+    /// The queued `(path relative to base, mode)` pairs, for a sweep's input.
+    pub(crate) fn planned(&self, base: &Path) -> Vec<(String, u32)> {
+        self.0.iter().map(|(p, m)| (rel(base, p), *m)).collect()
+    }
+
     /// Apply every queued mode, deepest paths first.
     pub(crate) fn apply(&mut self) {
         let mut plan = std::mem::take(&mut self.0);
@@ -169,3 +143,98 @@ pub(crate) fn map_rows(
         })
         .collect()
 }
+
+/// A crawled package as a row with its path relative to `base` (the sweep's
+/// tempdir), so the row is the same on every run.
+pub(crate) type RelRow = (String, String, Option<String>, String, String);
+
+pub(crate) fn rel(base: &Path, path: &Path) -> String {
+    match path.strip_prefix(base) {
+        Ok(rest) => rest.to_string_lossy().replace('\\', "/"),
+        Err(_) => format!("<abs>{}", path.display()),
+    }
+}
+
+pub(crate) fn rel_rows(base: &Path, pkgs: &[CrawledPackage]) -> Vec<RelRow> {
+    pkgs.iter().map(|p| rel_row(base, p)).collect()
+}
+
+fn rel_row(base: &Path, p: &CrawledPackage) -> RelRow {
+    (
+        p.name.clone(),
+        p.version.clone(),
+        p.namespace.clone(),
+        p.purl.clone(),
+        rel(base, &p.path),
+    )
+}
+
+/// A `find_by_purls` map as sorted [`RelRow`]s.
+pub(crate) fn rel_map_rows(
+    base: &Path,
+    map: &std::collections::HashMap<String, CrawledPackage>,
+) -> std::collections::BTreeMap<String, RelRow> {
+    map.iter()
+        .map(|(k, p)| (k.clone(), rel_row(base, p)))
+        .collect()
+}
+
+/// Every entry under `root` — path, kind, mode, file bytes, link target —
+/// as the input a sweep case records, so generator drift shows up as such.
+pub(crate) fn tree_listing(root: &Path) -> Vec<(String, String)> {
+    fn walk(base: &Path, dir: &Path, out: &mut Vec<(String, String)>) {
+        let Ok(entries) = std::fs::read_dir(dir) else {
+            return;
+        };
+        for entry in entries.flatten() {
+            let path = entry.path();
+            let Ok(meta) = std::fs::symlink_metadata(&path) else {
+                continue;
+            };
+            #[cfg(unix)]
+            let mode = {
+                use std::os::unix::fs::PermissionsExt as _;
+                meta.permissions().mode() & 0o7777
+            };
+            #[cfg(not(unix))]
+            let mode = 0;
+            let what = if meta.file_type().is_symlink() {
+                let target = std::fs::read_link(&path).unwrap_or_default();
+                format!("link {mode:o} {}", rel(base, &target))
+            } else if meta.is_dir() {
+                format!("dir {mode:o}")
+            } else if meta.is_file() {
+                // Generators may write the tempdir's own path into a file.
+                let text = String::from_utf8_lossy(&std::fs::read(&path).unwrap_or_default())
+                    .replace(&*base.to_string_lossy(), "<base>");
+                format!("file {mode:o} {}", crate::golden::digest(&text))
+            } else {
+                format!("other {mode:o}")
+            };
+            out.push((rel(base, &path), what));
+            if meta.is_dir() && !meta.file_type().is_symlink() {
+                walk(base, &path, out);
+            }
+        }
+    }
+    let mut out = Vec::new();
+    walk(root, root, &mut out);
+    out.sort();
+    out
+}
+
+/// Whether this run can replay a crawler golden: they were blessed on Linux
+/// (case-sensitive, symlinks), and a sweep that strips permissions as a
+/// non-root user, where the stripped modes are honored.
+pub(crate) fn crawl_goldens_apply(strips_permissions: bool) -> bool {
+    #[cfg(target_os = "linux")]
+    {
+        // SAFETY: geteuid has no preconditions.
+        !strips_permissions || unsafe { libc::geteuid() != 0 }
+    }
+    #[cfg(not(target_os = "linux"))]
+    {
+        let _ = strips_permissions;
+        false
+    }
+}
diff --git a/crates/socket-patch-core/src/golden.rs b/crates/socket-patch-core/src/golden.rs
new file mode 100644
index 000000000..c40efe5a6
--- /dev/null
+++ b/crates/socket-patch-core/src/golden.rs
@@ -0,0 +1,209 @@
+//! Golden snapshots of the randomized equivalence sweeps.
+//!
+//! #257 moved the crawlers onto the blocking pool and made the hosted
+//! rewriters single-pass, and kept each previous implementation as a
+//! test-only oracle that the new one had to match on thousands of generated
+//! inputs. The oracles are gone; what they proved is kept here instead. Each
+//! sweep still generates the same inputs from the same seeds, and its golden
+//! file pins, per case, a digest of the input and a digest of the output the
+//! oracle and the production code agreed on when the file was blessed. A
+//! changed output digest is a behavior change on that case; a changed input
+//! digest means the generator itself drifted.
+//!
+//! Bless only for an intended behavior change:
+//! `SOCKET_PATCH_BLESS_GOLDEN=1 cargo test -p socket-patch-core <test>`
+//! rewrites the file (review its diff like any other golden).
+
+use std::fmt::Write as _;
+use std::path::PathBuf;
+
+use serde::Serialize;
+use sha2::{Digest as _, Sha256};
+
+/// One sweep's recorded cases, compared against (or blessed into)
+/// `tests/equivalence/<name>.golden` by [`Golden::finish`].
+pub(crate) struct Golden {
+    name: &'static str,
+    about: &'static str,
+    lines: Vec<String>,
+    /// Cases folded into one line, so a 20k-case sweep stays a small file.
+    chunk: usize,
+    cases: usize,
+    pending: Vec<(String, String)>,
+}
+
+/// A short stable digest of `value`'s JSON encoding.
+pub(crate) fn digest<T: Serialize + ?Sized>(value: &T) -> String {
+    let json = serde_json::to_vec(value).expect("golden values serialize");
+    let hash = Sha256::digest(&json);
+    hash[..8].iter().fold(String::new(), |mut s, b| {
+        let _ = write!(s, "{b:02x}");
+        s
+    })
+}
+
+thread_local! {
+    static ACTIVE: std::cell::RefCell<Option<Golden>> = const { std::cell::RefCell::new(None) };
+}
+
+/// A [`Golden`] the sweep's shared helpers record into through [`record`],
+/// for the length of one test.
+pub(crate) struct Sweep;
+
+impl Sweep {
+    pub(crate) fn start(name: &'static str, about: &'static str) -> Self {
+        Self::with(Golden::new(name, about))
+    }
+
+    pub(crate) fn with(golden: Golden) -> Self {
+        ACTIVE.with(|a| *a.borrow_mut() = Some(golden));
+        Sweep
+    }
+
+    pub(crate) fn finish(self) {
+        let golden = ACTIVE
+            .with(|a| a.borrow_mut().take())
+            .expect("sweep started");
+        golden.finish();
+    }
+}
+
+impl Drop for Sweep {
+    fn drop(&mut self) {
+        ACTIVE.with(|a| a.borrow_mut().take());
+    }
+}
+
+/// Record one case into the running [`Sweep`], if any.
+pub(crate) fn record<I, O>(input: &I, output: &O)
+where
+    I: Serialize + ?Sized,
+    O: Serialize + ?Sized,
+{
+    ACTIVE.with(|a| {
+        if let Some(golden) = a.borrow_mut().as_mut() {
+            golden.next(input, output);
+        }
+    });
+}
+
+impl Golden {
+    /// `about` becomes the file's header: what one case is.
+    pub(crate) fn new(name: &'static str, about: &'static str) -> Self {
+        Self {
+            name,
+            about,
+            lines: Vec::new(),
+            chunk: 1,
+            cases: 0,
+            pending: Vec::new(),
+        }
+    }
+
+    /// Fold every `chunk` consecutive cases into one golden line.
+    pub(crate) fn chunked(mut self, chunk: usize) -> Self {
+        self.chunk = chunk.max(1);
+        self
+    }
+
+    /// Record one case under `key` (unique within the sweep).
+    pub(crate) fn case<I, O>(&mut self, key: impl std::fmt::Display, input: &I, output: &O)
+    where
+        I: Serialize + ?Sized,
+        O: Serialize + ?Sized,
+    {
+        self.cases += 1;
+        if self.chunk == 1 {
+            self.lines
+                .push(format!("{key} {} {}", digest(input), digest(output)));
+            return;
+        }
+        self.pending.push((digest(input), digest(output)));
+        if self.pending.len() == self.chunk {
+            self.flush();
+        }
+    }
+
+    fn flush(&mut self) {
+        if self.pending.is_empty() {
+            return;
+        }
+        let first = self.cases - self.pending.len();
+        let (inputs, outputs): (Vec<_>, Vec<_>) =
+            std::mem::take(&mut self.pending).into_iter().unzip();
+        self.lines.push(format!(
+            "{first}-{} {} {}",
+            self.cases - 1,
+            digest(&inputs),
+            digest(&outputs)
+        ));
+    }
+
+    /// [`Golden::case`] keyed by its position in the sweep.
+    pub(crate) fn next<I, O>(&mut self, input: &I, output: &O)
+    where
+        I: Serialize + ?Sized,
+        O: Serialize + ?Sized,
+    {
+        self.case(self.cases, input, output);
+    }
+
+    fn path(&self) -> PathBuf {
+        PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+            .join("tests/equivalence")
+            .join(format!("{}.golden", self.name))
+    }
+
+    /// Compare every recorded case with the golden file, naming the first
+    /// that differs, or rewrite the file under `SOCKET_PATCH_BLESS_GOLDEN`.
+    pub(crate) fn finish(mut self) {
+        self.flush();
+        let path = self.path();
+        if std::env::var_os("SOCKET_PATCH_BLESS_GOLDEN").is_some() {
+            let mut text = String::new();
+            for line in self.about.lines() {
+                let _ = writeln!(text, "# {line}");
+            }
+            text.push_str("# <case> <input digest> <output digest>\n");
+            for line in &self.lines {
+                text.push_str(line);
+                text.push('\n');
+            }
+            std::fs::create_dir_all(path.parent().unwrap()).unwrap();
+            std::fs::write(&path, text).unwrap();
+            return;
+        }
+        let text = std::fs::read_to_string(&path)
+            .unwrap_or_else(|e| panic!("read {}: {e}", path.display()));
+        let want: Vec<&str> = text
+            .lines()
+            .map(|l| l.trim_end_matches('\r'))
+            .filter(|l| !l.is_empty() && !l.starts_with('#'))
+            .collect();
+        for (got, want) in self.lines.iter().zip(&want) {
+            let (got_key, got_rest) = got.split_once(' ').unwrap();
+            let (want_key, want_rest) = want.split_once(' ').unwrap_or((want, ""));
+            assert_eq!(got_key, want_key, "{}: case order changed", self.name);
+            if got_rest != want_rest {
+                let (got_in, got_out) = got_rest.split_once(' ').unwrap();
+                let (want_in, want_out) = want_rest.split_once(' ').unwrap_or((want_rest, ""));
+                assert_eq!(
+                    got_in, want_in,
+                    "{}: case {got_key}: the generated input changed (generator drift)",
+                    self.name
+                );
+                assert_eq!(
+                    got_out, want_out,
+                    "{}: case {got_key}: output differs from the blessed oracle output",
+                    self.name
+                );
+            }
+        }
+        assert_eq!(
+            self.lines.len(),
+            want.len(),
+            "{}: case count changed",
+            self.name
+        );
+    }
+}
diff --git a/crates/socket-patch-core/src/lib.rs b/crates/socket-patch-core/src/lib.rs
index 196beafed..a55bb77db 100644
--- a/crates/socket-patch-core/src/lib.rs
+++ b/crates/socket-patch-core/src/lib.rs
@@ -13,3 +13,8 @@ pub mod utils;
 pub mod vendor;
 pub mod vex;
 
+
+#[cfg(test)]
+mod golden;
+#[cfg(test)]
+mod test_rng;
diff --git a/crates/socket-patch-core/src/patch/redirect/cargo_lock_equivalence_tests.rs b/crates/socket-patch-core/src/patch/redirect/cargo_lock_equivalence_tests.rs
index 570ee7621..6a207193d 100644
--- a/crates/socket-patch-core/src/patch/redirect/cargo_lock_equivalence_tests.rs
+++ b/crates/socket-patch-core/src/patch/redirect/cargo_lock_equivalence_tests.rs
@@ -17,6 +17,7 @@ use serde_json::Value;
 
 use crate::formats::cargo::hosted::{CargoLockPlan, CARGO_LOCK_REFERENCE_KIND};
 use crate::formats::cargo::CargoLock;
+use crate::golden::Golden;
 use crate::patch::redirect::FileEdit;
 
 // ── the oracle: the previous line-grammar planner, verbatim ──
@@ -399,10 +400,18 @@ fn shape(plan: &CargoLockPlan) -> (String, Option<String>, Vec<FileEdit>) {
     }
 }
 
-fn assert_same(lock: &str, name: &str, version: &str, cksum: &str, what: &str) -> Option<String> {
+fn assert_same(
+    g: &mut Golden,
+    lock: &str,
+    name: &str,
+    version: &str,
+    cksum: &str,
+    what: &str,
+) -> Option<String> {
     let old = plan_cargo_lock(lock, name, version, INDEX, cksum);
     let new = plan_new(lock, name, version, cksum);
     let (old, new) = (shape(&old), shape(&new));
+    g.next(&(lock, name, version, cksum), &new);
     // The one shape the line grammar cannot read and cargo can: the block's
     // canonical header without the newline after `version` (a final block
     // at EOF with no trailing newline). The span planner finds it.
@@ -432,31 +441,44 @@ fn targets(lock: &str) -> Vec<(String, String)> {
 
 /// Every package of `lock`, planned by both, then a second package planned
 /// over the first's output and a re-run of the first (the no-op path).
-fn assert_lock(lock: &str, rng: &mut Rng, what: &str) {
+fn assert_lock(g: &mut Golden, lock: &str, rng: &mut Rng, what: &str) {
     let all = targets(lock);
     for (name, version) in &all {
         let cksum = format!("{:016x}{:016x}", rng.next(), rng.next());
-        let Some(once) = assert_same(lock, name, version, &cksum, what) else {
+        let Some(once) = assert_same(g, lock, name, version, &cksum, what) else {
             continue;
         };
-        assert_same(&once, name, version, &cksum, &format!("{what} re-run"));
+        assert_same(g, &once, name, version, &cksum, &format!("{what} re-run"));
         if let Some((other, other_version)) = all.get(rng.below(all.len())) {
-            assert_same(&once, other, other_version, "00ff", &format!("{what} then another"));
+            assert_same(
+                g,
+                &once,
+                other,
+                other_version,
+                "00ff",
+                &format!("{what} then another"),
+            );
         }
     }
     // An absent package, on both sides.
-    assert_same(lock, "absent-crate", "9.9.9", "00", what);
+    assert_same(g, lock, "absent-crate", "9.9.9", "00", what);
 }
 
 #[test]
 fn span_splice_matches_the_line_grammar_on_random_locks() {
+    let mut g = Golden::new(
+        "cargo_lock_random",
+        "One package of a seeded Cargo.lock, planned for the hosted index.",
+    )
+    .chunked(20);
     let mut rng = Rng(0x9E37_79B9_7F4A_7C15);
     for case in 0..300 {
         let v1 = rng.chance(50);
         let blocks = rng.below(12);
         let lock = synth_lock(&mut rng, blocks, v1);
-        assert_lock(&lock, &mut rng, &format!("case {case} (v1={v1})"));
+        assert_lock(&mut g, &lock, &mut rng, &format!("case {case} (v1={v1})"));
     }
+    g.finish();
 }
 
 /// Hand-written shapes the generator does not produce: multi-source twins
@@ -475,6 +497,10 @@ fn span_splice_matches_the_line_grammar_on_hand_written_locks() {
     let sourceless_v1 = "[[package]]\nname = \"s\"\nversion = \"1.0.0\"\n\n[metadata]\n\"checksum s 1.0.0 (registry+x)\" = \"ee\"\n".to_string();
     let source_at_eof = format!("[[package]]\nname = \"e\"\nversion = \"1.0.0\"\nsource = \"{crates_io}\"");
     let bare = "version = 3\n\n[[package]]\nname = \"b\"\nversion = \"1.0.0\"\n\n[[package]]\nname = \"c\"\nversion = \"1.0.0\"\n".to_string();
+    let mut g = Golden::new(
+        "cargo_lock_hand_written",
+        "One package of a hand-written Cargo.lock shape, planned for the hosted index.",
+    );
     let mut rng = Rng(0xD1B5_4A32_D192_ED03);
     for (what, lock) in [
         ("twins, one ours", twins_ours),
@@ -484,20 +510,33 @@ fn span_splice_matches_the_line_grammar_on_hand_written_locks() {
         ("source at EOF", source_at_eof),
         ("bare blocks", bare),
     ] {
-        assert_lock(&lock, &mut rng, what);
+        assert_lock(&mut g, &lock, &mut rng, what);
     }
+    g.finish();
 }
 
 /// The large-lock shape: ≥1k blocks, both formats, a sample of targets.
 #[test]
 fn span_splice_matches_the_line_grammar_on_a_large_lock() {
+    let mut g = Golden::new(
+        "cargo_lock_large",
+        "One sampled package of a seeded ≥1k-block Cargo.lock, planned for the hosted index.",
+    );
     let mut rng = Rng(0x2545_F491_4F6C_DD1D);
     for v1 in [false, true] {
         let lock = synth_lock(&mut rng, 1_200, v1);
         let all = targets(&lock);
         assert!(all.len() >= 1_000, "fixture keeps the ≥1k-block shape");
         for (name, version) in all.iter().step_by(97) {
-            assert_same(&lock, name, version, "abcd", &format!("large (v1={v1})"));
+            assert_same(
+                &mut g,
+                &lock,
+                name,
+                version,
+                "abcd",
+                &format!("large (v1={v1})"),
+            );
         }
     }
+    g.finish();
 }
diff --git a/crates/socket-patch-core/src/patch/redirect/composer_equivalence_tests.rs b/crates/socket-patch-core/src/patch/redirect/composer_equivalence_tests.rs
index 187c3c257..164e42921 100644
--- a/crates/socket-patch-core/src/patch/redirect/composer_equivalence_tests.rs
+++ b/crates/socket-patch-core/src/patch/redirect/composer_equivalence_tests.rs
@@ -441,6 +441,11 @@ fn in_place_composer_rewrite_matches_oracle() {
     let mut rewritten = 0;
     let mut edits = 0;
     let mut codes = std::collections::BTreeSet::new();
+    let mut golden = crate::golden::Golden::new(
+        "composer_lock_rewrite",
+        "One seeded composer.lock + overrides; the output covers a re-run over the result.",
+    )
+    .chunked(10);
     for seed in 1..=3000u64 {
         let mut rng = Rng(seed.wrapping_mul(0x9E37_79B9_7F4A_7C15) | 1);
         let pool = 3 + rng.below(12);
@@ -461,7 +466,8 @@ fn in_place_composer_rewrite_matches_oracle() {
         let got = run_both(&files, &overrides, &format!("seed {seed}"));
         let mut rerun = files.clone();
         rerun.extend(got.files.clone());
-        run_both(&rerun, &overrides, &format!("seed {seed} re-run"));
+        let again = run_both(&rerun, &overrides, &format!("seed {seed} re-run"));
+        golden.case(seed, &(&files, &overrides), &(&got, &again));
         rewritten += got.files.len();
         edits += got.edits.len();
         codes.extend(got.warnings.iter().map(|w| w.code.clone()));
@@ -479,6 +485,7 @@ fn in_place_composer_rewrite_matches_oracle() {
     ] {
         assert!(codes.contains(code), "no case reached {code}: {codes:?}");
     }
+    golden.finish();
 }
 
 #[test]
diff --git a/crates/socket-patch-core/src/patch/redirect/golang_equivalence_tests.rs b/crates/socket-patch-core/src/patch/redirect/golang_equivalence_tests.rs
index 7ac73360f..8e9963409 100644
--- a/crates/socket-patch-core/src/patch/redirect/golang_equivalence_tests.rs
+++ b/crates/socket-patch-core/src/patch/redirect/golang_equivalence_tests.rs
@@ -316,6 +316,7 @@ fn assert_same(want: &RewriteResult, got: &RewriteResult, what: &str) {
 }
 
 fn run_both(
+    g: &mut crate::golden::Golden,
     files: &BTreeMap<String, String>,
     overrides: &[DepOverride],
     what: &str,
@@ -325,6 +326,7 @@ fn run_both(
     let mut got = RewriteResult::default();
     rewrite_golang(files, overrides, &mut got);
     assert_same(&want, &got, what);
+    g.next(&(files, overrides), &got);
     got
 }
 
@@ -560,6 +562,11 @@ fn single_walk_golang_rewrite_matches_oracle() {
     let mut edits = 0;
     let mut codes = std::collections::BTreeSet::new();
     let mut kinds = std::collections::BTreeSet::new();
+    let mut g = crate::golden::Golden::new(
+        "golang_rewrite",
+        "One seeded go.mod / go.sum pair + overrides, or the re-run over its output.",
+    )
+    .chunked(20);
     for seed in 1..=3000u64 {
         let mut rng = Rng(seed.wrapping_mul(0x9E37_79B9_7F4A_7C15) | 1);
         let pool = 3 + rng.below(12);
@@ -579,11 +586,11 @@ fn single_walk_golang_rewrite_matches_oracle() {
             let again = overrides[rng.below(overrides.len())].clone();
             overrides.push(again);
         }
-        let got = run_both(&files, &overrides, &format!("seed {seed}"));
+        let got = run_both(&mut g, &files, &overrides, &format!("seed {seed}"));
         // A second pass over the output (the idempotent re-run) must agree too.
         let mut rerun = files.clone();
         rerun.extend(got.files.clone());
-        run_both(&rerun, &overrides, &format!("seed {seed} re-run"));
+        run_both(&mut g, &rerun, &overrides, &format!("seed {seed} re-run"));
         rewritten += got.files.len();
         edits += got.edits.len();
         codes.extend(got.warnings.iter().map(|w| w.code.clone()));
@@ -612,6 +619,7 @@ fn single_walk_golang_rewrite_matches_oracle() {
     ] {
         assert!(kinds.contains(kind), "no case reached {kind}: {kinds:?}");
     }
+    g.finish();
 }
 
 /// Runs the oracle over the benchmark go.mod / go.sum pairs (too
@@ -623,6 +631,7 @@ fn single_walk_golang_rewrite_matches_oracle_on_fixtures() {
         return;
     };
     let root = std::path::PathBuf::from(root);
+    let mut scratch = crate::golden::Golden::new("unused", "");
     for dir in ["go-grafana", "go-cache", "go-k8s"] {
         let read = |name: &str| std::fs::read_to_string(root.join(dir).join(name)).unwrap();
         let go_mod = read("go.mod");
@@ -666,7 +675,12 @@ fn single_walk_golang_rewrite_matches_oracle_on_fixtures() {
             let mut files = BTreeMap::new();
             files.insert("go.mod".to_string(), conv(go_mod.clone()));
             files.insert("go.sum".to_string(), conv(read("go.sum")));
-            let got = run_both(&files, &overrides, &format!("{dir} crlf={crlf}"));
+            let got = run_both(
+                &mut scratch,
+                &files,
+                &overrides,
+                &format!("{dir} crlf={crlf}"),
+            );
             // k8s pins every staging module with a user-authored replace, so
             // there every dep is a refused conflict.
             assert!(
@@ -675,7 +689,12 @@ fn single_walk_golang_rewrite_matches_oracle_on_fixtures() {
             );
             let mut rerun = files.clone();
             rerun.extend(got.files.clone());
-            run_both(&rerun, &overrides, &format!("{dir} crlf={crlf} re-run"));
+            run_both(
+                &mut scratch,
+                &rerun,
+                &overrides,
+                &format!("{dir} crlf={crlf} re-run"),
+            );
         }
     }
 }
diff --git a/crates/socket-patch-core/src/patch/redirect/lock_index_equivalence_tests.rs b/crates/socket-patch-core/src/patch/redirect/lock_index_equivalence_tests.rs
index e343e9d5b..cf997803a 100644
--- a/crates/socket-patch-core/src/patch/redirect/lock_index_equivalence_tests.rs
+++ b/crates/socket-patch-core/src/patch/redirect/lock_index_equivalence_tests.rs
@@ -146,6 +146,13 @@ fn npm_lock(rng: &mut Rng, pool: &mut Vec<(String, String)>) -> String {
 
 #[test]
 fn indexed_npm_lock_rewrite_matches_oracle() {
+    let sweep = crate::golden::Sweep::with(
+        crate::golden::Golden::new(
+            "npm_lock_rewrite",
+            "One seeded package-lock.json / npm-shrinkwrap.json + overrides.",
+        )
+        .chunked(4),
+    );
     let mut edits = 0;
     let mut codes = std::collections::BTreeSet::new();
     for seed in 1..=400u64 {
@@ -160,6 +167,7 @@ fn indexed_npm_lock_rewrite_matches_oracle() {
             let mut got = RewriteResult::default();
             rewrite_one_npm_lock(&text, lockfile, &refs, &mut got);
             assert_same(&want, &got, &format!("seed {seed} {lockfile}"));
+            crate::golden::record(&(&text, lockfile, &deps), &got);
             edits += got.edits.len();
             codes.extend(got.warnings.iter().map(|w| w.code.clone()));
         }
@@ -176,6 +184,7 @@ fn indexed_npm_lock_rewrite_matches_oracle() {
     ] {
         assert!(codes.contains(code), "missing {code}: {codes:?}");
     }
+    sweep.finish();
 }
 
 fn yarn_block(rng: &mut Rng, pool: &mut Vec<(String, String)>, i: usize) -> String {
@@ -223,6 +232,13 @@ fn yarn_block(rng: &mut Rng, pool: &mut Vec<(String, String)>, i: usize) -> Stri
 
 #[test]
 fn indexed_yarn_classic_rewrite_matches_oracle() {
+    let sweep = crate::golden::Sweep::with(
+        crate::golden::Golden::new(
+            "yarn_classic_rewrite",
+            "One seeded yarn.lock (v1) + overrides.",
+        )
+        .chunked(2),
+    );
     let mut edits = 0;
     let mut codes = std::collections::BTreeSet::new();
     for seed in 1..=400u64 {
@@ -248,6 +264,7 @@ fn indexed_yarn_classic_rewrite_matches_oracle() {
         let mut got = RewriteResult::default();
         rewrite_yarn_classic(&files, &deps, &mut got);
         assert_same(&want, &got, &format!("seed {seed}"));
+        crate::golden::record(&(&files, &deps), &got);
         edits += got.edits.len();
         codes.extend(got.warnings.iter().map(|w| w.code.clone()));
     }
@@ -260,6 +277,7 @@ fn indexed_yarn_classic_rewrite_matches_oracle() {
     ] {
         assert!(codes.contains(code), "missing {code}: {codes:?}");
     }
+    sweep.finish();
 }
 
 // ── oracles: the pre-index implementations, verbatim ────────────────────────
diff --git a/crates/socket-patch-core/src/patch/redirect/mod.rs b/crates/socket-patch-core/src/patch/redirect/mod.rs
index 4163755d4..0c5dd7259 100644
--- a/crates/socket-patch-core/src/patch/redirect/mod.rs
+++ b/crates/socket-patch-core/src/patch/redirect/mod.rs
@@ -82,6 +82,7 @@ pub(crate) use hosted_url::{hosted_url_names, hosted_url_version};
 
 /// One ecosystem's integrity hashes (mirrors the TS `PatchArtifactIntegrity`).
 #[derive(Debug, Clone, Default, Deserialize)]
+#[cfg_attr(test, derive(Serialize))]
 #[serde(rename_all = "camelCase")]
 pub struct Integrity {
     pub sha512: Option<String>,
@@ -99,6 +100,7 @@ pub struct Integrity {
 }
 
 #[derive(Debug, Clone, Default, Deserialize)]
+#[cfg_attr(test, derive(Serialize))]
 #[serde(rename_all = "camelCase")]
 pub struct RegistryOverrideIdentifiers {
     pub name: String,
@@ -147,6 +149,7 @@ pub struct RegistryOverrideIdentifiers {
 }
 
 #[derive(Debug, Clone, Deserialize)]
+#[cfg_attr(test, derive(Serialize))]
 #[serde(rename_all = "camelCase")]
 pub struct RegistryOverride {
     pub kind: String,
@@ -156,6 +159,7 @@ pub struct RegistryOverride {
 
 /// One patched dependency to redirect (mirrors the TS `DepOverride`).
 #[derive(Debug, Clone, Deserialize)]
+#[cfg_attr(test, derive(Serialize))]
 #[serde(rename_all = "camelCase")]
 pub struct DepOverride {
     pub ecosystem: String,
@@ -198,6 +202,7 @@ pub struct RewriteWarning {
 }
 
 #[derive(Debug, Default, Clone, PartialEq)]
+#[cfg_attr(test, derive(Serialize))]
 pub struct RewriteResult {
     /// Rewritten file contents keyed by repo-relative path — only CHANGED files.
     pub files: BTreeMap<String, String>,
diff --git a/crates/socket-patch-core/src/patch/redirect/pnpm_equivalence_tests.rs b/crates/socket-patch-core/src/patch/redirect/pnpm_equivalence_tests.rs
index 906427f0d..a5b3d25ac 100644
--- a/crates/socket-patch-core/src/patch/redirect/pnpm_equivalence_tests.rs
+++ b/crates/socket-patch-core/src/patch/redirect/pnpm_equivalence_tests.rs
@@ -16,6 +16,7 @@ fn assert_equivalent(files: &BTreeMap<String, String>, overrides: &[DepOverride]
     let mut got = RewriteResult::default();
     plan_hosted(files, overrides, &mut got);
     assert_same(&want, &got, "pnpm");
+    crate::golden::record(&(files, overrides), &got);
     got
 }
 
@@ -219,6 +220,10 @@ fn packages(n: usize, rng: &mut Rng) -> Vec<Pkg> {
 /// missing-sha512 deps, plus a non-npm override the rewriter must ignore.
 #[test]
 fn indexed_pnpm_rewrite_matches_oracle_on_depscan_sized_lock_set() {
+    let sweep = crate::golden::Sweep::start(
+        "pnpm_depscan_sized",
+        "A depscan-sized seeded pnpm-lock.yaml set + shuffled overrides.",
+    );
     let mut rng = Rng(0x5eed_cafe_f00d_0001);
     let root = packages(4000, &mut rng);
     let nested = packages(1200, &mut rng);
@@ -325,6 +330,7 @@ fn indexed_pnpm_rewrite_matches_oracle_on_depscan_sized_lock_set() {
     ] {
         assert!(codes.contains(&code), "missing {code}: {codes:?}");
     }
+    sweep.finish();
 }
 
 /// Two overrides of the SAME name@version with different artifacts: the
@@ -332,6 +338,10 @@ fn indexed_pnpm_rewrite_matches_oracle_on_depscan_sized_lock_set() {
 /// is the first's `new`), exactly as the per-dep re-parse did.
 #[test]
 fn duplicate_override_sees_the_prior_rewrite() {
+    let sweep = crate::golden::Sweep::start(
+        "pnpm_duplicate_override",
+        "A pnpm lock whose overrides repeat a package.",
+    );
     let p = Pkg {
         name: "left-pad".into(),
         version: "1.3.0".into(),
@@ -355,6 +365,7 @@ fn duplicate_override_sees_the_prior_rewrite() {
     // The same pair with identical artifacts: the second is a no-op.
     let r = assert_equivalent(&files, &[second.clone(), second]);
     assert_eq!(r.edits.len(), 2, "{:#?}", r.edits);
+    sweep.finish();
 }
 
 /// Every peer-suffixed instance gets its own edit, in file order, keyed by
@@ -362,6 +373,10 @@ fn duplicate_override_sees_the_prior_rewrite() {
 /// contexts and a v5 `_` suffix in a second lock.
 #[test]
 fn peer_suffixed_instances_rewrite_in_file_order() {
+    let sweep = crate::golden::Sweep::start(
+        "pnpm_peer_suffixed",
+        "A pnpm lock with peer-suffixed instances of one package.",
+    );
     let lock_v6 = "lockfileVersion: '6.0'\n\npackages:\n\n  '/@s/p@1.0.0(react@18.2.0(scheduler@0.23.2))':\n    resolution: {integrity: sha512-UP==}\n\n  /@s/p@1.0.0:\n    resolution: {integrity: sha512-UP==}\n\n  /@s/p@1.0.0(react@17.0.2):\n    resolution: {integrity: sha512-UP==}\n\n  /@s/p@1.0.01:\n    resolution: {integrity: sha512-OTHER==}\n";
     let lock_v5 = "lockfileVersion: 5.4\n\npackages:\n\n  /@s/p/1.0.0_react@18.2.0:\n    resolution: {integrity: sha512-UP==}\n";
     let files = BTreeMap::from([
@@ -391,6 +406,7 @@ fn peer_suffixed_instances_rewrite_in_file_order() {
         ]
     );
     assert!(r.files["a/pnpm-lock.yaml"].contains("sha512-OTHER=="));
+    sweep.finish();
 }
 
 /// Randomized small lock sets over every flavor (including the refused
@@ -398,6 +414,10 @@ fn peer_suffixed_instances_rewrite_in_file_order() {
 /// residuals and misses all interleave.
 #[test]
 fn indexed_pnpm_rewrite_matches_oracle_on_random_lock_sets() {
+    let sweep = crate::golden::Sweep::start(
+        "pnpm_random",
+        "One seeded pnpm-lock.yaml set (every flavor) + overrides.",
+    );
     let flavors = [
         Flavor::V9,
         Flavor::V6,
@@ -524,6 +544,7 @@ fn indexed_pnpm_rewrite_matches_oracle_on_random_lock_sets() {
             "sweep never reached {want}: {outcomes:?}"
         );
     }
+    sweep.finish();
 }
 
 // ── oracle: the pre-index implementation, verbatim ──────────────────────────
diff --git a/crates/socket-patch-core/src/patch/redirect/python_lock_equivalence_tests.rs b/crates/socket-patch-core/src/patch/redirect/python_lock_equivalence_tests.rs
index f783a6a8c..017bd6555 100644
--- a/crates/socket-patch-core/src/patch/redirect/python_lock_equivalence_tests.rs
+++ b/crates/socket-patch-core/src/patch/redirect/python_lock_equivalence_tests.rs
@@ -152,6 +152,7 @@ fn run_both(
     let mut got = RewriteResult::default();
     rewrite_uv_lock(files, overrides, metadata, &mut got);
     assert_same(&want, &got, what);
+    crate::golden::record(&(files, overrides, metadata), &got);
     got
 }
 
@@ -584,6 +585,13 @@ fn case(seed: u64) -> Case {
 
 #[test]
 fn single_parse_uv_rewrite_matches_oracle() {
+    let sweep = crate::golden::Sweep::with(
+        crate::golden::Golden::new(
+            "python_lock_rewrite",
+            "One seeded uv / pylock / PEP 723 lock set + overrides + wheel metadata.",
+        )
+        .chunked(5),
+    );
     let mut rewritten = 0;
     let mut edits = 0;
     let mut codes = std::collections::BTreeSet::new();
@@ -609,12 +617,17 @@ fn single_parse_uv_rewrite_matches_oracle() {
     ] {
         assert!(codes.contains(code), "no case reached {code}: {codes:?}");
     }
+    sweep.finish();
 }
 
 /// A refusal between two rewritten deps must leave the lock exactly as the
 /// first dep left it — the session decides every refusal before mutating.
 #[test]
 fn refusal_in_the_middle_leaves_the_prior_rewrite_intact() {
+    let sweep = crate::golden::Sweep::start(
+        "python_lock_refusal",
+        "A uv.lock + pyproject.toml whose middle dep is refused, LF and CRLF.",
+    );
     let lock = "version = 1\nrevision = 3\n\n[[package]]\nname = \"app\"\nversion = \"0.1.0\"\nsource = { virtual = \".\" }\ndependencies = [{ name = \"a\" }, { name = \"b\" }, { name = \"c\" }]\n\n[package.metadata]\nrequires-dist = [{ name = \"a\" }, { name = \"b\" }, { name = \"c\" }]\n\n[[package]]\nname = \"a\"\nversion = \"1.0.0\"\nsource = { registry = \"https://pypi.org/simple\" }\nwheels = [{ url = \"https://files.pythonhosted.org/a-1.0.0-py3-none-any.whl\", hash = \"sha256:00\" }]\n\n[[package]]\nname = \"b\"\nversion = \"1.0.0\"\nsource = { registry = \"https://pypi.org/simple\" }\nwheels = [{ url = \"https://files.pythonhosted.org/b-1.0.0-py3-none-any.whl\", hash = \"sha256:00\" }]\n\n[[package]]\nname = \"c\"\nversion = \"1.0.0\"\nsource = { registry = \"https://pypi.org/simple\" }\nwheels = [{ url = \"https://files.pythonhosted.org/c-1.0.0-py3-none-any.whl\", hash = \"sha256:00\" }]\n";
     let project = "[project]\nname = \"app\"\nversion = \"0.1.0\"\ndependencies = [\"a\", \"b\", \"c\"]\n\n[tool.uv]\noverride-dependencies = [\"b==1.0.0\"]\n";
     let mk = |name: &str, n: usize| DepOverride {
@@ -670,6 +683,7 @@ fn refusal_in_the_middle_leaves_the_prior_rewrite_intact() {
             .refused_python_lock_uuids
             .contains(&overrides[1].patch_uuid));
     }
+    sweep.finish();
 }
 
 /// Runs the oracle over the benchmark fixtures (real ~1.9 MB uv,
diff --git a/crates/socket-patch-core/src/test_rng.rs b/crates/socket-patch-core/src/test_rng.rs
new file mode 100644
index 000000000..876c54dbb
--- /dev/null
+++ b/crates/socket-patch-core/src/test_rng.rs
@@ -0,0 +1,35 @@
+//! The one deterministic RNG the randomized tests share (no `rand`
+//! dev-dependency). Every generator seeds it the way its inputs were first
+//! drawn, so the golden snapshots in `tests/equivalence/` keep
+//! replaying the exact same cases.
+
+/// xorshift64*.
+pub(crate) struct Rng(pub(crate) u64);
+
+impl Rng {
+    /// Seed from a small counter, mixing it so seeds 0, 1, 2… diverge at once.
+    pub(crate) fn new(seed: u64) -> Self {
+        Self(seed.wrapping_mul(0x9E37_79B9_7F4A_7C15) | 1)
+    }
+
+    pub(crate) fn next(&mut self) -> u64 {
+        let mut x = self.0;
+        x ^= x >> 12;
+        x ^= x << 25;
+        x ^= x >> 27;
+        self.0 = x;
+        x.wrapping_mul(0x2545_F491_4F6C_DD1D)
+    }
+
+    pub(crate) fn below(&mut self, n: usize) -> usize {
+        (self.next() % n as u64) as usize
+    }
+
+    pub(crate) fn chance(&mut self, percent: u64) -> bool {
+        self.next() % 100 < percent
+    }
+
+    pub(crate) fn pick<'a>(&mut self, items: &[&'a str]) -> &'a str {
+        items[self.below(items.len())]
+    }
+}
diff --git a/crates/socket-patch-core/src/vex/verify.rs b/crates/socket-patch-core/src/vex/verify.rs
index 3227b7e27..e594c44e0 100644
--- a/crates/socket-patch-core/src/vex/verify.rs
+++ b/crates/socket-patch-core/src/vex/verify.rs
@@ -1754,7 +1754,8 @@ mod tests {
 
     #[tokio::test]
     async fn judge_installed_record_matches_verify_and_evidence_scan() {
-        use crate::crawlers::oracle_support::{fifo, mkdir, write, Rng};
+        use crate::crawlers::test_tree::{fifo, mkdir, write};
+        use crate::test_rng::Rng;
 
         let patched = compute_git_sha256_from_bytes(b"patched");
         let upstream = compute_git_sha256_from_bytes(b"upstream");
diff --git a/crates/socket-patch-core/tests/equivalence/cargo_lock_hand_written.golden b/crates/socket-patch-core/tests/equivalence/cargo_lock_hand_written.golden
new file mode 100644
index 000000000..c416de05d
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/cargo_lock_hand_written.golden
@@ -0,0 +1,34 @@
+# One package of a hand-written Cargo.lock shape, planned for the hosted index.
+# <case> <input digest> <output digest>
+0 706a2c1abf97c1b4 26d81ae16d72cab3
+1 0013f297dd492650 1428acc04f9e446f
+2 5c5c9865e85a268e d123c201da48e32f
+3 7e6322041427f070 c9473f27f38da73a
+4 9d8bcf7735d2008e 1428acc04f9e446f
+5 6ec6285a7b61479f 0dcfa85143654a54
+6 ef2fed64a9d24209 8388406d7bc88ba3
+7 3d9a7b57fa5c470a fe8445153947c6af
+8 3b11f8aed597c49d fe8445153947c6af
+9 29994524553d22ee 8388406d7bc88ba3
+10 71499101583df353 e7ecb5ace517a1d6
+11 36d06182e2a1c1e9 1428acc04f9e446f
+12 68989afaeffb42a1 bffffda01b112ac7
+13 af64333e15e6b606 4af8fd36e7286fef
+14 5cec941739965a2b 1428acc04f9e446f
+15 7241469515e1e102 129d26df99f15585
+16 2b16d975ceee5389 8388406d7bc88ba3
+17 fc916c73fcf340b5 9a85046178baaf05
+18 3e48d7d989e4ebc0 1428acc04f9e446f
+19 5036e5b279a082fc 89f28ce664aa4d1a
+20 ea3db94c11b41887 8388406d7bc88ba3
+21 215499487910362c e5b728d164a80524
+22 a543ccd11ef08544 1428acc04f9e446f
+23 fd7112c582ba94ce fa2725078c2108f0
+24 9337c8c0437c0d1e 8388406d7bc88ba3
+25 a01510ddd6232374 209e728561ddbcef
+26 ff44ba433551f787 1428acc04f9e446f
+27 d41fbcbb78263ef7 7b3af5fbb5ff1e34
+28 930b1a4569318906 4ebc39a8335e270b
+29 42ccdafbcf685997 1428acc04f9e446f
+30 4f43463b7f55fee2 36521a8bfb53eec1
+31 f4bf8598e35a43e8 8388406d7bc88ba3
diff --git a/crates/socket-patch-core/tests/equivalence/cargo_lock_large.golden b/crates/socket-patch-core/tests/equivalence/cargo_lock_large.golden
new file mode 100644
index 000000000..327f3f699
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/cargo_lock_large.golden
@@ -0,0 +1,28 @@
+# One sampled package of a seeded ≥1k-block Cargo.lock, planned for the hosted index.
+# <case> <input digest> <output digest>
+0 78045c5e39db073b f2cf0090ac2ce5e7
+1 05dfc47f50a498c1 3f2c8debbb1d0145
+2 d854b4cf14f9f61d 8857fbf24537018f
+3 9c4a785df44318c7 d00b6fc606b303db
+4 a25a1c30b0cdf6b5 76d68a56da0a85aa
+5 101baf93e0a7f9d8 e9c57cf0b99a1684
+6 3a6b3874476a882a 856fa93ccdcfb6af
+7 f9eaf6afbb1a9c66 dd37b2e4b773d076
+8 a2a84f014fb4dabc ee9f4e62becb7cc6
+9 35b474487d5ff6b9 091a8d6e21322223
+10 38789819cea16a4f b378bd7f02a8714d
+11 c4c27c5d4f4daf67 96f19e29103fabd1
+12 be94b55d7c3c1480 8ed48177335ef376
+13 746dbc23026f79ed e17d988ec31acb4f
+14 7d8fe30baee23b9b be565b36d3fa7922
+15 46947f017e5b4c48 cb91d36563a63052
+16 0003561dcc79589c d069f669afd6cd52
+17 b54e0470cd987144 2cb03a40e3a3e409
+18 d4bf856fb926a83f f89b80deec3260fe
+19 cb99923406f3fcd0 e0a883a4b9455386
+20 513193db2b707372 e7463dafaa030836
+21 ea9a3e2b5e22133a 53a9b1d38f0d90c6
+22 5fd2b34ba2924902 cdc341c3b0655b62
+23 8308cfa77d8eb679 8ae5384da5f521a6
+24 30cc19f98558363c 012f808a18623335
+25 20ed7cc1c8b6dd5f 9522170ea2f5a131
diff --git a/crates/socket-patch-core/tests/equivalence/cargo_lock_random.golden b/crates/socket-patch-core/tests/equivalence/cargo_lock_random.golden
new file mode 100644
index 000000000..e205c4ff7
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/cargo_lock_random.golden
@@ -0,0 +1,260 @@
+# One package of a seeded Cargo.lock, planned for the hosted index.
+# <case> <input digest> <output digest>
+0-19 f29f7f036e08101d 15fcdd2345db5f51
+20-39 88970b1c782bcc4f 93a31a340b0c206e
+40-59 e549d7f4feee28f7 c161ce241dc3e0e7
+60-79 41b623cd509a8e39 148c8b1efa8b253c
+80-99 f08ba147bc7d2675 7a061e373beb12cd
+100-119 379725799f733b36 4ca10f565e554a57
+120-139 aa62dff09077b08e 1b85d3e33155a2a6
+140-159 2a4c5cd72107f9a3 9d4d48535bbad70b
+160-179 7d647e971cf28a8f e7e33bd606496eab
+180-199 ddff2c72b70e55b3 65383b9cedf5ddb5
+200-219 a1cca3cd191c12b5 1d764cced5ac65d4
+220-239 c91de04cdb183add a32f7decba3bce7f
+240-259 c47f781a988d65c3 4b972d7662c88a87
+260-279 73aa02ab25ba273a 1421ed4bedfb7403
+280-299 04f68baa5c4e4bc9 cd5fe00fb4d285f6
+300-319 047f47e885ede5e2 9c2b76ba612cace4
+320-339 df0836300d651076 c286b98681df94bd
+340-359 a266b0e79a7d84a8 08cfa92f8485ef35
+360-379 58f6b017612c6816 1a419331b35ef70a
+380-399 5ba3d117de9176c2 1164dc9f9b72d7f7
+400-419 ba83002bce60d60b ace83b6844b4e300
+420-439 dc2cf2ba92e262d7 d9dbdaeba998c99a
+440-459 8a9124f759249703 ad7d4fb70740adbf
+460-479 3e6f5a32150c1d46 82654e822d1d1aa9
+480-499 848742697c7dbd06 77b67452702dafa9
+500-519 c34758da24407a5e 64e9642a147fc269
+520-539 22afb2f6091466ce 984c72442984b4df
+540-559 30b34caac24ab212 2167ceb67e82b1a9
+560-579 cf1804b6bead618d 980ab43ca9eb8945
+580-599 715ae75d087e6dcf f3f12b3776555567
+600-619 483b71715363f2ec e8c7324b79e44366
+620-639 b483216cbd0c41c3 66f21dbd9f5002db
+640-659 e01ba3d32f5f418c f94a3dfedf8a33aa
+660-679 08eb9ede990c2e12 efd5e128232021cd
+680-699 9c00cf0528ca7cee f2f1b9e5f022f0d7
+700-719 bdee62c931789604 e1b6432d16fcf963
+720-739 b3612440a4be00f4 7efbb10e59383192
+740-759 bf1691f95878ee6d f671fc5ac13b24ba
+760-779 4e953a507f7593e8 1b7f257fb5c5937d
+780-799 0933b559bc0abf54 da5b93d1b8ae6fd7
+800-819 bf4d2aceb4750e1b 2d130ffd05d9df5b
+820-839 9fb73f3721bf732f 30f3f9a0a65640e4
+840-859 2df21b0d1f4d1f2f 2c59c0dafb5cb638
+860-879 de2ea5ec7d76789e ed449b7d3f0b18f6
+880-899 aab4f16968c175d3 2937195c32e9b980
+900-919 8895cb6b7144ed9e 435ea56f5c5828a9
+920-939 e938457d6c4cc1d6 f478205e3098b08c
+940-959 6afdf98ced22e2b7 03b4312a63ea0589
+960-979 70c5d89b29da668d 30245179f92456ed
+980-999 4aba83fc1363e434 1b46cde2f3583d9a
+1000-1019 192d5ff95b760412 566da0e129ed445a
+1020-1039 3ac6c735f54fbb18 d3c9e1a68df460b7
+1040-1059 8f33d42a12e8573a 3fbae4cd14a0eb2e
+1060-1079 ed67f3c218c44077 3e5106301f0f25e5
+1080-1099 b9abdde99c15b43d 2f6bdab2b53e187f
+1100-1119 1922ffd988064a0d af8d65d647125435
+1120-1139 93705a742562faf3 5adba08db501fa41
+1140-1159 014c38e750a3e021 001baca306a132db
+1160-1179 05aadfdaacfae94a cd7c9efc33dcd03a
+1180-1199 63bc62b68eb2c59e a5f07c35bc0dd51a
+1200-1219 3c00cdeee782ebe8 ac0d3bf871549065
+1220-1239 8bbf5ed2af8288eb fcfa7ac56a5b1916
+1240-1259 59b2c183f8b69485 c02c6863664e45cb
+1260-1279 dbd6fb55e744e369 cd1347421a7cfe62
+1280-1299 ca8eb4cb0d6552f0 45ebcf4c550c37e5
+1300-1319 6f90d259572896ba 927684d7642f118f
+1320-1339 f37906c70ad6a2f4 7bc7ed81986c83ce
+1340-1359 2ccba48216e1de6c 89f1e98e97f3bb25
+1360-1379 ba467b035586147f 023225e36e3b3495
+1380-1399 22b468b5ff39a45b d286c2bb94512a65
+1400-1419 a0dd45690f72a8d0 ead22c45b7ec9ff9
+1420-1439 0b2792d94a0681b1 d026684f4573484e
+1440-1459 47edad566619a8f8 7bfe59dc09a93d41
+1460-1479 15c0e9ceeb4e0e6c a44c9a2a33915853
+1480-1499 e79d5635ab1a462b 81f645b1342bdcf9
+1500-1519 304beca9b1ac6b91 330cefea075ca239
+1520-1539 fbc4b99cf28e76bd 28bd89cb0b2c2475
+1540-1559 b2987da2f02b49ed 8a040ed1d4ae3558
+1560-1579 fd5575bf96e89f2c 82cfb6b0d39ba20d
+1580-1599 41518f7e89703e9d 8ada06dbad0d655a
+1600-1619 68cdea13bca0d10b ddfb0ddc2a883111
+1620-1639 4ac6cc10f072afc6 13d9d63e141ef9ee
+1640-1659 2331c995c5705cfe 1a68ba062744d709
+1660-1679 b5a58935e8dd88ec edca9dc56b388b7d
+1680-1699 a48f20e4bde54b39 d52e0e0373c5aa64
+1700-1719 24567ec898aaafff b546ce1278184168
+1720-1739 4d5a9738aa730c18 5ee312648a112dd6
+1740-1759 43456b7adeadcf56 c310cd6b8066267d
+1760-1779 5bc475bc11a5c16e a485c95285ac355a
+1780-1799 24daef9b23da61f2 b93764d8d56df189
+1800-1819 355c1b7729c6a0a3 ab2490e4d55521ef
+1820-1839 f28e59c983556824 e8af4777388f67c4
+1840-1859 2fb2fec2a71f360e a1206dc7621f1b77
+1860-1879 22d3787161003f0c aaaed7c20ba91f4d
+1880-1899 1837be0743c6cee2 4eb849fa14add39f
+1900-1919 bb1d18e322ba6494 d3b09bbf92643eff
+1920-1939 7e7d61074278d806 609765dca4d6b699
+1940-1959 ad44f61ee06ef232 7a424139b5e0269f
+1960-1979 9134be270d17364b 7025306327a8efca
+1980-1999 ef696e4045391f2d 916f38f3937fd7fb
+2000-2019 8499f868520b3f8e 5b3bc7a31d3d93c1
+2020-2039 8ad512de7b529038 490a3f5aa1778f15
+2040-2059 c69c16b1a115e9ac 5d9a904cda23615e
+2060-2079 945cba5bee5bc399 767fedaebb7bc00e
+2080-2099 e3147fed90db9855 888aeb2af65837cd
+2100-2119 98bf6471b6cb0615 eab6f9b350fc4dae
+2120-2139 90f38a07d2573cf0 efaf3964b0dab056
+2140-2159 da5782e3633006f7 f2beef78afb853f4
+2160-2179 7bdacb27708daa87 a9c3364bc49bc3e1
+2180-2199 2f82996cf7f24576 875ba5c485a0874b
+2200-2219 b1e2199d52cce57f c5fb1f7bbd02c67b
+2220-2239 19a653c17ec51323 aa50e297011141c5
+2240-2259 f5ac4e0c0993f327 af8fb5f449afd87f
+2260-2279 f0a1eb778213dd23 9ba99949b1179d63
+2280-2299 0e50ca7d34ef0d62 1eb1e2cd7c54107b
+2300-2319 7221fb632f837418 6f5e13b31cea030f
+2320-2339 e1cf296bb8e21bde 77c7b92980752534
+2340-2359 636b76011aff79e1 f4431f380618d52f
+2360-2379 71e932a5a3bdfb8e c60b499b397c575f
+2380-2399 c117916cd277ec6f 95bbe2feb60cccb3
+2400-2419 ccfdba5fdf0a9415 8b2cc626871d0fb0
+2420-2439 dc6dd7969e0f1e36 94e0f97378ac1b25
+2440-2459 e1fea14d81ceb91c ae3f79dfdbeb7f7c
+2460-2479 f5cedaabb7724677 d59e1da2bc0e0743
+2480-2499 e26961852ecc22ae da99f352250c1b45
+2500-2519 a25796c4f7fbad7c f8a164c5544a7254
+2520-2539 4fb0e7c218149c7e 0319c40be2e31b64
+2540-2559 0c81e323fb67df40 6e08ef2537f3ca96
+2560-2579 b65f596fff015d46 41feb9684e934416
+2580-2599 b79f6e99dae9205e 031f4009cbbe9af5
+2600-2619 c604cf1aad4f649f d554c480f8b05951
+2620-2639 76f7969d453acebe eebfa9af71697aa6
+2640-2659 b5becb850e265522 1269cdfe95e8974f
+2660-2679 4a2d7d35dfbd1b5f e538ca966604e479
+2680-2699 49d14ba9d02841fb b99bcb47badbb193
+2700-2719 649762baa856d048 7f56e0186ea3d487
+2720-2739 4f96dc61948f2884 334cf1e3e0fd24a4
+2740-2759 be2bdfa73e690282 95f8ab7d42c00ec6
+2760-2779 dcac309d22b001b3 dd4bcc069e011382
+2780-2799 907d81c1fc8e62a8 22f0667e5a46678c
+2800-2819 493cc61dc72b18a0 5fe2e0608206c130
+2820-2839 f2834bfbc9846784 17c670bf5da2d384
+2840-2859 d06f0d7d42652336 ab3835ee6d865319
+2860-2879 2a21a9bc94491852 6a5a3d00ef65f41c
+2880-2899 611504eace82f58d 61473122b3912af9
+2900-2919 352b76e78f376685 a6b5bd24de45e478
+2920-2939 17c034af64775b1a ce5b3f75c461a821
+2940-2959 0f2379bb287254bf 56beb942e124639e
+2960-2979 34fa7e24504b986a 3d7c0cf80891f403
+2980-2999 17d02ce6d30b01d1 e7b3068735bac0ac
+3000-3019 cb56a52b91c07c3a 36120e3f70208071
+3020-3039 a486b88249f2bffc 136f1610c407390d
+3040-3059 edaaaa41992c4c37 da1394f27770b85f
+3060-3079 1cd0f784fd5e3bac 8303db273a0eb798
+3080-3099 17ce14fc832a3ca2 96e326f20334385e
+3100-3119 aee3cf2eeb6c8239 c39c5bcb22400061
+3120-3139 cc7176a5e83d72f6 528969f211608881
+3140-3159 723b7920d611d760 6c19966602d0b8eb
+3160-3179 176b38a6cde2ee46 d0581faff8e98ab7
+3180-3199 6e690a7653ad76e2 3a463fd2fc90a488
+3200-3219 e7f9198eeb91b429 0e4aeb2e4e0a4421
+3220-3239 9cbade3ca42b488a 5544e0538aabf17f
+3240-3259 1d0708203dae99e4 be3e22b909ba487b
+3260-3279 5a2b666997abe74a c0cfc8b3d1c1364b
+3280-3299 3ad2c0076f628fdc 042c47415841b001
+3300-3319 3b4325f4842b3978 575e706f43048a90
+3320-3339 d407e6aad990b794 462153c4561369cb
+3340-3359 5c4064cba50101c5 78c524f4dc4e695d
+3360-3379 63107d93346dd91c fa6a9a6ab55eb079
+3380-3399 a14b22d3d5aa7068 05f78b4d8915ccb0
+3400-3419 5bfe607fa099222f 77e5bd0ec426f62a
+3420-3439 238654ad7fd731fc 1462c995e3025a09
+3440-3459 aff73d40237b79c3 a12121daa5833c0d
+3460-3479 815f03b8e8801faa 5a57de807e2befbd
+3480-3499 6487a346b83c1a78 810b4ad1c78b0e7a
+3500-3519 46edaa06f0ee0769 3bf7c59c715ca7e6
+3520-3539 3e64bec5cf546343 bfe286e4d19c9ab6
+3540-3559 73e6cd8e9b04d93d 5345d890934635b9
+3560-3579 fd4ba4ce60f7cf10 7b604469555ebda3
+3580-3599 444e6b4cbef13ecb 78eb4929919fb9f6
+3600-3619 d25c25858e9d29d2 1c9ec8efeb219413
+3620-3639 11958621d1a0622c 187b3789f90b213c
+3640-3659 32cda6b56d107181 264be07c80829590
+3660-3679 759d6019beced504 c22bf8969db2ecb1
+3680-3699 58a6ba4bd3f5d359 223ff38df5ce4a59
+3700-3719 6e1f4fd78ebd3355 9f361789bebbb98e
+3720-3739 a997d0ccedda5c64 544a8c9090dc9735
+3740-3759 57cbd84d0094ed86 87750b3baf8e796b
+3760-3779 215b7c020db270be e30299b0a287f1a9
+3780-3799 dc5f8938d270c893 976ae59059bfccfd
+3800-3819 3ceef0d65cbf8b7d cc0da82ab8176f45
+3820-3839 ecc8ec56b6dd2e00 769077ac5634bbe5
+3840-3859 6b26c92b7de2c742 24796faa4da5fea9
+3860-3879 248c9b4fe8310237 e352bbff021e9818
+3880-3899 f829bfad2a69ede2 81ac4722d38b28ae
+3900-3919 f6512b14d775e864 8c6eb605dbea1964
+3920-3939 39a927088f4f88b9 a6490708edca0417
+3940-3959 070296b95464b935 b28f872a06cda16e
+3960-3979 236de91489337214 06ec5b3f0cce147b
+3980-3999 44892f2560197b78 74ed890c0d8d9c15
+4000-4019 7aef382a1b427383 e8b0cf479f6f253b
+4020-4039 577683c9d88e1d71 cec8220150a8ea46
+4040-4059 4e2f423ff0f9ea61 ab113a91a641dfc8
+4060-4079 b30a1eee1e9c6368 cd5ed2ddad4a0f18
+4080-4099 1660a2f271745f4d 740c68108d49994a
+4100-4119 4be7d38149f89e9a 13c182ce4ac70210
+4120-4139 c21b510da4ee70cb ee5aa7986d555c33
+4140-4159 366bdb067c694ba2 b2e7035f82d4ab10
+4160-4179 f2cf904fe73b556f 0e3e9a742bbf84ad
+4180-4199 d4ce35fc918e49a7 38ed3f77dc645887
+4200-4219 32b7caf91af21c3c 58e11d8f1d93f505
+4220-4239 cd8010e83e9fd72e ed44a3354dbb4b61
+4240-4259 621ed1bc982212eb 69a57062935da5c9
+4260-4279 8a71c6e538792327 027e291d3c2aefb6
+4280-4299 b1ed226babf0b2a8 1c31138ed6637fb1
+4300-4319 16001aa3329dbe2a 8f7944e375dcbce3
+4320-4339 66c436462def9c0a 386b23cfd1fb1d42
+4340-4359 788e5f3213ce177d 39184f15b26e6bf0
+4360-4379 6caebcdaf6c0f02d 894b49f4db7b10d1
+4380-4399 df18c925dc1ae013 6504168382a7f575
+4400-4419 8bff99e0b48fa3f4 eabe70692a37a208
+4420-4439 0b910c768e5c00f2 b8c1994b0653dd31
+4440-4459 f357166cba13602c 3514d46b12b31021
+4460-4479 63472e5b76fdd703 37c9f08d82226231
+4480-4499 d6e9040e54354020 554305137b8a7250
+4500-4519 ea5f1eb0aafc64d9 5795c80b6165fd48
+4520-4539 05ffe86951490efd c519c0637aff3227
+4540-4559 907af4190b058042 9b2e445e0c0618ae
+4560-4579 60afec8b2e9bf3b6 1809e06b57598a5f
+4580-4599 a2c1a5be4f249df7 5f4edb16b1e6a2ca
+4600-4619 9e2eba5f1395b8d2 84bf62484d2478a3
+4620-4639 126e7be0b4f60180 0262b6351c44eafd
+4640-4659 005e406b74e136a5 d140efb0e813d08c
+4660-4679 9a68cc25f745e30c 8a6c57cc64baa60c
+4680-4699 e992d034fa06e77e f54b9e62475e2adf
+4700-4719 1360a562d6a15ebe a84b5e486396378f
+4720-4739 8263e73d7b9a9e55 dbcb5a5f67f66472
+4740-4759 3ecf06ca573b4450 3af92dd11ad9d29f
+4760-4779 8b562cd2da15acd9 0c3cc6ea2faec5c1
+4780-4799 965c3a17b2013c07 0cb0b5717b8b8ebb
+4800-4819 19da8a20cb2b29e7 8d9e9810948ff151
+4820-4839 f25130d77f8970b2 8da56c91879b4139
+4840-4859 f1014250a60478bb bfc9be790c53808e
+4860-4879 15f973b93b489a2b bffd36c7d2397db2
+4880-4899 972eb459d0b832ea e8e99926f2e81941
+4900-4919 a5d4ba4e6d3f3876 f8cb52226ff18400
+4920-4939 1dbdba5ba4abf9d0 9c5f30bfc028dbc2
+4940-4959 3c4449d0a978cfe5 6b885d6175f23748
+4960-4979 8c32df3e79c709d4 e0f723df9d288603
+4980-4999 993fdee9018d4401 5b957ba534eb769c
+5000-5019 a9c3e1f25d020754 b2dbe851e709da95
+5020-5039 84e18c0fb88538ae f0ee3a067ea3550f
+5040-5059 b031e323c5eddac9 099a9f7cf8c6a9aa
+5060-5079 dc3963dfb34b2748 80f2d7bd7e34f302
+5080-5099 112aec43fae4e864 f6bd4c112eeccc38
+5100-5119 4693e39175662c0a 990e605ffd23e163
+5120-5139 65de9cdc9aa6d49b 2d2b0058899f7c15
+5140-5141 195107ff0499c01b ea616eff5b65486b
diff --git a/crates/socket-patch-core/tests/equivalence/composer_lock_rewrite.golden b/crates/socket-patch-core/tests/equivalence/composer_lock_rewrite.golden
new file mode 100644
index 000000000..a988f3cd7
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/composer_lock_rewrite.golden
@@ -0,0 +1,302 @@
+# One seeded composer.lock + overrides; the output covers a re-run over the result.
+# <case> <input digest> <output digest>
+0-9 9b3913152ed56889 b6d816e59837a34a
+10-19 8b0e7c18e23365be a021c92b31297243
+20-29 10597f7d4241889b 86eb70311eada692
+30-39 38f4d393467c2662 e2f10bbfd38362fe
+40-49 540be54f6398c6bc af202f87ff4cee11
+50-59 b7e60dc68bc06a3e c1de7be73a8b3307
+60-69 449bd991c2c57f67 d964c8de2233194e
+70-79 9171b2d14a8fefcf 05c2364e4f6e101a
+80-89 f625f1b416e3cfd9 0fb80a016e9f1f2b
+90-99 135c9d83b6c46c26 97724c3775768e12
+100-109 acf8163910e2eebd 090bf53555f59c80
+110-119 51547c69666e738b addfc0c403d63548
+120-129 ee96dc03014b050c a90c2ed09e68a186
+130-139 0fa7a04a12ead2ed b5c722d4861b34dd
+140-149 3fee7b5966327e1d b11badf2c28221d9
+150-159 60130c815986abf9 81223f819f52dff8
+160-169 3e203584629e38ce 69d2a42c77970c31
+170-179 566479413b96bf4d 16e4c082f96aab2d
+180-189 45084bd0d9d64863 9cc6df066bb360e7
+190-199 4f526f27c379aa4f 94d92a17832c64cc
+200-209 4217aecb9f72695f 1c25b6d380ae7568
+210-219 0b4af20591cc9811 d1a64892ac646334
+220-229 e5c7c3326d15f512 59b0807c13dca350
+230-239 1b3c02390c029bc3 1bd2c68102893b97
+240-249 731d6eaf6715e20b e7af1b24a0387722
+250-259 65fd2264b19fe2e4 6f974477bdbc1755
+260-269 8cc4818aefd59c09 34fc3a0a92f24ee9
+270-279 268809def8610f47 910062258ddfc953
+280-289 595b29ce14609c28 206af5c4c07f7396
+290-299 09322ccefc2998a5 2e55e5b4ed0a5aab
+300-309 b25411e11d5e856f e08db2d860db38ab
+310-319 9bd06d383a994d30 171c763c3120d62d
+320-329 8e000e36d1c2b7c6 195e34b0d627a808
+330-339 2fa421b61f2be783 68f9e91ba5c38a41
+340-349 72ccc6d520c9adb4 3d65308830fb17eb
+350-359 58085ba8d8a575de 1fc06c62a2af7ca8
+360-369 d62cbf72433032c5 0563036c930a8986
+370-379 d896942db25ebd08 7c4e3a855e78bfb0
+380-389 ae5f0bc5b83d7785 0e78bc8c01f8137a
+390-399 e6a0764ee780f903 17ddde794f8ca284
+400-409 d017a139b4b2ecc1 f68c20fe7e6b6382
+410-419 6bcb7de9a2c3cf4f 43861731ea9538af
+420-429 dcba4e53a568986e 0f413f9a7c184a6e
+430-439 bc819ddf251b899c 831de20722712f27
+440-449 30a35552f97b63a2 dd351425b7a87f6b
+450-459 05bc3a579d0741d6 f54036cf3048cac4
+460-469 ef5cfb8eb51ff482 e7162607c12bc71e
+470-479 b4e4eafd1ddc80f5 6b32d5def5a5c15d
+480-489 be296a64587b4c42 96812e51ccc52a8e
+490-499 c71e197575fd43ea 44094306ab726b19
+500-509 98d28900fe251d41 c07371af0129b6a0
+510-519 b6bc3f7829e592d0 336945fb32ea88ab
+520-529 5516175f760f06cf af5f99074a57d458
+530-539 fda0d9dcb7f00610 0f23c4958cead660
+540-549 87f001f41a4161a1 4a4ce23c58c27495
+550-559 20c63bf6e05623e5 67a98ffeeb0c7a9f
+560-569 498d6df82d825071 0a8bdbc62e5f5e68
+570-579 d1846f120d680191 4553f911f43b0520
+580-589 bb2150e8293e4162 6bffecaac2e9a505
+590-599 6d6855e4f945620d f592c0b7bdf0120c
+600-609 b4fefe0c3b25d530 7311263707aaa563
+610-619 60dddaafcf11069e 355bd1abc1a1c3fa
+620-629 f87f7d5afc0bceba 2d85e04560a86277
+630-639 d103f7aeaeea25f0 1d0b582ee4c4aacc
+640-649 4dcb57b5ffb59874 34e06df948e295bb
+650-659 fb7e49a1f7b8473c 73a07c3b0dc613ea
+660-669 8834c59100871e34 0dfff168b2bb7db6
+670-679 7020731021f8206c f115432a4c7e7f91
+680-689 fa2bdcbdbcf4b906 4127b43f9de658d6
+690-699 63060a6dc78bb262 adfaf45e37646bb1
+700-709 56b52d1492894d9d 1372f37a3729211e
+710-719 0153cf07fa4e377c e4a0ac87cdfd5e1a
+720-729 237fab46d1881ea8 31f94021ba08e29b
+730-739 4a097592f7d4fa64 fe37b11b900cba01
+740-749 4035306732a28491 a116ee0a6ecef23c
+750-759 5ddea19ce922b2e8 92ea0e9311000d5b
+760-769 b0bd41b4de346d7d cbd86dc4c47da56d
+770-779 298a306991b7bbf6 9479a27d8a0a766e
+780-789 46bcd1424c504e72 58263541bcfce839
+790-799 3af7dc6ced1095b8 55e380555818d7d3
+800-809 48c3a02b7ec9fee8 3365278677ca8248
+810-819 dfc4c3b8e1bfa2ba 8dbe6cdc9d03ab62
+820-829 21a14cc4b5bab80f 542360ead43705f9
+830-839 72fde278503484b9 d82173f629557472
+840-849 539ea42be8393774 75fab852e747d3e2
+850-859 4aac1ffd240be722 83a1aaa0c03b4254
+860-869 a01a5410e881003c 05457966f86d315a
+870-879 b00a9414b57548dc b74627975bcd0c34
+880-889 ae63c91e6bb683b4 9ba346ceef9a7fad
+890-899 1f1039bd34125aaa 45730f2333d2530d
+900-909 c64eccd0942270df eeb8eac22c37c2c2
+910-919 ea186bbbedef37a7 dd70fa39c13f3500
+920-929 ae1ff18ec90f735e 64cecd6993ded271
+930-939 6b14fedd21ca8a95 3163acdc486544dc
+940-949 3f7c54792366bdde f0d0ff8a18ae8439
+950-959 d79dec373010f741 fad3154ff90ce151
+960-969 fd660ee7ca849ea4 d5de33e1201fb043
+970-979 1dafe5f9cb119e57 db469eeac9ee625e
+980-989 e9ed8b6887adf4a0 0c66269cda618b1c
+990-999 360c0d192fb8e495 fc164dd0c1d09fa4
+1000-1009 054e132f7e49c642 8c078cb4d6488f84
+1010-1019 969f18158d04bfb9 4cc07848f7a31fe5
+1020-1029 00c47aa7e0298a36 dbf91c5b4b44dc89
+1030-1039 b6fefe6bb2f56e76 7598b65ffec17ecc
+1040-1049 5caeeb437c1d567f 28dddbd424223271
+1050-1059 e54f749b7ade1f42 3b5631a3b987361d
+1060-1069 0af9a40876a1a3e2 b6892c2bd0401944
+1070-1079 2bf24c3dde55e583 22ecd65a0b741dbb
+1080-1089 4606fbf38cad5cb8 d454b0e0f00afa08
+1090-1099 3057c7895d7637a7 41dc7759353c288e
+1100-1109 fa217f86ca4d96c8 37f21f68a734a711
+1110-1119 63b7dda8f847f8f1 4eb81d6f4d6c255b
+1120-1129 e221db7d26e8dcee b8c85d991cfefb90
+1130-1139 43af7d656f35bafe 2b3c08f77cabf8f0
+1140-1149 a286955bfa184f42 f2ddd82e886f4202
+1150-1159 69891337a0e6fe98 31ff65b4cfb7ccce
+1160-1169 7aca13c2b26eb950 56770887024ca954
+1170-1179 8861e7931a806313 27ebefe77f73e9eb
+1180-1189 a08c1d0286af8aad cb2e401d444d60ee
+1190-1199 f3506769220087c7 b8884c9594666ad8
+1200-1209 b6178f1e65c5eb94 39ea8069c510d914
+1210-1219 1596f602126c0856 9e7feb05a2792c14
+1220-1229 cb8f8e60d9661a6b 1f6cca100e55cc0d
+1230-1239 ae306bfaa7bb3644 13f976fd7afe7e9e
+1240-1249 4c5134fdd4926ca7 a3fbb52c0f5e64ac
+1250-1259 b5abc7c0192ce96c 89d9678eaa7756eb
+1260-1269 bcea57d71759c6e6 b9eaf2f4f3a9de70
+1270-1279 7e03624e8bcaacb4 3d534f5031fb551f
+1280-1289 85de42631f1bb8bc d2b88419fd6e495b
+1290-1299 c1edccf2660848b1 240e97c70a33da4e
+1300-1309 83ede72bba78f0d8 9f637af2fa85b5cb
+1310-1319 a7fe6e14e0e47e7c b37fcde88257783e
+1320-1329 c7f59918d250e797 b6d58222a1fd43a0
+1330-1339 8f254ae7c3ee815b 71cff09e418253bc
+1340-1349 49c369925c38bf46 c22328d857091203
+1350-1359 edaf301dc01701d1 e8412ef24f638651
+1360-1369 d9a0931404538a74 351f8d329197a34a
+1370-1379 cadb3113e85018a1 6b47f9f0e1285bef
+1380-1389 e022f9f6c7f648d5 1716a77e6c518daf
+1390-1399 394a979099d3ec41 cd7fde61be2f70c6
+1400-1409 341a250931bedc96 435bb42c5790735c
+1410-1419 fd1e24144db27416 38e1b3972a8cbb50
+1420-1429 6a070ffc0d76afcc eb33b6f641d45e21
+1430-1439 4bc5c5ffe222b48f 739e52c61ae66e90
+1440-1449 dbe1c685221f12c1 a79a4f4716c05e6a
+1450-1459 25a0f981e99bbd98 0cc2b45c7a55b3f1
+1460-1469 814451ccd914da37 d39456a7d9a19549
+1470-1479 7b0fd52f5b3edbb8 8f34ec3c83d3a9bb
+1480-1489 14f0f9a8f83b2ffc 2a4eac5fbb62c0e4
+1490-1499 79ec9c01053c1cea 120b2f46a9b6cbe5
+1500-1509 544946ffc89548dc 3d1b67601a61b31f
+1510-1519 cb62e8a14223db38 a94d5eee2043b818
+1520-1529 cc4e2c4b9cefe2e3 a5cb00cb7e2885ae
+1530-1539 5b07763e5ef53985 075fd5be1c4456d7
+1540-1549 4418402e9f02d504 fea9b3404164c00b
+1550-1559 e0c3d390e9529e0c cd248512689b4ac5
+1560-1569 e3e0c64b7cc8a073 ea232776d2bca3ff
+1570-1579 8ed1b5c30fee67a0 f2af253c27ce305e
+1580-1589 401f7f1208d30504 6f895be8b1eb000d
+1590-1599 0b907a87f3faa763 a34eeb94f4315cdb
+1600-1609 2c978457145da2e2 b50b3aa31022c1be
+1610-1619 d001626c11d94851 b04200cd7d42a5aa
+1620-1629 a8a2992876708b65 4e6acb48bf54d9f5
+1630-1639 7523117074d163c5 516895c5a69e0605
+1640-1649 adfa4b224c5f1ab9 68fc1903acf39a24
+1650-1659 64f4524e4072056d 7ca52b4dcff57bce
+1660-1669 a3f172526ffbc1bf a6ebdecd9177aa68
+1670-1679 1a3eb4731c833128 2386264643e85561
+1680-1689 7806067dbae47384 0f218b590bba0e8d
+1690-1699 ee2ac7a51dd2adbf 973a8aaef86676b7
+1700-1709 3690294fe5856e70 58ada83118de2ec9
+1710-1719 5cd78bffe4f3a946 e23e76c514657d01
+1720-1729 2feef891665485e1 a1b3ae03495f89d8
+1730-1739 463f949d31bafbbb a9eb72624cc56a16
+1740-1749 d07799ed18c47b10 6c6b9c7470fe0d37
+1750-1759 9e457622ebcb2ed6 b12bc0a737cc8a47
+1760-1769 4bac206c3ff87699 f5f55c99a9c6c183
+1770-1779 6f6a9d69b6638721 01d4c90029695a44
+1780-1789 4875faeea36242f9 c48fc1fc19feaf4c
+1790-1799 14764890b8b45d74 a1774af24eaab0ce
+1800-1809 b27293bcff4b5809 d5d0063aeffe20d7
+1810-1819 38cfb22a7ac43635 93001d704a7a197a
+1820-1829 7d29ef7ad6853a7a a6fdf09e60c2c6bf
+1830-1839 ce2ca12632091190 fa16dd8f3e25898d
+1840-1849 f7a5ecd45a442e25 b02ae62c683344f4
+1850-1859 ecd21b0eabb5d5db 6c72bdc2d29dd235
+1860-1869 aeae9651788c5a33 f354756118715bf9
+1870-1879 41e15c5d9509b981 454d3a0dcb0c4ddc
+1880-1889 c8ce339f488359bc d6d3464aa9512bfe
+1890-1899 c81c194c139d0991 8a031ad2867b77fb
+1900-1909 9aa95d10dc01291e 74bb85284f8bdfeb
+1910-1919 26d5acce5322b15e 7420f29ab285a3f7
+1920-1929 84680d82dac5b7bc 620b1a90b4f47f2d
+1930-1939 bc4144086eac3f6f da265732f041d1e2
+1940-1949 677b355f9539110f 4d9d5dd92fbcc82b
+1950-1959 fe1820f0ada2af2f 9c6e9529f74e1a13
+1960-1969 5aeb4278d0b4d7a9 5f140583ec4c1fa7
+1970-1979 a0f7d62fbecfaab5 5a38d9d893eb428b
+1980-1989 db915a98ef84161b fcb07036b76507f0
+1990-1999 527c34290eaa4fc8 3680f5228c0fd6f3
+2000-2009 cfc7d4a64bca4a2a c4ece89828cad4d8
+2010-2019 fdd9af52f9c38dbd 487430ac2199215e
+2020-2029 7b13906b6c1acd11 bb0adfb04e0e2772
+2030-2039 bb380c77eba02bad 36ed1f80330ec0b6
+2040-2049 71f9c221a0312645 56dbc314cc50ffd7
+2050-2059 0f7d37862d816b3a d05cbf15af150f40
+2060-2069 caa69add664231e3 64bc5a1db5c8a3f1
+2070-2079 149f90d0e2be85b3 421783dd58d625d1
+2080-2089 37c01b3ded464a3a 12cf2fefb19578fb
+2090-2099 92629d7e61b8e664 0e80eaa8a4b597fb
+2100-2109 22f5805468982d5b f7f06cbaeb558e76
+2110-2119 171fcd407e7ad667 f6997ac29d1a3ff2
+2120-2129 62c2516753013b97 36c3ba8cca52992e
+2130-2139 a525d636e4a4500e 7851432872803102
+2140-2149 d43a3b1435bfeac2 6b82552c07dcf943
+2150-2159 527c9d4a6e4c2ee6 11b9d816455a0321
+2160-2169 17d378316cf9f95e 3e97ba26fb234fa8
+2170-2179 cab55e14a5eb5eb4 85bcb71693d9225d
+2180-2189 ae86380e68de14fe 1581333a5482e4d0
+2190-2199 8779111852f5a424 0a6065a2d85f1599
+2200-2209 ab2fbc1e1561f1f5 c3c7b38251254351
+2210-2219 0c30457835f0aa6f 96958ec960b807c9
+2220-2229 5117d8ec8fcf9b30 e5db32dddf9fd99b
+2230-2239 c52e238274d920f0 e90f82d7a341f13e
+2240-2249 d4a60e8ca0f0c188 11f08e6b524f7567
+2250-2259 b077275a5b12a7b9 57868f765ae85e6b
+2260-2269 d952d252b7f2cee2 6e72925b1fcbaf5e
+2270-2279 dc7415f060a655b8 e5f3fc1afdcc89b6
+2280-2289 7f0ff508b1d5f9cd 45c549538a84d755
+2290-2299 1e0c075bb6b5728e 4da263732d2902a9
+2300-2309 787cb077fc7ce277 85012e6ecb67567a
+2310-2319 b9cf471c54429b5c f3872fc55add2006
+2320-2329 1cbdfb2221ef0bca 8c95cc8a99f80090
+2330-2339 b184f11d2971ba02 485c85e4b63528f6
+2340-2349 408b5056d6da5901 12c00b404c5c2d21
+2350-2359 3a28cdb761604140 e25533bb07a68767
+2360-2369 16a1b0f2fd3595a0 4d482cdd08e89dab
+2370-2379 4ec4721d19036117 20528728cfb64d02
+2380-2389 93e5d1bebc0a4611 580fb6b8b7e217be
+2390-2399 fbfc425dc450c7c3 41412b47ffa12896
+2400-2409 0092c6fa138e1a2e 2bb3b6d4fcca1518
+2410-2419 79a34ae1d6837fc2 3bd6fed06af46c7a
+2420-2429 bb88e37a16837b9b 2d35daea15cee5c9
+2430-2439 818b162e8399655d 7d99ae093095b450
+2440-2449 5c043f6402cbd457 d8b3bf0aac28d401
+2450-2459 bd4c58fc95cbf8b3 2d2ca8735dff6460
+2460-2469 dfa72b14435b87e7 ad33a1480ed13670
+2470-2479 ee95719dd3805867 630003d35245030c
+2480-2489 2fb5b1f7bdf3f3a8 d6b365ab6d728880
+2490-2499 a3962ff35c4187bd ffd23d3c8201bc7a
+2500-2509 46f52bc6fed65c85 92401ba374964be8
+2510-2519 67038d18a1a474ee 856d73c34ec41aa3
+2520-2529 1e061d9617b7165e 05ead8c3f1ab2ee1
+2530-2539 41a7c930af9763e0 16b9381912bf2fe5
+2540-2549 701b58d0aa1c7414 a0307a0b0fba7bd7
+2550-2559 384e86c8d48a6169 7be2103bd838e1eb
+2560-2569 b251f7a003bcec51 cae058909c20c91b
+2570-2579 9e0a27c5ae1eff83 d7496f5fd73ea510
+2580-2589 4250e99da39e01df 0f3022eafc6a136d
+2590-2599 0b2026feb8d3fe35 059990fff3d9a1f0
+2600-2609 f746eaf424849b80 aee2188468674a10
+2610-2619 5b1b9f69f80dd78f d7d4277b752ff256
+2620-2629 36ffd34d19fbe0f7 8edb29e95e8d3ce5
+2630-2639 64c5b5527452961c 928dc7de4812f7b0
+2640-2649 585aee44d9e1e8aa 31cbde5255fd78aa
+2650-2659 5a6aa7a967106cf2 af825458292988a8
+2660-2669 dcef03adf4eb0fb2 27d47fb6a567016b
+2670-2679 b5ab24004a2380bf 973a8a08ada4a2a8
+2680-2689 2647f5b8551ee408 31468aec8df439ba
+2690-2699 dececbf9f4d7e4ee d5808ef0822bb34b
+2700-2709 8ed173aa3bb3e978 8f4cdeb54383a4c2
+2710-2719 ef438a0504675d9e 0113d930b0dff1e9
+2720-2729 6944641a49203e29 127310716ca776a5
+2730-2739 00d258d0bb8b1bf6 68867721fa1ea078
+2740-2749 c09bb87c87efaf04 b2d41c1f65d3be23
+2750-2759 eb7df9380bb32f69 41a1178e8c7ed3d5
+2760-2769 04b5db75a0914506 77cf9f1de31c38d2
+2770-2779 4ca469cf65851a21 953005365502cd02
+2780-2789 648ec0986f434f3c 7013efe6c3eb5ead
+2790-2799 72b72832379e697f 82670341d98f3da3
+2800-2809 d35f189e98c94308 5320ca1dbe07b0ed
+2810-2819 b439496a8dc271e4 b62ba3b54b22434a
+2820-2829 93d90f4581ebeadf fd541b192a9bdc2f
+2830-2839 995f0e749038f4a3 c64124ed2ff521b3
+2840-2849 18c1114b7e5fcd24 f5d715f5eb46afc2
+2850-2859 856a8277a2d15f2d 341008bcba6ac54a
+2860-2869 738d465908dc3142 24fe09b405c20302
+2870-2879 6aac9af43ac5e5f4 edcf71ae1e8d83c5
+2880-2889 7db38e4466ff9dee 0bd808119f3a462b
+2890-2899 d12e9754ebef26dc 719d862bf5ad114b
+2900-2909 72effc2f1d455492 6c1b50160211ac72
+2910-2919 08ff30de2e060659 2e0e81d0bec8e027
+2920-2929 46ae5c31ffd3c5f2 b52b2c830a339bf4
+2930-2939 c89d5c692cd391bf 2a88e53cebde77e9
+2940-2949 26a69703c3b353fd eff461fc634eabe0
+2950-2959 7d6569f91c04e308 89070a41968488c8
+2960-2969 c81ca590d672f7cd 021853c02aad3964
+2970-2979 18d909d4858d5616 cc6aabddec38fb2c
+2980-2989 902da9471b58f3e6 b54ee00d5d2caec9
+2990-2999 8243329515cd22e5 2a18374ca4e0e4d0
diff --git a/crates/socket-patch-core/tests/equivalence/crawl_cargo_sources.golden b/crates/socket-patch-core/tests/equivalence/crawl_cargo_sources.golden
new file mode 100644
index 000000000..fbf194271
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/crawl_cargo_sources.golden
@@ -0,0 +1,66 @@
+# One seeded crate source tree, crawled.
+# <case> <input digest> <output digest>
+0 0789b0fe8b73ff39 26407d0bc68ec44f
+1 8bac33558d2e9c8a 1c6204aa67affd23
+2 334bc0a5ba5e0056 95fb19c76b6253b2
+3 ed9843cdccf5d2f5 ae8d5d10e962d0e5
+4 3a80295d499c52d1 42dac0066a840f62
+5 4e125142985d6dbb 4f53cda18c2baa0c
+6 1d11cc4b9ea1dc0d 4f4c3c5a87ddbf8a
+7 3a8cdd959d248d21 e4e1bd3d1c0dcafc
+8 0e54a4ca2380d229 ec72075a9aa2f2ff
+9 7dd7687e80d48f22 5b07dbbd4d12dea8
+10 1c2a95c1dcc301b2 83cdac95f0d5fbe5
+11 fce2a9624e41d8e4 2e11a56c24d2a20f
+12 429f723ce8e5a3bd 9e7381a2686cbe42
+13 50f887399b68e021 8e835d8347df9a85
+14 abdc31e79f3b17b2 7cdf2e446f7df102
+15 b6b6d92bfbe487b1 932027f62b0faae7
+16 5203efc6092a4f49 1b8a15f18f4f512d
+17 0b66e5dc06bb2db3 70abd289095a42c0
+18 e9940f05110f39de a78cf316bac0eefb
+19 40a040eef2a66e72 19da56940c131faf
+20 c67bd7f2dc3c5abf 7eccc6a15afb7dd4
+21 ad0111618920c3be b991cb2f8d95107a
+22 8613465a2a5b00b0 271162fec3450d38
+23 7c4227f4c13d9cdb b790937907a0a884
+24 d9ee84bc98d5c20c de7dbb8f9f7df675
+25 0f810904ad2b699a 21aaa408e25a9f70
+26 fe27fb2b759ee457 690d94cc02b1c57b
+27 a5531d9628b39668 4675c971e48988c9
+28 6832492e0914c1df 2b6d084c9fa89f0e
+29 0d36ad3df7134460 6bcee1ce2cb1c5b4
+30 85b1ec5ebe8de0e6 f5e92dbd85e88e4a
+31 1c9fde0f9c823576 02bbd127070319f0
+32 092e40669b384b51 60ec706237b1b295
+33 4bf3e8e64b011eb7 c7e09e300f6c1c68
+34 ec210082c86d62f5 4a50eed552242ab3
+35 b390dd445a292a53 93d66ea9d9d7e1c5
+36 2c1f6008abadfd74 09471d64aac5a7be
+37 a971203608212569 a02305d78a3ba2c0
+38 3f5b96371387fddc 5c521fb090047b81
+39 2b064398698adfa2 a32181ccbe73d0bd
+40 aec74fa566406c8a 8b90b6b7308dc8c6
+41 1153d86dfc58efb8 81a9fe3cf62777f9
+42 06186b908205f06b 4b2d7bc4f02fa53d
+43 5aff639d08feb168 b42d8bce860dc1b4
+44 8bf60977ce4a90ad aecf0be7223e9559
+45 e5e367cf4e4c30bb 183174b984fad6eb
+46 2ef905ea70d3c74f 7f7b5ac489348046
+47 5953f2b486633801 f01725d6c91e9397
+48 d7a37c8ea8b08c98 4f53cda18c2baa0c
+49 a143f7b3b011c6fd 35159302f163c290
+50 c83513d4747c1154 ca560c122aa1d9a2
+51 b0d4bf4641ac2026 bde1d5d64ec04489
+52 674927cd33943bfb 43ec5342779e682f
+53 9080a3f0502d620e 618fd9f82adbc40f
+54 54d4a010e58a81a0 587fed7b06512843
+55 c512ebe218d497cf b42d8bce860dc1b4
+56 4f122e1df4dc5d91 08c09ce10b8fd1ab
+57 71e1c312c060b652 2946402fb230caa5
+58 c86ddcfede19c23e 4f53cda18c2baa0c
+59 25e239384415c870 938e97cb0010242f
+60 e1bd11aa60296f0a 5e6421bf4400360e
+61 556b26b148d45ece 1155e51f7d4cf976
+62 d1f951b1df677147 6598c35bd955be15
+63 c86ddcfede19c23e 4f53cda18c2baa0c
diff --git a/crates/socket-patch-core/tests/equivalence/crawl_cargo_vendor.golden b/crates/socket-patch-core/tests/equivalence/crawl_cargo_vendor.golden
new file mode 100644
index 000000000..2060c02b6
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/crawl_cargo_vendor.golden
@@ -0,0 +1,3 @@
+# A seeded Cargo project vendor/ tree, crawled locally.
+# <case> <input digest> <output digest>
+7 a815ebc03ce3ff32 3cb969673348ada9
diff --git a/crates/socket-patch-core/tests/equivalence/crawl_composer_vendor.golden b/crates/socket-patch-core/tests/equivalence/crawl_composer_vendor.golden
new file mode 100644
index 000000000..0f540b5c6
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/crawl_composer_vendor.golden
@@ -0,0 +1,66 @@
+# One seeded vendor/composer tree: crawl_all, then find_by_purls.
+# <case> <input digest> <output digest>
+0 481ee51952ffe8dc 23ee912aa8ee0590
+1 27509876a53013ca f5cfd2c59c23469b
+2 bd5be17b059039a5 3987f0890a3ec641
+3 86453c294c4f9c99 2081bed25e05ae17
+4 3720aab1955f47ce b8f25b20ecb3409f
+5 85d8f5e067d99b6c 6b25fcd85bbb1433
+6 9b83c4e955737a81 11759140a0efd967
+7 cf8ab23dbaec622a bca2667df0003231
+8 3c42accbb09dd278 35332e95e2bed8a3
+9 0db6aa6600b9357f 10a4beead0128ce6
+10 81f5c24a4fc44a9a 3c516ad10b7bdeef
+11 3f434a118dc59d0a b239673923670c96
+12 6119ea4e4da0228a 5eed25f9aa1c6813
+13 f80159f839dd2fc7 c9837778da4dbbe7
+14 3570e2e9003ca1a5 863955e31c1a9bd9
+15 5d8b9d6475bcd81c f08502a70190fb06
+16 a3b70f7a2c9fdb7c bf47bbb8c8d108f4
+17 a229a6dbc1567436 eb4a332864b1cd1d
+18 a1f6345d930155ad ae98db734423df60
+19 99bb5b30993fdbf8 11e9eda7d6b2cd42
+20 131f2d6a2dc1af9a d097456cc89f52cd
+21 12eebac61ad8ae13 2a219b6ce8a6de9d
+22 0c9a06f215eac815 4772996b67bc47ee
+23 e0f36e5724c4fb1d 88251caf97a1c1d4
+24 0f7e0776633c49c1 59ebe69baf1858b6
+25 c468482bc9609750 adcd2213921370d3
+26 f30333ab141b9a00 6b4ff2abfeb1cebb
+27 ce71fb28c4d3615b 89ea06f0d32e6d30
+28 e254ce011dd6da66 71d95338d2b8a58e
+29 7a0955d1bee8f873 5eed25f9aa1c6813
+30 727a63507e938cc2 a9c3a7259f18a266
+31 d9779f1f2851771d 5eed25f9aa1c6813
+32 128f30148c0558fa a4e55a181be914e9
+33 61ca773f3c054e9b 1ab87b7c322707e3
+34 06fe2ec9fc3bf501 d33b8fa533247d93
+35 1a34b1bd4e469182 b30be1ffa61304cf
+36 8bbd9fc3e83d9407 5eed25f9aa1c6813
+37 e2fe845fbb4c290d 428a34dc27031df6
+38 c74d445edcf070cb 6d72e0d5dab5184a
+39 77dca03d65926964 e9e4ce73d722162e
+40 fbc66261e0c10d53 5eed25f9aa1c6813
+41 4ae2a78ca42d0ce4 ec579eb182f1396a
+42 b2e6ea2a7a8c52bc 063a130d58371e62
+43 0232d7bb196cc1b3 0895447b7cbdfd1e
+44 fa6b981e90a5572e 2f66b04582d2032f
+45 a294d01ec0ba8123 a08c74681bd99240
+46 eb9588b645aecf1f 46825b82fd7f7565
+47 237a52594c771ccf 4dfd3ababe9f0b10
+48 6544ab8f35963a3f a122194b5da3390c
+49 9531acad33a2345c e149928e30dcecfa
+50 a72a53201cf0da6e c6950f2efafad17a
+51 1fbfc38110d4ea4b 9c49d33a48bffbf1
+52 468b8f772dd06fcf f0dde94279624310
+53 01e076cf13883c93 4de1a998178a6d6c
+54 99b991038eb415fa 5eed25f9aa1c6813
+55 40b779cca6fcabd6 5eed25f9aa1c6813
+56 e671ec5361b7fab1 2d5e9efb8713dbdd
+57 4d17a695c60bcf12 af7cc3cf949dcf13
+58 7a0955d1bee8f873 5eed25f9aa1c6813
+59 7a0955d1bee8f873 5eed25f9aa1c6813
+60 d3ae9f865ec4b638 ea2d4b73350194b8
+61 42fd3da563789da5 5164e7f6f430a622
+62 5926efccfc90678a 5eed25f9aa1c6813
+63 1e34e88cfa154309 bad6fbdd33aafef3
diff --git a/crates/socket-patch-core/tests/equivalence/crawl_go_absent_root.golden b/crates/socket-patch-core/tests/equivalence/crawl_go_absent_root.golden
new file mode 100644
index 000000000..0deb8c207
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/crawl_go_absent_root.golden
@@ -0,0 +1,3 @@
+# An absent GOMODCACHE root.
+# <case> <input digest> <output digest>
+absent_root 74234e98afe7498f 5eed25f9aa1c6813
diff --git a/crates/socket-patch-core/tests/equivalence/crawl_go_module_cache.golden b/crates/socket-patch-core/tests/equivalence/crawl_go_module_cache.golden
new file mode 100644
index 000000000..e3219fb42
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/crawl_go_module_cache.golden
@@ -0,0 +1,50 @@
+# One seeded GOMODCACHE tree: crawl_all, then find_by_purls.
+# <case> <input digest> <output digest>
+seed_0 09dc43c2bd39e22f 5eed25f9aa1c6813
+seed_1 00772a0786c4f36a 5eed25f9aa1c6813
+seed_2 e1509a6dfaeb9d05 619799f8074ddd2e
+seed_3 d70377a81b173ac6 6efa72d795922324
+seed_4 c7c8df366af126d5 8287e2010e95b57a
+seed_5 293d9b53851181fc 79d8bcb340b3a6e0
+seed_6 3b35080f289a936f 5eed25f9aa1c6813
+seed_7 d30e64fe21a8b734 82c8498a74955ed8
+seed_8 1c3ecb63d8547fa6 c77270617c92afde
+seed_9 6ef37162cf4a9866 ac48d04966a2fe4a
+seed_10 00772a0786c4f36a 5eed25f9aa1c6813
+seed_11 217c77d756638d79 563b76b1f6ef7fb9
+seed_12 d17d424e043f6cf0 5eed25f9aa1c6813
+seed_13 c22a392f48d0cb5a b834592fa44e36fb
+seed_14 76c86c0677f93138 5224fd044a742e29
+seed_15 294f44ea2c246e7c e35b3c196c32933b
+seed_16 279643999c89b149 680b0ad0add4f786
+seed_17 75c24791e38b2505 9d81a409eb191f76
+seed_18 00772a0786c4f36a 5eed25f9aa1c6813
+seed_19 5679325c7877931f 5eed25f9aa1c6813
+seed_20 b945a5ad20fef508 4721164372d3867a
+seed_21 d966f4c16ae89283 7a7c9305f573dfcf
+seed_22 4ba673f6c1ffc0fc 4503e988627f2258
+seed_23 0895264a85e189cb 0a7b2e12f26935d0
+seed_24 00772a0786c4f36a 5eed25f9aa1c6813
+seed_25 00772a0786c4f36a 5eed25f9aa1c6813
+seed_26 a8bd6da0ecd79da3 30b42134e8432116
+seed_27 ad9a096c40156a09 a0447b566366142e
+seed_28 c558e9381eec8498 177ac34fd1f53863
+seed_29 b692ddc36361d23c 3cb2e0a7ededc924
+seed_30 d7e3db2a7601177f 5eed25f9aa1c6813
+seed_31 00772a0786c4f36a 5eed25f9aa1c6813
+seed_32 bd7288f41494818b 4709622ab336b624
+seed_33 b4d20d774545956e 2c7e345753062082
+seed_34 4a3cabc641101595 82c8498a74955ed8
+seed_35 e2a1cce0ad0e106b d07d7ee9c5dcf23a
+seed_36 00772a0786c4f36a 5eed25f9aa1c6813
+seed_37 9b0b0506e709a900 f44d704466afc919
+seed_38 c8eea4a77e6b5cfe e68639bf967e5bde
+seed_39 4f334c24c990696c 711a211f8450fbb4
+seed_40 d17d424e043f6cf0 5eed25f9aa1c6813
+seed_41 50c68eb563e66117 37769ceabaa50bef
+seed_42 75dc7908ca2a18a3 8102d0fe4af8ac84
+seed_43 3ce27d6fe36eecea 8435a1ad1d43a4b3
+seed_44 d30e64fe21a8b734 82c8498a74955ed8
+seed_45 97114e2e0ddb3ea6 69f0ffcc0e2397c9
+seed_46 fad4e893f24a9a20 5cb2d57e0c7b6e2b
+seed_47 1cea6d8c747a8291 7b64f1a0b048997e
diff --git a/crates/socket-patch-core/tests/equivalence/crawl_maven_consistent.golden b/crates/socket-patch-core/tests/equivalence/crawl_maven_consistent.golden
new file mode 100644
index 000000000..4b32801a1
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/crawl_maven_consistent.golden
@@ -0,0 +1,66 @@
+# One seeded ~/.m2 repository whose POMs agree with their dirs, crawled.
+# <case> <input digest> <output digest>
+0 83185147d1312c61 c27298d200b3dc0e
+1 3ae7d693d22a2bc4 4f53cda18c2baa0c
+2 6d5d0daf2c58c795 92e8c5c82527e482
+3 7882c3ee0e0577c8 9066b78e07521109
+4 184d09b2a9c71c1d 3251f4abb2b78a61
+5 55d474e3ffb547fe f043128a968499cd
+6 c9f5f5ee8be09506 611a683040dc53d1
+7 40d9fde22c82df2d a0346060bfe11d31
+8 5ed72b6859fb88cf c3d04a179319ec00
+9 1989d3ce6d60ccc8 53a58ed0288b0ead
+10 c1951452b4bea696 16453eca18438dbf
+11 c89f440d0033e327 ec17a49a388e3dc9
+12 dcd0dbf319356eaa fdab50efeee9816f
+13 f7664df72a4c7bff 02ec0aae539e7dec
+14 28ff5e5c3fa4168f ae256498106d1869
+15 a7cddacabbabbcc8 a1349576e333b951
+16 2b022dea196c0759 631514d669b583b6
+17 56481c19967eda63 67ed98779ef0094e
+18 3ae7d693d22a2bc4 4f53cda18c2baa0c
+19 d22982401d63c72f 5eae4d1326caa792
+20 4b6e0dc9f3273a89 1d4d63bf11b386fc
+21 2b90bb6b6b334f7f 1d0de1f3f7b16133
+22 f9fb106aca5b4abe 74c1c68a16f0f1e6
+23 7ab1eb3f97b4b205 f38bd759e63b6a04
+24 6e1b34117f644804 806682cc4e106046
+25 3ae7d693d22a2bc4 4f53cda18c2baa0c
+26 aee88a61f2440dbe 39d56051cb3bf3d9
+27 20eba6ee1b4c8a5c f8570186c608dfe0
+28 ecd34acbe2d9f61a 63a2cefb8d003327
+29 b9f82b40d0730e3a 152bafc06a1bc3f8
+30 333cc7bdf7764e14 e34675ebc50f1f4c
+31 34c4efc2186d4884 9a832c0f61089ea4
+32 67e1f3a54ab15478 76c1e5a74d52ff50
+33 cfda0865198f2cee 37499f6e20710bc9
+34 3da4180d551416ee e261f0ae7c2886f4
+35 b4c5060b4bf5e79a 2ef03f759bf644ad
+36 d9c3733f3e5ea710 7fe3696c1a2825ad
+37 166abb4840b02066 cb7dbd277f46cc1e
+38 cbdeca620e029c9e f5c39a7fecb7d967
+39 4c56ac7be8e6cce9 b578620afea9a905
+40 6e60a101a67bc65e f4a6a52cd1cb4874
+41 d86304526feee83b 35216dfdf9f41281
+42 837e7c80e830f846 72255ac587d2f3dd
+43 3113d81e4b804bbe 3b0dc70c5bf85a3b
+44 34b7036fe87982d8 51886e3c0da09cc3
+45 34682e1bb48d59fc 7aa48fc0a5a6ae76
+46 458da35494f15f79 48fe121af1f3b26c
+47 5f9fbd69acae51fd e0bbf43efef9b495
+48 d84adc28a627e49c e69ca7268c7538c2
+49 cb2f6dc03fb2e8ad 2caa518b926e9140
+50 91218a0318c84c33 542c79207bfcfab8
+51 0e2b582c1d294bba c349d1e525cc3fbb
+52 f7d27badc4ba3eec f931d8d02eec2153
+53 16705daea7213a94 36530719e0d429df
+54 c1929ddebf99ed81 efee665e3135a883
+55 6dd2cc4ce022d960 d4327690b20c733c
+56 6ed5305060283e6b 29e0dcc28f618d97
+57 45447e9dc92cade0 3af6a0a5dd177e65
+58 3ae7d693d22a2bc4 4f53cda18c2baa0c
+59 31993051ed82029e 7e6bbaf00c9433ba
+60 b7cd6723d50daa88 4a9e5e31b989bb3a
+61 8e6aab531a34d949 d48045c3756653dc
+62 f1496c0187c801ba 6c1ba12ad6e6052f
+63 b2e5c1f97b7da4c8 fdd406a1137ec3c0
diff --git a/crates/socket-patch-core/tests/equivalence/crawl_maven_misrooted.golden b/crates/socket-patch-core/tests/equivalence/crawl_maven_misrooted.golden
new file mode 100644
index 000000000..d58503833
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/crawl_maven_misrooted.golden
@@ -0,0 +1,357 @@
+# One seeded ~/.m2 repository, crawled from a misplaced root.
+# <case> <input digest> <output digest>
+0/ 83185147d1312c61 a71304c85035417c
+0/repository/org 83185147d1312c61 8be53deb0d5b8a83
+0/repository/com 83185147d1312c61 e6a175052ff9b719
+0/repository/io 83185147d1312c61 d549186a0a371376
+0/repository/org/apache 83185147d1312c61 0f0825f5d1f4b700
+0/repository/com/google 83185147d1312c61 98064dc329ea4f04
+1/ 3ae7d693d22a2bc4 4f53cda18c2baa0c
+2/ 6d5d0daf2c58c795 3f501c3d7d4aa0a7
+2/repository/org 6d5d0daf2c58c795 2987bb8101517ad0
+2/repository/com 6d5d0daf2c58c795 4936683c859b18ae
+2/repository/io 6d5d0daf2c58c795 f681b96f337e64d0
+2/repository/org/apache 6d5d0daf2c58c795 ba1e19ac7c744bad
+2/repository/com/google 6d5d0daf2c58c795 4936683c859b18ae
+3/ 7882c3ee0e0577c8 fc06dce5178766dc
+3/repository/org 7882c3ee0e0577c8 db0460f62a7ff49c
+3/repository/com 7882c3ee0e0577c8 83f40b6ee567a416
+3/repository/io 7882c3ee0e0577c8 a4032586b953e8fd
+3/repository/org/apache 7882c3ee0e0577c8 9ed6e24533d903e5
+3/repository/com/google 7882c3ee0e0577c8 4674f14eb046f592
+4/ 184d09b2a9c71c1d fa9432f0ec915656
+4/repository/org 184d09b2a9c71c1d 88f6a59bcff150c8
+4/repository/com 184d09b2a9c71c1d 719b3014757e8a96
+4/repository/io 184d09b2a9c71c1d b53146816a67f697
+4/repository/org/apache 184d09b2a9c71c1d 211fac8876e484cf
+4/repository/com/google 184d09b2a9c71c1d 9d234653c04cb805
+5/ 55d474e3ffb547fe c80eee3f38836f1f
+5/repository/org 55d474e3ffb547fe b8d001c2b8f9c8b0
+5/repository/com 55d474e3ffb547fe d40ff808b713af79
+5/repository/io 55d474e3ffb547fe 16bbf52ab9465038
+5/repository/org/apache 55d474e3ffb547fe 75520f619fe067c0
+5/repository/com/google 55d474e3ffb547fe cb204ead909772db
+6/ c9f5f5ee8be09506 ea7c43fd9289085b
+6/repository/org c9f5f5ee8be09506 8147cd641759a00f
+6/repository/com c9f5f5ee8be09506 e52c2847409a3e86
+6/repository/io c9f5f5ee8be09506 ee32a06fc2bd9699
+6/repository/org/apache c9f5f5ee8be09506 7a1a7ec8298344df
+6/repository/com/google c9f5f5ee8be09506 696f5b2db94323d9
+7/ 40d9fde22c82df2d 0d7c3583ed62d137
+7/repository/org 40d9fde22c82df2d b5e4928bbceeebb1
+7/repository/com 40d9fde22c82df2d db60c32c4dc30dac
+7/repository/io 40d9fde22c82df2d 85c811a6814bdaf4
+7/repository/org/apache 40d9fde22c82df2d af72a76ea431c997
+7/repository/com/google 40d9fde22c82df2d 139185fc7b71cf5a
+8/ 5ed72b6859fb88cf 879f0c2ba500c813
+8/repository/org 5ed72b6859fb88cf 2da03ad46c7fc426
+8/repository/com 5ed72b6859fb88cf 158d805263fc0c65
+8/repository/io 5ed72b6859fb88cf ee6c0e4d39a4e279
+8/repository/org/apache 5ed72b6859fb88cf 93828b506baff47d
+8/repository/com/google 5ed72b6859fb88cf 0188e76580349c97
+9/ 1989d3ce6d60ccc8 5558be13299029b2
+9/repository/org 1989d3ce6d60ccc8 2b6e4b1286e9b600
+9/repository/com 1989d3ce6d60ccc8 c767da1e27822b78
+9/repository/io 1989d3ce6d60ccc8 45dde3fcdf7abd83
+9/repository/org/apache 1989d3ce6d60ccc8 99d05bfef6a3eec1
+9/repository/com/google 1989d3ce6d60ccc8 ccdf4b68fcd972d4
+10/ c1951452b4bea696 85fc00aa66d34c5f
+10/repository/org c1951452b4bea696 88197fe9d77578bf
+10/repository/com c1951452b4bea696 d1227d2c1fe65ce9
+10/repository/org/apache c1951452b4bea696 65df3c08604d6f6c
+10/repository/com/google c1951452b4bea696 bb3b73ca733e4fd3
+11/ c89f440d0033e327 c25d3c0cf1558716
+11/repository/org c89f440d0033e327 5f570eec669d4e03
+11/repository/com c89f440d0033e327 32042fe53a328f52
+11/repository/io c89f440d0033e327 7e692302141a7b6f
+11/repository/org/apache c89f440d0033e327 6c80335d07a02e76
+11/repository/com/google c89f440d0033e327 45b5c24acc80e4b2
+12/ dcd0dbf319356eaa b565822b197f0332
+12/repository/org dcd0dbf319356eaa 25266133c46b0df2
+12/repository/com dcd0dbf319356eaa 0f2094596889dd59
+12/repository/io dcd0dbf319356eaa 5ab41a117c0eaa23
+12/repository/org/apache dcd0dbf319356eaa 25266133c46b0df2
+12/repository/com/google dcd0dbf319356eaa aa80fceecc0220ca
+13/ f7664df72a4c7bff ef0b1cc104dab6ce
+13/repository/org f7664df72a4c7bff 6297d43fb8e3052d
+13/repository/com f7664df72a4c7bff 8bfe2e0695cd7b1c
+13/repository/io f7664df72a4c7bff 3fd8de76cb50314b
+13/repository/org/apache f7664df72a4c7bff 989a8b617fa4db56
+13/repository/com/google f7664df72a4c7bff 4169ba0a767f564a
+14/ 28ff5e5c3fa4168f 00a01c97323f3e1d
+14/repository/org 28ff5e5c3fa4168f f8b00e6bc927b366
+14/repository/com 28ff5e5c3fa4168f 266d52f552d17b6c
+14/repository/io 28ff5e5c3fa4168f 2bc110e78e754e40
+14/repository/org/apache 28ff5e5c3fa4168f 327348b9cae2ce58
+14/repository/com/google 28ff5e5c3fa4168f d78d795efc89cb8d
+15/ a7cddacabbabbcc8 8d22078fe0256c75
+15/repository/org a7cddacabbabbcc8 ee7d5b4bbcf81590
+15/repository/com a7cddacabbabbcc8 26eb419e633df174
+15/repository/io a7cddacabbabbcc8 a3d4f52ad169157d
+15/repository/org/apache a7cddacabbabbcc8 4d9dd798f648c0eb
+15/repository/com/google a7cddacabbabbcc8 517faa777350fab4
+16/ 2b022dea196c0759 5813f23d4a560667
+16/repository/org 2b022dea196c0759 6541795e3c9508a2
+16/repository/com 2b022dea196c0759 20e75af30aa9070c
+16/repository/io 2b022dea196c0759 36d75c74fbf84937
+16/repository/org/apache 2b022dea196c0759 0bb8e8d849c64583
+16/repository/com/google 2b022dea196c0759 f375dc3054f19999
+17/ 56481c19967eda63 3211ea46bdffedc1
+17/repository/org 56481c19967eda63 fc53bd7dff7b6553
+17/repository/com 56481c19967eda63 4f53cda18c2baa0c
+17/repository/io 56481c19967eda63 e1d6105b6705a88d
+17/repository/org/apache 56481c19967eda63 15432e01c8d11334
+17/repository/com/google 56481c19967eda63 4f53cda18c2baa0c
+18/ 3ae7d693d22a2bc4 4f53cda18c2baa0c
+19/ d22982401d63c72f 260ae2554c22843a
+19/repository/org d22982401d63c72f e31694c060810bc8
+19/repository/com d22982401d63c72f 98c3f8932c6af6ad
+19/repository/io d22982401d63c72f 8d2178a38389c045
+19/repository/org/apache d22982401d63c72f e31694c060810bc8
+19/repository/com/google d22982401d63c72f b5aecce8321464c5
+20/ 4b6e0dc9f3273a89 5cd451bba627e7ab
+20/repository/org 4b6e0dc9f3273a89 e2a168eb5d8b9367
+20/repository/com 4b6e0dc9f3273a89 ea9899706b5163d7
+20/repository/io 4b6e0dc9f3273a89 a2be4cebe49cb281
+20/repository/org/apache 4b6e0dc9f3273a89 09bd89df59e27687
+20/repository/com/google 4b6e0dc9f3273a89 d19b557eb168b3f3
+21/ 2b90bb6b6b334f7f 50cff148046ccc47
+21/repository/org 2b90bb6b6b334f7f 4ad58e3cd3c0c473
+21/repository/com 2b90bb6b6b334f7f 56a072ea97443f47
+21/repository/io 2b90bb6b6b334f7f a25ee8f9d6f00761
+21/repository/org/apache 2b90bb6b6b334f7f 4ad58e3cd3c0c473
+21/repository/com/google 2b90bb6b6b334f7f 8451e87e6b899f13
+22/ f9fb106aca5b4abe cfa45d2524492f9e
+22/repository/org f9fb106aca5b4abe a5fadba5add8aec1
+22/repository/com f9fb106aca5b4abe aad2df5bbf9ae28a
+22/repository/io f9fb106aca5b4abe 70dd3a9bbb6a5e62
+22/repository/org/apache f9fb106aca5b4abe 74d8d4007b48540b
+22/repository/com/google f9fb106aca5b4abe 2468fb7e6bfc4bfc
+23/ 7ab1eb3f97b4b205 b6055192d11532a4
+23/repository/org 7ab1eb3f97b4b205 0b0c9f81cc3453bf
+23/repository/com 7ab1eb3f97b4b205 964e6c7d70f23769
+23/repository/io 7ab1eb3f97b4b205 497dfc941da50f4a
+23/repository/org/apache 7ab1eb3f97b4b205 a8a87a4d945b401c
+23/repository/com/google 7ab1eb3f97b4b205 49980d320d5fc6b0
+24/ 6e1b34117f644804 bfa6a6778f7996de
+24/repository/org 6e1b34117f644804 b8f1296b857d981d
+24/repository/com 6e1b34117f644804 64d8153c379e8db5
+24/repository/io 6e1b34117f644804 42ced11487a4f43e
+24/repository/org/apache 6e1b34117f644804 cc41a238dff9d490
+24/repository/com/google 6e1b34117f644804 4132c43999e9d5d6
+25/ 3ae7d693d22a2bc4 4f53cda18c2baa0c
+26/ aee88a61f2440dbe bfc98950e2ff6f95
+26/repository/org aee88a61f2440dbe 4f53cda18c2baa0c
+26/repository/com aee88a61f2440dbe 008466e04349d1ac
+26/repository/org/apache aee88a61f2440dbe 4f53cda18c2baa0c
+26/repository/com/google aee88a61f2440dbe 488f70405d310bb7
+27/ 20eba6ee1b4c8a5c 517670e7b5486ec0
+27/repository/org 20eba6ee1b4c8a5c 4c5887c54d34b1d5
+27/repository/com 20eba6ee1b4c8a5c 1edaa0736638ed84
+27/repository/io 20eba6ee1b4c8a5c 22f8d5c6de070f19
+27/repository/org/apache 20eba6ee1b4c8a5c 707a8fef61845e66
+27/repository/com/google 20eba6ee1b4c8a5c e79649991c29ba5c
+28/ ecd34acbe2d9f61a 780b0257da62e1cb
+28/repository/org ecd34acbe2d9f61a 4ab53a2da4225100
+28/repository/com ecd34acbe2d9f61a 4ad4baf33da5ebc8
+28/repository/io ecd34acbe2d9f61a 83492b0e721c5659
+28/repository/org/apache ecd34acbe2d9f61a 0e0b8ff56fb77423
+28/repository/com/google ecd34acbe2d9f61a a971f93fea0c322c
+29/ b9f82b40d0730e3a 58fb7deabc1d25c7
+29/repository/io b9f82b40d0730e3a dc2cb0580f07669d
+30/ 333cc7bdf7764e14 69be247cc02cc775
+30/repository/org 333cc7bdf7764e14 d92b47d474e0ff3c
+30/repository/com 333cc7bdf7764e14 e00d719658a957e1
+30/repository/io 333cc7bdf7764e14 2990c0f6d2e3554b
+30/repository/org/apache 333cc7bdf7764e14 a6b35bb6a35446c7
+30/repository/com/google 333cc7bdf7764e14 8010b6e9239548a8
+31/ 34c4efc2186d4884 b60e80d12522d1bd
+31/repository/org 34c4efc2186d4884 cadc7e8cae342a21
+31/repository/com 34c4efc2186d4884 fb9bfa15f0e301c5
+31/repository/io 34c4efc2186d4884 09ee21a36f719298
+31/repository/org/apache 34c4efc2186d4884 f481f94ccfd4c1e5
+31/repository/com/google 34c4efc2186d4884 19d9a439234799c1
+32/ 67e1f3a54ab15478 de412c8d492e24a2
+32/repository/org 67e1f3a54ab15478 2d52e9caeb65f3d6
+32/repository/com 67e1f3a54ab15478 5281a0e8c04cbd40
+32/repository/io 67e1f3a54ab15478 f629f0580ad1ae6c
+32/repository/org/apache 67e1f3a54ab15478 2b4d4757962ffdd3
+32/repository/com/google 67e1f3a54ab15478 12604b5268fddc15
+33/ cfda0865198f2cee 35fddec816c2613d
+33/repository/org cfda0865198f2cee f21af7192c04efc0
+33/repository/com cfda0865198f2cee 1f4ab7ebedfd141b
+33/repository/io cfda0865198f2cee 7561d407effd17df
+33/repository/org/apache cfda0865198f2cee cdaf670b34429b5b
+33/repository/com/google cfda0865198f2cee fced9194c59f9347
+34/ 3da4180d551416ee 9e2cf4b26cce5036
+34/repository/org 3da4180d551416ee 88a4911a0fb52ccf
+34/repository/com 3da4180d551416ee 607ba0c14fe4c7fe
+34/repository/io 3da4180d551416ee 02752e0622d5ccc9
+34/repository/org/apache 3da4180d551416ee 9c6582cad449bb5b
+34/repository/com/google 3da4180d551416ee 9f11b123efc33af6
+35/ b4c5060b4bf5e79a 636e90de0a26bca9
+35/repository/org b4c5060b4bf5e79a b22728486ed404bf
+35/repository/com b4c5060b4bf5e79a a5518e136fab400e
+35/repository/io b4c5060b4bf5e79a 99059b326317540e
+35/repository/org/apache b4c5060b4bf5e79a e7a66eaabc426dde
+35/repository/com/google b4c5060b4bf5e79a 99d91e64704e1968
+36/ d9c3733f3e5ea710 75f35b17bea558aa
+36/repository/org d9c3733f3e5ea710 52629f7058e6e3d2
+36/repository/com d9c3733f3e5ea710 748a130317093d92
+36/repository/io d9c3733f3e5ea710 4b14ae2f88ff979d
+36/repository/org/apache d9c3733f3e5ea710 52629f7058e6e3d2
+36/repository/com/google d9c3733f3e5ea710 34f86376535b0813
+37/ 166abb4840b02066 3af95524a427f535
+37/repository/org 166abb4840b02066 c57b9f04fa3813f1
+37/repository/com 166abb4840b02066 2bb9897649e015b7
+37/repository/io 166abb4840b02066 b828271aa9a17731
+37/repository/org/apache 166abb4840b02066 2e360600483d0b19
+37/repository/com/google 166abb4840b02066 14576a20b438644d
+38/ cbdeca620e029c9e 8a9382fa8af7f368
+38/repository/org cbdeca620e029c9e 1ac4f4526eb7c44f
+38/repository/com cbdeca620e029c9e 4f53cda18c2baa0c
+38/repository/io cbdeca620e029c9e fc4d3052ba0640f8
+38/repository/org/apache cbdeca620e029c9e f434b09e3e034670
+38/repository/com/google cbdeca620e029c9e 4f53cda18c2baa0c
+39/ 4c56ac7be8e6cce9 2e648a04af4184fc
+39/repository/org 4c56ac7be8e6cce9 e5102c595b0b9927
+39/repository/com 4c56ac7be8e6cce9 55ffc202d3b7526a
+39/repository/io 4c56ac7be8e6cce9 e23216c9b5f269d5
+39/repository/org/apache 4c56ac7be8e6cce9 e569758edd22073b
+39/repository/com/google 4c56ac7be8e6cce9 40f0f8771f9ecd63
+40/ 6e60a101a67bc65e 60bdeb92249370b1
+40/repository/org 6e60a101a67bc65e b1bdf553a580e894
+40/repository/com 6e60a101a67bc65e 2df904e4b436b513
+40/repository/io 6e60a101a67bc65e 01949d14fdb95f66
+40/repository/org/apache 6e60a101a67bc65e 90bcb8412ce2d94f
+40/repository/com/google 6e60a101a67bc65e b084b99cbcbe6279
+41/ d86304526feee83b 35216dfdf9f41281
+41/repository/org d86304526feee83b 4f53cda18c2baa0c
+41/repository/io d86304526feee83b 35216dfdf9f41281
+41/repository/org/apache d86304526feee83b 4f53cda18c2baa0c
+42/ 837e7c80e830f846 518895e643927a7c
+42/repository/org 837e7c80e830f846 a8a940e6d8b7ddb6
+42/repository/com 837e7c80e830f846 9be2698cea6e3c34
+42/repository/io 837e7c80e830f846 4cdf9e14c320bf8d
+42/repository/org/apache 837e7c80e830f846 ecbd8e9a49ca7963
+42/repository/com/google 837e7c80e830f846 2d7b917cef12dc43
+43/ 3113d81e4b804bbe bd43767c8df590a7
+43/repository/org 3113d81e4b804bbe 6dfa14b0856a8b23
+43/repository/com 3113d81e4b804bbe b695f223c26cacba
+43/repository/io 3113d81e4b804bbe de8a971e80c014bf
+43/repository/org/apache 3113d81e4b804bbe 4959b0985dddf72b
+43/repository/com/google 3113d81e4b804bbe e492979f86550b99
+44/ 34b7036fe87982d8 969832c017dd2741
+44/repository/org 34b7036fe87982d8 4f53cda18c2baa0c
+44/repository/com 34b7036fe87982d8 4f53cda18c2baa0c
+44/repository/io 34b7036fe87982d8 0136a2841e08a759
+44/repository/org/apache 34b7036fe87982d8 4f53cda18c2baa0c
+44/repository/com/google 34b7036fe87982d8 4f53cda18c2baa0c
+45/ 34682e1bb48d59fc 5b92947be3a7594d
+45/repository/org 34682e1bb48d59fc 4e8098f4a223a8cb
+45/repository/com 34682e1bb48d59fc f623eceece1cca68
+45/repository/io 34682e1bb48d59fc 2e45c9703f790798
+45/repository/org/apache 34682e1bb48d59fc 4e8098f4a223a8cb
+45/repository/com/google 34682e1bb48d59fc e2bc666ba158f6e2
+46/ 458da35494f15f79 3c1fe2ed75756069
+46/repository/org 458da35494f15f79 5e9db7cdcda190c1
+46/repository/com 458da35494f15f79 eb0ae4b074542677
+46/repository/io 458da35494f15f79 4f53cda18c2baa0c
+46/repository/org/apache 458da35494f15f79 4e365fb29f3f2d46
+46/repository/com/google 458da35494f15f79 b1eb90878036f78c
+47/ 5f9fbd69acae51fd 22dd6297a05d74a3
+47/repository/org 5f9fbd69acae51fd 32fbd5276fbbceba
+47/repository/com 5f9fbd69acae51fd 9f6d0e5ab889a1d0
+47/repository/io 5f9fbd69acae51fd 4f53cda18c2baa0c
+47/repository/org/apache 5f9fbd69acae51fd cb81cd68d05a624a
+47/repository/com/google 5f9fbd69acae51fd 89750523973d719a
+48/ d84adc28a627e49c 3bad9d67d052be90
+48/repository/org d84adc28a627e49c d0d9025b393e8319
+48/repository/com d84adc28a627e49c b4b385819582bf1b
+48/repository/io d84adc28a627e49c 35216dfdf9f41281
+48/repository/org/apache d84adc28a627e49c 167e0d5197a9910f
+48/repository/com/google d84adc28a627e49c 832939faf8547b27
+49/ cb2f6dc03fb2e8ad 9868923c09faee3c
+49/repository/org cb2f6dc03fb2e8ad 7fa1c7567b9a99cf
+49/repository/com cb2f6dc03fb2e8ad a290677fd4b7e401
+49/repository/io cb2f6dc03fb2e8ad 4f53cda18c2baa0c
+49/repository/org/apache cb2f6dc03fb2e8ad 8ca9217a5e914a27
+49/repository/com/google cb2f6dc03fb2e8ad 32f4eceedb038380
+50/ 91218a0318c84c33 dcf050eff1d11ecc
+50/repository/org 91218a0318c84c33 f880fda94fe16b27
+50/repository/com 91218a0318c84c33 47ef8dd579883682
+50/repository/io 91218a0318c84c33 b39fdefa6000fa67
+50/repository/org/apache 91218a0318c84c33 6c5c7d9b2f404185
+50/repository/com/google 91218a0318c84c33 16c14b77db190d11
+51/ 0e2b582c1d294bba 051cecee24bc8f8a
+51/repository/org 0e2b582c1d294bba b9d7f249eb46b0e3
+51/repository/com 0e2b582c1d294bba 97e5d710e00e586f
+51/repository/io 0e2b582c1d294bba a422baa2def94db7
+51/repository/org/apache 0e2b582c1d294bba 596ecaaf1ca10ed8
+51/repository/com/google 0e2b582c1d294bba 3b7f6676b5b10d70
+52/ f7d27badc4ba3eec 2d1468be2e57bae5
+52/repository/org f7d27badc4ba3eec cd1233a10848c564
+52/repository/com f7d27badc4ba3eec ee632848925ebfdb
+52/repository/io f7d27badc4ba3eec 105c1dd8bec40412
+52/repository/org/apache f7d27badc4ba3eec cd1233a10848c564
+52/repository/com/google f7d27badc4ba3eec ee632848925ebfdb
+53/ 16705daea7213a94 16977e3caa0fa454
+53/repository/org 16705daea7213a94 33ab9ee916b4f645
+53/repository/com 16705daea7213a94 32d68356c4afe51e
+53/repository/io 16705daea7213a94 3a667530c7ef6120
+53/repository/org/apache 16705daea7213a94 f934392eadd3d7e3
+53/repository/com/google 16705daea7213a94 7eab7f0a3fb69bac
+54/ c1929ddebf99ed81 f0197ce125d81dff
+54/repository/org c1929ddebf99ed81 f4bbbb8e2be1ee18
+54/repository/com c1929ddebf99ed81 f708664485c0320e
+54/repository/io c1929ddebf99ed81 c47f976f27482541
+54/repository/org/apache c1929ddebf99ed81 371081c0e0dba54d
+54/repository/com/google c1929ddebf99ed81 11a0eed6acc32f44
+55/ 6dd2cc4ce022d960 258ccb6ddf0447eb
+55/repository/org 6dd2cc4ce022d960 63da2dded56f3d50
+55/repository/com 6dd2cc4ce022d960 5879ac1867ff615d
+55/repository/io 6dd2cc4ce022d960 9aeaa5ffab1c4afc
+55/repository/org/apache 6dd2cc4ce022d960 8e9046201a466b8a
+55/repository/com/google 6dd2cc4ce022d960 ed8e69468a009151
+56/ 6ed5305060283e6b a14a35d36b15ebff
+56/repository/org 6ed5305060283e6b 4757e759cb2bb8c2
+56/repository/com 6ed5305060283e6b e68adfc5993e9c25
+56/repository/io 6ed5305060283e6b 85c811a6814bdaf4
+56/repository/org/apache 6ed5305060283e6b abd7198e92fbce2e
+56/repository/com/google 6ed5305060283e6b 6ac2b789124d81ca
+57/ 45447e9dc92cade0 6a6c23a6b0729655
+57/repository/org 45447e9dc92cade0 35518a5ff40d9085
+57/repository/com 45447e9dc92cade0 70543d7138284a87
+57/repository/io 45447e9dc92cade0 c679134eb5812a71
+57/repository/org/apache 45447e9dc92cade0 b48383ee0af91cae
+57/repository/com/google 45447e9dc92cade0 46d0c049c2be7326
+58/ 3ae7d693d22a2bc4 4f53cda18c2baa0c
+59/ 31993051ed82029e 9b82fc8f671b2aef
+59/repository/org 31993051ed82029e 37d3a224198a1f09
+59/repository/com 31993051ed82029e d87f5919a76f7b48
+59/repository/org/apache 31993051ed82029e d9a51d50e62baf1a
+59/repository/com/google 31993051ed82029e 454c72696b8f8ce6
+60/ b7cd6723d50daa88 bc205b48358b4f94
+60/repository/org b7cd6723d50daa88 dde41ca18fe070e6
+60/repository/com b7cd6723d50daa88 1037e2b674257aaa
+60/repository/io b7cd6723d50daa88 ac3951cdfd8cdd5d
+60/repository/org/apache b7cd6723d50daa88 dde41ca18fe070e6
+60/repository/com/google b7cd6723d50daa88 59ff33a45ebd2c8e
+61/ 8e6aab531a34d949 5f5afa3fb079b526
+61/repository/org 8e6aab531a34d949 ffb701d8d7016bb9
+61/repository/com 8e6aab531a34d949 4b867e62ab6cada9
+61/repository/io 8e6aab531a34d949 aab2eddec4a28ddd
+61/repository/org/apache 8e6aab531a34d949 ffb701d8d7016bb9
+61/repository/com/google 8e6aab531a34d949 11251de57d7061d5
+62/ f1496c0187c801ba f6733d19c3289000
+62/repository/org f1496c0187c801ba 1d9771b71389dfc9
+62/repository/com f1496c0187c801ba 09b609e11c9be817
+62/repository/io f1496c0187c801ba e35706651dc1108d
+62/repository/org/apache f1496c0187c801ba 088bf01bf2579d5b
+62/repository/com/google f1496c0187c801ba c90792dc54c2b93b
+63/ b2e5c1f97b7da4c8 b634c5c1237cccfc
+63/repository/org b2e5c1f97b7da4c8 bba01dca9f951c91
+63/repository/com b2e5c1f97b7da4c8 b8d7a4239fa34964
+63/repository/io b2e5c1f97b7da4c8 74727eb3aba9f452
+63/repository/org/apache b2e5c1f97b7da4c8 8d3167d8afa17dd1
+63/repository/com/google b2e5c1f97b7da4c8 b8d7a4239fa34964
diff --git a/crates/socket-patch-core/tests/equivalence/crawl_maven_no_pool.golden b/crates/socket-patch-core/tests/equivalence/crawl_maven_no_pool.golden
new file mode 100644
index 000000000..d072a0e4c
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/crawl_maven_no_pool.golden
@@ -0,0 +1,18 @@
+# One seeded ~/.m2 repository, crawled with no walk pool.
+# <case> <input digest> <output digest>
+0 5b5654a14f7365bb c7e1c0a57131c767
+1 3ae7d693d22a2bc4 4f53cda18c2baa0c
+2 ee48f75088974079 5301e71c28240cde
+3 7e7d77307da2ccbb cde58c16c037f5c9
+4 d98b379559cbee49 e689eedb5fdb6ea8
+5 317df3f5558ce26f 08704999b65006f3
+6 11a97846afdffab4 1e082cf6879ab372
+7 40d9fde22c82df2d a0346060bfe11d31
+8 ae42cfa775a23966 248f603a5f0ecb72
+9 91942a182e6f86f0 e6d4e6e5635dd32c
+10 c1951452b4bea696 16453eca18438dbf
+11 0a2d97ca91ac61e4 1accd4fc0d578579
+12 107f6a82d14cf8d0 37eafd42bf6225a3
+13 954630fc63779ed4 0eb6039d9e3a8952
+14 c0700cc52558dd7f 2a437d79c4fa7ed2
+15 6a626c3695e3e954 687ef5b00c0dd8b2
diff --git a/crates/socket-patch-core/tests/equivalence/crawl_maven_parse_chunks.golden b/crates/socket-patch-core/tests/equivalence/crawl_maven_parse_chunks.golden
new file mode 100644
index 000000000..412aa6be0
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/crawl_maven_parse_chunks.golden
@@ -0,0 +1,98 @@
+# One seeded ~/.m2 repository, scanned at one parse chunk size.
+# <case> <input digest> <output digest>
+0/0 5b5654a14f7365bb c7e1c0a57131c767
+0/1 5b5654a14f7365bb c7e1c0a57131c767
+0/2 5b5654a14f7365bb c7e1c0a57131c767
+0/3 5b5654a14f7365bb c7e1c0a57131c767
+0/7 5b5654a14f7365bb c7e1c0a57131c767
+0/4096 5b5654a14f7365bb c7e1c0a57131c767
+1/0 3ae7d693d22a2bc4 4f53cda18c2baa0c
+1/1 3ae7d693d22a2bc4 4f53cda18c2baa0c
+1/2 3ae7d693d22a2bc4 4f53cda18c2baa0c
+1/3 3ae7d693d22a2bc4 4f53cda18c2baa0c
+1/7 3ae7d693d22a2bc4 4f53cda18c2baa0c
+1/4096 3ae7d693d22a2bc4 4f53cda18c2baa0c
+2/0 ee48f75088974079 5301e71c28240cde
+2/1 ee48f75088974079 5301e71c28240cde
+2/2 ee48f75088974079 5301e71c28240cde
+2/3 ee48f75088974079 5301e71c28240cde
+2/7 ee48f75088974079 5301e71c28240cde
+2/4096 ee48f75088974079 5301e71c28240cde
+3/0 7e7d77307da2ccbb cde58c16c037f5c9
+3/1 7e7d77307da2ccbb cde58c16c037f5c9
+3/2 7e7d77307da2ccbb cde58c16c037f5c9
+3/3 7e7d77307da2ccbb cde58c16c037f5c9
+3/7 7e7d77307da2ccbb cde58c16c037f5c9
+3/4096 7e7d77307da2ccbb cde58c16c037f5c9
+4/0 d98b379559cbee49 e689eedb5fdb6ea8
+4/1 d98b379559cbee49 e689eedb5fdb6ea8
+4/2 d98b379559cbee49 e689eedb5fdb6ea8
+4/3 d98b379559cbee49 e689eedb5fdb6ea8
+4/7 d98b379559cbee49 e689eedb5fdb6ea8
+4/4096 d98b379559cbee49 e689eedb5fdb6ea8
+5/0 317df3f5558ce26f 08704999b65006f3
+5/1 317df3f5558ce26f 08704999b65006f3
+5/2 317df3f5558ce26f 08704999b65006f3
+5/3 317df3f5558ce26f 08704999b65006f3
+5/7 317df3f5558ce26f 08704999b65006f3
+5/4096 317df3f5558ce26f 08704999b65006f3
+6/0 11a97846afdffab4 1e082cf6879ab372
+6/1 11a97846afdffab4 1e082cf6879ab372
+6/2 11a97846afdffab4 1e082cf6879ab372
+6/3 11a97846afdffab4 1e082cf6879ab372
+6/7 11a97846afdffab4 1e082cf6879ab372
+6/4096 11a97846afdffab4 1e082cf6879ab372
+7/0 40d9fde22c82df2d a0346060bfe11d31
+7/1 40d9fde22c82df2d a0346060bfe11d31
+7/2 40d9fde22c82df2d a0346060bfe11d31
+7/3 40d9fde22c82df2d a0346060bfe11d31
+7/7 40d9fde22c82df2d a0346060bfe11d31
+7/4096 40d9fde22c82df2d a0346060bfe11d31
+8/0 ae42cfa775a23966 248f603a5f0ecb72
+8/1 ae42cfa775a23966 248f603a5f0ecb72
+8/2 ae42cfa775a23966 248f603a5f0ecb72
+8/3 ae42cfa775a23966 248f603a5f0ecb72
+8/7 ae42cfa775a23966 248f603a5f0ecb72
+8/4096 ae42cfa775a23966 248f603a5f0ecb72
+9/0 91942a182e6f86f0 e6d4e6e5635dd32c
+9/1 91942a182e6f86f0 e6d4e6e5635dd32c
+9/2 91942a182e6f86f0 e6d4e6e5635dd32c
+9/3 91942a182e6f86f0 e6d4e6e5635dd32c
+9/7 91942a182e6f86f0 e6d4e6e5635dd32c
+9/4096 91942a182e6f86f0 e6d4e6e5635dd32c
+10/0 c1951452b4bea696 16453eca18438dbf
+10/1 c1951452b4bea696 16453eca18438dbf
+10/2 c1951452b4bea696 16453eca18438dbf
+10/3 c1951452b4bea696 16453eca18438dbf
+10/7 c1951452b4bea696 16453eca18438dbf
+10/4096 c1951452b4bea696 16453eca18438dbf
+11/0 0a2d97ca91ac61e4 1accd4fc0d578579
+11/1 0a2d97ca91ac61e4 1accd4fc0d578579
+11/2 0a2d97ca91ac61e4 1accd4fc0d578579
+11/3 0a2d97ca91ac61e4 1accd4fc0d578579
+11/7 0a2d97ca91ac61e4 1accd4fc0d578579
+11/4096 0a2d97ca91ac61e4 1accd4fc0d578579
+12/0 107f6a82d14cf8d0 37eafd42bf6225a3
+12/1 107f6a82d14cf8d0 37eafd42bf6225a3
+12/2 107f6a82d14cf8d0 37eafd42bf6225a3
+12/3 107f6a82d14cf8d0 37eafd42bf6225a3
+12/7 107f6a82d14cf8d0 37eafd42bf6225a3
+12/4096 107f6a82d14cf8d0 37eafd42bf6225a3
+13/0 954630fc63779ed4 0eb6039d9e3a8952
+13/1 954630fc63779ed4 0eb6039d9e3a8952
+13/2 954630fc63779ed4 0eb6039d9e3a8952
+13/3 954630fc63779ed4 0eb6039d9e3a8952
+13/7 954630fc63779ed4 0eb6039d9e3a8952
+13/4096 954630fc63779ed4 0eb6039d9e3a8952
+14/0 c0700cc52558dd7f 2a437d79c4fa7ed2
+14/1 c0700cc52558dd7f 2a437d79c4fa7ed2
+14/2 c0700cc52558dd7f 2a437d79c4fa7ed2
+14/3 c0700cc52558dd7f 2a437d79c4fa7ed2
+14/7 c0700cc52558dd7f 2a437d79c4fa7ed2
+14/4096 c0700cc52558dd7f 2a437d79c4fa7ed2
+15/0 6a626c3695e3e954 687ef5b00c0dd8b2
+15/1 6a626c3695e3e954 687ef5b00c0dd8b2
+15/2 6a626c3695e3e954 687ef5b00c0dd8b2
+15/3 6a626c3695e3e954 687ef5b00c0dd8b2
+15/7 6a626c3695e3e954 687ef5b00c0dd8b2
+15/4096 6a626c3695e3e954 687ef5b00c0dd8b2
diff --git a/crates/socket-patch-core/tests/equivalence/crawl_maven_repos.golden b/crates/socket-patch-core/tests/equivalence/crawl_maven_repos.golden
new file mode 100644
index 000000000..76aaa8af7
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/crawl_maven_repos.golden
@@ -0,0 +1,66 @@
+# One seeded ~/.m2 repository, crawled.
+# <case> <input digest> <output digest>
+0 5b5654a14f7365bb c7e1c0a57131c767
+1 3ae7d693d22a2bc4 4f53cda18c2baa0c
+2 ee48f75088974079 5301e71c28240cde
+3 7e7d77307da2ccbb cde58c16c037f5c9
+4 d98b379559cbee49 e689eedb5fdb6ea8
+5 317df3f5558ce26f 08704999b65006f3
+6 11a97846afdffab4 1e082cf6879ab372
+7 40d9fde22c82df2d a0346060bfe11d31
+8 ae42cfa775a23966 248f603a5f0ecb72
+9 91942a182e6f86f0 e6d4e6e5635dd32c
+10 c1951452b4bea696 16453eca18438dbf
+11 0a2d97ca91ac61e4 1accd4fc0d578579
+12 107f6a82d14cf8d0 37eafd42bf6225a3
+13 954630fc63779ed4 0eb6039d9e3a8952
+14 c0700cc52558dd7f 2a437d79c4fa7ed2
+15 6a626c3695e3e954 687ef5b00c0dd8b2
+16 1a7e9e314c4af5af 697f54cd7726b65c
+17 56481c19967eda63 67ed98779ef0094e
+18 3ae7d693d22a2bc4 4f53cda18c2baa0c
+19 20210d2df560de82 aa7639a08098c8fd
+20 803a0fbd33a97439 1d4d63bf11b386fc
+21 6d3d1cef30d3ae73 340ab953f2951e59
+22 e579439e0feefa00 6f50304a47540681
+23 7ab1eb3f97b4b205 f38bd759e63b6a04
+24 4ea7f34c0b9236de bcba33bb0e6b26bf
+25 3ae7d693d22a2bc4 4f53cda18c2baa0c
+26 aee88a61f2440dbe 39d56051cb3bf3d9
+27 dcb76fc05f6c4f96 01a79cce28c17d13
+28 559271e56082798b 2ac797cd92ab556e
+29 b9f82b40d0730e3a 152bafc06a1bc3f8
+30 ef2c07d7f7f14721 e34675ebc50f1f4c
+31 9277538b0ca68ad9 9a832c0f61089ea4
+32 67e1f3a54ab15478 76c1e5a74d52ff50
+33 e8ad95ab962c10a9 37499f6e20710bc9
+34 7870de94ede7cb29 e261f0ae7c2886f4
+35 5cd929154d38e553 2ef03f759bf644ad
+36 8508a9663c02315e f4b4b054b07ac39f
+37 166abb4840b02066 cb7dbd277f46cc1e
+38 cbdeca620e029c9e f5c39a7fecb7d967
+39 c3126b7c5fc1b7f1 dfffaba76f1d3b06
+40 126c91c93ae6a280 b0a3c6e8d2a9e63d
+41 d86304526feee83b 35216dfdf9f41281
+42 837e7c80e830f846 72255ac587d2f3dd
+43 58e3727fdce896ad 19023fe778c318eb
+44 b9a55aa1fea0ebb8 51886e3c0da09cc3
+45 34682e1bb48d59fc 7aa48fc0a5a6ae76
+46 844110f591e06935 48fe121af1f3b26c
+47 70c91166bc4ede3c 02c33ee163a6dd96
+48 cc79c82b6b5a2fd3 4f134a8185ed741c
+49 69e48839abc4fd4b 0e1820b383ff90a1
+50 6c3cc6e6aed1c46a d32ee23b7e07ba8c
+51 5b6e8b24b02bee14 807ce06f3806e86b
+52 f7d27badc4ba3eec f931d8d02eec2153
+53 56db33e29e6a8aba ee50019e34d8d3d7
+54 130204b8b7d55365 1922164f817bfb76
+55 f785d74c4f308a92 8a6d5d0b588e6d15
+56 f08e499aff937dea 81cac89174f186c0
+57 969a8256e04f109a 703322284ffe7a3a
+58 3ae7d693d22a2bc4 4f53cda18c2baa0c
+59 31993051ed82029e 7e6bbaf00c9433ba
+60 14df89c190cdca14 898a9f15a3f2f41a
+61 f35e04ed656c9caf 9c28c739a5edf0bd
+62 0469139586a500e5 a5e78d233078f30a
+63 b2e5c1f97b7da4c8 fdd406a1137ec3c0
diff --git a/crates/socket-patch-core/tests/equivalence/crawl_npm_foreign_identity.golden b/crates/socket-patch-core/tests/equivalence/crawl_npm_foreign_identity.golden
new file mode 100644
index 000000000..6f819a925
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/crawl_npm_foreign_identity.golden
@@ -0,0 +1,3 @@
+# A pnpm store entry whose child names a foreign identity.
+# <case> <input digest> <output digest>
+0 ba28487ce0d2cf60 c5c151111ff2d527
diff --git a/crates/socket-patch-core/tests/equivalence/crawl_npm_kitchen_sink.golden b/crates/socket-patch-core/tests/equivalence/crawl_npm_kitchen_sink.golden
new file mode 100644
index 000000000..2ea93a8e6
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/crawl_npm_kitchen_sink.golden
@@ -0,0 +1,3 @@
+# A hand-built project tree with one of every tricky shape.
+# <case> <input digest> <output digest>
+0 008e2c070f7b2f08 2fc6b55231b85ae1
diff --git a/crates/socket-patch-core/tests/equivalence/crawl_npm_no_pool.golden b/crates/socket-patch-core/tests/equivalence/crawl_npm_no_pool.golden
new file mode 100644
index 000000000..40af4c7d4
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/crawl_npm_no_pool.golden
@@ -0,0 +1,18 @@
+# One seeded project tree, walked with no walk pool.
+# <case> <input digest> <output digest>
+0 9332dd1f4f3b1b5a 42a50cf96cfb1f93
+1 87f0231ea83751e5 9a7b731e9bc9302e
+2 325bedbaf0777e73 235643586618b8e6
+3 bec280310ecbaa49 3ce9b0814058bbc1
+4 71207105c5707828 5ae1625b488b3935
+5 7976073fca1abd2c 73b59f3c4a8c7f71
+6 73c8485afafbbc15 82655d71c989fd9e
+7 0826b0e516996d93 49b1abd2bb54c67e
+8 95c85184f2512021 aad4389f1a42210a
+9 5779eb343cdfbe0c 41371a72e1b32fcb
+10 e940aad08464f8c1 76d8debaa890f0d6
+11 954d051d92e7ec76 9627aec81df769d1
+12 2b97495c5ba2408a 5f0c8138f62257fc
+13 3e20ddb2daa13324 3b3e8a11a33ab72f
+14 57180066dc248df7 c369a3535442d8c8
+15 9a726d40880c7687 4c1d73af9ca8ad7e
diff --git a/crates/socket-patch-core/tests/equivalence/crawl_npm_trees.golden b/crates/socket-patch-core/tests/equivalence/crawl_npm_trees.golden
new file mode 100644
index 000000000..a2b5ec199
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/crawl_npm_trees.golden
@@ -0,0 +1,66 @@
+# One seeded project tree: node_modules roots, crawl_all, find_by_purls and store listings.
+# <case> <input digest> <output digest>
+0 9332dd1f4f3b1b5a 42a50cf96cfb1f93
+1 87f0231ea83751e5 9a7b731e9bc9302e
+2 325bedbaf0777e73 235643586618b8e6
+3 bec280310ecbaa49 3ce9b0814058bbc1
+4 71207105c5707828 5ae1625b488b3935
+5 7976073fca1abd2c 73b59f3c4a8c7f71
+6 73c8485afafbbc15 82655d71c989fd9e
+7 0826b0e516996d93 49b1abd2bb54c67e
+8 95c85184f2512021 aad4389f1a42210a
+9 5779eb343cdfbe0c 41371a72e1b32fcb
+10 e940aad08464f8c1 76d8debaa890f0d6
+11 954d051d92e7ec76 9627aec81df769d1
+12 2b97495c5ba2408a 5f0c8138f62257fc
+13 3e20ddb2daa13324 3b3e8a11a33ab72f
+14 57180066dc248df7 c369a3535442d8c8
+15 9a726d40880c7687 4c1d73af9ca8ad7e
+16 ec40803a19fe496c 044587c7242ea8f4
+17 4b56b28914d9ae02 5ae1625b488b3935
+18 ead6918dac95eada cc6e150ed45d0502
+19 b2e88f4f8b020265 8cc585830b36bd2c
+20 1e0aed07d0286073 edd708f1ea326759
+21 75076a2c50864cc7 f2c5163578631080
+22 8ada91e69bf14cbd d890f6a8bca7f9f5
+23 9378572222695a01 5ae1625b488b3935
+24 33eddb513026f0d6 93051b96b0369514
+25 5ad5c432b8e9d1e9 035cc1d3229df742
+26 a2881647fcfd24ab 37193750dab63e2b
+27 85b5c79ce9ea9def 7b980a03d22f4733
+28 7fa1bb6dcd7a6b27 a6fef4d0403085ad
+29 ae980398fd035e11 0406b9335cf583e3
+30 164c4300a9475cf0 dd9bd5916b04bc09
+31 956c42f0c77d6406 64fb2bf619c3a873
+32 2cab3988ee1fa3bd 47b8ffbc2abeb7ae
+33 a28c48e5298d7a27 2a31c268899342d4
+34 a43320e49eee8007 64fa87cd24370217
+35 fc95ae83bd368052 5ae1625b488b3935
+36 4fbf5c8e27ef5bf1 9da5dcfa926f25d9
+37 eae8bd963b3c9b71 9442382403da0b4f
+38 341fa3590814bc17 2904ac711f04277b
+39 5cfd56f4ba53ccbf d9011f18b1c95a7d
+40 71207105c5707828 5ae1625b488b3935
+41 3ecf3a58e6e37f42 dc026dd4f088ed54
+42 fca4c0eb17dbeede 415342b0ea9e4f9d
+43 f79087f59560df61 5b23ba7782c47a57
+44 71207105c5707828 5ae1625b488b3935
+45 93f89af59050e022 e46fa8096b1b88ad
+46 8fbc2b78892e9d56 c22705acb08e924c
+47 d7850d919297b355 15882bcf35b80986
+48 93d8817d0718939a e7f6d6567b1cff18
+49 9060244769799b4b d26f0abefdf367f0
+50 8fe7013f64aab256 bfa9f22b3ee1c9db
+51 7228fe322169222f ccfd29c90be765d2
+52 b68f26cf2787440e 0eebe9711043ad2a
+53 ad70b8b14804c6d5 5ae1625b488b3935
+54 a31637fd6d8011d8 6e90a2b10778bc89
+55 0f711526b87fb5cd d6c4215fd15a9110
+56 71207105c5707828 5ae1625b488b3935
+57 a57aa4656ce7750e 5d72a89d7ce3e344
+58 6cfcbaaba6c2c14c bd7e05ac768d23ba
+59 51c7acfacde543e3 5ae1625b488b3935
+60 c6e68358c6fcafa5 47441e0e3efbd16a
+61 d378272354c7a3b4 5ae1625b488b3935
+62 81e72e06e6f4d422 02318419e13d92cb
+63 dc16be9eaf8be272 e3e9e309e9cec2f7
diff --git a/crates/socket-patch-core/tests/equivalence/crawl_nuget_legacy_fallback.golden b/crates/socket-patch-core/tests/equivalence/crawl_nuget_legacy_fallback.golden
new file mode 100644
index 000000000..4239d0367
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/crawl_nuget_legacy_fallback.golden
@@ -0,0 +1,3 @@
+# A legacy packages/ root probed by case-variant PURLs.
+# <case> <input digest> <output digest>
+0 36ae401955e34281 afcd4f7d169b9926
diff --git a/crates/socket-patch-core/tests/equivalence/crawl_nuget_packages.golden b/crates/socket-patch-core/tests/equivalence/crawl_nuget_packages.golden
new file mode 100644
index 000000000..0b5e0ced5
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/crawl_nuget_packages.golden
@@ -0,0 +1,66 @@
+# One seeded NuGet packages root: crawl_all, then find_by_purls.
+# <case> <input digest> <output digest>
+0 3ed5c68bfd238745 aad8979de1b2e503
+1 69aca2d82ac7fdf8 afa054faa29dfaa3
+2 22270f6d715524c1 2a98660a38e39f1e
+3 8a45ea040c012203 f7ad263cda326355
+4 d50c0fedf83f0ab1 d5dcd09017c194f8
+5 6e505aec00e47600 7c7a4da8741c771e
+6 b9ca5a9849f2a8d4 5eed25f9aa1c6813
+7 a5ee3b8f619bc4d1 cf27e7d683455f82
+8 551ac3f79e5c3484 b59dc2a7eee036cb
+9 5e7ec527fd679fd3 24cf5fb29b9983d3
+10 cac677008911f6f5 86aad81ad926fb3f
+11 7249e892a298cf34 4038050f3e3db2ac
+12 3c4ec8b8b14204a8 a29ab8b13b251bee
+13 0d063bd73d928425 dd1b9589155f9c1a
+14 75ae733cc6d5fb9a 2943ba0095ad1e5d
+15 efeda9556a8a553e cf3f759216372ae0
+16 6f86dc2f3fbd887d 45a8ef5f4991acb7
+17 71524ffec2f0163a 717cf21307145b30
+18 e4f31dcf05599c40 5eed25f9aa1c6813
+19 e05e0775945ff4f0 f4cb530d3ca447a9
+20 78d23fd67bfbc949 611a1919df025a84
+21 01e8261b5135bf05 8ea4e7912d815a92
+22 57655d43bfd313df 8c0921c8cf0bfd98
+23 3fc5b11684fbfd17 918dc654fcf8559f
+24 41faff7e584bb646 cea826e330ea4599
+25 53e16564fccccee1 5eed25f9aa1c6813
+26 572647525bfe1665 5eed25f9aa1c6813
+27 4456f55fe1089c71 a4c5674461db4473
+28 dff37130f2679566 17d19a0e527daeee
+29 beb8f92823e3479c d6ea0fa9422be99c
+30 0eab2dd35efe9a29 bbe9add2c1db81e5
+31 78fd6295fe3f58f2 01f1ec9a720940ce
+32 80f7021977fd6ec5 200aba7779ac75ee
+33 ec487d6badc02d68 ae5fb20fca28d7f3
+34 44b4b1927f52067b b56086bbd1bff829
+35 c3835d306801db2c 144d6962f78c694f
+36 fcaf05cf8ce9cdce 6b1ceda1182f2123
+37 30f7f7e53118623c 8a864af6323035e2
+38 3efaf00433287504 1b017222f32f54b4
+39 5cf2a0e1d3db99c0 06b9b79381c1e95d
+40 7a4eb8234eba06f9 a24c79acf272b25d
+41 c965d7ca845ddf8e 88e8cbe8a457f908
+42 76839b11488b9183 4bb6f776b375cbed
+43 c58c93123184fb12 5eed25f9aa1c6813
+44 0347b2710c0b54eb 5916e980c6853c4a
+45 fdf83c377b9ee589 5eed25f9aa1c6813
+46 1d113406e9b45128 414cca03cbc09201
+47 3839c27816c7629d 1b6e32e3cff823ad
+48 0899e6140f4c6120 87d4bdd91d341564
+49 0e1b7aacee9a7fc8 611c123eae958f7a
+50 1fc64d2e334bd2bd 3342ef2cda27e822
+51 100c5a70fb719f91 a7ea1adc385153cd
+52 05b9234969171aa5 f8f5b13750c8e079
+53 41c15a8bdf3a668b c92ee243df48ecc3
+54 96093cbf36093a41 6ea4fbfccbe916a0
+55 bf6831c35e5af859 806a3368f7218af7
+56 e51cbd96fe8a9fa6 a3735a2d9e10ed0c
+57 cff669a1bfeb6031 474f9821105dd114
+58 8d5f4f9af8e920e5 5eed25f9aa1c6813
+59 faa4bbdf65418651 32cefe9711f750ff
+60 aab16b8c720350e5 5eed25f9aa1c6813
+61 673a0fdb7a5681d1 bd7763e7b2776eef
+62 a87f51a0fa3cbd3f 1eabdbc0af1d32db
+63 8aa48e03aa4966b4 ea7b412234cc3d75
diff --git a/crates/socket-patch-core/tests/equivalence/crawl_python_site_packages.golden b/crates/socket-patch-core/tests/equivalence/crawl_python_site_packages.golden
new file mode 100644
index 000000000..31f75a84c
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/crawl_python_site_packages.golden
@@ -0,0 +1,66 @@
+# One seeded site-packages: the dist-info listing, crawl_all, find_by_purls and find_each_by_purl.
+# <case> <input digest> <output digest>
+0 198016d750fe9101 e8d93ecbbb02df49
+1 d2acae82860bdcd9 0e256ad9eafd9ba1
+2 e24a68678fc0cef8 53fbfbe5d2e0a22a
+3 95ae92892c2424ab a43b919fe8b68264
+4 5c9d8f0446166269 4cc13cdadef780a7
+5 06a4e4ff72f9418d b8b691a2aee89232
+6 4a3de3ce09375ef1 068db66866295cb8
+7 2428d8ac2bd74e6d d1de5ff399a4b134
+8 0283d9e5ae898e37 b2ea74e40b7a40bd
+9 9d55dc729fcccf80 8edf93ca455c07c2
+10 1fc2ce4fad28b48f 97592ff14fc2e007
+11 e592d8197ae88181 acebcfacf1982d28
+12 4aa0415164a41abb 3b7904637a910c6c
+13 5df1ff28b8710467 b6016b20babe139d
+14 b515a33eb3859f27 b5928355ba9c89b8
+15 32b44e5486ec8e47 1d310fbdad691744
+16 2115aca4dfc41f81 5e18ee9de13ce5dc
+17 a5c1fcec68e54bb7 4a7b5fc1ca158522
+18 7c0743865e227e6b 7e5ba6fb0f1e24eb
+19 c32b2329da7770b9 a88833e56cb9a8dc
+20 8778f67a16fb68cb 680d3a2df7e892fe
+21 64c4df60b43116be 49dea01a1538cb98
+22 df350b75002e36b1 86787a55c69c2df7
+23 abb3a2b5cce8a495 3aee53c827b01757
+24 02b1aa8344eec2b0 e3680d26eaaba9ee
+25 72bf43de7665f1d1 1e90542621296098
+26 7092370a1e0f78ef 79d0205edc7fc477
+27 63f3f845aa3927fa 2ad70e37b03396fd
+28 895926e5e0a8a510 0da0d2c9e7129f36
+29 2b9451525e7077f2 fc4490115352643b
+30 8b29f5eb5cfc82d0 400e6a022de63170
+31 10489bf517542a88 14fce84a889fcea2
+32 ddf44ec548ef3814 731915cdb72d06c1
+33 77ae548a02c773c8 0787d2e73e3fad5a
+34 d3a69850470f8bc6 cb3d44715bc1184d
+35 c8cc54db540a284c 483eb953fd28ac31
+36 784ded8d8adf5b3e 6ebb851606a7d6a3
+37 dcdb78324c2ad9e1 d5e50adf4a6ae00c
+38 af80f0acab34ae92 02903f199c21d896
+39 682c4572f2485ab3 4409b63524b1f636
+40 87cec8cbf714a32d f7c4a7338ee4169f
+41 0798f2d44ba97d30 3842d792fff5ff64
+42 ec0b6750635ce4be 99243d00c64721b3
+43 1aa636c56f2142cf 268f922aacc40634
+44 6e2dfaa8c93b4ad4 cc110895d8bd24d5
+45 2df7bf3e9f77a150 0a4829981088eaa7
+46 0789e6ce0c6ea93c a0f72f52e9f74cbf
+47 b1db1a2b62e6640f b626bdd6f135dedf
+48 6abcb187e9e0e6ba e72384338256569c
+49 7503e0f2639a6f75 2624c7902626b5d6
+50 24d2df3005be76dd cd13e182f95aaed0
+51 56a76b18f3fa4326 650c186ab1ef8b78
+52 38af01370ac937d1 b9033260451a5853
+53 e9d72fab580421be 3cdb0607a3205f63
+54 33a5036ff50edef3 ee5338153080178d
+55 1edf45d032e41a8b 4a2e125d0ebbb949
+56 d97d1665e545bcc7 0d0e7d5a8450817a
+57 98081f0eaa3f3ba6 27438a16dd114f63
+58 851ddf1f98e18c3f ccce651e903b957c
+59 5f72261172180301 f67d0f3c246f40c6
+60 03669bdd3d8945ba ebed8b047d70d6e7
+61 17d5ff764f35a61b f8d269181d04be6e
+62 93758d178863dc32 9a82c8e1d2fc8f00
+63 851ddf1f98e18c3f ccce651e903b957c
diff --git a/crates/socket-patch-core/tests/equivalence/golang_rewrite.golden b/crates/socket-patch-core/tests/equivalence/golang_rewrite.golden
new file mode 100644
index 000000000..b6c252cb5
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/golang_rewrite.golden
@@ -0,0 +1,302 @@
+# One seeded go.mod / go.sum pair + overrides, or the re-run over its output.
+# <case> <input digest> <output digest>
+0-19 47d5047209d4622f cfb61fda8ead9dfe
+20-39 f299a1238223bea4 c3edb6138b865a9e
+40-59 45539d80f3047234 deea356dff20b1ab
+60-79 5cf7e6389b620d2f 35d231e30b8a1da8
+80-99 e4e6b4404e6c2775 f423b388175598ba
+100-119 c0ee59e8ed967d73 c39342753206b8de
+120-139 1c8cb7b720cee08f dd5fc59277757625
+140-159 72cba47f206127e0 f7751f4d46e49cfb
+160-179 9e5cf7e678219b8b b85826ee6629769d
+180-199 69a9cf1ef391ca10 d90b6bb988306cf5
+200-219 c8209dd9d9d97c9a f2ca76820e5ee929
+220-239 aabcb9ac5ef2bff2 57a51f50cada0d57
+240-259 575031a900e3bad3 c504bff314072199
+260-279 690472b457b56f00 bd88df7cc9813075
+280-299 3e7cf40d2dd9424f 4d2aefec23d08238
+300-319 c392fc7ae4e9a64d 9cd531d6442ce036
+320-339 7dec0e59b0c835ae 0a42a4908dd35ea2
+340-359 142eed22f68d019a 488145b72e8dd83f
+360-379 573401f7851a39a1 190a72101e00926b
+380-399 a3f838911f829800 b83abf8dd29041d0
+400-419 d33eb814ad930ce0 cb4c682266cf703c
+420-439 06841ada7e240e8e 6ec27ddf7b2f6160
+440-459 9789cf941beb7f60 b84ebc45ba9646ad
+460-479 b0ac5b43c552e1d7 2a05b275244b30a1
+480-499 77437bfa264ea1b4 3f1068fc323b5e76
+500-519 f610efe54c6dcb90 89126477ab4ebf0f
+520-539 92abe9164af43122 fa216aa853527650
+540-559 6f14a818683a4640 7195bb2ad5f771ce
+560-579 2fc174f205bc9e1d fdbfb7b4a2a3e3af
+580-599 c77fcfd2ea5445e9 9b2980e26bdc2fdb
+600-619 08cd0e0042521d3f 1b16dd536a428b9c
+620-639 b0a9577eac494289 746299aae8afa586
+640-659 615aabec4790f001 7e1d46b3d7ab21bc
+660-679 7db64775d6a8a68b 17c1a7a497ea71fa
+680-699 1c3c676e67b93b86 6f7c47208f18010e
+700-719 a51ffd2f2ad999f1 591d9ae3eb3ae09b
+720-739 f5de2acf81a9eff2 2cdefa768429a2e9
+740-759 ae7425b416e46f72 782aecf2092a65a5
+760-779 cd4821c76201d9e9 0fb6925b98463b01
+780-799 6aa8cfa2092f5e97 b373be106f8aa16a
+800-819 e6ca6ee02cdd3b22 af22460213179a03
+820-839 63ff9a5e4f7004ed c7cad0d8d57681f4
+840-859 a1a80cd4bd7a6fbc f9442f31e1e0acc5
+860-879 9203c1653969c63c 6a53242431c223cf
+880-899 11f6dae72f17fe2c c088350169e4f2be
+900-919 ae79b0a645201b37 46a87f861db17c1f
+920-939 ef977eeed16f06c6 1b9795ad8797f53f
+940-959 e46895ccdc7bcb22 95036d70702b674d
+960-979 ef45ed34b85a111a 44f9de049d21e73d
+980-999 f3ff2e6609de8351 d43c047c8e275f33
+1000-1019 63fe150aac83c96f e0a6ec5c97a8592d
+1020-1039 16de7feb09c935e8 88aee1438b50c94e
+1040-1059 215b160127c039d3 24684edd7716877f
+1060-1079 8da143d954c77db8 e1b7424ba9ef6ec9
+1080-1099 814bb342544d5397 df222dc1d2d54d6b
+1100-1119 06732fb65f50a6f2 a2bf3a2413253bc6
+1120-1139 d2b0ad1445a3f72a e88efac8a1d8fe97
+1140-1159 4b9949b08e412958 bde79afca1477a5c
+1160-1179 caf31598bced35e2 4a9903bbe7d70032
+1180-1199 f1f983c0f8db9d9c 240546a2e45c5176
+1200-1219 69a1c445be4bfd2c 94f1186fbf9534e8
+1220-1239 8e2337da6d380b78 81e23f1618825680
+1240-1259 244cec3ada30154a 1f45e1b11eeed1c1
+1260-1279 942329ca670067c6 f9c7eb8621d19ce8
+1280-1299 17a45fb2c157b62e 2f502cd2730a60ba
+1300-1319 06975d4d3628cd46 5581b65992d7291f
+1320-1339 a7b7c30167326a72 1a46b7ca1c33bec4
+1340-1359 fc7c051064d0abe2 50314a84cb4c34a7
+1360-1379 2e722de13f86d458 1470099826b24678
+1380-1399 b7469aca24d5b15d b170fa1fafb09bd8
+1400-1419 740303be4451aa3e 0d5cd8b252c101d9
+1420-1439 a24d04fdb4d5d4e3 143b770f5efad8d6
+1440-1459 f112439a0551e420 e461b52e9bb976ca
+1460-1479 acda6112f4c1caf4 1caf8de27c216844
+1480-1499 f72f001ca193939e 8e05bc21621b9686
+1500-1519 843134f99d1aeae4 929207ed9c42ecf6
+1520-1539 b8a1b71548a7a6e7 acf0aed035f2ced9
+1540-1559 1ddaae3401dcf284 40565518df5f1041
+1560-1579 c71800b3bfd6b832 0c152f1b70a666fe
+1580-1599 865583b60ffbb933 28e462491ec7c339
+1600-1619 9c9aff8b23ae7130 7c95e2375ca33fe8
+1620-1639 e1c84998b82ac101 f605a841239d7e61
+1640-1659 f3cb4270ce405204 2cffea8ddd9d7acb
+1660-1679 49e61143ae4a3a66 fee585d8cc18b5e2
+1680-1699 3f4dcc15913b1d9b e4ceba8b3767815a
+1700-1719 9c36aaee81e79965 50d69bc624425367
+1720-1739 4d0a013f099c54ad fdc70d133fedab31
+1740-1759 6573e7d000b199c8 414361bca975f14d
+1760-1779 e8e1abf74bfe3f20 f77b13738b0c5f28
+1780-1799 e68cf725dde04bb7 850ecbe9fe772b02
+1800-1819 82f9904bc1f84e7d ce017362903b025e
+1820-1839 63c4d5ac7559fcc1 94283822d37e12d1
+1840-1859 c43534e0c0fbf289 a71f2edad771522c
+1860-1879 e6bc5e6da6587bc3 cc2403b2a07e596f
+1880-1899 7fc04ed43b9b6d95 10bc42e84df79ea9
+1900-1919 c812367467a2150b fba3fbc9ad42d9c5
+1920-1939 191a911c8bfe4b77 d4bf15f5512dc58a
+1940-1959 cb6122f867f2d010 179a50c2636720b2
+1960-1979 62db19d5eb0d436b 69460bff89154908
+1980-1999 8474ca426482f574 c68fe56d117a4016
+2000-2019 65b07848b3497a05 b9656e64977d389e
+2020-2039 ea42598f96cfbea7 bd4ce7c411b8bd60
+2040-2059 5efec203227b66bc fc73ecc9611f5448
+2060-2079 d7120546cd0d7dff b8b991071c615a07
+2080-2099 76104b0ef20425b5 60438646a0cebd36
+2100-2119 b61591b68c61e2f4 b8bade9d59bf7a0b
+2120-2139 532f381c0eab2aa0 b9e7fa744da8b777
+2140-2159 b26d027bab7f2d23 a582bd3588b38d67
+2160-2179 60158ac27994de24 38c6a7f76dcd064d
+2180-2199 97eac5df2b3a3bf6 6cec852148533d75
+2200-2219 74859d240903a709 6683626fb2c64dc2
+2220-2239 fb5fa2c4d0d5dd22 adf628baf7f12376
+2240-2259 9f934c3b7fce7ad4 b17d44d8ee4648f3
+2260-2279 d63532beae94eaa8 86ff90b276dfc3ee
+2280-2299 67bad70103ac06bd 4568fe441859ef5c
+2300-2319 eae25c0b8601ca74 96e9d3b30a8b7e88
+2320-2339 eb7918df58d1b6b6 64dd928266b63e3c
+2340-2359 b1d789e50df0afa6 3a95d5999b55a01e
+2360-2379 c25e1631ab19b3a2 1dc359eccc56047b
+2380-2399 b222a18694649fb3 8633d001257d352b
+2400-2419 181dcd38afcf32d8 5cbc35f671c19101
+2420-2439 5b89f5398b62f5a9 6be4ab4f8c9f82fd
+2440-2459 1465bece187bf5fd d803d2c6cd8e0a04
+2460-2479 db9f485af47beafa a9442198de3b5f40
+2480-2499 1277cd6f63fea8ed 7e7711e2b7dc57d9
+2500-2519 02883b6b5585df65 542bcb404f620d7b
+2520-2539 efe673e099e30f4e 8516b1a55a0d0dce
+2540-2559 c4da37cd175fbcba fa12f0b58a30358a
+2560-2579 b3f06bf69e367f70 421256d8fa63cdfe
+2580-2599 1c9aa5e45a2fb52a 9dd64e42d2fe0ba9
+2600-2619 85652d6dcba1fde4 0cab1dda6ad3b656
+2620-2639 a734153a12b5963b 7047b7c6b153a1fd
+2640-2659 55154a54bc431f27 df8d1366b3cb659a
+2660-2679 8b24ded782213baa 20873d49e81a98c8
+2680-2699 ffc128f8b801235b 6a666541861aa02f
+2700-2719 128be586e41b193e 7d7cf2c84854b1d5
+2720-2739 68e0c0ef8fc28c34 08d273563119e9e9
+2740-2759 75c72ec1e707e7c7 0250a58a991b9804
+2760-2779 25ccceb30770d8ab 9bc0b3c900776430
+2780-2799 cffbd964982f9690 7aad80adb6b342fb
+2800-2819 df60e5afe00f1786 7284f342246b1cf4
+2820-2839 70053fdfa65a7cef e6c631afd83c28a2
+2840-2859 140c1499c4b9a881 7b0ae492af2ee4ec
+2860-2879 7b445697cf0df0ef e35226f8ec2e1394
+2880-2899 2df4bb8470a1cf39 241193774e2e8d15
+2900-2919 39f8762d71de75e6 b70124fa7e4107d0
+2920-2939 bdb9b2a097b1b38a 8c6e765cc702d976
+2940-2959 2cb4ab90edcf8ba1 0c7c8a3b9ac74e62
+2960-2979 4d401383a0ec703f 088be9ba44587183
+2980-2999 e5b4be04989b99da 38c6ba7bb6d403f4
+3000-3019 8af1db165cb5c840 2a4a7d42c174f71e
+3020-3039 caf84edb28cb8b8f 64df250943e3e19e
+3040-3059 660b90953403d6a8 74cb08f1de3dbeb6
+3060-3079 5f483c0b6f36f446 a079b9988ed26451
+3080-3099 00680e3376b6b3ab 652436ac09baa89a
+3100-3119 c1c208f3ae1fe6cf 9b036621cbdca3b1
+3120-3139 93c6c99e9976f649 ea48dd2f42153a4d
+3140-3159 9099e0d1e0b1a1b9 5f155bfb024ddf42
+3160-3179 9e0242d08f9d0ad2 39f4de3896ff0436
+3180-3199 545f3409ff9929c7 57ce774acbe547fb
+3200-3219 2500cd52bbcad9f1 7900dfb72932b73d
+3220-3239 ac035af6534c96cb 8bdee012561d7a6e
+3240-3259 7b186e356113cc74 1e0f907dfd49a19f
+3260-3279 606eb1289c1a0671 ebff3bef140c0052
+3280-3299 29875fdd5ef6ce83 e491dcbc31da78ab
+3300-3319 0fa46712875ba7cb 8cd83afe6c778aab
+3320-3339 1190f489a3871f02 e8537c168b72c2b5
+3340-3359 a9b389e34c1784d6 36160f09d10dc03b
+3360-3379 25151fb9affb34fc 4b68b91e4d36d229
+3380-3399 885e5ca2db48f76d 111bc05fa7f1df1e
+3400-3419 6e11c53dc344802d 0bc85b065f2bc9d9
+3420-3439 854bdd511382d8fd ccebf5900bb58a01
+3440-3459 59cd7341338352b4 02068ee2de04a1d6
+3460-3479 c80ed4739df083ea 70bddf1ba00095a1
+3480-3499 0ee091a7a3ea3b54 fd6f5e5c577a9dde
+3500-3519 0d6a7028e2e6710f 84e0dfe27c056050
+3520-3539 0c3c7d797e8c250a dfcfdd2918a22f8d
+3540-3559 d8dbba1a146accea d74b9d10156600a7
+3560-3579 773211963ec148a3 9ae65ece43e91f48
+3580-3599 05a92e2020f244e4 0f58e22fc5107c38
+3600-3619 3a42a7fce3a41067 8ad25966cd0fa340
+3620-3639 bf0c096cd64d9385 e2a4c24df2d038ec
+3640-3659 a42e08cc7d6b9c26 446d748f1a2b50fd
+3660-3679 c4774086e93045d5 20333853750491b4
+3680-3699 7d2fa17c148a0114 1e14742b592c70bd
+3700-3719 7e6449ab10c43305 a5fb611a8bedc31f
+3720-3739 dad8194e4e3c2475 b1ab2a8ab9262785
+3740-3759 e4dd13be4a1e4ae3 72cd75867e028f90
+3760-3779 e49f7aa39d639df8 62300bafbe0a48d5
+3780-3799 0d89b510759802e6 902ae86fe793b654
+3800-3819 c56c0b4569c437c7 785946aaba05529b
+3820-3839 415a50f93c72d5cd bf05d1c5efbc63c4
+3840-3859 ff81ab33ff4b4dad 9c28b46e6e357643
+3860-3879 86c7c205ba184708 044edc635d100ab6
+3880-3899 86585bbec961349e a058991c988c5c3e
+3900-3919 2219ccc764489dbd f27e8a606a70435d
+3920-3939 52df81f8715e9b56 c0ab2e1c88502cdb
+3940-3959 524b83dbce6f5e42 dd800613d7973538
+3960-3979 1af607563aed866c b10fa6ef246bb0de
+3980-3999 348a7eb9cc4452cb c0769de641815cc7
+4000-4019 50443de9d0576fa9 3772314334a0dd8b
+4020-4039 8ea004cc85321a88 a4ade9bddf4666cf
+4040-4059 5e7905526ada862d 1272e8590eda2076
+4060-4079 8a78a842855ce474 c3034badee686879
+4080-4099 c67cf3970d783240 2b99403759b0e59e
+4100-4119 ad0707bf662d4474 103b69b11098e942
+4120-4139 496226ad5d1d54bc d2ce37345e5e7206
+4140-4159 6e44e2d004764cdb 286cfa254cec65b3
+4160-4179 a59ca018acef5b10 a88799c32f30cf02
+4180-4199 18f9756d3ef2a2a0 2798f9af5548b61b
+4200-4219 5aab561ab1b5b916 e5d1105796f197a4
+4220-4239 2e28168b3ea22b5c 49a59fb15998115f
+4240-4259 fbe2fdaee6fbd295 fa96ea6a21fd03b9
+4260-4279 b65ab638df93c476 2016cd5cb2906b17
+4280-4299 b1d7ec27a6bbe59d 23e7900cd270556c
+4300-4319 06ea7ea85f0cb1d2 70da790feb208091
+4320-4339 df8792b362eab98d 23d77cc04689af6f
+4340-4359 8058bbe8209fe438 ea810be1578a3f96
+4360-4379 a3ef611fe488aac8 dd6a284459c761c8
+4380-4399 f9cb5985eb807eab 34402c13ef42a82b
+4400-4419 139b8662fd680074 99913ba0c1e61b8c
+4420-4439 c210770360cfc28b ac361f4103c273ad
+4440-4459 6a8b767e23bade9e 53c9c7d2d5da0a15
+4460-4479 e5a86a712e1126af 140440d60ae8008b
+4480-4499 b71a3611ab452b95 92656a99dddc903a
+4500-4519 f9f332644bd4a3aa 6919b6dc30c06829
+4520-4539 c66b39e6f14a5dce 5cec0a9cb7c89c91
+4540-4559 97fa859531ca5a6a 12a75d6d13a6343b
+4560-4579 ec2036d68cfc2501 1bdaa52fea5d55eb
+4580-4599 1e59ddb5512aac2f ac7349b08398f51f
+4600-4619 910df75fb6e98676 8fc6a9dee9d05961
+4620-4639 66f453b7f0f77c8d 9faf9bbb31aed006
+4640-4659 a11ebfbfff7ffc18 995fefdb0f324ec4
+4660-4679 796061d8f2ff0760 e84a1574bb036af4
+4680-4699 926383ef80237578 7652fcf1a56176d7
+4700-4719 ec63e1d63e08afc6 615c60f2393d4f70
+4720-4739 e0a8f1a419329606 2e390e437a522b3e
+4740-4759 3593968f80c4c1f3 c6ccdef36502466f
+4760-4779 1515916f7b00317a c0b37c7a143a3edf
+4780-4799 4ab877dcafc32dd5 64fae785627df52d
+4800-4819 fc332ac3bf56dacf 1886f56ed621c61b
+4820-4839 419d7abe8f87b0d0 dd0a5e5a935c3e6d
+4840-4859 d1c0c9f4bcae03ad 4675b6ca088c79d4
+4860-4879 dd050eaeae20f065 b43d9dbff6c5c9bf
+4880-4899 570d31906b1336f0 974ef87fd9aeceac
+4900-4919 8046b7a7dd8a27a8 4bb995089cde4df8
+4920-4939 9d1cc2b8baf0e25d 61463f2feb6d1826
+4940-4959 0961fe46ae0d1812 f2404cf60e7f6340
+4960-4979 80b0a9164316128a c29823e3c367decc
+4980-4999 a213879423a7ce90 8d97a2509cb25486
+5000-5019 64608de3fdae0f59 54524839b1534d54
+5020-5039 d603b52e4d579c34 d1bd7294f2ecdd70
+5040-5059 fa974c38e95dd027 e560f903417c68ee
+5060-5079 bd27a2294dbefa2e 266455f3fdc5c57c
+5080-5099 c914579a93e541ce 6c6292e0cfc6a5a3
+5100-5119 c1306803cbf1e0f5 a397491371232aeb
+5120-5139 aa3439af7c93e288 0f3b5a2ee6e4659a
+5140-5159 15395c633a3372d4 95a6c1648e5ea937
+5160-5179 f89ecb475e434463 a4ff4baf5f86214a
+5180-5199 5b717af07137ee88 54e539dd5249876d
+5200-5219 9dfdde75a8f9d5bc d48214b6ddff9501
+5220-5239 6433dbac68e8f025 c97d8febf6e11114
+5240-5259 647aadba3f155859 a7450e8e95b433ce
+5260-5279 69d9b00f4190b106 ae6e154761851200
+5280-5299 962709da39972d6d 2ab48dcfac880f9e
+5300-5319 1f8033825ca0dea6 1278ddca31068fe0
+5320-5339 b1cce2073028caf1 a7274e347681ab0c
+5340-5359 b001ce59586281e7 c85136fdb7f1035e
+5360-5379 454fba783e92b42c 689db18b00385c88
+5380-5399 7e08209a9f76f8d9 67f663bc7930a60a
+5400-5419 0631873474458d1a 15b5b8ea97b6ffa8
+5420-5439 b2d54cc4a4d89d50 891c2fcce0111481
+5440-5459 763601d8ff89ea28 46f979b52998c963
+5460-5479 8e797184f9069690 a9b6c9bf021d1d8c
+5480-5499 0ce66ca39e28f543 0197c65d7d5e9507
+5500-5519 52abbca78a26fb2c 69eb73156a3264fe
+5520-5539 7652067bf14e3231 750fd9254014aead
+5540-5559 6c80188a45bca573 d6c563b37eca9ebe
+5560-5579 f96781b7a793d705 4fd246d9bccde25f
+5580-5599 ce37ae5dba3a12fd a22cc2cb6cb0eb7c
+5600-5619 e39f9ecf8445e1c8 67e38fd702f3dce0
+5620-5639 8c33c0d52bbbc38d ae2e13021e3303ad
+5640-5659 44c1dcc0997ef62f a8f270df47c51c46
+5660-5679 b583c9ca2d94daec 45473bae2e0554f0
+5680-5699 a8240786cdbebfc7 f489ab55e8959013
+5700-5719 87ec2a405c64093e 6d5bcbf2baa65fc2
+5720-5739 2a8ed0ff2ff627a0 63d53c5bfbfe00f4
+5740-5759 4d3ae6cb6547e9ee 1bd8934657451ed5
+5760-5779 fee139e30199d2b0 14246ff41137c94e
+5780-5799 9a368f5678cd720b 196bea4b293962d3
+5800-5819 dd016075390d29e0 eac9869e7df702b1
+5820-5839 1aaa56bf143b56b1 596f95c6c52798ff
+5840-5859 e651ed383ddb1f35 6e514013e4d0f5f8
+5860-5879 f0f6836bcceaad62 89e3dbbbf5576f69
+5880-5899 a60a67ea60aa6517 d0ebdde22c764214
+5900-5919 e7ffd8f65e6bcc24 bba95be7aebb7f90
+5920-5939 2419ac3e52eb581d e22a156355b80a01
+5940-5959 3debd9e1353bf1f5 88d2d62e74f3eaf5
+5960-5979 3ac7c9616704f164 1969aeb02e50e4eb
+5980-5999 2b7455bbaac929eb 9f0110999cfb357f
diff --git a/crates/socket-patch-core/tests/equivalence/maven_pom_project.golden b/crates/socket-patch-core/tests/equivalence/maven_pom_project.golden
new file mode 100644
index 000000000..8bf776b63
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/maven_pom_project.golden
@@ -0,0 +1,202 @@
+# One seeded project-shaped POM, parsed for its coordinates.
+# <case> <input digest> <output digest>
+0-24 a610f5814be56477 732b351a8b2cca3c
+25-49 cb404a6a05a570c7 fd3ce74eef75c5fc
+50-74 0c29406ed49bc10b 87aabca1a8a6a13b
+75-99 559412d885e6b427 d8413303a8652ad7
+100-124 83f5c9670bede1bc 142468508abba53c
+125-149 25d77751a99decf5 0081d935e085a0f6
+150-174 250465c930959d70 0b6591a25467ea39
+175-199 e33516c736ba9670 72406b197f6fb5b5
+200-224 8534bedce8f516cb 8bf996426c8923a6
+225-249 2975407ac1f49d10 c2247e6cc0749184
+250-274 01f45865ec17cf8b 4e716e61598ef15c
+275-299 c8766f54478aeace 980b442e958584e2
+300-324 a653c188efeb5c13 0a60dd568d845e23
+325-349 a5a8567e52df6d55 f48218fb66acf417
+350-374 ea83f43ae67ef0b5 a40437ad81fdde70
+375-399 59a64fe05a3832bd 0b1c5e4b1399a89d
+400-424 4246179c11d7b06e 9a8c12e753da25a7
+425-449 5031666d8204073e 8dd187ff3a4bf2f7
+450-474 6693e59d747fd54a 48a41d59020985fb
+475-499 c98f16980ad73a7e da2f970cd20e9a13
+500-524 417729e81ccc196c 74b27cf5ff7a98c4
+525-549 1c92d7ab9e3ed63b 5dcffd21b0ef0c22
+550-574 5b6b5143ae9e619c ab8e62845db6af60
+575-599 d28000307c7e334e 44600f1ad46d3892
+600-624 21762a2a4a58048f 6ddebe9b1329338e
+625-649 5e85a2167a059f27 f49036f82a9c9721
+650-674 4b5309304a5ba565 a7e627f236d0312d
+675-699 01bf15179e0031bb ec0363db5199dd25
+700-724 417dd1767c3ae775 0813af4d484c9a33
+725-749 67931d2b6e1cd68a a894ac960128c575
+750-774 278c3b6240d69311 f4f35702735beca8
+775-799 b98d229f479c5c7b c5a1df8152683330
+800-824 ed99de308882d930 b11633a01420721b
+825-849 43ea18fcb258c6a0 5cfd30b67fde0a50
+850-874 9348f14d2022ab2d 8981fd2dfa55983d
+875-899 259b7261dd6b6536 c4d461ce4fea3e7d
+900-924 3298b305d39a5d42 732c22f847ced4c5
+925-949 0978990abc91f342 d832f29ef5227aa5
+950-974 c4ebbc9881a88c1c 81be9a89d66424aa
+975-999 bdd65f6c964e03c4 71b7de7715d35271
+1000-1024 3f0c34faf4937556 ae53750a30241b09
+1025-1049 40708c8c7acae580 871efed5a2562200
+1050-1074 733080f3849a569c 3ac587cbc46cea29
+1075-1099 bd034bc1aefddb6f 329f656662abdfce
+1100-1124 4e23b27a7dd50ad1 72c3ab9e69b70909
+1125-1149 8f73c16084832815 e240e6038d71ef83
+1150-1174 8958bfbbcc3a8f84 a4f5731151b25da8
+1175-1199 ef1af7d7180da213 79358c1b8c25ef51
+1200-1224 97675c612e59bc50 9ac72e758370242a
+1225-1249 d1bddb3de70044b9 fa4ffe438f7727e3
+1250-1274 d3fc03c03d8d377d 0270dc471621bd83
+1275-1299 129df415815b540a 0e9a712d5b1c6ebe
+1300-1324 33542aa7d105418e 45b1b3b186700252
+1325-1349 31e354fbec00575b 879ef6f991bddf0d
+1350-1374 599fce9cea41248b 1636edadf3d12449
+1375-1399 a3ad71fc77c7e3a6 9b72e91a3f1fdd59
+1400-1424 1ef2a0e33e69353c 0397b290bc032adf
+1425-1449 d5cb58ae69710b17 07a7b87d37c81369
+1450-1474 086040b190869a33 dea36efd6701bd7d
+1475-1499 d8047365340b9ab6 407d6073c0d80df7
+1500-1524 f64e9f0017aaf002 30a3fe80a95a3dbd
+1525-1549 70870bae91e3e037 b048796e0c2c9271
+1550-1574 677542d7e12589f9 384555edc78e1d0b
+1575-1599 f8abf9fbfd47723d 454351e337c2cf79
+1600-1624 31e60433ac8f9dd7 bbe9a8def52a87f0
+1625-1649 a314802e207b0dbc 031ec828570a469c
+1650-1674 bcf47bee223782d0 4405872e846c77fd
+1675-1699 d4a86e50883cab75 1dd38085703deaa5
+1700-1724 2fc739930dcd61de 1e46c49b0b81190f
+1725-1749 115ff5d5d0dd12d7 97ce1d915f9b2c56
+1750-1774 113bad72a949ba7e b4c87574651738d9
+1775-1799 08514ea59828cedf 06354532c9fbd15a
+1800-1824 7a333eaa20086008 68371ec0b7c59feb
+1825-1849 fa6d330faca83e52 1be9e48943d321e1
+1850-1874 7033e1e9c1cce1a5 914b592320200399
+1875-1899 9d40149e0ecbdbb7 b0b5e6e1df9312df
+1900-1924 c178c682b5eb0b7f bf3f153906951e88
+1925-1949 38750ad6e01ca297 b38b23a611d4eaaf
+1950-1974 7d76a03e300ee434 0390891afc275ede
+1975-1999 11a8c602c4f59a05 5569819cfeadd971
+2000-2024 6c92a3d2209da284 9a039cbf43d1f351
+2025-2049 687de414714c4943 40aa15ec0594f895
+2050-2074 bd094989a3055e01 cf9f722e86c2899f
+2075-2099 e2c089c94f3d6f2c 98c8addd973014c4
+2100-2124 c558891b1927c07f aacf969d770d61da
+2125-2149 81fb71b85491b14b 00b3c1c26b9f0095
+2150-2174 f008d2f1880b2d89 bf084a134e570ddf
+2175-2199 624d7d126108f2d0 2bac95cf11ea69c7
+2200-2224 a7ddb2c9ffd85376 e7fed2c725d26020
+2225-2249 8f14108e8cf142f4 adefaac9e985c6c7
+2250-2274 c44bf87ef351d05c ff60d637a45f1467
+2275-2299 ba0e734028458784 a776502a805ba719
+2300-2324 c0c7aba9c4be593a 5571b3d6493067d2
+2325-2349 424170a262ea6a8c b0dd37e0658874a4
+2350-2374 4c27a1dcb0f48c47 673195f0cf07b979
+2375-2399 1e0c6b24369c0132 a1e8e16281025388
+2400-2424 521364dbc2a5281f e8cb742acc703004
+2425-2449 6265053c0a81c450 d759275a64edbf94
+2450-2474 f49b013a481d0c66 83315cf018c66b8f
+2475-2499 9f73ba97ff7711d9 10d806b00923e9eb
+2500-2524 5de86971e44e9c2c 474423ee3d15169e
+2525-2549 1c1306be8ce0becd 45ebc1e3540b46c7
+2550-2574 6455ac0e298e77d2 4ef9a540816a31c6
+2575-2599 1189bf7911427cce f59cd4f0c2d6ef6c
+2600-2624 a274d063a758fdab d6949ed1d372aee3
+2625-2649 fc7ade3099dc3988 1f62061d08f9edfe
+2650-2674 29811849cf88b54b 280e057179293cfb
+2675-2699 5725a1f7caba6dd2 8e7b05f583d5e2a2
+2700-2724 e0921138a6069211 a2aa2d401396a074
+2725-2749 a384c2a07fa14889 73d7a9c41aee856d
+2750-2774 9f2c3e75a192ebda af339dfc80243ea5
+2775-2799 8a7fd032e84531f5 5b8e4acbe6d3a00a
+2800-2824 24c117a0938dd6aa ffc3c98e6121b532
+2825-2849 97985dd00cf58975 581a5449b3ff0719
+2850-2874 39c1e0bd1b0f348c f8b29279e3de0ebe
+2875-2899 ad5e4d76ae54aca6 a349af10953b9705
+2900-2924 f5a98fdacf7cb014 ac4c197f609db15c
+2925-2949 02ced22ed347ca76 282f7dc0cd7cfaee
+2950-2974 63f4946cf4613a02 9a4d52aa95e023bf
+2975-2999 44d0b92f39db1755 0e7cdaaf264ff64e
+3000-3024 5d0dff4eebf2307d 797c4b59e37840f0
+3025-3049 46baa70b2a2c2e16 2921afbfdcdd6e54
+3050-3074 e753ae3c99977770 9cc364c0d9a3dc0b
+3075-3099 f60071661ebc0c8f ca2d18f44404984b
+3100-3124 f4c9360af48b440f 7af240a2640ea87f
+3125-3149 85407f92e8d4b060 bd145d4f7fd240cd
+3150-3174 dc0c1f3a339ff5ea dd557f80b758e128
+3175-3199 39def0120ef8bd96 be66d6f095492fd5
+3200-3224 47239a7be8a853d6 1035b9b99ecb69b6
+3225-3249 91c3c522fda4bba9 b221fca469a827fe
+3250-3274 6dc078e3dfc06b0c b75ac4e8624fd4ee
+3275-3299 79b85f5a1e50cff2 f2175b4594a23512
+3300-3324 a1b78c9ac96d5d28 504ef969bc9b9022
+3325-3349 8eac57aa3b36a589 906d5790e1dc47d7
+3350-3374 3ca7fbdde7485b09 04ee07a9de9474d4
+3375-3399 51a8d8015b62bbef 75fb3cd95f69e452
+3400-3424 9af28124abfd6a31 1443d5889a2482c9
+3425-3449 bd2644905284d3c3 8460306ffc6efc9f
+3450-3474 51a3a0e4ad44ded3 76d93179d8cdb60a
+3475-3499 c65e07dce54ab62e b2e298cc30050e33
+3500-3524 f9c7a57428eb000b c857dd9d76d14aee
+3525-3549 16b95ba98d3c629b 026a66706018cea8
+3550-3574 a89606d166adaaa1 ca60b9744572abf9
+3575-3599 e0285c98fcb36940 82bbc2e1803afeb4
+3600-3624 ee7581d050ef4f11 f9f8fc40e50539e9
+3625-3649 aa6f7ac119966a03 1f5c2f678cd46782
+3650-3674 533a9058644215cf ed8df24927540681
+3675-3699 b7c58b5494424e72 8e3cbc975614906c
+3700-3724 422a864ec933ce87 83dfc920f48b6c63
+3725-3749 27a8e5b1ed17390f 9ff0705542ff85d9
+3750-3774 37646dfa5884c996 9bdc9a2f4885b927
+3775-3799 17e51d1f7bfa8dcc 2d3ac89642a369de
+3800-3824 a42c87a37c418f7e 7c22b4e77064375f
+3825-3849 ba92d46512ecaa48 7195a05d067dc684
+3850-3874 4e0f257695d60b86 a61d616218326340
+3875-3899 dfff10713ac19342 f4ab0af228ec6f5a
+3900-3924 6a6d0795cd3ab92a 6a875aa1ed07756f
+3925-3949 39c0aeabe7fa7167 50f75144a1b850ce
+3950-3974 a40cae34c076f499 23891da0e0f5599f
+3975-3999 8cee75c9bbf423b8 a4489715ec91dee6
+4000-4024 c7b4a60bd5965916 4986b87884052c23
+4025-4049 793e01cb333688ae 66a4dc9b0699ebc4
+4050-4074 b8f6467ecaced076 42196aaf9ce369ba
+4075-4099 5839526b747a24f1 fa409f5fce794cb0
+4100-4124 4b144f8b6cf32dad d7df7cba966c5e8f
+4125-4149 f76a52b0463d6990 0672da719c4723ba
+4150-4174 297c8766905145b5 e48068db04b83d33
+4175-4199 57829c0edd537317 385b5288f76758f7
+4200-4224 8409611444c6efd9 3765a5d8ecd98d1d
+4225-4249 dc4056f30f39bbb3 d43568b9ab2c37b2
+4250-4274 658f104ded7b342a cb80390b87e36639
+4275-4299 9e06c0f9828d1211 32772763d5cf9058
+4300-4324 7bd7cd738d223f6d 1924177f7d9cba95
+4325-4349 1adede41a01cf174 2484595687ff6cd3
+4350-4374 0db0ae36d387d938 d0d354d53140fd35
+4375-4399 7f748aae1a4675f4 552ff7115328bc60
+4400-4424 0eae5f21629b09b9 07f4ad54e69f0101
+4425-4449 96900510ec7c9c3e 5cad185fd9e81886
+4450-4474 8c3d9fde4c4703ec 809a92acd28c2cc6
+4475-4499 28d01b9db566eebc c774243163da4021
+4500-4524 7d1b219877442a96 3ee75f377de60ffc
+4525-4549 ea457c638c810af5 0ad6d6626414cb9d
+4550-4574 02df6dbf69324b6c 2f7b615eae72f448
+4575-4599 f73dc28476ed6264 9da06970d3de7c63
+4600-4624 98b1a03ba68c18a8 4ab4a5b3cb6c4c37
+4625-4649 1684efa4f16080c0 07ccd6a3894ff168
+4650-4674 1b688c4763a0feba c2984993ab38eb37
+4675-4699 187df5dee75c5fd4 0a1683363c55f355
+4700-4724 b9acc2c2cc852e82 0b0e8f9deaaac737
+4725-4749 01a66ee1fae4433d 3e3e696b8b473092
+4750-4774 30ea6fced6cb893e 95abc03787eaaf23
+4775-4799 84f68c4dc8b7e4ef 3e6ea5e5eef18177
+4800-4824 bd59448b004b91b8 ab57f07ea79513a8
+4825-4849 fe2d0717c1d1bf94 bd262d174383e276
+4850-4874 d809a89766161545 8fff219ba1b02134
+4875-4899 fd36c7fd32a4d3a8 8dcf72f716686e56
+4900-4924 2c60e8b78e5cc57c 835ff7304055929a
+4925-4949 9867b6c5017b757f f03f23cfd82650e3
+4950-4974 9af3cca9bed9c4ed 659717628261f1a2
+4975-4999 dc0ce190698ce4e8 c2e432643acd8f07
diff --git a/crates/socket-patch-core/tests/equivalence/maven_pom_random.golden b/crates/socket-patch-core/tests/equivalence/maven_pom_random.golden
new file mode 100644
index 000000000..8036acbf1
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/maven_pom_random.golden
@@ -0,0 +1,202 @@
+# One seeded POM fragment soup, parsed for its coordinates.
+# <case> <input digest> <output digest>
+0-99 ceeda62151aa3e16 fe38e292b8adf574
+100-199 77c8562558e9552e 6d4fe2defeeb46e8
+200-299 ad4b7721cf741277 6d4fe2defeeb46e8
+300-399 a1f14bc33c78db8e 10d9d43fadbbe19a
+400-499 40a4c4025c82e3bf 1ea4903f73b31c0b
+500-599 8644a9e4b8e5cac4 5dfe0126e4a52e0b
+600-699 9a66c87ea7570852 229fd3e184570ab1
+700-799 82518d66ad970a1d 6d4fe2defeeb46e8
+800-899 a26ef5a3db858a94 eb35950f620a95d3
+900-999 f0e259b40bf56549 6d4fe2defeeb46e8
+1000-1099 82028d957345826d 6d4fe2defeeb46e8
+1100-1199 9a4ac4cdf562b771 6d4fe2defeeb46e8
+1200-1299 5626bd302fac539c 6d4fe2defeeb46e8
+1300-1399 55c7d939fb2a21f4 0e2831d674cd77cb
+1400-1499 1b2bd5c98615b4e0 04091012afe8ed0b
+1500-1599 1555f01c427f4c79 6d4fe2defeeb46e8
+1600-1699 e4b02340c8093b84 7268f6a7215f5317
+1700-1799 1f1395e3768115a8 341a23a09222b9f9
+1800-1899 421d2e143c9506a8 7a501d2b9fb09bf7
+1900-1999 7aace17918df5c22 6d4fe2defeeb46e8
+2000-2099 49fe81fb1f9a3c5f 960961d974284703
+2100-2199 f2090f3a5d3706a0 6d4fe2defeeb46e8
+2200-2299 b12426823351edd9 fcceaffc12ac855a
+2300-2399 d081b72558da0ef9 1635f3bb4895f289
+2400-2499 5722caed0a98f5cc b307c3841b6cccb3
+2500-2599 15e5bbeaa500ba4f bebc05768366a44e
+2600-2699 0ab509b624dc7d17 6d4fe2defeeb46e8
+2700-2799 86711b8c9cb3c11e 6d4fe2defeeb46e8
+2800-2899 f8825c3332c7fb91 3aad227d107eff3a
+2900-2999 00214e86be09a10f 6d4fe2defeeb46e8
+3000-3099 acc019432453d12e 0703338c1b240c3a
+3100-3199 a4377ddf0b7332e2 56fb9d6f5e267fd2
+3200-3299 c3d2a4097a0578a9 6d4fe2defeeb46e8
+3300-3399 7fe5af45c1e40d5d 245c172afad22320
+3400-3499 b76b831c8240d53c 6d4fe2defeeb46e8
+3500-3599 0cd462648f1ca732 6d4fe2defeeb46e8
+3600-3699 b8beb692c9bbae71 212a0ae491712f95
+3700-3799 c61c54e2d41f21a0 6d4fe2defeeb46e8
+3800-3899 765694bb38d23d38 2d39184f113a3512
+3900-3999 89942b22fd7b2dec 7268f6a7215f5317
+4000-4099 6b5306fe59d0be23 6d4fe2defeeb46e8
+4100-4199 12c0c4247621df13 6d4fe2defeeb46e8
+4200-4299 2ac0f72474cb735b 6d4fe2defeeb46e8
+4300-4399 ebbe3397ab914690 4d6572ea7e8250cf
+4400-4499 d15d1fcd066b2b38 6d4fe2defeeb46e8
+4500-4599 68f67c6e7a9b7bbb 417464b310a339e6
+4600-4699 165a9ef7063e8510 565247e496a34b72
+4700-4799 0d1339b94bb87a11 6d4fe2defeeb46e8
+4800-4899 9a2132f333bcce62 6d4fe2defeeb46e8
+4900-4999 70f11e20b601d113 6d4fe2defeeb46e8
+5000-5099 6056a9bed0e63ebe 9bc76f00fc324cdf
+5100-5199 4fc9296b090a055b 6d4fe2defeeb46e8
+5200-5299 2c04eeafaf88ba2a 9754700ea1666830
+5300-5399 56bb5fd8b66acc55 6d4fe2defeeb46e8
+5400-5499 ea993fae9ee22d60 6d4fe2defeeb46e8
+5500-5599 f6006e44a0d7e0f8 6d4fe2defeeb46e8
+5600-5699 b7bca94687e7e31c 427d6c166b179647
+5700-5799 f3498da40331e61f 6d4fe2defeeb46e8
+5800-5899 220210f9279a2a57 6d4fe2defeeb46e8
+5900-5999 e89a7a15d0fb818a 103ba96fdf71db1f
+6000-6099 052e3e982563bc18 6d4fe2defeeb46e8
+6100-6199 f6db719e23625017 c71321a6b14adb42
+6200-6299 17ad3348d0fc00e1 d104d78f87c527cd
+6300-6399 1ef6e5580cd1aad9 6d4fe2defeeb46e8
+6400-6499 307f27a5590a2592 39d6239d158e598b
+6500-6599 4e85478897f35302 2b1261a216de3764
+6600-6699 561b17b51fd0484a 6d4fe2defeeb46e8
+6700-6799 b5f7d125ca7dcfd8 6d4fe2defeeb46e8
+6800-6899 2dd58ca901042303 6d4fe2defeeb46e8
+6900-6999 4f5f9fb99bf2fb69 6d4fe2defeeb46e8
+7000-7099 6ed05be8f62f944a 56d4efb8b5cd9382
+7100-7199 a34941ecad55940e 6d4fe2defeeb46e8
+7200-7299 54350f6162c4cd89 6d4fe2defeeb46e8
+7300-7399 8d7fd611ff69dbf7 6d4fe2defeeb46e8
+7400-7499 7299ff2e7e2c0042 6d4fe2defeeb46e8
+7500-7599 b6d3a5ad6c2453e5 a02b27a84a793766
+7600-7699 0f53981a6fb348d0 bc7e68c57c2f02c1
+7700-7799 0e524bdcce5dddf0 6d4fe2defeeb46e8
+7800-7899 ecf0f021b0b42630 6d4fe2defeeb46e8
+7900-7999 b4673fa49050d948 6d4fe2defeeb46e8
+8000-8099 c718d3a723207602 beb44c99a02e9250
+8100-8199 cdf21e602f7e898c 6d4fe2defeeb46e8
+8200-8299 ac20e1dc6c70527b 6d4fe2defeeb46e8
+8300-8399 17f933ff1c618119 6d4fe2defeeb46e8
+8400-8499 392898283456b9f6 3aa2366696aeacde
+8500-8599 a71f8a979453d71b 6d4fe2defeeb46e8
+8600-8699 33f354888335bb64 ca444b1ae466e2b8
+8700-8799 1ce2c764bb6ae8b8 6d4fe2defeeb46e8
+8800-8899 e1be2f0d7d48d9c2 2b28f1c877d45ac1
+8900-8999 e20e32166bdc5e49 6d4fe2defeeb46e8
+9000-9099 ce94a4afbf06edbd a4e3011b1ec49d74
+9100-9199 aa8504cf451bb762 a3029571fa2d4011
+9200-9299 90e7aa70c1ca2dc4 6d4fe2defeeb46e8
+9300-9399 7a07ed626ad4d3e8 6d4fe2defeeb46e8
+9400-9499 3d50279abdf9b36e ac4963053b41507c
+9500-9599 1f963b925830466c 6d4fe2defeeb46e8
+9600-9699 af32fcf1420731ad 6d4fe2defeeb46e8
+9700-9799 06b3ebee17344058 6d4fe2defeeb46e8
+9800-9899 5b125aa057926cf3 8e99a4a9334eaa0a
+9900-9999 9e9d5c1b9f44d979 5a0cfda917d749ea
+10000-10099 78432a22d5e2bf5d 6d4fe2defeeb46e8
+10100-10199 c037c0961dd9f9dd 6d4fe2defeeb46e8
+10200-10299 0dc0322bc5dc084e 6d4fe2defeeb46e8
+10300-10399 9e43869af274a21e 6f547e90f07ef1fb
+10400-10499 5a114f63f9cb4c5b 6d4fe2defeeb46e8
+10500-10599 d5e1eb29f5f15510 50de3f3e36dc159e
+10600-10699 269c112ca7474227 b984bab27f5f1003
+10700-10799 f36998ffaa695a6d b4d93777cb1f0083
+10800-10899 310b460ced5431f8 6045df12bda52d35
+10900-10999 5ba306d3762f94b5 89787880b36e7996
+11000-11099 549ad634fe50f57f 7c31e688ca30cbab
+11100-11199 4883ab5e8e16a7c7 6d4fe2defeeb46e8
+11200-11299 7ff2aeb39e041b96 0d0b1015cc30d8e7
+11300-11399 ae32dc95ad89a286 6d4fe2defeeb46e8
+11400-11499 2ab0533386ef3d40 6d4fe2defeeb46e8
+11500-11599 1c88776f51911b36 6c4a12976cec2649
+11600-11699 b6112d23b1319dd4 6d4fe2defeeb46e8
+11700-11799 89c2da6c43c9c982 4e14d34a8d909a71
+11800-11899 53da7e5b649ee6e1 3e14e23d8655e187
+11900-11999 7d694913ec8fb348 6d4fe2defeeb46e8
+12000-12099 c418910a708c8a54 742aa030473121d3
+12100-12199 50caf91917479196 6d4fe2defeeb46e8
+12200-12299 7199f61b58a89018 6d4fe2defeeb46e8
+12300-12399 705685cd918f1fb5 6d4fe2defeeb46e8
+12400-12499 c0b3f41cfb62c1dc 6d4fe2defeeb46e8
+12500-12599 775ec2ddf3a0e3eb 6d4fe2defeeb46e8
+12600-12699 5de91dbce4de552d 6d4fe2defeeb46e8
+12700-12799 5d2cf1bb68e9aac0 eb52e3bae531ae35
+12800-12899 34aeb26135497fd2 6d4fe2defeeb46e8
+12900-12999 d5d562c9808728b1 6d4fe2defeeb46e8
+13000-13099 127dc2a6b3025cc0 6d4fe2defeeb46e8
+13100-13199 a0d9f899a2e58ffa 3a6233108c49c68e
+13200-13299 4382a19eb609d5b3 6d4fe2defeeb46e8
+13300-13399 ba7a34016a4347cb 5169bfee029ceefa
+13400-13499 4fd3a10515d5921a c1ae132c7ecd0da4
+13500-13599 abde9c4db9f1f17e 36d0bc9ac1a0798f
+13600-13699 17d152c61cad1feb 6d4fe2defeeb46e8
+13700-13799 7089e4891123d2cd 6d4fe2defeeb46e8
+13800-13899 520acc4cab34ec2a 6d4fe2defeeb46e8
+13900-13999 973d0ccbfabb045b 09984a373469e7c9
+14000-14099 664dd90a77ed5ffb 6d4fe2defeeb46e8
+14100-14199 abcec400dfa87489 6d4fe2defeeb46e8
+14200-14299 b1acad0c912bae74 0e3ae5e2c6dd9335
+14300-14399 c317578130eb11db 6d4fe2defeeb46e8
+14400-14499 7d4f11b28354036f 6d4fe2defeeb46e8
+14500-14599 851ef1f65441343e 39f9a1d1d412a789
+14600-14699 480c1e1b0de47743 9cc145536e393384
+14700-14799 79051b86c03326ad d442966e358e11bb
+14800-14899 5a0b80f692ff1829 ede001e0e80a9504
+14900-14999 cf6d54f69b54790d f605d220cb613879
+15000-15099 d5232510ede45e02 a5c6343b1f21e1cf
+15100-15199 a961f1b02b245399 6d4fe2defeeb46e8
+15200-15299 94898cc0310198d1 6d4fe2defeeb46e8
+15300-15399 21a445d67ac33a38 284ae3cfc55ca02f
+15400-15499 2c850c17c20b432b 6d4fe2defeeb46e8
+15500-15599 13b306efa59acf90 fe1744035e766b24
+15600-15699 f4c300e0ff3c4e8b 6d4fe2defeeb46e8
+15700-15799 747aff147a96a84c 77d75b64ff1662e5
+15800-15899 f7cdbc45914d5a3e 6d4fe2defeeb46e8
+15900-15999 3514c344d782376c 7c31e688ca30cbab
+16000-16099 3612ea3a5fe7b919 6d4fe2defeeb46e8
+16100-16199 ffcc4b0a232407d4 6d4fe2defeeb46e8
+16200-16299 28700a74a5b0da16 6d4fe2defeeb46e8
+16300-16399 4da99e8ac8ba9f2a 6d4fe2defeeb46e8
+16400-16499 36444ce857287621 9506f304c6c7e265
+16500-16599 f38bae758801de58 f8e14ef0708361fa
+16600-16699 ce225dc2a5f154df 3a0662521d321b07
+16700-16799 c53ac2d526297ed3 50d6dde2ebd9fe74
+16800-16899 5759244b7926a37b 67b992ddcb3e8d80
+16900-16999 2fd1a4f657a0d9eb 6d4fe2defeeb46e8
+17000-17099 ae8457666e46c947 2a13b63d7a73ae51
+17100-17199 e5c847c4340f36d6 95b223bd39a20da4
+17200-17299 81c3460f91a459b7 97c7bf125951fbd0
+17300-17399 acd214368ee950d1 5fdc6efe27ed457c
+17400-17499 ea2c30dc5466fb4d 91a4502d6de557f3
+17500-17599 fa6778e47ac2d9d3 6d4fe2defeeb46e8
+17600-17699 5fe22e30cf46b8db 8feac4289e0b2325
+17700-17799 cb16bfb6493ce177 6d4fe2defeeb46e8
+17800-17899 83b86226ae444d12 780018a4f635df4c
+17900-17999 52e78adf9d998f8a 6d4fe2defeeb46e8
+18000-18099 9ecc4c6767d06b6a 6d4fe2defeeb46e8
+18100-18199 86967c55bf52f782 6d4fe2defeeb46e8
+18200-18299 0e8379144e6de405 0105786f74125762
+18300-18399 fdf00789a0fb556a ff68630159214641
+18400-18499 85d8946f5fcb28f0 6d4fe2defeeb46e8
+18500-18599 1d6bcd48056a27a8 6d4fe2defeeb46e8
+18600-18699 394a2afff1ccba6e c09469d5386f3652
+18700-18799 10452a6d22ea9ecb 89b071da85e20561
+18800-18899 89ac0a995f8aac3a 6d4fe2defeeb46e8
+18900-18999 fef193875fba5444 bef7850123dfa7f7
+19000-19099 00a892559e739db5 2aa1217f448283d2
+19100-19199 cc512d0380a7812b b3295b0b991d8ba1
+19200-19299 0ec22fd70adbdad2 6d4fe2defeeb46e8
+19300-19399 3bb26aa61319df6a 42a3f19c6eaa2f40
+19400-19499 df77c1f0e1d58cc2 6d4fe2defeeb46e8
+19500-19599 5611b8eb38fa8204 6d4fe2defeeb46e8
+19600-19699 2808f87db8e62ce1 6d4fe2defeeb46e8
+19700-19799 1f3ad58097c6fc5e 6d4fe2defeeb46e8
+19800-19899 7b8a1eb72ce18ebc 6d4fe2defeeb46e8
+19900-19999 bf800d07f4dc6ff4 5de7e3eb519dcde0
diff --git a/crates/socket-patch-core/tests/equivalence/npm_lock_rewrite.golden b/crates/socket-patch-core/tests/equivalence/npm_lock_rewrite.golden
new file mode 100644
index 000000000..1338caeae
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/npm_lock_rewrite.golden
@@ -0,0 +1,202 @@
+# One seeded package-lock.json / npm-shrinkwrap.json + overrides.
+# <case> <input digest> <output digest>
+0-3 436ec9d91cabf549 6afbf79b2ea51d7f
+4-7 72c6e601ea066a90 0234d597163850f1
+8-11 1a50518a1f9eb760 0671dbb2288c2520
+12-15 4e4f7346053ff7e0 60ec31624712a77a
+16-19 e5222baab59219fd fbb3a1c64927f7dc
+20-23 d0b0cb93200f8675 36c2dd9b52c4f509
+24-27 1cac5c9cbe420e9a 58d66e565aa4fd51
+28-31 e5e1dc7a28dbd39d 29fc8116aa94fb5c
+32-35 002366dd89842d8c c5fc2510910daa71
+36-39 4bf727acf4b58a42 9ea5d8d9e0d0b7bc
+40-43 3e8b73c49e9ca46d 6dc1a2f316fea439
+44-47 a7fe841d45bc8929 fe7bcd7668916be4
+48-51 dd103d16879ecaae 7f6fc1a7d4b046f9
+52-55 73dee24177a90525 7604ade4a0a89219
+56-59 adfa05698e7912ea 3504a591b574d127
+60-63 9aceb0ed455216ba dbc423fe3aa2031c
+64-67 8739d95de7a176c3 c58dce409d967d71
+68-71 5ea4d9fab3ee0e80 918eb331f480af44
+72-75 3e3552717c3337a7 eb8e0a1834f3c4c9
+76-79 878774a4b5a8672e 6ad26aa874db0b3f
+80-83 62ceb4f1d9c83ee1 103252c10e0e4796
+84-87 f9e3df2cbdda6df8 078eeb46fd92ff43
+88-91 980b749f5d9d2601 58d76ad81a0736f1
+92-95 28d1a0176fdbb419 2c66448481270ec3
+96-99 04cf7d1b04237800 08948aed5135ec1f
+100-103 0e3e905f79585c77 af5e7560a9d0c0bd
+104-107 473c5fe992f380d6 27e2b78479f64dee
+108-111 da1db22b0fed5e3c 98f730a5706b25d6
+112-115 b7cf9020a594d487 392efc30f7f532cb
+116-119 76851929f8f47fff 892261da3954f566
+120-123 8dc8c914d5b0603b 985f1874988de52b
+124-127 1ada8055411da949 1903864d3d585314
+128-131 df5fef0e32810cc7 80e4b2ec800f162a
+132-135 73d8c7c7eb99e45e 244c2f2ce05cadd7
+136-139 53af449ff9f1fb14 9011cd7a515c0826
+140-143 b5f1275e6a7775bd 9da248d486b3c382
+144-147 7501c5b4b093f685 55da03ffc362d938
+148-151 71f61d0243effe3a 31b5b52dbaf2afed
+152-155 35351b3bf10277ab 7f198d2d08e2d656
+156-159 d630224cb78d8f5e ca68697c227ebea9
+160-163 c913c90ce202504a 11e2adc2d8e75624
+164-167 94f863055ea14efd a3fa28797bc91236
+168-171 33f3c575b9ed0c1d bf8c8db42eeccc8c
+172-175 d6ac5199b7210b61 98aa42cd99b2ef29
+176-179 66a7d5e6d0678bd3 a76633f81f07d4a7
+180-183 e5b67debb40dac28 cd0f2d2f7aa925a8
+184-187 9f5a62ec44c7a9a6 d64742504fdaaba0
+188-191 f9e22331885d4a6c fc9fd305e1ddc085
+192-195 64f9d1a554e8e683 7ef3c98c60d82ab5
+196-199 8e18128717944eef 1834aaaa0f9cf4e5
+200-203 a7d5e85430ebe498 a5c6cacbd076196e
+204-207 2a07d78540f32811 3fa6da640079201f
+208-211 c923981668a7dc4d ce52ae0e9fe5c201
+212-215 3bb07031bb4b68d3 44c191684952c35d
+216-219 abca87f1db06dfdf 7335c0978cc1c66e
+220-223 3bef52e1a95930ad a8c2c5ed16f51ab2
+224-227 77073756c6aab887 19df59fcb5719e5f
+228-231 56543e556123d913 10a44be416359fe9
+232-235 a608e9d19dd22fae 13685e45ce0530dd
+236-239 b6f1dc23182c5d90 2f9548820333e8ca
+240-243 70380a7b52510248 2c42475072ac9025
+244-247 11b7216569d17ad3 5bca5722c86de90b
+248-251 99b84e3e49cd3f9f 2dfb1d83eb83cbe4
+252-255 8288b030c7430ff0 f0f9bbd3e645f0a1
+256-259 1b5d22d607073901 1507fd6e0786016b
+260-263 98705af9db5f70a5 087b2271977ba307
+264-267 ff21cb4ee7527f96 7c0aeabf6e27638f
+268-271 05afd1d311d68821 961c2cbf0c72226b
+272-275 ad81dcb016e6b4ca 543f347b65a23c70
+276-279 8beb590c04efc77e 0c715c2207044d29
+280-283 08a61f814959f92c 8e480b61d81592af
+284-287 3789465398a2f628 64578f1e84310366
+288-291 789b3cb2f1d42820 68797a18e99c2dbd
+292-295 0003515075431603 9c8a170ff899c58b
+296-299 0f314a7f041481a6 536e77ae46114631
+300-303 93a3eb7e1eb61be5 bab49d863a06a18e
+304-307 9cd90679c646eab3 ee0cc2e069d5e0f9
+308-311 b15d26b99980b95f 28296ac8c39c5dcf
+312-315 b650f628757faf08 98807cd38d0e4fb4
+316-319 8877bbee4234bff0 281b9314ec579043
+320-323 38cb9f6c48b89161 2ab2a92cb15c09cc
+324-327 fed44161777c89cf 2e1a0cad7e7f49b8
+328-331 574808b086d4e968 45de24588519ef65
+332-335 7ff15f3dd1ecd28a 4821eb617b8d86ec
+336-339 77f7afcd87c36dcb 9f069a599d03be8b
+340-343 9b32b796cbf41222 562af394d0cb24db
+344-347 4fce9528f524fd08 7f3b5b09c26ad562
+348-351 06b5121233325634 e0f1d4a90bf10bbc
+352-355 6bc7710990a593eb 471c904c5bd15578
+356-359 b6fdc5650f65ace2 d9b4d4de533a4b35
+360-363 0bcb7491bfb50de9 21c59a685c9b48f8
+364-367 a8a87a339369d810 f9f82c123e2a73d7
+368-371 1cb3866a3b8b845d 44f173d7028a72e7
+372-375 e65748890859c07e e612c7529ecd9fc1
+376-379 fd4fb3da2bc44425 27eb4c24c582e5be
+380-383 7b2a108bc60c0062 c62f2970357958d4
+384-387 eccdfd6c4bf54902 694120e2b01d24db
+388-391 d47b6667005768a1 f681d116f11dc011
+392-395 2b562ec084078512 fdc1bd49d88b0f00
+396-399 d85a8a51027a33ac 1fe4da6c539ccf86
+400-403 2fa47d4613b4f1fb 9795245a300e80da
+404-407 a64a0346807a8424 6fd4d2a386eed373
+408-411 ee73f33b70405dde 0bc11d72a0297bb9
+412-415 75380e2d14775cc1 a2330b0fc992c811
+416-419 e6a09fdb977e798b 97225086b3cde613
+420-423 f30bbaf56d483bdc fadc9e8e38e60240
+424-427 6a4f7c861d9b74f3 88649c02c40ace42
+428-431 3d453a48fd5ab193 3875f53d37e204d1
+432-435 83897bdc74eacdd4 47fe549195bb9a15
+436-439 019316885110c664 d8aaef4d259a74ad
+440-443 fa47b9185807528c a4f72811e3bffae7
+444-447 38d2eb72452c9621 66e21676c46442a5
+448-451 a592da3d46da87b7 8a2b3312f0c89fa8
+452-455 d522f26ecff679e2 fe060608d6730ef9
+456-459 2c983208f7e013aa b2def197c1a7f2e3
+460-463 3032d2113b924c26 b45744c5bfb34150
+464-467 205f3e4e4b72a37b e1259bda18595a9a
+468-471 356e95dee8189224 0a64e4abb6603264
+472-475 0ed5ae6f2dce47be 6e0b231581610bca
+476-479 be2b8654f5d98b88 e32e1ee9c4690986
+480-483 b251e41140077506 3f2903a8a1f3d955
+484-487 709c021ece7adfbe a3c8744a57be0dda
+488-491 c26dfab7bd273c3f 4827195052919674
+492-495 d464742e0e9c6f11 bdeb1a87ef9305c2
+496-499 40b1b971ee1c4e6e 1bd273b112273309
+500-503 81889a7f0525708b 25ff9866dabb19b5
+504-507 1164a9adf43d83f9 ec0b3fba5c88c493
+508-511 ed8a2503a8b02040 37616449222b5305
+512-515 f3816947c895956b cc92331d1da45af9
+516-519 f7cf4dfa1afe8e4d 2412c7294ae0e7fb
+520-523 5c8125cbc885455f 2151d47d975cb37f
+524-527 e32c5f977e7f3afd 7c39d5aa3d8b642a
+528-531 f823d93114f54334 b061be4d09b62e08
+532-535 3c95b42857ac0b9f 3ca34eed97e981b6
+536-539 f2100ed9f54d76f1 d9bc957c8cae0752
+540-543 02ff176e35bc7402 441ba16c8b63b7b3
+544-547 31f13efc338cd642 1e3325d4109dd7b7
+548-551 cf2dd6e175e65ea3 cdda5e17b4f48a72
+552-555 75ebb1b561235328 d0df0c9009bc78a6
+556-559 3f737e7bb070001f 882e42c94ab9c1ab
+560-563 f9cf3a0e0600daf2 adb2ddac66bceede
+564-567 712070e2c1f005fe 69123af19dd03c33
+568-571 9909d31c73f3c0d5 b4e3b6ca4d70ca48
+572-575 2395dc1edd7abb8a c31226a5993d36d0
+576-579 eb29bd6947028161 b2589b8c5862526d
+580-583 7b73ea52462da6ab ae1c81bc0e42a310
+584-587 5507b86d706a1f4d 365bd19a4a6b4001
+588-591 b014c985229be878 66b0ec275885c59c
+592-595 9252add93bd869a7 b690d76fc146a3cb
+596-599 a11dc9d04783296e ec2982d7ac00c04d
+600-603 2725b972ac5cb9a1 0a0039c9514fa44a
+604-607 8d2b577a4ace3c2e d0d34470f95f0f00
+608-611 19711716f82abfdb c9c44c8231adc276
+612-615 aae1737f033588b2 ae6b338ed65863e2
+616-619 481f9a60220d9283 e04ec4070749160b
+620-623 461a96437805aff1 8fbb465964e46b0e
+624-627 90370826836abfcb 3e9ad345fcf9a2c4
+628-631 6618f5bcf483891f 99eeb42b41eac287
+632-635 f2f445689a5f4cf7 82d095eaed3f21e1
+636-639 8f53e218ad770c13 fc9da6ebac16e671
+640-643 4e8ffe73d766e8df 3ff41983caa23faf
+644-647 a16126334b82987c 943e9e9921ecb728
+648-651 f041e0d105247d9e ace2b06a8b8c8c2f
+652-655 1a8e20fc8ac36e0c 8fea29aad4870b17
+656-659 a96131e2101715a8 0aaa723ae5b9df03
+660-663 4cbd8ccf8793c563 2320f8c204b31436
+664-667 907d78284b983e3e cb9bf66dc3cda08a
+668-671 24012a58f15f4920 4564ab4a7f0d559d
+672-675 047e218a1faefda4 c6df6f0d87b9b9c3
+676-679 600823726bcfae15 7580908dfdcfea1d
+680-683 c7e78b7c4c53a207 804313d49536b1eb
+684-687 d8b5b27aab977e85 398c4bfcc9646dad
+688-691 6e34496f79edae77 e539a4a91043a734
+692-695 1c7bda3e06220e87 cebeb8199696570a
+696-699 26b84be788f1a48d 806297d879f04028
+700-703 94e4093c305a986c a3ad262fe1bbe8b1
+704-707 c73bf97238f19e0a 1ab6149d78be4168
+708-711 6ae4909bc03fc08d f77474faf5d33ba7
+712-715 d5f18003203fbfe6 cac8d4e20c22b5a2
+716-719 ee3012adb245a6ef 8bfa142895937a5b
+720-723 677c6583665c73ff 653e264f24b22aed
+724-727 d66c2b56646eca6b d75e9978ae05cfff
+728-731 4dd6cfd5136de761 a026a111e5942609
+732-735 c04292859165f162 1101d2c2bdbc07cb
+736-739 ca9d2e0e98c4eec5 b43ec4abbe4b9637
+740-743 5a82486608fcff21 0ac08b9102fe82c4
+744-747 eebbb4494d7a9137 34c8f3d49bf9d824
+748-751 24228e0121ef4eb4 e1e2ef0f8acc106b
+752-755 f5b827c4d38d3ac9 1f3743ef48f2b715
+756-759 c9fb5235f331e138 5e1314867d30fa3d
+760-763 61902d5b351f29b8 33ce5e620fa20e08
+764-767 156d4a6998aae750 edae9a91a5a0c070
+768-771 91a13cc81cb0d210 df626fca46bed1f9
+772-775 9920d2bb6f55385e 224f4602080a058c
+776-779 77f0ea705d98745d 15185a1ff7aa56d6
+780-783 7ea814a108add327 e910828f4f26627c
+784-787 3cdc860fc5478f90 aebb40e04549459e
+788-791 d37e6bf1e228a641 4bed71a422cb5f7a
+792-795 6330b1c981d4cc77 02a005a2a4cc27c6
+796-799 83acb0a27732fa35 71dc369195531335
diff --git a/crates/socket-patch-core/tests/equivalence/pnpm_depscan_sized.golden b/crates/socket-patch-core/tests/equivalence/pnpm_depscan_sized.golden
new file mode 100644
index 000000000..02011518f
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/pnpm_depscan_sized.golden
@@ -0,0 +1,3 @@
+# A depscan-sized seeded pnpm-lock.yaml set + shuffled overrides.
+# <case> <input digest> <output digest>
+0 ac457be5dab9ce57 f3e10497dfc8fec6
diff --git a/crates/socket-patch-core/tests/equivalence/pnpm_duplicate_override.golden b/crates/socket-patch-core/tests/equivalence/pnpm_duplicate_override.golden
new file mode 100644
index 000000000..6b517866d
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/pnpm_duplicate_override.golden
@@ -0,0 +1,4 @@
+# A pnpm lock whose overrides repeat a package.
+# <case> <input digest> <output digest>
+0 079dd0b62fc67e8a d4b25ff165bd224e
+1 c276c7dbae69afbc 8d62d8bae9f344d2
diff --git a/crates/socket-patch-core/tests/equivalence/pnpm_peer_suffixed.golden b/crates/socket-patch-core/tests/equivalence/pnpm_peer_suffixed.golden
new file mode 100644
index 000000000..a895c8cb1
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/pnpm_peer_suffixed.golden
@@ -0,0 +1,3 @@
+# A pnpm lock with peer-suffixed instances of one package.
+# <case> <input digest> <output digest>
+0 086e91d468b55bb7 53796577f31fa17b
diff --git a/crates/socket-patch-core/tests/equivalence/pnpm_random.golden b/crates/socket-patch-core/tests/equivalence/pnpm_random.golden
new file mode 100644
index 000000000..88c1595be
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/pnpm_random.golden
@@ -0,0 +1,302 @@
+# One seeded pnpm-lock.yaml set (every flavor) + overrides.
+# <case> <input digest> <output digest>
+0 845acd5c384aa141 86557e9261e7ae3f
+1 e2b1d479fcece67f 22c28b98ac0f0477
+2 c26f8036fc8d9885 c4a8f631b2560cdf
+3 b279683682f3771e 53ffc15b302ae93a
+4 48c47b949f14f39a 0329e582d126f538
+5 d392ccefd6fedeee 692f5da9e274faf7
+6 a5271e04812250ba 2ba07393b1c33397
+7 a780ae72d4e5a060 62f0fb68b7e5f39d
+8 984135256046f1b7 06b2d798e29f432f
+9 4d32423117232d30 0241d1f777c32dec
+10 337c2a51d41d76b6 10ad8a55f8d139d3
+11 fcbabe0000d6a74c 2758bb6c40deadc3
+12 a41e39bfd0f388be 0dfbdf2296ebe401
+13 50bf73248958e024 3ffb8eb6917aa71d
+14 ea7645c773c856ab de69e5009e8875c8
+15 f07f330e7bae74f1 0b69769ffdb1c53a
+16 aed7b4bc228792d7 b4bf6e4520421e33
+17 2cf7945ab554fa08 1e9b82eeb9ddd4ea
+18 4660bdc69d0a2e88 3e774f29548674c2
+19 381bd4625fe86b13 e8cd4e40e7d9207a
+20 c73a375f6b59cb51 07276d7e463857a1
+21 79085aa88c559231 beb490c65e1bb2f4
+22 450f7249978998ba d32901b21e3b5d5e
+23 95d3ca7729237645 f84c23bc4f9edf4e
+24 e73fc3ab922969ca adf2f9fdb9c80c59
+25 7e6dd3f710fdcf3c dae922c18cc0b1b1
+26 f1956ab060b35a47 0d8ff28f2cd7e153
+27 13feca39ec38c323 1fa44c1b66a0380e
+28 2802e2998c57acf1 638d8356a05908cd
+29 02d4869196db2dc9 0384892b9a4208ee
+30 f8b0db7ff0f94296 7da432dea7f3c696
+31 b5d730dd8dbdfbee cc24cc58ce10f3a6
+32 c2b2f495327400be d9dbd9869f82ce42
+33 509668fb554dcdba d5104d612326e9b7
+34 89df43005c5e36f8 d4fc859e33ab0496
+35 6d5d1bd00afdb9cb f37a267b8014d6e5
+36 6e3b0beee595bb45 dd3b7f58418bdd79
+37 51e79b33c6a1aea3 e1b918519edd56fb
+38 aeebdf87ace41900 4f28c68298ffbfb8
+39 e1a2265a46e35f51 ccea009b3da5bbb3
+40 e5e8fa3c3da64b90 fe306ef78e4cad53
+41 ef765ee755d817cf 578ba6ccc7d83f13
+42 6300015ed9399745 459cbf4728d9e40a
+43 ed215e89232a50d8 c6af9b9679f58453
+44 147a66c5fb34e166 2247848bf05f9aa4
+45 1de1fdeaa7d92fd2 dfa031cad69c2b50
+46 e7ab349eeec3f48a b9736369bafb3f1c
+47 1f893f8dc6d9fe3e 72439d9c572e2912
+48 322aed13b5d27f6b de2a67a04009273c
+49 624d6f76b9514d56 5264ffd52c909daa
+50 d00c11372e88c5b8 1c132cadf66aff8e
+51 af07e0fd78dcf837 d2bb330a1c6e07e9
+52 c6a689bb5af6dbfc e9eb9a4ce7161cf6
+53 509d2816be72b047 9496bc8280e2b4ca
+54 efe48aff4bc0aba1 5ac44e6488a2c6a9
+55 f0d8d00f78dcc1d6 6ba98e722a794104
+56 5b61a15fcf9d0fda 8f2b82a204cda555
+57 a9197f123af0f683 073f9e4820540a8a
+58 2df4d12a4d1ed7e8 33fc749155b68b9a
+59 a7043e47ac865f5f 3a2d037d1e7b4f22
+60 c479cd0a743ed9bc 469148a7f91c28a7
+61 41cbc2bdb04c3c3e 61ad040ae22bf850
+62 fe9a540988abe05f b1e44f8ad57c0d27
+63 a42be0f88160bd8f 7b321d1b6f28dc91
+64 269b4753fe9550c2 b6f635a866e5ce44
+65 a90ec678b36ec24a 5c9ff91ce4db1a16
+66 1e5a0880786d940e 2807c977d3633224
+67 432f5784d084e50b 850846cc0109609d
+68 43bf1f3a7823fe96 1d42b79fdaa7d0bc
+69 df2f251d8f77589f cdca0c5f16e10694
+70 8fdb7257c73f1806 7f2e44485c349923
+71 fee7f63b4e97073a 1222c58ee04124da
+72 bc70079b1f7a8a84 85dccdb360390c4f
+73 353895234d299864 1181657312effda4
+74 ada44408020214c6 c82be8ef6892dc71
+75 dfe68ff9a774e830 ad35fcdd7a1536f6
+76 9e7406be6b7242fa f7ca6e0523cbf03d
+77 6ce10ff44ec012b4 b612f69addb11e0a
+78 82b640a9e8dd2381 11946c4debd32e1c
+79 6681707d216c8fb3 b707ea406e8ea6b0
+80 984cd8bca1e98ab3 e2a0dffdc70b9cd5
+81 aef733317a857cd8 e26a7ec21c434907
+82 7b89b590f55b2105 344f2d0da0f3a24d
+83 7c4c84a8e4b2d143 8b834fa119de2995
+84 c74518e95c8fc268 cf5f48af022e5b50
+85 66622ae43ea80780 b69175b2d96e56d6
+86 91b23e70ba602e40 c67c2ce9dcb34e23
+87 7791bd07834fa335 acbbcc6212f79d7b
+88 d4deb3346780e74b 43e5c3352307659a
+89 eb81f01174b04824 bafe1da5f0c32145
+90 59b22f84492e7c02 85dccdb360390c4f
+91 2625e89af9e716d6 f992faee0bf0510a
+92 862d857e72bd088e 6a078b629129aa04
+93 853a590beb2dea15 ad439f5fdf1b0cde
+94 cd229d89ffc59296 ae0561438abfe0f6
+95 b6633a2e18ed8a8c c6aa50dfdc8d2b42
+96 6eafc45aaa071b3e 365e7b27785ac089
+97 97df3d634ae37b88 7d6ccaece8ebcdfd
+98 d568c9da0157528b 57e2fd33f8be657b
+99 4f3fa10405302cf6 e578553c9368cdb6
+100 6a12d2d385763ef5 c84492172f1a5c4e
+101 c9ac185fe172f294 8f8451a135448fc4
+102 84bcf4418e9bcf59 220b9095e99855d7
+103 fc73c01cba11aa5b a2e3b8320d897a9d
+104 f81c05c50080b2d6 bea5202dd77d29d6
+105 9d819e6a953fff9a ec64ff42bb1723c3
+106 48a2e017e6d81113 2dfd44423162d4b0
+107 0160ca5e622f983b c3e0272699ad4c99
+108 74da3cf84455f512 b248f9262c5c1630
+109 f8b789978dc5217d fc674d0071093855
+110 f2302b2235db0f5c e63b9bfd39c12195
+111 a51fa393d3516482 1b0381853978a436
+112 d1a64e23b82a555a 36eb05e727a50b3f
+113 07d8475f309f76b1 bb75b309aee3edfd
+114 733ff8571e7abe21 71d931da1134ff66
+115 8e8814251757da35 3fa7f4239b106521
+116 50cc9d7dfdf74957 9137620f1bcf7966
+117 69363bed692ce0a9 cfde3dedc8a15beb
+118 1f989abc3d625ee7 0fff908d2383b0b2
+119 2c39fa2550d13496 7ed53916a11f0d80
+120 ba6a03eaeb1c8099 8b1fb4cc14cd8d73
+121 3d3936b91ae20992 612826613cf0bfb6
+122 9f13d1aad39020a0 473c58d60cacc28d
+123 1c3c46680af9f517 51e7a9fef6734712
+124 4f337e13a76a1e66 c07d42dfbacc1a7a
+125 4c2e58078758c94a ec721e5dcb693c6b
+126 4741a83b28f8e00d 799708bedbf8bc54
+127 cc7cf8de415d28c4 5e584b24c0c21155
+128 fa598245dc7028d3 2aaba72d72662e4c
+129 d6dc7dc698d8ce4d ca696c0971d2bba3
+130 0f2ac556ed6593cb 007b2fa41d0325d0
+131 d8379277aac2a570 937b8245e7f14f65
+132 a3de3ed2141d14ff b432d92be9026be6
+133 98a7e01178726bfe 65fe5491f741583c
+134 9bebfa1d060dd3fb 24a5f99f46212a79
+135 6055dd1df9b0e94e 0a1dfb6fefd2aa1c
+136 e2d0a46c2b933991 7c090e8132dda999
+137 3c7d04f9ad5f699c 631d0f87fe7bad5f
+138 da35c25c447d8827 c818776065678941
+139 1ad23dc61e62a5c5 dbd2f0d21102208b
+140 5e0487fee998aad3 4f460446228913c4
+141 8937ebfab962d3d1 ff9d53b044acbb6a
+142 7ddcbde35b1d4176 e6665217433a4070
+143 7916b3b2499da887 861796c69cf863d5
+144 7a49c43c78ac480e c72dac2e6e44251c
+145 2d24bb888def49fe f42cf4cd20e6c250
+146 a88dc4f114fb364b ada685d3be546c84
+147 b672c11babd1f934 ddc8a3f45978c6bd
+148 2f06fc2e6ab2080e 945ef0bea9f4a103
+149 07256eabe7e034e0 cbbc616420873112
+150 56a33bd0df86dc0f d57dc179304613bf
+151 4d8d5b09155f94dc 528920983f9ebcd2
+152 343b3dce48573034 dcec680cc60325df
+153 8051bab5d97f6a64 c36ac8a31afce5a9
+154 ff0685e533c98471 a52fc55e41dbf1e4
+155 6d15c4fd605fd505 21856e4beb2a32cc
+156 6208125e3826bda1 0c7a4850ee33746f
+157 47cb281d8653a42a 2a7603286455fe4d
+158 2e846effb7732730 3b0c99008ab73566
+159 7f7d108eca77cc53 097ff0fa720d3247
+160 4d5e204e6df8868c c140fb38a4f4ffa9
+161 a55d91ca4be95c1c 4d4342beff2bf91a
+162 5abeb2287cb795d5 b82863b31496acdb
+163 f31d1b0fcf89d2c1 120bedb9c429a435
+164 21d6e4acaffe5f19 f4535c7d90454632
+165 1ddd551565beef3c e97fc66fe6e6394c
+166 ce81a38e51da1b78 8f22e2da5dd58227
+167 76719941a3421719 9650c3af5e7347f6
+168 cb266b421a87e8f0 89371914a5fdf312
+169 f7fa72101378f451 68ee98d2f5ec19c0
+170 6419b6bda0c45f5e a17b4615e1b0cb76
+171 50dab7f304863b3d 3c462c5a11237537
+172 2091bfcf163967c5 0021796de79371fb
+173 0c10e900cad5c7d9 4f26a400696396e3
+174 dbe3742499bcd300 cd1e650b6bd06e16
+175 09c4951fde66b8af 0e46e51036dc1098
+176 8cdf41b515ab8b7d cfe833a61bb4b73c
+177 3a91a117ff8abd20 e88c2bf4a3ae7f83
+178 c4333cda1ad530a0 54c0f42c16a697f6
+179 c3e509ac21003672 39c778ac3a029ae3
+180 d4a0e534d40fb7d0 758d0ace624439bf
+181 0c4a132868a7dc45 00eb26045e83fac1
+182 91d5a815a7ee06a0 a03acaaf2dc73457
+183 608eb68a67a8732c 9e67b2c5d7bd454a
+184 e3ceb9e28c533b97 5662d62477869d37
+185 a8af7754efec4c02 fef44ae7704f54f5
+186 2c61c193012398cf 0b1b553fdb67d510
+187 f62924de0e2d7d25 c6287bcf1f166797
+188 c87d194b3c52b25a e54676099bc664a8
+189 b4e9ba931a6dfb06 44537fb8d9d46156
+190 405e92449f6c6973 7aaa34c616511b04
+191 e6d5f505c8b13f8e cc02b2f14b00426b
+192 dcf05be7ccd9404a 1e39ede692ce307d
+193 5dab80036ec95426 d0ba91fb922300cb
+194 28b220d04e1b90bf e512b3dc4a4ebe7a
+195 7b58b330f6550d6b bf6c594c70a7bede
+196 7ca9bd574a3d6dc4 6430f68d12f1611c
+197 733e54c38f51d863 e3801a0cb5638edf
+198 b3834135f39fb7cd 893218e812b014f9
+199 59ff1c1a965da283 3ad9b509a032213c
+200 4e3b273dba36981d 41b2d8553aa079f3
+201 6fbb150df84d4ce5 7507fa5a5cef3b0a
+202 06d02a9ce138c19b 65a65397824787b9
+203 e2ac8d47918a3e99 4f1c0add74ab3041
+204 959d86dece7491b5 f530c6a70766d661
+205 598567f6ed0c80fd 3c55af7ceee182e7
+206 595a7bb8a2b8383f 98843b30447b37b9
+207 9c47f008d8734910 f26877c1ccba5eff
+208 f29467afb48d86de 08c0e322fa386a63
+209 0395ccea807d06a3 bd38e9145de2898a
+210 de6d363b1cb54d6c 1958e62086157dbe
+211 e2000faaba0db099 cb654af40d4cc3aa
+212 ac5e163b5ec4b0de 43f06d65eebc3f26
+213 812b7768bae46f88 731b45310f48a670
+214 5cce0ec47bf800e0 422cfa0fcf192534
+215 78c914c9d5338950 4373d7e8a999cfdd
+216 708e7aa1c500718c 7cb918c5cbecd08e
+217 e4cb5a55aab28a16 52bbc4dca9098108
+218 8ae001ea4f01a15f 0744b1a8269191de
+219 09c603d99b5ea6b0 056eff9d441b9924
+220 a2eb633c277b03d6 251f6e74ffe70890
+221 22b546a29141220c ed8109a9adc2cf5f
+222 1be332ff4141026b 49a0f3b6d3668dc1
+223 658d3d51361eb7f5 005efd0129732dd5
+224 06a0dc4f82e50344 131ad0b3d2543b96
+225 e3b0b0389d8fb367 94b3b4761396ea58
+226 e6e12f4fb23e1c3c b7ea630601d68e4a
+227 3bf2c36ad7b22d6f a3984649726c3a8f
+228 bfe6bb901654f595 e0f2d14826ec2831
+229 0bc1c1d1ad3ea0ff fcd68b93fd906049
+230 99bb4e15d6f05dad b970669d497f7c75
+231 6557e7e245c5083a e52ff07643088bba
+232 60ed5a530e07f222 542edf290c79e9de
+233 6da5dbc46ec877fb adcbfdb4d9fe9ac0
+234 e1c7e9ac30cfabfc 6693ac60eb7327e4
+235 09e78b9fc8bdd11d 0445a42b8a33b97b
+236 2050fadcb70b6cf3 b223910d93f2f8ee
+237 58ab859a453877f9 ce1e5ff6ff63f571
+238 0fb311979914b252 5f0308acad632beb
+239 2baa96cbb1e08480 162e7342dcd5fb95
+240 9ead4da83e9b2d9c 737b4e4d2f5c8738
+241 2ab476ae758fc8c1 cada05e73e2fe831
+242 5d144f8447f3bd4f 5369d5c87fdab08c
+243 c0be02aa8a65463e d007087a4a342f9e
+244 d3add35a4f65e768 37326391150989bb
+245 44592cc4d1a20888 473a9e943690f9ac
+246 726b5910a1188372 310ddeec5698a8f4
+247 d7361c301ac4c639 bbefab0ff68deff6
+248 f0b72fe5b5ec0ed1 9419542d8b40b813
+249 c18056bd7c6a544a d0b511890e32b0d3
+250 97deff22c339f0c6 ffb3532c06ced802
+251 39e9c9ce332f90ed 1bc5767f7a495c8a
+252 969b0b8e37747984 8bc231b46b90403f
+253 6f529d773ff0e04c 327abaa71f7eb193
+254 4dfb5a5828d36cfe 0e579c3915ed01e1
+255 d4abae6d7301a238 ef31a004eeb8cba4
+256 5ef54f58baebc45f b65ecf44882fcb3d
+257 4ad5b0d3b2ca5191 18d32f1c8449f18e
+258 118458b49ae70d85 0b4299cafde3b7a7
+259 443ac3a47da93b9d 096d51700c44cba6
+260 0d5c3e2dd54e2689 0669c3ded68f1008
+261 c58a0a19ff0267ac ceecc9df3546e4ab
+262 48f95e253c3be932 2847e98a74eb4d45
+263 c58a28463de6c810 fd4c46bacccf047a
+264 2542d5ddd25a7371 51804dd6660443a7
+265 2261d6dfa9bc4010 9b8aade0eecda0d2
+266 d8c78af97b65efac 636dc05e81dd4484
+267 c571aca902b8e9e4 53ce40d303fb6f80
+268 5c78a294cb41c4fd 2f14d335fc161f5d
+269 1556256cfcb51ce5 353dfaa98d41e0be
+270 ce83603d9eb871c4 18f96bc2239e7dcf
+271 e8fccc9859070e1a 751ef70c971bbcea
+272 5946c06eaa21052c 692cc7d2ef55a37f
+273 e907dee4973daca3 6c97206e8d37760e
+274 f9feba1f0f75e17c 81d3f469170025bf
+275 83e961eae1570b64 b5a867977a0173d6
+276 3fafd107786d762e 5f85e5ca0a8e09a9
+277 d42c7655be849258 021eeb79b6e3668a
+278 186cc7b21a9ded6b 5d265cbd9732a0d4
+279 04bf18957e5f3cfd 7eb4d003174524c2
+280 4d38e19e544b9afb 25bc546b43cd4df9
+281 10696b6f48619aa8 b5563fb664db457d
+282 3f3bd21e6f071227 fce72442c59fb99e
+283 9e1a4297ebb8b517 f10a86aa929f96d0
+284 410607f08b3963ce 723ac9a2b4b3d871
+285 7589ee25d5ead86e 834d65bc7d4d3857
+286 c02dfbe9a6090f8e 05d50e5d7f22801f
+287 a5adb2c91a101cd7 0756f468aa4c0ff8
+288 c4beb4e67d804e7a fe657dd1d9d7eb98
+289 35c1898d9a28ef17 91e59d72ed5c10b1
+290 875c15574e17a6dc a977fe74e59ccea7
+291 55918257f281cb11 4945be4adc6879d6
+292 2f3765f354dfe090 83ac874984ed6418
+293 c28b43ba9ec64980 9dbeafc6de348f5d
+294 b8353bad83045d97 f4535c7d90454632
+295 ea61e12cdc996952 ef17303d4c19dbcf
+296 8bfeb118162528a1 4a65753d560ff56a
+297 1a15d0401a092176 156e2738391b2777
+298 467016bb350357c0 186ac9b56b590757
+299 952be724c6617c65 650734e70de17bb3
diff --git a/crates/socket-patch-core/tests/equivalence/python_lock_refusal.golden b/crates/socket-patch-core/tests/equivalence/python_lock_refusal.golden
new file mode 100644
index 000000000..7f7722cbe
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/python_lock_refusal.golden
@@ -0,0 +1,6 @@
+# A uv.lock + pyproject.toml whose middle dep is refused, LF and CRLF.
+# <case> <input digest> <output digest>
+0 6d7e563bb65949fa efb0c5ad3e7e4d37
+1 75c450008bf727d3 05f38ded897afaa1
+2 0f842216382af53e 5f70dfa0b238ff6a
+3 bff9fb490135ba57 c48407e0913b0c9c
diff --git a/crates/socket-patch-core/tests/equivalence/python_lock_rewrite.golden b/crates/socket-patch-core/tests/equivalence/python_lock_rewrite.golden
new file mode 100644
index 000000000..7b73bf4c7
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/python_lock_rewrite.golden
@@ -0,0 +1,302 @@
+# One seeded uv / pylock / PEP 723 lock set + overrides + wheel metadata.
+# <case> <input digest> <output digest>
+0-4 4246a1d1f25d9fa2 48a0e144464b8f8a
+5-9 a5a26dcbcfd0207e ae07e91b0894f326
+10-14 42db1d0b4485b5c5 ce91f93cd49ca4f5
+15-19 a61747719df830eb 590f305643295efc
+20-24 fd4e44904af2f210 9fa1deaf96f07fe2
+25-29 073c95105fb1ba25 3ab9faa9395cf06f
+30-34 1e41e24ca7944ced ade5041ad97eb6f3
+35-39 08b94291dfb382b8 040d41e8e286d342
+40-44 8fb06b65316e1e97 b9005c5ab4e2d992
+45-49 90538ba474aced2c 703a8fae640714d8
+50-54 70e99cf706580234 6ba89e38cf850141
+55-59 e3f14f7643288326 34103170b8df8696
+60-64 5d9465b1b083884a e269d6e79181da6a
+65-69 0746b50391a7c655 ffec6efe319265a7
+70-74 7f5d09f71b20fd2e b1e8a696d2d54b16
+75-79 3c77826082e3396f 42df63da4590a254
+80-84 3907b9d56c9cf26c 5ca41094d0424e3d
+85-89 717aa5d3a3232bb3 65b152efd83c3bd6
+90-94 2f1d4d111168252b d69a5253edd903d6
+95-99 ee9a5a4f9adde785 c47c75663ff48676
+100-104 bc117d99280f56ec 2c43f956c74c6f26
+105-109 4ed96027d7159080 e20dfee24af86bff
+110-114 43f78a58fe44d48e 3466cdd3d19a1300
+115-119 b4cceca352fbc413 8466395f3165a0ef
+120-124 e74852f5fdd1d5b9 41fc3cf934fc6087
+125-129 7512d49b677869d8 a47bfa725066c0f2
+130-134 fe9ea18a4bc1a405 047307c34ed923f7
+135-139 ab1ba8eeeb4b026a ec9316e47aaf4eab
+140-144 6a3abc2efa8769bd 56ac168022c5a5f6
+145-149 70d6b42568f8ca34 f16c3c8253ab5ddc
+150-154 fad9dd453088a595 121853d116c28aa3
+155-159 f9ce7edcf5c31b54 853fcb9da6efea74
+160-164 7057a249f512d760 34d616cba9ff2f92
+165-169 825ebe6a1d5cff84 4ee31b57d3a5fb45
+170-174 d92517669f012741 4d8622bd269f21c5
+175-179 d3a86d3b9948efa7 fe0ef3c12d1a0cb2
+180-184 b974311940fe7729 849fc5b3c32d6b64
+185-189 03de7e166de975e8 42f8708863320edf
+190-194 760880ff5ebbcb7c 03f687f9a1ef3754
+195-199 e9581c532fa6a9f5 a2787877f35e9517
+200-204 e04a861ba5c6f6b9 31aad032ae8b9c21
+205-209 71d58fc0300f2948 b0f2b706aaac0850
+210-214 2e7b83648984283e 78fbabe1106e949b
+215-219 f1aed69bb4e21e43 4dd9af60759027c9
+220-224 db3f3ff44ea5043e ea1624f09c3d14b2
+225-229 0a3f323e6d7f431c 6351804ffd423e35
+230-234 3e604b105b62115c 0bac935606117b80
+235-239 01c13f65933d4779 69b3aa958f41d110
+240-244 832b673100f611ba 8e780f81f0f963a3
+245-249 f0dcfeb0b6a23cbc a0c928a84a61285a
+250-254 e71240e64dfced17 d0f0d350180f3eee
+255-259 94919d58c33e52c9 d1e8dd678ec4364f
+260-264 197b70004c8a9fba c28304e6d6901fde
+265-269 ec83fca69b6f38ef aa18c672fc3c2eaf
+270-274 60a4a2a288f41da4 420f0773032cf669
+275-279 5f8328a3110fc056 bb0f59f239f75d75
+280-284 f969ffac3b5225e4 bfc9c9e993e9a71a
+285-289 43df88790957f84e 5f7f1a56d0410550
+290-294 8bd7285ab2fd2d7e 2b87546cfa85399e
+295-299 0f8ab29ece91dbea e891c6658cee191a
+300-304 c6f92dc176f158f1 458bf378d060d912
+305-309 b57d3dbc4b5ac97d 9773426cddea96c8
+310-314 47617c267fb8cb74 aebfc7302ea42601
+315-319 eaa9768bbc630bf6 2a770b1138e80898
+320-324 dfe2152f570c051e 7c2702afd192fef0
+325-329 2738d6af1e309bcf 6c57e6841ecf35c3
+330-334 a9c95787e7a8dca5 35fdd17d28531ad6
+335-339 db9cb1793dc57c1f 61f544ab33b2cfd6
+340-344 2612e962790778ff 164a716794d54313
+345-349 5b610d146513faf2 1836f9a125c48b47
+350-354 6a2b9ef832452841 75535c0ded362ece
+355-359 693b421e1707ff7e 135f6304ae30656f
+360-364 780638c49699100d ee7e33f8f8305703
+365-369 ceea14be62cd4dd4 159ef5b3c823d104
+370-374 39f9e4aa5333b6f8 eb537062c9b097a3
+375-379 9aa94eedbaddf86e 0345c0b1783881a7
+380-384 04716c0796688c14 394248e293242674
+385-389 0496ead79aec4887 a48cd849bf320b7b
+390-394 29095a6eb8e198d1 8a4c74b37267fb35
+395-399 1f6d2cb0c9d79b77 5fed6d12d2490ddc
+400-404 7381df995b737c25 06b82bdf156dad07
+405-409 57e7849c7641c43f 4c43f9bf02b1c878
+410-414 b8b3d800fdb4a31c 9451b97982579b88
+415-419 8f57ab3f9def7cb1 167b4bffef187ba6
+420-424 dde5f452b921ff47 d23974a3a1068894
+425-429 d518f388f91516ae f5d0b8ab277a2913
+430-434 b112897a2f8b6e87 e5605a0a65a3449f
+435-439 156e1f9fdb6e0855 29d92ee2415d97a6
+440-444 815514a3771bbe18 5cc3259644dba24e
+445-449 f11d33ce7b344cd0 ae824a4613425ce3
+450-454 5f25ecb64bb85011 509f4c37ddd7e5c0
+455-459 361ec7baa03ded4f ed317c05f75fc6d8
+460-464 5ad79f8a3b80d450 1c2cf9bde750b81e
+465-469 4a0a99ab0580f9d4 fd4b8e2927bebd03
+470-474 6bfdf455045a86a6 2d8a71aa7154e62a
+475-479 5aac218d281489e5 b85602f8b33a3a40
+480-484 772f52a5e6ad2350 1f45e83958ffd0fc
+485-489 d46af9a65b156c8e 209f6097b55a6075
+490-494 bfef203ae00b3fe0 f2ef44e740b04752
+495-499 1b31a7c6142eac25 14e10c33f2200fd2
+500-504 7926ae0f92a86a9f 5cb08498d8c7701d
+505-509 6d4f0949b263089d 8d22ee5d9c4a28c1
+510-514 dba067b22b29f75d ade0d01f88cdff6f
+515-519 ecb763e1719c76a7 4a93055b7f3ee09a
+520-524 6b8b96482b378fd0 5cd6cc5bb8431e8a
+525-529 d077e356f00005a3 43a791951252a9e9
+530-534 32208474e45e4a50 2d5fece8c7f51bcc
+535-539 322c023cad5e3a3c 202e07f57fcd5ad4
+540-544 864e5d1986141dd4 a412eafd24000b57
+545-549 03e1ff7e508dbd24 1a54ff34be5e0e66
+550-554 36bee2f379a522e4 b218188b3377d409
+555-559 40e8550932d36d58 46055bd9e4a3bb42
+560-564 ff9673e17730ce79 2484d12a07617823
+565-569 6a1f7fe5fb56c675 29a97162543d8b50
+570-574 9376ad2878332e9e 9129c77c05f88fc1
+575-579 dd9649c26685e3fb dccc25c013660626
+580-584 cdb2921a2994e2cb 2c2c062689744a81
+585-589 8c3d2a58fb96f2df cf5507fcd05366b8
+590-594 77c7a32edf05ba6c fe36de2dc975e97d
+595-599 60b7e1357259ecdb d2a9ec7caa9fafd6
+600-604 8ae0729cf2305fec 4c047a0a600ee68c
+605-609 2517a16d4eb94721 33a266c3126b7268
+610-614 f88d321103db46d7 1dae82316d44d372
+615-619 b42fa40b448cb9e2 efea9c54f9b7df69
+620-624 55348566515493dc cc34678cbba8cbc4
+625-629 d56d61284864db7c 35647b7151bbe854
+630-634 87829693b412f4a8 b51049d5a507e712
+635-639 ca3c05bedc928725 97c29483a27d20fb
+640-644 d67c3ce50a2febc0 3487fe4c2cec2c2a
+645-649 863b5598f984bf03 3a62197bc682135c
+650-654 7b375d32b1b4a4e7 8a9bfc4768db7bb8
+655-659 385e2c94ef7934a3 8926ce36aa150d51
+660-664 e3d8a373d589986b e85fffa3833a1371
+665-669 5ba094e5031ad65e b483caa3c99f50cb
+670-674 ebb226a9484d0227 b7bf3747d5fbf62b
+675-679 4b46f87572b2c542 83b29f9e3c6941d3
+680-684 6ce1a3365afe35e2 aee86cac7c126b10
+685-689 ec98c83127bdc7c2 420a3a319d2d57be
+690-694 4cdbae074cfeaeef 9a4bf80f37fc9789
+695-699 bf080f91ade5529c fa37072b6e4e7450
+700-704 7ddf0acebd095697 bbaa6aa02e40ab6a
+705-709 a8d479e2fd9ecd09 8ce390034469015e
+710-714 20801954a140ee9e a05f22cc7d6e9e1c
+715-719 f02816f815324d14 6c033a3cb4d2f9d3
+720-724 7a0384b45bd4fab3 aadfdb29a8bcc99e
+725-729 fe73a5da8e81a6a1 091c5a374fc1377c
+730-734 07950d08a43759b0 491db122776600fc
+735-739 a32c1efc62f52a6a 2138cf6efd2f4588
+740-744 47f9bead12a92e2c e2e144556544337d
+745-749 bd9d7cc0d3baa3de b97784b37ffa6263
+750-754 f4086e74010fe1d9 ea15a0ee1b498b25
+755-759 10dfb7dd622c0e2d f12a5d7653e27e6f
+760-764 8b262519fea5aa96 959dc5c757d52c8d
+765-769 da04c65473fac9cf 049f159ef1f568d2
+770-774 7c8a5ae32aa67a84 dd07433b2861886f
+775-779 4029e4dd51c6652c 24950068997cf758
+780-784 02705cd644839fbf aea7405cafc4c5b7
+785-789 4a871ab89a8881d6 d09cb03d8bcaa1c0
+790-794 143d349032fbfabf af6b032b8a30c9e4
+795-799 351d09b66a47a032 7fe79ef93103d105
+800-804 61933e9ed65b6a16 6388df7540367932
+805-809 37bcb047d5aab6f3 37cd7bcf3db57250
+810-814 62b3dde6f7772737 e8dce9cbdaf9c660
+815-819 d5ead64e902d85c6 73bb5b3877877d35
+820-824 448a71c94fc8c473 b5ddf35a824246bf
+825-829 809660a9d73b2f8d d0a1e91738e2ec76
+830-834 1669922b7bd34d1a ece90eb006469f2c
+835-839 a84c09e09a4c979f cf44816b0061e2ae
+840-844 f7406290a526001a 114514f32ba03093
+845-849 1e98c88ae4fb1aaf c8bdad3967dcbcc3
+850-854 a64a2bd04fdf9294 732ca28e3d4297b0
+855-859 a2edcf1699e9652c 6aa69904a771b1be
+860-864 d1c88279b148b2a5 bbfe2b44c90238ee
+865-869 33eeaaf9e99f21b5 4306522989316626
+870-874 308b0324eb073508 bad87cd34faa9fff
+875-879 743c627da20d5f4d 68cb56df14f44059
+880-884 35b0fd26614ae4ce 78f4d9f2f0dd1801
+885-889 27e378cc7773b581 3c93b27e52621833
+890-894 4bf3856889f8e975 a3c5804a9da388fc
+895-899 0fd27748f27c928b ddc86e63ebde42c6
+900-904 9835192f858ef3b0 83e3365600063210
+905-909 b463b3370e32e5a6 457ee81515713cc2
+910-914 21671bc2f7471f47 9306a002b60831fd
+915-919 63bae266784bf79e e87365882f0beeba
+920-924 0cf5fbf646d318af 25eb24321c54f780
+925-929 9a9cbeb44f87117b 36a2a2804e7199c0
+930-934 335bc8200a0caa48 b5dddbf9c9184d72
+935-939 cdcd3dee492bb02a 599467bdcd4949b8
+940-944 b2e0c90c9f5661c1 0bb7947f46f77e87
+945-949 04eb14c5a23b42cb 0b69206a8bdd92aa
+950-954 183e2800bbb0befd 0d8028b27ca53895
+955-959 805b9a4e8a8f2899 35a711c543af79eb
+960-964 050054c9ea73789c fcdcb792020ab11d
+965-969 ec82be7eb93f9b5a accc4d3b52b55f17
+970-974 668d303117b56d11 d97e1ecca67f167c
+975-979 f5753a49542389c8 1382eae2605e3b7d
+980-984 af9bc2f82dcc463d a0d94833e09775ea
+985-989 03cfc1c7dab3b00f 732049e217f02ccb
+990-994 f5cd733d6f2c7cf4 eb3b3c6230974260
+995-999 d47487e893d8f5ca d7ebad60ceec36e0
+1000-1004 d82279f4014a7aaa 0727318c8714df42
+1005-1009 ee612a87b14a705d 355fdf9286f05798
+1010-1014 3e116e0aedb23775 b9b5a3a04eecda96
+1015-1019 ca8d302b527d910f de4ce5e33e0d1833
+1020-1024 c82c89bd7c3e8ece 489900f10b3cb72c
+1025-1029 692bf1edb8b37b40 434d0d92660eb334
+1030-1034 c681f72a1ad96426 e781914100066bf6
+1035-1039 862e94feb9ce17cf eacecb30a4ac9cb7
+1040-1044 2447113d13545b18 2eb630023ef89bd6
+1045-1049 f61bccbf5d174182 36356c5c4b00e9bd
+1050-1054 7ba638b419ebb99b bc2a9fe2197ec4b7
+1055-1059 b9c2b945389e32c6 9cc3743396a581ac
+1060-1064 61cf0fd522dda6a9 48a9e7854dbc4dc5
+1065-1069 201f4830a3058984 5565fb9078c47532
+1070-1074 b1a231a2045bd65e 068bb08e149f4464
+1075-1079 3eb211c20ca52d45 fef6ee44b83a0b99
+1080-1084 dc173652a304a0f8 1e2593e8af06cfbd
+1085-1089 639794b0e0a5512f 9b87d1e77b5a7538
+1090-1094 d04f6c6075971311 319c81aa9068c32e
+1095-1099 f9570c020c6273ed abb36a2405d57084
+1100-1104 b0e69c932a202ca7 5579c18523a5832c
+1105-1109 9091735b166e2e01 51c62ff51c8af2e4
+1110-1114 0f5cdd9d325e3035 d7616af8e73b78de
+1115-1119 a88c4ab36e8b5525 e6760b2ab436b96a
+1120-1124 e2b8a765ae32bc05 6bbca72310c14bb7
+1125-1129 61b106b1a5833cd1 ae282d0c8193cd22
+1130-1134 8b11b9c6e72eb551 6b874f3cfe5a8fc9
+1135-1139 d40059b61cc54aed 6bda0887d04230ba
+1140-1144 a5d4f344d65e7af2 3fb8ade336a5c7d6
+1145-1149 e23e72290a0e3ac1 480ad4ea25e080c5
+1150-1154 f106ccdfa52c3028 64986e06854ec675
+1155-1159 3ffd8acbba19849b e1c407246e3db283
+1160-1164 f5d818be75d4b41c be60639cbdf765b0
+1165-1169 138261edd1fa6ef8 3247630f4715bab6
+1170-1174 f51975bde6f06222 8ce01f5933288267
+1175-1179 db7ca3a4ab18c609 f74c503679d95c63
+1180-1184 e1d6ff2d0e1abce7 b540d1ce2616d726
+1185-1189 921e6b51ac039f85 730d26cf221de4a6
+1190-1194 8ba390a760fb045d 6c0326f584d4cc47
+1195-1199 5b59ba1f05a4541c b805922b219f6337
+1200-1204 947dd0cb57af675e 1283e8e570bda37e
+1205-1209 8373edf7e3b877d8 61e7624495287ee6
+1210-1214 f1bd0e615f2da0d0 00119cb67fa3ecd6
+1215-1219 b36e6145ed6d6795 e7b94f1e48147a90
+1220-1224 4dbf58c153b299b2 231dd0874c6755f5
+1225-1229 8898dffc5b694bef df2a03c51d6c3fdc
+1230-1234 1d4d15a6961729bb 670c47a3cce7618c
+1235-1239 04aea1ee3d1969b8 821efaa24f2b62b9
+1240-1244 d09da3a0be22f908 3edd06583588d801
+1245-1249 0f9208447b58dbb5 512797b949f264fd
+1250-1254 34aaaf3262443fe8 57a14aa19e34660c
+1255-1259 993a63e93e5319de f88d92dd1bcada2c
+1260-1264 3259d5cc0293cd53 a4f79bdb0ab09720
+1265-1269 82ee3acf13eb4acd 4611ad1016b5130b
+1270-1274 82f75e024efa2e91 6ce85e6ae2c08b17
+1275-1279 5539e5f2b8e4c15e c1826baa46eb4b3e
+1280-1284 911c89216b29d64d 9ced5547bd54c1a9
+1285-1289 4b04055786390352 5b7faaa1a0713bfd
+1290-1294 83e929c23ccc1078 b95d052756067610
+1295-1299 68194049f570b68c 48c3046250deef23
+1300-1304 087c7318e552b5ee 7a99eefa76f2470d
+1305-1309 f8bd1e0ac11bf341 b63f19108a0245c6
+1310-1314 1e2640e7cdc1af0e 928623220e0baeef
+1315-1319 0c9b0bfcf693d0fa d45a129e78008a8e
+1320-1324 a5fcd09904fe26ec 48b0bff72e8cc16c
+1325-1329 efbc928054bf4997 66255eb274356b46
+1330-1334 37bdc62d616da4b3 bb5cb44c0018f1f2
+1335-1339 b5d2a67d34beee3f 4f78edd9e58c2c92
+1340-1344 ab08be8fa335a2ec 2421aa9dc78a887f
+1345-1349 4359542ef7771ef8 1bf5697c4e214647
+1350-1354 3a9c8437b369b18d 08fc13aa0d72b77d
+1355-1359 a683c95cb86a730d ea6849feb7fcc751
+1360-1364 8a29bc78436bc6ae 41b409e99d3d6407
+1365-1369 8692ae5864d71e27 8e01f8a9337c54eb
+1370-1374 564687ad71ae1c8d 5ce79828e38e3251
+1375-1379 28b20cd1c7614c60 f8bc89701ecdb22f
+1380-1384 60c3a372f5a271e8 c16656410a682f46
+1385-1389 d80ecf054d176bdb 4e0785c55962a338
+1390-1394 980519d7625d79a9 86d8cf73e159021f
+1395-1399 0636ebd79722375c 4e4a263e2423589f
+1400-1404 fdca3c2930c30f50 7e7fb731f6c82704
+1405-1409 995fba3f4d9387ec bce4cb677d18c7a8
+1410-1414 2ca51f782342dc08 71313b54a3fa6c86
+1415-1419 bb651a2fae867c23 bf4169615aefe9c5
+1420-1424 58d54f77bdc62d3a 0944208a7b10e1f2
+1425-1429 5acf1a44fab98c50 a24c343175848041
+1430-1434 288f31cca4019cb8 4888e0644305f3e7
+1435-1439 bc71e65b94be39e5 c3274156d1ccc915
+1440-1444 29faa3de9bac1978 2c7a5fe6c18d9400
+1445-1449 739daeb7e40a0d4e 67b24598732fa3fe
+1450-1454 92dfcc9e00271ed2 029a1152a0c94435
+1455-1459 4eb4c054800fca53 8768bc139f54bb69
+1460-1464 82e36c6ee4b834d7 de3ace466142c7e6
+1465-1469 2ff60461f4803000 cd1492eabdb7ef4a
+1470-1474 6c5f53ee64d1ccba 9ebcb3c0e2ee91ad
+1475-1479 fbbf53a5a34d9f02 83cc3b42bc69dce7
+1480-1484 cd1bc4e171ae6722 69f317816faa2b4b
+1485-1489 b615a728eef36b94 03ac60bf7554ad65
+1490-1494 d8fbaf65535655fe 4836d39291d5d3c1
+1495-1499 b71316ba04a59cd3 077b55523590479c
diff --git a/crates/socket-patch-core/tests/equivalence/yarn_classic_rewrite.golden b/crates/socket-patch-core/tests/equivalence/yarn_classic_rewrite.golden
new file mode 100644
index 000000000..f47078a61
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/yarn_classic_rewrite.golden
@@ -0,0 +1,202 @@
+# One seeded yarn.lock (v1) + overrides.
+# <case> <input digest> <output digest>
+0-1 41db2e8d30f97c01 e8dc1c09e202ea26
+2-3 ab1f790dc3fcdb9c 3869a61f85e0e1b8
+4-5 9ac02c90e200e030 7d6b98165170e620
+6-7 f1f2ea13cbde214a 1fb27d735de4cbbe
+8-9 064a0fc8b5520063 7ad679dee1ec8d49
+10-11 a7b11a4f8ed8a138 53c9924e9d031970
+12-13 9549d80012991745 fd167be2cc4baa0f
+14-15 0050b5f7bf362e3f adb4cb06017ef9fc
+16-17 28c9d5727c2fde74 0ce72eed267ebc06
+18-19 410e1ea9f80f8b41 612115cd88da46da
+20-21 201689d51a304177 ea5a9b414bbbb8bf
+22-23 1c3252c3639afec0 b94672fd7806ae91
+24-25 ff03525fc21915de fe67293582497cf7
+26-27 15bff8b2e62e2e05 1de8cff6d3df0db6
+28-29 c5fab4ef623ab8e5 b99cfc831d7ee07a
+30-31 b3ceb512247458b0 99f9347e2bc2b412
+32-33 74a71f08bdbbd7b2 e72cd966fddda02c
+34-35 3366103bae4864d1 2a589c4fbeb4d40d
+36-37 f26eed61f488d805 652c5bf017c28bdb
+38-39 00d88508ef18317a a5198a89e6282db9
+40-41 1b8061d464175b15 53da7c91b1a67df9
+42-43 cc0eb1e9a501e75a 7080fec0ca9bc4ad
+44-45 4cd17305d5818465 35ee0e3337c41a31
+46-47 69f3b7436742a29b adbd137d774d1f2b
+48-49 bc4d1d58f3173270 e56094c868ceb733
+50-51 09bd33180f1fdad6 e97b13ca8bbc60cb
+52-53 d22a9c67627c00b9 284a1324e548f2ab
+54-55 76c523af0290ef70 ea7cf5752cc054aa
+56-57 0736f7932865b5a0 e6ac8694ea759078
+58-59 83e2dc152211a7b1 9e260b7c24d783df
+60-61 e7e749f9362e5c0f 9a223786aae324f4
+62-63 e6f1aa2a3c45a06a fce13931283bad56
+64-65 a19406518b5f4e10 def49b7bcdf8b86a
+66-67 b5b9a138094d2a64 90885de7399544af
+68-69 f53eaaf301862364 60507aa4a3c8d08e
+70-71 a5d662df513cff4a 758907b08d749c04
+72-73 64079562b753ad64 7ac909f471bf7bf9
+74-75 07d99e5a40728478 9f12e86f7660befd
+76-77 94e913157798f7df 0479eadf8d02cb89
+78-79 bc3f9f5833f15a75 859bc3d7150208fd
+80-81 9ef8b6e05b3f5118 9a9162acc0d9a57b
+82-83 07fc7316da95a56f aaa4b0419b62b0ad
+84-85 b86fc515ac6d1eb5 fe0e6827fc7705da
+86-87 2b9425c1e69f7df6 1c649f5a07123fbf
+88-89 2d1a7b4a4f702884 4852e6e124420ac6
+90-91 714b905ec1600d55 cb1978d1fa63e951
+92-93 94d5f4622bb63012 80b8d9bc47b04a3a
+94-95 2b9797ca32a6771a df88da0ccd6e0553
+96-97 c5ce81a424f16339 46f9dd9d8bbcd3fc
+98-99 10af14514ed83334 252802dcfc97d3ae
+100-101 962ede26783f22e0 5777ad61dbb23d66
+102-103 3df3534fa803d6c9 9f845d084e712e91
+104-105 209885193af54ced 8a8f51dd658ed10c
+106-107 08521af0c0baafdc 9d4aadc6ba4e7e2e
+108-109 8f96b3275e10b479 fc7752feb4e46245
+110-111 ebef881b272f6ed3 19ef39a099202dc3
+112-113 2ba847d1b99e13bf 53a797787215d9d4
+114-115 6eec961657d6d4db 2554ace2dcc93b15
+116-117 095751143680201a 01efc52f1d4ee70b
+118-119 552ff6fe4cd81385 da62a103796737e9
+120-121 54dfc469b7020e5b 4cd92c06d45fef35
+122-123 f42546a9668a40a8 ed8406bf03a1046b
+124-125 3e7e61e9efb360a0 93a3bb7b27cf2ddd
+126-127 40a19df10169a4ca e24509e78a17553b
+128-129 0ee4401e8715a2e6 c9a345287353c637
+130-131 0800b3bb05bb606c 5e871bed9b4e9c98
+132-133 9faa668cd4b186de 3d2716a58b333b48
+134-135 213c6f1a4602f673 89e0f11f493042c1
+136-137 b3253d028a84cdf8 a4274a2d1fad5840
+138-139 4fbb092fedea1b16 9d297739c36b0b80
+140-141 cd83f8b7014ac286 15261be202c167a0
+142-143 5f6166069446f8b2 49565331a76e0c68
+144-145 71fa8708968fc3b8 1adfef48bc413bd8
+146-147 2ac09be6ef2050d3 47ac1f33a38092c0
+148-149 6164e2211bcddd65 61b46c8c1debb3fe
+150-151 2105bd903cf3febc fdd9261e4cd099b2
+152-153 6c8fcde3efc3e09c cdf20344f77fb72d
+154-155 d2df7cb1188fe5c5 b0e8dfb0419b9ae3
+156-157 e36dc4da7a1766df e041f45858df4f0a
+158-159 8ccba17f927aed93 48b7cbdae908784e
+160-161 70e6f02aabebbe39 aa028597bee05f68
+162-163 68dd4015097d8520 295c7736b5336291
+164-165 5c1b3327e000861d 97689d6bbf14955e
+166-167 73a6f32ea5b37bef 2f6e344ae5cdbc6c
+168-169 416dd06dc18322e9 fa02bb7098abd57d
+170-171 cdc7d7d9e85c217e 7f0255cf04696296
+172-173 c9ffa4a473123c8d 6e10d8da0eb9599f
+174-175 3d01ae74db41587d bd55e6c08af6d476
+176-177 22cb36520abc9287 ad46822096f8e346
+178-179 e8137da7f7ab91a5 e555bf01c4758766
+180-181 c428c28ee88ade71 2c5dbad8dbee8761
+182-183 6c8f32df04f0cdc6 8618a7b9108deb7d
+184-185 cd168292edf1d284 0e06140ab6510bdf
+186-187 0906487cc3f0e669 7710e41cc383d389
+188-189 41c8fc910a8592a6 c77c404f92ce6c4b
+190-191 47413d524c358483 0d053b599bb56554
+192-193 bdb0245f62ff9dc9 0717e0198c5e0e5e
+194-195 a1df7982a92163f9 bdec007fb99201fe
+196-197 af5820f234f17709 49b056e43d6bdd14
+198-199 72e9b823ba4776b8 afa62f7958d04aa1
+200-201 60835e0b46efae09 4d5e3ed6a85b5ab3
+202-203 4d1ff252e070d3e2 61cf7d4629179860
+204-205 4a91f771ba8bf28b 1b07d17000ef2731
+206-207 68774e375783748e 7f20a40bc4e3b245
+208-209 0cc19b4cd9540425 e86681d615a21831
+210-211 d41ad2cc04129025 6e07ace24940e58a
+212-213 535156894976d4ec eabc32e6e90af593
+214-215 0e875f3a6631c51e 4464d026070c1392
+216-217 53c335a317d6229a 182d9bad1a3a1fcd
+218-219 d590de8cfe33f668 a4bd3eb4c4e69e18
+220-221 cf5c78a4b0b000ac 38d8f49d3fbf76d3
+222-223 b7ec58bb61b1ff92 6e6823fdfe1b8664
+224-225 26ce9ca27fcf26fd 5caeaeeb19f12ee2
+226-227 e9675ebfc8235a8c b9491474b79285e1
+228-229 6a1f0e0033132e75 90f67ba67e384abd
+230-231 b7d20cb0fabf2b9f 52b4c6b05ea94696
+232-233 c7f05442332bcecd 1f14c14eefd61f83
+234-235 797742e68dc3bdcf 1223921bfe62a2b8
+236-237 b09aa94d1b4177fa aaa4a32af1f0f003
+238-239 85ec811d0ff482bd 2de273da1e9fd774
+240-241 4722a08d5a63fc36 8bf52d2859163808
+242-243 2e493acd1f065c60 ef342c38d53e55a9
+244-245 cec62a62fd8b3673 0d7e27edbbb990d1
+246-247 b62b44cc63b75702 7f327d597a8763f8
+248-249 6ad33cd3b2ef30c9 d5f144cf6a62f93e
+250-251 26d6965a360e9c10 fdcc68e1c5401a2f
+252-253 2bcf2e83859ee4ac 8e3682cf9479eb22
+254-255 dbe369ae4371b6bd 63f4dad63dd645d7
+256-257 c64a07d6c882ce0b 34140dbf8695bcbf
+258-259 8a8200e1a45c6d8e 39bf6b563208c8c4
+260-261 9d6a1af339c69307 edef78c7b7eaedf5
+262-263 46e5458f2c238270 b390cf8ddcc0e2bc
+264-265 1142d6c7507b86ff 9cc761805a766424
+266-267 9d067a4ae6a76ae9 6afe645267922bb7
+268-269 e02bb9c7fd5071a4 aad62d95630c7d9e
+270-271 0f18a3a2f0bb7e86 170bb06e956b20aa
+272-273 b4d2cf4ec86e023f ccef1212c7a4008d
+274-275 87001bb3adf56001 7d3e52ba7bad54cd
+276-277 6b11088209951eda b9acb73685495232
+278-279 987ca669f79d5d6c f7e03678929d10b9
+280-281 e5f4073a2a1f9356 398bd84b1ca365cb
+282-283 5d0f451aef1036f9 b8f3b508121835bd
+284-285 33a46e3ff6da1518 cb1a580793aa0e46
+286-287 705c7b4188248c52 8861a26b49603cef
+288-289 bc0d14ef75258859 b042339412932249
+290-291 ac4d47f2cc21788e 1f289c9ce2cfacd2
+292-293 c08aa2d10b055d60 da8a5b2821d9cc30
+294-295 b0d504845dd85569 c192f9eab5afc324
+296-297 7de2a67160b6f462 47f1b5477ce206b9
+298-299 898ee4e505e557a1 09276f6ba92aa176
+300-301 848bac8e4ed2a985 3fdc694c82dfe2cb
+302-303 afbe5d47b9cfdf1f 3dfa9851b74e68f4
+304-305 16e1a022f9f52c63 babbaea8499f2201
+306-307 c1ae16934a1a88dd b0341ed0bc387c7a
+308-309 ec99ff8ab0915431 4bb9115ee0710b4d
+310-311 6165e671b5b447de df1b46fdcaa0ab81
+312-313 0667967ea507ad4b 9093779bcb7d694e
+314-315 a390a23f26f3b0f9 42c43eadd5448d5e
+316-317 5342b6964b507488 3634962bd2e8c100
+318-319 f9b56fd24c5f416d 26c5a8b2f0b809df
+320-321 5245ae3bd302c686 6744a6189354a042
+322-323 89b23afb8eba2c8c e1dcf138b89effe3
+324-325 89d68619d5198f95 3f0d70a5a920e61d
+326-327 53a5cce7ef98d69f d04a411ef047cac5
+328-329 badd562cac1ae4a8 335e7a320f7f4e04
+330-331 6e810217abb7c3db 78144de0c0ce70a0
+332-333 2c94d311f966cfe9 9c86402aa689b375
+334-335 37188d6d831849a0 90b01dba37cd6e67
+336-337 6b4bf1a7b356494b d3a8a82c2c57ed78
+338-339 b9d15ee2515587cc 3859f4780498b2a7
+340-341 1d643769b34dfb2a 35c48ff807ba1e57
+342-343 f3ef822084db5f99 6acade12c4e1dbda
+344-345 333b26a3d3cefcc2 d2d578b99a6ee9eb
+346-347 4e5eb6a52e0d984c fc16c04ca675aa6b
+348-349 cac83bd9c42c7b81 dba43a02d257d9c3
+350-351 96afa4bc5901dee3 f30e1b86ff002b10
+352-353 de9ff00a5734c5d2 bf6f349d67fbfb90
+354-355 5e2079e507ea2efd fc276d10f198f125
+356-357 0ff919d62867d77e 14968653c3426a35
+358-359 c9fd2c2b5384c289 2a1aad673965dcbc
+360-361 d03accefea0f1254 8f9a63a647a536c1
+362-363 51f8eb476cbd1e8e 897bd9c60815a5b0
+364-365 46c5f77b46a1c802 4b3baf5be3e9ca86
+366-367 71f112d76e0ca2ec 6da67d5894ca93e0
+368-369 ca6cd1b6a825d0fe 067e679412065805
+370-371 74c1e5551b889a3d af6e29e5d26f2598
+372-373 5e6cc90a402dc77d 1278c723844e9009
+374-375 16a05436a6f9734c 81c8538c61256b1a
+376-377 3d85dcf6e8804670 f639404251e3e17e
+378-379 291c6a127ad85190 9b870e9074ecac7f
+380-381 e9531c458eeffe66 0e7873e2e3061475
+382-383 b31cf6d020a44511 253c644b42808762
+384-385 06476a969bfe636e e20810e72dbe25da
+386-387 a06e44d92333935e e7a9a9e3d5c53358
+388-389 293b294a0fe8f700 81cfcfddccb90d15
+390-391 7ecc3fa0ac3c8230 99e8ae5f267a94f2
+392-393 c32fc0025132df90 674f91f3d20953e0
+394-395 4e4068c9d4e383f9 b3b9e49e34865327
+396-397 9d3e00201392f7d3 cb51ba17099eac24
+398-399 4c3f1e4e9dfad396 4681f54698a20616

From 7029f416090a56d1770179dd4c9c1498f67bae23 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 28 Sep 2026 22:18:38 +0000
Subject: [PATCH 2/6] Retire the #257 crawler and rewriter oracles

The equivalence sweeps now replay against the golden digests pinned
in the previous commit instead of re-running the verbatim previous
implementations: the crawler oracles (cargo, composer, go, maven,
npm, nuget, python), the hosted rewriter oracles and the reference
POM parser are deleted. Every sweep still generates the same inputs
from the same seeds, so a changed output is still caught per case.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N9YdJqaGiT9Jf5LN1hDFhB
---
 .../src/crawlers/cargo_crawler.rs             |   22 +-
 .../src/crawlers/cargo_crawler/oracle.rs      |   79 -
 .../src/crawlers/composer_crawler.rs          |   26 +-
 .../src/crawlers/composer_crawler/oracle.rs   |  117 -
 .../src/crawlers/go_crawler.rs                |   35 +-
 .../src/crawlers/go_crawler/oracle.rs         |  163 --
 .../src/crawlers/maven_crawler.rs             |   48 +-
 .../src/crawlers/maven_crawler/oracle.rs      |  172 --
 .../crawlers/maven_pom_equivalence_tests.rs   |  297 +--
 .../src/crawlers/npm_crawler.rs               |    2 +-
 .../src/crawlers/npm_crawler/oracle.rs        | 1900 -----------------
 .../src/crawlers/npm_crawler/sweep_tests.rs   |  954 +++++++++
 .../src/crawlers/nuget_crawler.rs             |   37 +-
 .../src/crawlers/nuget_crawler/oracle.rs      |  207 --
 .../src/crawlers/python_crawler.rs            |   36 +-
 .../src/crawlers/python_crawler/oracle.rs     |   96 -
 .../src/crawlers/test_tree.rs                 |   20 -
 .../redirect/cargo_lock_equivalence_tests.rs  |  372 +---
 .../redirect/composer_equivalence_tests.rs    |  341 +--
 .../redirect/golang_equivalence_tests.rs      |  442 +---
 .../redirect/lock_index_equivalence_tests.rs  |  350 +--
 .../src/patch/redirect/mod.rs                 |    6 +-
 .../patch/redirect/pnpm_equivalence_tests.rs  |  276 +--
 .../redirect/python_lock_equivalence_tests.rs |  262 +--
 .../patch/redirect/rewrite_oracle_support.rs  |  125 --
 .../src/utils/python_lock.rs                  |    4 -
 .../src/utils/python_lock_oracle.rs           |  239 ---
 .../composer_json_object_end.golden           |   92 +
 28 files changed, 1249 insertions(+), 5471 deletions(-)
 delete mode 100644 crates/socket-patch-core/src/crawlers/cargo_crawler/oracle.rs
 delete mode 100644 crates/socket-patch-core/src/crawlers/composer_crawler/oracle.rs
 delete mode 100644 crates/socket-patch-core/src/crawlers/go_crawler/oracle.rs
 delete mode 100644 crates/socket-patch-core/src/crawlers/maven_crawler/oracle.rs
 delete mode 100644 crates/socket-patch-core/src/crawlers/npm_crawler/oracle.rs
 create mode 100644 crates/socket-patch-core/src/crawlers/npm_crawler/sweep_tests.rs
 delete mode 100644 crates/socket-patch-core/src/crawlers/nuget_crawler/oracle.rs
 delete mode 100644 crates/socket-patch-core/src/crawlers/python_crawler/oracle.rs
 delete mode 100644 crates/socket-patch-core/src/patch/redirect/rewrite_oracle_support.rs
 delete mode 100644 crates/socket-patch-core/src/utils/python_lock_oracle.rs
 create mode 100644 crates/socket-patch-core/tests/equivalence/composer_json_object_end.golden

diff --git a/crates/socket-patch-core/src/crawlers/cargo_crawler.rs b/crates/socket-patch-core/src/crawlers/cargo_crawler.rs
index b9db123cc..a34aa05c8 100644
--- a/crates/socket-patch-core/src/crawlers/cargo_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/cargo_crawler.rs
@@ -6,9 +6,6 @@ use super::types::{CrawledPackage, CrawlerOptions};
 use crate::patch::path_safety;
 use crate::utils::fs::{is_dir, run_blocking};
 
-#[cfg(test)]
-mod oracle;
-
 // ---------------------------------------------------------------------------
 // Cargo.toml minimal parser
 // ---------------------------------------------------------------------------
@@ -1126,13 +1123,12 @@ version = "fake"
         assert_eq!(packages[0].purl, "pkg:cargo/serde@1.0.200");
     }
 
-    // ── Equivalence with the per-call async scan (oracle) ─────────────
+    // ── Seeded source trees, pinned by golden ────────────────────────
 
-    mod equivalence {
-        use super::super::oracle::LegacyCargoCrawler;
+    mod sweep {
         use super::*;
         use crate::crawlers::test_tree::{
-            crawl_goldens_apply, mkdir, rel_rows, rows, symlink, tree_listing, write, PermGuard,
+            crawl_goldens_apply, mkdir, rel_rows, symlink, tree_listing, write, PermGuard,
         };
         use crate::golden::Golden;
         use crate::test_rng::Rng;
@@ -1188,7 +1184,7 @@ version = "fake"
         }
 
         #[tokio::test]
-        async fn randomized_sources_match_the_async_oracle() {
+        async fn randomized_sources_match_golden() {
             let mut total = 0;
             let mut g = Golden::new(
                 "crawl_cargo_sources",
@@ -1208,10 +1204,8 @@ version = "fake"
                     global_prefix: Some(root.clone()),
                 };
                 let new = CargoCrawler::new().crawl_all(&options).await;
-                let old = LegacyCargoCrawler::crawl_all(&options).await;
-                assert_eq!(rows(&new), rows(&old), "seed {seed}");
                 g.case(seed, &input, &rel_rows(tmp.path(), &new));
-                total += old.len();
+                total += new.len();
             }
             assert!(total > 200, "vacuous fixtures: {total}");
             if crawl_goldens_apply(true) {
@@ -1221,7 +1215,7 @@ version = "fake"
 
         /// Local mode: a Cargo project with a `vendor/` tree.
         #[tokio::test]
-        async fn vendor_tree_matches_the_async_oracle() {
+        async fn vendor_tree_matches_golden() {
             let tmp = tempfile::tempdir().unwrap();
             let mut perms = PermGuard::default();
             let mut rng = Rng::new(7);
@@ -1240,9 +1234,7 @@ version = "fake"
                 global_prefix: None,
             };
             let new = CargoCrawler::new().crawl_all(&options).await;
-            let old = LegacyCargoCrawler::crawl_all(&options).await;
-            assert!(!old.is_empty());
-            assert_eq!(rows(&new), rows(&old));
+            assert!(!new.is_empty());
             let mut g = Golden::new(
                 "crawl_cargo_vendor",
                 "A seeded Cargo project vendor/ tree, crawled locally.",
diff --git a/crates/socket-patch-core/src/crawlers/cargo_crawler/oracle.rs b/crates/socket-patch-core/src/crawlers/cargo_crawler/oracle.rs
deleted file mode 100644
index 6513c4d86..000000000
--- a/crates/socket-patch-core/src/crawlers/cargo_crawler/oracle.rs
+++ /dev/null
@@ -1,79 +0,0 @@
-//! The pre-blocking-pool (one tokio hop per readdir/stat/read) crate source
-//! scan, kept verbatim as the equivalence oracle for the parallel scan in
-//! the parent module. Test-only; never compiled into the binary.
-
-use std::collections::HashSet;
-use std::path::Path;
-
-use super::{parse_cargo_toml_name_version, CargoCrawler};
-use crate::crawlers::types::{CrawledPackage, CrawlerOptions};
-
-pub(super) struct LegacyCargoCrawler;
-
-impl LegacyCargoCrawler {
-    pub(super) async fn crawl_all(options: &CrawlerOptions) -> Vec<CrawledPackage> {
-        let mut packages = Vec::new();
-        let mut seen = HashSet::new();
-
-        let src_paths = CargoCrawler::new()
-            .get_crate_source_paths(options)
-            .await
-            .unwrap_or_default();
-
-        for src_path in &src_paths {
-            let found = Self::scan_crate_source(src_path, &mut seen).await;
-            packages.extend(found);
-        }
-
-        packages
-    }
-
-    async fn scan_crate_source(src_path: &Path, seen: &mut HashSet<String>) -> Vec<CrawledPackage> {
-        let mut results = Vec::new();
-
-        for entry in crate::utils::fs::list_dir_entries(src_path).await {
-            if !crate::utils::fs::entry_is_dir(&entry).await {
-                continue;
-            }
-
-            let dir_name = entry.file_name();
-            let dir_name_str = dir_name.to_string_lossy();
-
-            if dir_name_str.starts_with('.') {
-                continue;
-            }
-
-            let crate_path = src_path.join(&*dir_name_str);
-            if let Some(pkg) = Self::read_crate_cargo_toml(&crate_path, &dir_name_str, seen).await {
-                results.push(pkg);
-            }
-        }
-
-        results
-    }
-
-    async fn read_crate_cargo_toml(
-        crate_path: &Path,
-        dir_name: &str,
-        seen: &mut HashSet<String>,
-    ) -> Option<CrawledPackage> {
-        let cargo_toml_path = crate_path.join("Cargo.toml");
-        let content = tokio::fs::read_to_string(&cargo_toml_path).await.ok()?;
-
-        let (name, version) = parse_cargo_toml_name_version(&content)
-            .or_else(|| CargoCrawler::parse_dir_name_version(dir_name))?;
-
-        let purl = crate::utils::purl::build_cargo_purl(&name, &version);
-        if !seen.insert(purl.clone()) {
-            return None;
-        }
-
-        Some(CrawledPackage {
-            name,
-            version,
-            namespace: None,
-            purl,
-            path: crate_path.to_path_buf(),
-        })
-    }
-}
diff --git a/crates/socket-patch-core/src/crawlers/composer_crawler.rs b/crates/socket-patch-core/src/crawlers/composer_crawler.rs
index 5e3ce537b..2e244d491 100644
--- a/crates/socket-patch-core/src/crawlers/composer_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/composer_crawler.rs
@@ -7,9 +7,6 @@ use crate::patch::path_safety;
 use crate::utils::fs::{is_dir, is_dir_sync, is_file, normalize_lexically, run_blocking};
 use crate::utils::process::{CommandRunner, SystemCommandRunner};
 
-#[cfg(test)]
-mod oracle;
-
 /// PHP/Composer ecosystem crawler for discovering packages in Composer
 /// vendor directories.
 pub struct ComposerCrawler;
@@ -1729,13 +1726,12 @@ mod tests {
         );
     }
 
-    // ── Equivalence with the per-package async stats (oracle) ─────────
+    // ── Seeded vendor trees, pinned by golden ────────────────────────
 
-    mod equivalence {
-        use super::super::oracle::LegacyComposerCrawler;
+    mod sweep {
         use super::*;
         use crate::crawlers::test_tree::{
-            crawl_goldens_apply, map_rows, mkdir, rel_map_rows, rel_rows, rows, symlink,
+            crawl_goldens_apply, mkdir, rel_map_rows, rel_rows, symlink,
             tree_listing, write,
         };
         use crate::golden::Golden;
@@ -1797,7 +1793,7 @@ mod tests {
         }
 
         #[tokio::test]
-        async fn randomized_vendor_trees_match_the_async_oracle() {
+        async fn randomized_vendor_trees_match_golden() {
             let (mut crawled, mut found) = (0, 0);
             let mut g = Golden::new(
                 "crawl_composer_vendor",
@@ -1815,10 +1811,8 @@ mod tests {
                     global_prefix: None,
                 };
                 let new = ComposerCrawler::new().crawl_all(&options).await;
-                let old = LegacyComposerCrawler::crawl_all(&options).await;
-                assert_eq!(rows(&new), rows(&old), "seed {seed}: crawl_all");
 
-                let mut purls: Vec<String> = old.iter().map(|p| p.purl.clone()).collect();
+                let mut purls: Vec<String> = new.iter().map(|p| p.purl.clone()).collect();
                 for (name, version) in &packages {
                     purls.push(format!("pkg:composer/{name}@{version}"));
                     purls.push(format!(
@@ -1832,12 +1826,6 @@ mod tests {
                     .find_by_purls(&vendor, &purls)
                     .await
                     .unwrap();
-                let old_found = LegacyComposerCrawler::find_by_purls(&vendor, &purls).await;
-                assert_eq!(
-                    map_rows(&new_found),
-                    map_rows(&old_found),
-                    "seed {seed}: find_by_purls"
-                );
                 g.case(
                     seed,
                     &input,
@@ -1846,8 +1834,8 @@ mod tests {
                         rel_map_rows(tmp.path(), &new_found),
                     ),
                 );
-                crawled += old.len();
-                found += old_found.len();
+                crawled += new.len();
+                found += new_found.len();
             }
             assert!(
                 crawled > 50 && found > 50,
diff --git a/crates/socket-patch-core/src/crawlers/composer_crawler/oracle.rs b/crates/socket-patch-core/src/crawlers/composer_crawler/oracle.rs
deleted file mode 100644
index 84077d52c..000000000
--- a/crates/socket-patch-core/src/crawlers/composer_crawler/oracle.rs
+++ /dev/null
@@ -1,117 +0,0 @@
-//! The pre-batching (one tokio `is_dir` hop per package) Composer crawl and
-//! PURL lookup, kept verbatim as the equivalence oracle for the parent
-//! module. Test-only; never compiled into the binary.
-
-use std::collections::{HashMap, HashSet};
-use std::path::Path;
-
-use super::{
-    normalize_version, read_installed_json, resolve_package_dir, resolve_project_root,
-    ComposerCrawler, ComposerPackageEntry,
-};
-use crate::crawlers::types::{CrawledPackage, CrawlerOptions};
-use crate::utils::fs::is_dir;
-
-pub(super) struct LegacyComposerCrawler;
-
-impl LegacyComposerCrawler {
-    pub(super) async fn crawl_all(options: &CrawlerOptions) -> Vec<CrawledPackage> {
-        let mut packages = Vec::new();
-        let mut seen = HashSet::new();
-
-        let vendor_paths = ComposerCrawler::new()
-            .get_vendor_paths(options)
-            .await
-            .unwrap_or_default();
-
-        for vendor_path in &vendor_paths {
-            let project_root = resolve_project_root(vendor_path).await;
-            let entries = read_installed_json(vendor_path).await;
-            for entry in entries {
-                if let Some((namespace, name)) = entry.name.split_once('/') {
-                    let Some(pkg_path) = resolve_package_dir(vendor_path, &project_root, &entry)
-                    else {
-                        continue;
-                    };
-                    if !is_dir(&pkg_path).await {
-                        continue;
-                    }
-
-                    let version = normalize_version(&entry.version).to_string();
-
-                    let ns_canon = namespace.to_ascii_lowercase();
-                    let name_canon = name.to_ascii_lowercase();
-                    let purl =
-                        crate::utils::purl::build_composer_purl(&ns_canon, &name_canon, &version);
-
-                    if !seen.insert(purl.clone()) {
-                        continue;
-                    }
-
-                    packages.push(CrawledPackage {
-                        name: name_canon,
-                        version,
-                        namespace: Some(ns_canon),
-                        purl,
-                        path: pkg_path,
-                    });
-                }
-            }
-        }
-
-        packages
-    }
-
-    pub(super) async fn find_by_purls(
-        vendor_path: &Path,
-        purls: &[String],
-    ) -> HashMap<String, CrawledPackage> {
-        let mut result: HashMap<String, CrawledPackage> = HashMap::new();
-
-        let entries = read_installed_json(vendor_path).await;
-        let installed: HashMap<String, ComposerPackageEntry> = entries
-            .into_iter()
-            .map(|e| (e.name.to_ascii_lowercase(), e))
-            .collect();
-        let project_root = resolve_project_root(vendor_path).await;
-
-        for purl in purls {
-            if let Some(((namespace, name), version)) =
-                crate::utils::purl::parse_composer_purl(purl)
-            {
-                let (namespace, name, version) =
-                    (namespace.as_ref(), name.as_ref(), version.as_ref());
-                let full_name = format!("{namespace}/{name}").to_ascii_lowercase();
-
-                let Some(entry) = installed.get(&full_name) else {
-                    continue;
-                };
-
-                if normalize_version(&entry.version) != normalize_version(version) {
-                    continue;
-                }
-
-                let Some(pkg_dir) = resolve_package_dir(vendor_path, &project_root, entry) else {
-                    continue;
-                };
-
-                if !is_dir(&pkg_dir).await {
-                    continue;
-                }
-
-                result.insert(
-                    purl.clone(),
-                    CrawledPackage {
-                        name: name.to_ascii_lowercase(),
-                        version: version.to_string(),
-                        namespace: Some(namespace.to_ascii_lowercase()),
-                        purl: purl.clone(),
-                        path: pkg_dir,
-                    },
-                );
-            }
-        }
-
-        result
-    }
-}
diff --git a/crates/socket-patch-core/src/crawlers/go_crawler.rs b/crates/socket-patch-core/src/crawlers/go_crawler.rs
index 3b545a924..d9f6a2363 100644
--- a/crates/socket-patch-core/src/crawlers/go_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/go_crawler.rs
@@ -6,9 +6,6 @@ use super::types::{CrawledPackage, CrawlerOptions};
 use crate::patch::path_safety;
 use crate::utils::fs::{is_dir_sync, run_blocking};
 
-#[cfg(test)]
-mod oracle;
-
 // ---------------------------------------------------------------------------
 // Case-encoding helpers
 // ---------------------------------------------------------------------------
@@ -1368,14 +1365,13 @@ mod tests {
         assert_eq!(pkg.path, module_dir);
     }
 
-    // ── Equivalence with the per-call async walk (oracle) ─────────────
+    // ── Seeded module caches, pinned by golden ───────────────────────
 
-    mod equivalence {
-        use super::super::oracle::LegacyGoCrawler;
+    mod sweep {
         use super::*;
         use crate::crawlers::test_tree::{
-            crawl_goldens_apply, map_rows, mkdir, rel_map_rows, rel_rows, rows, symlink,
-            tree_listing, write, PermGuard,
+            crawl_goldens_apply, mkdir, rel_map_rows, rel_rows, symlink, tree_listing, write,
+            PermGuard,
         };
         use crate::golden::Golden;
         use crate::test_rng::Rng;
@@ -1491,7 +1487,7 @@ mod tests {
 
         /// Returns (packages crawled, PURLs found) so the caller can check
         /// the fixtures are not vacuous.
-        async fn assert_equivalent(
+        async fn check(
             g: &mut Golden,
             input: &impl serde::Serialize,
             gen: &Gen,
@@ -1503,31 +1499,22 @@ mod tests {
                 global_prefix: Some(gen.root.clone()),
             };
             let new = GoCrawler::new().crawl_all(&options).await;
-            let old = LegacyGoCrawler::crawl_all(&options).await;
-            assert_eq!(rows(&new), rows(&old), "{label}: crawl_all");
-
-            let purls = probe_purls(gen, &old);
+            let purls = probe_purls(gen, &new);
             let new_found = GoCrawler::new()
                 .find_by_purls(&gen.root, &purls)
                 .await
                 .unwrap();
-            let old_found = LegacyGoCrawler::find_by_purls(&gen.root, &purls).await;
-            assert_eq!(
-                map_rows(&new_found),
-                map_rows(&old_found),
-                "{label}: find_by_purls"
-            );
             let base = gen.root.parent().unwrap();
             g.case(
                 label.replace(' ', "_"),
                 input,
                 &(rel_rows(base, &new), rel_map_rows(base, &new_found)),
             );
-            (old.len(), old_found.len())
+            (new.len(), new_found.len())
         }
 
         #[tokio::test]
-        async fn randomized_caches_match_the_async_oracle() {
+        async fn randomized_caches_match_golden() {
             let (mut crawled, mut found) = (0, 0);
             let mut g = Golden::new(
                 "crawl_go_module_cache",
@@ -1556,7 +1543,7 @@ mod tests {
                     gen.versioned.clone(),
                 );
                 gen.perms.apply();
-                let (c, f) = assert_equivalent(&mut g, &input, &gen, &format!("seed {seed}")).await;
+                let (c, f) = check(&mut g, &input, &gen, &format!("seed {seed}")).await;
                 crawled += c;
                 found += f;
                 seed += 1;
@@ -1571,7 +1558,7 @@ mod tests {
         }
 
         #[tokio::test]
-        async fn missing_cache_root_matches_the_async_oracle() {
+        async fn missing_cache_root_matches_golden() {
             let tmp = tempfile::tempdir().unwrap();
             let gen = Gen {
                 rng: Rng::new(0),
@@ -1581,7 +1568,7 @@ mod tests {
                 versioned: vec!["mod@v1.0.0".to_string()],
             };
             let mut g = Golden::new("crawl_go_absent_root", "An absent GOMODCACHE root.");
-            assert_equivalent(&mut g, &(), &gen, "absent root").await;
+            check(&mut g, &(), &gen, "absent root").await;
             if crawl_goldens_apply(false) {
                 g.finish();
             }
diff --git a/crates/socket-patch-core/src/crawlers/go_crawler/oracle.rs b/crates/socket-patch-core/src/crawlers/go_crawler/oracle.rs
deleted file mode 100644
index a80793c47..000000000
--- a/crates/socket-patch-core/src/crawlers/go_crawler/oracle.rs
+++ /dev/null
@@ -1,163 +0,0 @@
-//! The pre-blocking-pool (one tokio hop per readdir/stat) Go module cache
-//! walk and PURL lookup, kept verbatim as the equivalence oracle for the
-//! synchronous walkers in the parent module. Test-only; never compiled into
-//! the binary.
-
-use std::collections::{HashMap, HashSet};
-use std::path::Path;
-
-use super::{
-    decode_module_path, encode_module_path, is_safe_module_coordinate, split_module_path, GoCrawler,
-};
-use crate::crawlers::types::{CrawledPackage, CrawlerOptions};
-use crate::utils::fs::is_dir;
-
-pub(super) struct LegacyGoCrawler;
-
-impl LegacyGoCrawler {
-    pub(super) async fn crawl_all(options: &CrawlerOptions) -> Vec<CrawledPackage> {
-        let mut packages = Vec::new();
-        let mut seen = HashSet::new();
-
-        let cache_paths = GoCrawler::new()
-            .get_module_cache_paths(options)
-            .await
-            .unwrap_or_default();
-
-        for cache_path in &cache_paths {
-            Self::scan_dir_recursive(cache_path, cache_path, &mut seen, &mut packages).await;
-        }
-
-        packages
-    }
-
-    pub(super) async fn find_by_purls(
-        cache_path: &Path,
-        purls: &[String],
-    ) -> HashMap<String, CrawledPackage> {
-        let mut result: HashMap<String, CrawledPackage> = HashMap::new();
-
-        for purl in purls {
-            if let Some((module_path, version)) = crate::utils::purl::parse_golang_purl(purl) {
-                let (module_path, version) = (module_path.as_ref(), version.as_ref());
-                if !is_safe_module_coordinate(module_path, version) {
-                    continue;
-                }
-                let encoded = encode_module_path(module_path);
-                let encoded_version = encode_module_path(version);
-
-                let module_dir = cache_path.join(format!("{encoded}@{encoded_version}"));
-
-                if is_dir(&module_dir).await {
-                    if is_partially_extracted(cache_path, &encoded, &encoded_version).await {
-                        continue;
-                    }
-                    let (namespace, name) = split_module_path(module_path);
-
-                    result.insert(
-                        purl.clone(),
-                        CrawledPackage {
-                            name: name.to_string(),
-                            version: version.to_string(),
-                            namespace: Some(namespace.to_string()),
-                            purl: purl.clone(),
-                            path: module_dir,
-                        },
-                    );
-                }
-            }
-        }
-
-        result
-    }
-
-    fn scan_dir_recursive<'a>(
-        base_path: &'a Path,
-        current_path: &'a Path,
-        seen: &'a mut HashSet<String>,
-        results: &'a mut Vec<CrawledPackage>,
-    ) -> std::pin::Pin<Box<dyn std::future::Future<Output = ()> + 'a>> {
-        Box::pin(async move {
-            for entry in crate::utils::fs::list_dir_entries(current_path).await {
-                if !crate::utils::fs::entry_is_dir(&entry).await {
-                    continue;
-                }
-
-                let dir_name = entry.file_name();
-                let dir_name_str = dir_name.to_string_lossy();
-
-                if dir_name_str.starts_with('.')
-                    || (dir_name_str == "cache" && current_path == base_path)
-                {
-                    continue;
-                }
-
-                let full_path = current_path.join(&dir_name);
-
-                if dir_name_str.contains('@') {
-                    if let Some(pkg) = Self::parse_versioned_dir(base_path, &full_path, seen).await
-                    {
-                        results.push(pkg);
-                    }
-                } else {
-                    Self::scan_dir_recursive(base_path, &full_path, seen, results).await;
-                }
-            }
-        })
-    }
-
-    async fn parse_versioned_dir(
-        base_path: &Path,
-        dir_path: &Path,
-        seen: &mut HashSet<String>,
-    ) -> Option<CrawledPackage> {
-        let rel_path = dir_path.strip_prefix(base_path).ok()?;
-        let rel_str = rel_path.to_string_lossy().replace('\\', "/");
-
-        let at_idx = rel_str.rfind('@')?;
-        let encoded_module_path = &rel_str[..at_idx];
-        let version = &rel_str[at_idx + 1..];
-
-        if encoded_module_path.is_empty() || version.is_empty() {
-            return None;
-        }
-
-        if is_partially_extracted(base_path, encoded_module_path, version).await {
-            return None;
-        }
-
-        let module_path = decode_module_path(encoded_module_path);
-        let version = decode_module_path(version);
-
-        let purl = crate::utils::purl::build_golang_purl(&module_path, &version);
-
-        if seen.contains(&purl) {
-            return None;
-        }
-        seen.insert(purl.clone());
-
-        let (namespace, name) = split_module_path(&module_path);
-
-        Some(CrawledPackage {
-            name: name.to_string(),
-            version: version.to_string(),
-            namespace: Some(namespace.to_string()),
-            purl,
-            path: dir_path.to_path_buf(),
-        })
-    }
-}
-
-async fn is_partially_extracted(
-    cache_path: &Path,
-    encoded_module: &str,
-    encoded_version: &str,
-) -> bool {
-    let marker = cache_path
-        .join("cache")
-        .join("download")
-        .join(encoded_module)
-        .join("@v")
-        .join(format!("{encoded_version}.partial"));
-    tokio::fs::metadata(&marker).await.is_ok()
-}
diff --git a/crates/socket-patch-core/src/crawlers/maven_crawler.rs b/crates/socket-patch-core/src/crawlers/maven_crawler.rs
index e83819d2c..137acf0be 100644
--- a/crates/socket-patch-core/src/crawlers/maven_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/maven_crawler.rs
@@ -7,9 +7,6 @@ use super::walk_pool::{par_map, run_walk};
 use crate::patch::path_safety;
 use crate::utils::fs::is_dir;
 
-#[cfg(test)]
-mod oracle;
-
 /// How many `.pom` paths the parallel parse takes at a time. Every phase
 /// stays in walk order whatever the chunk, so this only bounds peak
 /// memory: a real `~/.m2` holds 10-50k artifacts (corporate caches many
@@ -2165,10 +2162,9 @@ mod tests {
         assert_eq!(paths[0], dir.path().to_path_buf());
     }
 
-    // ── Equivalence with the serial scan (oracle) ────────────────────
+    // ── Seeded repositories, pinned by golden ────────────────────────
 
-    mod equivalence {
-        use super::super::oracle::LegacyMavenCrawler;
+    mod sweep {
         use super::*;
         use crate::crawlers::test_tree::{
             crawl_goldens_apply, mkdir, rel, rel_rows, rows, symlink, tree_listing, write,
@@ -2246,11 +2242,11 @@ mod tests {
 
         /// Chunking the parallel parse changes nothing: the walk, the
         /// parse and the dedup each stay in walk order, so every chunk
-        /// size — one POM at a time included — produces the serial
-        /// oracle's rows, with the first-seen version dir still winning
-        /// across a chunk boundary.
+        /// size — one POM at a time included — produces the same rows,
+        /// with the first-seen version dir still winning across a chunk
+        /// boundary.
         #[tokio::test]
-        async fn every_parse_chunk_size_matches_the_serial_oracle() {
+        async fn every_parse_chunk_size_matches_golden() {
             let mut g = Golden::new(
                 "crawl_maven_parse_chunks",
                 "One seeded ~/.m2 repository, scanned at one parse chunk size.",
@@ -2269,18 +2265,18 @@ mod tests {
                     global: false,
                     global_prefix: Some(root.clone()),
                 };
-                let old = LegacyMavenCrawler::crawl_all(&options).await;
+                let crawled = MavenCrawler::new().crawl_all(&options).await;
                 for chunk in [0usize, 1, 2, 3, 7, 4096] {
                     let mut seen = HashSet::new();
                     let found = MavenCrawler.scan_maven_repo_chunked(&root, &mut seen, chunk);
-                    assert_eq!(rows(&found), rows(&old), "seed {seed}, chunk {chunk}");
+                    assert_eq!(rows(&found), rows(&crawled), "seed {seed}, chunk {chunk}");
                     g.case(
                         format!("{seed}/{chunk}"),
                         &input,
                         &rel_rows(tmp.path(), &found),
                     );
                 }
-                total += old.len();
+                total += crawled.len();
             }
             assert!(total > 50, "vacuous fixtures: {total}");
             if crawl_goldens_apply(true) {
@@ -2290,12 +2286,12 @@ mod tests {
 
         /// The no-walk-pool fallback (the OS refused even one walk thread,
         /// so `run_walk` runs the walk on the calling blocking-pool thread)
-        /// scans exactly as the serial oracle does. A bare rayon iterator
+        /// scans exactly as the pooled walk does. A bare rayon iterator
         /// here would instead build rayon's GLOBAL pool from that thread —
         /// which needs the threads the OS just refused, and panics when it
         /// cannot get them — where the serial scan simply finished.
         #[tokio::test]
-        async fn no_pool_repos_match_the_serial_oracle() {
+        async fn no_pool_repos_match_golden() {
             let mut g = Golden::new(
                 "crawl_maven_no_pool",
                 "One seeded ~/.m2 repository, crawled with no walk pool.",
@@ -2316,10 +2312,8 @@ mod tests {
                     global_prefix: Some(root.clone()),
                 };
                 let new = MavenCrawler::new().crawl_all(&options).await;
-                let old = LegacyMavenCrawler::crawl_all(&options).await;
-                assert_eq!(rows(&new), rows(&old), "no pool, seed {seed}");
                 g.case(seed, &input, &rel_rows(tmp.path(), &new));
-                total += old.len();
+                total += new.len();
             }
             assert!(total > 50, "vacuous fixtures: {total}");
             if crawl_goldens_apply(true) {
@@ -2334,7 +2328,7 @@ mod tests {
         /// included (`extra.pom`, unreadable and non-UTF-8 files, parent-only
         /// and comment-only POMs).
         #[tokio::test]
-        async fn consistent_repos_match_the_content_first_scan() {
+        async fn consistent_repos_match_golden() {
             let mut g = Golden::new(
                 "crawl_maven_consistent",
                 "One seeded ~/.m2 repository whose POMs agree with their dirs, crawled.",
@@ -2360,10 +2354,8 @@ mod tests {
                     global_prefix: Some(root.clone()),
                 };
                 let new = MavenCrawler::new().crawl_all(&options).await;
-                let old = super::super::oracle::crawl_all_content_first(&options).await;
-                assert_eq!(rows(&new), rows(&old), "seed {seed}");
                 g.case(seed, &input, &rel_rows(tmp.path(), &new));
-                total += old.len();
+                total += new.len();
             }
             assert!(total > 200, "vacuous fixtures: {total}");
             if crawl_goldens_apply(true) {
@@ -2378,7 +2370,7 @@ mod tests {
         /// scan exactly as the content-first scan had it — the parse and
         /// path-rescue arms included.
         #[tokio::test]
-        async fn misrooted_repos_match_the_content_first_scan() {
+        async fn misrooted_repos_match_golden() {
             let mut g = Golden::new(
                 "crawl_maven_misrooted",
                 "One seeded ~/.m2 repository, crawled from a misplaced root.",
@@ -2412,14 +2404,12 @@ mod tests {
                         global_prefix: Some(misroot.clone()),
                     };
                     let new = MavenCrawler::new().crawl_all(&options).await;
-                    let old = super::super::oracle::crawl_all_content_first(&options).await;
-                    assert_eq!(rows(&new), rows(&old), "seed {seed}, {}", misroot.display());
                     g.case(
                         format!("{seed}/{}", rel(tmp.path(), &misroot)),
                         &input,
                         &rel_rows(tmp.path(), &new),
                     );
-                    total += old.len();
+                    total += new.len();
                 }
             }
             assert!(total > 400, "vacuous fixtures: {total}");
@@ -2429,7 +2419,7 @@ mod tests {
         }
 
         #[tokio::test]
-        async fn randomized_repos_match_the_serial_oracle() {
+        async fn randomized_repos_match_golden() {
             let mut g = Golden::new("crawl_maven_repos", "One seeded ~/.m2 repository, crawled.");
             let mut total = 0;
             for seed in 0..64u64 {
@@ -2446,10 +2436,8 @@ mod tests {
                     global_prefix: Some(root.clone()),
                 };
                 let new = MavenCrawler::new().crawl_all(&options).await;
-                let old = LegacyMavenCrawler::crawl_all(&options).await;
-                assert_eq!(rows(&new), rows(&old), "seed {seed}");
                 g.case(seed, &input, &rel_rows(tmp.path(), &new));
-                total += old.len();
+                total += new.len();
             }
             assert!(total > 200, "vacuous fixtures: {total}");
             if crawl_goldens_apply(true) {
diff --git a/crates/socket-patch-core/src/crawlers/maven_crawler/oracle.rs b/crates/socket-patch-core/src/crawlers/maven_crawler/oracle.rs
deleted file mode 100644
index 1f37c3dcd..000000000
--- a/crates/socket-patch-core/src/crawlers/maven_crawler/oracle.rs
+++ /dev/null
@@ -1,172 +0,0 @@
-//! The serial (walk, read and parse one POM at a time) local-repository
-//! scan, kept as the equivalence oracle for the parallel scan in the parent
-//! module. Verbatim but for MVN-1's path-first step, which it spells out on
-//! its own (not through the parent's `canonical_layout_coordinates` /
-//! `LayoutTrust`, so a bug there cannot hide on both sides): a POM at its
-//! canonical `<group>/<a>/<v>/<a>-<v>.pom` path takes its coordinates from
-//! that path once the first such POM of its top-level group directory whose
-//! content parses has agreed with its own path. Test-only; never compiled
-//! into the binary.
-
-use std::collections::{HashMap, HashSet};
-use std::path::Path;
-
-use super::{
-    parse_path_coordinates, parse_pom_group_artifact_version, MavenCrawler, LAYOUT_TRUST_ATTEMPTS,
-};
-use crate::crawlers::types::{CrawledPackage, CrawlerOptions};
-use crate::utils::fs::run_blocking;
-
-pub(super) struct LegacyMavenCrawler;
-
-impl LegacyMavenCrawler {
-    pub(super) async fn crawl_all(options: &CrawlerOptions) -> Vec<CrawledPackage> {
-        let mut packages = Vec::new();
-        let mut seen = HashSet::new();
-
-        let repo_paths = MavenCrawler::new()
-            .get_maven_repo_paths(options)
-            .await
-            .unwrap_or_default();
-
-        for repo_path in repo_paths {
-            let (found, returned_seen) = run_blocking(move || {
-                let found = scan_maven_repo(&repo_path, &mut seen);
-                (found, seen)
-            })
-            .await;
-            seen = returned_seen;
-            packages.extend(found);
-        }
-
-        packages
-    }
-}
-
-/// The scan as it stood before MVN-1, verbatim: every POM is read and its
-/// content decides, the directory path only rescuing an unparseable one.
-/// On a repository whose POMs all agree with their directories it must
-/// report exactly what the path-first scan reports.
-pub(super) async fn crawl_all_content_first(options: &CrawlerOptions) -> Vec<CrawledPackage> {
-    let mut packages = Vec::new();
-    let mut seen = HashSet::new();
-    let repo_paths = MavenCrawler::new()
-        .get_maven_repo_paths(options)
-        .await
-        .unwrap_or_default();
-    for repo_path in repo_paths {
-        let (found, returned_seen) = run_blocking(move || {
-            let found = scan(&repo_path, &mut seen, false);
-            (found, seen)
-        })
-        .await;
-        seen = returned_seen;
-        packages.extend(found);
-    }
-    packages
-}
-
-fn scan_maven_repo(repo_path: &Path, seen: &mut HashSet<String>) -> Vec<CrawledPackage> {
-    scan(repo_path, seen, true)
-}
-
-/// The canonical-layout coordinates of `path` under `repo_path`, spelled
-/// independently of the parent module: the group directories (at least
-/// one, none dotted), then `<a>/<v>/`, then a file named exactly
-/// `<a>-<v>.pom`.
-fn canonical_gav(path: &Path, repo_path: &Path) -> Option<(String, String, String)> {
-    let rel = path.strip_prefix(repo_path).ok()?;
-    let mut names = Vec::new();
-    for component in rel.components() {
-        let std::path::Component::Normal(name) = component else {
-            return None;
-        };
-        names.push(name.to_str()?.to_string());
-    }
-    if names.len() < 4 {
-        return None;
-    }
-    let file = names.pop()?;
-    let version = names.pop()?;
-    let artifact = names.pop()?;
-    if file != format!("{artifact}-{version}.pom") || names.iter().any(|n| n.contains('.')) {
-        return None;
-    }
-    Some((names.join("."), artifact, version))
-}
-
-/// Per top-level group directory: `Some(agreed)` once a POM's content
-/// parsed, else how many canonical POMs were read without one parsing.
-type Trust = HashMap<String, (Option<bool>, u8)>;
-
-fn scan(repo_path: &Path, seen: &mut HashSet<String>, path_first: bool) -> Vec<CrawledPackage> {
-    let mut results = Vec::new();
-    let mut trust: Trust = HashMap::new();
-
-    for entry in walkdir::WalkDir::new(repo_path)
-        .follow_links(false)
-        .into_iter()
-        .filter_map(|e| e.ok())
-    {
-        if !entry.file_type().is_file() {
-            continue;
-        }
-        let path = entry.path();
-        if path.extension().is_none_or(|ext| ext != "pom") {
-            continue;
-        }
-
-        let version_dir = match path.parent() {
-            Some(p) => p,
-            None => continue,
-        };
-
-        let content_first = || {
-            std::fs::read_to_string(path)
-                .ok()
-                .and_then(|content| parse_pom_group_artifact_version(&content))
-                .or_else(|| parse_path_coordinates(version_dir, repo_path))
-        };
-        let canonical = path_first.then(|| canonical_gav(path, repo_path)).flatten();
-        let coords = match canonical {
-            None => content_first(),
-            Some(gav) => {
-                let top = gav.0.split('.').next().unwrap_or_default().to_string();
-                let state = trust.entry(top).or_insert((None, 0));
-                match *state {
-                    (Some(true), _) => Some(gav),
-                    (Some(false), _) => content_first(),
-                    (None, read) if read >= LAYOUT_TRUST_ATTEMPTS => content_first(),
-                    (None, read) => match std::fs::read_to_string(path)
-                        .ok()
-                        .and_then(|content| parse_pom_group_artifact_version(&content))
-                    {
-                        Some(content) => {
-                            *state = (Some(content == gav), read);
-                            Some(content)
-                        }
-                        None => {
-                            *state = (None, read + 1);
-                            parse_path_coordinates(version_dir, repo_path)
-                        }
-                    },
-                }
-            }
-        };
-
-        if let Some((group_id, artifact_id, version)) = coords {
-            let purl = crate::utils::purl::build_maven_purl(&group_id, &artifact_id, &version);
-            if seen.insert(purl.clone()) {
-                results.push(CrawledPackage {
-                    name: artifact_id,
-                    version,
-                    namespace: Some(group_id),
-                    purl,
-                    path: version_dir.to_path_buf(),
-                });
-            }
-        }
-    }
-
-    results
-}
diff --git a/crates/socket-patch-core/src/crawlers/maven_pom_equivalence_tests.rs b/crates/socket-patch-core/src/crawlers/maven_pom_equivalence_tests.rs
index 1e72dc5b2..1f2de7d8a 100644
--- a/crates/socket-patch-core/src/crawlers/maven_pom_equivalence_tests.rs
+++ b/crates/socket-patch-core/src/crawlers/maven_pom_equivalence_tests.rs
@@ -1,273 +1,11 @@
-//! Equivalence oracle for the POM coordinate parser, which now uses static
-//! tag needles, borrows comment-free lines, skips tag-free lines and stops
-//! once the project's own coordinates are complete. The previous
-//! implementation is kept here verbatim; the production parser must return
-//! the identical result on every document.
+//! Seeded POM documents for the coordinate parser, which uses static tag
+//! needles, borrows comment-free lines, skips tag-free lines and stops once
+//! the project's own coordinates are complete. Each sweep is pinned by a
+//! golden (see `crate::golden`) blessed when #257's verbatim previous
+//! parser and this one agreed on every document.
 
 use super::maven_crawler::parse_pom_group_artifact_version;
-
-/// Extract the text value between `<element>` and `</element>` on a single line.
-fn extract_xml_value(line: &str, element: &str) -> Option<String> {
-    let open = format!("<{element}>");
-    let close = format!("</{element}>");
-    let start = line.find(&open)?;
-    let value_start = start + open.len();
-    let end = line[value_start..].find(&close)?;
-    let value = line[value_start..value_start + end].trim().to_string();
-    if value.is_empty() {
-        None
-    } else {
-        Some(value)
-    }
-}
-
-/// Strip the commented-out portions of a single line, threading the
-/// `in_comment` state across lines so multi-line `<!-- ... -->` blocks are
-/// handled. XML comments do not nest, so we always close on the first `-->`.
-///
-/// This runs before any tag matching: POM files routinely carry license
-/// headers and commented-out `<dependency>`/`<build>` snippets, and naive
-/// substring matching would otherwise miscount skip-section depth (e.g. a
-/// comment containing `</build>` could "close" a block that is still open
-/// and leak a plugin's coordinates as the project's).
-fn strip_comment_spans(line: &str, in_comment: &mut bool) -> String {
-    let mut out = String::new();
-    let mut rest = line;
-    loop {
-        if *in_comment {
-            match rest.find("-->") {
-                Some(end) => {
-                    rest = &rest[end + 3..];
-                    *in_comment = false;
-                }
-                None => return out, // remainder of the line is inside a comment
-            }
-        } else {
-            match rest.find("<!--") {
-                Some(start) => {
-                    out.push_str(&rest[..start]);
-                    rest = &rest[start + 4..];
-                    *in_comment = true;
-                }
-                None => {
-                    out.push_str(rest);
-                    return out;
-                }
-            }
-        }
-    }
-}
-
-/// Find the first *real* opening tag for `element` on this line and report
-/// whether it self-closes (`Some(true)` for `<dependencies/>`, `Some(false)`
-/// for a plain `<dependencies>` or `<dependencies foo="x">`); `None` if there
-/// is no opening tag at all.
-///
-/// "Real" means there is a tag boundary immediately after the element name —
-/// `>`, `/`, whitespace, or end-of-line. This is critical: a bare substring
-/// match would prefix-match a *different* element such as `<buildtools>` as if
-/// it opened `<build>`. Because the corresponding close `</buildtools>` never
-/// equals `</build>`, that phantom open would never be matched by a close and
-/// would leak the entire remainder of the document into the skip section,
-/// dropping the project's real coordinates.
-fn opening_tag(line: &str, element: &str) -> Option<bool> {
-    let needle = format!("<{element}");
-    let mut from = 0;
-    while let Some(rel) = line[from..].find(&needle) {
-        let pos = from + rel;
-        let after = &line[pos + needle.len()..];
-        match after.chars().next() {
-            // Tag name runs to the end of the line (attributes continue on the
-            // next line): a real, non-self-closing open.
-            None => return Some(false),
-            Some(c) if c == '>' || c == '/' || c.is_whitespace() => {
-                let self_closes = match after.find('>') {
-                    Some(gt) => after[..gt].trim_end().ends_with('/'),
-                    None => false,
-                };
-                return Some(self_closes);
-            }
-            // Prefix match of a longer name (`<buildtools>`): keep scanning for
-            // a genuine `<build>`/`<build ...>`/`<build/>` later on the line.
-            _ => from = pos + needle.len(),
-        }
-    }
-    None
-}
-
-/// Does this line contain a *real* closing tag `</element>` (tolerating
-/// whitespace before `>`, e.g. `</build >`)? The boundary `>` is required, so
-/// `</buildtools>` is not treated as a close of `</build>` — mirroring the
-/// boundary discipline of [`opening_tag`].
-fn contains_closing_tag(line: &str, element: &str) -> bool {
-    let needle = format!("</{element}");
-    let mut from = 0;
-    while let Some(rel) = line[from..].find(&needle) {
-        let pos = from + rel;
-        let after = &line[pos + needle.len()..];
-        if after.trim_start().starts_with('>') {
-            return true;
-        }
-        from = pos + needle.len();
-    }
-    false
-}
-
-/// Parse `groupId`, `artifactId`, and `version` from a POM XML file.
-///
-/// Uses a simple line-based parser — no XML crate dependency.
-/// Tracks nesting depth to skip `<dependencies>`, `<build>`, `<profiles>`, etc.
-/// Extracts top-level `<groupId>`, `<artifactId>`, `<version>` from `<project>`.
-/// Falls back to `<parent>` block for groupId if missing at top level.
-/// Returns `None` for property references (`${...}`).
-fn reference_parse_pom(content: &str) -> Option<(String, String, String)> {
-    let mut group_id: Option<String> = None;
-    let mut artifact_id: Option<String> = None;
-    let mut version: Option<String> = None;
-    let mut parent_group_id: Option<String> = None;
-
-    let mut in_parent = false;
-    let mut in_comment = false;
-    let mut skip_depth: u32 = 0;
-
-    let skip_sections = [
-        "dependencies",
-        "build",
-        "profiles",
-        "reporting",
-        "dependencyManagement",
-        "pluginManagement",
-        "modules",
-        "distributionManagement",
-        "repositories",
-        "pluginRepositories",
-        // Free-form (xs:any): a property may be named exactly `version`/
-        // `groupId`/`artifactId` (Maven warns but permits it) and would
-        // otherwise win first-match extraction over the project's own
-        // coordinates. Project coordinates never live in <properties>,
-        // so skipping it can only prevent leaks.
-        "properties",
-    ];
-
-    for line in content.lines() {
-        let cleaned = strip_comment_spans(line, &mut in_comment);
-        let trimmed = cleaned.trim();
-
-        // Check for skip section open/close. A tag that opens and closes on
-        // the same line (`<modules></modules>`) or self-closes
-        // (`<dependencies/>`) leaves the depth unchanged; only a lone open
-        // increments and a lone close decrements.
-        //
-        // Any line carrying a close tag still holds that section's content up
-        // to the close (`<version>9.9</version></dependencies>`, or a whole
-        // compact `<dependencies>...</dependencies>` block), so it must not
-        // reach extraction even once the depth is back to 0 — otherwise a
-        // dependency's coordinates leak as the project's. A coordinate that
-        // legitimately follows a close on the same line is sacrificed to
-        // `None`, which scan rescues via the directory-path fallback.
-        let mut saw_section_close = false;
-        for section in &skip_sections {
-            let open = opening_tag(trimmed, section);
-            let has_open = open.is_some();
-            let has_close = contains_closing_tag(trimmed, section);
-            saw_section_close |= has_close;
-            if has_open && !has_close && open != Some(true) {
-                skip_depth += 1;
-            } else if has_close && !has_open {
-                skip_depth = skip_depth.saturating_sub(1);
-            }
-        }
-
-        if skip_depth > 0 || saw_section_close {
-            continue;
-        }
-
-        // Track parent section (a self-closing `<parent/>` carries no
-        // coordinates, so it never opens a parent block).
-        let parent_open = opening_tag(trimmed, "parent");
-        if parent_open.is_some()
-            && !contains_closing_tag(trimmed, "parent")
-            && parent_open != Some(true)
-        {
-            in_parent = true;
-            continue;
-        }
-        if contains_closing_tag(trimmed, "parent") {
-            in_parent = false;
-            continue;
-        }
-
-        if in_parent {
-            if parent_group_id.is_none() {
-                if let Some(val) = extract_xml_value(trimmed, "groupId") {
-                    if val.contains("${") {
-                        // Property reference in parent — skip
-                    } else {
-                        parent_group_id = Some(val);
-                    }
-                }
-            }
-            continue;
-        }
-
-        // Extract top-level coordinates
-        if group_id.is_none() {
-            if let Some(val) = extract_xml_value(trimmed, "groupId") {
-                if val.contains("${") {
-                    return None;
-                }
-                group_id = Some(val);
-            }
-        }
-        if artifact_id.is_none() {
-            if let Some(val) = extract_xml_value(trimmed, "artifactId") {
-                if val.contains("${") {
-                    return None;
-                }
-                artifact_id = Some(val);
-            }
-        }
-        if version.is_none() {
-            if let Some(val) = extract_xml_value(trimmed, "version") {
-                if val.contains("${") {
-                    return None;
-                }
-                version = Some(val);
-            }
-        }
-    }
-
-    // Fall back to parent groupId
-    let final_group_id = group_id.or(parent_group_id)?;
-    let final_artifact_id = artifact_id?;
-    let final_version = version?;
-
-    if final_group_id.is_empty() || final_artifact_id.is_empty() || final_version.is_empty() {
-        return None;
-    }
-
-    Some((final_group_id, final_artifact_id, final_version))
-}
-
-/// Deterministic xorshift64* — no `rand` dev-dependency.
-struct Rng(u64);
-
-impl Rng {
-    fn next(&mut self) -> u64 {
-        let mut x = self.0;
-        x ^= x >> 12;
-        x ^= x << 25;
-        x ^= x >> 27;
-        self.0 = x;
-        x.wrapping_mul(0x2545_F491_4F6C_DD1D)
-    }
-    fn below(&mut self, n: usize) -> usize {
-        (self.next() % n as u64) as usize
-    }
-    fn pick<'a>(&mut self, items: &[&'a str]) -> &'a str {
-        items[self.below(items.len())]
-    }
-}
+use crate::test_rng::Rng;
 
 /// Line fragments covering every branch of the parser: coordinates (plain,
 /// empty, `${…}`, split across lines), skip-section opens/closes in every
@@ -362,18 +100,16 @@ fn synth_pom(rng: &mut Rng) -> String {
 }
 
 #[test]
-fn parser_matches_reference_on_random_poms() {
+fn parser_matches_golden_on_random_poms() {
     let mut g = crate::golden::Golden::new(
         "maven_pom_random",
         "One seeded POM fragment soup, parsed for its coordinates.",
     )
     .chunked(100);
     let mut rng = Rng(0xA076_1D64_78BD_642F);
-    for case in 0..20_000 {
+    for _ in 0..20_000 {
         let pom = synth_pom(&mut rng);
-        let got = parse_pom_group_artifact_version(&pom);
-        assert_eq!(got, reference_parse_pom(&pom), "case {case}: {pom:?}");
-        g.next(&pom, &got);
+        g.next(&pom, &parse_pom_group_artifact_version(&pom));
     }
     g.finish();
 }
@@ -381,7 +117,7 @@ fn parser_matches_reference_on_random_poms() {
 /// Well-formed project poms with the coordinates placed before, between and
 /// after the noisy sections — the shapes the early exit stops on.
 #[test]
-fn parser_matches_reference_on_project_shaped_poms() {
+fn parser_matches_golden_on_project_shaped_poms() {
     let mut g = crate::golden::Golden::new(
         "maven_pom_project",
         "One seeded project-shaped POM, parsed for its coordinates.",
@@ -389,7 +125,7 @@ fn parser_matches_reference_on_project_shaped_poms() {
     .chunked(25);
     let mut rng = Rng(0xE703_7ED1_A0B4_28DB);
     let mut resolved = 0;
-    for case in 0..5_000 {
+    for _ in 0..5_000 {
         let mut lines = vec![
             "<?xml version=\"1.0\"?>".to_string(),
             "<project>".to_string(),
@@ -409,14 +145,9 @@ fn parser_matches_reference_on_project_shaped_poms() {
         lines.extend(body);
         lines.push("</project>".to_string());
         let pom = lines.join(rng.pick(&["\n", "\r\n"]));
-        let want = reference_parse_pom(&pom);
-        resolved += usize::from(want.is_some());
-        assert_eq!(
-            parse_pom_group_artifact_version(&pom),
-            want,
-            "case {case}: {pom:?}"
-        );
-        g.next(&pom, &want);
+        let got = parse_pom_group_artifact_version(&pom);
+        resolved += usize::from(got.is_some());
+        g.next(&pom, &got);
     }
     assert!(resolved > 1_000, "the corpus exercises the resolving path");
     g.finish();
diff --git a/crates/socket-patch-core/src/crawlers/npm_crawler.rs b/crates/socket-patch-core/src/crawlers/npm_crawler.rs
index 146e53a99..dcca60f22 100644
--- a/crates/socket-patch-core/src/crawlers/npm_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/npm_crawler.rs
@@ -13,7 +13,7 @@ use crate::utils::purl::{percent_decode_purl_component, strip_purl_qualifiers};
 use crate::vendor::vlt_lock_text::decode_vlt_dep_id;
 
 #[cfg(test)]
-mod oracle;
+mod sweep_tests;
 
 /// Directories to skip when searching for workspace node_modules.
 const SKIP_DIRS: &[&str] = &[
diff --git a/crates/socket-patch-core/src/crawlers/npm_crawler/oracle.rs b/crates/socket-patch-core/src/crawlers/npm_crawler/oracle.rs
deleted file mode 100644
index 414e5fa61..000000000
--- a/crates/socket-patch-core/src/crawlers/npm_crawler/oracle.rs
+++ /dev/null
@@ -1,1900 +0,0 @@
-//! The pre-parallel (one tokio `spawn_blocking` hop per filesystem call)
-//! npm crawler, kept verbatim as the equivalence oracle for the
-//! blocking-pool walkers in the parent module: the randomized fixture
-//! tests assert both produce identical `crawl_all` / `find_by_purls` /
-//! store-enumeration output. Test-only; never compiled into the binary.
-
-use std::collections::{HashMap, HashSet, VecDeque};
-use std::ffi::OsString;
-use std::path::{Path, PathBuf};
-
-use super::{
-    build_npm_purl, is_legacy_pnpm_store_dir_name,
-    is_safe_npm_component, parse_package_name, read_package_json, NpmCrawler, StoreEntry,
-    Target, NESTED_STORE_MAX_DEPTH, NESTED_STORE_MAX_DIRS, SKIP_DIRS, VLT_STORE_NAME,
-};
-use crate::crawlers::types::{CrawledPackage, CrawlerOptions};
-use crate::utils::fs::is_dir;
-
-/// Which kind of `node_modules` directory a scan pass is walking — the one
-/// traversal-policy bit that differs between them.
-#[derive(Clone, Copy)]
-enum ScanPolicy<'a> {
-    /// An importer's or package's `node_modules`: symlinked entries are
-    /// recorded (pnpm and vlt link direct deps; `npm link` targets) but
-    /// never traversed into, and a `.pnpm` or `.vlt` child is the virtual
-    /// store, scanned in a deferred pass.
-    Importer,
-    /// One pnpm or vlt store entry's `node_modules`: only REAL
-    /// directories are inventoried — a symlinked (or, on Windows,
-    /// junctioned) entry here is the package's dependency pointing at a
-    /// sibling store entry, which is inventoried via that entry; following
-    /// it would record the same package under a path owned by a different
-    /// store entry.
-    /// `identity_seen` optionally carries the entry's own package name
-    /// (what the store dir name decodes to) when its name@version is
-    /// already inventoried — the importer pass wins the `seen` dedup for
-    /// every root-linked direct dep — so that child's package.json is not
-    /// read a second time; everything below it is still scanned.
-    StoreEntry { identity_seen: Option<&'a str> },
-}
-
-pub(super) struct LegacyNpmCrawler;
-
-/// Whether every component of `dir_key` (`name` or `@scope/name`) below
-/// `nm_path` is a real directory: links and junctions do not count.
-async fn is_real_package_dir(nm_path: &Path, dir_key: &str) -> bool {
-    let mut path = nm_path.to_path_buf();
-    for component in dir_key.split('/') {
-        path.push(component);
-        let real = tokio::fs::symlink_metadata(&path)
-            .await
-            .is_ok_and(|m| m.is_dir());
-        if !real {
-            return false;
-        }
-    }
-    true
-}
-
-/// Whether `pkg_path` is the physical dir one of `copies` resolves to.
-async fn resolves_to_any(pkg_path: &Path, copies: &[CrawledPackage]) -> bool {
-    let Ok(canon) = tokio::fs::canonicalize(pkg_path).await else {
-        return false;
-    };
-    for copy in copies {
-        if tokio::fs::canonicalize(&copy.path).await.ok().as_ref() == Some(&canon) {
-            return true;
-        }
-    }
-    false
-}
-
-impl LegacyNpmCrawler {
-    /// The old `NpmCrawler::crawl_all`: global roots come from the (shared,
-    /// unchanged) global-path logic; local roots from the old async walk.
-    pub(super) async fn crawl_all(options: &CrawlerOptions) -> Vec<CrawledPackage> {
-        let mut packages = Vec::new();
-        let mut seen = HashSet::new();
-
-        let nm_paths = if options.global || options.global_prefix.is_some() {
-            NpmCrawler::new()
-                .get_node_modules_paths(options)
-                .await
-                .unwrap_or_default()
-        } else {
-            Self::find_local_node_modules_dirs(&options.cwd).await
-        };
-
-        for nm_path in &nm_paths {
-            let found = Self::scan_node_modules(nm_path, &mut seen, ScanPolicy::Importer).await;
-            packages.extend(found);
-        }
-
-        packages
-    }
-
-    pub(super) async fn find_by_purls(
-        node_modules_path: &Path,
-        purls: &[String],
-    ) -> Result<HashMap<String, Vec<CrawledPackage>>, std::io::Error> {
-        let mut result: HashMap<String, Vec<CrawledPackage>> = HashMap::new();
-
-        let mut pending: Vec<Target> = Vec::new();
-        for purl in purls {
-            let Some((namespace, name, version)) = NpmCrawler::parse_purl_components(purl) else {
-                continue;
-            };
-
-            // SECURITY: `namespace`/`name` come straight from the (untrusted)
-            // manifest PURL and are joined onto `node_modules_path` below,
-            // then patched in place. A real npm scope/name is a single
-            // path segment, so reject any that could traverse out of the
-            // tree (`pkg:npm/../../evil@1.0.0`). Fail closed — twin of the
-            // deno/go/maven coordinate gates.
-            let ns_safe = namespace
-                .as_deref()
-                .map(is_safe_npm_component)
-                .unwrap_or(true);
-            if !ns_safe || !is_safe_npm_component(&name) {
-                continue;
-            }
-
-            let dir_key = match &namespace {
-                Some(ns) => format!("{ns}/{name}"),
-                None => name.clone(),
-            };
-            pending.push(Target {
-                namespace,
-                name,
-                version,
-                purl: purl.clone(),
-                dir_key,
-            });
-        }
-
-        // Pass 1 — filtered: `.pnpm` virtual-store entries are enqueued
-        // only when their dir name decodes to a still-pending target's
-        // name (a manifest routinely lists packages that simply aren't
-        // installed here, and probing every entry of a large monorepo
-        // store for them would add a readdir+stat storm to every
-        // apply/rollback run).
-        let pending =
-            Self::resolve_pending_targets(node_modules_path, pending, &mut result, true).await;
-
-        // Pass 2 — unfiltered fallback, only for targets pass 1 could not
-        // resolve: a target can physically exist ONLY inside another
-        // package's store entry (a bundled dependency at
-        // `.pnpm/host@1.0.0/node_modules/host/node_modules/<target>`),
-        // whose entry name decodes to the HOST's name — the pass-1 filter
-        // skips it, leaving an installed, scan-visible package invisible
-        // to apply (fail-open: apply reported it not installed). Probe
-        // every store entry for just the leftovers; the common all-
-        // resolved case never reaches this pass, so its perf is intact.
-        if !pending.is_empty() {
-            Self::resolve_pending_targets(node_modules_path, pending, &mut result, false).await;
-        }
-
-        Ok(result)
-    }
-
-    /// One breadth-first resolution pass over the tree rooted at
-    /// `node_modules_path`: the root `node_modules` first (so a root-level
-    /// install always wins), then — only while targets remain unresolved —
-    /// each nested `node_modules`. npm nests a conflicting version under
-    /// the dependent package, so a patched version can exist *only*
-    /// nested; CLI_CONTRACT ("Deeply nested transitive dependencies are
-    /// fully supported") promises those are patched identically to direct
-    /// deps, and `crawl_all` (scan) already discovers them at unbounded
-    /// depth.
-    ///
-    /// EVERY matching physical copy of each target lands in `result`
-    /// (keyed by the target's verbatim PURL, root-copy-first). Targets are
-    /// kept live across the whole walk — a duplicate copy can live at any
-    /// depth — so the traversal continues past the first match rather than
-    /// stopping. Targets for which NO copy was found anywhere are returned
-    /// (the pass-2 fallback re-probes them with the unfiltered store walk).
-    /// `filter_store_entries` selects whether pnpm virtual-store entries are
-    /// bounded by the still-unmatched-name filter (pass 1) or all probed
-    /// (the pass-2 fallback) — see `find_by_purls`.
-    async fn resolve_pending_targets(
-        node_modules_path: &Path,
-        mut pending: Vec<Target>,
-        result: &mut HashMap<String, Vec<CrawledPackage>>,
-        filter_store_entries: bool,
-    ) -> Vec<Target> {
-        if pending.is_empty() {
-            return pending;
-        }
-        let mut queue: VecDeque<(PathBuf, bool)> =
-            VecDeque::from([(node_modules_path.to_path_buf(), false)]);
-        while let Some((nm_path, store_entry)) = queue.pop_front() {
-            for target in &pending {
-                let pkg_path = nm_path.join(&target.dir_key);
-                // Inside a store entry a link is a dependency edge into a
-                // sibling entry, whose own probe records that copy.
-                if store_entry && !is_real_package_dir(&nm_path, &target.dir_key).await {
-                    continue;
-                }
-                let pkg_json_path = pkg_path.join("package.json");
-
-                match read_package_json(&pkg_json_path).await {
-                    // The on-disk *name* must match too: an alias install
-                    // (`npm i foo@npm:bar@1.0.0`) puts a different package
-                    // in `node_modules/foo`, so matching on version alone
-                    // would misidentify it and patch the wrong package's
-                    // files.
-                    Some((found_name, found_version))
-                        if found_name == target.dir_key && found_version == target.version =>
-                    {
-                        let copies = result.entry(target.purl.clone()).or_default();
-                        // Record each physical copy once — a path reached
-                        // twice (defensive against overlapping walks) is not
-                        // double-counted, and a store copy an importer link
-                        // already resolves to keeps the importer path.
-                        let recorded = copies.iter().any(|c| c.path == pkg_path)
-                            || (store_entry && resolves_to_any(&pkg_path, copies).await);
-                        if !recorded {
-                            copies.push(CrawledPackage {
-                                name: target.name.clone(),
-                                version: found_version,
-                                namespace: target.namespace.clone(),
-                                purl: target.purl.clone(),
-                                path: pkg_path,
-                            });
-                        }
-                    }
-                    _ => {}
-                }
-            }
-            // Descend importer-tree nested `node_modules` for ALL targets
-            // (a duplicate copy lives at an unknown depth), but probe the
-            // pnpm virtual store only for targets NOT YET found anywhere: a
-            // matched direct dep's store peer-variants are the apply
-            // engine's fan-out job, and re-probing the store for it would
-            // add a readdir storm. A target with no importer-tree copy
-            // (transitive-only) still gets its store entries probed.
-            let unmatched_names: HashSet<&str> = pending
-                .iter()
-                .filter(|t| !result.contains_key(&t.purl))
-                .map(|t| t.dir_key.as_str())
-                .collect();
-            let filter = filter_store_entries.then_some(&unmatched_names);
-            Self::collect_nested_node_modules(&nm_path, filter, &mut queue).await;
-        }
-        // Only the targets with zero copies remain "pending" for pass 2.
-        pending.retain(|t| !result.contains_key(&t.purl));
-        pending
-    }
-
-    /// Append the `node_modules` dirs living one level below `nm_path`
-    /// (inside each of its package dirs, scoped or not) to `queue`, each
-    /// tagged `true` when it is a store entry's (see `ScanPolicy::StoreEntry`).
-    /// Mirrors `scan_node_modules`' traversal policy: hidden entries are
-    /// skipped and symlinked packages are never traversed — a symlink here
-    /// points into pnpm's content-addressed store or an `npm link` target
-    /// outside the project. The one exception is pnpm's `.pnpm` virtual
-    /// store (see below); `pending_names` — `Some(the still-unresolved
-    /// targets' full package names)` — bounds which store entries get
-    /// enqueued, while `None` (the pass-2 fallback of `find_by_purls`)
-    /// enqueues every store entry.
-    async fn collect_nested_node_modules(
-        nm_path: &Path,
-        pending_names: Option<&HashSet<&str>>,
-        queue: &mut VecDeque<(PathBuf, bool)>,
-    ) {
-        for entry in crate::utils::fs::list_dir_entries(nm_path).await {
-            let name = entry.file_name();
-            let name_str = name.to_string_lossy();
-            // pnpm's virtual store. Under the isolated linker the store is
-            // the ONLY physical home of transitive dependencies: the
-            // importer's node_modules holds symlinks for direct deps only,
-            // so a transitive-only target (installed at
-            // `.pnpm/<x>/node_modules/<name>`, runtime-loaded) is
-            // unreachable through the symlink-free walk above — invisible
-            // to apply despite being importable. Probe REAL store entries'
-            // `node_modules`; the name+version match in `find_by_purls`
-            // keeps aliases and multi-version store entries distinct, and
-            // BFS order guarantees a root-linked install has already been
-            // probed (and removed from `pending`) before these are
-            // dequeued, so a package is never resolved twice.
-            if name_str == ".pnpm" {
-                let Some(file_type) = crate::utils::fs::entry_file_type(&entry).await else {
-                    continue;
-                };
-                if !file_type.is_dir() {
-                    continue;
-                }
-                let store_path = nm_path.join(&name);
-                let entries = Self::list_pnpm_store_entries(&store_path).await;
-                Self::enqueue_pending_store_entries(
-                    StoreEntry::pnpm(entries),
-                    pending_names,
-                    queue,
-                );
-                continue;
-            }
-            // vlt's store has the same transitive-only-home property: every
-            // package lives at `.vlt/<DepID>/node_modules/<name>` and the
-            // importer holds only links into it.
-            if name_str == VLT_STORE_NAME {
-                let Some(file_type) = crate::utils::fs::entry_file_type(&entry).await else {
-                    continue;
-                };
-                if !file_type.is_dir() {
-                    continue;
-                }
-                let entries = Self::list_vlt_store_entries(&nm_path.join(&name)).await;
-                Self::enqueue_pending_store_entries(StoreEntry::vlt(entries), pending_names, queue);
-                continue;
-            }
-            // pnpm <=3: the virtual store is a hidden `.<registry-host>` dir
-            // (there is no `.pnpm` at all) with the same
-            // transitive-only-deps property, so it gets the same probing.
-            // Must run before the generic hidden-entry skip below, which
-            // would otherwise swallow it — leaving every transitive-only
-            // install unpatchable on those layouts.
-            if is_legacy_pnpm_store_dir_name(&name_str) {
-                let Some(file_type) = crate::utils::fs::entry_file_type(&entry).await else {
-                    continue;
-                };
-                if !file_type.is_dir() {
-                    continue;
-                }
-                let mut entries = Vec::new();
-                Self::collect_nested_store_entries(&nm_path.join(&name), &mut entries).await;
-                Self::enqueue_pending_store_entries(
-                    StoreEntry::pnpm(entries),
-                    pending_names,
-                    queue,
-                );
-                continue;
-            }
-            if name_str.starts_with('.') || name_str == "node_modules" {
-                continue;
-            }
-            let Some(file_type) = crate::utils::fs::entry_file_type(&entry).await else {
-                continue;
-            };
-            if !file_type.is_dir() {
-                continue;
-            }
-            let entry_path = nm_path.join(&name);
-
-            if name_str.starts_with('@') {
-                for scoped in crate::utils::fs::list_dir_entries(&entry_path).await {
-                    let scoped_name = scoped.file_name();
-                    if scoped_name.to_string_lossy().starts_with('.') {
-                        continue;
-                    }
-                    let Some(scoped_type) = crate::utils::fs::entry_file_type(&scoped).await else {
-                        continue;
-                    };
-                    if !scoped_type.is_dir() {
-                        continue;
-                    }
-                    let nested = entry_path.join(&scoped_name).join("node_modules");
-                    if is_dir(&nested).await {
-                        queue.push_back((nested, false));
-                    }
-                }
-            } else {
-                let nested = entry_path.join("node_modules");
-                if is_dir(&nested).await {
-                    queue.push_back((nested, false));
-                }
-            }
-        }
-    }
-
-    /// Enqueue virtual-store entries that can still hold a pending target.
-    /// A manifest routinely lists packages that simply aren't installed
-    /// here, and probing every entry of a large monorepo store for them
-    /// would add a readdir+stat storm to every apply/rollback run. The
-    /// entry name advertises the entry's package, so filter by PENDING
-    /// NAME only — the version is deliberately NOT matched at this stage
-    /// (dir-name versions can carry peer/build decorations; the
-    /// package.json probe stays the authority). An undecodable name
-    /// (truncated/hash-suffixed dirs, git/URL deps, `_`-bearing names)
-    /// reveals nothing about what's inside, so it stays probeable.
-    ///
-    /// `pending_names = None` disables the filter entirely: the entry name
-    /// only advertises the entry's OWN package, so a target present solely
-    /// as a bundled dependency INSIDE another package's entry hides behind
-    /// a non-matching name — `find_by_purls`' pass-2 fallback probes every
-    /// entry for exactly those. Both enumerators only yield entries whose
-    /// `node_modules` exists, so no re-stat here.
-    fn enqueue_pending_store_entries(
-        entries: Vec<StoreEntry>,
-        pending_names: Option<&HashSet<&str>>,
-        queue: &mut VecDeque<(PathBuf, bool)>,
-    ) {
-        for entry in entries {
-            if let (Some(filter), Some((entry_pkg, _version))) = (pending_names, &entry.advertised)
-            {
-                if !filter.contains(entry_pkg.as_str()) {
-                    continue;
-                }
-            }
-            queue.push_back((entry.node_modules, true));
-        }
-    }
-
-    /// Find `node_modules` directories within the project root.
-    /// Recursively searches for workspace `node_modules` but stays within the
-    /// project.
-    async fn find_local_node_modules_dirs(start_path: &Path) -> Vec<PathBuf> {
-        let mut results = Vec::new();
-
-        // Direct node_modules in start_path
-        let direct = start_path.join("node_modules");
-        if is_dir(&direct).await {
-            results.push(direct);
-        }
-
-        // Recursively search for workspace node_modules
-        Self::find_workspace_node_modules(start_path, &mut results).await;
-
-        results
-    }
-
-    /// Recursively find `node_modules` in subdirectories (for monorepos / workspaces).
-    /// Skips symlinks, hidden dirs, and well-known non-workspace dirs.
-    fn find_workspace_node_modules<'a>(
-        dir: &'a Path,
-        results: &'a mut Vec<PathBuf>,
-    ) -> std::pin::Pin<Box<dyn std::future::Future<Output = ()> + 'a>> {
-        Box::pin(async move {
-            for entry in crate::utils::fs::list_dir_entries(dir).await {
-                let Some(file_type) = crate::utils::fs::entry_file_type(&entry).await else {
-                    continue;
-                };
-                if !file_type.is_dir() {
-                    continue;
-                }
-
-                let name = entry.file_name();
-                let name_str = name.to_string_lossy();
-
-                // Skip node_modules, hidden dirs, and well-known build dirs
-                if name_str == "node_modules"
-                    || name_str.starts_with('.')
-                    || SKIP_DIRS.contains(&name_str.as_ref())
-                {
-                    continue;
-                }
-
-                let full_path = dir.join(&name);
-
-                // Check if this subdirectory has its own node_modules
-                let sub_nm = full_path.join("node_modules");
-                if is_dir(&sub_nm).await {
-                    results.push(sub_nm);
-                }
-
-                // Recurse
-                Self::find_workspace_node_modules(&full_path, results).await;
-            }
-        })
-    }
-
-    // ------------------------------------------------------------------
-    // Private helpers – scanning
-    // ------------------------------------------------------------------
-
-    /// Scan a `node_modules` directory, returning all valid packages found.
-    /// Recurses into each package's own nested `node_modules`. The one
-    /// policy bit distinguishing an importer/package tree from a pnpm
-    /// virtual-store entry is carried by [`ScanPolicy`].
-    fn scan_node_modules<'a>(
-        node_modules_path: &'a Path,
-        seen: &'a mut HashSet<String>,
-        policy: ScanPolicy<'a>,
-    ) -> std::pin::Pin<Box<dyn std::future::Future<Output = Vec<CrawledPackage>> + 'a>> {
-        Box::pin(async move {
-            let mut results = Vec::new();
-            let mut pnpm_store: Option<PathBuf> = None;
-            let mut vlt_store: Option<PathBuf> = None;
-            let mut legacy_stores: Vec<PathBuf> = Vec::new();
-            let (store_entry, identity_seen) = match policy {
-                ScanPolicy::Importer => (false, None),
-                ScanPolicy::StoreEntry { identity_seen } => (true, identity_seen),
-            };
-
-            for entry in crate::utils::fs::list_dir_entries(node_modules_path).await {
-                let name = entry.file_name();
-                let name_str = name.to_string_lossy().to_string();
-
-                // pnpm's virtual store: under the isolated linker it is the
-                // ONLY physical home of transitive dependencies (the
-                // importer's node_modules symlinks direct deps only), so
-                // skipping it as just-another-hidden-dir leaves every
-                // transitive-only install invisible to scan. Deferred until
-                // after this loop so root-level entries are inventoried
-                // first and win the `seen` name@version dedup at their
-                // importer-root paths. (A store entry's own children never
-                // include a nested `.pnpm`; under `StoreEntry` policy the
-                // name falls through to the hidden-entry skip below.)
-                if !store_entry && name_str == ".pnpm" {
-                    let Some(file_type) = crate::utils::fs::entry_file_type(&entry).await else {
-                        continue;
-                    };
-                    if file_type.is_dir() {
-                        pnpm_store = Some(node_modules_path.join(&name_str));
-                    }
-                    continue;
-                }
-
-                // vlt's store, deferred for the same reason: importer links
-                // win the `seen` dedup at their importer-root paths.
-                if !store_entry && name_str == VLT_STORE_NAME {
-                    let Some(file_type) = crate::utils::fs::entry_file_type(&entry).await else {
-                        continue;
-                    };
-                    if file_type.is_dir() {
-                        vlt_store = Some(node_modules_path.join(&name_str));
-                    }
-                    continue;
-                }
-
-                // pnpm <=3 virtual store (a hidden `.<registry-host>` dir;
-                // no `.pnpm` exists on those layouts): same
-                // transitive-only-home property, same deferred scan so
-                // root-level entries win the `seen` dedup. Must run before
-                // the hidden-entry skip below, which would otherwise leave
-                // every transitive-only install invisible to scan.
-                if !store_entry && is_legacy_pnpm_store_dir_name(&name_str) {
-                    let Some(file_type) = crate::utils::fs::entry_file_type(&entry).await else {
-                        continue;
-                    };
-                    if file_type.is_dir() {
-                        legacy_stores.push(node_modules_path.join(&name_str));
-                    }
-                    continue;
-                }
-
-                // Skip hidden files and node_modules
-                if name_str.starts_with('.') || name_str == "node_modules" {
-                    continue;
-                }
-
-                let Some(file_type) = crate::utils::fs::entry_file_type(&entry).await else {
-                    continue;
-                };
-
-                // Importer trees allow both directories and symlinks (pnpm
-                // links direct deps); a store entry accepts REAL dirs only
-                // (see `ScanPolicy::StoreEntry`).
-                let acceptable = if store_entry {
-                    file_type.is_dir()
-                } else {
-                    file_type.is_dir() || file_type.is_symlink()
-                };
-                if !acceptable {
-                    continue;
-                }
-
-                let entry_path = node_modules_path.join(&name_str);
-
-                if name_str.starts_with('@') {
-                    // Scoped packages
-                    let scoped = Self::scan_scoped_packages(&entry_path, seen, policy).await;
-                    results.extend(scoped);
-                } else {
-                    // Regular package. `identity_seen` marks this exact dir
-                    // as already inventoried by the importer pass — skip
-                    // the redundant package.json read, but still descend
-                    // below: bundled dependencies are real dirs nested
-                    // inside the package itself (pnpm cannot link them
-                    // out), physically present only here.
-                    if identity_seen != Some(name_str.as_str()) {
-                        if let Some(pkg) = Self::check_package(&entry_path, seen).await {
-                            results.push(pkg);
-                        }
-                    }
-                    // Recurse into nested node_modules only for real
-                    // directories (not symlinks). Following a symlink here
-                    // would walk into pnpm's content-addressed store (or an
-                    // `npm link` target outside the project).
-                    if file_type.is_dir() {
-                        let nested = Self::scan_node_modules(
-                            &entry_path.join("node_modules"),
-                            seen,
-                            ScanPolicy::Importer,
-                        )
-                        .await;
-                        results.extend(nested);
-                    }
-                }
-            }
-
-            if let Some(store_path) = pnpm_store {
-                let entries = Self::list_pnpm_store_entries(&store_path).await;
-                results.extend(Self::scan_store_entries(StoreEntry::pnpm(entries), seen).await);
-            }
-            for store_path in legacy_stores {
-                let mut entries = Vec::new();
-                Self::collect_nested_store_entries(&store_path, &mut entries).await;
-                results.extend(Self::scan_store_entries(StoreEntry::pnpm(entries), seen).await);
-            }
-            if let Some(store_path) = vlt_store {
-                let entries = Self::list_vlt_store_entries(&store_path).await;
-                results.extend(Self::scan_store_entries(StoreEntry::vlt(entries), seen).await);
-            }
-
-            results
-        })
-    }
-
-    /// Enumerate pnpm virtual-store (`node_modules/.pnpm`) entries,
-    /// yielding `(entry_name, <entry>/node_modules)` for every entry whose
-    /// `node_modules` actually exists. The child literally named
-    /// `node_modules` is pnpm's internal hoist dir (nothing but symlinks
-    /// into sibling entries) and hidden children are store metadata — both
-    /// skipped. A REAL directory child with a `node_modules` of its own is
-    /// a flat (pnpm 6+) entry; one *without* is the pnpm 4/5 nested layout
-    /// — the child is a registry-host dir
-    /// (`.pnpm/<registry-host>/<name>/<version>/node_modules/<name>`), so
-    /// treating it as an empty entry silently hid every transitive-only
-    /// install (apply exited 0 claiming success with nothing written) —
-    /// descend it instead. Shared by the resolver
-    /// (`collect_nested_node_modules`) and the scan pass
-    /// (`scan_store_entries` callers) so the store-layout policy lives
-    /// once.
-    pub(super) async fn list_pnpm_store_entries(store_path: &Path) -> Vec<(String, PathBuf)> {
-        let mut entries = Vec::new();
-        for entry in crate::utils::fs::list_dir_entries(store_path).await {
-            let name = entry.file_name();
-            let name_str = name.to_string_lossy();
-            if name_str.starts_with('.') || name_str == "node_modules" {
-                continue;
-            }
-            let Some(file_type) = crate::utils::fs::entry_file_type(&entry).await else {
-                continue;
-            };
-            if !file_type.is_dir() {
-                continue;
-            }
-            let entry_path = store_path.join(&name);
-            let entry_nm = entry_path.join("node_modules");
-            if is_dir(&entry_nm).await {
-                entries.push((name_str.into_owned(), entry_nm));
-            } else {
-                Self::collect_nested_store_entries(&entry_path, &mut entries).await;
-            }
-        }
-        entries
-    }
-
-    /// Enumerate vlt's store (`node_modules/.vlt`), yielding the lossless
-    /// entry name and `<entry>/node_modules` for every REAL entry dir whose
-    /// `node_modules` is a real dir. Skipped: dot-names (store metadata and
-    /// the `.VLT.DELETE.<key>.<DepID>` rollback staging that lingers on
-    /// Windows), the `node_modules` child (vlt's internal hoist dir: links
-    /// plus real `@scope` dirs holding links), files (`vlt.json`) and links.
-    /// The store is always flat; every entry holds exactly one real package
-    /// dir named after the package (never the alias).
-    pub(super) async fn list_vlt_store_entries(store_path: &Path) -> Vec<(OsString, PathBuf)> {
-        let mut entries = Vec::new();
-        for entry in crate::utils::fs::list_dir_entries(store_path).await {
-            let name = entry.file_name();
-            if name.as_encoded_bytes().starts_with(b".") || name == "node_modules" {
-                continue;
-            }
-            let Some(file_type) = crate::utils::fs::entry_file_type(&entry).await else {
-                continue;
-            };
-            if !file_type.is_dir() {
-                continue;
-            }
-            let entry_nm = store_path.join(&name).join("node_modules");
-            let real_nm = tokio::fs::symlink_metadata(&entry_nm)
-                .await
-                .is_ok_and(|m| m.is_dir());
-            if real_nm {
-                entries.push((name, entry_nm));
-            }
-        }
-        entries
-    }
-
-    /// Descend a *nested* virtual-store host dir, yielding
-    /// `(name@version, <version-dir>/node_modules)` for each package home
-    /// found. Covers the two pre-flat layouts (both confirmed against
-    /// captured real installs):
-    /// - pnpm 4/5: `.pnpm/<registry-host>/…` — called on a `.pnpm` child
-    ///   that has no `node_modules` of its own;
-    /// - pnpm <=3: `node_modules/.<registry-host>/…` — called on the
-    ///   hidden store root directly.
-    ///
-    /// Below the host, path components are registry coordinates (`@scope`,
-    /// name, version), NOT package dirs, so the importer-walk hidden-name
-    /// skip does not apply here — but symlinks are never traversed (a link
-    /// inside the store points at a sibling entry or out of tree, and
-    /// following one could cycle), and both depth and total fan-out are
-    /// bounded. Each found dir's host-relative path is synthesized into
-    /// the flat `name@version` entry-name form so downstream consumers
-    /// (the pending-name filter, the `identity_seen` dedup) treat nested
-    /// and flat entries identically; a shape that doesn't fit stays an
-    /// undecodable — always-probed — name, the conservative direction.
-    pub(super) async fn collect_nested_store_entries(
-        host_path: &Path,
-        entries: &mut Vec<(String, PathBuf)>,
-    ) {
-        let mut remaining = NESTED_STORE_MAX_DIRS;
-        let mut queue: VecDeque<(PathBuf, String, usize)> =
-            VecDeque::from([(host_path.to_path_buf(), String::new(), 0)]);
-        while let Some((dir, rel, depth)) = queue.pop_front() {
-            for entry in crate::utils::fs::list_dir_entries(&dir).await {
-                let name = entry.file_name();
-                let name_str = name.to_string_lossy();
-                // A `node_modules` here belongs to a parent entry (already
-                // yielded), never a name/version coordinate.
-                if name_str == "node_modules" {
-                    continue;
-                }
-                let Some(file_type) = crate::utils::fs::entry_file_type(&entry).await else {
-                    continue;
-                };
-                if !file_type.is_dir() {
-                    continue;
-                }
-                if remaining == 0 {
-                    return;
-                }
-                remaining -= 1;
-                let child = dir.join(&name);
-                let child_rel = if rel.is_empty() {
-                    name_str.into_owned()
-                } else {
-                    format!("{rel}/{name_str}")
-                };
-                let child_nm = child.join("node_modules");
-                if is_dir(&child_nm).await {
-                    // `<name>/<version>/node_modules` — a package home.
-                    // Anything deeper belongs to that package's own tree,
-                    // which the store-entry scan walks itself.
-                    let entry_name = match child_rel.rsplit_once('/') {
-                        Some((pkg, version)) => format!("{pkg}@{version}"),
-                        // Directly under the host there is no name/version
-                        // split; the raw component stays the entry name
-                        // (undecodable ⇒ probed).
-                        None => child_rel,
-                    };
-                    entries.push((entry_name, child_nm));
-                    continue;
-                }
-                if depth + 1 < NESTED_STORE_MAX_DEPTH {
-                    queue.push_back((child, child_rel, depth + 1));
-                }
-            }
-        }
-    }
-
-    /// Inventory the packages under each virtual-store entry's
-    /// `node_modules` (entries come from `list_pnpm_store_entries`,
-    /// `collect_nested_store_entries` or `list_vlt_store_entries`). An
-    /// entry whose name decodes to a name@version the importer pass already
-    /// inventoried (every root-linked direct dep) skips the redundant
-    /// package.json re-read via `identity_seen` — the entry is still
-    /// walked, because bundled/injected dependencies are real dirs that
-    /// physically live only inside the store entry.
-    async fn scan_store_entries(
-        entries: Vec<StoreEntry>,
-        seen: &mut HashSet<String>,
-    ) -> Vec<CrawledPackage> {
-        let mut results = Vec::new();
-
-        for StoreEntry {
-            advertised,
-            node_modules: entry_nm,
-        } in entries
-        {
-            let identity_seen = advertised
-                .filter(|(full_name, version)| {
-                    let (ns, bare) = parse_package_name(full_name);
-                    seen.contains(&build_npm_purl(ns.as_deref(), &bare, version))
-                })
-                .map(|(full_name, _version)| full_name);
-            let found = Self::scan_node_modules(
-                &entry_nm,
-                seen,
-                ScanPolicy::StoreEntry {
-                    identity_seen: identity_seen.as_deref(),
-                },
-            )
-            .await;
-            results.extend(found);
-        }
-
-        results
-    }
-
-    /// Scan a scoped packages directory (`@scope/`). `policy` carries the
-    /// caller's traversal rules (see [`ScanPolicy`]); nested `node_modules`
-    /// below a scoped package are always regular importer-style trees.
-    fn scan_scoped_packages<'a>(
-        scope_path: &'a Path,
-        seen: &'a mut HashSet<String>,
-        policy: ScanPolicy<'a>,
-    ) -> std::pin::Pin<Box<dyn std::future::Future<Output = Vec<CrawledPackage>> + 'a>> {
-        Box::pin(async move {
-            let mut results = Vec::new();
-            let (store_entry, identity_seen) = match policy {
-                ScanPolicy::Importer => (false, None),
-                ScanPolicy::StoreEntry { identity_seen } => (true, identity_seen),
-            };
-            // `identity_seen` names the full `@scope/name`; this dir is the
-            // `@scope` half.
-            let scope_name = scope_path
-                .file_name()
-                .map(|s| s.to_string_lossy().into_owned())
-                .unwrap_or_default();
-
-            for entry in crate::utils::fs::list_dir_entries(scope_path).await {
-                let name = entry.file_name();
-                let name_str = name.to_string_lossy().to_string();
-
-                if name_str.starts_with('.') {
-                    continue;
-                }
-
-                let Some(file_type) = crate::utils::fs::entry_file_type(&entry).await else {
-                    continue;
-                };
-
-                let acceptable = if store_entry {
-                    file_type.is_dir()
-                } else {
-                    file_type.is_dir() || file_type.is_symlink()
-                };
-                if !acceptable {
-                    continue;
-                }
-
-                let pkg_path = scope_path.join(&name_str);
-                let already_inventoried =
-                    identity_seen.is_some_and(|full| full == format!("{scope_name}/{name_str}"));
-                if !already_inventoried {
-                    if let Some(pkg) = Self::check_package(&pkg_path, seen).await {
-                        results.push(pkg);
-                    }
-                }
-
-                // Nested node_modules only for real directories
-                if file_type.is_dir() {
-                    let nested = Self::scan_node_modules(
-                        &pkg_path.join("node_modules"),
-                        seen,
-                        ScanPolicy::Importer,
-                    )
-                    .await;
-                    results.extend(nested);
-                }
-            }
-
-            results
-        })
-    }
-
-    /// Check a package directory and return `CrawledPackage` if valid.
-    /// Deduplicates by PURL via the `seen` set.
-    async fn check_package(pkg_path: &Path, seen: &mut HashSet<String>) -> Option<CrawledPackage> {
-        let pkg_json_path = pkg_path.join("package.json");
-        let (full_name, version) = read_package_json(&pkg_json_path).await?;
-        let (namespace, name) = parse_package_name(&full_name);
-        let purl = build_npm_purl(namespace.as_deref(), &name, &version);
-
-        if seen.contains(&purl) {
-            return None;
-        }
-        seen.insert(purl.clone());
-
-        Some(CrawledPackage {
-            name,
-            version,
-            namespace,
-            purl,
-            path: pkg_path.to_path_buf(),
-        })
-    }
-}
-
-/// Equivalence of the blocking-pool walkers against the oracle above, over
-/// randomized fixture trees exercising every layout rule the walks encode:
-/// flat/nested/legacy pnpm stores, scoped packages, symlinks (live,
-/// dangling, into the store), duplicate identities, aliases, broken / BOM'd
-/// / FIFO / directory package.json, unreadable and unsearchable dirs, and
-/// case variants of `node_modules`.
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::collections::BTreeMap;
-
-    type Row = (String, String, String, Option<String>, PathBuf);
-
-    fn rows(pkgs: &[CrawledPackage]) -> Vec<Row> {
-        pkgs.iter()
-            .map(|p| {
-                (
-                    p.purl.clone(),
-                    p.name.clone(),
-                    p.version.clone(),
-                    p.namespace.clone(),
-                    p.path.clone(),
-                )
-            })
-            .collect()
-    }
-
-    fn map_rows(map: &HashMap<String, Vec<CrawledPackage>>) -> BTreeMap<String, Vec<Row>> {
-        map.iter().map(|(k, v)| (k.clone(), rows(v))).collect()
-    }
-
-    const NAMES: &[&str] = &[
-        "foo",
-        "bar",
-        "baz",
-        "dup",
-        "Foo",
-        "lodash._x",
-        "@s/a",
-        "@s/b",
-        "@t/c",
-    ];
-    const VERSIONS: &[&str] = &["1.0.0", "1.0.1", "2.0.0"];
-    const WS_NAMES: &[&str] = &[
-        "packages", "apps", "a", "b", "lib", "dist", "vendor", ".git", "tmp",
-    ];
-
-    /// Restores permissions the generator stripped, before the tempdir is
-    /// removed (declare it AFTER the tempdir so it drops first). Only Unix
-    /// strips permissions.
-    #[cfg_attr(not(unix), allow(dead_code))]
-    struct PermGuard(Vec<PathBuf>);
-    impl Drop for PermGuard {
-        fn drop(&mut self) {
-            #[cfg(unix)]
-            for p in self.0.iter().rev() {
-                use std::os::unix::fs::PermissionsExt as _;
-                let _ = std::fs::set_permissions(p, std::fs::Permissions::from_mode(0o755));
-            }
-        }
-    }
-
-    // Symlinks, FIFOs and permission stripping are generated on Unix only.
-    #[cfg_attr(not(unix), allow(dead_code))]
-    struct Gen {
-        state: u64,
-        /// Out-of-tree dir for symlink targets that get traversed.
-        scratch: PathBuf,
-        /// Real package dirs created so far (symlink targets).
-        pkg_dirs: Vec<PathBuf>,
-        /// Real `node_modules` dirs created so far (symlink targets).
-        nm_dirs: Vec<PathBuf>,
-        /// Dirs whose permissions were stripped; applied at the END (a
-        /// stripped dir must not block the rest of the generation).
-        lock_plan: Vec<(PathBuf, u32)>,
-        uniq: usize,
-    }
-
-    impl Gen {
-        fn new(seed: u64, scratch: PathBuf) -> Self {
-            Self {
-                state: seed.wrapping_mul(0x9E37_79B9_7F4A_7C15) | 1,
-                scratch,
-                pkg_dirs: Vec::new(),
-                nm_dirs: Vec::new(),
-                lock_plan: Vec::new(),
-                uniq: 0,
-            }
-        }
-
-        fn next(&mut self) -> u64 {
-            // xorshift64*
-            let mut x = self.state;
-            x ^= x >> 12;
-            x ^= x << 25;
-            x ^= x >> 27;
-            self.state = x;
-            x.wrapping_mul(0x2545_F491_4F6C_DD1D)
-        }
-
-        fn below(&mut self, n: usize) -> usize {
-            (self.next() % n as u64) as usize
-        }
-
-        fn chance(&mut self, pct: usize) -> bool {
-            self.below(100) < pct
-        }
-
-        fn pick<'a>(&mut self, items: &'a [&'a str]) -> &'a str {
-            items[self.below(items.len())]
-        }
-
-        fn uniq(&mut self) -> usize {
-            self.uniq += 1;
-            self.uniq
-        }
-
-        #[allow(unused_variables)]
-        fn symlink(target: &Path, link: &Path) {
-            #[cfg(unix)]
-            {
-                if let Some(parent) = link.parent() {
-                    let _ = std::fs::create_dir_all(parent);
-                }
-                let _ = std::os::unix::fs::symlink(target, link);
-            }
-        }
-
-        #[allow(unused_variables)]
-        fn plan_lock(&mut self, dir: &Path, mode: u32) {
-            #[cfg(unix)]
-            self.lock_plan.push((dir.to_path_buf(), mode));
-        }
-
-        fn apply_locks(&mut self, guard: &mut PermGuard) {
-            #[cfg(unix)]
-            {
-                use std::os::unix::fs::PermissionsExt as _;
-                // Deepest first, so a stripped parent never blocks a child.
-                let mut plan = std::mem::take(&mut self.lock_plan);
-                plan.sort_by_key(|(p, _)| std::cmp::Reverse(p.components().count()));
-                for (dir, mode) in plan {
-                    if std::fs::symlink_metadata(&dir).is_ok_and(|m| m.is_dir())
-                        && std::fs::set_permissions(&dir, std::fs::Permissions::from_mode(mode))
-                            .is_ok()
-                    {
-                        guard.0.push(dir);
-                    }
-                }
-            }
-            #[cfg(not(unix))]
-            let _ = guard;
-        }
-
-        /// Write `dir/package.json` in one of many shapes.
-        fn package_json(&mut self, dir: &Path, name: &str, version: &str) {
-            let _ = std::fs::create_dir_all(dir);
-            let pj = dir.join("package.json");
-            if pj.symlink_metadata().is_ok() {
-                // Never write through an existing one (it may be a FIFO).
-                return;
-            }
-            let valid = format!(r#"{{"name": "{name}", "version": "{version}"}}"#);
-            match self.below(100) {
-                0..=69 => {
-                    let _ = std::fs::write(&pj, valid);
-                }
-                70..=74 => {
-                    let _ = std::fs::write(&pj, format!("\u{feff}{valid}"));
-                }
-                75..=78 => {
-                    let _ = std::fs::write(&pj, "not json");
-                }
-                79..=82 => {
-                    let _ = std::fs::write(&pj, format!(r#"{{"name": "{name}"}}"#));
-                }
-                83..=85 => {
-                    let _ =
-                        std::fs::write(&pj, format!(r#"{{"name": "", "version": "{version}"}}"#));
-                }
-                86..=90 => {
-                    #[cfg(unix)]
-                    {
-                        let c = std::ffi::CString::new(pj.to_str().unwrap()).unwrap();
-                        // SAFETY: plain libc call on a valid C string.
-                        unsafe { libc::mkfifo(c.as_ptr(), 0o644) };
-                    }
-                    #[cfg(not(unix))]
-                    let _ = std::fs::write(&pj, valid);
-                }
-                91..=93 => {
-                    let _ = std::fs::create_dir_all(&pj);
-                }
-                _ => {}
-            }
-        }
-
-        /// A package dir `nm/<dir_name>` (maybe with nested node_modules).
-        fn package(&mut self, nm: &Path, depth: usize) {
-            let dir_name = self.pick(NAMES).to_string();
-            // Mostly the dir's own name; sometimes an alias install.
-            let pkg_name = if self.chance(88) {
-                dir_name.clone()
-            } else {
-                self.pick(NAMES).to_string()
-            };
-            let version = self.pick(VERSIONS).to_string();
-            let dir = nm.join(&dir_name);
-            if dir.exists() {
-                return;
-            }
-            self.package_json(&dir, &pkg_name, &version);
-            self.pkg_dirs.push(dir.clone());
-            if depth < 3 && self.chance(30) {
-                let store_ok = self.chance(10);
-                self.node_modules(&dir.join("node_modules"), depth + 1, store_ok);
-            }
-            if self.chance(4) {
-                self.plan_lock(&dir, 0o000);
-            }
-        }
-
-        fn node_modules(&mut self, nm: &Path, depth: usize, store_ok: bool) {
-            let _ = std::fs::create_dir_all(nm);
-            self.nm_dirs.push(nm.to_path_buf());
-            let mut store_pkgs: Vec<(String, PathBuf)> = Vec::new();
-            if store_ok && self.chance(60) {
-                store_pkgs = self.pnpm_store(&nm.join(".pnpm"), depth);
-            } else if self.chance(5) {
-                let _ = std::fs::write(nm.join(".pnpm"), "not a store");
-            }
-            if store_ok && self.chance(15) {
-                self.legacy_store(&nm.join(".registry.npmjs.org"), depth);
-            }
-            if store_ok && self.chance(20) {
-                let vlt_pkgs = self.vlt_store(&nm.join(".vlt"), depth);
-                store_pkgs.extend(vlt_pkgs);
-            }
-            let n = self.below(6);
-            for _ in 0..n {
-                match self.below(100) {
-                    0..=54 => self.package(nm, depth),
-                    55..=62 => {
-                        // Symlinked entry: live, into the store, or dangling.
-                        let name = self.pick(NAMES);
-                        let link = nm.join(name);
-                        if link.symlink_metadata().is_ok() {
-                            continue;
-                        }
-                        let target = if !store_pkgs.is_empty() && self.chance(50) {
-                            {
-                                let i = self.below(store_pkgs.len());
-                                store_pkgs[i].1.clone()
-                            }
-                        } else if !self.pkg_dirs.is_empty() && self.chance(80) {
-                            {
-                                let i = self.below(self.pkg_dirs.len());
-                                self.pkg_dirs[i].clone()
-                            }
-                        } else {
-                            nm.join(format!("dangling-{}", self.uniq()))
-                        };
-                        Self::symlink(&target, &link);
-                    }
-                    63..=66 => {
-                        let hidden = nm.join(format!(".cache{}", self.uniq()));
-                        self.package_json(&hidden.join("foo"), "foo", "1.0.0");
-                    }
-                    67..=70 => {
-                        let _ = std::fs::write(nm.join(format!("README{}", self.uniq())), "x");
-                    }
-                    71..=74 => {
-                        // A symlinked scope dir (to a scope living outside
-                        // the tree, so the followed walk cannot cycle).
-                        let id = self.uniq();
-                        let target = self.scratch.join(format!("scope{id}"));
-                        let version = self.pick(VERSIONS).to_string();
-                        self.package_json(&target.join("x"), "@link/x", &version);
-                        let link = nm.join(format!("@link{}", self.uniq()));
-                        Self::symlink(&target, &link);
-                    }
-                    75..=79 => {
-                        let bin = nm.join(".bin");
-                        let _ = std::fs::create_dir_all(&bin);
-                        if let Some(target) = self.pkg_dirs.first().cloned() {
-                            let link = bin.join(format!("tool{}", self.uniq()));
-                            Self::symlink(&target, &link);
-                        }
-                    }
-                    80..=82 => {
-                        // A nested `node_modules` entry inside node_modules.
-                        self.package_json(&nm.join("node_modules").join("foo"), "foo", "1.0.0");
-                    }
-                    _ => {
-                        let scoped = self.pick(&["@s/a", "@s/b", "@t/c"]).to_string();
-                        let dir = nm.join(&scoped);
-                        if !dir.exists() {
-                            let version = self.pick(VERSIONS).to_string();
-                            self.package_json(&dir, &scoped, &version);
-                            self.pkg_dirs.push(dir.clone());
-                            if depth < 3 && self.chance(25) {
-                                self.node_modules(&dir.join("node_modules"), depth + 1, false);
-                            }
-                        }
-                    }
-                }
-            }
-            // Root-linked direct deps: importer symlinks into the store.
-            for (name, target) in store_pkgs {
-                let link = nm.join(&name);
-                if self.chance(50) && link.symlink_metadata().is_err() {
-                    Self::symlink(&target, &link);
-                }
-            }
-            if self.chance(3) {
-                self.plan_lock(nm, 0o000);
-            }
-        }
-
-        /// A `.vlt` store; returns `(name, package dir)` of the entries'
-        /// own packages (importer link targets). DepIDs of every era and
-        /// shape, with the store's hoist dir, rollback staging, metadata
-        /// file, dependency links and a linked `node_modules` mixed in.
-        fn vlt_store(&mut self, store: &Path, depth: usize) -> Vec<(String, PathBuf)> {
-            let _ = std::fs::create_dir_all(store);
-            let _ = std::fs::write(store.join("vlt.json"), "{}");
-            let mut own = Vec::new();
-            for _ in 0..1 + self.below(6) {
-                let name = self.pick(NAMES).to_string();
-                let version = self.pick(VERSIONS).to_string();
-                let escaped = name.replace('/', "+");
-                let id = match self.below(10) {
-                    0 => format!("~npm~{escaped}@{version}~peer.{}", self.uniq()),
-                    1 => format!("··{}@{version}", name.replace('/', "§")),
-                    2 => format!("·npm·{}@{version}", name.replace('/', "§")),
-                    3 => format!("git~github_cu+r~v{}", self.uniq()),
-                    4 => format!(".VLT.DELETE.{}.~npm~{escaped}@{version}", self.uniq()),
-                    5 => "node_modules".to_string(),
-                    _ => format!("~npm~{escaped}@{version}"),
-                };
-                let entry = store.join(&id);
-                if entry.symlink_metadata().is_ok() {
-                    continue;
-                }
-                let entry_nm = entry.join("node_modules");
-                if self.chance(5) {
-                    let _ = std::fs::create_dir_all(&entry);
-                    let id = self.uniq();
-                    let elsewhere = self.scratch.join(format!("vlt-nm{id}"));
-                    self.package_json(&elsewhere.join(&name), &name, &version);
-                    Self::symlink(&elsewhere, &entry_nm);
-                    continue;
-                }
-                let pkg_name = if self.chance(90) {
-                    name.clone()
-                } else {
-                    self.pick(NAMES).to_string()
-                };
-                let pkg = entry_nm.join(&name);
-                self.package_json(&pkg, &pkg_name, &version);
-                self.pkg_dirs.push(pkg.clone());
-                own.push((name.clone(), pkg.clone()));
-                for _ in 0..self.below(3) {
-                    if let Some((dep, target)) = own.first().cloned() {
-                        Self::symlink(&target, &entry_nm.join(&dep));
-                    }
-                }
-                if depth < 2 && self.chance(25) {
-                    self.node_modules(&pkg.join("node_modules"), depth + 1, false);
-                }
-                if self.chance(4) {
-                    self.plan_lock(&entry_nm, 0o000);
-                }
-            }
-            own
-        }
-
-        fn store_entry_name(&mut self, name: &str, version: &str) -> String {
-            let escaped = name.replace('/', "+");
-            match self.below(10) {
-                0 => format!("{escaped}@{version}(peer@1.0.0)"),
-                1 => format!("{escaped}@{version}_peer@1.0.0"),
-                2 => format!("{escaped}@github.com+u+r@abc{}", self.uniq()),
-                3 => format!("truncated-{}_abcdef", self.uniq()),
-                _ => format!("{escaped}@{version}"),
-            }
-        }
-
-        /// A `.pnpm` virtual store; returns `(name, package dir)` of the
-        /// flat entries' own packages (importer symlink targets).
-        fn pnpm_store(&mut self, store: &Path, depth: usize) -> Vec<(String, PathBuf)> {
-            let _ = std::fs::create_dir_all(store);
-            let _ = std::fs::write(store.join("lock.yaml"), "x");
-            let mut own = Vec::new();
-            let n = 1 + self.below(6);
-            for _ in 0..n {
-                let name = self.pick(NAMES).to_string();
-                let version = self.pick(VERSIONS).to_string();
-                match self.below(100) {
-                    0..=59 => {
-                        let entry = store.join(self.store_entry_name(&name, &version));
-                        let entry_nm = entry.join("node_modules");
-                        let pkg_name = if self.chance(90) {
-                            name.clone()
-                        } else {
-                            self.pick(NAMES).to_string()
-                        };
-                        let pkg = entry_nm.join(&name);
-                        self.package_json(&pkg, &pkg_name, &version);
-                        self.pkg_dirs.push(pkg.clone());
-                        own.push((name.clone(), pkg.clone()));
-                        // Dependencies: symlinks to sibling entries.
-                        for _ in 0..self.below(3) {
-                            if let Some((dep, target)) = own.first().cloned() {
-                                Self::symlink(&target, &entry_nm.join(format!("{dep}-dep")));
-                            }
-                        }
-                        // Another real package in the entry (injected dep).
-                        if self.chance(20) {
-                            self.package(&entry_nm, depth + 1);
-                        }
-                        // Bundled deps below the package itself.
-                        if depth < 2 && self.chance(25) {
-                            self.node_modules(&pkg.join("node_modules"), depth + 1, false);
-                        }
-                        match self.below(100) {
-                            0..=3 => self.plan_lock(&entry_nm, 0o000),
-                            4..=6 => self.plan_lock(&entry, 0o000),
-                            7..=9 => self.plan_lock(&entry_nm, 0o300),
-                            _ => {}
-                        }
-                    }
-                    60..=67 => {
-                        // pnpm 4/5 nested host layout.
-                        let pkg = store
-                            .join("registry.npmjs.org")
-                            .join(&name)
-                            .join(&version)
-                            .join("node_modules")
-                            .join(&name);
-                        self.package_json(&pkg, &name, &version);
-                        self.pkg_dirs.push(pkg);
-                    }
-                    68..=71 => {
-                        let _ = std::fs::create_dir_all(
-                            store.join(format!("empty{}@1.0.0", self.uniq())),
-                        );
-                    }
-                    72..=75 => {
-                        let entry = store.join(self.store_entry_name(&name, &version));
-                        let _ = std::fs::create_dir_all(&entry);
-                        let _ = std::fs::write(entry.join("node_modules"), "file");
-                    }
-                    76..=79 => {
-                        // An entry whose node_modules is a symlink.
-                        if let Some(target) = self.nm_dirs.first().cloned() {
-                            let entry = store.join(self.store_entry_name(&name, &version));
-                            let _ = std::fs::create_dir_all(&entry);
-                            Self::symlink(&target, &entry.join("node_modules"));
-                        }
-                    }
-                    80..=83 => {
-                        // The entry itself is a symlink (skipped).
-                        if let Some(target) = self.pkg_dirs.first().cloned() {
-                            let link = store.join(format!("{name}@9.9.{}", self.uniq()));
-                            Self::symlink(&target, &link);
-                        }
-                    }
-                    84..=89 => {
-                        // pnpm's hoist dir: symlinks only.
-                        let hoist = store.join("node_modules");
-                        let _ = std::fs::create_dir_all(&hoist);
-                        if let Some((dep, target)) = own.first().cloned() {
-                            Self::symlink(&target, &hoist.join(dep));
-                        }
-                    }
-                    _ => {
-                        // Nested host with a scoped coordinate.
-                        let pkg = store
-                            .join("registry.npmjs.org")
-                            .join("@s")
-                            .join("a")
-                            .join(&version)
-                            .join("node_modules")
-                            .join("@s")
-                            .join("a");
-                        self.package_json(&pkg, "@s/a", &version);
-                    }
-                }
-            }
-            own
-        }
-
-        /// A pnpm <=3 `.registry.npmjs.org` store.
-        fn legacy_store(&mut self, store: &Path, depth: usize) {
-            for _ in 0..1 + self.below(4) {
-                let name = self.pick(NAMES).to_string();
-                let version = self.pick(VERSIONS).to_string();
-                let home = store.join(&name).join(&version).join("node_modules");
-                self.package_json(&home.join(&name), &name, &version);
-                if depth < 2 && self.chance(20) {
-                    self.package(&home, depth + 1);
-                }
-            }
-        }
-
-        fn workspace(&mut self, dir: &Path, depth: usize) {
-            let _ = std::fs::create_dir_all(dir);
-            if self.chance(70) {
-                self.node_modules(&dir.join("node_modules"), 0, true);
-            }
-            if depth >= 3 {
-                return;
-            }
-            for _ in 0..self.below(5) {
-                let child = dir.join(format!("{}{}", self.pick(WS_NAMES), self.uniq()));
-                match self.below(100) {
-                    0..=49 => self.workspace(&child, depth + 1),
-                    50..=57 => {
-                        // Skipped by name (dist/vendor/.git/tmp as-is).
-                        let skipped = dir.join(self.pick(&["dist", "vendor", ".git", "tmp"]));
-                        self.workspace(&skipped, depth + 1);
-                    }
-                    58..=63 => {
-                        // A symlinked workspace dir (never walked).
-                        if let Some(target) = self.nm_dirs.first().and_then(|p| p.parent()) {
-                            let target = target.to_path_buf();
-                            Self::symlink(&target, &child);
-                        }
-                    }
-                    64..=69 => {
-                        // node_modules itself a symlink.
-                        let _ = std::fs::create_dir_all(&child);
-                        if let Some(target) = self.nm_dirs.first().cloned() {
-                            Self::symlink(&target, &child.join("node_modules"));
-                        }
-                    }
-                    70..=73 => {
-                        let _ = std::fs::create_dir_all(&child);
-                        let _ = std::fs::write(child.join("node_modules"), "file");
-                    }
-                    74..=79 => {
-                        // Case variant (aliases node_modules on APFS/NTFS).
-                        let _ = std::fs::create_dir_all(&child);
-                        let variant = self.pick(&["Node_Modules", "NODE_MODULES"]);
-                        self.node_modules(&child.join(variant), 1, false);
-                    }
-                    80..=85 => {
-                        self.workspace(&child, depth + 1);
-                        self.plan_lock(&child, 0o000);
-                    }
-                    86..=91 => {
-                        // Readable but not searchable: lists fine, stats fail.
-                        self.workspace(&child, depth + 1);
-                        self.plan_lock(&child, 0o600);
-                    }
-                    _ => {
-                        let _ = std::fs::create_dir_all(&child);
-                        let _ = std::fs::write(child.join("package.json"), "{}");
-                    }
-                }
-            }
-        }
-    }
-
-    /// Every purl worth resolving against a tree: all crawled identities,
-    /// qualified / percent-encoded spellings, absent versions, and names
-    /// that only exist inside store entries or aliases.
-    fn probe_purls(crawled: &[CrawledPackage]) -> Vec<String> {
-        let mut purls: Vec<String> = crawled.iter().map(|p| p.purl.clone()).collect();
-        for name in NAMES {
-            for version in VERSIONS {
-                purls.push(format!("pkg:npm/{name}@{version}"));
-            }
-        }
-        purls.push("pkg:npm/%40s/a@1.0.0".to_string());
-        purls.push("pkg:npm/foo@1.0.0?vcs_url=git@x".to_string());
-        purls.push("pkg:npm/absent@1.0.0".to_string());
-        purls.push("pkg:npm/casedir@1.0.0".to_string());
-        purls.push("pkg:npm/@cs/x@1.0.0".to_string());
-        purls.push("pkg:npm/../evil@1.0.0".to_string());
-        purls.sort();
-        purls.dedup();
-        purls
-    }
-
-    async fn assert_equivalent(root: &Path, label: &str) {
-        let base = root.parent().unwrap();
-        let rel = |p: &Path| crate::crawlers::test_tree::rel(base, p);
-        let rel_rows = |pkgs: &[CrawledPackage]| crate::crawlers::test_tree::rel_rows(base, pkgs);
-        let rel_pairs = |v: &[(String, PathBuf)]| -> Vec<(String, String)> {
-            v.iter().map(|(k, p)| (k.clone(), rel(p))).collect()
-        };
-        let input = crate::crawlers::test_tree::tree_listing(base);
-        let mut per_nm = Vec::new();
-        let options = CrawlerOptions {
-            cwd: root.to_path_buf(),
-            global: false,
-            global_prefix: None,
-        };
-        let crawler = NpmCrawler::new();
-
-        let new_paths = crawler.get_node_modules_paths(&options).await.unwrap();
-        let old_paths = LegacyNpmCrawler::find_local_node_modules_dirs(root).await;
-        assert_eq!(new_paths, old_paths, "{label}: node_modules roots differ");
-
-        let new_pkgs = crawler.crawl_all(&options).await;
-        let old_pkgs = LegacyNpmCrawler::crawl_all(&options).await;
-        assert_eq!(
-            rows(&new_pkgs),
-            rows(&old_pkgs),
-            "{label}: crawl_all differs"
-        );
-
-        let purls = probe_purls(&new_pkgs);
-        for nm in &new_paths {
-            let new_found = crawler.find_by_purls(nm, &purls).await.unwrap();
-            let old_found = LegacyNpmCrawler::find_by_purls(nm, &purls).await.unwrap();
-            assert_eq!(
-                map_rows(&new_found),
-                map_rows(&old_found),
-                "{label}: find_by_purls differs under {}",
-                nm.display()
-            );
-
-            let store = nm.join(".pnpm");
-            assert_eq!(
-                NpmCrawler::list_pnpm_store_entries(&store).await,
-                LegacyNpmCrawler::list_pnpm_store_entries(&store).await,
-                "{label}: store entries differ under {}",
-                store.display()
-            );
-            let vlt = nm.join(".vlt");
-            assert_eq!(
-                NpmCrawler::list_vlt_store_entries(&vlt).await,
-                LegacyNpmCrawler::list_vlt_store_entries(&vlt).await,
-                "{label}: vlt store entries differ under {}",
-                vlt.display()
-            );
-            let legacy = nm.join(".registry.npmjs.org");
-            let mut new_nested = Vec::new();
-            NpmCrawler::collect_nested_store_entries(&legacy, &mut new_nested).await;
-            let mut old_nested = Vec::new();
-            LegacyNpmCrawler::collect_nested_store_entries(&legacy, &mut old_nested).await;
-            assert_eq!(
-                new_nested, old_nested,
-                "{label}: nested store entries differ"
-            );
-            let found: BTreeMap<String, Vec<_>> = new_found
-                .iter()
-                .map(|(k, v)| (k.clone(), rel_rows(v)))
-                .collect();
-            let vlt: Vec<(String, String)> = NpmCrawler::list_vlt_store_entries(&vlt)
-                .await
-                .iter()
-                .map(|(k, p)| (k.to_string_lossy().into_owned(), rel(p)))
-                .collect();
-            per_nm.push((
-                rel(nm),
-                found,
-                rel_pairs(&NpmCrawler::list_pnpm_store_entries(&store).await),
-                vlt,
-                rel_pairs(&new_nested),
-            ));
-        }
-        let paths: Vec<String> = new_paths.iter().map(|p| rel(p)).collect();
-        crate::golden::record(&input, &(paths, rel_rows(&new_pkgs), per_nm));
-    }
-
-    #[tokio::test(flavor = "multi_thread")]
-    async fn randomized_trees_match_the_sequential_oracle() {
-        let sweep = crate::golden::Sweep::start(
-            "crawl_npm_trees",
-            "One seeded project tree: node_modules roots, crawl_all, find_by_purls and store listings.",
-        );
-        let mut nonempty = 0;
-        for seed in 0..64u64 {
-            let tmp = tempfile::tempdir().unwrap();
-            let mut guard = PermGuard(Vec::new());
-            let root = tmp.path().join("proj");
-            let mut gen = Gen::new(seed, tmp.path().join("scratch"));
-            gen.workspace(&root, 0);
-            gen.apply_locks(&mut guard);
-
-            assert_equivalent(&root, &format!("seed {seed}")).await;
-            let options = CrawlerOptions {
-                cwd: root.clone(),
-                global: false,
-                global_prefix: None,
-            };
-            if !NpmCrawler::new().crawl_all(&options).await.is_empty() {
-                nonempty += 1;
-            }
-            drop(guard);
-        }
-        // The generator must actually produce packages most of the time,
-        // or the comparison above is vacuous.
-        assert!(nonempty > 32, "only {nonempty} non-empty trees");
-        if crate::crawlers::test_tree::crawl_goldens_apply(true) {
-            sweep.finish();
-        }
-    }
-
-    /// A store entry whose own child's package.json disagrees with the
-    /// entry's name@version, for a root-installed package: the sequential
-    /// walk skips that child by name (`identity_seen`) without reading it,
-    /// so the foreign identity must never surface.
-    #[tokio::test]
-    async fn store_entry_child_with_a_foreign_identity_is_skipped_like_the_oracle() {
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path().join("proj");
-        let nm = root.join("node_modules");
-        let write = |dir: &Path, name: &str, version: &str| {
-            std::fs::create_dir_all(dir).unwrap();
-            std::fs::write(
-                dir.join("package.json"),
-                format!(r#"{{"name": "{name}", "version": "{version}"}}"#),
-            )
-            .unwrap();
-        };
-        write(&nm.join("qux"), "qux", "1.0.0");
-        write(&nm.join("@s").join("q"), "@s/q", "1.0.0");
-        let store = nm.join(".pnpm");
-        let q = store.join("qux@1.0.0").join("node_modules");
-        write(&q.join("qux"), "qux", "9.9.9");
-        // Below the skipped child is still walked.
-        write(
-            &q.join("qux").join("node_modules").join("inner"),
-            "inner",
-            "1.0.0",
-        );
-        // A sibling of the skipped child is not skipped.
-        write(&q.join("sib"), "sib", "1.0.0");
-        write(
-            &store
-                .join("@s+q@1.0.0")
-                .join("node_modules")
-                .join("@s")
-                .join("q"),
-            "@s/q",
-            "9.9.9",
-        );
-        // Not root-installed: its child is read, foreign identity and all.
-        write(
-            &store.join("free@1.0.0").join("node_modules").join("free"),
-            "free",
-            "7.7.7",
-        );
-
-        let sweep = crate::golden::Sweep::start(
-            "crawl_npm_foreign_identity",
-            "A pnpm store entry whose child names a foreign identity.",
-        );
-        assert_equivalent(&root, "foreign identity").await;
-        if crate::crawlers::test_tree::crawl_goldens_apply(false) {
-            sweep.finish();
-        }
-
-        let options = CrawlerOptions {
-            cwd: root.clone(),
-            global: false,
-            global_prefix: None,
-        };
-        let purls: Vec<String> = NpmCrawler::new()
-            .crawl_all(&options)
-            .await
-            .into_iter()
-            .map(|p| p.purl)
-            .collect();
-        for present in [
-            "pkg:npm/qux@1.0.0",
-            "pkg:npm/@s/q@1.0.0",
-            "pkg:npm/inner@1.0.0",
-            "pkg:npm/sib@1.0.0",
-            "pkg:npm/free@7.7.7",
-        ] {
-            assert!(
-                purls.iter().any(|p| p == present),
-                "missing {present}: {purls:?}"
-            );
-        }
-        for absent in ["pkg:npm/qux@9.9.9", "pkg:npm/@s/q@9.9.9"] {
-            assert!(
-                !purls.iter().any(|p| p == absent),
-                "{absent} must be skipped: {purls:?}"
-            );
-        }
-    }
-
-    /// With no walk pool (the OS refused every walk thread) the walk runs
-    /// sequentially on the calling thread and still matches the oracle.
-    #[tokio::test]
-    async fn walk_without_a_pool_matches_the_sequential_oracle() {
-        let _off = crate::crawlers::walk_pool::test_hooks::DisablePool::new();
-        let sweep = crate::golden::Sweep::start(
-            "crawl_npm_no_pool",
-            "One seeded project tree, walked with no walk pool.",
-        );
-        for seed in 0..16u64 {
-            let tmp = tempfile::tempdir().unwrap();
-            let mut guard = PermGuard(Vec::new());
-            let root = tmp.path().join("proj");
-            let mut gen = Gen::new(seed, tmp.path().join("scratch"));
-            gen.workspace(&root, 0);
-            gen.apply_locks(&mut guard);
-            assert_equivalent(&root, &format!("no pool, seed {seed}")).await;
-            drop(guard);
-        }
-        if crate::crawlers::test_tree::crawl_goldens_apply(true) {
-            sweep.finish();
-        }
-    }
-
-    /// Hand-built tree with one of every tricky shape (so each is covered
-    /// regardless of what the random generator happens to draw), asserting
-    /// equivalence and pinning a few load-bearing outcomes.
-    #[tokio::test]
-    async fn kitchen_sink_tree_matches_the_sequential_oracle() {
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path().join("proj");
-        let nm = root.join("node_modules");
-        let write = |dir: &Path, name: &str, version: &str| {
-            std::fs::create_dir_all(dir).unwrap();
-            std::fs::write(
-                dir.join("package.json"),
-                format!(r#"{{"name": "{name}", "version": "{version}"}}"#),
-            )
-            .unwrap();
-        };
-        // Importer tree: plain, scoped, nested duplicate, alias.
-        write(&nm.join("foo"), "foo", "1.0.0");
-        write(&nm.join("@s").join("a"), "@s/a", "1.0.0");
-        write(
-            &nm.join("bar").join("node_modules").join("foo"),
-            "foo",
-            "1.0.0",
-        );
-        write(&nm.join("bar"), "bar", "1.0.0");
-        write(&nm.join("alias"), "baz", "2.0.0");
-        // Flat store: a root-linked dep's own entry (identity_seen skip) with
-        // a bundled dep, a transitive-only entry, peer variants.
-        let store = nm.join(".pnpm");
-        let q = store.join("qux@1.0.0").join("node_modules");
-        write(&q.join("qux"), "qux", "1.0.0");
-        write(
-            &q.join("qux").join("node_modules").join("bundled"),
-            "bundled",
-            "3.0.0",
-        );
-        write(
-            &store.join("t@1.0.0").join("node_modules").join("t"),
-            "t",
-            "1.0.0",
-        );
-        write(
-            &store
-                .join("p@1.0.0(r@17.0.0)")
-                .join("node_modules")
-                .join("p"),
-            "p",
-            "1.0.0",
-        );
-        write(
-            &store
-                .join("p@1.0.0(r@18.0.0)")
-                .join("node_modules")
-                .join("p"),
-            "p",
-            "1.0.0",
-        );
-        write(
-            &store
-                .join("@s+b@1.0.0")
-                .join("node_modules")
-                .join("@s")
-                .join("b"),
-            "@s/b",
-            "1.0.0",
-        );
-        // Nested (pnpm 4/5) host and legacy (pnpm <=3) store.
-        write(
-            &store
-                .join("registry.npmjs.org")
-                .join("n")
-                .join("1.0.0")
-                .join("node_modules")
-                .join("n"),
-            "n",
-            "1.0.0",
-        );
-        write(
-            &nm.join(".registry.npmjs.org")
-                .join("l")
-                .join("1.0.0")
-                .join("node_modules")
-                .join("l"),
-            "l",
-            "1.0.0",
-        );
-        // A dir whose spelling differs from its package's name only by case
-        // (resolves under the lowercase name on case-insensitive volumes),
-        // and a scope spelled likewise.
-        write(&nm.join("CaseDir"), "casedir", "1.0.0");
-        write(&nm.join("@Cs").join("x"), "@cs/x", "1.0.0");
-        // Broken / BOM'd package.json.
-        std::fs::create_dir_all(nm.join("broken")).unwrap();
-        std::fs::write(nm.join("broken").join("package.json"), "{").unwrap();
-        std::fs::create_dir_all(nm.join("bom")).unwrap();
-        std::fs::write(
-            nm.join("bom").join("package.json"),
-            "\u{feff}{\"name\":\"bom\",\"version\":\"1.0.0\"}",
-        )
-        .unwrap();
-        // Workspaces: plain, skipped, case variant, node_modules-as-file.
-        write(
-            &root
-                .join("packages")
-                .join("w")
-                .join("node_modules")
-                .join("w"),
-            "w",
-            "1.0.0",
-        );
-        write(
-            &root.join("dist").join("node_modules").join("d"),
-            "d",
-            "1.0.0",
-        );
-        write(
-            &root.join("cv").join("Node_Modules").join("cv"),
-            "cv",
-            "1.0.0",
-        );
-        std::fs::create_dir_all(root.join("nf")).unwrap();
-        std::fs::write(root.join("nf").join("node_modules"), "file").unwrap();
-
-        let tmp_guard;
-        #[cfg(unix)]
-        {
-            use std::os::unix::fs::{symlink, PermissionsExt as _};
-            // Root-linked direct dep into the store, a dangling link.
-            symlink(q.join("qux"), nm.join("qux")).unwrap();
-            symlink(root.join("nowhere"), nm.join("dangling")).unwrap();
-            // FIFO package.json.
-            std::fs::create_dir_all(nm.join("fifo")).unwrap();
-            let c = std::ffi::CString::new(nm.join("fifo").join("package.json").to_str().unwrap())
-                .unwrap();
-            // SAFETY: plain libc call on a valid C string.
-            assert_eq!(unsafe { libc::mkfifo(c.as_ptr(), 0o644) }, 0);
-            // A workspace whose node_modules is a symlink.
-            std::fs::create_dir_all(root.join("ln")).unwrap();
-            symlink(
-                root.join("packages").join("w").join("node_modules"),
-                root.join("ln").join("node_modules"),
-            )
-            .unwrap();
-            // Unreadable store entry node_modules; unsearchable workspace.
-            let locked_nm = store.join("z@1.0.0").join("node_modules");
-            write(&locked_nm.join("z"), "z", "1.0.0");
-            write(
-                &root.join("rw").join("node_modules").join("r"),
-                "r",
-                "1.0.0",
-            );
-            std::fs::set_permissions(&locked_nm, std::fs::Permissions::from_mode(0o000)).unwrap();
-            std::fs::set_permissions(root.join("rw"), std::fs::Permissions::from_mode(0o600))
-                .unwrap();
-            tmp_guard = PermGuard(vec![locked_nm, root.join("rw")]);
-        }
-        #[cfg(not(unix))]
-        {
-            tmp_guard = PermGuard(Vec::new());
-        }
-
-        let sweep = crate::golden::Sweep::start(
-            "crawl_npm_kitchen_sink",
-            "A hand-built project tree with one of every tricky shape.",
-        );
-        assert_equivalent(&root, "kitchen sink").await;
-        if crate::crawlers::test_tree::crawl_goldens_apply(true) {
-            sweep.finish();
-        }
-
-        let options = CrawlerOptions {
-            cwd: root.clone(),
-            global: false,
-            global_prefix: None,
-        };
-        let purls: Vec<String> = NpmCrawler::new()
-            .crawl_all(&options)
-            .await
-            .into_iter()
-            .map(|p| p.purl)
-            .collect();
-        for expected in [
-            "pkg:npm/foo@1.0.0",
-            "pkg:npm/@s/a@1.0.0",
-            "pkg:npm/bundled@3.0.0",
-            "pkg:npm/t@1.0.0",
-            "pkg:npm/p@1.0.0",
-            "pkg:npm/@s/b@1.0.0",
-            "pkg:npm/n@1.0.0",
-            "pkg:npm/l@1.0.0",
-            "pkg:npm/bom@1.0.0",
-            "pkg:npm/w@1.0.0",
-        ] {
-            assert!(
-                purls.iter().any(|p| p == expected),
-                "missing {expected}: {purls:?}"
-            );
-        }
-        assert!(
-            !purls.iter().any(|p| p == "pkg:npm/d@1.0.0"),
-            "dist/ must be skipped"
-        );
-        drop(tmp_guard);
-    }
-}
diff --git a/crates/socket-patch-core/src/crawlers/npm_crawler/sweep_tests.rs b/crates/socket-patch-core/src/crawlers/npm_crawler/sweep_tests.rs
new file mode 100644
index 000000000..4ae3b5901
--- /dev/null
+++ b/crates/socket-patch-core/src/crawlers/npm_crawler/sweep_tests.rs
@@ -0,0 +1,954 @@
+//! Seeded npm project trees, pinned by golden (see `crate::golden`):
+//! flat/nested/legacy pnpm stores, scoped packages, symlinks (live,
+//! dangling, into the store), duplicate identities, aliases, broken / BOM'd
+//! / FIFO / directory package.json, unreadable and unsearchable dirs, and
+//! case variants of `node_modules`.
+
+use std::collections::BTreeMap;
+use std::path::{Path, PathBuf};
+
+use super::NpmCrawler;
+use crate::crawlers::types::{CrawledPackage, CrawlerOptions};
+use crate::test_rng::Rng;
+
+const NAMES: &[&str] = &[
+    "foo",
+    "bar",
+    "baz",
+    "dup",
+    "Foo",
+    "lodash._x",
+    "@s/a",
+    "@s/b",
+    "@t/c",
+];
+const VERSIONS: &[&str] = &["1.0.0", "1.0.1", "2.0.0"];
+const WS_NAMES: &[&str] = &[
+    "packages", "apps", "a", "b", "lib", "dist", "vendor", ".git", "tmp",
+];
+
+/// Restores permissions the generator stripped, before the tempdir is
+/// removed (declare it AFTER the tempdir so it drops first). Only Unix
+/// strips permissions.
+#[cfg_attr(not(unix), allow(dead_code))]
+struct PermGuard(Vec<PathBuf>);
+impl Drop for PermGuard {
+    fn drop(&mut self) {
+        #[cfg(unix)]
+        for p in self.0.iter().rev() {
+            use std::os::unix::fs::PermissionsExt as _;
+            let _ = std::fs::set_permissions(p, std::fs::Permissions::from_mode(0o755));
+        }
+    }
+}
+
+// Symlinks, FIFOs and permission stripping are generated on Unix only.
+#[cfg_attr(not(unix), allow(dead_code))]
+struct Gen {
+    rng: Rng,
+    /// Out-of-tree dir for symlink targets that get traversed.
+    scratch: PathBuf,
+    /// Real package dirs created so far (symlink targets).
+    pkg_dirs: Vec<PathBuf>,
+    /// Real `node_modules` dirs created so far (symlink targets).
+    nm_dirs: Vec<PathBuf>,
+    /// Dirs whose permissions were stripped; applied at the END (a
+    /// stripped dir must not block the rest of the generation).
+    lock_plan: Vec<(PathBuf, u32)>,
+    uniq: usize,
+}
+
+impl Gen {
+    fn new(seed: u64, scratch: PathBuf) -> Self {
+        Self {
+            rng: Rng::new(seed),
+            scratch,
+            pkg_dirs: Vec::new(),
+            nm_dirs: Vec::new(),
+            lock_plan: Vec::new(),
+            uniq: 0,
+        }
+    }
+
+    fn below(&mut self, n: usize) -> usize {
+        self.rng.below(n)
+    }
+
+    fn chance(&mut self, percent: u64) -> bool {
+        self.rng.chance(percent)
+    }
+
+    fn pick<'a>(&mut self, items: &[&'a str]) -> &'a str {
+        self.rng.pick(items)
+    }
+
+    fn uniq(&mut self) -> usize {
+        self.uniq += 1;
+        self.uniq
+    }
+
+    #[allow(unused_variables)]
+    fn symlink(target: &Path, link: &Path) {
+        #[cfg(unix)]
+        {
+            if let Some(parent) = link.parent() {
+                let _ = std::fs::create_dir_all(parent);
+            }
+            let _ = std::os::unix::fs::symlink(target, link);
+        }
+    }
+
+    #[allow(unused_variables)]
+    fn plan_lock(&mut self, dir: &Path, mode: u32) {
+        #[cfg(unix)]
+        self.lock_plan.push((dir.to_path_buf(), mode));
+    }
+
+    fn apply_locks(&mut self, guard: &mut PermGuard) {
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt as _;
+            // Deepest first, so a stripped parent never blocks a child.
+            let mut plan = std::mem::take(&mut self.lock_plan);
+            plan.sort_by_key(|(p, _)| std::cmp::Reverse(p.components().count()));
+            for (dir, mode) in plan {
+                if std::fs::symlink_metadata(&dir).is_ok_and(|m| m.is_dir())
+                    && std::fs::set_permissions(&dir, std::fs::Permissions::from_mode(mode))
+                        .is_ok()
+                {
+                    guard.0.push(dir);
+                }
+            }
+        }
+        #[cfg(not(unix))]
+        let _ = guard;
+    }
+
+    /// Write `dir/package.json` in one of many shapes.
+    fn package_json(&mut self, dir: &Path, name: &str, version: &str) {
+        let _ = std::fs::create_dir_all(dir);
+        let pj = dir.join("package.json");
+        if pj.symlink_metadata().is_ok() {
+            // Never write through an existing one (it may be a FIFO).
+            return;
+        }
+        let valid = format!(r#"{{"name": "{name}", "version": "{version}"}}"#);
+        match self.below(100) {
+            0..=69 => {
+                let _ = std::fs::write(&pj, valid);
+            }
+            70..=74 => {
+                let _ = std::fs::write(&pj, format!("\u{feff}{valid}"));
+            }
+            75..=78 => {
+                let _ = std::fs::write(&pj, "not json");
+            }
+            79..=82 => {
+                let _ = std::fs::write(&pj, format!(r#"{{"name": "{name}"}}"#));
+            }
+            83..=85 => {
+                let _ =
+                    std::fs::write(&pj, format!(r#"{{"name": "", "version": "{version}"}}"#));
+            }
+            86..=90 => {
+                #[cfg(unix)]
+                {
+                    let c = std::ffi::CString::new(pj.to_str().unwrap()).unwrap();
+                    // SAFETY: plain libc call on a valid C string.
+                    unsafe { libc::mkfifo(c.as_ptr(), 0o644) };
+                }
+                #[cfg(not(unix))]
+                let _ = std::fs::write(&pj, valid);
+            }
+            91..=93 => {
+                let _ = std::fs::create_dir_all(&pj);
+            }
+            _ => {}
+        }
+    }
+
+    /// A package dir `nm/<dir_name>` (maybe with nested node_modules).
+    fn package(&mut self, nm: &Path, depth: usize) {
+        let dir_name = self.pick(NAMES).to_string();
+        // Mostly the dir's own name; sometimes an alias install.
+        let pkg_name = if self.chance(88) {
+            dir_name.clone()
+        } else {
+            self.pick(NAMES).to_string()
+        };
+        let version = self.pick(VERSIONS).to_string();
+        let dir = nm.join(&dir_name);
+        if dir.exists() {
+            return;
+        }
+        self.package_json(&dir, &pkg_name, &version);
+        self.pkg_dirs.push(dir.clone());
+        if depth < 3 && self.chance(30) {
+            let store_ok = self.chance(10);
+            self.node_modules(&dir.join("node_modules"), depth + 1, store_ok);
+        }
+        if self.chance(4) {
+            self.plan_lock(&dir, 0o000);
+        }
+    }
+
+    fn node_modules(&mut self, nm: &Path, depth: usize, store_ok: bool) {
+        let _ = std::fs::create_dir_all(nm);
+        self.nm_dirs.push(nm.to_path_buf());
+        let mut store_pkgs: Vec<(String, PathBuf)> = Vec::new();
+        if store_ok && self.chance(60) {
+            store_pkgs = self.pnpm_store(&nm.join(".pnpm"), depth);
+        } else if self.chance(5) {
+            let _ = std::fs::write(nm.join(".pnpm"), "not a store");
+        }
+        if store_ok && self.chance(15) {
+            self.legacy_store(&nm.join(".registry.npmjs.org"), depth);
+        }
+        if store_ok && self.chance(20) {
+            let vlt_pkgs = self.vlt_store(&nm.join(".vlt"), depth);
+            store_pkgs.extend(vlt_pkgs);
+        }
+        let n = self.below(6);
+        for _ in 0..n {
+            match self.below(100) {
+                0..=54 => self.package(nm, depth),
+                55..=62 => {
+                    // Symlinked entry: live, into the store, or dangling.
+                    let name = self.pick(NAMES);
+                    let link = nm.join(name);
+                    if link.symlink_metadata().is_ok() {
+                        continue;
+                    }
+                    let target = if !store_pkgs.is_empty() && self.chance(50) {
+                        {
+                            let i = self.below(store_pkgs.len());
+                            store_pkgs[i].1.clone()
+                        }
+                    } else if !self.pkg_dirs.is_empty() && self.chance(80) {
+                        {
+                            let i = self.below(self.pkg_dirs.len());
+                            self.pkg_dirs[i].clone()
+                        }
+                    } else {
+                        nm.join(format!("dangling-{}", self.uniq()))
+                    };
+                    Self::symlink(&target, &link);
+                }
+                63..=66 => {
+                    let hidden = nm.join(format!(".cache{}", self.uniq()));
+                    self.package_json(&hidden.join("foo"), "foo", "1.0.0");
+                }
+                67..=70 => {
+                    let _ = std::fs::write(nm.join(format!("README{}", self.uniq())), "x");
+                }
+                71..=74 => {
+                    // A symlinked scope dir (to a scope living outside
+                    // the tree, so the followed walk cannot cycle).
+                    let id = self.uniq();
+                    let target = self.scratch.join(format!("scope{id}"));
+                    let version = self.pick(VERSIONS).to_string();
+                    self.package_json(&target.join("x"), "@link/x", &version);
+                    let link = nm.join(format!("@link{}", self.uniq()));
+                    Self::symlink(&target, &link);
+                }
+                75..=79 => {
+                    let bin = nm.join(".bin");
+                    let _ = std::fs::create_dir_all(&bin);
+                    if let Some(target) = self.pkg_dirs.first().cloned() {
+                        let link = bin.join(format!("tool{}", self.uniq()));
+                        Self::symlink(&target, &link);
+                    }
+                }
+                80..=82 => {
+                    // A nested `node_modules` entry inside node_modules.
+                    self.package_json(&nm.join("node_modules").join("foo"), "foo", "1.0.0");
+                }
+                _ => {
+                    let scoped = self.pick(&["@s/a", "@s/b", "@t/c"]).to_string();
+                    let dir = nm.join(&scoped);
+                    if !dir.exists() {
+                        let version = self.pick(VERSIONS).to_string();
+                        self.package_json(&dir, &scoped, &version);
+                        self.pkg_dirs.push(dir.clone());
+                        if depth < 3 && self.chance(25) {
+                            self.node_modules(&dir.join("node_modules"), depth + 1, false);
+                        }
+                    }
+                }
+            }
+        }
+        // Root-linked direct deps: importer symlinks into the store.
+        for (name, target) in store_pkgs {
+            let link = nm.join(&name);
+            if self.chance(50) && link.symlink_metadata().is_err() {
+                Self::symlink(&target, &link);
+            }
+        }
+        if self.chance(3) {
+            self.plan_lock(nm, 0o000);
+        }
+    }
+
+    /// A `.vlt` store; returns `(name, package dir)` of the entries'
+    /// own packages (importer link targets). DepIDs of every era and
+    /// shape, with the store's hoist dir, rollback staging, metadata
+    /// file, dependency links and a linked `node_modules` mixed in.
+    fn vlt_store(&mut self, store: &Path, depth: usize) -> Vec<(String, PathBuf)> {
+        let _ = std::fs::create_dir_all(store);
+        let _ = std::fs::write(store.join("vlt.json"), "{}");
+        let mut own = Vec::new();
+        for _ in 0..1 + self.below(6) {
+            let name = self.pick(NAMES).to_string();
+            let version = self.pick(VERSIONS).to_string();
+            let escaped = name.replace('/', "+");
+            let id = match self.below(10) {
+                0 => format!("~npm~{escaped}@{version}~peer.{}", self.uniq()),
+                1 => format!("··{}@{version}", name.replace('/', "§")),
+                2 => format!("·npm·{}@{version}", name.replace('/', "§")),
+                3 => format!("git~github_cu+r~v{}", self.uniq()),
+                4 => format!(".VLT.DELETE.{}.~npm~{escaped}@{version}", self.uniq()),
+                5 => "node_modules".to_string(),
+                _ => format!("~npm~{escaped}@{version}"),
+            };
+            let entry = store.join(&id);
+            if entry.symlink_metadata().is_ok() {
+                continue;
+            }
+            let entry_nm = entry.join("node_modules");
+            if self.chance(5) {
+                let _ = std::fs::create_dir_all(&entry);
+                let id = self.uniq();
+                let elsewhere = self.scratch.join(format!("vlt-nm{id}"));
+                self.package_json(&elsewhere.join(&name), &name, &version);
+                Self::symlink(&elsewhere, &entry_nm);
+                continue;
+            }
+            let pkg_name = if self.chance(90) {
+                name.clone()
+            } else {
+                self.pick(NAMES).to_string()
+            };
+            let pkg = entry_nm.join(&name);
+            self.package_json(&pkg, &pkg_name, &version);
+            self.pkg_dirs.push(pkg.clone());
+            own.push((name.clone(), pkg.clone()));
+            for _ in 0..self.below(3) {
+                if let Some((dep, target)) = own.first().cloned() {
+                    Self::symlink(&target, &entry_nm.join(&dep));
+                }
+            }
+            if depth < 2 && self.chance(25) {
+                self.node_modules(&pkg.join("node_modules"), depth + 1, false);
+            }
+            if self.chance(4) {
+                self.plan_lock(&entry_nm, 0o000);
+            }
+        }
+        own
+    }
+
+    fn store_entry_name(&mut self, name: &str, version: &str) -> String {
+        let escaped = name.replace('/', "+");
+        match self.below(10) {
+            0 => format!("{escaped}@{version}(peer@1.0.0)"),
+            1 => format!("{escaped}@{version}_peer@1.0.0"),
+            2 => format!("{escaped}@github.com+u+r@abc{}", self.uniq()),
+            3 => format!("truncated-{}_abcdef", self.uniq()),
+            _ => format!("{escaped}@{version}"),
+        }
+    }
+
+    /// A `.pnpm` virtual store; returns `(name, package dir)` of the
+    /// flat entries' own packages (importer symlink targets).
+    fn pnpm_store(&mut self, store: &Path, depth: usize) -> Vec<(String, PathBuf)> {
+        let _ = std::fs::create_dir_all(store);
+        let _ = std::fs::write(store.join("lock.yaml"), "x");
+        let mut own = Vec::new();
+        let n = 1 + self.below(6);
+        for _ in 0..n {
+            let name = self.pick(NAMES).to_string();
+            let version = self.pick(VERSIONS).to_string();
+            match self.below(100) {
+                0..=59 => {
+                    let entry = store.join(self.store_entry_name(&name, &version));
+                    let entry_nm = entry.join("node_modules");
+                    let pkg_name = if self.chance(90) {
+                        name.clone()
+                    } else {
+                        self.pick(NAMES).to_string()
+                    };
+                    let pkg = entry_nm.join(&name);
+                    self.package_json(&pkg, &pkg_name, &version);
+                    self.pkg_dirs.push(pkg.clone());
+                    own.push((name.clone(), pkg.clone()));
+                    // Dependencies: symlinks to sibling entries.
+                    for _ in 0..self.below(3) {
+                        if let Some((dep, target)) = own.first().cloned() {
+                            Self::symlink(&target, &entry_nm.join(format!("{dep}-dep")));
+                        }
+                    }
+                    // Another real package in the entry (injected dep).
+                    if self.chance(20) {
+                        self.package(&entry_nm, depth + 1);
+                    }
+                    // Bundled deps below the package itself.
+                    if depth < 2 && self.chance(25) {
+                        self.node_modules(&pkg.join("node_modules"), depth + 1, false);
+                    }
+                    match self.below(100) {
+                        0..=3 => self.plan_lock(&entry_nm, 0o000),
+                        4..=6 => self.plan_lock(&entry, 0o000),
+                        7..=9 => self.plan_lock(&entry_nm, 0o300),
+                        _ => {}
+                    }
+                }
+                60..=67 => {
+                    // pnpm 4/5 nested host layout.
+                    let pkg = store
+                        .join("registry.npmjs.org")
+                        .join(&name)
+                        .join(&version)
+                        .join("node_modules")
+                        .join(&name);
+                    self.package_json(&pkg, &name, &version);
+                    self.pkg_dirs.push(pkg);
+                }
+                68..=71 => {
+                    let _ = std::fs::create_dir_all(
+                        store.join(format!("empty{}@1.0.0", self.uniq())),
+                    );
+                }
+                72..=75 => {
+                    let entry = store.join(self.store_entry_name(&name, &version));
+                    let _ = std::fs::create_dir_all(&entry);
+                    let _ = std::fs::write(entry.join("node_modules"), "file");
+                }
+                76..=79 => {
+                    // An entry whose node_modules is a symlink.
+                    if let Some(target) = self.nm_dirs.first().cloned() {
+                        let entry = store.join(self.store_entry_name(&name, &version));
+                        let _ = std::fs::create_dir_all(&entry);
+                        Self::symlink(&target, &entry.join("node_modules"));
+                    }
+                }
+                80..=83 => {
+                    // The entry itself is a symlink (skipped).
+                    if let Some(target) = self.pkg_dirs.first().cloned() {
+                        let link = store.join(format!("{name}@9.9.{}", self.uniq()));
+                        Self::symlink(&target, &link);
+                    }
+                }
+                84..=89 => {
+                    // pnpm's hoist dir: symlinks only.
+                    let hoist = store.join("node_modules");
+                    let _ = std::fs::create_dir_all(&hoist);
+                    if let Some((dep, target)) = own.first().cloned() {
+                        Self::symlink(&target, &hoist.join(dep));
+                    }
+                }
+                _ => {
+                    // Nested host with a scoped coordinate.
+                    let pkg = store
+                        .join("registry.npmjs.org")
+                        .join("@s")
+                        .join("a")
+                        .join(&version)
+                        .join("node_modules")
+                        .join("@s")
+                        .join("a");
+                    self.package_json(&pkg, "@s/a", &version);
+                }
+            }
+        }
+        own
+    }
+
+    /// A pnpm <=3 `.registry.npmjs.org` store.
+    fn legacy_store(&mut self, store: &Path, depth: usize) {
+        for _ in 0..1 + self.below(4) {
+            let name = self.pick(NAMES).to_string();
+            let version = self.pick(VERSIONS).to_string();
+            let home = store.join(&name).join(&version).join("node_modules");
+            self.package_json(&home.join(&name), &name, &version);
+            if depth < 2 && self.chance(20) {
+                self.package(&home, depth + 1);
+            }
+        }
+    }
+
+    fn workspace(&mut self, dir: &Path, depth: usize) {
+        let _ = std::fs::create_dir_all(dir);
+        if self.chance(70) {
+            self.node_modules(&dir.join("node_modules"), 0, true);
+        }
+        if depth >= 3 {
+            return;
+        }
+        for _ in 0..self.below(5) {
+            let child = dir.join(format!("{}{}", self.pick(WS_NAMES), self.uniq()));
+            match self.below(100) {
+                0..=49 => self.workspace(&child, depth + 1),
+                50..=57 => {
+                    // Skipped by name (dist/vendor/.git/tmp as-is).
+                    let skipped = dir.join(self.pick(&["dist", "vendor", ".git", "tmp"]));
+                    self.workspace(&skipped, depth + 1);
+                }
+                58..=63 => {
+                    // A symlinked workspace dir (never walked).
+                    if let Some(target) = self.nm_dirs.first().and_then(|p| p.parent()) {
+                        let target = target.to_path_buf();
+                        Self::symlink(&target, &child);
+                    }
+                }
+                64..=69 => {
+                    // node_modules itself a symlink.
+                    let _ = std::fs::create_dir_all(&child);
+                    if let Some(target) = self.nm_dirs.first().cloned() {
+                        Self::symlink(&target, &child.join("node_modules"));
+                    }
+                }
+                70..=73 => {
+                    let _ = std::fs::create_dir_all(&child);
+                    let _ = std::fs::write(child.join("node_modules"), "file");
+                }
+                74..=79 => {
+                    // Case variant (aliases node_modules on APFS/NTFS).
+                    let _ = std::fs::create_dir_all(&child);
+                    let variant = self.pick(&["Node_Modules", "NODE_MODULES"]);
+                    self.node_modules(&child.join(variant), 1, false);
+                }
+                80..=85 => {
+                    self.workspace(&child, depth + 1);
+                    self.plan_lock(&child, 0o000);
+                }
+                86..=91 => {
+                    // Readable but not searchable: lists fine, stats fail.
+                    self.workspace(&child, depth + 1);
+                    self.plan_lock(&child, 0o600);
+                }
+                _ => {
+                    let _ = std::fs::create_dir_all(&child);
+                    let _ = std::fs::write(child.join("package.json"), "{}");
+                }
+            }
+        }
+    }
+}
+
+/// Every purl worth resolving against a tree: all crawled identities,
+/// qualified / percent-encoded spellings, absent versions, and names
+/// that only exist inside store entries or aliases.
+fn probe_purls(crawled: &[CrawledPackage]) -> Vec<String> {
+    let mut purls: Vec<String> = crawled.iter().map(|p| p.purl.clone()).collect();
+    for name in NAMES {
+        for version in VERSIONS {
+            purls.push(format!("pkg:npm/{name}@{version}"));
+        }
+    }
+    purls.push("pkg:npm/%40s/a@1.0.0".to_string());
+    purls.push("pkg:npm/foo@1.0.0?vcs_url=git@x".to_string());
+    purls.push("pkg:npm/absent@1.0.0".to_string());
+    purls.push("pkg:npm/casedir@1.0.0".to_string());
+    purls.push("pkg:npm/@cs/x@1.0.0".to_string());
+    purls.push("pkg:npm/../evil@1.0.0".to_string());
+    purls.sort();
+    purls.dedup();
+    purls
+}
+
+async fn check(root: &Path) {
+    let base = root.parent().unwrap();
+    let rel = |p: &Path| crate::crawlers::test_tree::rel(base, p);
+    let rel_rows = |pkgs: &[CrawledPackage]| crate::crawlers::test_tree::rel_rows(base, pkgs);
+    let rel_pairs = |v: &[(String, PathBuf)]| -> Vec<(String, String)> {
+        v.iter().map(|(k, p)| (k.clone(), rel(p))).collect()
+    };
+    let input = crate::crawlers::test_tree::tree_listing(base);
+    let mut per_nm = Vec::new();
+    let options = CrawlerOptions {
+        cwd: root.to_path_buf(),
+        global: false,
+        global_prefix: None,
+    };
+    let crawler = NpmCrawler::new();
+
+    let new_paths = crawler.get_node_modules_paths(&options).await.unwrap();
+    let new_pkgs = crawler.crawl_all(&options).await;
+
+    let purls = probe_purls(&new_pkgs);
+    for nm in &new_paths {
+        let new_found = crawler.find_by_purls(nm, &purls).await.unwrap();
+        let store = nm.join(".pnpm");
+        let vlt = nm.join(".vlt");
+        let legacy = nm.join(".registry.npmjs.org");
+        let mut new_nested = Vec::new();
+        NpmCrawler::collect_nested_store_entries(&legacy, &mut new_nested).await;
+        let found: BTreeMap<String, Vec<_>> = new_found
+            .iter()
+            .map(|(k, v)| (k.clone(), rel_rows(v)))
+            .collect();
+        let vlt: Vec<(String, String)> = NpmCrawler::list_vlt_store_entries(&vlt)
+            .await
+            .iter()
+            .map(|(k, p)| (k.to_string_lossy().into_owned(), rel(p)))
+            .collect();
+        per_nm.push((
+            rel(nm),
+            found,
+            rel_pairs(&NpmCrawler::list_pnpm_store_entries(&store).await),
+            vlt,
+            rel_pairs(&new_nested),
+        ));
+    }
+    let paths: Vec<String> = new_paths.iter().map(|p| rel(p)).collect();
+    crate::golden::record(&input, &(paths, rel_rows(&new_pkgs), per_nm));
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn randomized_trees_match_golden() {
+    let sweep = crate::golden::Sweep::start(
+        "crawl_npm_trees",
+        "One seeded project tree: node_modules roots, crawl_all, find_by_purls and store listings.",
+    );
+    let mut nonempty = 0;
+    for seed in 0..64u64 {
+        let tmp = tempfile::tempdir().unwrap();
+        let mut guard = PermGuard(Vec::new());
+        let root = tmp.path().join("proj");
+        let mut gen = Gen::new(seed, tmp.path().join("scratch"));
+        gen.workspace(&root, 0);
+        gen.apply_locks(&mut guard);
+
+        check(&root).await;
+        let options = CrawlerOptions {
+            cwd: root.clone(),
+            global: false,
+            global_prefix: None,
+        };
+        if !NpmCrawler::new().crawl_all(&options).await.is_empty() {
+            nonempty += 1;
+        }
+        drop(guard);
+    }
+    // The generator must actually produce packages most of the time,
+    // or the golden above is vacuous.
+    assert!(nonempty > 32, "only {nonempty} non-empty trees");
+    if crate::crawlers::test_tree::crawl_goldens_apply(true) {
+        sweep.finish();
+    }
+}
+
+/// A store entry whose own child's package.json disagrees with the
+/// entry's name@version, for a root-installed package: the sequential
+/// walk skips that child by name (`identity_seen`) without reading it,
+/// so the foreign identity must never surface.
+#[tokio::test]
+async fn store_entry_child_with_a_foreign_identity_is_skipped() {
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path().join("proj");
+    let nm = root.join("node_modules");
+    let write = |dir: &Path, name: &str, version: &str| {
+        std::fs::create_dir_all(dir).unwrap();
+        std::fs::write(
+            dir.join("package.json"),
+            format!(r#"{{"name": "{name}", "version": "{version}"}}"#),
+        )
+        .unwrap();
+    };
+    write(&nm.join("qux"), "qux", "1.0.0");
+    write(&nm.join("@s").join("q"), "@s/q", "1.0.0");
+    let store = nm.join(".pnpm");
+    let q = store.join("qux@1.0.0").join("node_modules");
+    write(&q.join("qux"), "qux", "9.9.9");
+    // Below the skipped child is still walked.
+    write(
+        &q.join("qux").join("node_modules").join("inner"),
+        "inner",
+        "1.0.0",
+    );
+    // A sibling of the skipped child is not skipped.
+    write(&q.join("sib"), "sib", "1.0.0");
+    write(
+        &store
+            .join("@s+q@1.0.0")
+            .join("node_modules")
+            .join("@s")
+            .join("q"),
+        "@s/q",
+        "9.9.9",
+    );
+    // Not root-installed: its child is read, foreign identity and all.
+    write(
+        &store.join("free@1.0.0").join("node_modules").join("free"),
+        "free",
+        "7.7.7",
+    );
+
+    let sweep = crate::golden::Sweep::start(
+        "crawl_npm_foreign_identity",
+        "A pnpm store entry whose child names a foreign identity.",
+    );
+    check(&root).await;
+    if crate::crawlers::test_tree::crawl_goldens_apply(false) {
+        sweep.finish();
+    }
+
+    let options = CrawlerOptions {
+        cwd: root.clone(),
+        global: false,
+        global_prefix: None,
+    };
+    let purls: Vec<String> = NpmCrawler::new()
+        .crawl_all(&options)
+        .await
+        .into_iter()
+        .map(|p| p.purl)
+        .collect();
+    for present in [
+        "pkg:npm/qux@1.0.0",
+        "pkg:npm/@s/q@1.0.0",
+        "pkg:npm/inner@1.0.0",
+        "pkg:npm/sib@1.0.0",
+        "pkg:npm/free@7.7.7",
+    ] {
+        assert!(
+            purls.iter().any(|p| p == present),
+            "missing {present}: {purls:?}"
+        );
+    }
+    for absent in ["pkg:npm/qux@9.9.9", "pkg:npm/@s/q@9.9.9"] {
+        assert!(
+            !purls.iter().any(|p| p == absent),
+            "{absent} must be skipped: {purls:?}"
+        );
+    }
+}
+
+/// With no walk pool (the OS refused every walk thread) the walk runs
+/// sequentially on the calling thread and still matches the golden.
+#[tokio::test]
+async fn walk_without_a_pool_matches_golden() {
+    let _off = crate::crawlers::walk_pool::test_hooks::DisablePool::new();
+    let sweep = crate::golden::Sweep::start(
+        "crawl_npm_no_pool",
+        "One seeded project tree, walked with no walk pool.",
+    );
+    for seed in 0..16u64 {
+        let tmp = tempfile::tempdir().unwrap();
+        let mut guard = PermGuard(Vec::new());
+        let root = tmp.path().join("proj");
+        let mut gen = Gen::new(seed, tmp.path().join("scratch"));
+        gen.workspace(&root, 0);
+        gen.apply_locks(&mut guard);
+        check(&root).await;
+        drop(guard);
+    }
+    if crate::crawlers::test_tree::crawl_goldens_apply(true) {
+        sweep.finish();
+    }
+}
+
+/// Hand-built tree with one of every tricky shape (so each is covered
+/// regardless of what the random generator happens to draw), pinned by
+/// golden, with a few load-bearing outcomes asserted outright.
+#[tokio::test]
+async fn kitchen_sink_tree_matches_golden() {
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path().join("proj");
+    let nm = root.join("node_modules");
+    let write = |dir: &Path, name: &str, version: &str| {
+        std::fs::create_dir_all(dir).unwrap();
+        std::fs::write(
+            dir.join("package.json"),
+            format!(r#"{{"name": "{name}", "version": "{version}"}}"#),
+        )
+        .unwrap();
+    };
+    // Importer tree: plain, scoped, nested duplicate, alias.
+    write(&nm.join("foo"), "foo", "1.0.0");
+    write(&nm.join("@s").join("a"), "@s/a", "1.0.0");
+    write(
+        &nm.join("bar").join("node_modules").join("foo"),
+        "foo",
+        "1.0.0",
+    );
+    write(&nm.join("bar"), "bar", "1.0.0");
+    write(&nm.join("alias"), "baz", "2.0.0");
+    // Flat store: a root-linked dep's own entry (identity_seen skip) with
+    // a bundled dep, a transitive-only entry, peer variants.
+    let store = nm.join(".pnpm");
+    let q = store.join("qux@1.0.0").join("node_modules");
+    write(&q.join("qux"), "qux", "1.0.0");
+    write(
+        &q.join("qux").join("node_modules").join("bundled"),
+        "bundled",
+        "3.0.0",
+    );
+    write(
+        &store.join("t@1.0.0").join("node_modules").join("t"),
+        "t",
+        "1.0.0",
+    );
+    write(
+        &store
+            .join("p@1.0.0(r@17.0.0)")
+            .join("node_modules")
+            .join("p"),
+        "p",
+        "1.0.0",
+    );
+    write(
+        &store
+            .join("p@1.0.0(r@18.0.0)")
+            .join("node_modules")
+            .join("p"),
+        "p",
+        "1.0.0",
+    );
+    write(
+        &store
+            .join("@s+b@1.0.0")
+            .join("node_modules")
+            .join("@s")
+            .join("b"),
+        "@s/b",
+        "1.0.0",
+    );
+    // Nested (pnpm 4/5) host and legacy (pnpm <=3) store.
+    write(
+        &store
+            .join("registry.npmjs.org")
+            .join("n")
+            .join("1.0.0")
+            .join("node_modules")
+            .join("n"),
+        "n",
+        "1.0.0",
+    );
+    write(
+        &nm.join(".registry.npmjs.org")
+            .join("l")
+            .join("1.0.0")
+            .join("node_modules")
+            .join("l"),
+        "l",
+        "1.0.0",
+    );
+    // A dir whose spelling differs from its package's name only by case
+    // (resolves under the lowercase name on case-insensitive volumes),
+    // and a scope spelled likewise.
+    write(&nm.join("CaseDir"), "casedir", "1.0.0");
+    write(&nm.join("@Cs").join("x"), "@cs/x", "1.0.0");
+    // Broken / BOM'd package.json.
+    std::fs::create_dir_all(nm.join("broken")).unwrap();
+    std::fs::write(nm.join("broken").join("package.json"), "{").unwrap();
+    std::fs::create_dir_all(nm.join("bom")).unwrap();
+    std::fs::write(
+        nm.join("bom").join("package.json"),
+        "\u{feff}{\"name\":\"bom\",\"version\":\"1.0.0\"}",
+    )
+    .unwrap();
+    // Workspaces: plain, skipped, case variant, node_modules-as-file.
+    write(
+        &root
+            .join("packages")
+            .join("w")
+            .join("node_modules")
+            .join("w"),
+        "w",
+        "1.0.0",
+    );
+    write(
+        &root.join("dist").join("node_modules").join("d"),
+        "d",
+        "1.0.0",
+    );
+    write(
+        &root.join("cv").join("Node_Modules").join("cv"),
+        "cv",
+        "1.0.0",
+    );
+    std::fs::create_dir_all(root.join("nf")).unwrap();
+    std::fs::write(root.join("nf").join("node_modules"), "file").unwrap();
+
+    let tmp_guard;
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::{symlink, PermissionsExt as _};
+        // Root-linked direct dep into the store, a dangling link.
+        symlink(q.join("qux"), nm.join("qux")).unwrap();
+        symlink(root.join("nowhere"), nm.join("dangling")).unwrap();
+        // FIFO package.json.
+        std::fs::create_dir_all(nm.join("fifo")).unwrap();
+        let c = std::ffi::CString::new(nm.join("fifo").join("package.json").to_str().unwrap())
+            .unwrap();
+        // SAFETY: plain libc call on a valid C string.
+        assert_eq!(unsafe { libc::mkfifo(c.as_ptr(), 0o644) }, 0);
+        // A workspace whose node_modules is a symlink.
+        std::fs::create_dir_all(root.join("ln")).unwrap();
+        symlink(
+            root.join("packages").join("w").join("node_modules"),
+            root.join("ln").join("node_modules"),
+        )
+        .unwrap();
+        // Unreadable store entry node_modules; unsearchable workspace.
+        let locked_nm = store.join("z@1.0.0").join("node_modules");
+        write(&locked_nm.join("z"), "z", "1.0.0");
+        write(
+            &root.join("rw").join("node_modules").join("r"),
+            "r",
+            "1.0.0",
+        );
+        std::fs::set_permissions(&locked_nm, std::fs::Permissions::from_mode(0o000)).unwrap();
+        std::fs::set_permissions(root.join("rw"), std::fs::Permissions::from_mode(0o600))
+            .unwrap();
+        tmp_guard = PermGuard(vec![locked_nm, root.join("rw")]);
+    }
+    #[cfg(not(unix))]
+    {
+        tmp_guard = PermGuard(Vec::new());
+    }
+
+    let sweep = crate::golden::Sweep::start(
+        "crawl_npm_kitchen_sink",
+        "A hand-built project tree with one of every tricky shape.",
+    );
+    check(&root).await;
+    if crate::crawlers::test_tree::crawl_goldens_apply(true) {
+        sweep.finish();
+    }
+
+    let options = CrawlerOptions {
+        cwd: root.clone(),
+        global: false,
+        global_prefix: None,
+    };
+    let purls: Vec<String> = NpmCrawler::new()
+        .crawl_all(&options)
+        .await
+        .into_iter()
+        .map(|p| p.purl)
+        .collect();
+    for expected in [
+        "pkg:npm/foo@1.0.0",
+        "pkg:npm/@s/a@1.0.0",
+        "pkg:npm/bundled@3.0.0",
+        "pkg:npm/t@1.0.0",
+        "pkg:npm/p@1.0.0",
+        "pkg:npm/@s/b@1.0.0",
+        "pkg:npm/n@1.0.0",
+        "pkg:npm/l@1.0.0",
+        "pkg:npm/bom@1.0.0",
+        "pkg:npm/w@1.0.0",
+    ] {
+        assert!(
+            purls.iter().any(|p| p == expected),
+            "missing {expected}: {purls:?}"
+        );
+    }
+    assert!(
+        !purls.iter().any(|p| p == "pkg:npm/d@1.0.0"),
+        "dist/ must be skipped"
+    );
+    drop(tmp_guard);
+}
diff --git a/crates/socket-patch-core/src/crawlers/nuget_crawler.rs b/crates/socket-patch-core/src/crawlers/nuget_crawler.rs
index 7293a9c9e..5f0c4040d 100644
--- a/crates/socket-patch-core/src/crawlers/nuget_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/nuget_crawler.rs
@@ -6,9 +6,6 @@ use super::types::{CrawledPackage, CrawlerOptions};
 use crate::patch::path_safety;
 use crate::utils::fs::{is_dir, is_dir_sync, run_blocking};
 
-#[cfg(test)]
-mod oracle;
-
 /// NuGet/.NET ecosystem crawler for discovering packages in global cache,
 /// legacy `packages/` folders, and `obj/` restore layouts.
 pub struct NuGetCrawler;
@@ -1289,14 +1286,13 @@ mod tests {
         );
     }
 
-    // ── Equivalence with the per-call async scan (oracle) ─────────────
+    // ── Seeded package roots, pinned by golden ───────────────────────
 
-    mod equivalence {
-        use super::super::oracle::LegacyNuGetCrawler;
+    mod sweep {
         use super::*;
         use crate::crawlers::test_tree::{
-            crawl_goldens_apply, map_rows, mkdir, rel_map_rows, rel_rows, rows, symlink,
-            tree_listing, write, PermGuard,
+            crawl_goldens_apply, mkdir, rel_map_rows, rel_rows, symlink, tree_listing, write,
+            PermGuard,
         };
         use crate::golden::Golden;
         use crate::test_rng::Rng;
@@ -1398,13 +1394,13 @@ mod tests {
         /// The case-insensitive legacy fallback — the only reader of the
         /// package root's memoized listing — over several PURLs in one
         /// call: the listing is built on the first PURL that needs it and
-        /// reused by the rest, matching the per-PURL oracle either way.
+        /// reused by the rest, answering as a per-PURL lookup would.
         ///
         /// The fallback can only MATCH on a case-sensitive filesystem:
         /// where `Foo.1.0` and `foo.1.0` are one directory, the exact-case
         /// probe above it already resolves every case variant, so nothing
-        /// reaches the fallback with a name to find (the randomized oracle
-        /// test has the same blind spot locally — it distinguishes the two
+        /// reaches the fallback with a name to find (the randomized sweep
+        /// has the same blind spot locally — it distinguishes the two
         /// layouts by case alone). The on-disk spelling below is therefore
         /// asserted only where the filesystem can tell them apart, and CI
         /// is where that happens.
@@ -1434,8 +1430,6 @@ mod tests {
                 .find_by_purls(&root, &purls)
                 .await
                 .unwrap();
-            let old = LegacyNuGetCrawler::find_by_purls(&root, &purls).await;
-            assert_eq!(map_rows(&new), map_rows(&old));
             assert_eq!(new.len(), 2, "{new:?}");
             let mut g = Golden::new(
                 "crawl_nuget_legacy_fallback",
@@ -1490,7 +1484,7 @@ mod tests {
         }
 
         #[tokio::test]
-        async fn randomized_package_dirs_match_the_async_oracle() {
+        async fn randomized_package_dirs_match_golden() {
             let (mut crawled, mut found) = (0, 0);
             let mut g = Golden::new(
                 "crawl_nuget_packages",
@@ -1510,20 +1504,11 @@ mod tests {
                     global_prefix: Some(root.clone()),
                 };
                 let new = NuGetCrawler::new().crawl_all(&options).await;
-                let old = LegacyNuGetCrawler::crawl_all(&options).await;
-                assert_eq!(rows(&new), rows(&old), "seed {seed}: crawl_all");
-
-                let purls = probe_purls(&mut rng, &old);
+                let purls = probe_purls(&mut rng, &new);
                 let new_found = NuGetCrawler::new()
                     .find_by_purls(&root, &purls)
                     .await
                     .unwrap();
-                let old_found = LegacyNuGetCrawler::find_by_purls(&root, &purls).await;
-                assert_eq!(
-                    map_rows(&new_found),
-                    map_rows(&old_found),
-                    "seed {seed}: find_by_purls"
-                );
                 g.case(
                     seed,
                     &(input, &purls),
@@ -1532,8 +1517,8 @@ mod tests {
                         rel_map_rows(tmp.path(), &new_found),
                     ),
                 );
-                crawled += old.len();
-                found += old_found.len();
+                crawled += new.len();
+                found += new_found.len();
             }
             assert!(
                 crawled > 100 && found > 100,
diff --git a/crates/socket-patch-core/src/crawlers/nuget_crawler/oracle.rs b/crates/socket-patch-core/src/crawlers/nuget_crawler/oracle.rs
deleted file mode 100644
index 7c9602e31..000000000
--- a/crates/socket-patch-core/src/crawlers/nuget_crawler/oracle.rs
+++ /dev/null
@@ -1,207 +0,0 @@
-//! The pre-blocking-pool (one tokio hop per readdir/stat) NuGet package
-//! scan and PURL lookup, kept verbatim as the equivalence oracle for the
-//! synchronous walkers in the parent module. Test-only; never compiled into
-//! the binary.
-
-use std::collections::{HashMap, HashSet};
-use std::path::{Path, PathBuf};
-
-use super::{is_safe_nuget_coordinate, parse_legacy_dir_name, NuGetCrawler};
-use crate::crawlers::types::{CrawledPackage, CrawlerOptions};
-use crate::utils::fs::is_dir;
-
-pub(super) struct LegacyNuGetCrawler;
-
-impl LegacyNuGetCrawler {
-    pub(super) async fn crawl_all(options: &CrawlerOptions) -> Vec<CrawledPackage> {
-        let mut packages = Vec::new();
-        let mut seen = HashSet::new();
-
-        let pkg_paths = NuGetCrawler::new()
-            .get_nuget_package_paths(options)
-            .await
-            .unwrap_or_default();
-
-        for pkg_path in &pkg_paths {
-            let found = Self::scan_package_dir(pkg_path, &mut seen).await;
-            packages.extend(found);
-        }
-
-        packages
-    }
-
-    pub(super) async fn find_by_purls(
-        pkg_path: &Path,
-        purls: &[String],
-    ) -> HashMap<String, CrawledPackage> {
-        let mut result: HashMap<String, CrawledPackage> = HashMap::new();
-
-        for purl in purls {
-            let Some((name, version)) = crate::utils::purl::parse_nuget_purl(purl) else {
-                continue;
-            };
-            let (name, version) = (name.as_ref(), version.as_ref());
-            if !is_safe_nuget_coordinate(name, version) {
-                continue;
-            }
-
-            let global_dir = pkg_path
-                .join(name.to_lowercase())
-                .join(version.to_lowercase());
-            let legacy_dir = pkg_path.join(format!("{name}.{version}"));
-
-            let found = if Self::verify_nuget_package(&global_dir).await {
-                Some(global_dir)
-            } else if Self::verify_nuget_package(&legacy_dir).await {
-                Some(legacy_dir)
-            } else {
-                Self::find_legacy_dir_case_insensitive(pkg_path, name, version).await
-            };
-
-            if let Some(path) = found {
-                result.insert(
-                    purl.clone(),
-                    CrawledPackage {
-                        name: name.to_string(),
-                        version: version.to_string(),
-                        namespace: None,
-                        purl: purl.clone(),
-                        path,
-                    },
-                );
-            }
-        }
-
-        result
-    }
-
-    async fn scan_package_dir(pkg_path: &Path, seen: &mut HashSet<String>) -> Vec<CrawledPackage> {
-        let mut results = Vec::new();
-
-        for entry in crate::utils::fs::list_dir_entries(pkg_path).await {
-            if !crate::utils::fs::entry_is_dir(&entry).await {
-                continue;
-            }
-
-            let dir_name = entry.file_name();
-            let dir_name_str = dir_name.to_string_lossy();
-
-            if dir_name_str.starts_with('.') {
-                continue;
-            }
-
-            let entry_path = pkg_path.join(&*dir_name_str);
-
-            if let Some(pkgs) =
-                Self::scan_global_cache_package(&entry_path, &dir_name_str, seen).await
-            {
-                results.extend(pkgs);
-                continue;
-            }
-
-            if let Some((name, version)) = parse_legacy_dir_name(&dir_name_str) {
-                if Self::verify_nuget_package(&entry_path).await {
-                    let purl = crate::utils::purl::build_nuget_purl(&name, &version);
-                    if !seen.contains(&purl) {
-                        seen.insert(purl.clone());
-                        results.push(CrawledPackage {
-                            name,
-                            version,
-                            namespace: None,
-                            purl,
-                            path: entry_path,
-                        });
-                    }
-                }
-            }
-        }
-
-        results
-    }
-
-    async fn scan_global_cache_package(
-        name_dir: &Path,
-        name: &str,
-        seen: &mut HashSet<String>,
-    ) -> Option<Vec<CrawledPackage>> {
-        let mut found_any = false;
-        let mut results = Vec::new();
-
-        for ver_entry in crate::utils::fs::list_dir_entries(name_dir).await {
-            if !crate::utils::fs::entry_is_dir(&ver_entry).await {
-                continue;
-            }
-
-            let ver_name = ver_entry.file_name();
-            let ver_str = ver_name.to_string_lossy();
-
-            if !ver_str.starts_with(|c: char| c.is_ascii_digit()) {
-                continue;
-            }
-
-            let ver_path = name_dir.join(&*ver_str);
-
-            if Self::verify_nuget_package(&ver_path).await {
-                found_any = true;
-                let purl = crate::utils::purl::build_nuget_purl(name, &ver_str);
-                if !seen.contains(&purl) {
-                    seen.insert(purl.clone());
-                    results.push(CrawledPackage {
-                        name: name.to_string(),
-                        version: ver_str.to_string(),
-                        namespace: None,
-                        purl,
-                        path: ver_path,
-                    });
-                }
-            }
-        }
-
-        if found_any {
-            Some(results)
-        } else {
-            None
-        }
-    }
-
-    async fn verify_nuget_package(path: &Path) -> bool {
-        if !is_dir(path).await {
-            return false;
-        }
-
-        if is_dir(&path.join("lib")).await {
-            return true;
-        }
-
-        for entry in crate::utils::fs::list_dir_entries(path).await {
-            if let Some(name) = entry.file_name().to_str() {
-                if name.ends_with(".nuspec") {
-                    return true;
-                }
-            }
-        }
-
-        false
-    }
-
-    async fn find_legacy_dir_case_insensitive(
-        pkg_path: &Path,
-        name: &str,
-        version: &str,
-    ) -> Option<PathBuf> {
-        let target = format!("{}.{}", name.to_lowercase(), version.to_lowercase());
-
-        for entry in crate::utils::fs::list_dir_entries(pkg_path).await {
-            let dir_name = entry.file_name();
-            let dir_name_str = dir_name.to_string_lossy();
-            if dir_name_str.to_lowercase() == target {
-                let path = pkg_path.join(&*dir_name_str);
-                if Self::verify_nuget_package(&path).await {
-                    return Some(path);
-                }
-            }
-        }
-
-        None
-    }
-}
diff --git a/crates/socket-patch-core/src/crawlers/python_crawler.rs b/crates/socket-patch-core/src/crawlers/python_crawler.rs
index e0406026c..a475a1603 100644
--- a/crates/socket-patch-core/src/crawlers/python_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/python_crawler.rs
@@ -8,9 +8,6 @@ use crate::utils::fs::{
 };
 use crate::utils::process::{CommandRunner, SystemCommandRunner};
 
-#[cfg(test)]
-mod oracle;
-
 // ---------------------------------------------------------------------------
 // Python command discovery
 // ---------------------------------------------------------------------------
@@ -2732,14 +2729,13 @@ mod tests {
         assert!(!result.contains_key("pkg:pypi/flask@3.0.0"));
     }
 
-    // ── Equivalence with the per-call async scan (oracle) ─────────────
+    // ── Seeded site-packages, pinned by golden ───────────────────────
 
-    mod equivalence {
-        use super::super::oracle::{self, LegacyPythonCrawler};
+    mod sweep {
         use super::*;
         use crate::crawlers::test_tree::{
-            crawl_goldens_apply, fifo, map_rows, mkdir, rel_map_rows, rel_rows, rows, symlink,
-            tree_listing, write, write_bytes, PermGuard,
+            crawl_goldens_apply, fifo, mkdir, rel_map_rows, rel_rows, rows, symlink, tree_listing,
+            write, write_bytes, PermGuard,
         };
         use crate::golden::Golden;
         use crate::test_rng::Rng;
@@ -2786,7 +2782,7 @@ mod tests {
         }
 
         #[tokio::test]
-        async fn randomized_site_packages_match_the_async_oracle() {
+        async fn randomized_site_packages_match_golden() {
             let (mut crawled, mut found) = (0, 0);
             let mut g = Golden::new(
                 "crawl_python_site_packages",
@@ -2802,21 +2798,14 @@ mod tests {
                 perms.apply();
 
                 let listing = list_dist_info_packages(&root).await;
-                assert_eq!(
-                    listing,
-                    oracle::list_dist_info_packages(&root).await,
-                    "seed {seed}: listing"
-                );
                 let options = CrawlerOptions {
                     cwd: tmp.path().to_path_buf(),
                     global: false,
                     global_prefix: Some(root.clone()),
                 };
                 let new = PythonCrawler::new().crawl_all(&options).await;
-                let old = LegacyPythonCrawler::crawl_all(&options).await;
-                assert_eq!(rows(&new), rows(&old), "seed {seed}: crawl_all");
 
-                let mut purls: Vec<String> = old.iter().map(|p| p.purl.clone()).collect();
+                let mut purls: Vec<String> = new.iter().map(|p| p.purl.clone()).collect();
                 purls.push("pkg:pypi/Flask-Cors@1.0".to_string());
                 purls.push("pkg:pypi/requests@1.0%2Blocal".to_string());
                 purls.push("pkg:pypi/DUP@1.0".to_string());
@@ -2826,13 +2815,14 @@ mod tests {
                     .find_by_purls(&root, &purls)
                     .await
                     .unwrap();
-                let found_old = LegacyPythonCrawler::find_by_purls(&root, &purls).await;
-                assert_eq!(map_rows(&found_new), map_rows(&found_old));
-                // Each PURL on its own, from one listing.
+                // Each PURL on its own, from one listing, answers as a
+                // one-PURL lookup would.
                 let each = PythonCrawler::new().find_each_by_purl(&root, &purls).await;
                 for (purl, got) in purls.iter().zip(&each) {
-                    let single =
-                        LegacyPythonCrawler::find_by_purls(&root, std::slice::from_ref(purl)).await;
+                    let single = PythonCrawler::new()
+                        .find_by_purls(&root, std::slice::from_ref(purl))
+                        .await
+                        .unwrap();
                     assert_eq!(
                         got.as_ref().map(|p| rows(std::slice::from_ref(p))),
                         single.get(purl).map(|p| rows(std::slice::from_ref(p))),
@@ -2856,7 +2846,7 @@ mod tests {
                         each_rows,
                     ),
                 );
-                crawled += old.len();
+                crawled += new.len();
                 found += found_new.len();
             }
             assert!(
diff --git a/crates/socket-patch-core/src/crawlers/python_crawler/oracle.rs b/crates/socket-patch-core/src/crawlers/python_crawler/oracle.rs
deleted file mode 100644
index 4aab29ea4..000000000
--- a/crates/socket-patch-core/src/crawlers/python_crawler/oracle.rs
+++ /dev/null
@@ -1,96 +0,0 @@
-//! The pre-blocking-pool (one tokio hop per readdir/stat/read)
-//! `site-packages` scan, kept verbatim as the equivalence oracle for the
-//! parallel scan in the parent module. Test-only; never compiled into the
-//! binary.
-
-use std::collections::{HashMap, HashSet};
-use std::path::Path;
-
-use super::{canonicalize_pypi_name, read_python_metadata, PythonCrawler};
-use crate::crawlers::types::{CrawledPackage, CrawlerOptions};
-
-pub(super) struct LegacyPythonCrawler;
-
-impl LegacyPythonCrawler {
-    pub(super) async fn crawl_all(options: &CrawlerOptions) -> Vec<CrawledPackage> {
-        let mut packages = Vec::new();
-        let mut seen = HashSet::new();
-
-        let sp_paths = PythonCrawler::new()
-            .get_site_packages_paths(options)
-            .await
-            .unwrap_or_default();
-
-        for sp_path in &sp_paths {
-            for (name, version) in list_dist_info_packages(sp_path).await {
-                let purl = format!("pkg:pypi/{name}@{version}");
-                if !seen.insert(purl.clone()) {
-                    continue;
-                }
-                packages.push(CrawledPackage {
-                    name,
-                    version,
-                    namespace: None,
-                    purl,
-                    path: sp_path.clone(),
-                });
-            }
-        }
-
-        packages
-    }
-
-    pub(super) async fn find_by_purls(
-        site_packages_path: &Path,
-        purls: &[String],
-    ) -> HashMap<String, CrawledPackage> {
-        let mut result = HashMap::new();
-
-        let mut purl_lookup: HashMap<String, &str> = HashMap::new();
-        for purl in purls {
-            if let Some((name, version)) = crate::utils::purl::parse_pypi_purl(purl) {
-                let key = format!("{}@{}", canonicalize_pypi_name(&name), version);
-                purl_lookup.insert(key, purl.as_str());
-            }
-        }
-
-        if purl_lookup.is_empty() {
-            return result;
-        }
-
-        for (name, version) in list_dist_info_packages(site_packages_path).await {
-            let key = format!("{name}@{version}");
-            if let Some(&matched_purl) = purl_lookup.get(&key) {
-                result.insert(
-                    matched_purl.to_string(),
-                    CrawledPackage {
-                        name,
-                        version,
-                        namespace: None,
-                        purl: matched_purl.to_string(),
-                        path: site_packages_path.to_path_buf(),
-                    },
-                );
-            }
-        }
-
-        result
-    }
-}
-
-/// The old per-entry async `list_dist_info_packages`.
-pub(super) async fn list_dist_info_packages(site_packages_path: &Path) -> Vec<(String, String)> {
-    let mut out = Vec::new();
-    for entry in crate::utils::fs::list_dir_entries(site_packages_path).await {
-        let name = entry.file_name();
-        let name_str = name.to_string_lossy();
-        if !name_str.ends_with(".dist-info") {
-            continue;
-        }
-        let dist_info_path = site_packages_path.join(&*name_str);
-        if let Some((raw_name, version)) = read_python_metadata(&dist_info_path).await {
-            out.push((canonicalize_pypi_name(&raw_name), version));
-        }
-    }
-    out
-}
diff --git a/crates/socket-patch-core/src/crawlers/test_tree.rs b/crates/socket-patch-core/src/crawlers/test_tree.rs
index 424a1dc24..e9b38ac1e 100644
--- a/crates/socket-patch-core/src/crawlers/test_tree.rs
+++ b/crates/socket-patch-core/src/crawlers/test_tree.rs
@@ -124,26 +124,6 @@ pub(crate) fn rows(pkgs: &[CrawledPackage]) -> Vec<Row> {
         .collect()
 }
 
-/// A `find_by_purls` map as sorted comparable rows.
-pub(crate) fn map_rows(
-    map: &std::collections::HashMap<String, CrawledPackage>,
-) -> std::collections::BTreeMap<String, Row> {
-    map.iter()
-        .map(|(k, p)| {
-            (
-                k.clone(),
-                (
-                    p.name.clone(),
-                    p.version.clone(),
-                    p.namespace.clone(),
-                    p.purl.clone(),
-                    p.path.clone(),
-                ),
-            )
-        })
-        .collect()
-}
-
 /// A crawled package as a row with its path relative to `base` (the sweep's
 /// tempdir), so the row is the same on every run.
 pub(crate) type RelRow = (String, String, Option<String>, String, String);
diff --git a/crates/socket-patch-core/src/patch/redirect/cargo_lock_equivalence_tests.rs b/crates/socket-patch-core/src/patch/redirect/cargo_lock_equivalence_tests.rs
index 6a207193d..082849761 100644
--- a/crates/socket-patch-core/src/patch/redirect/cargo_lock_equivalence_tests.rs
+++ b/crates/socket-patch-core/src/patch/redirect/cargo_lock_equivalence_tests.rs
@@ -1,295 +1,15 @@
-//! Equivalence oracle for the Cargo.lock hosted splice, which now edits the
-//! byte spans of the lock's one parse ([`CargoLock::parse`] →
-//! [`CargoLock::plan_hosted`]) instead of searching the text for cargo's
-//! canonical `[[package]]\nname = …\nversion = …\n` header. The previous
-//! line-grammar planner is kept below, test-only, as the oracle: over every
-//! canonical lock shape (v1 `[metadata]` + full-id references, v3/v4 inline
-//! checksums, multi-source twins, `[root]`, trailers, a missing final
-//! newline) both must produce identical bytes and identical `FileEdit`s,
-//! for every package of every lock and a re-run over the result. (Locks the
-//! old grammar could not read — a comment or reordered key inside a block —
-//! are where the two differ by design: the span planner finds them.)
-
-use std::sync::LazyLock;
-
-use regex::Regex;
-use serde_json::Value;
-
-use crate::formats::cargo::hosted::{CargoLockPlan, CARGO_LOCK_REFERENCE_KIND};
+//! Seeded and hand-written Cargo.lock sweeps for the hosted splice, which
+//! edits the byte spans of the lock's one parse ([`CargoLock::parse`] →
+//! [`CargoLock::plan_hosted`]). Every plan is pinned per case by
+//! `tests/equivalence/cargo_lock_*.golden`, blessed while the previous
+//! line-grammar planner still ran beside it as an oracle (identical bytes
+//! and edits wherever that grammar could read the lock).
+
+use crate::formats::cargo::hosted::CargoLockPlan;
 use crate::formats::cargo::CargoLock;
 use crate::golden::Golden;
 use crate::patch::redirect::FileEdit;
-
-// ── the oracle: the previous line-grammar planner, verbatim ──
-
-/// The line-anchored header cargo writes for `name`@`version`.
-fn package_head(name: &str, version: &str) -> String {
-    format!("[[package]]\nname = \"{name}\"\nversion = \"{version}\"\n")
-}
-
-/// Every offset of `needle` in `content` that starts a line.
-fn line_anchored<'c>(content: &'c str, needle: &'c str) -> impl Iterator<Item = usize> + 'c {
-    content
-        .match_indices(needle)
-        .map(|(at, _)| at)
-        .filter(|&at| at == 0 || content.as_bytes()[at - 1] == b'\n')
-}
-
-static CARGO_LOCK_SOURCE_LINE_RE: LazyLock<Regex> = LazyLock::new(|| {
-    Regex::new(r#"(?m)^source = "([^"]*)"$"#).expect("static lock source-line regex is valid")
-});
-static CARGO_LOCK_CHECKSUM_LINE_RE: LazyLock<Regex> = LazyLock::new(|| {
-    Regex::new(r#"(?m)^checksum = "[^"]*"$"#).expect("static lock checksum-line regex is valid")
-});
-// `$` (not `\n`) so it also anchors a source line that ENDS the block: the
-// trailing newline sits outside the block region.
-static CARGO_LOCK_AFTER_SOURCE_RE: LazyLock<Regex> = LazyLock::new(|| {
-    Regex::new(r#"(?m)^(source = "[^"]*")$"#).expect("static source-line anchor regex is valid")
-});
-
-/// Repoint the crate's `[[package]]` at the hosted index with the patched
-/// `.crate`'s checksum, in whichever Cargo.lock format the file is:
-///
-/// * v2–v4: `source` + an inline `checksum` in the entry;
-/// * v1 (cargo < 1.41, still read by every cargo): the entry carries only
-///   `source`; the checksum lives in the trailing `[metadata]` table under
-///   `"checksum <name> <version> (<source>)"`, and every dependent names the
-///   crate by its FULL package id `"<name> <version> (<source>)"`. Both are
-///   keyed by the source, so both must follow it — a v1 lock with only the
-///   entry repointed names a package that no longer exists (cargo discards
-///   the lock and re-resolves; `--locked` fails) and pins nothing.
-///
-/// Full-id references are rewritten in any format (v2+ spells them that way
-/// when a name + version is ambiguous). Each changed fragment is its own
-/// `redirect_cargo_lock_entry` edit (unique text, so the fragment revert is
-/// unambiguous) — the entry and the `[metadata]` line — and the dependents'
-/// references are one `redirect_cargo_lock_reference` edit holding the
-/// quoted full id, reverted at every occurrence.
-fn plan_cargo_lock(
-    content: &str,
-    crate_name: &str,
-    version: &str,
-    index_url: &str,
-    cksum: &str,
-) -> CargoLockPlan {
-    // Rust's regex has NO lookahead, so bound the [[package]] block by string
-    // search (see [`lock_block_end`]): from its header to the next block or
-    // trailing table (or EOF), so the bytes after the block (incl. the final
-    // newline) are preserved.
-    let head = package_head(crate_name, version);
-    // Every line-anchored header for this name@version. A Cargo.lock may
-    // legitimately hold TWO blocks for one name@version from different
-    // sources — after a redirect, a transitive crates.io copy resolves beside
-    // the socket-registry copy, and cargo sorts the crates.io block FIRST —
-    // so the first hit alone would repoint the wrong twin.
-    let heads: Vec<usize> = line_anchored(content, &head).collect();
-    let block_start = match heads.as_slice() {
-        [] => return CargoLockPlan::NotFound,
-        [only] => *only,
-        twins => {
-            // Exactly one twin already at the target index is OURS (a re-run
-            // over a redirected lock); anything else cannot be attributed and
-            // the dep is skipped transactionally.
-            let target_source = format!("source = \"{index_url}\"");
-            let mut ours = twins.iter().copied().filter(|&at| {
-                let body_start = at + head.len();
-                content[body_start..lock_block_end(content, body_start)]
-                    .lines()
-                    .any(|line| line == target_source)
-            });
-            match (ours.next(), ours.next()) {
-                (Some(at), None) => at,
-                _ => return CargoLockPlan::Ambiguous,
-            }
-        }
-    };
-    let body_start = block_start + head.len();
-    let block_end = lock_block_end(content, body_start);
-    let original = content[block_start..block_end].to_string();
-    let mut body = content[body_start..block_end].to_string();
-    let old_source = CARGO_LOCK_SOURCE_LINE_RE
-        .captures(&body)
-        .map(|c| c[1].to_string());
-    if old_source.is_some() {
-        body = CARGO_LOCK_SOURCE_LINE_RE
-            .replace(&body, format!("source = \"{index_url}\"").as_str())
-            .to_string();
-    } else {
-        body = format!("source = \"{index_url}\"\n{body}");
-    }
-    // A v1 lock keeps the checksum in `[metadata]`, keyed by the package id
-    // — the chosen block's OWN source when it has one, so a multi-source
-    // twin's line is never taken for ours.
-    let metadata_source = old_source
-        .as_deref()
-        .map_or_else(|| r#"[^)"]*"#.to_string(), regex::escape);
-    let metadata_re = Regex::new(&format!(
-        r#"(?m)^"checksum {} {} \({metadata_source}\)" = "[^"]*"$"#,
-        regex::escape(crate_name),
-        regex::escape(version)
-    ))
-    .expect("escaped lock metadata-line regex is valid");
-    let metadata_line = metadata_re.find(content).map(|m| m.as_str().to_string());
-    if metadata_line.is_none() {
-        if CARGO_LOCK_CHECKSUM_LINE_RE.is_match(&body) {
-            body = CARGO_LOCK_CHECKSUM_LINE_RE
-                .replace(&body, format!("checksum = \"{cksum}\"").as_str())
-                .to_string();
-        } else {
-            body = CARGO_LOCK_AFTER_SOURCE_RE
-                .replace(&body, format!("${{1}}\nchecksum = \"{cksum}\"").as_str())
-                .to_string();
-        }
-    }
-    let rebuilt = format!("{head}{body}");
-    let key = format!("{crate_name}@{version}");
-    let edit = |original: &str, new: &str| FileEdit {
-        path: "Cargo.lock".into(),
-        kind: "redirect_cargo_lock_entry".into(),
-        action: "rewritten".into(),
-        key: Some(key.clone()),
-        original: Some(Value::String(original.to_string())),
-        new: Some(Value::String(new.to_string())),
-    };
-    let mut edits = Vec::new();
-    let mut new_content = content.to_string();
-    if rebuilt != original {
-        new_content.replace_range(block_start..block_end, &rebuilt);
-        edits.push(edit(&original, &rebuilt));
-    }
-    if let Some(line) = metadata_line {
-        let pinned = format!("\"checksum {crate_name} {version} ({index_url})\" = \"{cksum}\"");
-        if line != pinned {
-            new_content = new_content.replacen(&line, &pinned, 1);
-            edits.push(edit(&line, &pinned));
-        }
-    }
-    // Dependents' full-id references to the OLD source, recorded as ONE
-    // `redirect_cargo_lock_reference` edit holding just the quoted id —
-    // never a dependent's whole block: a block referencing two patched
-    // packages (the root of a v1 lock) would hold two overlapping block
-    // edits, and reverting the first-applied one alone would find neither of
-    // its fragments. The id names this name + version + source exactly, so its
-    // inverse puts back EVERY occurrence, independently of any other
-    // package's edits and in any removal order.
-    if let Some(old) = old_source.filter(|old| old != index_url) {
-        let from = format!("\"{crate_name} {version} ({old})\"");
-        let to = format!("\"{crate_name} {version} ({index_url})\"");
-        let mut repointed_any = false;
-        // The oldest v1 locks keep the ROOT package in a standalone `[root]`
-        // table instead of the `[[package]]` array, with its own full-id
-        // `dependencies`. It precedes the array, so the block walk below
-        // never reaches it and the lock would keep naming a package it no
-        // longer contains (`--locked` fails; an unlocked build silently
-        // re-resolves).
-        if let Some((start, end)) = lock_root_table(&new_content) {
-            if new_content[start..end].contains(&from) {
-                let repointed = new_content[start..end].replace(&from, &to);
-                new_content.replace_range(start..end, &repointed);
-                repointed_any = true;
-            }
-        }
-        let mut cursor = 0;
-        while let Some((start, end)) = next_lock_block(&new_content, cursor) {
-            if new_content[start..end].contains(&from) {
-                let repointed = new_content[start..end].replace(&from, &to);
-                new_content.replace_range(start..end, &repointed);
-                repointed_any = true;
-                cursor = start + repointed.len();
-            } else {
-                cursor = end;
-            }
-        }
-        if repointed_any {
-            edits.push(FileEdit {
-                kind: CARGO_LOCK_REFERENCE_KIND.into(),
-                ..edit(&from, &to)
-            });
-        }
-    }
-    // Already redirected (re-run): every fragment is at the target values; a
-    // recorded edit would have original == new and grow the ledger forever.
-    if edits.is_empty() {
-        return CargoLockPlan::AlreadyRedirected;
-    }
-    CargoLockPlan::Rewritten {
-        content: new_content,
-        edits,
-    }
-}
-
-/// The v1 `[root]` table's span, when the lock has one: cargo before the
-/// `[root]` removal recorded the root package there rather than in the
-/// `[[package]]` array, and its `dependencies` spell full package ids the
-/// same way. Bounded by [`lock_block_end`], like a package block.
-fn lock_root_table(content: &str) -> Option<(usize, usize)> {
-    const HEADER: &str = "[root]\n";
-    let at = content
-        .match_indices(HEADER)
-        .map(|(at, _)| at)
-        .find(|&at| at == 0 || content.as_bytes()[at - 1] == b'\n')?;
-    Some((at, lock_block_end(content, at + HEADER.len())))
-}
-
-/// The next `[[package]]` block starting at or after `from`, as
-/// [`lock_block_end`] bounds it.
-fn next_lock_block(content: &str, from: usize) -> Option<(usize, usize)> {
-    let rel = content.get(from..)?.find("[[package]]\n")?;
-    let start = from + rel;
-    if start != 0 && content.as_bytes()[start - 1] != b'\n' {
-        return next_lock_block(content, start + 1);
-    }
-    Some((
-        start,
-        lock_block_end(content, start + "[[package]]\n".len()),
-    ))
-}
-
-/// End of the `[[package]]` block whose body starts at `body_start`,
-/// excluding the newline(s) before the next block / trailing table / EOF (so
-/// a recorded original/new stops after the block's last content byte — the
-/// TS rewriter's `(?=\n*$)` lookahead — while the file keeps its newlines).
-fn lock_block_end(content: &str, body_start: usize) -> usize {
-    // The next block, or the `[metadata]` / `[[patch.unused]]` tables that
-    // trail the packages. The trailing tables are searched only up to the
-    // next block: they sit after every `[[package]]` (absent entirely from
-    // v3/v4 locks), and an unbounded search per block scanned to EOF for
-    // every block of every dep. Each marker holds its only `\n` at offset 0,
-    // so a hit starting before the next block also ends by it — the bounded
-    // minimum is the unbounded one.
-    let rest = &content[body_start..];
-    let next_block = rest.find("\n[[package]]").unwrap_or(rest.len());
-    let mut end = ["\n[metadata]", "\n[[patch.unused]]", "\n[patch"]
-        .iter()
-        .filter_map(|marker| rest[..next_block].find(marker))
-        .min()
-        .map_or(body_start + next_block, |rel| body_start + rel);
-    while end > body_start && content.as_bytes()[end - 1] == b'\n' {
-        end -= 1;
-    }
-    end
-}
-
-
-/// Deterministic xorshift64* — no `rand` dev-dependency.
-struct Rng(u64);
-
-impl Rng {
-    fn next(&mut self) -> u64 {
-        let mut x = self.0;
-        x ^= x >> 12;
-        x ^= x << 25;
-        x ^= x >> 27;
-        self.0 = x;
-        x.wrapping_mul(0x2545_F491_4F6C_DD1D)
-    }
-    fn below(&mut self, n: usize) -> usize {
-        (self.next() % n as u64) as usize
-    }
-    fn chance(&mut self, percent: u64) -> bool {
-        self.next() % 100 < percent
-    }
-}
+use crate::test_rng::Rng;
 
 const CRATES_IO: &str = "registry+https://github.com/rust-lang/crates.io-index";
 
@@ -378,8 +98,6 @@ fn synth_lock(rng: &mut Rng, blocks: usize, v1: bool) -> String {
 }
 
 
-// ── the comparison ──
-
 const INDEX: &str = "sparse+https://socket.example/cargo/index/";
 
 fn plan_new(lock: &str, name: &str, version: &str, cksum: &str) -> CargoLockPlan {
@@ -400,32 +118,9 @@ fn shape(plan: &CargoLockPlan) -> (String, Option<String>, Vec<FileEdit>) {
     }
 }
 
-fn assert_same(
-    g: &mut Golden,
-    lock: &str,
-    name: &str,
-    version: &str,
-    cksum: &str,
-    what: &str,
-) -> Option<String> {
-    let old = plan_cargo_lock(lock, name, version, INDEX, cksum);
-    let new = plan_new(lock, name, version, cksum);
-    let (old, new) = (shape(&old), shape(&new));
+fn check(g: &mut Golden, lock: &str, name: &str, version: &str, cksum: &str) -> Option<String> {
+    let new = shape(&plan_new(lock, name, version, cksum));
     g.next(&(lock, name, version, cksum), &new);
-    // The one shape the line grammar cannot read and cargo can: the block's
-    // canonical header without the newline after `version` (a final block
-    // at EOF with no trailing newline). The span planner finds it.
-    let canonical_head = format!("[[package]]\nname = \"{name}\"\nversion = \"{version}\"\n");
-    if old.0 == "not-found" && new.0 != "not-found" && !lock.contains(&canonical_head) {
-        return new.1;
-    }
-    assert_eq!(new.0, old.0, "{what}: {name}@{version} outcome\n{lock}");
-    assert_eq!(new.1, old.1, "{what}: {name}@{version} bytes\n{lock}");
-    assert_eq!(
-        serde_json::to_value(&new.2).unwrap(),
-        serde_json::to_value(&old.2).unwrap(),
-        "{what}: {name}@{version} edits"
-    );
     new.1
 }
 
@@ -439,44 +134,36 @@ fn targets(lock: &str) -> Vec<(String, String)> {
         .collect()
 }
 
-/// Every package of `lock`, planned by both, then a second package planned
-/// over the first's output and a re-run of the first (the no-op path).
-fn assert_lock(g: &mut Golden, lock: &str, rng: &mut Rng, what: &str) {
+/// Every package of `lock`, then a second package planned over the first's
+/// output and a re-run of the first (the no-op path), and an absent package.
+fn sweep_lock(g: &mut Golden, lock: &str, rng: &mut Rng) {
     let all = targets(lock);
     for (name, version) in &all {
         let cksum = format!("{:016x}{:016x}", rng.next(), rng.next());
-        let Some(once) = assert_same(g, lock, name, version, &cksum, what) else {
+        let Some(once) = check(g, lock, name, version, &cksum) else {
             continue;
         };
-        assert_same(g, &once, name, version, &cksum, &format!("{what} re-run"));
+        check(g, &once, name, version, &cksum);
         if let Some((other, other_version)) = all.get(rng.below(all.len())) {
-            assert_same(
-                g,
-                &once,
-                other,
-                other_version,
-                "00ff",
-                &format!("{what} then another"),
-            );
+            check(g, &once, other, other_version, "00ff");
         }
     }
-    // An absent package, on both sides.
-    assert_same(g, lock, "absent-crate", "9.9.9", "00", what);
+    check(g, lock, "absent-crate", "9.9.9", "00");
 }
 
 #[test]
-fn span_splice_matches_the_line_grammar_on_random_locks() {
+fn span_splice_matches_golden_on_random_locks() {
     let mut g = Golden::new(
         "cargo_lock_random",
         "One package of a seeded Cargo.lock, planned for the hosted index.",
     )
     .chunked(20);
     let mut rng = Rng(0x9E37_79B9_7F4A_7C15);
-    for case in 0..300 {
+    for _ in 0..300 {
         let v1 = rng.chance(50);
         let blocks = rng.below(12);
         let lock = synth_lock(&mut rng, blocks, v1);
-        assert_lock(&mut g, &lock, &mut rng, &format!("case {case} (v1={v1})"));
+        sweep_lock(&mut g, &lock, &mut rng);
     }
     g.finish();
 }
@@ -485,7 +172,7 @@ fn span_splice_matches_the_line_grammar_on_random_locks() {
 /// (one at the target index, and none), a v1 `[root]` table, a v1 block with
 /// no source, a source ending the text, and blocks with neither line.
 #[test]
-fn span_splice_matches_the_line_grammar_on_hand_written_locks() {
+fn span_splice_matches_golden_on_hand_written_locks() {
     let crates_io = CRATES_IO;
     let twins_ours = format!(
         "version = 3\n\n[[package]]\nname = \"t\"\nversion = \"1.0.0\"\nsource = \"{crates_io}\"\nchecksum = \"aa\"\n\n[[package]]\nname = \"t\"\nversion = \"1.0.0\"\nsource = \"{INDEX}\"\nchecksum = \"bb\"\n"
@@ -502,7 +189,7 @@ fn span_splice_matches_the_line_grammar_on_hand_written_locks() {
         "One package of a hand-written Cargo.lock shape, planned for the hosted index.",
     );
     let mut rng = Rng(0xD1B5_4A32_D192_ED03);
-    for (what, lock) in [
+    for (_what, lock) in [
         ("twins, one ours", twins_ours),
         ("twins, neither ours", twins_neither),
         ("v1 [root]", v1_root),
@@ -510,14 +197,14 @@ fn span_splice_matches_the_line_grammar_on_hand_written_locks() {
         ("source at EOF", source_at_eof),
         ("bare blocks", bare),
     ] {
-        assert_lock(&mut g, &lock, &mut rng, what);
+        sweep_lock(&mut g, &lock, &mut rng);
     }
     g.finish();
 }
 
 /// The large-lock shape: ≥1k blocks, both formats, a sample of targets.
 #[test]
-fn span_splice_matches_the_line_grammar_on_a_large_lock() {
+fn span_splice_matches_golden_on_a_large_lock() {
     let mut g = Golden::new(
         "cargo_lock_large",
         "One sampled package of a seeded ≥1k-block Cargo.lock, planned for the hosted index.",
@@ -528,14 +215,7 @@ fn span_splice_matches_the_line_grammar_on_a_large_lock() {
         let all = targets(&lock);
         assert!(all.len() >= 1_000, "fixture keeps the ≥1k-block shape");
         for (name, version) in all.iter().step_by(97) {
-            assert_same(
-                &mut g,
-                &lock,
-                name,
-                version,
-                "abcd",
-                &format!("large (v1={v1})"),
-            );
+            check(&mut g, &lock, name, version, "abcd");
         }
     }
     g.finish();
diff --git a/crates/socket-patch-core/src/patch/redirect/composer_equivalence_tests.rs b/crates/socket-patch-core/src/patch/redirect/composer_equivalence_tests.rs
index 164e42921..a417cfc23 100644
--- a/crates/socket-patch-core/src/patch/redirect/composer_equivalence_tests.rs
+++ b/crates/socket-patch-core/src/patch/redirect/composer_equivalence_tests.rs
@@ -1,289 +1,19 @@
-//! Equivalence oracle for the hosted composer.lock rewriter, which now tests
-//! each `"name"` occurrence's value before walking its object, walks objects
-//! byte-wise, and splices each edit into the lock in place instead of
-//! re-allocating the whole lock per edit. The previous implementation is kept
-//! here verbatim and the production rewriter must produce the identical
-//! output bytes, FileEdit list and warnings on randomized locks.
+//! Seeded composer.lock sweep for the hosted rewriter (the in-place,
+//! byte-walking splice): output bytes, FileEdits and warnings are pinned per
+//! case by `tests/equivalence/composer_*.golden`, blessed while the
+//! pre-splice rewriter still ran beside it as an oracle.
 
 use super::*;
-use crate::crawlers::composer_crawler::normalize_version;
 use crate::formats::composer::hosted::*;
+use crate::golden::Golden;
+use crate::test_rng::Rng;
 
-fn json_object_end_from_oracle(text: &str, from: usize) -> Option<usize> {
-    let mut depth = 0usize;
-    let mut in_string = false;
-    let mut escaped = false;
-    for (offset, ch) in text[from..].char_indices() {
-        if in_string {
-            match ch {
-                _ if escaped => escaped = false,
-                '\\' => escaped = true,
-                '"' => in_string = false,
-                _ => {}
-            }
-            continue;
-        }
-        match ch {
-            '"' => in_string = true,
-            '{' => depth += 1,
-            '}' if depth == 0 => return Some(from + offset),
-            '}' => depth -= 1,
-            _ => {}
-        }
-    }
-    None
-}
-
-fn find_composer_entry_oracle(content: &str, pkg: &str, version: &str) -> ComposerEntry {
-    let mut mismatched: Option<String> = None;
-    for (name_idx, _) in content.match_indices("\"name\": \"") {
-        let Some(end) = json_object_end_from_oracle(content, name_idx) else {
-            continue;
-        };
-        let entry = &content[name_idx..=end];
-        if !json_string_field(entry, "name").is_some_and(|n| n.eq_ignore_ascii_case(pkg)) {
-            continue;
-        }
-        // Every package entry carries `version`; an `authors[]`/`support`
-        // object that happens to have a matching `name` does not.
-        let Some(locked) = json_string_field(entry, "version") else {
-            continue;
-        };
-        if normalize_version(locked) == normalize_version(version) {
-            return ComposerEntry::Found(name_idx, end);
-        }
-        mismatched = Some(locked.to_string());
-    }
-    match mismatched {
-        Some(locked) => ComposerEntry::VersionMismatch(locked),
-        None => ComposerEntry::NotFound,
-    }
-}
-
-fn composer_source_before_dist_oracle(
-    content: &str,
-    entry_start: usize,
-    dist_start: usize,
-) -> Option<usize> {
-    const SOURCE_KEY: &str = "\"source\": {";
-    let source_start = entry_start + content[entry_start..dist_start].rfind(SOURCE_KEY)?;
-    let source_end = json_object_end_from_oracle(content, source_start + SOURCE_KEY.len())?;
-    (source_end < dist_start && content[source_end + 1..dist_start].trim() == ",")
-        .then_some(source_start)
-}
-
-fn rewrite_composer_lock_oracle(
-    files: &BTreeMap<String, String>,
-    overrides: &[DepOverride],
-    result: &mut RewriteResult,
-) {
-    let composer: Vec<&DepOverride> = overrides
-        .iter()
-        .filter(|o| o.ecosystem == "composer")
-        .collect();
-    if composer.is_empty() {
-        return;
-    }
-    // Parity with `redirect_npm_no_lockfile`: a granted dep the project has
-    // no lock to pin must be SAID, not silently dropped from the redirected
-    // count (a composer.json + installed vendor tree without a lock is
-    // discovered and granted like any other).
-    if !files.contains_key("composer.lock") {
-        result.warnings.push(RewriteWarning {
-            code: "redirect_composer_no_lockfile".into(),
-            detail: "no composer.lock present; composer redirect skipped".into(),
-        });
-        return;
-    }
-    const DIST_KEY: &str = "\"dist\": {";
-    let mut content = files["composer.lock"].clone();
-    let type_re: &Regex = &COMPOSER_DIST_TYPE_RE;
-    let url_re: &Regex = &COMPOSER_DIST_URL_RE;
-    let shasum_re: &Regex = &COMPOSER_DIST_SHASUM_RE;
-    let mut changed = false;
-    for dep in &composer {
-        let composer_name = full_name(dep);
-        let Some(sha1) = dep.integrity.sha1.clone() else {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_composer_missing_sha1".into(),
-                detail: format!("{composer_name} has no sha1 (dist.shasum) integrity"),
-            });
-            continue;
-        };
-        let (entry_start, entry_end) =
-            match find_composer_entry_oracle(&content, &composer_name, &dep.version) {
-                ComposerEntry::Found(start, end) => (start, end),
-                ComposerEntry::VersionMismatch(locked) => {
-                    result.warnings.push(RewriteWarning {
-                        code: "redirect_composer_version_mismatch".into(),
-                        detail: format!(
-                            "composer.lock pins {composer_name}@{locked}, not the patched {}",
-                            dep.version
-                        ),
-                    });
-                    continue;
-                }
-                ComposerEntry::NotFound => {
-                    result.warnings.push(RewriteWarning {
-                        code: "redirect_composer_pkg_not_found".into(),
-                        detail: format!(
-                            "no composer.lock package named {composer_name}@{}",
-                            dep.version
-                        ),
-                    });
-                    continue;
-                }
-            };
-        // The dist block MUST belong to the located entry. Scanning forward
-        // from the name for the next `"dist": {` walked into the FOLLOWING
-        // package whenever the target was installed from source, repointing a
-        // bystander's url + shasum — a checksum-clean install of the wrong
-        // code. A target with no dist of its own pins nothing: fail closed.
-        let Some(dist_start) = content[entry_start..=entry_end]
-            .find(DIST_KEY)
-            .map(|offset| entry_start + offset)
-        else {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_composer_no_dist".into(),
-                detail: format!("{composer_name} has no dist block"),
-            });
-            continue;
-        };
-        let Some(dist_end) = json_object_end_from_oracle(&content, dist_start + DIST_KEY.len())
-        else {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_composer_lock_malformed".into(),
-                detail: format!("{composer_name}'s dist block is unterminated"),
-            });
-            continue;
-        };
-        let block = content[dist_start..=dist_end].to_string();
-        // Already redirected (either slash spelling): recording an edit whose
-        // `original` IS the hosted url would grow the ledger on every re-run
-        // and poison a future revert.
-        if artifact_url_present(&block, &dep.artifact_url) && block.contains(&sha1) {
-            continue;
-        }
-        if !block.contains("\"url\": \"") {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_composer_no_dist_url".into(),
-                detail: format!("{composer_name}'s dist block has no url to redirect"),
-            });
-            continue;
-        }
-        let mut rewritten = type_re.replace(&block, "${1}zip${2}").to_string();
-        rewritten = url_re
-            .replace(
-                &rewritten,
-                format!("${{1}}{}${{2}}", dep.artifact_url).as_str(),
-            )
-            .to_string();
-        rewritten = if rewritten.contains("\"shasum\": \"") {
-            shasum_re
-                .replace(&rewritten, format!("${{1}}{sha1}${{2}}").as_str())
-                .to_string()
-        } else {
-            append_composer_shasum(&rewritten, &sha1)
-        };
-        // Drop the entry's `source` (the vendored backend does the same):
-        // when the dist download fails — checksum mismatch, an expired grant
-        // token, a patch-server outage — composer 1 and composer 2 before its
-        // source-fallback cutoff (2.2 LTS included) print "Now trying to
-        // download from source" and silently install the PRISTINE upstream
-        // commit from git, and `--prefer-source` / `preferred-install:
-        // source` always does. With the source gone the hosted archive is
-        // the only way to install the package, so a failed fetch fails the
-        // install instead of shipping the vulnerable code. The edit then
-        // spans `"source": {…},\n<indent>"dist": {…}`, so the ledger's
-        // fragment revert puts both blocks back byte-for-byte.
-        let (edit_start, original) =
-            match composer_source_before_dist_oracle(&content, entry_start, dist_start) {
-                Some(source_start) => (source_start, content[source_start..=dist_end].to_string()),
-                None => {
-                    if content[entry_start..=entry_end].contains("\"source\": {") {
-                        result.warnings.push(RewriteWarning {
-                            code: "redirect_composer_source_kept".into(),
-                            detail: format!(
-                                "{composer_name}'s source block does not directly precede its \
-                                 dist and was left in place; a failed hosted download may fall \
-                                 back to it"
-                            ),
-                        });
-                    }
-                    (dist_start, block.clone())
-                }
-            };
-        if rewritten != original {
-            content = format!(
-                "{}{}{}",
-                &content[..edit_start],
-                rewritten,
-                &content[dist_end + 1..]
-            );
-            changed = true;
-            result.edits.push(FileEdit {
-                path: "composer.lock".into(),
-                kind: "redirect_composer_dist".into(),
-                action: "rewritten".into(),
-                key: Some(composer_name),
-                original: Some(Value::String(original)),
-                new: Some(Value::String(rewritten)),
-            });
-        }
-    }
-    if changed {
-        result.files.insert("composer.lock".into(), content);
-    }
-}
-
-fn assert_same(want: &RewriteResult, got: &RewriteResult, what: &str) {
-    assert_eq!(got.files, want.files, "{what}: rewritten bytes");
-    assert_eq!(got.edits.len(), want.edits.len(), "{what}: edit count");
-    for (i, (g, w)) in got.edits.iter().zip(&want.edits).enumerate() {
-        assert_eq!(g, w, "{what}: edit #{i}");
-    }
-    let warnings = |r: &RewriteResult| {
-        r.warnings
-            .iter()
-            .map(|w| (w.code.clone(), w.detail.clone()))
-            .collect::<Vec<_>>()
-    };
-    assert_eq!(warnings(got), warnings(want), "{what}: warnings in order");
-}
-
-fn run_both(
-    files: &BTreeMap<String, String>,
-    overrides: &[DepOverride],
-    what: &str,
-) -> RewriteResult {
-    let mut want = RewriteResult::default();
-    rewrite_composer_lock_oracle(files, overrides, &mut want);
+fn run(files: &BTreeMap<String, String>, overrides: &[DepOverride]) -> RewriteResult {
     let mut got = RewriteResult::default();
     rewrite_composer_lock(files, overrides, &mut got);
-    assert_same(&want, &got, what);
     got
 }
 
-/// Deterministic xorshift64* — no `rand` dev-dependency.
-struct Rng(u64);
-
-impl Rng {
-    fn next(&mut self) -> u64 {
-        let mut x = self.0;
-        x ^= x >> 12;
-        x ^= x << 25;
-        x ^= x >> 27;
-        self.0 = x;
-        x.wrapping_mul(0x2545_F491_4F6C_DD1D)
-    }
-    fn below(&mut self, n: usize) -> usize {
-        (self.next() % n as u64) as usize
-    }
-    fn chance(&mut self, percent: u64) -> bool {
-        self.next() % 100 < percent
-    }
-}
-
 fn pkg(i: usize, rng: &mut Rng) -> String {
     if rng.chance(15) {
         format!("Vendor{}/Pkg-{i}", i % 3)
@@ -437,7 +167,7 @@ fn dep(rng: &mut Rng, pool: usize, n: usize) -> DepOverride {
 }
 
 #[test]
-fn in_place_composer_rewrite_matches_oracle() {
+fn in_place_composer_rewrite_matches_golden() {
     let mut rewritten = 0;
     let mut edits = 0;
     let mut codes = std::collections::BTreeSet::new();
@@ -447,7 +177,7 @@ fn in_place_composer_rewrite_matches_oracle() {
     )
     .chunked(10);
     for seed in 1..=3000u64 {
-        let mut rng = Rng(seed.wrapping_mul(0x9E37_79B9_7F4A_7C15) | 1);
+        let mut rng = Rng::new(seed);
         let pool = 3 + rng.below(12);
         let mut files = BTreeMap::new();
         if !rng.chance(3) {
@@ -463,10 +193,10 @@ fn in_place_composer_rewrite_matches_oracle() {
             }
             overrides.push(again);
         }
-        let got = run_both(&files, &overrides, &format!("seed {seed}"));
+        let got = run(&files, &overrides);
         let mut rerun = files.clone();
         rerun.extend(got.files.clone());
-        let again = run_both(&rerun, &overrides, &format!("seed {seed} re-run"));
+        let again = run(&rerun, &overrides);
         golden.case(seed, &(&files, &overrides), &(&got, &again));
         rewritten += got.files.len();
         edits += got.edits.len();
@@ -489,56 +219,21 @@ fn in_place_composer_rewrite_matches_oracle() {
 }
 
 #[test]
-fn byte_walk_matches_the_char_walk() {
+fn json_object_end_matches_golden() {
     let texts = [
         r#"{"a": "}", "b": {"c": "\"}"}, "d": "é\é\\"}"#,
         "{\"x\": \"\\\u{e9}}\"}, \"y\": 1}",
         "\"unterminated {",
         "{{{}}}}",
     ];
+    let mut golden = Golden::new(
+        "composer_json_object_end",
+        "One (text, start) pair: where its JSON object ends.",
+    );
     for text in texts {
         for from in (0..=text.len()).filter(|&i| text.is_char_boundary(i)) {
-            assert_eq!(
-                json_object_end_from(text, from),
-                json_object_end_from_oracle(text, from),
-                "{text:?} from {from}"
-            );
+            golden.next(&(text, from), &json_object_end_from(text, from));
         }
     }
-}
-
-/// Runs the oracle over a large benchmark composer.lock (too large to
-/// commit) when `SOCKET_PATCH_COMPOSER_FIXTURE` names it, redirecting every
-/// package; a no-op otherwise.
-#[test]
-fn in_place_composer_rewrite_matches_oracle_on_fixture() {
-    let Some(path) = std::env::var_os("SOCKET_PATCH_COMPOSER_FIXTURE") else {
-        return;
-    };
-    let text = std::fs::read_to_string(path).unwrap();
-    let doc: Value = serde_json::from_str(&text).unwrap();
-    let overrides: Vec<DepOverride> = ["packages", "packages-dev"]
-        .iter()
-        .flat_map(|k| doc[k].as_array().cloned().unwrap_or_default())
-        .enumerate()
-        .map(|(n, p)| DepOverride {
-            ecosystem: "composer".into(),
-            name: p["name"].as_str().unwrap().to_string(),
-            namespace: None,
-            version: p["version"].as_str().unwrap().to_string(),
-            token: String::new(),
-            patch_uuid: format!("00000000-0000-4000-8000-{n:012}"),
-            artifact_url: format!("https://patch.socket.dev/composer/{n}.zip"),
-            berry_zip_url: None,
-            registry_override: None,
-            integrity: Integrity {
-                sha1: Some("0123456789abcdef0123456789abcdef01234567".into()),
-                ..Default::default()
-            },
-        })
-        .collect();
-    let mut files = BTreeMap::new();
-    files.insert("composer.lock".to_string(), text);
-    let got = run_both(&files, &overrides, "fixture");
-    assert!(!got.edits.is_empty());
+    golden.finish();
 }
diff --git a/crates/socket-patch-core/src/patch/redirect/golang_equivalence_tests.rs b/crates/socket-patch-core/src/patch/redirect/golang_equivalence_tests.rs
index 8e9963409..39f31864f 100644
--- a/crates/socket-patch-core/src/patch/redirect/golang_equivalence_tests.rs
+++ b/crates/socket-patch-core/src/patch/redirect/golang_equivalence_tests.rs
@@ -1,355 +1,22 @@
-//! Equivalence oracle for the hosted golang rewriter, which now reads go.mod
-//! once per dep (one walk for the prior directive, the required version and
-//! the upsert scan), appends its directives in place, and edits go.sum as
-//! lines, joining it once at the end. The previous implementation is kept
-//! here verbatim over the text transforms, and the production rewriter must
-//! produce the identical output bytes, FileEdit list and warnings on
-//! randomized go.mod / go.sum pairs — CRLF and mixed endings, unclosed
-//! blocks, socket-owned and user-authored replaces, stale pins, malformed
-//! integrity and duplicate deps.
+//! Seeded go.mod / go.sum sweep for the hosted golang rewriter (one go.mod
+//! walk per dep, directives appended in place, go.sum edited as lines):
+//! CRLF and mixed endings, unclosed blocks, socket-owned and user-authored
+//! replaces, stale pins, malformed integrity and duplicate deps. Output
+//! bytes, FileEdits and warnings are pinned per case by
+//! `tests/equivalence/golang_rewrite.golden`, blessed while the previous
+//! rewriter still ran beside it as an oracle.
 
 use super::*;
+use crate::golden::Golden;
+use crate::test_rng::Rng;
 
-fn rewrite_golang_oracle(
-    files: &BTreeMap<String, String>,
-    overrides: &[DepOverride],
-    result: &mut RewriteResult,
-) {
-    use crate::vendor::go_mod_edit::{self, HOSTED_GO_MODULE_PREFIX};
-    use crate::vendor::go_sum_edit;
-
-    let golang: Vec<&DepOverride> = overrides
-        .iter()
-        .filter(|o| o.ecosystem == "golang")
-        .collect();
-    if golang.is_empty() {
-        return;
-    }
-    // The replace directive can only live in the MAIN module's go.mod.
-    let Some(orig_go_mod) = files.get("go.mod") else {
-        result.warnings.push(RewriteWarning {
-            code: "redirect_golang_no_go_mod".into(),
-            detail: "no go.mod present; golang redirect skipped".into(),
-        });
-        return;
-    };
-    let mut go_mod = orig_go_mod.clone();
-    // An absent go.sum starts empty: the fully-replaced original needs no
-    // lines of its own, so the two socket lines alone are a complete pin.
-    let mut go_sum = files.get("go.sum").cloned().unwrap_or_default();
-    let (mut mod_changed, mut sum_changed) = (false, false);
-
-    for dep in &golang {
-        let fname = full_name(dep);
-        let Some(ov) = registry_override_of_kind(dep, "goproxy") else {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_golang_unsupported".into(),
-                detail: format!(
-                    "{fname}@{}: no hosted Go module is published for this patch; run \
-                     `socket-patch vendor` (committable, offline-verified) instead",
-                    dep.version
-                ),
-            });
-            continue;
-        };
-        let (Some(rhs_module), Some(rhs_version)) = (
-            &ov.identifiers.go_module_path,
-            &ov.identifiers.go_module_version,
-        ) else {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_golang_missing_module".into(),
-                detail: format!(
-                    "{fname}@{} goproxy override lacks goModulePath/goModuleVersion",
-                    dep.version
-                ),
-            });
-            continue;
-        };
-        // Fail closed on a module path outside the socket namespace: the
-        // prefix is the ONLY ownership signal — a directive we couldn't
-        // recognize later would be unremovable, and go.sum removal keys on it.
-        if !go_mod_edit::is_hosted_module_path(rhs_module) {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_golang_untrusted_module_path".into(),
-                detail: format!(
-                    "{fname}@{}: refusing hosted module path `{rhs_module}`: not \
-                     `{HOSTED_GO_MODULE_PREFIX}<patch uuid>`",
-                    dep.version
-                ),
-            });
-            continue;
-        }
-        // Every string interpolated into go.mod/go.sum must be a single clean
-        // token — whitespace or control characters would inject directives.
-        if [fname.as_str(), &dep.version, rhs_module, rhs_version]
-            .iter()
-            .any(|s| !go_token_safe(s))
-        {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_golang_unsafe_coords".into(),
-                detail: format!(
-                    "{fname}@{}: module/version tokens contain whitespace or control \
-                     characters; refusing to write them into go.mod/go.sum",
-                    dep.version
-                ),
-            });
-            continue;
-        }
-        // BOTH go.sum hashes must be pinnable up front — a replace without
-        // them (or with a malformed hash) bricks every `-mod=readonly` build.
-        let (Some(zip_h1), Some(gomod_h1)) = (&dep.integrity.dirhash_h1, &dep.integrity.go_mod_h1)
-        else {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_golang_missing_integrity".into(),
-                detail: format!(
-                    "{fname}@{} has no dirhashH1/goModH1 integrity pair",
-                    dep.version
-                ),
-            });
-            continue;
-        };
-        if !go_sum_edit::is_h1_dirhash(zip_h1) || !go_sum_edit::is_h1_dirhash(gomod_h1) {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_golang_missing_integrity".into(),
-                detail: format!(
-                    "{fname}@{}: integrity hashes must be `h1:` + 44-char base64 dirhashes",
-                    dep.version
-                ),
-            });
-            continue;
-        }
-        // Any pre-existing socket-owned directive for the module (this run is
-        // a refresh, or a takeover of a local/vendored redirect): capture its
-        // text — the ledger's `original` is the only pre-redirect record.
-        let prior = go_mod_edit::parse_replace_entries(&go_mod)
-            .into_iter()
-            .find(|e| e.module == fname && e.socket_owned());
-        let prior_text = prior.as_ref().map(|e| {
-            let target = e.path.clone().unwrap_or_else(|| match &e.rhs_version {
-                Some(v) => format!("{} {v}", e.rhs_module.as_deref().unwrap_or_default()),
-                None => e.rhs_module.clone().unwrap_or_default(),
-            });
-            let ver = e
-                .version
-                .as_deref()
-                .map(|v| format!(" {v}"))
-                .unwrap_or_default();
-            format!("replace {}{ver} => {target}", e.module)
-        });
-
-        // Stale-pin cross-check: `replace` is keyed on module+version, and a
-        // pin the graph no longer selects is SILENTLY inert (the build links
-        // the unpatched module with zero warning) — refuse to write one, and
-        // reconcile away OUR OWN inert directive if one is already committed:
-        // left in place, its module path keeps confirming the dep as
-        // redirected (ledger + VEX attestation) while go links the unpatched
-        // version.
-        let required = go_mod_edit::parse_required_versions(&go_mod);
-        if let Some(required) = required.get(&fname) {
-            if required != &dep.version {
-                result.warnings.push(RewriteWarning {
-                    code: "redirect_golang_version_mismatch".into(),
-                    detail: format!(
-                        "{fname}: go.mod requires {required} but the patch targets {} — \
-                         a version-pinned replace would be silently ignored",
-                        dep.version
-                    ),
-                });
-                let stale_hosted = prior
-                    .as_ref()
-                    .filter(|e| e.owner == Some(go_mod_edit::ReplaceOwner::Hosted));
-                if let Some(stale) = stale_hosted {
-                    if let Ok(Some(new)) = go_mod_edit::remove_replace_entry(
-                        &go_mod,
-                        &fname,
-                        go_mod_edit::ReplaceOwner::Hosted,
-                    ) {
-                        go_mod = new;
-                        mod_changed = true;
-                        result.edits.push(FileEdit {
-                            path: "go.mod".into(),
-                            kind: "redirect_golang_stale_replace_removed".into(),
-                            action: "removed".into(),
-                            key: Some(fname.clone()),
-                            original: prior_text.clone().map(Value::String),
-                            new: None,
-                        });
-                    }
-                    if let Some(stale_rhs) = stale.rhs_module.as_deref() {
-                        if let Some(new) =
-                            go_sum_edit::remove_module_prefix_lines(&go_sum, stale_rhs)
-                        {
-                            go_sum = new;
-                            sum_changed = true;
-                            result.edits.push(FileEdit {
-                                path: "go.sum".into(),
-                                kind: "redirect_golang_stale_gosum_removed".into(),
-                                action: "removed".into(),
-                                key: Some(stale_rhs.to_string()),
-                                original: None,
-                                new: None,
-                            });
-                        }
-                    }
-                }
-                continue;
-            }
-        } else if !go_sum_edit::has_module_version(&go_sum, &fname, &dep.version)
-            && prior
-                .as_ref()
-                .is_none_or(|e| e.version.as_deref() != Some(dep.version.as_str()))
-        {
-            // Not required, not in go.sum at this version, and not already
-            // redirected by us: the module is outside this project's graph
-            // (local discovery crawls the whole module cache). Its replace
-            // would be inert, and confirming it would attest a patch no
-            // build links.
-            result.warnings.push(RewriteWarning {
-                code: "redirect_golang_not_in_module_graph".into(),
-                detail: format!(
-                    "{fname}@{}: not required by go.mod and absent from go.sum — the \
-                     module is not in this project's build graph; nothing redirected",
-                    dep.version
-                ),
-            });
-            continue;
-        }
-
-        match go_mod_edit::upsert_hosted_replace_entry(
-            &go_mod,
-            &fname,
-            &dep.version,
-            rhs_module,
-            rhs_version,
-        ) {
-            Err(e) => {
-                result.warnings.push(RewriteWarning {
-                    code: "redirect_golang_replace_conflict".into(),
-                    detail: format!("{fname}@{}: {e}", dep.version),
-                });
-                continue;
-            }
-            // Re-run over an already-redirected go.mod: nothing to record.
-            Ok(None) => {}
-            Ok(Some(new)) => {
-                go_mod = new;
-                mod_changed = true;
-                result.edits.push(FileEdit {
-                    path: "go.mod".into(),
-                    kind: "redirect_golang_replace".into(),
-                    // A takeover/refresh of an existing socket directive must
-                    // keep its text in `original` — the ledger is the only
-                    // pre-redirect record a future revert can restore from.
-                    action: if prior_text.is_some() {
-                        "updated".into()
-                    } else {
-                        "added".into()
-                    },
-                    key: Some(fname.clone()),
-                    original: prior_text.map(Value::String),
-                    new: Some(Value::String(format!(
-                        "replace {fname} {} => {rhs_module} {rhs_version}",
-                        dep.version
-                    ))),
-                });
-            }
-        }
-        if let Some(new) =
-            go_sum_edit::upsert_module_lines(&go_sum, rhs_module, rhs_version, zip_h1, gomod_h1)
-        {
-            go_sum = new;
-            sum_changed = true;
-            result.edits.push(FileEdit {
-                path: "go.sum".into(),
-                kind: "redirect_golang_gosum".into(),
-                action: "added".into(),
-                key: Some(format!("{rhs_module}@{rhs_version}")),
-                original: None,
-                new: Some(Value::String(format!(
-                    "{rhs_module} {rhs_version} {zip_h1}\n{rhs_module} {rhs_version}/go.mod {gomod_h1}"
-                ))),
-            });
-        }
-        // Prune the replaced original's lines: with the pinned replace in
-        // force go never fetches or verifies the original, and `go mod tidy`
-        // prunes exactly these — writing the tidy-stable state up front keeps
-        // the first day-2 tidy a byte-level no-op. The removed lines ride in
-        // `original` so the ledger can restore them on revert.
-        if let Some((new, removed)) =
-            go_sum_edit::remove_exact_module_version_lines(&go_sum, &fname, &dep.version)
-        {
-            go_sum = new;
-            sum_changed = true;
-            result.edits.push(FileEdit {
-                path: "go.sum".into(),
-                kind: "redirect_golang_gosum_prune".into(),
-                action: "removed".into(),
-                key: Some(format!("{fname}@{}", dep.version)),
-                original: Some(Value::String(removed.join("\n"))),
-                new: None,
-            });
-        }
-        result.confirmed_golang_uuids.insert(dep.patch_uuid.clone());
-    }
-
-    if mod_changed {
-        result.files.insert("go.mod".into(), go_mod);
-    }
-    if sum_changed {
-        result.files.insert("go.sum".into(), go_sum);
-    }
-}
-
-fn assert_same(want: &RewriteResult, got: &RewriteResult, what: &str) {
-    assert_eq!(got.files, want.files, "{what}: rewritten bytes");
-    assert_eq!(got.edits.len(), want.edits.len(), "{what}: edit count");
-    for (i, (g, w)) in got.edits.iter().zip(&want.edits).enumerate() {
-        assert_eq!(g, w, "{what}: edit #{i}");
-    }
-    let warnings = |r: &RewriteResult| {
-        r.warnings
-            .iter()
-            .map(|w| (w.code.clone(), w.detail.clone()))
-            .collect::<Vec<_>>()
-    };
-    assert_eq!(warnings(got), warnings(want), "{what}: warnings in order");
-}
-
-fn run_both(
-    g: &mut crate::golden::Golden,
-    files: &BTreeMap<String, String>,
-    overrides: &[DepOverride],
-    what: &str,
-) -> RewriteResult {
-    let mut want = RewriteResult::default();
-    rewrite_golang_oracle(files, overrides, &mut want);
+fn run(g: &mut Golden, files: &BTreeMap<String, String>, overrides: &[DepOverride]) -> RewriteResult {
     let mut got = RewriteResult::default();
     rewrite_golang(files, overrides, &mut got);
-    assert_same(&want, &got, what);
     g.next(&(files, overrides), &got);
     got
 }
 
-/// Deterministic xorshift64* — no `rand` dev-dependency.
-struct Rng(u64);
-
-impl Rng {
-    fn next(&mut self) -> u64 {
-        let mut x = self.0;
-        x ^= x >> 12;
-        x ^= x << 25;
-        x ^= x >> 27;
-        self.0 = x;
-        x.wrapping_mul(0x2545_F491_4F6C_DD1D)
-    }
-    fn below(&mut self, n: usize) -> usize {
-        (self.next() % n as u64) as usize
-    }
-    fn chance(&mut self, percent: u64) -> bool {
-        self.next() % 100 < percent
-    }
-}
-
 const H1_A: &str = "h1:0000000000000000000000000000000000000000000=";
 const H1_B: &str = "h1:1111111111111111111111111111111111111111111=";
 
@@ -557,18 +224,18 @@ fn dep(rng: &mut Rng, pool: usize, n: usize) -> DepOverride {
 }
 
 #[test]
-fn single_walk_golang_rewrite_matches_oracle() {
+fn single_walk_golang_rewrite_matches_golden() {
     let mut rewritten = 0;
     let mut edits = 0;
     let mut codes = std::collections::BTreeSet::new();
     let mut kinds = std::collections::BTreeSet::new();
-    let mut g = crate::golden::Golden::new(
+    let mut g = Golden::new(
         "golang_rewrite",
         "One seeded go.mod / go.sum pair + overrides, or the re-run over its output.",
     )
     .chunked(20);
     for seed in 1..=3000u64 {
-        let mut rng = Rng(seed.wrapping_mul(0x9E37_79B9_7F4A_7C15) | 1);
+        let mut rng = Rng::new(seed);
         let pool = 3 + rng.below(12);
         let mut files = BTreeMap::new();
         if !rng.chance(3) {
@@ -586,11 +253,11 @@ fn single_walk_golang_rewrite_matches_oracle() {
             let again = overrides[rng.below(overrides.len())].clone();
             overrides.push(again);
         }
-        let got = run_both(&mut g, &files, &overrides, &format!("seed {seed}"));
-        // A second pass over the output (the idempotent re-run) must agree too.
+        let got = run(&mut g, &files, &overrides);
+        // A second pass over the output: the idempotent re-run.
         let mut rerun = files.clone();
         rerun.extend(got.files.clone());
-        run_both(&mut g, &rerun, &overrides, &format!("seed {seed} re-run"));
+        run(&mut g, &rerun, &overrides);
         rewritten += got.files.len();
         edits += got.edits.len();
         codes.extend(got.warnings.iter().map(|w| w.code.clone()));
@@ -621,80 +288,3 @@ fn single_walk_golang_rewrite_matches_oracle() {
     }
     g.finish();
 }
-
-/// Runs the oracle over the benchmark go.mod / go.sum pairs (too
-/// large to commit) when `SOCKET_PATCH_GO_FIXTURES` names their directory,
-/// redirecting every required module; a no-op otherwise.
-#[test]
-fn single_walk_golang_rewrite_matches_oracle_on_fixtures() {
-    let Some(root) = std::env::var_os("SOCKET_PATCH_GO_FIXTURES") else {
-        return;
-    };
-    let root = std::path::PathBuf::from(root);
-    let mut scratch = crate::golden::Golden::new("unused", "");
-    for dir in ["go-grafana", "go-cache", "go-k8s"] {
-        let read = |name: &str| std::fs::read_to_string(root.join(dir).join(name)).unwrap();
-        let go_mod = read("go.mod");
-        let mut required: Vec<(String, String)> =
-            crate::vendor::go_mod_edit::parse_required_versions(&go_mod)
-                .into_iter()
-                .collect();
-        required.sort();
-        let overrides: Vec<DepOverride> = required
-            .iter()
-            .enumerate()
-            .map(|(n, (m, v))| DepOverride {
-                ecosystem: "golang".into(),
-                name: m.clone(),
-                namespace: None,
-                version: v.clone(),
-                token: String::new(),
-                patch_uuid: uuid(n),
-                artifact_url: String::new(),
-                berry_zip_url: None,
-                registry_override: Some(RegistryOverride {
-                    kind: "goproxy".into(),
-                    index_url: "https://patch.socket.dev/patch-registry/golang".into(),
-                    identifiers: RegistryOverrideIdentifiers {
-                        name: m.clone(),
-                        version: v.clone(),
-                        go_module_path: Some(hosted(n)),
-                        go_module_version: Some("v1.0.0-socketpatch.1".into()),
-                        ..Default::default()
-                    },
-                }),
-                integrity: Integrity {
-                    dirhash_h1: Some(H1_A.into()),
-                    go_mod_h1: Some(H1_B.into()),
-                    ..Default::default()
-                },
-            })
-            .collect();
-        for crlf in [false, true] {
-            let conv = |s: String| if crlf { s.replace('\n', "\r\n") } else { s };
-            let mut files = BTreeMap::new();
-            files.insert("go.mod".to_string(), conv(go_mod.clone()));
-            files.insert("go.sum".to_string(), conv(read("go.sum")));
-            let got = run_both(
-                &mut scratch,
-                &files,
-                &overrides,
-                &format!("{dir} crlf={crlf}"),
-            );
-            // k8s pins every staging module with a user-authored replace, so
-            // there every dep is a refused conflict.
-            assert!(
-                !got.edits.is_empty() || !got.warnings.is_empty(),
-                "{dir}: nothing happened"
-            );
-            let mut rerun = files.clone();
-            rerun.extend(got.files.clone());
-            run_both(
-                &mut scratch,
-                &rerun,
-                &overrides,
-                &format!("{dir} crlf={crlf} re-run"),
-            );
-        }
-    }
-}
diff --git a/crates/socket-patch-core/src/patch/redirect/lock_index_equivalence_tests.rs b/crates/socket-patch-core/src/patch/redirect/lock_index_equivalence_tests.rs
index cf997803a..553528796 100644
--- a/crates/socket-patch-core/src/patch/redirect/lock_index_equivalence_tests.rs
+++ b/crates/socket-patch-core/src/patch/redirect/lock_index_equivalence_tests.rs
@@ -1,11 +1,12 @@
-//! Equivalence oracles for the npm package-lock and classic yarn.lock hosted
-//! rewriters, which now derive each entry's identity once per lock instead
-//! of once per entry per dep. The previous implementations are kept here
-//! verbatim and the production rewriters must produce the identical output
-//! bytes, FileEdit list, warnings and refusals on randomized locks.
+//! Seeded package-lock.json and classic yarn.lock sweeps for the indexed
+//! hosted rewriters (each entry's identity derived once per lock). Every
+//! output channel is pinned per case by `tests/equivalence/npm_lock_rewrite`
+//! and `yarn_classic_rewrite.golden`, blessed while the pre-index rewriters
+//! still ran beside them as oracles.
 
-use super::rewrite_oracle_support::{assert_same, Rng};
 use super::*;
+use crate::golden::{record, Golden, Sweep};
+use crate::test_rng::Rng;
 
 fn name(i: usize) -> String {
     match i % 4 {
@@ -145,9 +146,9 @@ fn npm_lock(rng: &mut Rng, pool: &mut Vec<(String, String)>) -> String {
 }
 
 #[test]
-fn indexed_npm_lock_rewrite_matches_oracle() {
-    let sweep = crate::golden::Sweep::with(
-        crate::golden::Golden::new(
+fn indexed_npm_lock_rewrite_matches_golden() {
+    let sweep = Sweep::with(
+        Golden::new(
             "npm_lock_rewrite",
             "One seeded package-lock.json / npm-shrinkwrap.json + overrides.",
         )
@@ -156,18 +157,15 @@ fn indexed_npm_lock_rewrite_matches_oracle() {
     let mut edits = 0;
     let mut codes = std::collections::BTreeSet::new();
     for seed in 1..=400u64 {
-        let mut rng = Rng(seed.wrapping_mul(0x9E37_79B9_7F4A_7C15) | 1);
+        let mut rng = Rng::new(seed);
         let mut pool = Vec::new();
         let text = npm_lock(&mut rng, &mut pool);
         let deps = overrides(&pool, &mut rng);
         let refs: Vec<&DepOverride> = deps.iter().collect();
         for lockfile in ["package-lock.json", "npm-shrinkwrap.json"] {
-            let mut want = RewriteResult::default();
-            rewrite_one_npm_lock_oracle(&text, lockfile, &refs, &mut want);
             let mut got = RewriteResult::default();
             rewrite_one_npm_lock(&text, lockfile, &refs, &mut got);
-            assert_same(&want, &got, &format!("seed {seed} {lockfile}"));
-            crate::golden::record(&(&text, lockfile, &deps), &got);
+            record(&(&text, lockfile, &deps), &got);
             edits += got.edits.len();
             codes.extend(got.warnings.iter().map(|w| w.code.clone()));
         }
@@ -231,9 +229,9 @@ fn yarn_block(rng: &mut Rng, pool: &mut Vec<(String, String)>, i: usize) -> Stri
 }
 
 #[test]
-fn indexed_yarn_classic_rewrite_matches_oracle() {
-    let sweep = crate::golden::Sweep::with(
-        crate::golden::Golden::new(
+fn indexed_yarn_classic_rewrite_matches_golden() {
+    let sweep = Sweep::with(
+        Golden::new(
             "yarn_classic_rewrite",
             "One seeded yarn.lock (v1) + overrides.",
         )
@@ -259,12 +257,9 @@ fn indexed_yarn_classic_rewrite_matches_oracle() {
         }
         let files = BTreeMap::from([("yarn.lock".to_string(), text)]);
         let deps = overrides(&pool, &mut rng);
-        let mut want = RewriteResult::default();
-        rewrite_yarn_classic_oracle(&files, &deps, &mut want);
         let mut got = RewriteResult::default();
         rewrite_yarn_classic(&files, &deps, &mut got);
-        assert_same(&want, &got, &format!("seed {seed}"));
-        crate::golden::record(&(&files, &deps), &got);
+        record(&(&files, &deps), &got);
         edits += got.edits.len();
         codes.extend(got.warnings.iter().map(|w| w.code.clone()));
     }
@@ -279,316 +274,3 @@ fn indexed_yarn_classic_rewrite_matches_oracle() {
     }
     sweep.finish();
 }
-
-// ── oracles: the pre-index implementations, verbatim ────────────────────────
-
-fn rewrite_one_npm_lock_oracle(
-    content: &str,
-    lockfile: &str,
-    npm: &[&DepOverride],
-    result: &mut RewriteResult,
-) {
-    let Ok(mut lock) = serde_json::from_str::<Value>(content) else {
-        // A corrupt lockfile is strictly worse than a missing one (which
-        // warns in the caller) — never skip the whole npm redirect silently.
-        result.warnings.push(RewriteWarning {
-            code: "redirect_npm_lock_unparseable".into(),
-            detail: format!("{lockfile} is not valid JSON; npm redirect skipped"),
-        });
-        return;
-    };
-    let mut changed = false;
-    for dep in npm {
-        let fname = full_name(dep);
-        let Some(sha512) = dep.integrity.sha512.clone() else {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_npm_missing_sha512".into(),
-                detail: format!("{fname}@{} has no sha512 integrity", dep.version),
-            });
-            continue;
-        };
-        let mut matched_any = false;
-        if let Some(packages) = lock.get_mut("packages").and_then(Value::as_object_mut) {
-            for (key, entry) in packages.iter_mut() {
-                // Only `node_modules/` keys are installable dependencies:
-                // "" is the project root and other bare keys are workspace
-                // members — SOURCE dirs a resolved/integrity insert would
-                // corrupt.
-                let Some((_, key_name)) = key.rsplit_once("node_modules/") else {
-                    continue;
-                };
-                // The package a lock entry stands for: the explicit `name`
-                // field when present (npm writes it for aliases — `npm i
-                // alias@npm:real` keys the entry by the ALIAS), else the
-                // key's trailing path. Mirrors `vendor::npm_lock`'s
-                // `entry_name`, so an alias install of the patched package
-                // redirects and an entry that merely SHARES the key name
-                // (`npm i <fname>@npm:other`) is never hijacked.
-                let entry_nm = entry
-                    .get("name")
-                    .and_then(Value::as_str)
-                    .unwrap_or(key_name);
-                let matches_ver =
-                    entry.get("version").and_then(Value::as_str) == Some(dep.version.as_str());
-                if entry_nm != fname || !matches_ver {
-                    continue;
-                }
-                if entry.get("link").and_then(Value::as_bool) == Some(true) {
-                    matched_any = true;
-                    result.warnings.push(RewriteWarning {
-                        code: "redirect_npm_link_entry_skipped".into(),
-                        detail: format!(
-                            "lock entry `{key}` is a link (npm workspaces/file: dir); skipped"
-                        ),
-                    });
-                    continue;
-                }
-                // npm reify extracts a bundled copy from its PARENT's tarball
-                // and ignores the entry's resolved/integrity, so a rewrite
-                // here would put the hosted URL in the lockfile (confirming
-                // and VEX-attesting the patch) while the unpatched bundled
-                // bytes keep installing. Mirrors the vendored backend's
-                // `vendor_bundled_instance_skipped` refusal.
-                if entry.get("inBundle").and_then(Value::as_bool) == Some(true) {
-                    matched_any = true;
-                    result.warnings.push(RewriteWarning {
-                        code: "redirect_npm_bundled_instance_skipped".into(),
-                        detail: format!(
-                            "lock entry `{key}` is bundled inside its parent's tarball and \
-                             CANNOT be redirected — that copy stays UNPATCHED; vendor or \
-                             update the bundling parent to cover it"
-                        ),
-                    });
-                    continue;
-                }
-                matched_any = true;
-                if let Some(edit) = rewrite_npm_entry(
-                    entry,
-                    dep,
-                    &sha512,
-                    lockfile,
-                    "redirect_npm_lock_entry",
-                    key,
-                ) {
-                    result.edits.push(edit);
-                    changed = true;
-                }
-            }
-        }
-        // v2 legacy `dependencies` tree (keyed by name), recursive.
-        if let Some(deps) = lock.get_mut("dependencies").and_then(Value::as_object_mut) {
-            changed = rewrite_npm_v2_deps(
-                deps,
-                &fname,
-                dep,
-                &sha512,
-                lockfile,
-                result,
-                &mut matched_any,
-            ) || changed;
-        }
-        // Parity with the pnpm/berry/uv rewriters: a granted dep the
-        // lockfile cannot pin must be SAID, not silently dropped from the
-        // redirected count.
-        if !matched_any {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_npm_entry_not_found".into(),
-                detail: format!("no {lockfile} entry for {fname}@{}", dep.version),
-            });
-        }
-    }
-    if changed {
-        // npm <= 6 (the only writer of lockfileVersion 1) installs a registry
-        // dependency from the CONFIGURED registry and ignores the entry's
-        // `resolved` — verified against real npm 6.14.18, while npm 7 / 11
-        // fetch the rewritten url from the same v1 lock. Under npm 6 the
-        // redirected lock therefore fails EINTEGRITY against the patched
-        // sha512 pin (fail-closed: the unpatched bytes never install). Say
-        // so instead of letting an npm 6 CI discover it.
-        if lock.get("lockfileVersion").and_then(Value::as_u64) == Some(1) {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_npm_legacy_client".into(),
-                detail: format!(
-                    "{lockfile} is lockfileVersion 1 (written by npm <= 6). npm <= 6 installs \
-                     registry dependencies from the configured registry and ignores the \
-                     redirected `resolved` url, so its installs fail EINTEGRITY against the \
-                     patched sha512 pin (the unpatched bytes are never installed); install \
-                     with npm >= 7, which fetches the hosted patch (and upgrades the lock)"
-                ),
-            });
-        }
-        result.files.insert(lockfile.into(), serialize_json(&lock));
-    }
-}
-
-fn rewrite_yarn_classic_oracle(
-    files: &BTreeMap<String, String>,
-    overrides: &[DepOverride],
-    result: &mut RewriteResult,
-) {
-    use crate::vendor::yarn_classic_lock::{pattern_real_name, split_key_patterns, split_pattern};
-
-    let npm: Vec<&DepOverride> = overrides.iter().filter(|o| o.ecosystem == "npm").collect();
-    if npm.is_empty() || !files.contains_key("yarn.lock") {
-        return;
-    }
-    let raw = &files["yarn.lock"];
-    if is_berry_lock(raw) {
-        return; // yarn-berry — not classic
-    }
-    // CRLF locks (core.autocrlf Windows checkouts — yarn v1 parses them fine)
-    // are processed LF-normalized and re-expanded on output, so untouched
-    // lines round-trip byte-identically. Without this, `split("\n\n")` never
-    // splits a CRLF file: the whole lock becomes ONE block and the
-    // leftmost-match replaces below would rewrite the FIRST entry in the
-    // file, not the target's. Bare `\r`s outside a CRLF pair make the
-    // round-trip lossy, so such a lock is refused untouched.
-    let crlf = raw.contains('\r');
-    let normalized: String;
-    let content: &str = if crlf {
-        normalized = raw.replace("\r\n", "\n");
-        if normalized.contains('\r') {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_yarn_classic_unsupported_line_endings".into(),
-                detail: "yarn.lock contains bare carriage returns (mixed line endings); \
-                         leaving it untouched"
-                    .into(),
-            });
-            return;
-        }
-        &normalized
-    } else {
-        raw
-    };
-    let mut blocks: Vec<String> = content.split("\n\n").map(String::from).collect();
-    let resolved_re =
-        Regex::new(r#"\n {2}resolved "[^"]*""#).expect("static resolved-line regex is valid");
-    let integrity_re =
-        Regex::new(r"\n {2}integrity [^\n]*").expect("static integrity-line regex is valid");
-    let mut changed = false;
-    for dep in &npm {
-        let fname = full_name(dep);
-        let Some(sha512) = dep.integrity.sha512.clone() else {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_yarn_classic_missing_sha512".into(),
-                detail: format!("{fname}@{} has no sha512 integrity", dep.version),
-            });
-            continue;
-        };
-        let version_re =
-            Regex::new(&(String::from(r#"\n {2}version ""#) + &regex::escape(&dep.version) + "\""))
-                .expect("version regex from the escaped version is valid");
-        let mut matched_any = false;
-        let mut alias_skipped = false;
-        for block in blocks.iter_mut() {
-            // The block's key line names its consumers; resolve every
-            // comma-joined pattern to the REAL package it stands for
-            // (`alias@npm:target@range` → target). A key like
-            // `<fname>@npm:<other-pkg>@…` — yarn v1's fork-substitution
-            // idiom — resolves to <other-pkg>, so it is NOT ours to touch:
-            // matching on the alias name alone would hijack the fork.
-            let Some(key_line) = block
-                .lines()
-                .find(|l| !l.is_empty() && !l.starts_with([' ', '\t', '#']))
-            else {
-                continue;
-            };
-            let Some(key) = key_line.strip_suffix(':') else {
-                continue;
-            };
-            let patterns = split_key_patterns(key);
-            if patterns.is_empty()
-                || !patterns
-                    .iter()
-                    .all(|p| pattern_real_name(p) == Some(fname.as_str()))
-            {
-                continue;
-            }
-            if !version_re.is_match(block) {
-                continue;
-            }
-            // A block reached only through `alias@npm:<fname>@range`
-            // descriptors is left byte-identical (mirroring the berry
-            // rewriter), but never silently: that copy keeps installing the
-            // unpatched artifact.
-            if !patterns
-                .iter()
-                .any(|p| split_pattern(p).is_some_and(|(n, _)| n == fname))
-            {
-                alias_skipped = true;
-                result.warnings.push(RewriteWarning {
-                    code: "redirect_yarn_classic_alias_skipped".into(),
-                    detail: format!(
-                        "lock entry `{key}` consumes {fname}@{} only through npm: alias \
-                         descriptors; the hosted redirect does not rewrite alias entries, \
-                         so this copy stays unpatched",
-                        dep.version
-                    ),
-                });
-                continue;
-            }
-            matched_any = true;
-            let frag = dep
-                .integrity
-                .sha1
-                .as_ref()
-                .map(|s| format!("#{s}"))
-                .unwrap_or_default();
-            let mut rewritten = resolved_re
-                .replace(
-                    block,
-                    format!("\n  resolved \"{}{frag}\"", dep.artifact_url).as_str(),
-                )
-                .to_string();
-            if integrity_re.is_match(&rewritten) {
-                rewritten = integrity_re
-                    .replace(&rewritten, format!("\n  integrity {sha512}").as_str())
-                    .to_string();
-            } else {
-                rewritten = resolved_re
-                    .replace(
-                        &rewritten,
-                        // $0 re-inserts the matched resolved line, then add integrity.
-                        format!(
-                            "\n  resolved \"{}{frag}\"\n  integrity {sha512}",
-                            dep.artifact_url
-                        )
-                        .as_str(),
-                    )
-                    .to_string();
-            }
-            if rewritten != *block {
-                // Ledger originals record the on-disk byte form, so a future
-                // revert of a CRLF lock can match what the file really held.
-                let (edit_original, edit_new) = if crlf {
-                    (block.replace('\n', "\r\n"), rewritten.replace('\n', "\r\n"))
-                } else {
-                    (block.clone(), rewritten.clone())
-                };
-                result.edits.push(FileEdit {
-                    path: "yarn.lock".into(),
-                    kind: "redirect_yarn_classic_entry".into(),
-                    action: "rewritten".into(),
-                    key: Some(format!("{fname}@{}", dep.version)),
-                    original: Some(Value::String(edit_original)),
-                    new: Some(Value::String(edit_new)),
-                });
-                *block = rewritten;
-                changed = true;
-            }
-        }
-        if !matched_any && !alias_skipped {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_yarn_classic_entry_not_found".into(),
-                detail: format!("no yarn.lock entry resolving {fname}@{}", dep.version),
-            });
-        }
-    }
-    if changed {
-        let mut out = blocks.join("\n\n");
-        if crlf {
-            out = out.replace('\n', "\r\n");
-        }
-        result.files.insert("yarn.lock".into(), out);
-    }
-}
diff --git a/crates/socket-patch-core/src/patch/redirect/mod.rs b/crates/socket-patch-core/src/patch/redirect/mod.rs
index 0c5dd7259..3950a97d0 100644
--- a/crates/socket-patch-core/src/patch/redirect/mod.rs
+++ b/crates/socket-patch-core/src/patch/redirect/mod.rs
@@ -44,9 +44,7 @@ pub mod npmrc;
 mod pdm;
 mod pipenv;
 pub mod presence;
-// The pnpm entry grammar and hosted planner live with the format's model.
-#[cfg(test)]
-use crate::formats::pnpm::grammar as pnpm;
+// The pnpm hosted planner lives with the format's model.
 use crate::formats::pnpm::plan_hosted;
 use crate::formats::cargo::CargoLock;
 use crate::formats::composer::hosted::rewrite_composer_lock;
@@ -63,8 +61,6 @@ mod poetry;
 #[cfg(test)]
 mod python_lock_equivalence_tests;
 mod requirements;
-#[cfg(test)]
-mod rewrite_oracle_support;
 mod staged;
 mod state;
 mod hosted_url;
diff --git a/crates/socket-patch-core/src/patch/redirect/pnpm_equivalence_tests.rs b/crates/socket-patch-core/src/patch/redirect/pnpm_equivalence_tests.rs
index a5b3d25ac..55fb88acb 100644
--- a/crates/socket-patch-core/src/patch/redirect/pnpm_equivalence_tests.rs
+++ b/crates/socket-patch-core/src/patch/redirect/pnpm_equivalence_tests.rs
@@ -1,22 +1,19 @@
-//! Equivalence oracle for the indexed pnpm hosted rewriter: the previous
-//! implementation (re-parse every lock per dep, splice per dep) is kept here
-//! verbatim as `rewrite_pnpm_lock_oracle`, and the production
-//! `plan_hosted` must produce the identical `RewriteResult` — output
-//! bytes, the FileEdit list (order and `original` fragments), warnings and
-//! refusals — on depscan-sized synthetic locks and on randomized mixes of
-//! every lock flavor the grammar handles.
+//! Depscan-sized and seeded pnpm-lock.yaml sweeps for the indexed hosted
+//! rewriter (one parse per lock, every dep spliced from it): output bytes,
+//! the FileEdit list (order and `original` fragments), warnings and
+//! refusals are pinned per case by `tests/equivalence/pnpm_*.golden`,
+//! blessed while the per-dep re-parsing rewriter still ran beside it as an
+//! oracle.
 
-use super::rewrite_oracle_support::{assert_same, Rng};
 use super::*;
+use crate::golden::{record, Sweep};
+use crate::test_rng::Rng;
 
-/// Run both implementations and assert they agree; returns the result.
-fn assert_equivalent(files: &BTreeMap<String, String>, overrides: &[DepOverride]) -> RewriteResult {
-    let mut want = RewriteResult::default();
-    rewrite_pnpm_lock_oracle(files, overrides, &mut want);
+/// The production rewriter, recorded into the running sweep.
+fn run(files: &BTreeMap<String, String>, overrides: &[DepOverride]) -> RewriteResult {
     let mut got = RewriteResult::default();
     plan_hosted(files, overrides, &mut got);
-    assert_same(&want, &got, "pnpm");
-    crate::golden::record(&(files, overrides), &got);
+    record(&(files, overrides), &got);
     got
 }
 
@@ -219,8 +216,8 @@ fn packages(n: usize, rng: &mut Rng) -> Vec<Pkg> {
 /// already-hosted, residual (unbalanced peer suffix), vendored, not-found and
 /// missing-sha512 deps, plus a non-npm override the rewriter must ignore.
 #[test]
-fn indexed_pnpm_rewrite_matches_oracle_on_depscan_sized_lock_set() {
-    let sweep = crate::golden::Sweep::start(
+fn indexed_pnpm_rewrite_matches_golden_on_depscan_sized_lock_set() {
+    let sweep = Sweep::start(
         "pnpm_depscan_sized",
         "A depscan-sized seeded pnpm-lock.yaml set + shuffled overrides.",
     );
@@ -317,7 +314,7 @@ fn indexed_pnpm_rewrite_matches_oracle_on_depscan_sized_lock_set() {
         shuffled.push(overrides.remove(i));
     }
 
-    let r = assert_equivalent(&files, &shuffled);
+    let r = run(&files, &shuffled);
     // The fixture must actually exercise the interesting paths.
     assert!(r.edits.len() > 90, "edits: {}", r.edits.len());
     assert_eq!(r.files.len(), 3, "{:?}", r.files.keys());
@@ -338,7 +335,7 @@ fn indexed_pnpm_rewrite_matches_oracle_on_depscan_sized_lock_set() {
 /// is the first's `new`), exactly as the per-dep re-parse did.
 #[test]
 fn duplicate_override_sees_the_prior_rewrite() {
-    let sweep = crate::golden::Sweep::start(
+    let sweep = Sweep::start(
         "pnpm_duplicate_override",
         "A pnpm lock whose overrides repeat a package.",
     );
@@ -350,7 +347,7 @@ fn duplicate_override_sees_the_prior_rewrite() {
     let files = BTreeMap::from([("pnpm-lock.yaml".to_string(), lock.to_string())]);
     let first = dep(&p, 1, "a", Some("sha512-FIRST=="));
     let second = dep(&p, 2, "b", Some("sha512-SECOND=="));
-    let r = assert_equivalent(&files, &[first.clone(), second.clone()]);
+    let r = run(&files, &[first.clone(), second.clone()]);
     assert_eq!(r.edits.len(), 4, "{:#?}", r.edits);
     for i in 0..2 {
         assert_eq!(r.edits[i + 2].original, r.edits[i].new, "edit {i}");
@@ -363,7 +360,7 @@ fn duplicate_override_sees_the_prior_rewrite() {
     );
     assert!(!out.contains(first.artifact_url.as_str()), "{out}");
     // The same pair with identical artifacts: the second is a no-op.
-    let r = assert_equivalent(&files, &[second.clone(), second]);
+    let r = run(&files, &[second.clone(), second]);
     assert_eq!(r.edits.len(), 2, "{:#?}", r.edits);
     sweep.finish();
 }
@@ -373,7 +370,7 @@ fn duplicate_override_sees_the_prior_rewrite() {
 /// contexts and a v5 `_` suffix in a second lock.
 #[test]
 fn peer_suffixed_instances_rewrite_in_file_order() {
-    let sweep = crate::golden::Sweep::start(
+    let sweep = Sweep::start(
         "pnpm_peer_suffixed",
         "A pnpm lock with peer-suffixed instances of one package.",
     );
@@ -387,7 +384,7 @@ fn peer_suffixed_instances_rewrite_in_file_order() {
         name: "@s/p".into(),
         version: "1.0.0".into(),
     };
-    let r = assert_equivalent(&files, &[dep(&p, 1, "a", Some("sha512-P=="))]);
+    let r = run(&files, &[dep(&p, 1, "a", Some("sha512-P=="))]);
     let keys: Vec<(&str, &str)> = r
         .edits
         .iter()
@@ -413,8 +410,8 @@ fn peer_suffixed_instances_rewrite_in_file_order() {
 /// early shrinkwrap and CRLF), with overrides drawn so hits, duplicates,
 /// residuals and misses all interleave.
 #[test]
-fn indexed_pnpm_rewrite_matches_oracle_on_random_lock_sets() {
-    let sweep = crate::golden::Sweep::start(
+fn indexed_pnpm_rewrite_matches_golden_on_random_lock_sets() {
+    let sweep = Sweep::start(
         "pnpm_random",
         "One seeded pnpm-lock.yaml set (every flavor) + overrides.",
     );
@@ -512,7 +509,7 @@ fn indexed_pnpm_rewrite_matches_oracle_on_random_lock_sets() {
                 overrides.push(dep(&p, i + 100, tag, Some(&sri("DUP"))));
             }
         }
-        let r = assert_equivalent(&files, &overrides);
+        let r = run(&files, &overrides);
         if !r.edits.is_empty() {
             outcomes.insert("edit".into());
         }
@@ -546,232 +543,3 @@ fn indexed_pnpm_rewrite_matches_oracle_on_random_lock_sets() {
     }
     sweep.finish();
 }
-
-// ── oracle: the pre-index implementation, verbatim ──────────────────────────
-
-fn rewrite_pnpm_lock_oracle(
-    files: &BTreeMap<String, String>,
-    overrides: &[DepOverride],
-    result: &mut RewriteResult,
-) {
-    let npm: Vec<&DepOverride> = overrides.iter().filter(|o| o.ecosystem == "npm").collect();
-    // A pnpm lock lives at the project root or at any nested path (e.g. Rush
-    // repos keep them under `common/config/rush/`); every such files-map key
-    // is rewritten under the same grammar. Deterministic order: BTreeMap
-    // iterates keys sorted, so goldens are stable across every lock in the set.
-    let lock_keys: Vec<&String> = files
-        .keys()
-        .filter(|k| {
-            matches!(
-                k.rsplit('/').next(),
-                Some("pnpm-lock.yaml" | "shrinkwrap.yaml")
-            )
-        })
-        .collect();
-    if npm.is_empty() || lock_keys.is_empty() {
-        return;
-    }
-    let mut contents: Vec<(&String, String, bool)> = lock_keys
-        .iter()
-        .map(|k| (*k, files[*k].clone(), false))
-        .collect();
-    for dep in &npm {
-        let fname = full_name(dep);
-        let unsafe_locks: Vec<_> = contents
-            .iter()
-            .filter(|(_, content, _)| {
-                pnpm::unsupported_early_shrinkwrap(content)
-                    && pnpm::entries(content)
-                        .iter()
-                        .any(|e| pnpm::suffix(e.key, &fname, &dep.version).is_some())
-            })
-            .map(|(path, _, _)| path.as_str())
-            .collect();
-        if !unsafe_locks.is_empty() {
-            result.refused_pnpm_uuids.insert(dep.patch_uuid.clone());
-            result.warnings.push(RewriteWarning {
-                code: "redirect_pnpm_legacy_lockfile_unsupported".into(),
-                detail: format!("{} uses early pnpm 1 shrinkwrapVersion 3 without a supported minor version. Those installers discard hosted tarball URLs; {fname}@{} was left unchanged in every lock. Upgrade to a tested pnpm release (1.43.1 or newer) and regenerate the lock, or use `scan --mode agent` for installed-file patching.", unsafe_locks.join(", "), dep.version),
-            });
-            continue;
-        }
-        let Some(sha512) = dep.integrity.sha512.clone() else {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_pnpm_missing_sha512".into(),
-                detail: format!("{fname}@{} has no sha512 integrity", dep.version),
-            });
-            continue;
-        };
-        // Every peer instance must be redirected, including nested peer
-        // contexts and the block resolutions emitted by pnpm 1–5.
-        let mut matched_any = false;
-        // Per-lock rewrites are PLANNED first and committed only after the
-        // residual gate below proves no instance of this dep escaped the
-        // splice grammar in ANY lock — committing lock-by-lock as we go
-        // would ship exactly the partial rewrite the gate exists to refuse.
-        let mut planned: Vec<(usize, String, Vec<FileEdit>)> = Vec::new();
-        let mut residuals: Vec<(&str, Vec<String>)> = Vec::new();
-        for (idx, (lock_key, content, _)) in contents.iter().enumerate() {
-            // (byte range to replace, replacement text) per instance, plus
-            // one FileEdit per instance keyed by the canonical instance key —
-            // per-instance edits keep the revert ledger lossless when several
-            // instances of one dep live in the same lock.
-            let mut splices: Vec<(std::ops::Range<usize>, String)> = Vec::new();
-            let mut instance_edits: Vec<FileEdit> = Vec::new();
-            for entry in pnpm::entries(content) {
-                let Some(suffix) = pnpm::suffix(entry.key, &fname, &dep.version) else {
-                    continue;
-                };
-                if !pnpm::supported_suffix(suffix) {
-                    continue;
-                }
-                let Some(resolution) = pnpm::resolution(&entry) else {
-                    continue;
-                };
-                matched_any = true;
-                let original = &content[resolution.range.clone()];
-                let rebuilt = resolution.rewrite(&sha512, &dep.artifact_url);
-                if rebuilt == original {
-                    continue;
-                }
-                splices.push((resolution.range, rebuilt.clone()));
-                instance_edits.push(FileEdit {
-                    path: (*lock_key).clone(),
-                    kind: "redirect_pnpm_resolution".into(),
-                    action: "rewritten".into(),
-                    key: Some(format!("{fname}@{}{suffix}", dep.version)),
-                    original: Some(Value::String(original.to_string())),
-                    new: Some(Value::String(rebuilt)),
-                });
-            }
-            // Splice by byte range (package blocks are disjoint and ordered) — a string replace could hit the wrong
-            // instance when two entries share identical surrounding bytes.
-            let candidate: Option<String> = if splices.is_empty() {
-                None
-            } else {
-                let mut out = String::with_capacity(content.len());
-                let mut cursor = 0usize;
-                for (range, replacement) in splices {
-                    out.push_str(&content[cursor..range.start]);
-                    out.push_str(&replacement);
-                    cursor = range.end;
-                }
-                out.push_str(&content[cursor..]);
-                Some(out)
-            };
-            // Residual gate, run over the POST-splice text: any instance of
-            // this exact name@version still resolving somewhere other than
-            // the hosted artifact — in a spelling the splice grammar cannot
-            // parse (e.g. an unbalanced peer suffix) — makes this a partial
-            // rewrite. Shipping it would confirm and VEX-attest the dep while
-            // dependents through the unmatched instance keep installing the
-            // unpatched upstream tarball, so the dep is refused instead.
-            let leftover = pnpm_unrewritten_instances(
-                candidate.as_deref().unwrap_or(content),
-                &fname,
-                &dep.version,
-                &dep.artifact_url,
-            );
-            if !leftover.is_empty() {
-                residuals.push(((*lock_key).as_str(), leftover));
-                continue;
-            }
-            if let Some(out) = candidate {
-                planned.push((idx, out, instance_edits));
-            }
-        }
-        // ANY residual anywhere refuses the dep across the WHOLE lock set —
-        // nothing rewritten, nothing recorded, nothing confirmed (the same
-        // fail-closed contract the pre-splice v5/v6 refusal had): a rewrite
-        // committed in one lock while another still resolves the dep
-        // upstream would confirm the dep set-wide.
-        if !residuals.is_empty() {
-            result.refused_pnpm_uuids.insert(dep.patch_uuid.clone());
-            for (lock_key, keys) in &residuals {
-                result.warnings.push(RewriteWarning {
-                    code: "redirect_pnpm_unsupported_lock_key".into(),
-                    detail: format!(
-                        "{fname}@{} still resolves through pnpm lock key(s) whose \
-                         resolution the redirect grammar cannot repoint: {} in \
-                         {lock_key}; the dep is left unredirected in EVERY lock \
-                         (nothing rewritten, nothing confirmed) — regenerate the \
-                         lock with a current pnpm (lockfileVersion 9) and re-run",
-                        dep.version,
-                        keys.join(", ")
-                    ),
-                });
-            }
-            continue;
-        }
-        for (idx, out, mut instance_edits) in planned {
-            let (_, content, changed) = &mut contents[idx];
-            *content = out;
-            *changed = true;
-            result.edits.append(&mut instance_edits);
-        }
-        // The entry-not-found warning fires only when the dep matched in NO
-        // pnpm lock across the whole set, not once per lock. A VENDORED dep
-        // is named as such: `socket-patch vendor` removes the registry
-        // resolution this grammar looks for (v9 respells the packages key
-        // `<name>@file:.socket/vendor/…`; v5/v6 rekey it to a bare `file:`
-        // key but keep the `<name>@<version>: file:…` overrides line), so
-        // the generic not-locked wording would send users on a wild-goose
-        // `pnpm install` when the real path is a mode switch. Fail-closed
-        // either way: nothing is rewritten for the dep.
-        if !matched_any {
-            let v9_vendored_key = format!("{fname}@file:");
-            let override_key = format!("{fname}@{}", dep.version);
-            let vendored = contents.iter().any(|(_, content, _)| {
-                content.lines().any(|line| {
-                    let t = line.trim_start();
-                    let t = t.strip_prefix('\'').unwrap_or(t);
-                    // v9 packages/snapshots key (leading `/` in v6 spelling).
-                    // The vendor backend always writes the RELATIVE
-                    // `file:.socket/vendor/…` spelling here, so anchoring on
-                    // it keeps a user's own `file:` dep of the same name
-                    // from being misreported as vendored.
-                    let key = t.strip_prefix('/').unwrap_or(t);
-                    if key
-                        .strip_prefix(&v9_vendored_key)
-                        .is_some_and(|rest| rest.starts_with(".socket/vendor/"))
-                    {
-                        return true;
-                    }
-                    // overrides / root-dep line: `<name>@<version>: file:…`
-                    // (pnpm <=8 absolutizes the value, so only the
-                    // `.socket/vendor/` tail is stable enough to match).
-                    t.strip_prefix(&override_key)
-                        .map(|rest| rest.strip_prefix('\'').unwrap_or(rest))
-                        .and_then(|rest| rest.strip_prefix(':'))
-                        .is_some_and(|rest| {
-                            rest.contains("file:") && rest.contains(".socket/vendor/")
-                        })
-                })
-            });
-            if vendored {
-                result.warnings.push(RewriteWarning {
-                    code: "redirect_pnpm_entry_vendored".into(),
-                    detail: format!(
-                        "{fname}@{} has no registry resolution because it is \
-                         VENDORED (the lock resolves it to a \
-                         file:.socket/vendor/… tarball); the hosted redirect \
-                         does not apply — run `socket-patch vendor --revert` to \
-                         restore the registry resolution, then re-run `scan \
-                         --mode hosted`",
-                        dep.version
-                    ),
-                });
-            } else {
-                result.warnings.push(RewriteWarning {
-                    code: "redirect_pnpm_entry_not_found".into(),
-                    detail: format!("no resolution for {fname}@{}", dep.version),
-                });
-            }
-        }
-    }
-    for (key, content, changed) in contents {
-        if changed {
-            result.files.insert(key.clone(), content);
-        }
-    }
-}
diff --git a/crates/socket-patch-core/src/patch/redirect/python_lock_equivalence_tests.rs b/crates/socket-patch-core/src/patch/redirect/python_lock_equivalence_tests.rs
index 017bd6555..00c7b138c 100644
--- a/crates/socket-patch-core/src/patch/redirect/python_lock_equivalence_tests.rs
+++ b/crates/socket-patch-core/src/patch/redirect/python_lock_equivalence_tests.rs
@@ -1,184 +1,28 @@
-//! Equivalence oracle for the hosted uv.lock / pylock / PEP 723 rewriter,
-//! which now parses each lock once and plans, applies and completes every
-//! dep against that one document. The previous implementation (three parses
-//! and two renders per dep) is kept here verbatim, over the verbatim text
-//! rewriters in `utils::python_lock::oracle`, and the production rewriter
-//! must produce the identical output bytes, FileEdit list, warnings and
-//! confirmed / refused sets on randomized locks — including CRLF and
-//! mixed-ending locks, refusals in the middle of the dep list, duplicate
-//! overrides and metadata completion.
+//! Seeded uv.lock / pylock / PEP 723 sweep for the hosted rewriter, which
+//! parses each lock once and plans, applies and completes every dep against
+//! that one document: CRLF and mixed-ending locks, refusals in the middle of
+//! the dep list, duplicate overrides and metadata completion. Output bytes,
+//! FileEdits, warnings and confirmed / refused sets are pinned per case by
+//! `tests/equivalence/python_lock_*.golden`, blessed while the previous
+//! rewriter (three parses and two renders per dep) still ran beside it as
+//! an oracle.
 
 use super::*;
-use crate::utils::python_lock::oracle;
+use crate::golden::{record, Golden, Sweep};
+use crate::test_rng::Rng;
 
-/// `rewrite_uv_lock` before the single-parse session, verbatim except for
-/// the two text rewriters, which are their verbatim oracles.
-fn rewrite_uv_lock_oracle(
-    files: &BTreeMap<String, String>,
-    overrides: &[DepOverride],
-    python_metadata: &BTreeMap<String, String>,
-    result: &mut RewriteResult,
-) {
-    use crate::utils::python_lock::{is_python_lock_name, ArtifactSource};
-    use oracle::{complete_python_lock_metadata, rewrite_python_lock};
-
-    let locks: Vec<(&String, &String)> = files
-        .iter()
-        .filter(|(path, _)| is_python_lock_name(path))
-        .collect();
-    if locks.is_empty() {
-        return;
-    }
-    let mut usable: Vec<(&DepOverride, &str)> = Vec::new();
-    for dep in overrides.iter().filter(|dep| dep.ecosystem == "pypi") {
-        result.python_lock_uuids.insert(dep.patch_uuid.clone());
-        match dep.integrity.sha256.as_deref() {
-            Some(sha256) => usable.push((dep, sha256)),
-            None => result.warnings.push(RewriteWarning {
-                code: "redirect_uv_missing_sha256".into(),
-                detail: format!("{} has no sha256 integrity", dep.name),
-            }),
-        }
-    }
-    for (path, original) in locks {
-        let mut content = original.clone();
-        for &(dep, sha256) in &usable {
-            let rewritten = match rewrite_python_lock(
-                &content,
-                &dep.name,
-                &dep.version,
-                ArtifactSource::Url(&dep.artifact_url),
-                sha256,
-            ) {
-                Ok(Some(rewritten)) => rewritten,
-                Ok(None) => {
-                    result.warnings.push(RewriteWarning {
-                        code: "redirect_uv_entry_not_found".into(),
-                        detail: format!("no {path} archive entry for {}@{}", dep.name, dep.version),
-                    });
-                    continue;
-                }
-                Err(detail) => {
-                    result
-                        .refused_python_lock_uuids
-                        .insert(dep.patch_uuid.clone());
-                    result.warnings.push(RewriteWarning {
-                        code: "redirect_uv_lock_unsupported".into(),
-                        detail: format!("{path}: {detail}"),
-                    });
-                    continue;
-                }
-            };
-            let (metadata_edit, project) =
-                match plan_python_metadata(path, &content, files, dep, result) {
-                    Ok(plan) => plan,
-                    Err(warning) => {
-                        result
-                            .refused_python_lock_uuids
-                            .insert(dep.patch_uuid.clone());
-                        result.warnings.push(warning);
-                        continue;
-                    }
-                };
-            let rewritten = match complete_python_lock_metadata(
-                &rewritten,
-                project.as_deref(),
-                &dep.name,
-                &dep.version,
-                ArtifactSource::Url(&dep.artifact_url),
-                python_metadata.get(&dep.artifact_url).map(String::as_str),
-            ) {
-                Ok(rewritten) => rewritten,
-                Err(detail) => {
-                    result
-                        .refused_python_lock_uuids
-                        .insert(dep.patch_uuid.clone());
-                    result.warnings.push(RewriteWarning {
-                        code: "redirect_uv_metadata_unsupported".into(),
-                        detail: format!("{path}: {detail}"),
-                    });
-                    continue;
-                }
-            };
-            result
-                .confirmed_python_lock_uuids
-                .insert(dep.patch_uuid.clone());
-            if let Some(edit) = metadata_edit {
-                record_python_metadata_edit(edit, dep, result);
-            }
-            if rewritten != content {
-                record_python_lock_edits(path, dep, &content, &rewritten, result);
-                content = rewritten;
-            }
-        }
-        if content != *original {
-            result.files.insert(path.clone(), content);
-        }
-    }
-}
-
-fn assert_same(want: &RewriteResult, got: &RewriteResult, what: &str) {
-    assert_eq!(got.files, want.files, "{what}: rewritten bytes");
-    assert_eq!(got.edits.len(), want.edits.len(), "{what}: edit count");
-    for (i, (g, w)) in got.edits.iter().zip(&want.edits).enumerate() {
-        assert_eq!(g, w, "{what}: edit #{i}");
-    }
-    let warnings = |r: &RewriteResult| {
-        r.warnings
-            .iter()
-            .map(|w| (w.code.clone(), w.detail.clone()))
-            .collect::<Vec<_>>()
-    };
-    assert_eq!(warnings(got), warnings(want), "{what}: warnings in order");
-    assert_eq!(got.python_lock_uuids, want.python_lock_uuids, "{what}");
-    assert_eq!(
-        got.confirmed_python_lock_uuids, want.confirmed_python_lock_uuids,
-        "{what}: confirmed"
-    );
-    assert_eq!(
-        got.refused_python_lock_uuids, want.refused_python_lock_uuids,
-        "{what}: refused"
-    );
-}
-
-fn run_both(
+/// The production rewriter, recorded into the running sweep.
+fn run(
     files: &BTreeMap<String, String>,
     overrides: &[DepOverride],
     metadata: &BTreeMap<String, String>,
-    what: &str,
 ) -> RewriteResult {
-    let mut want = RewriteResult::default();
-    rewrite_uv_lock_oracle(files, overrides, metadata, &mut want);
     let mut got = RewriteResult::default();
     rewrite_uv_lock(files, overrides, metadata, &mut got);
-    assert_same(&want, &got, what);
-    crate::golden::record(&(files, overrides, metadata), &got);
+    record(&(files, overrides, metadata), &got);
     got
 }
 
-/// Deterministic xorshift64* — no `rand` dev-dependency.
-struct Rng(u64);
-
-impl Rng {
-    fn next(&mut self) -> u64 {
-        let mut x = self.0;
-        x ^= x >> 12;
-        x ^= x << 25;
-        x ^= x >> 27;
-        self.0 = x;
-        x.wrapping_mul(0x2545_F491_4F6C_DD1D)
-    }
-    fn below(&mut self, n: usize) -> usize {
-        (self.next() % n as u64) as usize
-    }
-    fn chance(&mut self, percent: u64) -> bool {
-        self.next() % 100 < percent
-    }
-    fn pick<'a>(&mut self, items: &[&'a str]) -> &'a str {
-        items[self.below(items.len())]
-    }
-}
-
 const HEX: &str = "ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6";
 
 /// A spelling of `pkg-<i>` that canonicalizes back to it.
@@ -520,7 +364,7 @@ type Case = (
 );
 
 fn case(seed: u64) -> Case {
-    let mut rng = Rng(seed.wrapping_mul(0x9E37_79B9_7F4A_7C15) | 1);
+    let mut rng = Rng::new(seed);
     let pool = 4 + rng.below(10);
     let mut files = BTreeMap::new();
     let mut any = false;
@@ -584,9 +428,9 @@ fn case(seed: u64) -> Case {
 }
 
 #[test]
-fn single_parse_uv_rewrite_matches_oracle() {
-    let sweep = crate::golden::Sweep::with(
-        crate::golden::Golden::new(
+fn single_parse_uv_rewrite_matches_golden() {
+    let sweep = Sweep::with(
+        Golden::new(
             "python_lock_rewrite",
             "One seeded uv / pylock / PEP 723 lock set + overrides + wheel metadata.",
         )
@@ -597,13 +441,13 @@ fn single_parse_uv_rewrite_matches_oracle() {
     let mut codes = std::collections::BTreeSet::new();
     for seed in 1..=1500u64 {
         let (files, overrides, metadata) = case(seed);
-        let got = run_both(&files, &overrides, &metadata, &format!("seed {seed}"));
+        let got = run(&files, &overrides, &metadata);
         rewritten += got.files.len();
         edits += got.edits.len();
         codes.extend(got.warnings.iter().map(|w| w.code.clone()));
     }
     // The generator must actually reach the rewrite paths and every refusal,
-    // or the oracle compares nothing.
+    // or the golden pins nothing.
     assert!(rewritten > 300, "only {rewritten} rewritten files");
     assert!(edits > 1000, "only {edits} edits");
     for code in [
@@ -624,7 +468,7 @@ fn single_parse_uv_rewrite_matches_oracle() {
 /// first dep left it — the session decides every refusal before mutating.
 #[test]
 fn refusal_in_the_middle_leaves_the_prior_rewrite_intact() {
-    let sweep = crate::golden::Sweep::start(
+    let sweep = Sweep::start(
         "python_lock_refusal",
         "A uv.lock + pyproject.toml whose middle dep is refused, LF and CRLF.",
     );
@@ -656,7 +500,7 @@ fn refusal_in_the_middle_leaves_the_prior_rewrite_intact() {
         // b's wheel metadata is unparseable: b is refused after a is applied.
         let mut metadata = BTreeMap::new();
         metadata.insert(overrides[1].artifact_url.clone(), "[broken".to_string());
-        let got = run_both(&files, &overrides, &metadata, "b refused");
+        let got = run(&files, &overrides, &metadata);
         assert!(got
             .refused_python_lock_uuids
             .contains(&overrides[1].patch_uuid));
@@ -678,72 +522,10 @@ fn refusal_in_the_middle_leaves_the_prior_rewrite_intact() {
             1,
         );
         files.insert("uv.lock".to_string(), with_manifest);
-        let got = run_both(&files, &overrides, &BTreeMap::new(), "bad overrides");
+        let got = run(&files, &overrides, &BTreeMap::new());
         assert!(got
             .refused_python_lock_uuids
             .contains(&overrides[1].patch_uuid));
     }
     sweep.finish();
 }
-
-/// Runs the oracle over the benchmark fixtures (real ~1.9 MB uv,
-/// pylock and PEP 723 locks, too large to commit) when
-/// `SOCKET_PATCH_PY_LOCK_FIXTURES` names their directory; a no-op otherwise.
-#[test]
-fn single_parse_uv_rewrite_matches_oracle_on_fixture_locks() {
-    let Some(root) = std::env::var_os("SOCKET_PATCH_PY_LOCK_FIXTURES") else {
-        return;
-    };
-    let root = std::path::PathBuf::from(root);
-    for (dir, lock, metadata_file) in [
-        ("uv-big", "uv.lock", Some("pyproject.toml")),
-        ("pylock-big", "pylock.toml", None),
-        ("script-big", "tool.py.lock", Some("tool.py")),
-    ] {
-        let read = |name: &str| std::fs::read_to_string(root.join(dir).join(name)).unwrap();
-        let text = read(lock);
-        let names: Vec<(String, String)> = {
-            let doc: toml_edit::DocumentMut = text.parse().unwrap();
-            let collection = if lock == "pylock.toml" {
-                "packages"
-            } else {
-                "package"
-            };
-            doc[collection]
-                .as_array_of_tables()
-                .unwrap()
-                .iter()
-                .filter_map(|t| {
-                    Some((
-                        t.get("name")?.as_str()?.to_string(),
-                        t.get("version")?.as_str()?.to_string(),
-                    ))
-                })
-                .collect()
-        };
-        for crlf in [false, true] {
-            let conv = |s: String| if crlf { s.replace('\n', "\r\n") } else { s };
-            let mut files = BTreeMap::new();
-            files.insert(lock.to_string(), conv(text.clone()));
-            if let Some(m) = metadata_file {
-                files.insert(m.to_string(), conv(read(m)));
-            }
-            let mut rng = Rng(0x5eed + crlf as u64);
-            let mut overrides = Vec::new();
-            let mut metadata = BTreeMap::new();
-            for (n, (name, version)) in names.iter().step_by(29).enumerate() {
-                let mut d = dep(0, version, n, &mut rng);
-                d.ecosystem = "pypi".into();
-                d.name = name.clone();
-                d.artifact_url =
-                    format!("https://patch.socket.dev/patch/{n}/{name}-{version}-py3-none-any.whl");
-                if n % 3 == 0 {
-                    metadata.insert(d.artifact_url.clone(), wheel_metadata(&mut rng, 5));
-                }
-                overrides.push(d);
-            }
-            let got = run_both(&files, &overrides, &metadata, &format!("{dir} crlf={crlf}"));
-            assert!(!got.edits.is_empty(), "{dir}: nothing rewritten");
-        }
-    }
-}
diff --git a/crates/socket-patch-core/src/patch/redirect/rewrite_oracle_support.rs b/crates/socket-patch-core/src/patch/redirect/rewrite_oracle_support.rs
deleted file mode 100644
index c5084166c..000000000
--- a/crates/socket-patch-core/src/patch/redirect/rewrite_oracle_support.rs
+++ /dev/null
@@ -1,125 +0,0 @@
-//! Shared support for the hosted rewriters' equivalence oracles.
-//!
-//! One deterministic RNG and ONE snapshot, so the two sweeps cannot drift
-//! apart: the snapshot covers every `RewriteResult` channel, not only the
-//! ones a particular rewriter is known to touch, so a rewriter that starts
-//! writing a new channel is compared there from the first run.
-
-use super::*;
-
-/// Deterministic xorshift64* — no `rand` dev-dependency.
-pub(super) struct Rng(pub u64);
-
-impl Rng {
-    pub(super) fn next(&mut self) -> u64 {
-        let mut x = self.0;
-        x ^= x >> 12;
-        x ^= x << 25;
-        x ^= x >> 27;
-        self.0 = x;
-        x.wrapping_mul(0x2545_F491_4F6C_DD1D)
-    }
-    pub(super) fn below(&mut self, n: usize) -> usize {
-        (self.next() % n as u64) as usize
-    }
-    pub(super) fn chance(&mut self, percent: u64) -> bool {
-        self.next() % 100 < percent
-    }
-}
-
-/// The uuid sets, each under its field name so a mismatch says which.
-type UuidSets = Vec<(&'static str, std::collections::BTreeSet<String>)>;
-
-/// Every output channel of a [`RewriteResult`], in a comparable shape.
-pub(super) struct Snapshot {
-    files: BTreeMap<String, String>,
-    binary_files: BTreeMap<String, Vec<u8>>,
-    edits: Vec<FileEdit>,
-    warnings: Vec<(String, String)>,
-    uuids: UuidSets,
-}
-
-pub(super) fn snapshot(r: &RewriteResult) -> Snapshot {
-    Snapshot {
-        files: r.files.clone(),
-        binary_files: r.binary_files.clone(),
-        edits: r.edits.clone(),
-        warnings: r
-            .warnings
-            .iter()
-            .map(|w| (w.code.clone(), w.detail.clone()))
-            .collect(),
-        uuids: vec![
-            (
-                "confirmed_bun_binary_uuids",
-                r.confirmed_bun_binary_uuids.clone(),
-            ),
-            ("confirmed_cargo_uuids", r.confirmed_cargo_uuids.clone()),
-            ("confirmed_pipenv_uuids", r.confirmed_pipenv_uuids.clone()),
-            ("refused_pipenv_uuids", r.refused_pipenv_uuids.clone()),
-            ("confirmed_pdm_uuids", r.confirmed_pdm_uuids.clone()),
-            ("refused_pdm_uuids", r.refused_pdm_uuids.clone()),
-            ("refused_pnpm_uuids", r.refused_pnpm_uuids.clone()),
-            ("python_lock_uuids", r.python_lock_uuids.clone()),
-            (
-                "confirmed_python_lock_uuids",
-                r.confirmed_python_lock_uuids.clone(),
-            ),
-            (
-                "refused_python_lock_uuids",
-                r.refused_python_lock_uuids.clone(),
-            ),
-            ("hatch_uuids", r.hatch_uuids.clone()),
-            ("confirmed_hatch_uuids", r.confirmed_hatch_uuids.clone()),
-            (
-                "confirmed_requirements_uuids",
-                r.confirmed_requirements_uuids.clone(),
-            ),
-        ],
-    }
-}
-
-/// Assert the production rewriter's `got` equals the oracle's `want` on
-/// every channel, naming the first file byte / edit / set that differs.
-pub(super) fn assert_same(want: &RewriteResult, got: &RewriteResult, what: &str) {
-    let (want, got) = (snapshot(want), snapshot(got));
-    for (path, want_text) in &want.files {
-        let got_text = got.files.get(path);
-        assert!(
-            got_text == Some(want_text),
-            "{what}: rewritten bytes differ for {path} (first diff at byte {:?})",
-            got_text.map(|g| g
-                .bytes()
-                .zip(want_text.bytes())
-                .position(|(a, b)| a != b)
-                .unwrap_or(g.len().min(want_text.len())))
-        );
-    }
-    assert_eq!(
-        got.files.keys().collect::<Vec<_>>(),
-        want.files.keys().collect::<Vec<_>>(),
-        "{what}: rewritten file set"
-    );
-    assert_eq!(
-        got.binary_files.keys().collect::<Vec<_>>(),
-        want.binary_files.keys().collect::<Vec<_>>(),
-        "{what}: rewritten binary file set"
-    );
-    for (path, want_bytes) in &want.binary_files {
-        assert!(
-            got.binary_files.get(path) == Some(want_bytes),
-            "{what}: rewritten bytes differ for binary {path}"
-        );
-    }
-    assert_eq!(got.edits.len(), want.edits.len(), "{what}: edit count");
-    for (i, (g, w)) in got.edits.iter().zip(&want.edits).enumerate() {
-        assert_eq!(g, w, "{what}: edit #{i}");
-    }
-    assert_eq!(
-        got.warnings, want.warnings,
-        "{what}: warnings (code, detail) in order"
-    );
-    for ((field, got_set), (_, want_set)) in got.uuids.iter().zip(&want.uuids) {
-        assert_eq!(got_set, want_set, "{what}: {field}");
-    }
-}
diff --git a/crates/socket-patch-core/src/utils/python_lock.rs b/crates/socket-patch-core/src/utils/python_lock.rs
index 37ff911dd..594ef8eab 100644
--- a/crates/socket-patch-core/src/utils/python_lock.rs
+++ b/crates/socket-patch-core/src/utils/python_lock.rs
@@ -5,10 +5,6 @@ use toml_edit::{Array, ArrayOfTables, DocumentMut, InlineTable, Item, Table, Tab
 use crate::crawlers::python_crawler::canonicalize_pypi_name;
 use crate::utils::digest::{sha256_hex, sha256_prefixed};
 
-#[cfg(test)]
-#[path = "python_lock_oracle.rs"]
-pub(crate) mod oracle;
-
 #[derive(Clone, Copy, Debug)]
 pub enum ArtifactSource<'a> {
     Url(&'a str),
diff --git a/crates/socket-patch-core/src/utils/python_lock_oracle.rs b/crates/socket-patch-core/src/utils/python_lock_oracle.rs
deleted file mode 100644
index 4047300d2..000000000
--- a/crates/socket-patch-core/src/utils/python_lock_oracle.rs
+++ /dev/null
@@ -1,239 +0,0 @@
-//! The pre-single-parse text rewriters, kept verbatim as `#[cfg(test)]`
-//! oracles for the hosted uv / pylock / PEP 723 rewriter, which now plans,
-//! applies and completes every dep against one parsed document
-//! ([`super::PythonLockSession`]).
-
-use super::*;
-
-pub(crate) fn complete_python_lock_metadata(
-    text: &str,
-    project: Option<&str>,
-    name: &str,
-    version: &str,
-    artifact: ArtifactSource<'_>,
-    wheel_metadata: Option<&str>,
-) -> Result<String, String> {
-    let mut document: DocumentMut = text
-        .parse()
-        .map_err(|error| format!("invalid Python lock: {error}"))?;
-    if document
-        .get("package")
-        .and_then(Item::as_array_of_tables)
-        .is_none()
-    {
-        return Ok(text.to_string());
-    }
-    let name = canonicalize_pypi_name(name);
-    if let Some(project) = project {
-        let project: DocumentMut = project
-            .parse()
-            .map_err(|error| format!("invalid pyproject.toml: {error}"))?;
-        let packages = document
-            .get_mut("package")
-            .and_then(Item::as_array_of_tables_mut)
-            .expect("package collection checked");
-        for package in packages.iter_mut() {
-            let root = package
-                .get("source")
-                .and_then(Item::as_table_like)
-                .is_some_and(|source| {
-                    ["virtual", "editable"]
-                        .into_iter()
-                        .any(|key| source.get(key).and_then(Item::as_str) == Some("."))
-                });
-            if root {
-                if let Some(metadata) = package
-                    .get_mut("metadata")
-                    .and_then(Item::as_table_like_mut)
-                {
-                    for key in ["requires-dist", "requires-dev"] {
-                        if let Some(requirements) = metadata.get_mut(key) {
-                            rewrite_requirement_sources(requirements, &name, artifact);
-                        }
-                    }
-                }
-            }
-        }
-        let overridden = project
-            .get("tool")
-            .and_then(Item::as_table_like)
-            .and_then(|tool| tool.get("uv"))
-            .and_then(Item::as_table_like)
-            .and_then(|uv| uv.get("override-dependencies"))
-            .and_then(Item::as_array)
-            .is_some_and(|overrides| {
-                overrides.iter().filter_map(Value::as_str).any(|specifier| {
-                    canonicalize_pypi_name(
-                        specifier
-                            .split(|ch: char| {
-                                !ch.is_ascii_alphanumeric() && ch != '-' && ch != '_' && ch != '.'
-                            })
-                            .next()
-                            .unwrap_or_default(),
-                    ) == name
-                })
-            });
-        if overridden {
-            let manifest = document
-                .entry("manifest")
-                .or_insert(Item::Table(Table::new()))
-                .as_table_like_mut()
-                .ok_or("uv manifest must be a table")?;
-            let overrides = manifest
-                .entry("overrides")
-                .or_insert(Item::Value(Value::Array(Array::new())));
-            let exists = overrides.as_array().is_some_and(|overrides| {
-                overrides
-                    .iter()
-                    .filter_map(Value::as_inline_table)
-                    .any(|requirement| {
-                        requirement
-                            .get("name")
-                            .and_then(Value::as_str)
-                            .is_some_and(|value| canonicalize_pypi_name(value) == name)
-                    })
-            });
-            if exists {
-                rewrite_requirement_sources(overrides, &name, artifact);
-            } else {
-                overrides
-                    .as_array_mut()
-                    .ok_or("uv manifest overrides must be an array")?
-                    .push_formatted(inline(&[
-                        ("name", Value::from(name.as_str())),
-                        (artifact.key(), Value::from(artifact.location())),
-                    ]));
-            }
-        }
-    }
-    if let Some(metadata) = wheel_metadata {
-        let metadata: DocumentMut = metadata
-            .parse()
-            .map_err(|error| format!("invalid wheel metadata: {error}"))?;
-        let metadata = metadata
-            .get("package")
-            .and_then(Item::as_table_like)
-            .and_then(|package| package.get("metadata"))
-            .and_then(Item::as_table)
-            .ok_or("wheel metadata has no package metadata table")?;
-        for package in document
-            .get_mut("package")
-            .and_then(Item::as_array_of_tables_mut)
-            .expect("package collection checked")
-            .iter_mut()
-        {
-            if matching_package(package, &name, version) {
-                let mut metadata = metadata.clone();
-                metadata.set_position(None);
-                package.insert("metadata", Item::Table(metadata));
-            }
-        }
-    }
-    Ok(preserve_line_endings(text, document.to_string()))
-}
-
-pub(crate) fn rewrite_python_lock(
-    text: &str,
-    name: &str,
-    version: &str,
-    artifact: ArtifactSource<'_>,
-    sha256: &str,
-) -> Result<Option<String>, String> {
-    let mut document: DocumentMut = text
-        .parse()
-        .map_err(|error| format!("invalid Python lock: {error}"))?;
-    let Some(PythonLockPlan {
-        pep751,
-        legacy,
-        collection,
-        index,
-        name,
-        original_source,
-        legacy_strings,
-        legacy_artifact_tables,
-    }) = plan_python_lock_rewrite(&document, text, name, version, artifact)?
-    else {
-        return Ok(None);
-    };
-    let package = document
-        .get_mut(collection)
-        .and_then(Item::as_array_of_tables_mut)
-        .and_then(|packages| packages.get_mut(index))
-        .expect("planned package index exists");
-    let location = artifact.location();
-    let filename = location
-        .split(['?', '#'])
-        .next()
-        .unwrap_or(&location)
-        .rsplit('/')
-        .next()
-        .unwrap_or(&location);
-    let wheel = filename.ends_with(".whl");
-    for key in ["sdist", "wheel", "wheels", "archive"] {
-        package.remove(key);
-    }
-    if pep751 {
-        package.remove("index");
-        let hashes = inline(&[("sha256", Value::from(sha256))]);
-        package.insert(
-            "archive",
-            Item::Value(inline(&[
-                (artifact.key(), Value::from(location)),
-                ("hashes", hashes),
-            ])),
-        );
-    } else {
-        let source = if legacy_strings {
-            Item::Value(Value::from(format!("direct+{location}")))
-        } else {
-            Item::Value(inline(&[(artifact.key(), Value::from(location.clone()))]))
-        };
-        package.insert("source", source.clone());
-        let artifact_key = if matches!(artifact, ArtifactSource::Path(_)) && wheel {
-            "filename"
-        } else {
-            "url"
-        };
-        let artifact_location = if artifact_key == "filename" {
-            filename
-        } else {
-            &location
-        };
-        let entry = inline(&[
-            (artifact_key, Value::from(artifact_location)),
-            ("hash", Value::from(format!("sha256:{sha256}"))),
-        ]);
-        if legacy_artifact_tables && wheel {
-            let mut table = Table::new();
-            table["url"] = toml_edit::value(artifact_location);
-            table["hash"] = toml_edit::value(format!("sha256:{sha256}"));
-            let mut array = ArrayOfTables::new();
-            array.push(table);
-            package.insert("wheel", Item::ArrayOfTables(array));
-        } else if wheel {
-            let mut array = Array::new();
-            array.push_formatted(entry);
-            package.insert("wheels", Item::Value(Value::Array(array)));
-        } else if legacy_artifact_tables {
-            let mut table = Table::new();
-            table["url"] = toml_edit::value(artifact_location);
-            table["hash"] = toml_edit::value(format!("sha256:{sha256}"));
-            package.insert("sdist", Item::Table(table));
-        } else {
-            package.insert("sdist", Item::Value(entry));
-        }
-        if let Some(original_source) = original_source {
-            rewrite_references(
-                document.as_item_mut(),
-                &name,
-                version,
-                &original_source,
-                &source,
-            );
-        }
-    }
-    if !pep751 && !legacy {
-        rewrite_manifest(&mut document, &name, artifact);
-    }
-    Ok(Some(preserve_line_endings(text, document.to_string())))
-}
diff --git a/crates/socket-patch-core/tests/equivalence/composer_json_object_end.golden b/crates/socket-patch-core/tests/equivalence/composer_json_object_end.golden
new file mode 100644
index 000000000..a73f45635
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/composer_json_object_end.golden
@@ -0,0 +1,92 @@
+# One (text, start) pair: where its JSON object ends.
+# <case> <input digest> <output digest>
+0 7aeb4f0cd8305fb8 74234e98afe7498f
+1 e2b3e7e33cf55c97 71ee45a3c0db9a98
+2 a699980f74eb06fb 7902699be42c8a8e
+3 5a96e9c725068c65 7902699be42c8a8e
+4 30627aa32eb3e425 71ee45a3c0db9a98
+5 933fd7bad3713e4c 71ee45a3c0db9a98
+6 f0adab048e7484a2 71ee45a3c0db9a98
+7 23b311dd221b5145 7902699be42c8a8e
+8 5741602eb0dbcc45 670671cd97404156
+9 e1f3a83531f48d90 71ee45a3c0db9a98
+10 4648133e424a0010 71ee45a3c0db9a98
+11 b0f1e1d18c73939f 71ee45a3c0db9a98
+12 64a0e3ccd5edf191 670671cd97404156
+13 39a5935c34470b73 670671cd97404156
+14 915b63fa95e98aac 71ee45a3c0db9a98
+15 fd7c4b67bddf3339 71ee45a3c0db9a98
+16 cf1d11381d4ba4c7 71ee45a3c0db9a98
+17 3d0a7aeee8930ab0 670671cd97404156
+18 b467d4782c503826 670671cd97404156
+19 dc17b8d924a13be1 670671cd97404156
+20 249e9e7e5bb4c207 670671cd97404156
+21 b3bef0d7e2cc3de3 670671cd97404156
+22 14d2211abafe3af4 670671cd97404156
+23 1a7d91bc398fc4ce 670671cd97404156
+24 03df0f1a1009f7e0 670671cd97404156
+25 9d5c9530a427bf87 b7a56873cd771f2c
+26 b736c7398108e7ba 74234e98afe7498f
+27 3a09e484ad26337a 670671cd97404156
+28 c8d9e501ab9873f7 71ee45a3c0db9a98
+29 0960893517a39ee7 71ee45a3c0db9a98
+30 23391a334f139f74 71ee45a3c0db9a98
+31 3f28fea4ec2e6072 74234e98afe7498f
+32 591e879e2a2135ba 74234e98afe7498f
+33 b7e76e1a31a686e2 71ee45a3c0db9a98
+34 b706d70c8f6e2402 71ee45a3c0db9a98
+35 7638b525b6c72b71 71ee45a3c0db9a98
+36 2c4f20c4290dcace 74234e98afe7498f
+37 1792cef320d2bd9d 74234e98afe7498f
+38 a37e2f62d6750c2f 74234e98afe7498f
+39 fdbdc9dba508876d 74234e98afe7498f
+40 ca3e3c49803e815c 74234e98afe7498f
+41 87155c744c38149b 74234e98afe7498f
+42 dab4f0fde3b38383 71ee45a3c0db9a98
+43 fa77a8ddc63efa1b 74234e98afe7498f
+44 e77aa085232696eb 6f4b6612125fb3a0
+45 9471d5b751a24f8f 6b51d431df5d7f14
+46 80b53a7f7f617553 4a44dc15364204a8
+47 10b24a374484dd79 4a44dc15364204a8
+48 6e11ae9cc1196969 6b51d431df5d7f14
+49 9be44b92e364abf7 6b51d431df5d7f14
+50 9003e52c57d83f39 6b51d431df5d7f14
+51 2ddadc3dbc6ea928 4a44dc15364204a8
+52 029867400738a35f 4a44dc15364204a8
+53 34d047ace6f8ef93 4a44dc15364204a8
+54 512a07a19b13d853 74234e98afe7498f
+55 fb93462a03dbb3b1 6b51d431df5d7f14
+56 01d98301a2b8bdae 6f4b6612125fb3a0
+57 58c339124db4eb5e 6f4b6612125fb3a0
+58 19d0a90a5da36baf 6f4b6612125fb3a0
+59 21b3514debad9cc3 74234e98afe7498f
+60 3066fcc6db90ae91 74234e98afe7498f
+61 4eb12bf85ab46d8b 6f4b6612125fb3a0
+62 e164089493b98d5f 6f4b6612125fb3a0
+63 be20d2ba0eaa369f 6f4b6612125fb3a0
+64 6e8f74932f3c258a 6f4b6612125fb3a0
+65 0ca9dd31dc9e5bd1 74234e98afe7498f
+66 88c94156c2f78bc2 74234e98afe7498f
+67 6f249bbff2abfeb5 74234e98afe7498f
+68 bf2bfe1619d945bd 74234e98afe7498f
+69 69a04aa3a6ff61f0 74234e98afe7498f
+70 5831e00d9dec98de 74234e98afe7498f
+71 58ec3c16942a3de2 74234e98afe7498f
+72 2c5d5c979dd21a6f 74234e98afe7498f
+73 7f4be6a75813577c 74234e98afe7498f
+74 7669a7a4e02cf93d 74234e98afe7498f
+75 7db31c876bd5356f 74234e98afe7498f
+76 6b8efcdccc37754f 74234e98afe7498f
+77 061b83e971e03888 74234e98afe7498f
+78 f87c5c5e65c0d630 74234e98afe7498f
+79 f188223b610955d4 74234e98afe7498f
+80 2d1b5e209e56dd9b 74234e98afe7498f
+81 694c4d359d071414 74234e98afe7498f
+82 1435bf40ff91dfc5 e7f6c011776e8db7
+83 eb75f7ded9ad577e ef2d127de37b942b
+84 b44c44352f16ec40 4b227777d4dd1fc6
+85 6565e9014f23bf34 4e07408562bedb8b
+86 3fe8212bbd3f3426 4b227777d4dd1fc6
+87 a46020c5bfa0cbfe ef2d127de37b942b
+88 5a8dcc2b86882634 e7f6c011776e8db7
+89 756aa6e875b7c450 74234e98afe7498f

From d61f6bae9e4c28875c2fa152c52fcc4d6b20a78f Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 28 Sep 2026 22:24:16 +0000
Subject: [PATCH 3/6] Pin the pdm and poetry rewrites by golden

The pdm plan, pdm and poetry parse-reuse rewrites were checked
against #257's verbatim fresh-parse implementations. Their sweeps
now record per-case digests, blessed while those oracles still
agreed with production, and the oracles are deleted.

Golden keys with whitespace are normalized so a case label can
never split a golden line.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N9YdJqaGiT9Jf5LN1hDFhB
---
 crates/socket-patch-core/src/golden.rs        |   1 +
 .../src/patch/redirect/pdm.rs                 | 199 +---
 .../src/patch/redirect/poetry.rs              | 142 +--
 .../socket-patch-core/src/utils/pdm_lock.rs   | 201 +---
 .../src/utils/poetry_lock.rs                  | 215 +----
 .../equivalence/pdm_lock_reused_parse.golden  | 602 ++++++++++++
 .../tests/equivalence/pdm_plan.golden         | 352 +++++++
 .../pdm_rewrite_shared_parse.golden           | 122 +++
 .../poetry_lock_reused_parse.golden           | 872 ++++++++++++++++++
 .../tests/equivalence/poetry_rewrite.golden   | 122 +++
 10 files changed, 2155 insertions(+), 673 deletions(-)
 create mode 100644 crates/socket-patch-core/tests/equivalence/pdm_lock_reused_parse.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/pdm_plan.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/pdm_rewrite_shared_parse.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/poetry_lock_reused_parse.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/poetry_rewrite.golden

diff --git a/crates/socket-patch-core/src/golden.rs b/crates/socket-patch-core/src/golden.rs
index c40efe5a6..7c0377153 100644
--- a/crates/socket-patch-core/src/golden.rs
+++ b/crates/socket-patch-core/src/golden.rs
@@ -114,6 +114,7 @@ impl Golden {
     {
         self.cases += 1;
         if self.chunk == 1 {
+            let key = key.to_string().replace(char::is_whitespace, "_");
             self.lines
                 .push(format!("{key} {} {}", digest(input), digest(output)));
             return;
diff --git a/crates/socket-patch-core/src/patch/redirect/pdm.rs b/crates/socket-patch-core/src/patch/redirect/pdm.rs
index 51cab65da..a5103f872 100644
--- a/crates/socket-patch-core/src/patch/redirect/pdm.rs
+++ b/crates/socket-patch-core/src/patch/redirect/pdm.rs
@@ -157,49 +157,6 @@ fn plan_in(
     Ok((rewrite.text, edits))
 }
 
-/// The previous [`plan`], which re-derived the rewrite's edits, kept as the
-/// equivalence oracle.
-#[cfg(test)]
-fn plan_reference(text: &str, dep: &DepOverride) -> Result<(String, Vec<FileEdit>), String> {
-    let sha256 = dep
-        .integrity
-        .sha256
-        .as_deref()
-        .ok_or("missing PDM SHA-256")?;
-    let url = reqwest::Url::parse(&dep.artifact_url).map_err(|e| e.to_string())?;
-    if !matches!(url.scheme(), "http" | "https")
-        || url.fragment().is_some()
-        || url.query().is_some()
-    {
-        return Err("unsupported PDM artifact URL".into());
-    }
-    let filename = url
-        .path_segments()
-        .and_then(|mut segments| segments.next_back())
-        .ok_or("missing PDM wheel filename")?;
-    use crate::utils::pdm_lock::{pdm_lock_edits, rewrite_pdm_lock};
-    let rewritten = rewrite_pdm_lock(
-        text,
-        &dep.name,
-        &dep.version,
-        ("url", &dep.artifact_url),
-        filename,
-        sha256,
-    )?;
-    let edits = pdm_lock_edits(text, &rewritten, &dep.name)?
-        .into_iter()
-        .map(|(old, new)| FileEdit {
-            path: "pdm.lock".into(),
-            kind: "redirect_pdm_lock_package".into(),
-            action: "rewritten".into(),
-            key: Some(dep.name.clone()),
-            original: Some(json!(old)),
-            new: Some(json!(new)),
-        })
-        .collect();
-    Ok((rewritten, edits))
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -339,11 +296,15 @@ mod equivalence_tests {
         }
     }
 
-    /// `plan` equals the oracle (text and FileEdits, or the refusal) on every
-    /// native lock generation, LF and CRLF, for a landing dep, refusals, and
-    /// again over the landed output (re-run and rotated-token takeover).
+    /// `plan` (text and FileEdits, or the refusal) on every native lock
+    /// generation, LF and CRLF, for a landing dep, refusals, and again over
+    /// the landed output (re-run and rotated-token takeover).
     #[test]
-    fn plan_matches_reference_on_every_lock_generation() {
+    fn plan_matches_golden_on_every_lock_generation() {
+        let mut g = crate::golden::Golden::new(
+            "pdm_plan",
+            "One (lock, dep) pair, planned: the rewritten text and FileEdits, or the refusal.",
+        );
         let sha = "a".repeat(64);
         let wheel = "urllib3-1.26.18-py2.py3-none-any.whl";
         let deps = [
@@ -377,22 +338,20 @@ mod equivalence_tests {
                     lock.clone()
                 };
                 for (i, first) in deps.iter().enumerate() {
-                    let want = plan_reference(&lock, first);
                     let got = plan(&lock, first);
-                    assert_eq!(
-                        format!("{got:?}"),
-                        format!("{want:?}"),
-                        "{name} crlf={crlf} dep#{i}"
+                    g.case(
+                        format!("{name}/{crlf}/{i}"),
+                        &(&lock, i),
+                        &format!("{got:?}"),
                     );
-                    let Ok((rewritten, _)) = want else { continue };
+                    let Ok((rewritten, _)) = got else { continue };
                     landed += 1;
                     for (j, second) in deps.iter().enumerate() {
-                        let want = plan_reference(&rewritten, second);
                         let got = plan(&rewritten, second);
-                        assert_eq!(
-                            format!("{got:?}"),
-                            format!("{want:?}"),
-                            "{name} crlf={crlf} dep#{i} then dep#{j}"
+                        g.case(
+                            format!("{name}/{crlf}/{i}/{j}"),
+                            &(&rewritten, j),
+                            &format!("{got:?}"),
                         );
                     }
                 }
@@ -402,6 +361,7 @@ mod equivalence_tests {
             landed >= 20,
             "the corpus exercises the rewrite path ({landed})"
         );
+        g.finish();
     }
 }
 
@@ -409,113 +369,17 @@ mod equivalence_tests {
 mod parse_reuse_equivalence_tests {
     //! The hosted rewrite sharing one parse per lock state across the
     //! presence probe, the rewrite, the format probe and the next dep,
-    //! against the previous rewrite (a fresh parse for each), kept verbatim.
+    //! pinned by golden (blessed against #257's fresh-parse rewrite).
     use super::*;
     use crate::patch::redirect::Integrity;
     use crate::utils::pdm_lock::parse_reuse_tests::{fixtures, grown, steps};
 
-    fn rewrite_reference(
-        files: &BTreeMap<String, String>,
-        overrides: &[DepOverride],
-        result: &mut RewriteResult,
-    ) {
-        let Some(original) = files.get("pdm.lock") else {
-            return;
-        };
-        let mut text = original.clone();
-        let mut stale_warned = false;
-        for dep in overrides.iter().filter(|dep| dep.ecosystem == "pypi") {
-            // A package `pdm.lock` simply does not contain is not installed by pdm —
-            // a sibling `requirements.txt`/pylock may legitimately carry it — so we
-            // neither redirect it here nor veto the other pypi rewriters. Only a
-            // package the lock DOES contain but the plan refuses (source conflict,
-            // unsupported format, forked variants, bad hashes) withholds siblings.
-            if !lock_contains_reference(&text, &dep.name) {
-                continue;
-            }
-            match plan_reference(&text, dep) {
-                Ok((rewritten, edits)) => {
-                    result.confirmed_pdm_uuids.insert(dep.patch_uuid.clone());
-                    let lock_ver: Option<String> = rewritten
-                        .parse::<toml_edit::DocumentMut>()
-                        .ok()
-                        .and_then(|lock| {
-                            crate::utils::pdm_lock::lock_version(&lock)
-                                .ok()
-                                .map(str::to_string)
-                        });
-                    if lock_ver.as_deref() == Some("2") {
-                        result.warnings.push(RewriteWarning { code: "redirect_pdm_legacy_sync_required".into(), detail: "PDM 0.x may regenerate freshly generated locks during install; use `pdm sync` to preserve this patch, or upgrade PDM".into() });
-                    }
-                    // PDM < 2.11 (lock_version "2"/"4.3"/"4.4") does not replace an
-                    // already-installed package at the same version, so a warm
-                    // `pdm sync`/`pdm install` leaves the upstream bytes live
-                    // (measured: 1.4.5/2.9.3/2.10.4 keep them; 2.11+ reinstall). The
-                    // installed-byte probe only fires for a discoverable venv, so a
-                    // PEP 582 `__pypackages__` or a lock-only/CI scan gets no
-                    // warning: warn proactively once per lock, mirroring poetry's
-                    // `redirect_poetry_stale_install_risk`.
-                    if !stale_warned
-                        && matches!(lock_ver.as_deref(), Some("2") | Some("4.3") | Some("4.4"))
-                    {
-                        stale_warned = true;
-                        result.warnings.push(RewriteWarning {
-                            code: "redirect_pdm_stale_install_risk".into(),
-                            detail: format!(
-                                "pdm.lock (lock_version {}) was written by PDM < 2.11, which does \
-                                 not replace an already-installed package at the same version: an \
-                                 existing environment keeps the upstream {} until it is reinstalled \
-                                 \u{2014} recreate the environment (or uninstall the package) before \
-                                 `pdm sync`/`pdm install`; a fresh install picks up the patched \
-                                 wheel. The installed files were left unchanged.",
-                                lock_ver.as_deref().unwrap_or_default(),
-                                dep.name
-                            ),
-                        });
-                    }
-                    text = rewritten;
-                    result.edits.extend(edits);
-                }
-                Err(detail) => {
-                    result.refused_pdm_uuids.insert(dep.patch_uuid.clone());
-                    result.warnings.push(RewriteWarning {
-                        code: "redirect_pdm_refused".into(),
-                        detail,
-                    });
-                }
-            }
-        }
-        if text != *original {
-            result.files.insert("pdm.lock".into(), text);
-        }
-    }
-
-    /// Whether `pdm.lock` carries a `[[package]]` entry for `name`. When it does
-    /// not, pdm does not install this package, so the caller leaves it to the
-    /// sibling rewriters rather than vetoing them. A malformed lock, or one with no
-    /// package array, returns `true` so the genuine refusal still surfaces from
-    /// `rewrite_pdm_lock` (and, when pdm drives, withholds the siblings).
-    fn lock_contains_reference(text: &str, name: &str) -> bool {
-        let Ok(lock) = text.parse::<toml_edit::DocumentMut>() else {
-            return true;
-        };
-        let canon = canonicalize_pypi_name(name);
-        match lock
-            .get("package")
-            .and_then(toml_edit::Item::as_array_of_tables)
-        {
-            None => true,
-            Some(packages) => packages.iter().any(|package| {
-                package
-                    .get("name")
-                    .and_then(toml_edit::Item::as_str)
-                    .is_some_and(|candidate| canonicalize_pypi_name(candidate) == canon)
-            }),
-        }
-    }
-
     #[test]
-    fn shared_parse_matches_the_fresh_parse_rewrite() {
+    fn shared_parse_matches_golden() {
+        let mut g = crate::golden::Golden::new(
+            "pdm_rewrite_shared_parse",
+            "One grown pdm.lock and its url deps, rewritten, then re-run over the result.",
+        );
         let mut confirmed = 0;
         for (fixture, lock) in fixtures() {
             for extra in [0, 3] {
@@ -546,23 +410,24 @@ mod parse_reuse_equivalence_tests {
                         .collect();
                     let files = BTreeMap::from([("pdm.lock".to_string(), lock)]);
                     let what = format!("{fixture} extra={extra} crlf={crlf}");
-                    let mut want = RewriteResult::default();
-                    rewrite_reference(&files, &deps, &mut want);
                     let mut got = RewriteResult::default();
                     rewrite(&files, &deps, &mut got);
-                    assert_eq!(format!("{got:?}"), format!("{want:?}"), "{what}");
+                    g.case(what.replace(' ', "/"), &(&files, &deps), &format!("{got:?}"));
                     confirmed += got.confirmed_pdm_uuids.len();
 
                     let mut again = files.clone();
-                    again.extend(want.files.clone());
-                    let mut want = RewriteResult::default();
-                    rewrite_reference(&again, &deps, &mut want);
+                    again.extend(got.files.clone());
                     let mut got = RewriteResult::default();
                     rewrite(&again, &deps, &mut got);
-                    assert_eq!(format!("{got:?}"), format!("{want:?}"), "{what} re-run");
+                    g.case(
+                        format!("{}/re-run", what.replace(' ', "/")),
+                        &(&again, &deps),
+                        &format!("{got:?}"),
+                    );
                 }
             }
         }
         assert!(confirmed > 100, "only {confirmed} confirmed");
+        g.finish();
     }
 }
diff --git a/crates/socket-patch-core/src/patch/redirect/poetry.rs b/crates/socket-patch-core/src/patch/redirect/poetry.rs
index a2798cd69..bb198d2cd 100644
--- a/crates/socket-patch-core/src/patch/redirect/poetry.rs
+++ b/crates/socket-patch-core/src/patch/redirect/poetry.rs
@@ -157,127 +157,6 @@ pub(super) fn rewrite_poetry(
     }
 }
 
-/// The previous [`rewrite_poetry`], which re-derived each rewrite's edits
-/// and re-judged the lock's writer after every rewrite, kept as the
-/// equivalence oracle.
-#[cfg(test)]
-fn rewrite_poetry_reference(
-    files: &BTreeMap<String, String>,
-    overrides: &[DepOverride],
-    result: &mut RewriteResult,
-) {
-    use crate::utils::poetry_lock::{poetry_lock_edits, rewrite_poetry_lock};
-    let locks: Vec<(&String, &String)> = files
-        .iter()
-        .filter(|(path, _)| path.as_str() == "poetry.lock" || path.ends_with("/poetry.lock"))
-        .collect();
-    if locks.is_empty() {
-        return;
-    }
-    // Intake gate ONCE per dep, not once per lock file (uv parity).
-    let mut usable: Vec<(&DepOverride, &str)> = Vec::new();
-    for dep in overrides.iter().filter(|dep| dep.ecosystem == "pypi") {
-        result.python_lock_uuids.insert(dep.patch_uuid.clone());
-        match dep.integrity.sha256.as_deref() {
-            Some(sha256) => usable.push((dep, sha256)),
-            None => result.warnings.push(RewriteWarning {
-                code: "redirect_poetry_missing_sha256".into(),
-                detail: format!("{} has no SHA-256 integrity", dep.name),
-            }),
-        }
-    }
-    for (path, original) in locks {
-        let mut content = original.clone();
-        let mut stale_warned = false;
-        for &(dep, sha256) in &usable {
-            let filename = dep.artifact_url.rsplit('/').next().unwrap_or("");
-            match rewrite_poetry_lock(
-                &content,
-                &dep.name,
-                &dep.version,
-                "url",
-                &dep.artifact_url,
-                filename,
-                sha256,
-            ) {
-                Ok(Some(rewritten)) if rewritten != content => {
-                    match poetry_lock_edits(&content, &rewritten, &dep.name) {
-                        Ok(edits) => {
-                            for (original, new) in edits {
-                                result.edits.push(FileEdit {
-                                    path: path.clone(),
-                                    kind: "redirect_poetry_lock_package".into(),
-                                    action: "rewritten".into(),
-                                    key: Some(format!("{}@{}", dep.name, dep.version)),
-                                    original: Some(Value::String(original)),
-                                    new: Some(Value::String(new)),
-                                });
-                            }
-                        }
-                        Err(detail) => {
-                            result.refused_python_lock_uuids.insert(dep.patch_uuid.clone());
-                            result.warnings.push(RewriteWarning {
-                                code: "redirect_poetry_lock_unsupported".into(),
-                                detail: format!("{path}: {detail}"),
-                            });
-                            continue;
-                        }
-                    }
-                    result.confirmed_python_lock_uuids.insert(dep.patch_uuid.clone());
-                    content = rewritten;
-                    if !stale_warned {
-                        if let Some(format) = pre_1_4_writer(&content) {
-                            stale_warned = true;
-                            // Poetry 1.0 installs url sources through pip, which reads
-                            // the hash from the URL fragment; pip 22.3–23.0 take the
-                            // rest of the fragment (`&#egg=<name>`, appended by Poetry)
-                            // as part of the digest and refuse the install (measured;
-                            // pip <= 22.2 and >= 23.1 install and verify).
-                            let pip_note = if format == "1.0" {
-                                " Poetry 1.0 installs through pip: pip 22.3–23.0 misparse the \
-                                 hash fragment and refuse the install (fail-closed) — use pip \
-                                 <= 22.2 or >= 23.1 in the virtualenv."
-                            } else {
-                                ""
-                            };
-                            result.warnings.push(RewriteWarning {
-                                code: "redirect_poetry_stale_install_risk".into(),
-                                detail: format!(
-                                    "{path} was written by Poetry < 1.4, which does not replace \
-                                     an already-installed package at the same version: an \
-                                     existing virtualenv keeps the upstream {} until it is \
-                                     recreated (or the package is `pip uninstall`ed) before \
-                                     `poetry install`; fresh installs pick up the patched \
-                                     wheel.{pip_note}",
-                                    dep.name
-                                ),
-                            });
-                        }
-                    }
-                }
-                // Already redirected to this artifact (idempotent re-scan).
-                Ok(Some(_)) => {
-                    result.confirmed_python_lock_uuids.insert(dep.patch_uuid.clone());
-                }
-                Ok(None) => result.warnings.push(RewriteWarning {
-                    code: "redirect_poetry_entry_not_found".into(),
-                    detail: format!("no {path} entry for {}@{}", dep.name, dep.version),
-                }),
-                Err(detail) => {
-                    result.refused_python_lock_uuids.insert(dep.patch_uuid.clone());
-                    result.warnings.push(RewriteWarning {
-                        code: "redirect_poetry_lock_unsupported".into(),
-                        detail: format!("{path}: {detail}"),
-                    });
-                }
-            }
-        }
-        if content != *original {
-            result.files.insert(path.clone(), content);
-        }
-    }
-}
-
 #[cfg(test)]
 mod equivalence_tests {
     use super::*;
@@ -358,10 +237,14 @@ mod equivalence_tests {
     }
 
     /// Every lock generation, LF and CRLF, in two lock files, then again over
-    /// the rewritten output (the idempotent re-scan): the production
-    /// rewriter's files, edits, warnings and uuid sets equal the oracle's.
+    /// the rewritten output (the idempotent re-scan): the rewriter's files,
+    /// edits, warnings and uuid sets, pinned by golden.
     #[test]
-    fn rewrite_matches_reference_on_every_lock_generation() {
+    fn rewrite_matches_golden_on_every_lock_generation() {
+        let mut g = crate::golden::Golden::new(
+            "poetry_rewrite",
+            "One grown poetry.lock pair and its deps, rewritten, then re-run over the result.",
+        );
         for version in VERSIONS {
             for extra in [0, 3] {
                 for crlf in [false, true] {
@@ -376,21 +259,20 @@ mod equivalence_tests {
                     ]);
                     let deps = overrides(extra);
                     let what = format!("{version} extra={extra} crlf={crlf}");
-                    let want = run(rewrite_poetry_reference, &files, &deps);
                     let got = run(rewrite_poetry, &files, &deps);
-                    assert_eq!(format!("{got:?}"), format!("{want:?}"), "{what}");
+                    g.case(&what, &(&files, &deps), &format!("{got:?}"));
                     assert!(
-                        version.starts_with("0.") || !want.edits.is_empty(),
+                        version.starts_with("0.") || !got.edits.is_empty(),
                         "{what}: the corpus exercises the rewrite path"
                     );
 
                     let mut again = files.clone();
-                    again.extend(want.files.clone());
-                    let want = run(rewrite_poetry_reference, &again, &deps);
+                    again.extend(got.files.clone());
                     let got = run(rewrite_poetry, &again, &deps);
-                    assert_eq!(format!("{got:?}"), format!("{want:?}"), "{what} re-run");
+                    g.case(format!("{what}/re-run"), &(&again, &deps), &format!("{got:?}"));
                 }
             }
         }
+        g.finish();
     }
 }
diff --git a/crates/socket-patch-core/src/utils/pdm_lock.rs b/crates/socket-patch-core/src/utils/pdm_lock.rs
index 4dbd18167..772ce312c 100644
--- a/crates/socket-patch-core/src/utils/pdm_lock.rs
+++ b/crates/socket-patch-core/src/utils/pdm_lock.rs
@@ -892,167 +892,10 @@ mod tests {
 
 #[cfg(test)]
 pub(crate) mod parse_reuse_tests {
-    //! Shared by the pdm parse-reuse oracles: the previous
-    //! [`rewrite_pdm_lock_with_edits`], kept verbatim, and the native
-    //! fixtures grown to several packages.
+    //! Shared by the pdm parse-reuse sweeps: the native fixtures grown to
+    //! several packages, and the dep steps rewritten over them.
     use super::*;
 
-    pub(crate) fn rewrite_pdm_lock_with_edits_oracle<'a>(
-        text: &'a str,
-        name: &'a str,
-        version: &str,
-        source: (&str, &str),
-        filename: &str,
-        sha256: &str,
-    ) -> Result<PdmLockRewrite<'a>, String> {
-        let (kind, location) = source;
-        if !matches!(kind, "url" | "path")
-            || sha256.len() != 64
-            || !sha256.bytes().all(|byte| byte.is_ascii_hexdigit())
-        {
-            return Err("invalid PDM artifact source or SHA-256".into());
-        }
-        if !wheel_matches(filename, name, version) {
-            return Err("PDM patch wheel does not match package".into());
-        }
-        let mut lock: DocumentMut = text.parse().map_err(|e| format!("invalid PDM lock: {e}"))?;
-        lock_version(&lock)?;
-        validate_strategy(&lock)?;
-        let packages = lock
-            .get("package")
-            .and_then(Item::as_array_of_tables)
-            .ok_or("missing PDM packages")?;
-        let indices: Vec<_> = packages
-            .iter()
-            .enumerate()
-            .filter(|(_, package)| {
-                package
-                    .get("name")
-                    .and_then(Item::as_str)
-                    .is_some_and(|candidate| {
-                        canonicalize_pypi_name(candidate) == canonicalize_pypi_name(name)
-                    })
-            })
-            .map(|(index, _)| index)
-            .collect();
-        if indices.is_empty() {
-            return Err("missing PDM package".into());
-        }
-        // A marker/multi-target lock (PDM >= 2.17 `pdm lock --append`) can carry the
-        // same package at several versions, one per resolution fork. A single
-        // surgical rewrite would patch one fork and leave the others pinned to the
-        // registry, so refuse the whole lock ahead of the per-unit version check —
-        // the target version IS present, so the plain "version differs" below would
-        // misdirect the user to re-lock.
-        let locked_versions: std::collections::BTreeSet<&str> = indices
-            .iter()
-            .filter_map(|&index| packages.get(index)?.get("version").and_then(Item::as_str))
-            .collect();
-        if locked_versions.len() > 1 {
-            return Err(
-                "PDM lock resolves this package at multiple versions (a marker or \
-                        multi-target fork); patching one fork would leave the others unpatched"
-                    .into(),
-            );
-        }
-        let mut variants = std::collections::BTreeSet::new();
-        let mut edits = Vec::new();
-        for index in indices {
-            let package = packages.get(index).ok_or("missing PDM package")?;
-            if package.get("version").and_then(Item::as_str) != Some(version) {
-                return Err("PDM locked version differs from installed version".into());
-            }
-            let mut extras = Vec::new();
-            if let Some(value) = package.get("extras") {
-                for extra in value.as_array().ok_or("invalid PDM extras")? {
-                    extras.push(extra.as_str().ok_or("invalid PDM extra")?.to_string());
-                }
-            }
-            extras.sort();
-            if !variants.insert(extras) {
-                return Err("forked PDM package".into());
-            }
-            for field in [
-                "url", "path", "git", "hg", "svn", "bzr", "editable", "source",
-            ] {
-                if let Some(existing) = package.get(field) {
-                    let same_target = field == kind && existing.as_str() == Some(location);
-                    // A prior socket-hosted `url` (rotated grant token or a
-                    // superseded patch uuid — same origin and wheel leaf) is taken
-                    // over in place; foreign urls and every other source refuse.
-                    let prior_hosted = field == kind
-                        && kind == "url"
-                        && existing
-                            .as_str()
-                            .is_some_and(|existing| is_prior_hosted_url(existing, location));
-                    if !same_target && !prior_hosted {
-                        return Err(format!("refusing existing PDM {field} source"));
-                    }
-                }
-            }
-            let original_files = files_for(&lock, package).ok_or("missing PDM file hashes")?;
-            if original_files.is_empty()
-                || original_files.iter().any(|file| {
-                    !file
-                        .as_inline_table()
-                        .and_then(|file| file.get("hash"))
-                        .and_then(Value::as_str)
-                        .is_some_and(|hash| {
-                            hash.strip_prefix("sha256:").is_some_and(|hex| {
-                                hex.len() == 64 && hex.bytes().all(|byte| byte.is_ascii_hexdigit())
-                            })
-                        })
-                })
-            {
-                return Err("invalid PDM file hashes".into());
-            }
-            let files_key = legacy_files_key(package).ok_or("missing PDM files key")?;
-            edits.push((index, package.contains_key("files"), files_key));
-        }
-        for (index, inline_files, files_key) in edits {
-            let mut file = InlineTable::new();
-            file.insert("file", Value::from(filename));
-            file.insert(
-                "hash",
-                Value::from(format!("sha256:{}", sha256.to_ascii_lowercase())),
-            );
-            let mut files = Array::new();
-            files.push(file);
-            let package = lock
-                .get_mut("package")
-                .and_then(Item::as_array_of_tables_mut)
-                .and_then(|packages| packages.get_mut(index))
-                .ok_or("missing PDM package")?;
-            package.insert(kind, value(location));
-            if inline_files {
-                package.insert("files", value(files));
-            } else {
-                let table = lock
-                    .get_mut("metadata")
-                    .and_then(|metadata| metadata.get_mut("files"))
-                    .and_then(Item::as_table_like_mut)
-                    .ok_or("missing PDM metadata.files")?;
-                table.insert(&files_key, value(files));
-            }
-        }
-        let rendered = preserve_line_endings(text, lock.to_string());
-        let before = pdm_lock_fragments(text, name)?;
-        let after = pdm_lock_fragments(&rendered, name)?;
-        let edits = pair_pdm_lock_fragments(text, &before, &rendered, after)?;
-        let mut result = text.to_string();
-        for (old, new) in &edits {
-            result = result.replacen(old, new, 1);
-        }
-        let known_edits = (result == rendered).then_some(edits);
-        Ok(PdmLockRewrite {
-            text: result,
-            original: text,
-            name,
-            before,
-            known_edits,
-        })
-    }
-
     /// Every native pdm lock generation in `tests/fixtures/pdm-native`.
     pub(crate) fn fixtures() -> Vec<(String, String)> {
         let dir =
@@ -1182,49 +1025,41 @@ pub(crate) mod parse_reuse_tests {
     }
 
     #[test]
-    fn reused_parse_matches_the_fresh_parse_rewrite() {
+    fn reused_parse_matches_golden() {
+        let mut golden = crate::golden::Golden::new(
+            "pdm_lock_reused_parse",
+            "One rewrite step over a grown pdm.lock: the text and edits, or the refusal.",
+        );
         let mut landed = 0;
-        for (fixture, lock) in fixtures() {
+        for (_, lock) in fixtures() {
             for extra in [0, 3] {
                 for crlf in [false, true] {
                     let mut lock = grown(&lock.replace("\r\n", "\n"), extra);
                     if crlf {
                         lock = lock.replace('\n', "\r\n");
                     }
-                    let (mut want_text, mut got_text) = (lock.clone(), lock);
+                    let mut got_text = lock;
                     let mut parse = PdmLockParse::default();
-                    for (i, (name, version, (kind, location), sha)) in
-                        steps(extra).iter().enumerate()
-                    {
-                        let what = format!("{fixture} extra={extra} crlf={crlf} step {i}");
+                    for (name, version, (kind, location), sha) in steps(extra).iter() {
                         let filename = location.rsplit('/').next().unwrap();
                         let source = (kind.as_str(), location.as_str());
-                        let want = rewrite_pdm_lock_with_edits_oracle(
-                            &want_text, name, version, source, filename, sha,
-                        );
                         let got = rewrite_pdm_lock_in(
                             &mut parse, &got_text, name, version, source, filename, sha,
                         );
-                        match (want, got) {
-                            (Err(w), Err(g)) => assert_eq!(g, w, "{what}"),
-                            (Ok(w), Ok(g)) => {
-                                assert_eq!(g.text, w.text, "{what}: text");
-                                assert_eq!(g.edits(), w.edits(), "{what}: edits");
-                                landed += 1;
-                                want_text = w.text;
-                                got_text = g.text;
-                            }
-                            (w, g) => panic!(
-                                "{what}: verdicts differ: {:?} vs {:?}",
-                                w.map(|r| r.text),
-                                g.map(|r| r.text)
-                            ),
+                        golden.next(
+                            &(&got_text, name, version, kind, location, sha),
+                            &format!("{:?}", got.as_ref().map(|r| (&r.text, r.edits()))),
+                        );
+                        if let Ok(g) = got {
+                            landed += 1;
+                            got_text = g.text;
                         }
                     }
                 }
             }
         }
         assert!(landed > 100, "only {landed} rewrites landed");
+        golden.finish();
     }
 
     /// A parse is reused only for byte-identical text.
diff --git a/crates/socket-patch-core/src/utils/poetry_lock.rs b/crates/socket-patch-core/src/utils/poetry_lock.rs
index a59f79a62..f1cb815f1 100644
--- a/crates/socket-patch-core/src/utils/poetry_lock.rs
+++ b/crates/socket-patch-core/src/utils/poetry_lock.rs
@@ -922,174 +922,12 @@ mod tests {
 #[cfg(test)]
 mod parse_reuse_equivalence_tests {
     //! The single-parse rewrite ([`rewrite_poetry_lock_in`], reusing the
-    //! previous rewrite's parsed output) against the previous
-    //! [`rewrite_poetry_lock_with_edits`], kept verbatim: identical verdicts,
-    //! texts and edits at every step of a dep sequence, on every lock
-    //! generation, LF and CRLF, with refusals and re-runs in between.
+    //! previous rewrite's parsed output): verdicts, texts and edits at every
+    //! step of a dep sequence, on every lock generation, LF and CRLF, with
+    //! refusals and re-runs in between, pinned by golden (blessed against
+    //! #257's fresh-parse rewrite).
     use super::*;
 
-    fn rewrite_poetry_lock_with_edits_oracle<'a>(
-        text: &'a str,
-        name: &'a str,
-        version: &str,
-        source_type: &str,
-        source_url: &str,
-        filename: &str,
-        sha256: &str,
-    ) -> Result<Option<PoetryLockRewrite<'a>>, String> {
-        if !matches!(source_type, "file" | "url")
-            || sha256.len() != 64
-            || !sha256.bytes().all(|byte| byte.is_ascii_hexdigit())
-        {
-            return Err("invalid Poetry artifact source or SHA-256".into());
-        }
-        // Poetry compares the lock's `sha256:<hex>` against `hashlib`'s lowercase
-        // hexdigest as strings, so an uppercase digest would fail every install.
-        let sha256 = sha256.to_ascii_lowercase();
-        if filename.contains(['/', '\\']) || !filename.ends_with(".whl") {
-            return Err("Poetry patch wheel does not match the locked package".into());
-        }
-        let parts: Vec<_> = filename.split('-').collect();
-        if !matches!(parts.len(), 5 | 6)
-            || canonicalize_pypi_name(parts[0]) != canonicalize_pypi_name(name)
-            || parts[1] != version
-        {
-            return Err("Poetry patch wheel does not match the locked package".into());
-        }
-        let mut lock: DocumentMut = text
-            .parse()
-            .map_err(|e| format!("invalid Poetry lock: {e}"))?;
-        let format = lock_version(&lock)?.to_string();
-        if format == "0" && source_type == "url" {
-            return Err(
-                "Poetry 0.x ignores URL sources; hosted patches require Poetry >= 1.0".into(),
-            );
-        }
-        let effective_url = if format == "1.0" && source_type == "url" {
-            // Poetry 1.0 hands pip `<url>#egg=<name>` unconditionally; the trailing
-            // `&` keeps `sha256=<hex>` a complete fragment parameter when `#egg=`
-            // is appended (pip >= 22 would otherwise read `<hex>#egg=<name>` as the
-            // digest and hard-fail the install).
-            format!("{source_url}#sha256={sha256}&")
-        } else {
-            source_url.to_string()
-        };
-        let packages = lock
-            .get_mut("package")
-            .and_then(Item::as_array_of_tables_mut)
-            .ok_or("missing Poetry packages")?;
-        let indices: Vec<_> = packages
-            .iter()
-            .enumerate()
-            .filter(|(_, package)| {
-                package
-                    .get("name")
-                    .and_then(Item::as_str)
-                    .is_some_and(|candidate| {
-                        canonicalize_pypi_name(candidate) == canonicalize_pypi_name(name)
-                    })
-            })
-            .map(|(index, _)| index)
-            .collect();
-        if indices.is_empty() {
-            return Ok(None);
-        }
-        if indices.len() != 1 {
-            return Err("forked Poetry package requires an unambiguous source".into());
-        }
-        let package = packages
-            .get_mut(indices[0])
-            .ok_or("missing Poetry package")?;
-        if package.get("version").and_then(Item::as_str) != Some(version) {
-            return Ok(None);
-        }
-        let package_name = package
-            .get("name")
-            .and_then(Item::as_str)
-            .unwrap_or(name)
-            .to_string();
-        if let Some(source) = package.get("source") {
-            let existing_type = source.get("type").and_then(Item::as_str);
-            let existing_url = source.get("url").and_then(Item::as_str).unwrap_or("");
-            let same_target = existing_type == Some(source_type) && existing_url == effective_url;
-            let prior_hosted = source_type == "url"
-                && existing_type == Some("url")
-                && is_prior_hosted_url(existing_url, &effective_url);
-            if !same_target && !prior_hosted {
-                return Err(format!(
-                    "refusing to replace an existing Poetry source ({} {}) for {package_name}",
-                    existing_type.unwrap_or("unknown"),
-                    existing_url
-                ));
-            }
-        }
-        let mut entry = InlineTable::new();
-        entry.insert("file", Value::from(filename));
-        entry.insert("hash", Value::from(format!("sha256:{sha256}")));
-        let mut files = Array::new();
-        files.push(entry);
-        let mut source = Table::new();
-        source.insert("type", value(source_type));
-        source.insert("url", value(effective_url));
-        if matches!(format.as_str(), "0" | "1.0") {
-            // Poetry 0.12 / 1.0 read `source.reference` unconditionally (KeyError
-            // without it), even for archive sources.
-            source.insert("reference", value(""));
-        }
-        let rewritten = package.contains_key("source");
-        package.insert("source", Item::Table(source));
-        if matches!(format.as_str(), "1.0" | "1.1") && source_type == "url" {
-            // Poetry >= 1.2 verifies url sources against the package's own
-            // `files` (it never reads `metadata.files` hashes for them), Poetry
-            // 1.0/1.1 against `metadata.files` — write both so whichever installer
-            // consumes this legacy lock enforces the patched hash. Poetry 1.0/1.1
-            // ignore the extra package key (measured on 1.0.10; 1.2.2 rejects a
-            // tampered package `files` hash on a lock-1.0 file only when it is
-            // present).
-            package.insert("files", value(files.clone()));
-        }
-        if format.starts_with('2') {
-            package.insert("files", value(files));
-        } else {
-            let field = if format == "0" { "hashes" } else { "files" };
-            let table = lock
-                .get_mut("metadata")
-                .and_then(Item::as_table_like_mut)
-                .ok_or("missing Poetry lock metadata")?
-                .get_mut(field)
-                .ok_or_else(|| format!("missing Poetry integrity table [metadata.{field}]"))?
-                .as_table_like_mut()
-                .ok_or_else(|| format!("[metadata.{field}] is not a table"))?;
-            if format == "0" {
-                let mut hashes = Array::new();
-                hashes.push(sha256.as_str());
-                table.insert(&package_name, value(hashes));
-            } else {
-                let entry = legacy_files_entry(table, &package_name, files, rewritten);
-                table.insert(&package_name, entry);
-            }
-        }
-        let mut rewritten = lock.to_string();
-        if text.contains("\r\n") {
-            rewritten = rewritten.replace("\r\n", "\n").replace('\n', "\r\n");
-        }
-        let before = poetry_lock_fragments(text, name)?;
-        let after = poetry_lock_fragments(&rewritten, name)?;
-        let edits = pair_poetry_lock_fragments(text, &before, &rewritten, after)?;
-        let mut result = text.to_string();
-        for (original, replacement) in &edits {
-            result = result.replacen(original, replacement, 1);
-        }
-        let known_edits = (result == rewritten).then_some(edits);
-        Ok(Some(PoetryLockRewrite {
-            text: result,
-            original: text,
-            name,
-            before,
-            known_edits,
-        }))
-    }
-
     const VERSIONS: &[&str] = &[
         "0.12.17", "1.0.10", "1.1.15", "1.2.2", "1.3.2", "1.4.2", "1.5.1", "1.6.1", "1.7.1",
         "1.8.5", "2.0.1", "2.1.4", "2.2.1", "2.3.4", "2.4.3",
@@ -1162,7 +1000,11 @@ mod parse_reuse_equivalence_tests {
     }
 
     #[test]
-    fn reused_parse_matches_the_fresh_parse_rewrite() {
+    fn reused_parse_matches_golden() {
+        let mut golden = crate::golden::Golden::new(
+            "poetry_lock_reused_parse",
+            "One rewrite step over a grown poetry.lock: the text and edits, none, or the refusal.",
+        );
         let mut landed = 0;
         for version in VERSIONS {
             for extra in [0, 2, 4] {
@@ -1171,20 +1013,10 @@ mod parse_reuse_equivalence_tests {
                     if crlf {
                         lock = lock.replace('\n', "\r\n");
                     }
-                    let (mut want_text, mut got_text) = (lock.clone(), lock);
+                    let mut got_text = lock;
                     let mut parse = PoetryLockParse::default();
-                    for (i, (name, version, source_type, url)) in steps(extra).iter().enumerate() {
-                        let what = format!("{version} extra={extra} crlf={crlf} step {i}");
+                    for (name, version, source_type, url) in steps(extra).iter() {
                         let filename = url.rsplit('/').next().unwrap();
-                        let want = rewrite_poetry_lock_with_edits_oracle(
-                            &want_text,
-                            name,
-                            version,
-                            source_type,
-                            url,
-                            filename,
-                            SHA,
-                        );
                         let got = rewrite_poetry_lock_in(
                             &mut parse,
                             &got_text,
@@ -1195,27 +1027,24 @@ mod parse_reuse_equivalence_tests {
                             filename,
                             SHA,
                         );
-                        match (want, got) {
-                            (Err(w), Err(g)) => assert_eq!(g, w, "{what}"),
-                            (Ok(None), Ok(None)) => {}
-                            (Ok(Some(w)), Ok(Some(g))) => {
-                                assert_eq!(g.text, w.text, "{what}: text");
-                                assert_eq!(g.edits(), w.edits(), "{what}: edits");
-                                landed += 1;
-                                want_text = w.text;
-                                got_text = g.text;
-                            }
-                            (w, g) => panic!(
-                                "{what}: verdicts differ: {:?} vs {:?}",
-                                w.map(|r| r.map(|r| r.text)),
-                                g.map(|r| r.map(|r| r.text))
+                        golden.next(
+                            &(&got_text, name, version, source_type, url),
+                            &format!(
+                                "{:?}",
+                                got.as_ref()
+                                    .map(|r| r.as_ref().map(|r| (&r.text, r.edits())))
                             ),
+                        );
+                        if let Ok(Some(g)) = got {
+                            landed += 1;
+                            got_text = g.text;
                         }
                     }
                 }
             }
         }
         assert!(landed > 200, "only {landed} rewrites landed");
+        golden.finish();
     }
 
     /// A parse is reused only for byte-identical text: an external edit
diff --git a/crates/socket-patch-core/tests/equivalence/pdm_lock_reused_parse.golden b/crates/socket-patch-core/tests/equivalence/pdm_lock_reused_parse.golden
new file mode 100644
index 000000000..4fcd301ff
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/pdm_lock_reused_parse.golden
@@ -0,0 +1,602 @@
+# One rewrite step over a grown pdm.lock: the text and edits, or the refusal.
+# <case> <input digest> <output digest>
+0 51da3e941788e52a 9f0970f6f87c7931
+1 fdc56b69f9a5d32b bbf2b60628004c99
+2 f115aebddd4eacd8 4a97499202850f2f
+3 3bad998b90e64e11 31987b68f78a15ac
+4 50ae55df589e523e 9d4350e62594c4bd
+5 d3ea53459da34a28 5e7d516c90fbd221
+6 746636e98b80790d a5017370fb037b1c
+7 e82174d3a13e2277 147cedfd51c962e2
+8 327b1a829b329ec7 8354f40fbbe79f15
+9 d07c798cb62d9a56 66f9af1e989003f7
+10 6400bd3ed21dd681 4a97499202850f2f
+11 52863b1511d2568a 31987b68f78a15ac
+12 dd67b60bb734a55e 9d4350e62594c4bd
+13 3cd39cc38ec5053d 2d85be54a1b23258
+14 ea3d45f843bca759 62d8978b89c1919f
+15 bea24469df8f733c 147cedfd51c962e2
+16 8ea4dea4ceaa02e0 5b0d60cd940474a4
+17 76730e639c866305 7c018434c717682f
+18 24b16b19f2c2d5b8 058c4e147605ffbf
+19 acbc667113f91e32 4f223c4b36b8bc50
+20 84a819c45e4164af ea342cc2a624dde0
+21 8df0d973e6c8e282 4a97499202850f2f
+22 8157a4ef3d543821 31987b68f78a15ac
+23 8fd3a82cf7754660 9d4350e62594c4bd
+24 6c81ff4f86d08090 1b1feb2899042ce1
+25 011bcd41f45fac9f 55aebe7de046c85b
+26 d1c73523bb2757b9 147cedfd51c962e2
+27 e0238bf1d76af8da 08dec65ca8d213ac
+28 de3a94e87e8a32c7 1deb3cff276a4b7b
+29 3e72c7dde471c73a 041eef2fbc167231
+30 42c85d0b6cc6717e bf34b713f72d77f0
+31 ead4e3540408528d 4d12e0cf92fd04d5
+32 4e8fa7b44440f069 fc4d63b4f9a3662f
+33 f73a75c5b2128797 4a97499202850f2f
+34 ce36164e6db9c325 31987b68f78a15ac
+35 8e985259f0f2865f 9d4350e62594c4bd
+36 246e7ad2db85ab83 9b638af4dcd1c141
+37 6a56d31f6fc04410 d7e91f2ee61b155d
+38 b85f9ec63056b2b1 147cedfd51c962e2
+39 5aebcb6a99aefa3e f0783f9b854d5a8a
+40 4046b7368477ec44 419d4293e8ff73e9
+41 442f8824559bd810 4a97499202850f2f
+42 f8deda687913891e 4a97499202850f2f
+43 1412ce8f0c900846 31987b68f78a15ac
+44 0de9459b5f5f9af5 9d4350e62594c4bd
+45 110f8e297a0335a2 8343c3422a7b0704
+46 b8dd8d3746371d7a e20e516b7aef80c0
+47 9847b5b9e6d953b7 147cedfd51c962e2
+48 fb3f47ea61bfcd1d 5617053f29ac5c94
+49 afb82deda5b15a08 4a97499202850f2f
+50 691e5cfe019448d5 4a97499202850f2f
+51 e3806b344b7486df 31987b68f78a15ac
+52 2fd2f5546579fa9a 9d4350e62594c4bd
+53 aa6d9aec4aee5271 25429ccae40fe3b8
+54 67a32da4e100772d 912beda1648c98a5
+55 96801d75b42f0ab6 147cedfd51c962e2
+56 2dec5a69f8ffdde2 6b7d983b98c362ca
+57 82b23f5031338f33 b5518dff92fa5c8b
+58 29b86397c5a75e56 d729d0e317a8bfd2
+59 6bf696611506d6cb 29abc716a6385c0c
+60 4c943d2bf37a53e8 4a97499202850f2f
+61 647bc15c17dec3e3 4a97499202850f2f
+62 d54ce5bab8f78fe8 31987b68f78a15ac
+63 b405aa6018a4b855 9d4350e62594c4bd
+64 33602caafe7c09f8 7696e9580cc48bc3
+65 cecb25cc25f06e34 5bf1334db730b807
+66 033b831cf3ccdd1f 147cedfd51c962e2
+67 33d05273f679f096 b9e0f7f23cd531e0
+68 523119b613c5a788 b77f465561ebf4df
+69 fa60a69e3c37c3ae 90d5e51d7e0d69a8
+70 fe070a44fa2f4597 da34afe81c7da945
+71 e7b2812707103183 70b88524f0892347
+72 f066c15cb3ca4c14 4a97499202850f2f
+73 39255d97c29b8e70 4a97499202850f2f
+74 285cad975ce19f53 31987b68f78a15ac
+75 8491bdd25a2f57bf 9d4350e62594c4bd
+76 488c4b7de591a887 2231331235e2f913
+77 a5bdc23bca6e93a8 6465cca65be6fc73
+78 923d2675d18e44ec 147cedfd51c962e2
+79 918b380001651760 34ddbb309b487393
+80 834c2226edb9a309 40b7af0efb673911
+81 a254d43aaed2160d 40b7af0efb673911
+82 dddaf3987c5f65bf 40b7af0efb673911
+83 9cafe0c5639af5ad 40b7af0efb673911
+84 9c84bb72be286829 9d4350e62594c4bd
+85 834c2226edb9a309 40b7af0efb673911
+86 35d391704b679314 40b7af0efb673911
+87 a09ffcbb1f0a4cda 40b7af0efb673911
+88 77bd5404355cb2d7 40b7af0efb673911
+89 15b5dcc7ccb8dfe0 40b7af0efb673911
+90 0e1ec2e34b1d9a30 40b7af0efb673911
+91 b8880102d4fad8fc 40b7af0efb673911
+92 72b884ebec177c79 9d4350e62594c4bd
+93 77bd5404355cb2d7 40b7af0efb673911
+94 b278f711c6bad27b 40b7af0efb673911
+95 3eb2dfae31143cf6 40b7af0efb673911
+96 6c0a270455a5b2e8 40b7af0efb673911
+97 ca55c9edb24ed3fb 40b7af0efb673911
+98 143b7aad87048d3a 40b7af0efb673911
+99 453786b8ff7af18a 40b7af0efb673911
+100 bd413a22034cd225 40b7af0efb673911
+101 5ce5123baa1c3ae1 40b7af0efb673911
+102 f500c474c5e34907 40b7af0efb673911
+103 a4f7850f93dd4328 9d4350e62594c4bd
+104 6c0a270455a5b2e8 40b7af0efb673911
+105 b563f52c5036bf3c 40b7af0efb673911
+106 f514d821d245f81b 40b7af0efb673911
+107 ddfd2988d9942fab 40b7af0efb673911
+108 47d9bf3b11cb6f57 40b7af0efb673911
+109 627e20c162be5c9a 40b7af0efb673911
+110 0ba5f78b254d1902 40b7af0efb673911
+111 ebf24d71507702bf 40b7af0efb673911
+112 e10944aee3e6c526 40b7af0efb673911
+113 089286a57a4abd87 40b7af0efb673911
+114 a59a5caca26f5731 40b7af0efb673911
+115 cc905d6ef643de25 9d4350e62594c4bd
+116 47d9bf3b11cb6f57 40b7af0efb673911
+117 273750e92f8956e5 40b7af0efb673911
+118 cb7e0feca88d9f4c 40b7af0efb673911
+119 9cba74ce2ea6141b 40b7af0efb673911
+120 78413c0783d620f4 e5cfd07aff56674c
+121 7bb857036d73b6c6 e5cfd07aff56674c
+122 ca02e029dd3ab8a7 e5cfd07aff56674c
+123 166f3cb1785df018 e5cfd07aff56674c
+124 268cb0c93256947a 9d4350e62594c4bd
+125 78413c0783d620f4 e5cfd07aff56674c
+126 6c4324791908e935 e5cfd07aff56674c
+127 1e4146b21c80a25c e5cfd07aff56674c
+128 1d04ad4ad2cf6ccd e5cfd07aff56674c
+129 e4c13910bc951502 e5cfd07aff56674c
+130 1ebf1e81f25528cd e5cfd07aff56674c
+131 d823b610f9903730 e5cfd07aff56674c
+132 a485fffdfd765ffb 9d4350e62594c4bd
+133 1d04ad4ad2cf6ccd e5cfd07aff56674c
+134 ec9ad66a504eaeee e5cfd07aff56674c
+135 29b481817b981063 e5cfd07aff56674c
+136 e08ea2099aad8495 e5cfd07aff56674c
+137 b4843e921f065b6b e5cfd07aff56674c
+138 84147e5f50eecb47 e5cfd07aff56674c
+139 fc7e94d7e42ec795 e5cfd07aff56674c
+140 34bb40a9eddcc91d e5cfd07aff56674c
+141 fc8a7c74011210e4 e5cfd07aff56674c
+142 6bd01ae012218b23 e5cfd07aff56674c
+143 1e7d9b8fc56b1c36 9d4350e62594c4bd
+144 e08ea2099aad8495 e5cfd07aff56674c
+145 553a4ac6777383c3 e5cfd07aff56674c
+146 8db355e913350e52 e5cfd07aff56674c
+147 205eb8a7d5a993df e5cfd07aff56674c
+148 1e16857cb80a699b e5cfd07aff56674c
+149 2629b1fd2e8ed753 e5cfd07aff56674c
+150 42fd317c4f62f44c e5cfd07aff56674c
+151 f3f6a4ce1c2e076a e5cfd07aff56674c
+152 87cf9dc22d0b9b32 e5cfd07aff56674c
+153 fe0e54d12b308ca0 e5cfd07aff56674c
+154 dacfbcf5c85f3682 e5cfd07aff56674c
+155 44679c431e4e81df 9d4350e62594c4bd
+156 1e16857cb80a699b e5cfd07aff56674c
+157 1855f19a8a621db3 e5cfd07aff56674c
+158 0721f0d6e012d3eb e5cfd07aff56674c
+159 08d0c228e3ff4db5 e5cfd07aff56674c
+160 78413c0783d620f4 e5cfd07aff56674c
+161 7bb857036d73b6c6 e5cfd07aff56674c
+162 ca02e029dd3ab8a7 e5cfd07aff56674c
+163 166f3cb1785df018 e5cfd07aff56674c
+164 268cb0c93256947a 9d4350e62594c4bd
+165 78413c0783d620f4 e5cfd07aff56674c
+166 6c4324791908e935 e5cfd07aff56674c
+167 1e4146b21c80a25c e5cfd07aff56674c
+168 1d04ad4ad2cf6ccd e5cfd07aff56674c
+169 e4c13910bc951502 e5cfd07aff56674c
+170 1ebf1e81f25528cd e5cfd07aff56674c
+171 d823b610f9903730 e5cfd07aff56674c
+172 a485fffdfd765ffb 9d4350e62594c4bd
+173 1d04ad4ad2cf6ccd e5cfd07aff56674c
+174 ec9ad66a504eaeee e5cfd07aff56674c
+175 29b481817b981063 e5cfd07aff56674c
+176 e08ea2099aad8495 e5cfd07aff56674c
+177 b4843e921f065b6b e5cfd07aff56674c
+178 84147e5f50eecb47 e5cfd07aff56674c
+179 fc7e94d7e42ec795 e5cfd07aff56674c
+180 34bb40a9eddcc91d e5cfd07aff56674c
+181 fc8a7c74011210e4 e5cfd07aff56674c
+182 6bd01ae012218b23 e5cfd07aff56674c
+183 1e7d9b8fc56b1c36 9d4350e62594c4bd
+184 e08ea2099aad8495 e5cfd07aff56674c
+185 553a4ac6777383c3 e5cfd07aff56674c
+186 8db355e913350e52 e5cfd07aff56674c
+187 205eb8a7d5a993df e5cfd07aff56674c
+188 1e16857cb80a699b e5cfd07aff56674c
+189 2629b1fd2e8ed753 e5cfd07aff56674c
+190 42fd317c4f62f44c e5cfd07aff56674c
+191 f3f6a4ce1c2e076a e5cfd07aff56674c
+192 87cf9dc22d0b9b32 e5cfd07aff56674c
+193 fe0e54d12b308ca0 e5cfd07aff56674c
+194 dacfbcf5c85f3682 e5cfd07aff56674c
+195 44679c431e4e81df 9d4350e62594c4bd
+196 1e16857cb80a699b e5cfd07aff56674c
+197 1855f19a8a621db3 e5cfd07aff56674c
+198 0721f0d6e012d3eb e5cfd07aff56674c
+199 08d0c228e3ff4db5 e5cfd07aff56674c
+200 10c2078b66c024a1 83f82bf409a31f5d
+201 2f709b6ca6381750 4a97499202850f2f
+202 7f4d3d263da8a4c2 4a97499202850f2f
+203 be46887f225e4dab 31987b68f78a15ac
+204 ecc8bf1f3c521494 9d4350e62594c4bd
+205 5390313ba4f99848 65bd51df70306521
+206 9c29e72b441b736c a9a06db883716a12
+207 d09cdd2521e60698 147cedfd51c962e2
+208 de9bba1cb6d5ff7c a539bf808e1c34ad
+209 1919b89c2ccc2e3c 4a97499202850f2f
+210 f26da7d8b4c08e4a 4a97499202850f2f
+211 065f6b4af3e6a97b 31987b68f78a15ac
+212 46de38a64b406c88 9d4350e62594c4bd
+213 b662ce4971de793d afc3dab8b3bd4acb
+214 06ffe9617bcb9a44 ec9e04ec5697e4f5
+215 be65d47b26a266af 147cedfd51c962e2
+216 856d9b07f84a8d69 8922a099702ff25d
+217 71678edd5a40427a 727f6feb6252bc6c
+218 e491a17eb0c56d3e 297c5dc6afdec871
+219 e732c9803832d7e5 3654bc5fcb413b8a
+220 d112eb5594136d2c 4a97499202850f2f
+221 bfe71e0c6bdfeaf9 4a97499202850f2f
+222 52d9ff56d1a0adfe 31987b68f78a15ac
+223 bf7d0bb69c52b4e4 9d4350e62594c4bd
+224 e84630edcec7492f 076e0b998e86e668
+225 4434bbbd7a0e9401 4afd178f07d37855
+226 43db72800478f670 147cedfd51c962e2
+227 6ed2a69d3ecdc831 8074768821eb592f
+228 8cf942d530c2f66d 044de390b20b3077
+229 153d5c0d4e038f07 8f28d78c9652ef5b
+230 1a310685218772d0 edb5d2355b2c6376
+231 4982dbb1fb4d8afb 137635e880ae4ec9
+232 b821c969a6b84138 4a97499202850f2f
+233 42d8cbdd7cc23b71 4a97499202850f2f
+234 c54ca0f3a42a969f 31987b68f78a15ac
+235 e8ff617718340bd7 9d4350e62594c4bd
+236 f5eee279bae3d650 d62877bb740c1bef
+237 baf7d0642f95ab8d 0bb61663ac8e74dc
+238 4c450a4c5354a003 147cedfd51c962e2
+239 9de65bc2af470eee 21cdf600590cae82
+240 f5e3c7c3c2fc4a7d 2ecff5f3cf3cff90
+241 ff557cfba1a00d2b 4a97499202850f2f
+242 70ab35fb40c674cf 4a97499202850f2f
+243 dd344084697a3db5 31987b68f78a15ac
+244 e78f84b98a13a850 9d4350e62594c4bd
+245 722ff1cd23180005 a12058a9031e15b5
+246 1f2da8fbb310b818 b1356a5391856ddd
+247 140c327cbafe1766 147cedfd51c962e2
+248 3bb2f90fa1354ba0 31a2b94f7083cb5e
+249 c8aadfc0109f6d9c 4a97499202850f2f
+250 0130831e140aeb91 4a97499202850f2f
+251 5305441ee1edf71e 31987b68f78a15ac
+252 396e06a1c0d882f5 9d4350e62594c4bd
+253 4a4426c0238ab759 7ddbf842132d6221
+254 3bb89a1cc43ac47b e933196a46d1d230
+255 e0514ac8f379aea1 147cedfd51c962e2
+256 de77d87d239c4bcf ff79bbbf23ec1de3
+257 957f75246c1ec336 8bafe1da2532cef1
+258 33771824b3c4d99b 5821b93f187e2c97
+259 f00657356753b5e7 b1f0d4970b77af80
+260 52db94bc16865907 4a97499202850f2f
+261 43351f7825ff4eb5 4a97499202850f2f
+262 ccb08d1cc72fa6bd 31987b68f78a15ac
+263 0ff5212e87c403df 9d4350e62594c4bd
+264 a79eccd2fb7811b2 eb48235ad86b2649
+265 d28895d41f73bc84 6068cd48e63e2d77
+266 8154743847977b56 147cedfd51c962e2
+267 3e6008394ca62172 73a61be271184228
+268 3dfde73c08cea73a c46a2efcb0d77123
+269 35364e92e760479a d3bce982422db87f
+270 c97d883c6bce0906 0b9c9906c0b5d42b
+271 115145a51006f4ae 386dc3e8c7c824b3
+272 82bcf52c606b8f02 4a97499202850f2f
+273 9e2e6193164f014a 4a97499202850f2f
+274 4333452ee7f0a906 31987b68f78a15ac
+275 9ca6590b9273fc59 9d4350e62594c4bd
+276 8b6bfea955224cf5 225bae94d634b36e
+277 5a9df2111cc29133 9035ec492be66782
+278 0d566518acd89511 147cedfd51c962e2
+279 00e0f384d80f159e 3d9c867f5dd7496c
+280 20cab354d97a96d5 453cb9014ec90341
+281 14fd00d455327192 4a97499202850f2f
+282 8e3213115f538638 4a97499202850f2f
+283 bd32b55bc38b5ce5 31987b68f78a15ac
+284 d92b7fad0f5dd6e6 9d4350e62594c4bd
+285 a5718e0c1776130c ae967c2a05c0d032
+286 7b25cfeceadad0fe 79a3a8a28d53ac4e
+287 7c1b62718458c902 147cedfd51c962e2
+288 6995c722b083370f f7dfb74e12694237
+289 9d8168d24ae99e49 4a97499202850f2f
+290 7861d7b9ecc6652c 4a97499202850f2f
+291 6f677162097c97d9 31987b68f78a15ac
+292 38db0669550fd11b 9d4350e62594c4bd
+293 3e269d88201a7436 741766d85c5a5920
+294 453416febeb356b0 f227fad31168bf56
+295 d6f3f7d9ff77bf02 147cedfd51c962e2
+296 4cf9e033a453376b ce15ae2532592ae9
+297 61f51b6602f8723a e5b300d16bc63cd5
+298 c086ee17c56d2dc7 071fd71288d5ce51
+299 8ce3dc2edc26a433 66b476e1a7883936
+300 b4e2df8957fec73d 4a97499202850f2f
+301 1d274d94747b976b 4a97499202850f2f
+302 337531f365585eb9 31987b68f78a15ac
+303 b2a33b09dbd96018 9d4350e62594c4bd
+304 8515659c804c9b7f 06a796110163009b
+305 5c0e76fb50a6dd67 59042d6ce3fe8f20
+306 8ba70be9d1f8d6f1 147cedfd51c962e2
+307 b47ee8e0e0ed5971 e3f36d7ae285c8df
+308 96a20a00ea42dede 0a8afeeb7cfc95c2
+309 34f4192b660c2e10 5e99b06baf4b96f6
+310 4e66eb83afe6b612 4f3124babd96255e
+311 c5034642fe8930d9 25d91cf3e47f6381
+312 b6df2edee43e5965 4a97499202850f2f
+313 7a3e6bd77aaad2db 4a97499202850f2f
+314 6f394506203d14a7 31987b68f78a15ac
+315 7c463a884173e92f 9d4350e62594c4bd
+316 598cdb5c399521f0 c35c780abced4933
+317 dd925eaf074355cb 0bfe7689075f8e86
+318 a05afd7b62c839be 147cedfd51c962e2
+319 d9d0afea7877cdeb fca0e3c6f9d74051
+320 1c77b4696a2f0894 3bfbc89c556dd466
+321 d07b14a30b297ae7 9ec856ff287601e4
+322 e8a0e4b35424e6a7 4a97499202850f2f
+323 882a5411e217edfc 31987b68f78a15ac
+324 2ec38588887d62c5 9d4350e62594c4bd
+325 d8184f07abf632dc 5a69be4d1bc68cd9
+326 b9404d9c5cca5453 6c3ed7b127a8a0e1
+327 2431f1b6fdb2d670 147cedfd51c962e2
+328 159fcb1145b1eb0a 42b7e03bde37663a
+329 34efe6e4d5bcd464 fe1a4a0b04bbd143
+330 06f732f3c6629047 4a97499202850f2f
+331 5bc823657fe8cf99 31987b68f78a15ac
+332 3cf589cdef8744b4 9d4350e62594c4bd
+333 7bc2888722110bb8 716c354e784af8b5
+334 db8c9a7ea1afb42a a48b7bb73eae2a7b
+335 b35ee8b4e2117ceb 147cedfd51c962e2
+336 40a76ee0c9dd880f 99b0c0c7b0d70faa
+337 934875a11deac3c5 985120700e39dabd
+338 818bce5a2df8a6d4 2cb46af8c9041f73
+339 da0d2b41d511642d e7c3779bed148e48
+340 02a93e07bddb1121 67b244c8c7c07610
+341 779feb19ead30446 4a97499202850f2f
+342 a81bb3c2b2176de8 31987b68f78a15ac
+343 a002fd46f1cfaf97 9d4350e62594c4bd
+344 815148be1e4c8b8b d1220727b262ae3f
+345 27a65c7af65ef987 c0a18a21a8533941
+346 401ce13a484d40a6 147cedfd51c962e2
+347 184d94cda76678a0 9b4c6314ea881f5e
+348 7e3c576ee9904fe6 9f66001a828e9cc8
+349 afacd3730e4024cd 0d5e542e41e02256
+350 57d405130c8c9f95 39171751b8c08b2f
+351 c9aea89fac9ee4d1 d3b9c9707a7c6a29
+352 546be7d8896546d6 8b127586c411e830
+353 0605c42f7c7d0bc9 4a97499202850f2f
+354 2c56e4d8d51d0a2f 31987b68f78a15ac
+355 0cf4c0d5bcff1146 9d4350e62594c4bd
+356 7874cc0a35104008 05114f2c3540a5c1
+357 67b5531fdd64685e a061189ac0f59109
+358 1752ab4f8e9aa784 147cedfd51c962e2
+359 1fbddce315136249 36759eeffb31e029
+360 499e6a0d87ff3bf9 f147919beb494533
+361 2098361f04989bd4 4a97499202850f2f
+362 f647519ea7ec75c7 4a97499202850f2f
+363 f77cce552c1c4071 31987b68f78a15ac
+364 1864ea3b24f630b7 9d4350e62594c4bd
+365 d380c423f5a77eb4 bc3601fd98344659
+366 1fa556341ef3e18b 3f6287c2f18b5ee3
+367 e58f872d34428dc2 147cedfd51c962e2
+368 01c306b5a08c5248 e0d3f908a4a5b956
+369 daa6c4038ba3ab02 4a97499202850f2f
+370 e4e989708ba25b02 4a97499202850f2f
+371 14432d412e5d0416 31987b68f78a15ac
+372 591933d36d173969 9d4350e62594c4bd
+373 2a870344feab2435 329acd82cdf02bad
+374 5860b8b8df3f46ae 749ca3766b106126
+375 16316af702589c43 147cedfd51c962e2
+376 bf485bc899bf0401 9bfa7a4a7d028e8a
+377 9fe92cc0e442d47b 772b67ea4d42781a
+378 2adf9ba65e90471d 191a02d32cc06a85
+379 9a36207eebae160f 87e9ead546721228
+380 f67fa68e4eb4253a 4a97499202850f2f
+381 f8cf634e42654a94 4a97499202850f2f
+382 05409ca2a52db772 31987b68f78a15ac
+383 787ea8ea5e1b26d7 9d4350e62594c4bd
+384 0357f61eb2558e1d f87080abe5fd3540
+385 d4b510ab20a0e8f2 5f1d9161f454c012
+386 abff04fca1a2acee 147cedfd51c962e2
+387 60a1e8a5df29df1e e414f518b73230d1
+388 a707541155a80d15 769b2e6c77d31ac2
+389 1a019fb1b7030e46 d6d1e30d84d0ac23
+390 9b38be4b0365e279 3e67352e65b543ec
+391 00fc063b5e72b33a 1cc706ef835de1f5
+392 fe507aa9b02c64b2 4a97499202850f2f
+393 b54986928a79f33b 4a97499202850f2f
+394 b40cb865b688c04d 31987b68f78a15ac
+395 bf65bea84695683b 9d4350e62594c4bd
+396 a225c69bbd1d67e0 f40fb7195f28aa33
+397 c69c3dd6edf05819 b710b1ca83361783
+398 34f0ea08e970ecec 147cedfd51c962e2
+399 38be5157032150ba 5ceb282c1f457903
+400 647ee8d3441c5bf7 19baf59da7b9d9d3
+401 d2256f8f7ade8e83 19baf59da7b9d9d3
+402 b0f50f93e8a44cd3 19baf59da7b9d9d3
+403 11313347e7c68535 19baf59da7b9d9d3
+404 b1522a45a7161f20 9d4350e62594c4bd
+405 647ee8d3441c5bf7 19baf59da7b9d9d3
+406 bf7ebf168c51b295 19baf59da7b9d9d3
+407 dc4f4e404116ea10 19baf59da7b9d9d3
+408 d24eeff4f6959dbf 19baf59da7b9d9d3
+409 17ca09fe5c27d838 19baf59da7b9d9d3
+410 31aa58e9f117330a 19baf59da7b9d9d3
+411 888585d4516e7d79 19baf59da7b9d9d3
+412 160bc87d467f2292 9d4350e62594c4bd
+413 d24eeff4f6959dbf 19baf59da7b9d9d3
+414 7bae6841c0a11d6d 19baf59da7b9d9d3
+415 de6dba3f5ca4f98d 19baf59da7b9d9d3
+416 2693ce139bb13add 19baf59da7b9d9d3
+417 991639b17ed87965 19baf59da7b9d9d3
+418 535d489a07c5c2cc 19baf59da7b9d9d3
+419 1d012050be81d6e4 19baf59da7b9d9d3
+420 a2219882dbb9d2bf 19baf59da7b9d9d3
+421 5dea9607d4d96427 19baf59da7b9d9d3
+422 731c61fe14f5310b 19baf59da7b9d9d3
+423 2423ad27cdc3cb3a 9d4350e62594c4bd
+424 2693ce139bb13add 19baf59da7b9d9d3
+425 f54748293e559970 19baf59da7b9d9d3
+426 6a964da89bd302f6 19baf59da7b9d9d3
+427 8998c2ed76376521 19baf59da7b9d9d3
+428 7c7b19325e4916ee 19baf59da7b9d9d3
+429 7c7fe54d586266a5 19baf59da7b9d9d3
+430 2e4b8f5e416d10eb 19baf59da7b9d9d3
+431 e256f79d68585364 19baf59da7b9d9d3
+432 a77439ee62109032 19baf59da7b9d9d3
+433 9bd36c790386c41d 19baf59da7b9d9d3
+434 52a4a76f541b5aaa 19baf59da7b9d9d3
+435 8560f202e9ecca63 9d4350e62594c4bd
+436 7c7b19325e4916ee 19baf59da7b9d9d3
+437 e503c9450e4958aa 19baf59da7b9d9d3
+438 9c8a932cf22e25ac 19baf59da7b9d9d3
+439 c99e33ee5984331c 19baf59da7b9d9d3
+440 858f6359c6c4f795 84b40e1a94ad80ed
+441 ec6c882299a61119 84b40e1a94ad80ed
+442 86055cae165ed345 84b40e1a94ad80ed
+443 befd60f78c9f00e7 84b40e1a94ad80ed
+444 d6443fbeb262a984 9d4350e62594c4bd
+445 858f6359c6c4f795 84b40e1a94ad80ed
+446 807e30fa43e21b13 84b40e1a94ad80ed
+447 c01b57d10324039f 84b40e1a94ad80ed
+448 d4489cc21574905d 84b40e1a94ad80ed
+449 58037778db0ac83b 84b40e1a94ad80ed
+450 47d756e2c3ce062c 84b40e1a94ad80ed
+451 0fc4112e518534a7 84b40e1a94ad80ed
+452 4ab7ec9d36f2209b 9d4350e62594c4bd
+453 d4489cc21574905d 84b40e1a94ad80ed
+454 ba99ec08c1f99e15 84b40e1a94ad80ed
+455 93d357584194b7c1 84b40e1a94ad80ed
+456 d1245512dcfd7fd6 84b40e1a94ad80ed
+457 e9c02d6d961584ca 84b40e1a94ad80ed
+458 8fa04611a831375c 84b40e1a94ad80ed
+459 6d89b33bcdf06651 84b40e1a94ad80ed
+460 5dc04629d4a9bea1 84b40e1a94ad80ed
+461 4abd556cb6724aa6 84b40e1a94ad80ed
+462 e968c454a2870dbe 84b40e1a94ad80ed
+463 fa9440fb48ade7b0 9d4350e62594c4bd
+464 d1245512dcfd7fd6 84b40e1a94ad80ed
+465 ef8b57d69b695252 84b40e1a94ad80ed
+466 1e5c093e2012db42 84b40e1a94ad80ed
+467 c4e146f10d35f012 84b40e1a94ad80ed
+468 8dd48d14a66f7e09 84b40e1a94ad80ed
+469 b9437b21734dc5dd 84b40e1a94ad80ed
+470 27bc8e943e69e5c2 84b40e1a94ad80ed
+471 5e81baabfdb5b45b 84b40e1a94ad80ed
+472 0d43eec42b24b3c6 84b40e1a94ad80ed
+473 a7e9b26002e36a71 84b40e1a94ad80ed
+474 29a1847f1d50b27e 84b40e1a94ad80ed
+475 7979f59b49b960a8 9d4350e62594c4bd
+476 8dd48d14a66f7e09 84b40e1a94ad80ed
+477 ff91924d0adcbbcc 84b40e1a94ad80ed
+478 957240ed7882b659 84b40e1a94ad80ed
+479 e659eae583d5fb34 84b40e1a94ad80ed
+480 858f6359c6c4f795 84b40e1a94ad80ed
+481 ec6c882299a61119 84b40e1a94ad80ed
+482 86055cae165ed345 84b40e1a94ad80ed
+483 befd60f78c9f00e7 84b40e1a94ad80ed
+484 d6443fbeb262a984 9d4350e62594c4bd
+485 858f6359c6c4f795 84b40e1a94ad80ed
+486 807e30fa43e21b13 84b40e1a94ad80ed
+487 c01b57d10324039f 84b40e1a94ad80ed
+488 d4489cc21574905d 84b40e1a94ad80ed
+489 58037778db0ac83b 84b40e1a94ad80ed
+490 47d756e2c3ce062c 84b40e1a94ad80ed
+491 0fc4112e518534a7 84b40e1a94ad80ed
+492 4ab7ec9d36f2209b 9d4350e62594c4bd
+493 d4489cc21574905d 84b40e1a94ad80ed
+494 ba99ec08c1f99e15 84b40e1a94ad80ed
+495 93d357584194b7c1 84b40e1a94ad80ed
+496 d1245512dcfd7fd6 84b40e1a94ad80ed
+497 e9c02d6d961584ca 84b40e1a94ad80ed
+498 8fa04611a831375c 84b40e1a94ad80ed
+499 6d89b33bcdf06651 84b40e1a94ad80ed
+500 5dc04629d4a9bea1 84b40e1a94ad80ed
+501 4abd556cb6724aa6 84b40e1a94ad80ed
+502 e968c454a2870dbe 84b40e1a94ad80ed
+503 fa9440fb48ade7b0 9d4350e62594c4bd
+504 d1245512dcfd7fd6 84b40e1a94ad80ed
+505 ef8b57d69b695252 84b40e1a94ad80ed
+506 1e5c093e2012db42 84b40e1a94ad80ed
+507 c4e146f10d35f012 84b40e1a94ad80ed
+508 8dd48d14a66f7e09 84b40e1a94ad80ed
+509 b9437b21734dc5dd 84b40e1a94ad80ed
+510 27bc8e943e69e5c2 84b40e1a94ad80ed
+511 5e81baabfdb5b45b 84b40e1a94ad80ed
+512 0d43eec42b24b3c6 84b40e1a94ad80ed
+513 a7e9b26002e36a71 84b40e1a94ad80ed
+514 29a1847f1d50b27e 84b40e1a94ad80ed
+515 7979f59b49b960a8 9d4350e62594c4bd
+516 8dd48d14a66f7e09 84b40e1a94ad80ed
+517 ff91924d0adcbbcc 84b40e1a94ad80ed
+518 957240ed7882b659 84b40e1a94ad80ed
+519 e659eae583d5fb34 84b40e1a94ad80ed
+520 453556fb0220228c 47418fe16fbcc8a9
+521 9a3a25b1fc532ba0 4a97499202850f2f
+522 c26822d00bce67e9 4a97499202850f2f
+523 2397c03c47c05cb5 31987b68f78a15ac
+524 da4f7bd6ef09de3f 9d4350e62594c4bd
+525 748b592010d70267 9c233a3e60a0c647
+526 74db9c5c282833cc e895d9daff6b670b
+527 a31dd7624f11e404 147cedfd51c962e2
+528 e54310fe0bac46aa 80f1a16aa54d8a9b
+529 fb1371d086cc25f5 4a97499202850f2f
+530 2b902d3227cd1d2a 4a97499202850f2f
+531 53af1ac6b1cb488f 31987b68f78a15ac
+532 8409cf4389b3dbd4 9d4350e62594c4bd
+533 7aa2f21e23b94a21 2467740cf96b8eca
+534 907a6eee5205a594 0ca99558d9c1a39f
+535 846bce22287d4538 147cedfd51c962e2
+536 fbdb0191f09bacfd 53621bbd49ffd000
+537 a36e521cbaaabe93 5da1e1b9f1fe3767
+538 47b5cf9bd50e3f32 8697fd33ce12329c
+539 8f3b0f8a0e1ad840 83a59dad6e2963df
+540 5d76f3fa3ae0d9e8 4a97499202850f2f
+541 36f38f8f2939c2af 4a97499202850f2f
+542 eabb6324c613ea43 31987b68f78a15ac
+543 658a4255fb519125 9d4350e62594c4bd
+544 2714e75f946899a4 f0852ce72cb43a22
+545 190c67299a9a2f06 8ce1492bd8fe6f6e
+546 55e6460a6f9548c6 147cedfd51c962e2
+547 1f561d07fb39a2c7 b0fc4ce6c24ee1cc
+548 5b6eed66a470b2e8 b0ad53410f69cd11
+549 0749e676b08f896d 96d0daea03ab1637
+550 2e2d1fe16bfdccda f83d4d7047acc277
+551 8a25c2397979e45d f38dc03c50b0263b
+552 3e107be5eebe5163 4a97499202850f2f
+553 2165632e2d7d2ab7 4a97499202850f2f
+554 c7a13da6471db2b5 31987b68f78a15ac
+555 112c177e4da467b7 9d4350e62594c4bd
+556 fd296bbb282eaf9c c9bba77318b17582
+557 b8e1854503c47ce7 6fa21cc5d0232f24
+558 6e31c13f95e21340 147cedfd51c962e2
+559 9fc87c8c8355dc8a 54fee6532c345a48
+560 453556fb0220228c 47418fe16fbcc8a9
+561 9a3a25b1fc532ba0 4a97499202850f2f
+562 c26822d00bce67e9 4a97499202850f2f
+563 2397c03c47c05cb5 31987b68f78a15ac
+564 da4f7bd6ef09de3f 9d4350e62594c4bd
+565 748b592010d70267 9c233a3e60a0c647
+566 74db9c5c282833cc e895d9daff6b670b
+567 a31dd7624f11e404 147cedfd51c962e2
+568 e54310fe0bac46aa 80f1a16aa54d8a9b
+569 fb1371d086cc25f5 4a97499202850f2f
+570 2b902d3227cd1d2a 4a97499202850f2f
+571 53af1ac6b1cb488f 31987b68f78a15ac
+572 8409cf4389b3dbd4 9d4350e62594c4bd
+573 7aa2f21e23b94a21 2467740cf96b8eca
+574 907a6eee5205a594 0ca99558d9c1a39f
+575 846bce22287d4538 147cedfd51c962e2
+576 fbdb0191f09bacfd 53621bbd49ffd000
+577 a36e521cbaaabe93 5da1e1b9f1fe3767
+578 47b5cf9bd50e3f32 8697fd33ce12329c
+579 8f3b0f8a0e1ad840 83a59dad6e2963df
+580 5d76f3fa3ae0d9e8 4a97499202850f2f
+581 36f38f8f2939c2af 4a97499202850f2f
+582 eabb6324c613ea43 31987b68f78a15ac
+583 658a4255fb519125 9d4350e62594c4bd
+584 2714e75f946899a4 f0852ce72cb43a22
+585 190c67299a9a2f06 8ce1492bd8fe6f6e
+586 55e6460a6f9548c6 147cedfd51c962e2
+587 1f561d07fb39a2c7 b0fc4ce6c24ee1cc
+588 5b6eed66a470b2e8 b0ad53410f69cd11
+589 0749e676b08f896d 96d0daea03ab1637
+590 2e2d1fe16bfdccda f83d4d7047acc277
+591 8a25c2397979e45d f38dc03c50b0263b
+592 3e107be5eebe5163 4a97499202850f2f
+593 2165632e2d7d2ab7 4a97499202850f2f
+594 c7a13da6471db2b5 31987b68f78a15ac
+595 112c177e4da467b7 9d4350e62594c4bd
+596 fd296bbb282eaf9c c9bba77318b17582
+597 b8e1854503c47ce7 6fa21cc5d0232f24
+598 6e31c13f95e21340 147cedfd51c962e2
+599 9fc87c8c8355dc8a 54fee6532c345a48
diff --git a/crates/socket-patch-core/tests/equivalence/pdm_plan.golden b/crates/socket-patch-core/tests/equivalence/pdm_plan.golden
new file mode 100644
index 000000000..8d4ba81f7
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/pdm_plan.golden
@@ -0,0 +1,352 @@
+# One (lock, dep) pair, planned: the rewritten text and FileEdits, or the refusal.
+# <case> <input digest> <output digest>
+0.12.3-extras.lock/false/0 78c0d1394f4fc6bc 641af12243061413
+0.12.3-extras.lock/false/0/0 6086a7361d112583 c794dccadef2e1a3
+0.12.3-extras.lock/false/0/1 f502f2fee23a1d58 6594cad621796c4b
+0.12.3-extras.lock/false/0/2 b69d24c9271311c7 31987b68f78a15ac
+0.12.3-extras.lock/false/0/3 b002047527e7ad13 9d4350e62594c4bd
+0.12.3-extras.lock/false/0/4 42bda7e107c53828 9931d34fbe45f32a
+0.12.3-extras.lock/false/1 1d47e9e9d2933b4a 40f75922033dca4b
+0.12.3-extras.lock/false/1/0 5c15040e457bca61 b6bbfc082ad92f41
+0.12.3-extras.lock/false/1/1 b0b8796bf5efc39e b4f2458720f4cd7c
+0.12.3-extras.lock/false/1/2 1bef9b4a2202efa4 31987b68f78a15ac
+0.12.3-extras.lock/false/1/3 f5ed91606d4fbf7d 9d4350e62594c4bd
+0.12.3-extras.lock/false/1/4 7e8301d97dbed85f 0715c58f7c5319d5
+0.12.3-extras.lock/false/2 7dceb2d03ea484d2 31987b68f78a15ac
+0.12.3-extras.lock/false/3 08378e224be26302 9d4350e62594c4bd
+0.12.3-extras.lock/false/4 89e0d2790d70d761 1c82ec45cb26d815
+0.12.3-extras.lock/false/4/0 a3ba92b5ca9b06ba df1b988c1e90b760
+0.12.3-extras.lock/false/4/1 cffeddc5c6f38d5f 73452f1d0bacd19b
+0.12.3-extras.lock/false/4/2 5f650199b59aca2c 31987b68f78a15ac
+0.12.3-extras.lock/false/4/3 c0f461deb814a020 9d4350e62594c4bd
+0.12.3-extras.lock/false/4/4 9a0ed1349a5542d8 0ccd44d1d748b809
+0.12.3-extras.lock/true/0 889c2b3c73c80979 626d1ffaf17c247a
+0.12.3-extras.lock/true/0/0 df7bb229614e769a dfff021916037b96
+0.12.3-extras.lock/true/0/1 6c4cb26fad45df14 3c0e78778d30d550
+0.12.3-extras.lock/true/0/2 7c51eaea5709d0ae 31987b68f78a15ac
+0.12.3-extras.lock/true/0/3 0c399cea1ce94b3a 9d4350e62594c4bd
+0.12.3-extras.lock/true/0/4 2ef570d4e245edcd 9559753bd8985c28
+0.12.3-extras.lock/true/1 f583e3c835985494 0a5237c601b0fbd0
+0.12.3-extras.lock/true/1/0 3d8885bbc50c12e9 4dff40afe23447f4
+0.12.3-extras.lock/true/1/1 c1f70d10dbc04f1f f1c85439230fc62c
+0.12.3-extras.lock/true/1/2 91a07a19f96775dd 31987b68f78a15ac
+0.12.3-extras.lock/true/1/3 b2179a3dc35aa944 9d4350e62594c4bd
+0.12.3-extras.lock/true/1/4 48608e97c7de3b03 36be459d3ef4d437
+0.12.3-extras.lock/true/2 7bb227b4d13f42a9 31987b68f78a15ac
+0.12.3-extras.lock/true/3 f81d4dcb599cd462 9d4350e62594c4bd
+0.12.3-extras.lock/true/4 ce0465fe13e312d5 b266228082334d34
+0.12.3-extras.lock/true/4/0 1e7642b442257662 b9651f3b518c456a
+0.12.3-extras.lock/true/4/1 6783cd75ac86c5c4 4558e18b7fc5f622
+0.12.3-extras.lock/true/4/2 34317bdb4bffd9cb 31987b68f78a15ac
+0.12.3-extras.lock/true/4/3 8a7b9a908ab1a998 9d4350e62594c4bd
+0.12.3-extras.lock/true/4/4 a06ceafad0c4a775 107629accde8a726
+0.12.3.lock/false/0 059cb65cddfebda4 e31aa76ad2f62372
+0.12.3.lock/false/0/0 988c6e73fcfa2749 931937f81c56547a
+0.12.3.lock/false/0/1 fdbc99ae2feaadb8 2247e0a1eb31bd39
+0.12.3.lock/false/0/2 eebb095847f23edd 31987b68f78a15ac
+0.12.3.lock/false/0/3 4bf2c9f0e7447268 9d4350e62594c4bd
+0.12.3.lock/false/0/4 6749570e5eee4a23 4a97499202850f2f
+0.12.3.lock/false/1 de0790bc84133f7e 42f29e6f6f69652d
+0.12.3.lock/false/1/0 dd5e73e43f10f92c 2f149871e57b72cb
+0.12.3.lock/false/1/1 7d8c8dc8d7c07847 30c6e6ab223f47d2
+0.12.3.lock/false/1/2 e46f58ca98c934f9 31987b68f78a15ac
+0.12.3.lock/false/1/3 5e05546155b36e74 9d4350e62594c4bd
+0.12.3.lock/false/1/4 ea6b24f45f680e8a 4a97499202850f2f
+0.12.3.lock/false/2 f5ea0aedb12b55d8 31987b68f78a15ac
+0.12.3.lock/false/3 bd2de7d2e9b5fb14 9d4350e62594c4bd
+0.12.3.lock/false/4 253d0ebb38402458 4a97499202850f2f
+0.12.3.lock/true/0 caf8852d5edcd968 1237e046c1c0ce1f
+0.12.3.lock/true/0/0 8b503807e1f4551e d13fbed86369364a
+0.12.3.lock/true/0/1 4089f2ff1f715bfe 93d31c2c16094584
+0.12.3.lock/true/0/2 271ab0dc5812b332 31987b68f78a15ac
+0.12.3.lock/true/0/3 f9c4bcdac99e31be 9d4350e62594c4bd
+0.12.3.lock/true/0/4 d04710ab7abe0d34 4a97499202850f2f
+0.12.3.lock/true/1 621e8f88515da16a 9989694be8dc3eac
+0.12.3.lock/true/1/0 fba6ecb1a54aee42 462aaedc2f700cff
+0.12.3.lock/true/1/1 218e6f6a30cae17f dbd8029d038a99fd
+0.12.3.lock/true/1/2 f9cf049f5f4a5a42 31987b68f78a15ac
+0.12.3.lock/true/1/3 a9ca6b90954cef2c 9d4350e62594c4bd
+0.12.3.lock/true/1/4 1411304b2d86bb13 4a97499202850f2f
+0.12.3.lock/true/2 249bedf939ae8490 31987b68f78a15ac
+0.12.3.lock/true/3 fff2f091f829799a 9d4350e62594c4bd
+0.12.3.lock/true/4 008bb31ef347fcb3 4a97499202850f2f
+1.15.5.lock/false/0 9d72e20609fc3d38 40b7af0efb673911
+1.15.5.lock/false/1 8588f7862f471b81 40b7af0efb673911
+1.15.5.lock/false/2 f2c5d7ab6bbb0372 40b7af0efb673911
+1.15.5.lock/false/3 02857baf53a5d2f8 9d4350e62594c4bd
+1.15.5.lock/false/4 e116d0b471412989 40b7af0efb673911
+1.15.5.lock/true/0 d2bf27c59177dc0f 40b7af0efb673911
+1.15.5.lock/true/1 e03d432effad6805 40b7af0efb673911
+1.15.5.lock/true/2 3ae7f25cf253ea3f 40b7af0efb673911
+1.15.5.lock/true/3 7f9671aa49ce84d2 9d4350e62594c4bd
+1.15.5.lock/true/4 81545bc098518bd8 40b7af0efb673911
+2.0.3.lock/false/0 67bd95c4e31f570d e5cfd07aff56674c
+2.0.3.lock/false/1 b866378911a6a30a e5cfd07aff56674c
+2.0.3.lock/false/2 7acdd2c1fd2dbae4 e5cfd07aff56674c
+2.0.3.lock/false/3 9e4549c50c0f355b 9d4350e62594c4bd
+2.0.3.lock/false/4 0545dd8d827781e1 e5cfd07aff56674c
+2.0.3.lock/true/0 108d3012c2bf3a7d e5cfd07aff56674c
+2.0.3.lock/true/1 7f432fa1e2eea86c e5cfd07aff56674c
+2.0.3.lock/true/2 bc93cfa09e31941a e5cfd07aff56674c
+2.0.3.lock/true/3 bc28c56a292aad59 9d4350e62594c4bd
+2.0.3.lock/true/4 de66b7ca5a009e29 e5cfd07aff56674c
+2.1.5.lock/false/0 67bd95c4e31f570d e5cfd07aff56674c
+2.1.5.lock/false/1 b866378911a6a30a e5cfd07aff56674c
+2.1.5.lock/false/2 7acdd2c1fd2dbae4 e5cfd07aff56674c
+2.1.5.lock/false/3 9e4549c50c0f355b 9d4350e62594c4bd
+2.1.5.lock/false/4 0545dd8d827781e1 e5cfd07aff56674c
+2.1.5.lock/true/0 108d3012c2bf3a7d e5cfd07aff56674c
+2.1.5.lock/true/1 7f432fa1e2eea86c e5cfd07aff56674c
+2.1.5.lock/true/2 bc93cfa09e31941a e5cfd07aff56674c
+2.1.5.lock/true/3 bc28c56a292aad59 9d4350e62594c4bd
+2.1.5.lock/true/4 de66b7ca5a009e29 e5cfd07aff56674c
+2.10.4.lock/false/0 4b49f0d0cb61a9a5 02e011c925244d30
+2.10.4.lock/false/0/0 7449d96476be77fe fbbd7786d1511c97
+2.10.4.lock/false/0/1 8939f16214c1a975 7dd985a30e3340a4
+2.10.4.lock/false/0/2 c26fc670033ade33 31987b68f78a15ac
+2.10.4.lock/false/0/3 1108cbe009b2a8b8 9d4350e62594c4bd
+2.10.4.lock/false/0/4 7947bc2bcf2160fa 4a97499202850f2f
+2.10.4.lock/false/1 0649801b51d793c0 ebc63b4c53b0af6b
+2.10.4.lock/false/1/0 d58c2e2eebb0724d a2d80e971b4eaf2d
+2.10.4.lock/false/1/1 51e9e12c9d282e5f 2b6d59654a4c4d13
+2.10.4.lock/false/1/2 9d1c7074c077cf37 31987b68f78a15ac
+2.10.4.lock/false/1/3 a7c5868ce2f53a15 9d4350e62594c4bd
+2.10.4.lock/false/1/4 c8974a9aaae5eac2 4a97499202850f2f
+2.10.4.lock/false/2 bcbe81fd8d155b26 31987b68f78a15ac
+2.10.4.lock/false/3 2547935d140b7642 9d4350e62594c4bd
+2.10.4.lock/false/4 0aa1490b81cfef63 4a97499202850f2f
+2.10.4.lock/true/0 84d56df15a998d76 3b6d7173113b0cb5
+2.10.4.lock/true/0/0 807325f90ffc8917 7c21efc4765488ef
+2.10.4.lock/true/0/1 66bd13f9a308afe4 92c765a769d687ee
+2.10.4.lock/true/0/2 cf4d2eea0789b728 31987b68f78a15ac
+2.10.4.lock/true/0/3 0dfaa08357e428e6 9d4350e62594c4bd
+2.10.4.lock/true/0/4 6fec1678f7fbae6e 4a97499202850f2f
+2.10.4.lock/true/1 9dd71c39e8feab41 1c237a052284134c
+2.10.4.lock/true/1/0 eb7f6df52e9307ec a0d8246105e87a8d
+2.10.4.lock/true/1/1 769491e5465071b6 a07cd55953b6b5d2
+2.10.4.lock/true/1/2 a1f4b54e548d12d3 31987b68f78a15ac
+2.10.4.lock/true/1/3 be74589fb91ca7db 9d4350e62594c4bd
+2.10.4.lock/true/1/4 e70b05801ccd40e0 4a97499202850f2f
+2.10.4.lock/true/2 3b4bb5f2ad46201b 31987b68f78a15ac
+2.10.4.lock/true/3 2c3cc2ca3a49c20b 9d4350e62594c4bd
+2.10.4.lock/true/4 a7ce896471327446 4a97499202850f2f
+2.11.2.lock/false/0 1b29f8833aafa886 4aeafa9ba5751804
+2.11.2.lock/false/0/0 c371c8fa028f9282 c02f841018cf9f97
+2.11.2.lock/false/0/1 5a2d0f8322e5fa85 bab2f69ff616c57e
+2.11.2.lock/false/0/2 b5b39cdbb7443660 31987b68f78a15ac
+2.11.2.lock/false/0/3 4da894a325e20f22 9d4350e62594c4bd
+2.11.2.lock/false/0/4 cb0cfa4a7d607ac3 4a97499202850f2f
+2.11.2.lock/false/1 468e5a29dec27241 c0b255d4a846468e
+2.11.2.lock/false/1/0 8efbaa084dd60b35 6245564f1d77986a
+2.11.2.lock/false/1/1 56b215af9e252cfa 4cda3430ffb14c07
+2.11.2.lock/false/1/2 cae3af7aab713faa 31987b68f78a15ac
+2.11.2.lock/false/1/3 4d94bdcfec568d4a 9d4350e62594c4bd
+2.11.2.lock/false/1/4 ac09f36eb19f7ba6 4a97499202850f2f
+2.11.2.lock/false/2 23912b3c6f9a27f9 31987b68f78a15ac
+2.11.2.lock/false/3 8217e98f241873d5 9d4350e62594c4bd
+2.11.2.lock/false/4 03c094b4c51c9285 4a97499202850f2f
+2.11.2.lock/true/0 4e07c96cfcb18376 28ce8fc82e0ea3bc
+2.11.2.lock/true/0/0 93def020a91a9918 b8a37bf5d84fd2e3
+2.11.2.lock/true/0/1 7b78f82427e27501 896cc10f97969cbc
+2.11.2.lock/true/0/2 a9fd9bdc97b60006 31987b68f78a15ac
+2.11.2.lock/true/0/3 b0fa00159780ca47 9d4350e62594c4bd
+2.11.2.lock/true/0/4 09a43ab19e36cbe7 4a97499202850f2f
+2.11.2.lock/true/1 b6a649f59d474bd6 5b90c99302416a3f
+2.11.2.lock/true/1/0 156bb770f0f750f0 aca42b61ee63421f
+2.11.2.lock/true/1/1 2d48df55102a551b 83bac03e13f6e476
+2.11.2.lock/true/1/2 13dc3e43876b9dc9 31987b68f78a15ac
+2.11.2.lock/true/1/3 86a1bd7f05d932c8 9d4350e62594c4bd
+2.11.2.lock/true/1/4 8f543bb91be26075 4a97499202850f2f
+2.11.2.lock/true/2 d98c682914f1ac96 31987b68f78a15ac
+2.11.2.lock/true/3 2738d00d03241c74 9d4350e62594c4bd
+2.11.2.lock/true/4 fbed1f0f8562c76d 4a97499202850f2f
+2.17.3.lock/false/0 1a978bf6ec4e05c4 23c8a0ce65fa30a3
+2.17.3.lock/false/0/0 0fa2f6c2a4960807 2f3fe226135086e4
+2.17.3.lock/false/0/1 de8bb5f5c8213d14 e5147585e36687de
+2.17.3.lock/false/0/2 339863d7500f5f92 31987b68f78a15ac
+2.17.3.lock/false/0/3 061354d117f0ae08 9d4350e62594c4bd
+2.17.3.lock/false/0/4 36ca5c0363f484cb 4a97499202850f2f
+2.17.3.lock/false/1 f46253c14912d0d6 2b8fd04412796181
+2.17.3.lock/false/1/0 9dadfb7d381197eb 246f500d484017a1
+2.17.3.lock/false/1/1 bdaa0c4e009a2fb3 6dd3c4c57ba29cae
+2.17.3.lock/false/1/2 4afbab0568e00923 31987b68f78a15ac
+2.17.3.lock/false/1/3 913372421c075889 9d4350e62594c4bd
+2.17.3.lock/false/1/4 11396f5cee3460ca 4a97499202850f2f
+2.17.3.lock/false/2 986b83a7c6da3851 31987b68f78a15ac
+2.17.3.lock/false/3 62c0c49b913f3d5c 9d4350e62594c4bd
+2.17.3.lock/false/4 dd16c8b258b01501 4a97499202850f2f
+2.17.3.lock/true/0 59f37d4f84d0450a a593999fe97501c0
+2.17.3.lock/true/0/0 ac26a4e3872ebdff c9f98c47fe615945
+2.17.3.lock/true/0/1 bde1452cdeabf4d4 20936f4bc40be4ce
+2.17.3.lock/true/0/2 01da50e7dd0fccd2 31987b68f78a15ac
+2.17.3.lock/true/0/3 0c00fb0ed73d35bc 9d4350e62594c4bd
+2.17.3.lock/true/0/4 4718a0ed75c7c11e 4a97499202850f2f
+2.17.3.lock/true/1 565f0e865fb6f6b4 be834db44553c88f
+2.17.3.lock/true/1/0 c1de231f4a8ecf1e c90fb55476196f9d
+2.17.3.lock/true/1/1 88d27d4f7f2b461b d7394268b65e5add
+2.17.3.lock/true/1/2 9eff0871c3bd5a46 31987b68f78a15ac
+2.17.3.lock/true/1/3 6439ae064dc09a5e 9d4350e62594c4bd
+2.17.3.lock/true/1/4 39f9e4adb8412647 4a97499202850f2f
+2.17.3.lock/true/2 6654e3019c0b2fc3 31987b68f78a15ac
+2.17.3.lock/true/3 d444047068bb51eb 9d4350e62594c4bd
+2.17.3.lock/true/4 f795c54c92bd4a07 4a97499202850f2f
+2.29.2-extras.lock/false/0 4b4f6d3bbd40e8f0 9ee055ba2620d35d
+2.29.2-extras.lock/false/0/0 4236a1120886b33a 2516b8a4d057bc11
+2.29.2-extras.lock/false/0/1 ab121fcf6af55359 394eaf1a20bbe9c0
+2.29.2-extras.lock/false/0/2 5a276ccd185ba008 31987b68f78a15ac
+2.29.2-extras.lock/false/0/3 e5c164555600d1bf 9d4350e62594c4bd
+2.29.2-extras.lock/false/0/4 0ffc545a5ba29e13 20736854c7456967
+2.29.2-extras.lock/false/1 3d6d9f1aa4cd7d38 d78bb3ade5453cdd
+2.29.2-extras.lock/false/1/0 b487008f0aa3a7e4 db3ccf48ea8ecbfc
+2.29.2-extras.lock/false/1/1 0d7877c8042815bb 641d488b23f7c8c9
+2.29.2-extras.lock/false/1/2 c9bd997c198bd870 31987b68f78a15ac
+2.29.2-extras.lock/false/1/3 fb64a25d73a65c9e 9d4350e62594c4bd
+2.29.2-extras.lock/false/1/4 1ece70b4c30be10c 57c6944b8081dc52
+2.29.2-extras.lock/false/2 e566dae95a9e004d 31987b68f78a15ac
+2.29.2-extras.lock/false/3 0d3baab19958d37d 9d4350e62594c4bd
+2.29.2-extras.lock/false/4 cd4d01e96e783f60 cbc8fdf8412618de
+2.29.2-extras.lock/false/4/0 f11388289144bb10 b791924f46a9f5fb
+2.29.2-extras.lock/false/4/1 186c989dc779922a 167cb808ffcbf707
+2.29.2-extras.lock/false/4/2 0f9c440563cfe2f0 31987b68f78a15ac
+2.29.2-extras.lock/false/4/3 587733ccd4f9275c 9d4350e62594c4bd
+2.29.2-extras.lock/false/4/4 5ddfba572f128954 cf0b4824213c096b
+2.29.2-extras.lock/true/0 76cdfeb4a2b94bf0 db320a363f3b0aef
+2.29.2-extras.lock/true/0/0 c47e989c0e4dfe92 e00df16814e293c6
+2.29.2-extras.lock/true/0/1 4f9d83db83c80f72 ac51d054694d0605
+2.29.2-extras.lock/true/0/2 9c5f1bd156b8e30c 31987b68f78a15ac
+2.29.2-extras.lock/true/0/3 362b28a5a539d60f 9d4350e62594c4bd
+2.29.2-extras.lock/true/0/4 542b36ac8e279eb1 3a8e9068f2a4684a
+2.29.2-extras.lock/true/1 2279013e11776cc7 57f2d26e43c09de2
+2.29.2-extras.lock/true/1/0 307f45150e84ed7e 42ffefffbc549990
+2.29.2-extras.lock/true/1/1 10cca6777d487e44 be9060dc1b6a69c9
+2.29.2-extras.lock/true/1/2 4fba6905dcdf89e1 31987b68f78a15ac
+2.29.2-extras.lock/true/1/3 3c79e962b64d0737 9d4350e62594c4bd
+2.29.2-extras.lock/true/1/4 3070f1699a2704ee 6dfad02f0313a3cc
+2.29.2-extras.lock/true/2 076496fce5be8bbb 31987b68f78a15ac
+2.29.2-extras.lock/true/3 a2de7459efec7527 9d4350e62594c4bd
+2.29.2-extras.lock/true/4 5efd91f5a5ba60a0 e8bcc8043f9ab68d
+2.29.2-extras.lock/true/4/0 72f04ccd99c8d742 8b1d9e220912140c
+2.29.2-extras.lock/true/4/1 0d8c673e124427bd 79e77ba52682742e
+2.29.2-extras.lock/true/4/2 e0a8c1d36d42ac3d 31987b68f78a15ac
+2.29.2-extras.lock/true/4/3 d1b8cf0d0d1b4e32 9d4350e62594c4bd
+2.29.2-extras.lock/true/4/4 e7077f7068e1d9bb a66c11ad990d52e6
+2.29.2.lock/false/0 1edece642cfe0c82 0b4d13f6c6530254
+2.29.2.lock/false/0/0 231e0e611fd159e9 59e4551e3a18c54d
+2.29.2.lock/false/0/1 8cb0a3c104d0e085 f2ea3957fce316cf
+2.29.2.lock/false/0/2 41d8e6e9cb5edfd3 31987b68f78a15ac
+2.29.2.lock/false/0/3 2fb1cba7a90ef5ff 9d4350e62594c4bd
+2.29.2.lock/false/0/4 3e058d1109714614 4a97499202850f2f
+2.29.2.lock/false/1 53dc731fb86a6373 e867aaa9c9e6b91b
+2.29.2.lock/false/1/0 b72f4748ae803e97 620ef43ba38ee7e7
+2.29.2.lock/false/1/1 f6068a5e61a71a3c 677fd6c338025580
+2.29.2.lock/false/1/2 b7cc7693d49afdb0 31987b68f78a15ac
+2.29.2.lock/false/1/3 76881ad3bf43d6c7 9d4350e62594c4bd
+2.29.2.lock/false/1/4 20e2253a78534f2e 4a97499202850f2f
+2.29.2.lock/false/2 d89131c69f6c1227 31987b68f78a15ac
+2.29.2.lock/false/3 32e395e43fab5663 9d4350e62594c4bd
+2.29.2.lock/false/4 562e19bd55e8b674 4a97499202850f2f
+2.29.2.lock/true/0 8a43743e5286232e f07f55759755778d
+2.29.2.lock/true/0/0 71a3f31fec800a94 1ca72aab99b79722
+2.29.2.lock/true/0/1 377348d1770d8d3c 83f6e429a4b6dc23
+2.29.2.lock/true/0/2 594f0ebd90887831 31987b68f78a15ac
+2.29.2.lock/true/0/3 a751575c387bd80a 9d4350e62594c4bd
+2.29.2.lock/true/0/4 bde4e70968527015 4a97499202850f2f
+2.29.2.lock/true/1 bf5a4a16b326bbe3 487e511714886b25
+2.29.2.lock/true/1/0 792c78d66ba2c420 0b29c3a314eddedf
+2.29.2.lock/true/1/1 37d19a9b5caa7816 ba96185c0a0d871e
+2.29.2.lock/true/1/2 f2d579e4b4be55ba 31987b68f78a15ac
+2.29.2.lock/true/1/3 a9b40ca4d6485935 9d4350e62594c4bd
+2.29.2.lock/true/1/4 5fe2e98bcb96858a 4a97499202850f2f
+2.29.2.lock/true/2 1caffaf42779819c 31987b68f78a15ac
+2.29.2.lock/true/3 7fb7508b9af1a3d9 9d4350e62594c4bd
+2.29.2.lock/true/4 0505712b6e7cfba9 4a97499202850f2f
+2.3.4.lock/false/0 ac6cf543f7625ad5 19baf59da7b9d9d3
+2.3.4.lock/false/1 55f1f45d7ad970d2 19baf59da7b9d9d3
+2.3.4.lock/false/2 201de4c4094726e2 19baf59da7b9d9d3
+2.3.4.lock/false/3 02f719f63645f2d4 9d4350e62594c4bd
+2.3.4.lock/false/4 4ced9f97d019a596 19baf59da7b9d9d3
+2.3.4.lock/true/0 d44eb779ce8d49af 19baf59da7b9d9d3
+2.3.4.lock/true/1 424f199b199fd495 19baf59da7b9d9d3
+2.3.4.lock/true/2 16039e1e37786287 19baf59da7b9d9d3
+2.3.4.lock/true/3 5657e6b34be73da6 9d4350e62594c4bd
+2.3.4.lock/true/4 996e7bb3c8f1cb24 19baf59da7b9d9d3
+2.6.1.lock/false/0 af3be1157ecd6d58 84b40e1a94ad80ed
+2.6.1.lock/false/1 335238fbbe4c2423 84b40e1a94ad80ed
+2.6.1.lock/false/2 9b33ab2dd33d9cf2 84b40e1a94ad80ed
+2.6.1.lock/false/3 6fd61aa6609508be 9d4350e62594c4bd
+2.6.1.lock/false/4 e90d11b6d3e7f022 84b40e1a94ad80ed
+2.6.1.lock/true/0 c1ac5fa3ca8213cf 84b40e1a94ad80ed
+2.6.1.lock/true/1 6886de274446391d 84b40e1a94ad80ed
+2.6.1.lock/true/2 fa69ac05b81bd422 84b40e1a94ad80ed
+2.6.1.lock/true/3 984ee9676c10b7e8 9d4350e62594c4bd
+2.6.1.lock/true/4 ba3dff3fdab3186a 84b40e1a94ad80ed
+2.7.4.lock/false/0 af3be1157ecd6d58 84b40e1a94ad80ed
+2.7.4.lock/false/1 335238fbbe4c2423 84b40e1a94ad80ed
+2.7.4.lock/false/2 9b33ab2dd33d9cf2 84b40e1a94ad80ed
+2.7.4.lock/false/3 6fd61aa6609508be 9d4350e62594c4bd
+2.7.4.lock/false/4 e90d11b6d3e7f022 84b40e1a94ad80ed
+2.7.4.lock/true/0 c1ac5fa3ca8213cf 84b40e1a94ad80ed
+2.7.4.lock/true/1 6886de274446391d 84b40e1a94ad80ed
+2.7.4.lock/true/2 fa69ac05b81bd422 84b40e1a94ad80ed
+2.7.4.lock/true/3 984ee9676c10b7e8 9d4350e62594c4bd
+2.7.4.lock/true/4 ba3dff3fdab3186a 84b40e1a94ad80ed
+2.8.2.lock/false/0 013cfec6f337268d 3ae5146fc4b223ea
+2.8.2.lock/false/0/0 d80f5deb0440d83c 0d985a6b205233cf
+2.8.2.lock/false/0/1 2d0eb36af655b9af 861a365271db06fb
+2.8.2.lock/false/0/2 61361d1a0b5b0b8f 31987b68f78a15ac
+2.8.2.lock/false/0/3 d50e9644b5415804 9d4350e62594c4bd
+2.8.2.lock/false/0/4 f8962f673b623907 4a97499202850f2f
+2.8.2.lock/false/1 2b3be7571563d16d 6baa2d2dfc13267d
+2.8.2.lock/false/1/0 f95a93faed27af1d e2aaad3d6417a3d8
+2.8.2.lock/false/1/1 9a5fe84f5d756f7a f11528364defd16b
+2.8.2.lock/false/1/2 1e53d25319d5c2d5 31987b68f78a15ac
+2.8.2.lock/false/1/3 ac58dc489d0af8cb 9d4350e62594c4bd
+2.8.2.lock/false/1/4 77797e6ad3eed1bc 4a97499202850f2f
+2.8.2.lock/false/2 eafb788efd65ec0b 31987b68f78a15ac
+2.8.2.lock/false/3 783706256d72eaaf 9d4350e62594c4bd
+2.8.2.lock/false/4 5433ff2877eabd7c 4a97499202850f2f
+2.8.2.lock/true/0 9766a15fc33a49d8 d8edf85713a4fb8a
+2.8.2.lock/true/0/0 c93f89163fe62dc5 990d57106a8e8532
+2.8.2.lock/true/0/1 4da5e25af64ebb55 76646996517a0167
+2.8.2.lock/true/0/2 a40148df14979187 31987b68f78a15ac
+2.8.2.lock/true/0/3 604093f199da859f 9d4350e62594c4bd
+2.8.2.lock/true/0/4 8bd484eea95f2679 4a97499202850f2f
+2.8.2.lock/true/1 e11cc89b01cccf1e 708311e953408c09
+2.8.2.lock/true/1/0 cf32103eaef231ac d6ff4ea362936787
+2.8.2.lock/true/1/1 9e6164c8767f36d3 87ca72cd6d94d656
+2.8.2.lock/true/1/2 d3b2c871128bb7ae 31987b68f78a15ac
+2.8.2.lock/true/1/3 f7910f8688d17c91 9d4350e62594c4bd
+2.8.2.lock/true/1/4 0f67cb536ff941e8 4a97499202850f2f
+2.8.2.lock/true/2 4aa4b46de81d799b 31987b68f78a15ac
+2.8.2.lock/true/3 7282e3d121f92fc3 9d4350e62594c4bd
+2.8.2.lock/true/4 2a6c63b279706c7e 4a97499202850f2f
+2.9.3.lock/false/0 013cfec6f337268d 3ae5146fc4b223ea
+2.9.3.lock/false/0/0 d80f5deb0440d83c 0d985a6b205233cf
+2.9.3.lock/false/0/1 2d0eb36af655b9af 861a365271db06fb
+2.9.3.lock/false/0/2 61361d1a0b5b0b8f 31987b68f78a15ac
+2.9.3.lock/false/0/3 d50e9644b5415804 9d4350e62594c4bd
+2.9.3.lock/false/0/4 f8962f673b623907 4a97499202850f2f
+2.9.3.lock/false/1 2b3be7571563d16d 6baa2d2dfc13267d
+2.9.3.lock/false/1/0 f95a93faed27af1d e2aaad3d6417a3d8
+2.9.3.lock/false/1/1 9a5fe84f5d756f7a f11528364defd16b
+2.9.3.lock/false/1/2 1e53d25319d5c2d5 31987b68f78a15ac
+2.9.3.lock/false/1/3 ac58dc489d0af8cb 9d4350e62594c4bd
+2.9.3.lock/false/1/4 77797e6ad3eed1bc 4a97499202850f2f
+2.9.3.lock/false/2 eafb788efd65ec0b 31987b68f78a15ac
+2.9.3.lock/false/3 783706256d72eaaf 9d4350e62594c4bd
+2.9.3.lock/false/4 5433ff2877eabd7c 4a97499202850f2f
+2.9.3.lock/true/0 9766a15fc33a49d8 d8edf85713a4fb8a
+2.9.3.lock/true/0/0 c93f89163fe62dc5 990d57106a8e8532
+2.9.3.lock/true/0/1 4da5e25af64ebb55 76646996517a0167
+2.9.3.lock/true/0/2 a40148df14979187 31987b68f78a15ac
+2.9.3.lock/true/0/3 604093f199da859f 9d4350e62594c4bd
+2.9.3.lock/true/0/4 8bd484eea95f2679 4a97499202850f2f
+2.9.3.lock/true/1 e11cc89b01cccf1e 708311e953408c09
+2.9.3.lock/true/1/0 cf32103eaef231ac d6ff4ea362936787
+2.9.3.lock/true/1/1 9e6164c8767f36d3 87ca72cd6d94d656
+2.9.3.lock/true/1/2 d3b2c871128bb7ae 31987b68f78a15ac
+2.9.3.lock/true/1/3 f7910f8688d17c91 9d4350e62594c4bd
+2.9.3.lock/true/1/4 0f67cb536ff941e8 4a97499202850f2f
+2.9.3.lock/true/2 4aa4b46de81d799b 31987b68f78a15ac
+2.9.3.lock/true/3 7282e3d121f92fc3 9d4350e62594c4bd
+2.9.3.lock/true/4 2a6c63b279706c7e 4a97499202850f2f
diff --git a/crates/socket-patch-core/tests/equivalence/pdm_rewrite_shared_parse.golden b/crates/socket-patch-core/tests/equivalence/pdm_rewrite_shared_parse.golden
new file mode 100644
index 000000000..408fd6841
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/pdm_rewrite_shared_parse.golden
@@ -0,0 +1,122 @@
+# One grown pdm.lock and its url deps, rewritten, then re-run over the result.
+# <case> <input digest> <output digest>
+0.12.3-extras.lock/extra=0/crlf=false 32f821e7019d949a 08240ba723af2d0c
+0.12.3-extras.lock/extra=0/crlf=false/re-run 4f20edf70205d5fc 122633e9e87893b7
+0.12.3-extras.lock/extra=0/crlf=true 468e5e69961a14b8 661d3eab379eec41
+0.12.3-extras.lock/extra=0/crlf=true/re-run 4cd24c2439d21052 38321d58c8d79860
+0.12.3-extras.lock/extra=3/crlf=false e692045f63835350 835d9c46aa027db3
+0.12.3-extras.lock/extra=3/crlf=false/re-run d4fb12f2bb25f4b2 18db90f07be0748b
+0.12.3-extras.lock/extra=3/crlf=true e1af44c235731c5c fa72e7e13439bf56
+0.12.3-extras.lock/extra=3/crlf=true/re-run 495e22454c7a8c2e f10bc01b62db6995
+0.12.3.lock/extra=0/crlf=false aadedf7ab57ecec0 3fcae84c661312d8
+0.12.3.lock/extra=0/crlf=false/re-run 449a34f5b4b9cd5b a56f9fcdfd15ef59
+0.12.3.lock/extra=0/crlf=true 3440d1dd6fdef220 bfeb1aefb1e1cb94
+0.12.3.lock/extra=0/crlf=true/re-run 62bf34eccb5375b7 9a814aa9e74e2b1f
+0.12.3.lock/extra=3/crlf=false 469f7add2852e570 7874edd9e47717a8
+0.12.3.lock/extra=3/crlf=false/re-run 276a742789f69ecf b68d461fc7fe171a
+0.12.3.lock/extra=3/crlf=true a23f4e68810d2e31 f2933dc828bfeb6a
+0.12.3.lock/extra=3/crlf=true/re-run 924753d0642505ad 630aedbd31b3a8aa
+1.15.5.lock/extra=0/crlf=false 30e33073c006d54c 0ccbe59baa9f0fbe
+1.15.5.lock/extra=0/crlf=false/re-run 30e33073c006d54c 0ccbe59baa9f0fbe
+1.15.5.lock/extra=0/crlf=true 439940fedd41d447 0ccbe59baa9f0fbe
+1.15.5.lock/extra=0/crlf=true/re-run 439940fedd41d447 0ccbe59baa9f0fbe
+1.15.5.lock/extra=3/crlf=false 723f9fb197125287 5159a2ff08da0af0
+1.15.5.lock/extra=3/crlf=false/re-run 723f9fb197125287 5159a2ff08da0af0
+1.15.5.lock/extra=3/crlf=true ff0f2b5bc836736a 5159a2ff08da0af0
+1.15.5.lock/extra=3/crlf=true/re-run ff0f2b5bc836736a 5159a2ff08da0af0
+2.0.3.lock/extra=0/crlf=false d151295e2200c4de c783b4deb1169551
+2.0.3.lock/extra=0/crlf=false/re-run d151295e2200c4de c783b4deb1169551
+2.0.3.lock/extra=0/crlf=true f2dd1896360a12bf c783b4deb1169551
+2.0.3.lock/extra=0/crlf=true/re-run f2dd1896360a12bf c783b4deb1169551
+2.0.3.lock/extra=3/crlf=false 1ee3d0a050ff3b56 b191be10baefa6d7
+2.0.3.lock/extra=3/crlf=false/re-run 1ee3d0a050ff3b56 b191be10baefa6d7
+2.0.3.lock/extra=3/crlf=true 595076b077816648 b191be10baefa6d7
+2.0.3.lock/extra=3/crlf=true/re-run 595076b077816648 b191be10baefa6d7
+2.1.5.lock/extra=0/crlf=false d151295e2200c4de c783b4deb1169551
+2.1.5.lock/extra=0/crlf=false/re-run d151295e2200c4de c783b4deb1169551
+2.1.5.lock/extra=0/crlf=true f2dd1896360a12bf c783b4deb1169551
+2.1.5.lock/extra=0/crlf=true/re-run f2dd1896360a12bf c783b4deb1169551
+2.1.5.lock/extra=3/crlf=false 1ee3d0a050ff3b56 b191be10baefa6d7
+2.1.5.lock/extra=3/crlf=false/re-run 1ee3d0a050ff3b56 b191be10baefa6d7
+2.1.5.lock/extra=3/crlf=true 595076b077816648 b191be10baefa6d7
+2.1.5.lock/extra=3/crlf=true/re-run 595076b077816648 b191be10baefa6d7
+2.10.4.lock/extra=0/crlf=false e54717976bdd858c dc874a7a22e7924c
+2.10.4.lock/extra=0/crlf=false/re-run 73ab2b69040a181d ba6b6361916544f2
+2.10.4.lock/extra=0/crlf=true 4335e455031feee6 eb97cb41d74e0b09
+2.10.4.lock/extra=0/crlf=true/re-run 9d45a95e71c5513e ff6d620f94840245
+2.10.4.lock/extra=3/crlf=false 3d9b01cda617acc0 f87505b8e76d1664
+2.10.4.lock/extra=3/crlf=false/re-run 291415b8eb956abe 460733ce80caa2a2
+2.10.4.lock/extra=3/crlf=true 94cc3990fbfcd51e 1f33ff52cab24fad
+2.10.4.lock/extra=3/crlf=true/re-run e99e4203c1d331ef 25f71becb57e2c44
+2.11.2.lock/extra=0/crlf=false 70769835909eaac8 86e6d1a046779d57
+2.11.2.lock/extra=0/crlf=false/re-run 7963b4ae7d0d994a 55ca2409ae480dbf
+2.11.2.lock/extra=0/crlf=true cc3cbacb1731ab5f e5530caff4c2f936
+2.11.2.lock/extra=0/crlf=true/re-run c344cee817dbe0f9 c2f007bdb811f273
+2.11.2.lock/extra=3/crlf=false 37630585cfc724b0 390e37055a77d5bf
+2.11.2.lock/extra=3/crlf=false/re-run f8bb9f8026cb819c 24c66b7c114ad749
+2.11.2.lock/extra=3/crlf=true 6a599cc12b636545 8691357982ab4f25
+2.11.2.lock/extra=3/crlf=true/re-run 33cfa42ac5fdaa86 5abbebea7456d39a
+2.17.3.lock/extra=0/crlf=false a34d24b5bf65e86a e5fede4b116a45fe
+2.17.3.lock/extra=0/crlf=false/re-run 588911f0a1bb810d 55ca2409ae480dbf
+2.17.3.lock/extra=0/crlf=true 4b870f1dbec71d8f 74da760c19111918
+2.17.3.lock/extra=0/crlf=true/re-run 962b761529ce7422 c2f007bdb811f273
+2.17.3.lock/extra=3/crlf=false 717931ac14b867a1 00f5c85e81a1402a
+2.17.3.lock/extra=3/crlf=false/re-run aa6c9ec7867d959e 24c66b7c114ad749
+2.17.3.lock/extra=3/crlf=true a83c52ecc249c552 ec6b9c2e5ffd80bd
+2.17.3.lock/extra=3/crlf=true/re-run f5a2cf7a50401a7f 5abbebea7456d39a
+2.29.2-extras.lock/extra=0/crlf=false 86b81c50fe6c006b 7d28c3f85178a304
+2.29.2-extras.lock/extra=0/crlf=false/re-run b42dd0a578e5ff96 41b2b3b16308685b
+2.29.2-extras.lock/extra=0/crlf=true 328f5c2aea325c59 99963c06c57709c7
+2.29.2-extras.lock/extra=0/crlf=true/re-run f7e2684d419efe81 a8281c40211c9564
+2.29.2-extras.lock/extra=3/crlf=false 2afce565684f5fea 0046bbcdd56d9888
+2.29.2-extras.lock/extra=3/crlf=false/re-run 72cda940d69299e8 a3d92a64c9b9161a
+2.29.2-extras.lock/extra=3/crlf=true 7720d414e5596856 f3460c6de1231dd2
+2.29.2-extras.lock/extra=3/crlf=true/re-run 91d44ea3e6c55423 30bc0feb4cf3430e
+2.29.2.lock/extra=0/crlf=false 3cdca5c3b20a01ba 87aafe287ffa1b2d
+2.29.2.lock/extra=0/crlf=false/re-run fa015257a19c52a2 55ca2409ae480dbf
+2.29.2.lock/extra=0/crlf=true 1cdb37caf1f46f65 b66b619ce85adfae
+2.29.2.lock/extra=0/crlf=true/re-run 12cb176d9f553617 c2f007bdb811f273
+2.29.2.lock/extra=3/crlf=false 265519d6cf68fac6 a08e0b96fa59510d
+2.29.2.lock/extra=3/crlf=false/re-run 62332dbacf8ed1a9 24c66b7c114ad749
+2.29.2.lock/extra=3/crlf=true 427a629145b32492 fb06e91706beee85
+2.29.2.lock/extra=3/crlf=true/re-run f93afbac31f8538d 5abbebea7456d39a
+2.3.4.lock/extra=0/crlf=false 40e64edcc9d7d786 1b22a21fde747f10
+2.3.4.lock/extra=0/crlf=false/re-run 40e64edcc9d7d786 1b22a21fde747f10
+2.3.4.lock/extra=0/crlf=true 9c532c6a9e900f73 1b22a21fde747f10
+2.3.4.lock/extra=0/crlf=true/re-run 9c532c6a9e900f73 1b22a21fde747f10
+2.3.4.lock/extra=3/crlf=false a9c0c2181b62403b bae07a9d9d86a2dc
+2.3.4.lock/extra=3/crlf=false/re-run a9c0c2181b62403b bae07a9d9d86a2dc
+2.3.4.lock/extra=3/crlf=true 109c3f4d515f9b0a bae07a9d9d86a2dc
+2.3.4.lock/extra=3/crlf=true/re-run 109c3f4d515f9b0a bae07a9d9d86a2dc
+2.6.1.lock/extra=0/crlf=false 3b0e3fab2214638a 2eb0674ae44aafe5
+2.6.1.lock/extra=0/crlf=false/re-run 3b0e3fab2214638a 2eb0674ae44aafe5
+2.6.1.lock/extra=0/crlf=true 2cdeccca85cb10c5 2eb0674ae44aafe5
+2.6.1.lock/extra=0/crlf=true/re-run 2cdeccca85cb10c5 2eb0674ae44aafe5
+2.6.1.lock/extra=3/crlf=false 4b722baee7f0f317 94669d0d54dd0a72
+2.6.1.lock/extra=3/crlf=false/re-run 4b722baee7f0f317 94669d0d54dd0a72
+2.6.1.lock/extra=3/crlf=true a54ea3432b81f6df 94669d0d54dd0a72
+2.6.1.lock/extra=3/crlf=true/re-run a54ea3432b81f6df 94669d0d54dd0a72
+2.7.4.lock/extra=0/crlf=false 3b0e3fab2214638a 2eb0674ae44aafe5
+2.7.4.lock/extra=0/crlf=false/re-run 3b0e3fab2214638a 2eb0674ae44aafe5
+2.7.4.lock/extra=0/crlf=true 2cdeccca85cb10c5 2eb0674ae44aafe5
+2.7.4.lock/extra=0/crlf=true/re-run 2cdeccca85cb10c5 2eb0674ae44aafe5
+2.7.4.lock/extra=3/crlf=false 4b722baee7f0f317 94669d0d54dd0a72
+2.7.4.lock/extra=3/crlf=false/re-run 4b722baee7f0f317 94669d0d54dd0a72
+2.7.4.lock/extra=3/crlf=true a54ea3432b81f6df 94669d0d54dd0a72
+2.7.4.lock/extra=3/crlf=true/re-run a54ea3432b81f6df 94669d0d54dd0a72
+2.8.2.lock/extra=0/crlf=false 6c3cc7227d438ba3 5f6c14896258259e
+2.8.2.lock/extra=0/crlf=false/re-run 7eb8874b384e277f 4ec68a9020622cd5
+2.8.2.lock/extra=0/crlf=true 106a0b381a7f2ca6 f66e02a7d1d3b103
+2.8.2.lock/extra=0/crlf=true/re-run 328866e0c8c78cd6 b19163993a46fe62
+2.8.2.lock/extra=3/crlf=false b06f1554571af632 794fbf9141bfe2b5
+2.8.2.lock/extra=3/crlf=false/re-run 2226b0e4c8cb167a 8ee5d959e60359db
+2.8.2.lock/extra=3/crlf=true 2497000444598dcd 388cb4ac81e75f84
+2.8.2.lock/extra=3/crlf=true/re-run b5c4d673c417d27b 0c38b85d219ec85c
+2.9.3.lock/extra=0/crlf=false 6c3cc7227d438ba3 5f6c14896258259e
+2.9.3.lock/extra=0/crlf=false/re-run 7eb8874b384e277f 4ec68a9020622cd5
+2.9.3.lock/extra=0/crlf=true 106a0b381a7f2ca6 f66e02a7d1d3b103
+2.9.3.lock/extra=0/crlf=true/re-run 328866e0c8c78cd6 b19163993a46fe62
+2.9.3.lock/extra=3/crlf=false b06f1554571af632 794fbf9141bfe2b5
+2.9.3.lock/extra=3/crlf=false/re-run 2226b0e4c8cb167a 8ee5d959e60359db
+2.9.3.lock/extra=3/crlf=true 2497000444598dcd 388cb4ac81e75f84
+2.9.3.lock/extra=3/crlf=true/re-run b5c4d673c417d27b 0c38b85d219ec85c
diff --git a/crates/socket-patch-core/tests/equivalence/poetry_lock_reused_parse.golden b/crates/socket-patch-core/tests/equivalence/poetry_lock_reused_parse.golden
new file mode 100644
index 000000000..92c6bfa58
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/poetry_lock_reused_parse.golden
@@ -0,0 +1,872 @@
+# One rewrite step over a grown poetry.lock: the text and edits, none, or the refusal.
+# <case> <input digest> <output digest>
+0 7838f7f8f4fb2f70 7d3a95318af346aa
+1 b8abc1d318c69857 7d3a95318af346aa
+2 4455ad203c1857e6 7d3a95318af346aa
+3 9aed4d3c7aeecb00 a268e85ef673625d
+4 7838f7f8f4fb2f70 7d3a95318af346aa
+5 dee8f31dd1663146 7d3a95318af346aa
+6 f2fe25536bb05f10 d328039379eaf035
+7 7eeba9a2817615db 7d3a95318af346aa
+8 3db538680f7353af 7d3a95318af346aa
+9 cbe24dc5a979b381 7d3a95318af346aa
+10 a5a09f459a1d08f0 a268e85ef673625d
+11 7eeba9a2817615db 7d3a95318af346aa
+12 48f6e919199e639b 7d3a95318af346aa
+13 b63a603b6da720a8 6c989b8a5ad64ce2
+14 4bff41c15e070a15 7d3a95318af346aa
+15 ec49b75553cb184f 7d3a95318af346aa
+16 9db39321d8af57b9 7d3a95318af346aa
+17 63d4b66d2bb5c28a 7d3a95318af346aa
+18 36086d3b80e12b95 7d3a95318af346aa
+19 37ed1c8272ec221e a268e85ef673625d
+20 4bff41c15e070a15 7d3a95318af346aa
+21 8ca2d669e1fcb2d3 7d3a95318af346aa
+22 0fcfeb1aec3417bf c4aee716944cb5ef
+23 acf64f016131aa8f 2a63c4a3f83df877
+24 bcb06e4477145c98 7d3a95318af346aa
+25 c66750c61b9d9388 7d3a95318af346aa
+26 a80ee7b9ab744029 7d3a95318af346aa
+27 48024bf6176c3160 7d3a95318af346aa
+28 4ce86d4158f01f35 7d3a95318af346aa
+29 e4aba7a8854ac222 a268e85ef673625d
+30 bcb06e4477145c98 7d3a95318af346aa
+31 37c6395a40c06fb0 7d3a95318af346aa
+32 1375e0f1d5fced12 40b28b9e1a6d04ad
+33 bf0f4b6f085e7097 bc6d70529850c25a
+34 31b63481ebdd0481 7d3a95318af346aa
+35 9f92aa30ab1841b4 7d3a95318af346aa
+36 28e9f8a6c02cdc9b 7d3a95318af346aa
+37 fe13e38ebcfa13d1 7d3a95318af346aa
+38 7797272a95160d69 7d3a95318af346aa
+39 5470a8c38bf5bf4b 7d3a95318af346aa
+40 eb073793bef1ed1b 7d3a95318af346aa
+41 d145ac2577111d49 a268e85ef673625d
+42 31b63481ebdd0481 7d3a95318af346aa
+43 4449508eab5ae45f 7d3a95318af346aa
+44 809e3f4586bf7976 f1c5684b36bdf0a1
+45 079671c88ef7ef5d 71dde68bae429dbc
+46 5c9fb292440d6b46 7d3a95318af346aa
+47 86653779b6f48f9f 7d3a95318af346aa
+48 afee00d0a0214b7d 7d3a95318af346aa
+49 85e92dcab30cfa58 7d3a95318af346aa
+50 a566cc7ef71b0733 7d3a95318af346aa
+51 8c277a2959596d65 7d3a95318af346aa
+52 2a9f8041c798f61f 7d3a95318af346aa
+53 9d215cbc7b12dc0e a268e85ef673625d
+54 5c9fb292440d6b46 7d3a95318af346aa
+55 ba41631a3a831c6d 7d3a95318af346aa
+56 7be0a3cc0ce2b585 522aefee3ad06058
+57 bf00ed0c41d94b0b d22fa7470a610982
+58 080acc4ce1486f50 58ee04bf8550b643
+59 f1ba49a21cd72cb8 9a946702625c5b75
+60 a2f5af94f8758c21 539c1d2a923979b9
+61 18924699d59890de a268e85ef673625d
+62 bc05549d3897a7c2 bbf0609ef057d431
+63 be6913494112f00e 2f90002d3fed846e
+64 2f22510f2ae74251 9ea28f11728746d5
+65 25979033e37ea461 d29da66f1eeaa46d
+66 171e3cdb83497f32 9a946702625c5b75
+67 444c9579c55afedd 539c1d2a923979b9
+68 7d466824b6efa319 a268e85ef673625d
+69 6b8a17a57af57c5d 5b10e85632263dfd
+70 cfbde172dde75668 f67335ca72109fc4
+71 31b56b0077a83edc 9ea28f11728746d5
+72 8485a46a61840730 3a8c3537dc04bfe9
+73 3468d51c83811ca3 ca1a3315f07e57c9
+74 d7eedc8edfb834eb 38ed453866e3eb6c
+75 11e9cdcbc3dc8705 9a946702625c5b75
+76 f076099eee3dbf70 539c1d2a923979b9
+77 2147c1088d5b22ce a268e85ef673625d
+78 38edf45143d5e0b1 fc587df0ad3b4295
+79 3a050b4886522c5f 3097e24fdfda4d8a
+80 89e32eecbfc01377 9ea28f11728746d5
+81 1b449b11f6e07151 cf7be6ece6f4062a
+82 4c85c5bc86cf6915 4da124b63aef2f12
+83 5ac8402fc4adec3e fc63fa3ef6cdd242
+84 c39743e275810405 88d41c548793615a
+85 a97fcc9f10016693 9a946702625c5b75
+86 79f745dc9f6e0086 539c1d2a923979b9
+87 f2a2f0a77ecd569e a268e85ef673625d
+88 492204923bc4ebe9 653c4adc7c5f8be1
+89 60947e2cf227d970 381d7ab078d08e8e
+90 35987381cdbb28ee 9ea28f11728746d5
+91 79a976cb0cda34f7 cf7be6ece6f4062a
+92 4fa0be9f74401a83 01edae95d3d4ed47
+93 911aabb001ef6e8d 732e7e26de551f43
+94 3d8f8a0d5f874d57 fb605b9d822a361c
+95 01accde2f128c2d5 b1ee42755c19a7a4
+96 f72bb6ce0c7a9b45 97db4e14557c2d5a
+97 36b1b33c067db182 9a946702625c5b75
+98 758356552da893cb 539c1d2a923979b9
+99 5ba7af3c522ba3bb a268e85ef673625d
+100 10d14b0e411b1aa7 3e9741e5a1291ee6
+101 afb726d50d59c1e5 57e66fc5adebd789
+102 0aa4dcfbe462e5a5 9ea28f11728746d5
+103 381474a81bb774ee cf7be6ece6f4062a
+104 1a049cbf3e516d8e f45e9993f93c5d0d
+105 4dfcd01c2a8e564e 3805ffb61406f72f
+106 6e34751cbff7fc86 cb38816c35d8438f
+107 3f4b2ff713e72ea4 14f4d0a31907198a
+108 79b1b2a0c0f715f6 0af5fa92a361be20
+109 26e5f160f11df203 9a946702625c5b75
+110 24c5c4b7e4655feb 539c1d2a923979b9
+111 ac25471ee5199635 a268e85ef673625d
+112 ab9bbe515103d875 2f511c4eda31a500
+113 a9fe0d84c03236c5 4fa5cb42b68d6914
+114 fd3f376c4a644f78 9ea28f11728746d5
+115 e592e2facd02bbbf cf7be6ece6f4062a
+116 fb5b254b9994a188 cc944f55a5a0082f
+117 9f6fb05b6a75c96b 9a946702625c5b75
+118 60022608dcdb7b6f 539c1d2a923979b9
+119 9465be8865606316 a268e85ef673625d
+120 fd739a9f0836045f a252e7bed1d6a58b
+121 91b491a2852fdcc8 1978bf222c5fa6cb
+122 376fd61cb0dab429 a0c7f8b7a38ce82d
+123 e245a0bf72d8ab96 2cbccb4ec2f0c539
+124 63e577485a115e4e 9a946702625c5b75
+125 c29a0ac19f1a5523 539c1d2a923979b9
+126 3fcbc7aeaefd3917 a268e85ef673625d
+127 70325c0f5e684305 3213d601ce38c9e9
+128 8fe78ae2418b2831 87c9127dd9ddebb8
+129 3e0e275e4acafbf5 a0c7f8b7a38ce82d
+130 7cadfe0d41df5c75 662d03d37ece9276
+131 edd0f61a97a32946 ff9fca563e25cff4
+132 77c59ee7f4197a44 8237c506e6f38ccf
+133 9e8e073841ccc695 9a946702625c5b75
+134 9cfe6337b27ca40d 539c1d2a923979b9
+135 9813ae729caa8b20 a268e85ef673625d
+136 8e40c4787a136b9a ebcab9badc3e7e4d
+137 102423a374b12f00 771aeff31fc5f0d2
+138 772c2c5f97a4147f a0c7f8b7a38ce82d
+139 b5cba363e8ee130a fa079e0607c31b4f
+140 b74f22d0c14464f1 0a5e7223c1076ae2
+141 f488daabeb54ad07 ea40a8b7652bb1c0
+142 71811739278bab3c 3939cf05c8b9c74e
+143 ce90b0de308dabee 9a946702625c5b75
+144 791b5712dffa1955 539c1d2a923979b9
+145 2885f2259db1c515 a268e85ef673625d
+146 4f38204e76521ec3 298a5468c145227a
+147 2554632edf53b598 e9aacb5bd253a27b
+148 f49715f69179628a a0c7f8b7a38ce82d
+149 8d8401d7657d6a30 fa079e0607c31b4f
+150 a22abe031dc7b95b 5c3c377ff82d419e
+151 aff5ca113bca6803 147780fb186a73ac
+152 9d1e352e05da5d4b 74166bd05cc1d38e
+153 0323596d11a80337 a8917c74aa1db2b8
+154 5226569855f0bcae 0ed5c705501d2577
+155 60574077ed330d32 9a946702625c5b75
+156 e51dbd10a22122c5 539c1d2a923979b9
+157 4c3db0765b48b21f a268e85ef673625d
+158 f2fca4eef8a7bae3 bbda4630844e623b
+159 815678f2d5adad1b dbd56be550de7e8b
+160 6602486123f3e196 a0c7f8b7a38ce82d
+161 fa742580fa7d991a fa079e0607c31b4f
+162 7f77dda8c758c262 d769352939fbe184
+163 d85f4c2d65d24a6a 33622e8daa1ac3ec
+164 70993265fb755536 f29907d9ac99a2aa
+165 d4e7b25af7b60eb7 bef30065ef0fec38
+166 2af603c0419c0f59 80403f51d1c6b20d
+167 26deb39bc75f07fd 9a946702625c5b75
+168 62805153865f5092 539c1d2a923979b9
+169 5c6c94942d7ff99b a268e85ef673625d
+170 7b8b60e0f566a443 c0188f1d06f4d428
+171 cfe09a7772cbef30 3db6d68f5e658bbf
+172 2562818d58337be2 a0c7f8b7a38ce82d
+173 8a83d4292a09c86d fa079e0607c31b4f
+174 45222ee34dc2b35e c5123a3cb66596ed
+175 8a683c9af7ce5463 9a946702625c5b75
+176 3600fad12d1cd424 539c1d2a923979b9
+177 d59fbef1233e90a9 a268e85ef673625d
+178 68d1b2f7bd837f3b ae23c70254d2aba5
+179 04d085c24f1c4620 92bc60fc060e693c
+180 12d136a135c448f8 a0c7f8b7a38ce82d
+181 1239f0c80c44803a dde74e8640ca6e35
+182 b511a4f8a4d3e1f1 9a946702625c5b75
+183 768083cdf4027491 539c1d2a923979b9
+184 c878d7c780178d3e a268e85ef673625d
+185 bbe59f8cac508903 c3415dfd9db396c4
+186 714b12197e22fedf 26ab9b68d3bb5830
+187 687331e5a4daa4f8 a0c7f8b7a38ce82d
+188 5d94019155de85a5 93a83ca096dfd9a5
+189 4f920af03cc907c6 5eaca3fe56383b1c
+190 ab181640756eee81 5eaca3fe56383b1c
+191 c37cf7174488ae90 9a946702625c5b75
+192 b4fbdfe593458c46 539c1d2a923979b9
+193 f4843f4a132abb71 a268e85ef673625d
+194 2165a8237beb8d3e b6de9531248cfa9d
+195 281a457928d40310 2078b7f77398c61d
+196 49c9424c5d0956ab a0c7f8b7a38ce82d
+197 d1e01f2d24fcb21e 5eaca3fe56383b1c
+198 2d215351e4d38db2 9441ee325ac2271b
+199 a929a99018f473d2 5eaca3fe56383b1c
+200 a1831604ef7d46f7 5eaca3fe56383b1c
+201 56ade1edf5402c8c 9a946702625c5b75
+202 5e81917e41afc699 539c1d2a923979b9
+203 d42f6da337610b61 a268e85ef673625d
+204 59c700eaab481cd3 a5fc33f20460324c
+205 b36da2d7a5464106 1b0b85cc1611b215
+206 fe72c603e3a9bd1c a0c7f8b7a38ce82d
+207 c1e191b4fce506ea 5eaca3fe56383b1c
+208 052f2e3266a1caa8 dba33b7f150cd263
+209 5fb3066b2cf0130b 5eaca3fe56383b1c
+210 2d4fb90c8df59165 5eaca3fe56383b1c
+211 c67afefa1449e0c4 5eaca3fe56383b1c
+212 dfee7750fef28df7 5eaca3fe56383b1c
+213 2d9e0ed8b651a25c 9a946702625c5b75
+214 fc4271a6660bcba8 539c1d2a923979b9
+215 2776ac58d9c5e91c a268e85ef673625d
+216 9d9daa6d056bfaba e7ba5c068c3a530d
+217 d492f82fd6db94f4 141bef1ee07bb90d
+218 6144d70a110ba571 a0c7f8b7a38ce82d
+219 dc9ad5e0487a83c4 5eaca3fe56383b1c
+220 7865ab773bb0d7e0 5144c7839ce59870
+221 45651293a09fe14d 5eaca3fe56383b1c
+222 2b2870eb4d8e97f9 5eaca3fe56383b1c
+223 c2469bc57e61edbe 5eaca3fe56383b1c
+224 7e4c5ed1feae5430 5eaca3fe56383b1c
+225 686df423991ce00b 9a946702625c5b75
+226 dabb307cd8f28c20 539c1d2a923979b9
+227 f8606dce6c93d293 a268e85ef673625d
+228 203963983d6b848a 3ef2b91309f2e427
+229 611e2ff89c68f95c 2a0d02afedab3a5a
+230 f527497a97f701f8 a0c7f8b7a38ce82d
+231 c28e784b6f102d85 5eaca3fe56383b1c
+232 c1ce402f18781be2 a82074ae17313ffd
+233 007611118fe3a64e 9a946702625c5b75
+234 da193ee6f421e697 539c1d2a923979b9
+235 fcb8370f147cd498 a268e85ef673625d
+236 c7efb7c7e506bf0b fe7ffa81f4b20de5
+237 d239809c873e7cb1 c8209e224eae3bb0
+238 6a7255ffccc5619e a0c7f8b7a38ce82d
+239 3a5597bd79c8cade 9018fb47624482a5
+240 401e4631776091fe 9a946702625c5b75
+241 4a69d5c889a031db 539c1d2a923979b9
+242 d8d466b2b7801b6e a268e85ef673625d
+243 0f60b49e3cdce584 f8c7da65b2a18cf2
+244 0b103a5cc1a06696 8d1ce5e7027e75b3
+245 981098098ade4bfa a0c7f8b7a38ce82d
+246 c34cd2a51a2eeb37 e4ed78f1c41388d4
+247 c533f1cb93e1ac9e 02efbf1956ed0b70
+248 e94a54d03f8c9b7f 6aa30f8bf000ba00
+249 f7734bf6136b0114 9a946702625c5b75
+250 9831933a8516c708 539c1d2a923979b9
+251 5d4ec9ea82d01e14 a268e85ef673625d
+252 c4de19124816bb5f f5dcb94c17255110
+253 68775f1231372347 914b4f0fc4ae8688
+254 d182171b111be3ca a0c7f8b7a38ce82d
+255 e5a8321dfd99df64 fa079e0607c31b4f
+256 d7c34b9bb5fa01d6 166233a1773bf527
+257 cd4a7305624682b3 5dca32195af10b24
+258 89b994c8134d41e0 fbb2ec7dbc87180e
+259 13bfbc9fd10e27c8 9a946702625c5b75
+260 da2be22f4d97c7e8 539c1d2a923979b9
+261 bef183b50b9cc203 a268e85ef673625d
+262 c17fc6e0727ce18c 2c4bc20fc2a070ae
+263 e21bd9e589c3fa39 a5ed0838183c05c1
+264 f10f7f2ac12abf4f a0c7f8b7a38ce82d
+265 6e9013aea83ef4b4 fa079e0607c31b4f
+266 3db0d6d6e25138c1 bdfe2f771c7ed78d
+267 84fa852d79f239e9 7c87b6efac687050
+268 1678ce870260d889 57e11ce0c957c099
+269 8eb04cd46a76a6ac bee5a4b12b49eeb7
+270 a21615085d41c75f 065b4e9a418185b0
+271 b03330b6c47089cb 9a946702625c5b75
+272 b24a296f6c6cf366 539c1d2a923979b9
+273 587e4251a3adaa08 a268e85ef673625d
+274 39b84bd36767d208 36a52490a23076fd
+275 1560c86e86b18946 c13409f239ad2827
+276 68d816d0c1ff2f50 a0c7f8b7a38ce82d
+277 667fa61a12c3b26f fa079e0607c31b4f
+278 1e06368e9dd035c1 ecbb26e83e8f5e59
+279 3157b8a82d7a27f8 2187fd4e7585e54c
+280 201f26c3b7aa1b49 71c9006ab9302884
+281 7b2ff370dd99f08a 934b714b48ce9c7b
+282 31871fd008112edf 4c18d9e63dc6c9a4
+283 0f308a83a740e82f 9a946702625c5b75
+284 812a45e42f669a77 539c1d2a923979b9
+285 fe6bcd3505e01693 a268e85ef673625d
+286 3ef73600e8618ef4 73f09d10c7a90e0e
+287 53d21812e7dcbbb5 83387079942df61b
+288 b0ae87d3ea1849c7 a0c7f8b7a38ce82d
+289 3f3c7ba21cfc91b2 fa079e0607c31b4f
+290 5819cd17bc7035b3 f5940413bb5643fb
+291 1a0ffb221f921ef3 9a946702625c5b75
+292 e46cf780baf5deb0 539c1d2a923979b9
+293 c8e83855647a9402 a268e85ef673625d
+294 c50f51653082c8dd ffa90a689ddf31cc
+295 767e2552ddc22e72 9d4cfc1eda196acd
+296 add89f369b576be6 a0c7f8b7a38ce82d
+297 7ee3b3a90557ae60 5fa91e1d68fcf083
+298 b5839df0792cf58b 9a946702625c5b75
+299 94027948906531b2 539c1d2a923979b9
+300 6ab14b60bffb6cfe a268e85ef673625d
+301 aef183ef38546bc7 ca84cfc1aa0cabe0
+302 88b7fff1698f7752 e6cb8f2ff3fa8151
+303 1916983d5f19b39c a0c7f8b7a38ce82d
+304 c909fa8d25b8fc57 33522e585a3ded91
+305 ced752ddd9e0a466 4d852408fe833d49
+306 1cea8a0f38adb01c b5d9b1be9c5235fa
+307 b97f885b75e872d1 9a946702625c5b75
+308 b5ec2d81684179b4 539c1d2a923979b9
+309 01ac357711aa8bca a268e85ef673625d
+310 efa7b85b999acb6e bca8ad032db77d11
+311 cc65572737675507 e20ecb7d0b851260
+312 1c1a68fb55ad050c a0c7f8b7a38ce82d
+313 97f9df5d2c01caa0 fa079e0607c31b4f
+314 08d3905567d9fcfd 8e77e7911d85bf5b
+315 b54ca71634a47ceb 46d6ee5d5c577fc7
+316 0907461d01669163 a032b526fce85c8b
+317 0010a7478674d7c7 9a946702625c5b75
+318 82659362c339bf82 539c1d2a923979b9
+319 5f26e2eed87b3bea a268e85ef673625d
+320 11ad9f1dd7fbe16c 2f82ad412e85093c
+321 f97db0a712825ecb 3aee5702615e9818
+322 eb68d2c1994600dd a0c7f8b7a38ce82d
+323 f029b1bebd90a56c fa079e0607c31b4f
+324 ae081d30599cbdb1 acf8e147102b617f
+325 f2afa5ee721619c5 3940a3c4124bf277
+326 8b2af7de7336feee 63b5065950d37377
+327 73f653c4d56764b9 bab175aa052cb8dd
+328 0fb73a24ce2eefff a437ec109ba84f07
+329 4d6b2940b14618d7 9a946702625c5b75
+330 badeb4bc1749060e 539c1d2a923979b9
+331 20d0ee4a3bfa8e7f a268e85ef673625d
+332 b5921ec66943c82f cb3db0388f0da7c1
+333 6261ea0752832e7a b8d43c85d5c176ed
+334 4439437c38714bde a0c7f8b7a38ce82d
+335 75c926f9b9d6f752 fa079e0607c31b4f
+336 282cd007845db159 199297046cb33467
+337 9b587c5fb5c606d0 66fbb6297d733d57
+338 3a1d219e4aa4eb8a 4710a88dc8c13239
+339 86650296d7efb262 efe467c906731dfb
+340 37c4f2095bf4e8a1 824c3c6b85d018f4
+341 b41437fb74a3954a 9a946702625c5b75
+342 5c58ae2321976502 539c1d2a923979b9
+343 25a275e691adab57 a268e85ef673625d
+344 e5062a6d749dffdf 278f266e5397d260
+345 8cb8f7e34408f3c6 a8d0c327cb9b757c
+346 1b9043dfc29f0c41 a0c7f8b7a38ce82d
+347 58edc619775a37b9 fa079e0607c31b4f
+348 df5f238e62946b7b 05b61440919a3a80
+349 137d67b693a46d10 9a946702625c5b75
+350 537c4ded7f90291c 539c1d2a923979b9
+351 a027886921e5507a a268e85ef673625d
+352 3cd6c717fd0cae64 30bcdc015f13e84e
+353 80627371d0a05afe c376bd63b287d15f
+354 165290395237362d a0c7f8b7a38ce82d
+355 608af3f256e4e964 4e881033f7f4b97c
+356 c26e0fb16c68b46b 9a946702625c5b75
+357 f20c7a32b924273a 539c1d2a923979b9
+358 143c54520f4eb26f a268e85ef673625d
+359 10fc8bb4f8894bd5 088f0149a0b9931d
+360 a9579b8564654f15 382770193a0ccfef
+361 45a67546df2ea21f a0c7f8b7a38ce82d
+362 4dd9a7b9a479dc32 bd4e2fb6ff95080b
+363 43f408387653144e 1a39c8156bb0e42a
+364 85e0d89b2d8c7d37 4fd03c68fab03bee
+365 ceae1ee16b8ec45b 9a946702625c5b75
+366 61316a1d54bc7de5 539c1d2a923979b9
+367 cc4c77cb9015c840 a268e85ef673625d
+368 f5d5cb02f379639f 5d17e19341fdbc63
+369 9b14068157a4f92f f39d6db13288907b
+370 28a46096d845026e a0c7f8b7a38ce82d
+371 b89bf0643b14993b fa079e0607c31b4f
+372 14af5cbd8202c1d6 f5f551f2949244f9
+373 132bc5cc2dbfca36 dbe7e604c355cfdf
+374 589e6aa3a3f9c43b 09dbe26927b5ab28
+375 58837e13aa6d7192 9a946702625c5b75
+376 54418794ea39b2c7 539c1d2a923979b9
+377 76d723d9a8192536 a268e85ef673625d
+378 4a81e9244c370271 f191c56695b9ae22
+379 96b46e7e53f36028 d7449eb8cdbd7e4a
+380 9aaa1bdb45d790a7 a0c7f8b7a38ce82d
+381 0960dc410feb8e34 fa079e0607c31b4f
+382 680702f92a29b0d7 91c16056ff4cc6fd
+383 53ca57a1f4d18451 6203f199bfdab739
+384 54bb74c301909188 fc4e0678ad5c35d0
+385 68e3e1a0e50f5053 8e9d41a71bc22633
+386 b9d2b8f66a2a9e5a 54df7d108a7fe4ce
+387 1acf625370f03b1a 9a946702625c5b75
+388 55b6cc5cdd88b2eb 539c1d2a923979b9
+389 ed76cab395bd3fd7 a268e85ef673625d
+390 0c8d5e9081885c58 97170325b033756d
+391 40b71f1a825987c0 7a62b016fd2efa85
+392 16d8ca3dba642065 a0c7f8b7a38ce82d
+393 189bd6e139c8091b fa079e0607c31b4f
+394 c3743fd87d67e49a 4d9e775467eea1d0
+395 a9b9da9dd9414ecd 55a6d86c9c5cdd2d
+396 0b93f8e986787677 28e194978b8d5bb8
+397 d4b372b4ede4672f f342227b2841cefb
+398 66641e3b12009f63 8334fbd8e324c4e9
+399 8994cdcbd92db4bd 9a946702625c5b75
+400 92f43aa7fb4c025e 539c1d2a923979b9
+401 1f4054bf7a2c565c a268e85ef673625d
+402 04fcf0b896985bce a961ad6615255ff7
+403 8e7a8173711a50d0 81be6ab46ebf000a
+404 d5718b52dc79e4ec a0c7f8b7a38ce82d
+405 9efcbdd7d0190a5b fa079e0607c31b4f
+406 84aaca46035a146f 5e0bf9076af9e663
+407 344f5f2eccedf798 9a946702625c5b75
+408 a602717a0d806acb 539c1d2a923979b9
+409 188fd2c4e8685e1a a268e85ef673625d
+410 d15f3f04f141fa2e 9c1a55294b98338d
+411 9cce18c74516b8a6 357c0681dd233085
+412 20ac0cf91919c842 a0c7f8b7a38ce82d
+413 9dd8038824cacf85 998e0bf2891431c5
+414 5d72c96ee9ec0302 9a946702625c5b75
+415 07c57c8cdc7764bc 539c1d2a923979b9
+416 7ce2cb89e3a2e0ee a268e85ef673625d
+417 60eb0917c2546591 b25492d8f31939c0
+418 ed807cfb949c655f e34a6aa7e5c64b6a
+419 2d755b67ac659c6a a0c7f8b7a38ce82d
+420 0c79cbc27bdc746c 0f30d19b5c9fc0ad
+421 985c86cc4a0b1351 c75a10669400bc5c
+422 26536576e8031465 4cd2e5a1fbf40af2
+423 d9440f1fa47c4df8 9a946702625c5b75
+424 80f45489cfecb7bf 539c1d2a923979b9
+425 0711119f323e2986 a268e85ef673625d
+426 a31c248aeda39667 779c6e2aad622772
+427 85e7203fde00f03d 83a18362f77801b2
+428 8fcf7dddbbc2f6a2 a0c7f8b7a38ce82d
+429 558b1d26d89be615 fa079e0607c31b4f
+430 ec688e880e6fdc7a 39a7c39d78aa7e4c
+431 0491625f3a26952d 86fb56c929a00448
+432 1cf77352f3b3231b 7fde4ea97d37f1a6
+433 410d9f46d89b19a4 9a946702625c5b75
+434 6d048e41ff743d39 539c1d2a923979b9
+435 573bf3ce8ba174a5 a268e85ef673625d
+436 99a8872eb869db1f 7442ec9c5bf4be6e
+437 481379c82ea76246 2f32b40485c91420
+438 6113b0f4072f961a a0c7f8b7a38ce82d
+439 116d7b5e2f06e648 fa079e0607c31b4f
+440 93c9c70976071883 991c40a7f2ea6d36
+441 05757215fa6cb906 a40455c7fbd8f608
+442 76bd614eba0f795b a4cf6500e4db7952
+443 d4623e23ff8120d9 c755da61cfa0c149
+444 91448f2389ae4555 0c9370cc807da859
+445 92a40d1e35c15a0c 9a946702625c5b75
+446 45f6191e7fe76280 539c1d2a923979b9
+447 079e8e054580c0c4 a268e85ef673625d
+448 7e56722d052d2232 fb2cb89558738336
+449 ca95ca525add07bd 5de7cece8fb4f9e8
+450 96ac2f585069ee14 a0c7f8b7a38ce82d
+451 fb0e3ced2cd6f641 fa079e0607c31b4f
+452 3d668f0fc27b5487 eaee51dd9c46b4e2
+453 f38aed4c82d8cf43 cbe27f2a1d692974
+454 0a11eee54f189b41 9c09ab51c9295dfd
+455 7706538e22ed171f d86902442d3576f0
+456 b63d44cd79f4e6b9 58e7bdd315d5f855
+457 e08eb02752fa5c7e 9a946702625c5b75
+458 468f89317a6abec2 539c1d2a923979b9
+459 a7df00e75c7b1d83 a268e85ef673625d
+460 7dcc3d0c9c68ad4e 968ebfcb1bf1f9ef
+461 7437b5cd9aaf5584 5e63aad87e410d09
+462 9429061c15ad90fe a0c7f8b7a38ce82d
+463 cb972c062d38e80b fa079e0607c31b4f
+464 4b294a6489c0497d 215e551dc3815acf
+465 fc5b5306ede35de5 9a946702625c5b75
+466 71d599ba796386f5 539c1d2a923979b9
+467 3b294bf984262b85 a268e85ef673625d
+468 92216508b0b0e623 993ffead8da75d21
+469 4d56262e277aba84 0f37791c27aa2bbe
+470 209eb3d9570167a8 a0c7f8b7a38ce82d
+471 6b5e3ef33328b409 6c76f9bc1edb03ae
+472 63dd9f334465f84b 9a946702625c5b75
+473 a8c66b07ddf17d98 539c1d2a923979b9
+474 fd82bf829cd003a5 a268e85ef673625d
+475 902a254f7188e316 8ea7b5c2d080b941
+476 151b19de809af4c1 7c78018a7813e2fd
+477 3c18e89e56b26095 a0c7f8b7a38ce82d
+478 1a57237da9bab0b1 b24109b9abe172c9
+479 4c66505e3aea3e57 9d8f596a072f93aa
+480 2d4ec5a541abb340 2db56585ca4e27cf
+481 f1940404bc989dbd 9a946702625c5b75
+482 ac656ebbd6e733dd 539c1d2a923979b9
+483 47db17a38f12c8b1 a268e85ef673625d
+484 e9e00de5cc1cf464 b8b46ca85486610c
+485 4a0cc95f6bea24d2 fefb4a92baf8fa21
+486 82f9809b55071475 a0c7f8b7a38ce82d
+487 416b3ffc0b6bc614 fa079e0607c31b4f
+488 982cb4ce1abaf836 0c165cb0bba061bf
+489 27e435498f74056f f90d0edfccea87b0
+490 eab9a128c3a851c5 a718906f0899fcf7
+491 023e04474bee50b5 9a946702625c5b75
+492 9c670ee6630bce06 539c1d2a923979b9
+493 30242f55b29e389a a268e85ef673625d
+494 5af3aa8b3936cb17 176f3f13b7282c4f
+495 48a17ce7c8402e16 8e63cab086e9ed00
+496 9bd45523da93efa5 a0c7f8b7a38ce82d
+497 238daa228f7034b8 fa079e0607c31b4f
+498 f7426475a8fbf536 89c71d1075640a85
+499 d59f0a839a17f66e 97cd51411a269e3d
+500 11d23c4e453f9334 2ec09967e13baa74
+501 740204dad9986596 53af38f44b449285
+502 e690ea9ac0a03177 366622628af3d69e
+503 a5653f77a2ff29f0 9a946702625c5b75
+504 1f63ea8b0a6367b0 539c1d2a923979b9
+505 89e1b2539f2f6e3c a268e85ef673625d
+506 148d273c65126d33 ec22370901732721
+507 9cf82f2ef603dad1 604b3c665866ae8b
+508 e37d16164e51c99b a0c7f8b7a38ce82d
+509 58d30fb4f67afbc4 fa079e0607c31b4f
+510 4dc11e7c90bc09ae 9dd74e4e2a848eb2
+511 e1f5173eafa1333e 80687ac188957ee6
+512 7cd14b52a0765ebe 8902206f97d1825b
+513 d5e20e4bf10333a0 b8d21a2568f3b9b8
+514 957b8a6610746efa 9cd19872b05165c6
+515 af7863bb77291f4c 9a946702625c5b75
+516 4faf330465de9a56 539c1d2a923979b9
+517 7fd5a46ef61d764a a268e85ef673625d
+518 64119cecffd70ffe f849e65ec76e1a84
+519 b3a787892144f65d 9cc6a994839c45e4
+520 7df01ad13b16f63a a0c7f8b7a38ce82d
+521 a900694ff4711879 fa079e0607c31b4f
+522 3500978961304460 e4bd1f923794b147
+523 0d820a609af80901 9a946702625c5b75
+524 c430378109cad27a 539c1d2a923979b9
+525 176599d913af697a a268e85ef673625d
+526 0b3cf9e19c30b97f 58f2334f8ca9cb80
+527 78fe1d11e94692b2 f1aa6d8047c8323c
+528 a22705517e6515b6 a0c7f8b7a38ce82d
+529 6e19463c6c23ac36 43acaa1e14b30969
+530 8856fde1d1f0b090 9a946702625c5b75
+531 e3f43ace66aa1b41 539c1d2a923979b9
+532 a255b57321113cee a268e85ef673625d
+533 652b5ec6051051a9 5e8e7d4a79f70a69
+534 0dd05a89f94d5b53 a56f43445cc42f9c
+535 618665f5e8a2ca97 a0c7f8b7a38ce82d
+536 d9a3d7ebbdb8a7c0 841bd4b3c07b2e06
+537 fe0748a7a23c9888 167cb9df676ccc19
+538 69817be0896ec6f5 f7a743f7ed13a7ee
+539 9ed6989c768a8c41 9a946702625c5b75
+540 f2cdb95a3c881ac1 539c1d2a923979b9
+541 0cb1d968b3e70e4f a268e85ef673625d
+542 f3ae1399011e2486 008a6d58a73856df
+543 f7b398672cf4eea0 089bb4b0dd4f9855
+544 c4e022380dc98cfc a0c7f8b7a38ce82d
+545 f3aa52ab5dffe244 fa079e0607c31b4f
+546 262875fd15dd282e 7b24b4735525c64e
+547 7ea1e4806770d0bc 32aff86a02175f86
+548 018ffd0302af6a01 fce7fb229c97bf65
+549 e7ea31ae00081a75 9a946702625c5b75
+550 159d0a6f432acef6 539c1d2a923979b9
+551 e651b92483ada564 a268e85ef673625d
+552 dbfdc2a2f5880f4d 3a2e06aaf38036c9
+553 720da9c8af732736 f4353e308d272cd0
+554 6d748581042396dc a0c7f8b7a38ce82d
+555 47bc4e38555b8784 fa079e0607c31b4f
+556 b6187980a2a10e22 714d2a4829ac0c08
+557 0a0392e54aa5b925 4ff7ede1f6e83a5f
+558 d95c53b1a69d8a11 22fad75e10e92a93
+559 86fcd29f82627e38 20531bef9d408c42
+560 e8251a4c7a382bb5 129b9f3c21748863
+561 33d1e4b38e7336e0 9a946702625c5b75
+562 b69415f4ed0e83d5 539c1d2a923979b9
+563 723c167bd4d560dd a268e85ef673625d
+564 b5757b25c5bc48da d24e5e76d6b0c226
+565 ad4cd1c5e9ac52c5 c7cf6407bfcbd282
+566 841a38ad89029f17 a0c7f8b7a38ce82d
+567 2e3c568ab1209181 fa079e0607c31b4f
+568 e20d6f0121da6128 caa5bbe6c70fc7c7
+569 5d636343ed2e49ca 30080b5e818b5dde
+570 2813a364fc20ef6c 29877725f49926b9
+571 4ee0a4860ebbf64b df474ed8f4b878c1
+572 20dd84047c39de0c 9907fec486b664c8
+573 36c678306258f625 9a946702625c5b75
+574 abdc37eea2adf591 539c1d2a923979b9
+575 d245de32c151b25b a268e85ef673625d
+576 89d51a950211cac7 cac9aae7a77c49da
+577 3733edbc1dad4c19 4c7927a7fae749a6
+578 528391d6268f45c3 a0c7f8b7a38ce82d
+579 b48b7ce77c13e0e9 fa079e0607c31b4f
+580 fe6c7c9a26a664a8 e3e9c0d57941e614
+581 aec66a7bb1d6f536 9a946702625c5b75
+582 787302c55ec4a544 539c1d2a923979b9
+583 5b92d9b9a20888d1 a268e85ef673625d
+584 8a68a7728c4e609c e71201dbb772ce76
+585 932c693067900a37 585ade00061b49b4
+586 b9d5041400ac1605 a0c7f8b7a38ce82d
+587 e71879589c6b720f 4fa94170ea5cc6cb
+588 56dfd9521aa9baf5 9a946702625c5b75
+589 5379195f55abf490 539c1d2a923979b9
+590 3bc3a18eb47730d0 a268e85ef673625d
+591 5d6c7f35f53c3338 ed357497a73ae9b6
+592 23a2357e045f51b7 59793ef3961fd807
+593 53698f82c0158a50 a0c7f8b7a38ce82d
+594 f7ef7ebefd99d9a4 80d1209a5ee41d59
+595 b1c3255e9696d0cb 6b82671bd3a7c28a
+596 a6bbc943b01cba35 6ca80fb3ede40791
+597 e514b6dcff24d47a 9a946702625c5b75
+598 16c551c3214efa47 539c1d2a923979b9
+599 b0b034dd85e6cd45 a268e85ef673625d
+600 4665f9f6cdfbb36c ed9bb3898f762aa0
+601 772c32078dcc6c1b 5e3e450bad946e74
+602 85e596d5e81e4afa a0c7f8b7a38ce82d
+603 1551f821e74abc93 fa079e0607c31b4f
+604 2c875b20820b31d5 79ed48a792650b87
+605 c3c315772d321829 fca522c110f1277d
+606 812dde640d810666 123bc50c9dca9e5a
+607 d5e1960efd035a8a 9a946702625c5b75
+608 a34d84bdc20b6b7f 539c1d2a923979b9
+609 495269c10b9c95f1 a268e85ef673625d
+610 c08c609d0b99283e ba11c2d58234a0ca
+611 045d22bc44097421 eddee045502dfcd9
+612 f0e88f56b3a3ff52 a0c7f8b7a38ce82d
+613 5adb93ba90df91fa fa079e0607c31b4f
+614 1ad9b87259968700 bd5764b6af2b45cf
+615 1ebb1ad39f817d88 e7760c144ce87ff4
+616 3e66129926186a5b 8f356aa025326520
+617 7d1dc399888dcc98 e4ccf58e889d7c7a
+618 5acce0378add68fe db07dae6b495f0c4
+619 09b9fccda855b442 9a946702625c5b75
+620 9dc95c3e001357a7 539c1d2a923979b9
+621 650d73ba7de27907 a268e85ef673625d
+622 0087e72643748351 60d3fefff2b481c0
+623 620d85ed97d8ee71 4e0f93cee487c212
+624 7692afbf8e48e4f3 a0c7f8b7a38ce82d
+625 e3323a0a5318b5e4 fa079e0607c31b4f
+626 9d7f635b9a5798b7 1f514fa6595f6cd8
+627 c33cd7d0fc5263b9 e569e2b55c9eb579
+628 a6bb3a6bb53a171b dddeff1d80e4171f
+629 0e82a19e295a02c8 b0ac09b41a5a60c1
+630 756d46c4979301fc d6e7769eb188485f
+631 6ffbbf3054720afc 9a946702625c5b75
+632 d6511adc238f85c2 539c1d2a923979b9
+633 294b9a982f45ad78 a268e85ef673625d
+634 e0c9ffc6b17fc666 99e39c036704d046
+635 a52d50ddbd14cc0b fe97d4123d4058be
+636 10d6c7e40c5bb9c3 a0c7f8b7a38ce82d
+637 95835506c034071f fa079e0607c31b4f
+638 9e388546896bbaaf e1521dab24311489
+639 dec3a5b9cf8016c0 9a946702625c5b75
+640 4f555f7a31338b19 539c1d2a923979b9
+641 9ab86b618d1719d8 a268e85ef673625d
+642 0f5773351acdd6d2 52b8904dad59094d
+643 f033f3d818481203 c63c3604da5e279f
+644 3e8203da4c810e1b a0c7f8b7a38ce82d
+645 bb0b07fffdd7ede6 4b207596c1dbacc1
+646 5b3e4905c6c6eede 9a946702625c5b75
+647 c59c0017140f4c6c 539c1d2a923979b9
+648 e395c1678c830cca a268e85ef673625d
+649 e1a4854622c58eb5 7ab72b2f80ce61a2
+650 9577d41f9b61fbb7 4ced23d2d3d93638
+651 17d34576c8d4f0cc a0c7f8b7a38ce82d
+652 e962d90665f4a973 9ee0091aa73b4ddb
+653 c34853c60583d1f2 d3ee67f51ae74788
+654 2f520b1690ca56a5 32e600ebb7a2827a
+655 8df240f338b20031 9a946702625c5b75
+656 8da1c4bd473363c4 539c1d2a923979b9
+657 c6bf4afb98686b82 a268e85ef673625d
+658 8b73dd9833b0ec8e 6c157e62f840ff53
+659 2f9c186072f74a51 60956bd18bbaf256
+660 692f7da11426bc1f a0c7f8b7a38ce82d
+661 c0b485e3cccfdd82 fa079e0607c31b4f
+662 b7bd0e2b69c645da 1acbdd73063364e6
+663 cac6f5d8649db6b1 bbb1db49eced6d0a
+664 f4e2c14bb9c3c310 f23ed7f2ec8b4615
+665 0913460c7775edf4 9a946702625c5b75
+666 486b348ad26e736e 539c1d2a923979b9
+667 eefe3bac6f42dcd8 a268e85ef673625d
+668 4348268429967e5f 1954d002a278191d
+669 cdebe00feea92200 b70a2e4c15c49fb9
+670 674b2500841b93e6 a0c7f8b7a38ce82d
+671 c0be6b660f34ae07 fa079e0607c31b4f
+672 1a513bf929524ea1 6ace7b4946677f93
+673 e86732b87c457da6 5e4c1e06ce2c3330
+674 2c57da4a6de1a886 d9e3f3962429e75f
+675 db1487806323ba48 1cbb5e205e0d4b54
+676 03fee9758575e009 67dd5e713a3d3ab8
+677 afaf6ba3d330e0bd 9a946702625c5b75
+678 4b9eb586c92f5ff1 539c1d2a923979b9
+679 dd1bcd3e595ae8a4 a268e85ef673625d
+680 83d6d63e6151a524 fbcebfc24a583175
+681 fb6a159ff32a8c80 81a6bc2a91c2870e
+682 19d80a5a7385c273 a0c7f8b7a38ce82d
+683 6b2a63af737c087d fa079e0607c31b4f
+684 f7595f547b77eaaa 9fb838196b19881e
+685 d518355c1a832505 01fc20e67c8f8fc9
+686 69103bcd82facea1 90face6131717a4f
+687 eff63a4021952de5 b485550573b6fb61
+688 93c5c4102ed23a28 6c133795dd88a588
+689 5eb1f6d4f8895bf5 9a946702625c5b75
+690 5e676a635a44a8ac 539c1d2a923979b9
+691 c91bbdeeb6bc21da a268e85ef673625d
+692 93ca4f6f9593debf 1182057cdde2dd06
+693 70c983163ea79e05 fad7fdadbe6be120
+694 06d12e08968eb0a9 a0c7f8b7a38ce82d
+695 0804dceaa131e9e8 fa079e0607c31b4f
+696 72e2b31ef002f93d d11a758692cf05f8
+697 2f91d9474f17acdb 9a946702625c5b75
+698 ce6b43ed0c72194c 539c1d2a923979b9
+699 6c8f6ed88448a3d3 a268e85ef673625d
+700 f36069572f4c663e 03a77b44711d87e1
+701 f2b8a5d78661b51c 885365553b4cf3ae
+702 1d12ce2033db5680 a0c7f8b7a38ce82d
+703 953b6afe9ba1303b fcce80503ea070ad
+704 7720568f3237c2e5 9a946702625c5b75
+705 00303fcfa7aad1f6 539c1d2a923979b9
+706 b71fee3ab753eec7 a268e85ef673625d
+707 ef79d8cd55b54906 208c0fbb8a39a2ee
+708 111de55deb3b8f68 5f76570ca028a4d1
+709 61f062be7c41d9d8 a0c7f8b7a38ce82d
+710 1374f9adf1974004 cb20e850527b4f87
+711 55495a35887e46ee 6380cab448a3f704
+712 ed7a321c76d8547e 9a20a2935ac6a3ac
+713 cb1d0a1f2e036c53 9a946702625c5b75
+714 0c1267270f72aaa8 539c1d2a923979b9
+715 aaea403f4dce7309 a268e85ef673625d
+716 f05ed668f302204c 76c170b955fe47f7
+717 a6abc1bb75ef8847 0d6c2138caa1ac7b
+718 eca6689a6eb21d0d a0c7f8b7a38ce82d
+719 6c9b91fae3902329 fa079e0607c31b4f
+720 cd357ef026ab4f7e 1cd3fea3c9d32499
+721 b692c182e67c1b44 07fbb0c61d02a96e
+722 97d5a67976e8b4ea 7ea414e26ecc3fd3
+723 da1c9dd6c8a51515 9a946702625c5b75
+724 f008d5ea7d28fb67 539c1d2a923979b9
+725 ed6cbba1014436e6 a268e85ef673625d
+726 b56ab639fa5cea66 946dec2cda8972b2
+727 26093ee74fb843ed e7394d5674c04893
+728 e5213be1f282ed25 a0c7f8b7a38ce82d
+729 caa6b57cd4c3ed2f fa079e0607c31b4f
+730 c21404891d7dbe0d a48818f8c6fb10b1
+731 7633bf29ee8cda5d 517d18fbc6c5996f
+732 26ae98512d6a8562 fcea13972a7bbcb2
+733 682eb4212e9aed30 dc770a29a3d15e36
+734 aa86228d27bd6945 f983c22f4b629573
+735 0e4d2aef7a19eb88 9a946702625c5b75
+736 c0c7567259b0cb0a 539c1d2a923979b9
+737 c1f56a784fa2d728 a268e85ef673625d
+738 e08fc4d0ba0cc4dd 11a4ae86948669da
+739 980c6d182b9071af b001360a59397a09
+740 68cadf348e0e2c3b a0c7f8b7a38ce82d
+741 a09e05887498042b fa079e0607c31b4f
+742 cc4513f777cec34b e17d0ba3586c72be
+743 f4b34e1a926dd827 80e3b06d1c216e5f
+744 2a20954451679413 86d2c098b9233abd
+745 dace8b8f5642b846 29e67e78e3077753
+746 c0070275f42f3d6c 464cc91f6c08a58b
+747 c1225ccf13f2041b 9a946702625c5b75
+748 288ef06903377145 539c1d2a923979b9
+749 f3f05b9def0c5f0e a268e85ef673625d
+750 31dfcd70fc37ca75 54383784053856ba
+751 ddb42b6b033ab008 d0c0bb2094876513
+752 40041a7f0a436646 a0c7f8b7a38ce82d
+753 cbeaa107408270af fa079e0607c31b4f
+754 f6cfd1a3d53f692e 60c5cf35167bc2ad
+755 8e9d834717eb8da4 9a946702625c5b75
+756 c85b8006cd75874e 539c1d2a923979b9
+757 80c8e44c7bdf573a a268e85ef673625d
+758 c1b4aeda950cb92d 0ade615542138e42
+759 e5517b5e86093c31 f1a00ff6252b2e5d
+760 14c0863701eda852 a0c7f8b7a38ce82d
+761 8be51200b6511a35 d441335e8942716d
+762 284759850a866f2e 9a946702625c5b75
+763 f9a91d05145eb883 539c1d2a923979b9
+764 82c48b11f7e589b0 a268e85ef673625d
+765 dfdf10a74936725d 49f10baf46415403
+766 7aad1ca52eb8b83f d99d8df33cee5743
+767 657cca3a4f92213c a0c7f8b7a38ce82d
+768 de5c6fc8dded15a4 ff8d7e77ff1b54f3
+769 a4fb9be261f3ad2f 68d5429470596f49
+770 018402b71419e018 2b7741a0a3e2a74f
+771 b3905753aea57078 9a946702625c5b75
+772 2d33b2e49c1006ce 539c1d2a923979b9
+773 e74774d0c7e8d3f1 a268e85ef673625d
+774 f23314326d1670e0 6fa9761719a4e5ef
+775 3a9bd5dc832b1ec2 2cc46f976788f8bf
+776 2e7c38990b912015 a0c7f8b7a38ce82d
+777 27a5161b41e98573 fa079e0607c31b4f
+778 395c003790d4ffc3 1341f97b335a715b
+779 97e0dde0ac748fe2 bdafb3636d9d046d
+780 70b1c741155f3eac 9623037e5434fcaf
+781 b66f5f24454a0fcb 9a946702625c5b75
+782 6c307702d961caa3 539c1d2a923979b9
+783 5259d78dc7dd4029 a268e85ef673625d
+784 8f1d7ff65742f093 58f569834a746374
+785 4b4a9a534e44a2e8 6c5e8657d027b0d1
+786 d05a1e28065ce669 a0c7f8b7a38ce82d
+787 f2b8bef539161d2c fa079e0607c31b4f
+788 959ecd7ca52bc5e5 003ed13368451f27
+789 644d45670a7ed060 a44d437b32d98cc1
+790 fb402af7354ee68e 2bf8b2f8898bdc7e
+791 377c5c3252e4f272 e38f98d27b9d9263
+792 af1f4ac42898f244 ac0e2ccd28dbb4ad
+793 660bd1f258f9d5b8 9a946702625c5b75
+794 4a4900a9dbde81e5 539c1d2a923979b9
+795 7dc571c8a26f94a6 a268e85ef673625d
+796 ae655f1f16fe42ba 580cfa853a8cc0fc
+797 3da9fa8606bb5ae6 ebe35a600c4cc45c
+798 2ef7e96703c99ec8 a0c7f8b7a38ce82d
+799 07256b8e2d86ce0e fa079e0607c31b4f
+800 35e4c74162086005 7955b038ad806e79
+801 af5c394a0ba5ec6d fd3d7c3765ae3fb1
+802 43e5f13e064f1fde 3970f2c7b9f2aad8
+803 8294101db7c9fb8a dd2ec7e9845503c2
+804 760ed642b0985c62 ea208e0fcf600b89
+805 2dd33ba8962483ec 9a946702625c5b75
+806 c1903d7161bb87df 539c1d2a923979b9
+807 ba663d7fe1241c04 a268e85ef673625d
+808 5199e31f86c42804 3900b34a78245d67
+809 387d26844e85ba60 38929bf1af18b989
+810 de98c9d11d6e887e a0c7f8b7a38ce82d
+811 d8cf5579b80cc243 fa079e0607c31b4f
+812 5b5a282a2c78fd8e bda8d93e0d7324a0
+813 540b3362e235c2e9 9a946702625c5b75
+814 0b0e2b47b74560c5 539c1d2a923979b9
+815 e9a7f5dff8d2e377 a268e85ef673625d
+816 c6dad953413cbbe8 610cfb6a683df922
+817 c159dbbf0776747e f9cc4d261de7c34f
+818 9d73898674872ee3 a0c7f8b7a38ce82d
+819 ff512acc6e6d19ec 31d212cb02d89f0d
+820 fe1955fd8e764f2c 9a946702625c5b75
+821 ce52c324b8945714 539c1d2a923979b9
+822 fb5f64d7f2e3cada a268e85ef673625d
+823 1740a219bb94709d 67b307e451d4c455
+824 4ab3170b14032470 b58398529050d69f
+825 b2894d43e8ef4d78 a0c7f8b7a38ce82d
+826 199e9775cd323618 bb9b0e5946c39e6e
+827 739357a7ea6dbc0a f0fc3f50766427f4
+828 9024eaffa691b71c 2eaf6acfc3cabf25
+829 8d18299567927cbb 9a946702625c5b75
+830 e4d6f17c083f6b84 539c1d2a923979b9
+831 4569d66effcb6c83 a268e85ef673625d
+832 7739d57fac469b83 9696af78b7c82e66
+833 3dba91423ab77774 a3aa849c36d584e8
+834 ae77b6bc7d333c99 a0c7f8b7a38ce82d
+835 7885e6f28915897e fa079e0607c31b4f
+836 8a3dc804cc2bf515 94f3eb2d49d1fb8c
+837 919d3d9f16f1459e d8d42d7c68cdf1f7
+838 471d72d59f219163 de9742c264a38905
+839 c8223dbb9e9446f7 9a946702625c5b75
+840 c835e19be7ffdd22 539c1d2a923979b9
+841 c1299ace0e314f25 a268e85ef673625d
+842 68d2f117669d47a6 35d66b136bd1327d
+843 38a0e49225ddbc4f 9e3276e1acdcc526
+844 68457cfc8a9442b9 a0c7f8b7a38ce82d
+845 0d4dd665685a1630 fa079e0607c31b4f
+846 04cb8fc9c3bdfbb2 7fd8f3b5413b80e0
+847 9f4f3fc485e6a5c7 2597d1037afe1450
+848 c09de20e3638f2f6 b82e067679d4a0ca
+849 75735b9163e5c6a7 c50b00c1061f3b38
+850 3b92ccdbbd7943ec 39b8b6a378cce352
+851 f5f1b306cc951a26 9a946702625c5b75
+852 005492aa0e7d6046 539c1d2a923979b9
+853 32024b476c329fab a268e85ef673625d
+854 9e1b1cd2ad677f3a 083e66313157d5f6
+855 ebc1f9ea669f7e58 e1c7dfc57ff8c72c
+856 3f311d401c8478ce a0c7f8b7a38ce82d
+857 304557ae61644f07 fa079e0607c31b4f
+858 743993c74a0404c2 13f6d750674f9e5b
+859 123f000f3a9485d1 88c7118b4f5f164e
+860 ac0f7bdfac5d5a5f 3e9990694c244a92
+861 fa822def9d3d333b 629101ce681b00fe
+862 951c348fa5e6be54 065db272dc7adf99
+863 671b280d23ed273a 9a946702625c5b75
+864 74916a24e3537ebf 539c1d2a923979b9
+865 d8b0327197ff7f76 a268e85ef673625d
+866 4ae66b1b36d885a9 8be4b3eed027c3c4
+867 dc4bfaf40cdb6393 dfdee3d01e052064
+868 42fff8f51e69abd0 a0c7f8b7a38ce82d
+869 770199874b76b133 fa079e0607c31b4f
diff --git a/crates/socket-patch-core/tests/equivalence/poetry_rewrite.golden b/crates/socket-patch-core/tests/equivalence/poetry_rewrite.golden
new file mode 100644
index 000000000..336e84815
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/poetry_rewrite.golden
@@ -0,0 +1,122 @@
+# One grown poetry.lock pair and its deps, rewritten, then re-run over the result.
+# <case> <input digest> <output digest>
+0.12.17_extra=0_crlf=false 84711f5f3ad349f8 7f509240352ad7a8
+0.12.17_extra=0_crlf=false/re-run 84711f5f3ad349f8 7f509240352ad7a8
+0.12.17_extra=0_crlf=true 3f7f42cdd2b52172 7f509240352ad7a8
+0.12.17_extra=0_crlf=true/re-run 3f7f42cdd2b52172 7f509240352ad7a8
+0.12.17_extra=3_crlf=false b270b6cd9e80cd33 d0a6ea16d4cc417e
+0.12.17_extra=3_crlf=false/re-run b270b6cd9e80cd33 d0a6ea16d4cc417e
+0.12.17_extra=3_crlf=true 756a9815989d2df3 d0a6ea16d4cc417e
+0.12.17_extra=3_crlf=true/re-run 756a9815989d2df3 d0a6ea16d4cc417e
+1.0.10_extra=0_crlf=false 8b5a3e1971555e9c 68d9a638c38495be
+1.0.10_extra=0_crlf=false/re-run 49e744cee934c717 33bbc0c4a6aa1d37
+1.0.10_extra=0_crlf=true 3913879607abda1f ad4fd40d36c0ad94
+1.0.10_extra=0_crlf=true/re-run 0d77d35d896114a0 33bbc0c4a6aa1d37
+1.0.10_extra=3_crlf=false 8df74fcf53d1d924 4430fc9529674206
+1.0.10_extra=3_crlf=false/re-run 5a201480ae87cf82 058fe94fee294277
+1.0.10_extra=3_crlf=true 5fa9e4042c166543 ba84db1bf1aa9ae8
+1.0.10_extra=3_crlf=true/re-run b6b7cb59b2c3cff9 058fe94fee294277
+1.1.15_extra=0_crlf=false 674455ac5013465d 4f4f6683942816f7
+1.1.15_extra=0_crlf=false/re-run a3a3e4123d69a903 33bbc0c4a6aa1d37
+1.1.15_extra=0_crlf=true fbec33f96b0f67cc ce637cba6490743c
+1.1.15_extra=0_crlf=true/re-run 238893de017bfb67 33bbc0c4a6aa1d37
+1.1.15_extra=3_crlf=false 1d9454132e3381a5 21ee9a93167e1565
+1.1.15_extra=3_crlf=false/re-run a35f598b795621cf 058fe94fee294277
+1.1.15_extra=3_crlf=true 8c546cdfbf0ac7a8 d50b3dcc3db91f50
+1.1.15_extra=3_crlf=true/re-run bb616bdd3c930fc4 058fe94fee294277
+1.2.2_extra=0_crlf=false e2494b8af3c56779 f4162004a278ad59
+1.2.2_extra=0_crlf=false/re-run a7448271562781d0 33bbc0c4a6aa1d37
+1.2.2_extra=0_crlf=true 3fd16e08e102c14d 1e67c45e616e507e
+1.2.2_extra=0_crlf=true/re-run 38747ba9d94fddc1 33bbc0c4a6aa1d37
+1.2.2_extra=3_crlf=false 8452e4db33a6d96f 0b39f87964356f2c
+1.2.2_extra=3_crlf=false/re-run 14b0d49b8e8d0a36 a465f4f09bd7a1cb
+1.2.2_extra=3_crlf=true 4eb88ecc9eb6d49f f2af39ddf70ee7d4
+1.2.2_extra=3_crlf=true/re-run 6998840045551c7c a465f4f09bd7a1cb
+1.3.2_extra=0_crlf=false 2c9c6e9d498372b6 4bbfd63a2999d619
+1.3.2_extra=0_crlf=false/re-run a3bb7e5e6b808668 33bbc0c4a6aa1d37
+1.3.2_extra=0_crlf=true 3872773f0abe0601 2066c6ae7e285570
+1.3.2_extra=0_crlf=true/re-run 13c6607dffc2247d 33bbc0c4a6aa1d37
+1.3.2_extra=3_crlf=false 3359c70929e5f3d1 93587980e1c249f3
+1.3.2_extra=3_crlf=false/re-run b5d76f79240ccf1e 058fe94fee294277
+1.3.2_extra=3_crlf=true b96db65d6aafc293 62ff09de389cc26e
+1.3.2_extra=3_crlf=true/re-run 5405a65f3b32d58c 058fe94fee294277
+1.4.2_extra=0_crlf=false b8d55040123c0034 36b408b703f1d8aa
+1.4.2_extra=0_crlf=false/re-run 89897aae4086328a 33bbc0c4a6aa1d37
+1.4.2_extra=0_crlf=true 2d3cc248197aa69f 0a9305875ef23cab
+1.4.2_extra=0_crlf=true/re-run 4b513a41a6950129 33bbc0c4a6aa1d37
+1.4.2_extra=3_crlf=false 658a950d966029e9 9ce5033d5fe06c49
+1.4.2_extra=3_crlf=false/re-run 49838569adcdb5f4 058fe94fee294277
+1.4.2_extra=3_crlf=true 7d4e398daef5a5de cb69eada9836807d
+1.4.2_extra=3_crlf=true/re-run 1d448e1097d8f9bf 058fe94fee294277
+1.5.1_extra=0_crlf=false 87c6761c473d345f 4e26992d707a9185
+1.5.1_extra=0_crlf=false/re-run e3d34a1c034d775a 33bbc0c4a6aa1d37
+1.5.1_extra=0_crlf=true b4e6ae1bb3e8d4ca db8424880d0e4a52
+1.5.1_extra=0_crlf=true/re-run 107fa86d79624d45 33bbc0c4a6aa1d37
+1.5.1_extra=3_crlf=false 4d8f252368634b2c 2c4b5cb224ddc8d0
+1.5.1_extra=3_crlf=false/re-run a3a0685644112dbc 058fe94fee294277
+1.5.1_extra=3_crlf=true 82a745628a483aae 0554981aff8135c6
+1.5.1_extra=3_crlf=true/re-run c3be43e7cf3d14b0 058fe94fee294277
+1.6.1_extra=0_crlf=false 0ee75f6b15d9a03c fe6855296498d9fe
+1.6.1_extra=0_crlf=false/re-run a0c6784c4e55a158 33bbc0c4a6aa1d37
+1.6.1_extra=0_crlf=true 7f035cb8e45d8fd7 d61e14cff7784574
+1.6.1_extra=0_crlf=true/re-run 786564fe339dc227 33bbc0c4a6aa1d37
+1.6.1_extra=3_crlf=false 0a1437c13ca80097 2db96bfd93c1e9cf
+1.6.1_extra=3_crlf=false/re-run 1dddd499494ca1e1 058fe94fee294277
+1.6.1_extra=3_crlf=true ce56f8a19949edb8 26a0a64c5793d8ac
+1.6.1_extra=3_crlf=true/re-run a2a4b24d99970003 058fe94fee294277
+1.7.1_extra=0_crlf=false ef5c98150f87c813 6e2694ad356a0756
+1.7.1_extra=0_crlf=false/re-run 06a84a009cf67800 33bbc0c4a6aa1d37
+1.7.1_extra=0_crlf=true 6ecfcd2d0abe1638 8369450b092cf661
+1.7.1_extra=0_crlf=true/re-run b2364c2a9a90363a 33bbc0c4a6aa1d37
+1.7.1_extra=3_crlf=false 7a181c3a53433163 22176abf3ed1e1f3
+1.7.1_extra=3_crlf=false/re-run aa3e8ee35f696c57 058fe94fee294277
+1.7.1_extra=3_crlf=true e45e404197104298 e5be1777f605bf60
+1.7.1_extra=3_crlf=true/re-run adb0a804f952d87d 058fe94fee294277
+1.8.5_extra=0_crlf=false 693fb696e9bcabfc fdba5e6b6f532877
+1.8.5_extra=0_crlf=false/re-run 21dd82311a2d09dc 33bbc0c4a6aa1d37
+1.8.5_extra=0_crlf=true 0db19b4de6d36c44 bd0e4b35f46b1016
+1.8.5_extra=0_crlf=true/re-run b157daad5706df23 33bbc0c4a6aa1d37
+1.8.5_extra=3_crlf=false c95bf8c820b32938 79c02c70931e0527
+1.8.5_extra=3_crlf=false/re-run 16871a450187128c 058fe94fee294277
+1.8.5_extra=3_crlf=true 4d52e35da02ce726 b319402713da11d4
+1.8.5_extra=3_crlf=true/re-run 0d4417b9e5f60de6 058fe94fee294277
+2.0.1_extra=0_crlf=false fb2fdbf0499a2fe6 5e2d1de5fe694063
+2.0.1_extra=0_crlf=false/re-run 9593f9386b014db3 33bbc0c4a6aa1d37
+2.0.1_extra=0_crlf=true fe716a37ee9d0b4d 438f96aa4087c670
+2.0.1_extra=0_crlf=true/re-run b3c0752f54b013fb 33bbc0c4a6aa1d37
+2.0.1_extra=3_crlf=false 3e6e1eafdf1b46e0 f8b147dc42d7aebe
+2.0.1_extra=3_crlf=false/re-run 063c6a0c84fe1439 058fe94fee294277
+2.0.1_extra=3_crlf=true d663b81eda526ad2 84bd0d184fd4841d
+2.0.1_extra=3_crlf=true/re-run 5219297dd248549c 058fe94fee294277
+2.1.4_extra=0_crlf=false 20078dc5c63776a7 757a21041de4bafe
+2.1.4_extra=0_crlf=false/re-run 63fd32c0b568e5a9 33bbc0c4a6aa1d37
+2.1.4_extra=0_crlf=true 1407dded9b23ffc8 6480c31767f7cbce
+2.1.4_extra=0_crlf=true/re-run b93690c829cf280d 33bbc0c4a6aa1d37
+2.1.4_extra=3_crlf=false bb36cf121dcd84c3 466d6a49990d9d78
+2.1.4_extra=3_crlf=false/re-run 36536c906f6ce857 058fe94fee294277
+2.1.4_extra=3_crlf=true d2b5d9bcd2be823b 1ca37ca1cf0d8978
+2.1.4_extra=3_crlf=true/re-run 9a0e348f2da96d3a 058fe94fee294277
+2.2.1_extra=0_crlf=false 74fac4d8f9193131 7220a5bd51319fbc
+2.2.1_extra=0_crlf=false/re-run 2ff6fd632d0ef5c3 33bbc0c4a6aa1d37
+2.2.1_extra=0_crlf=true c16d856edcde2d0e 545be68d50053014
+2.2.1_extra=0_crlf=true/re-run c1eeffcca68e80c4 33bbc0c4a6aa1d37
+2.2.1_extra=3_crlf=false a839df17f390945a 81a4c77f7f4e49e1
+2.2.1_extra=3_crlf=false/re-run 98933e715c2af059 058fe94fee294277
+2.2.1_extra=3_crlf=true 44823b62a960ef38 0e8c1642cda6ab31
+2.2.1_extra=3_crlf=true/re-run 995156f4541984eb 058fe94fee294277
+2.3.4_extra=0_crlf=false 1a8e097d76734d18 fffc310706b37104
+2.3.4_extra=0_crlf=false/re-run 038939a3f11671b6 33bbc0c4a6aa1d37
+2.3.4_extra=0_crlf=true d1c93a5e16b7f407 7df856e191dcd834
+2.3.4_extra=0_crlf=true/re-run 931dd6aeb008ad6a 33bbc0c4a6aa1d37
+2.3.4_extra=3_crlf=false 775da867fea7a448 0a52b8d5379a1ab6
+2.3.4_extra=3_crlf=false/re-run 5d546d81dade99fe 058fe94fee294277
+2.3.4_extra=3_crlf=true 60aed4e71eb98f9b 351bb2773426b174
+2.3.4_extra=3_crlf=true/re-run ed72011884151bd4 058fe94fee294277
+2.4.3_extra=0_crlf=false f41399b367881495 1bfcdd185fb8ff92
+2.4.3_extra=0_crlf=false/re-run f245f230e9fb38ff 33bbc0c4a6aa1d37
+2.4.3_extra=0_crlf=true 2c762d43f92a0e67 c52420d9986dd40d
+2.4.3_extra=0_crlf=true/re-run 806b7bfad57d17d5 33bbc0c4a6aa1d37
+2.4.3_extra=3_crlf=false 2074ae48edbde92d 63289bf331a1b40c
+2.4.3_extra=3_crlf=false/re-run bfd3b334288374c6 058fe94fee294277
+2.4.3_extra=3_crlf=true d49e48cd318b9b94 9e944e2c50375cbc
+2.4.3_extra=3_crlf=true/re-run 923608de3d8c9a14 058fe94fee294277

From a61a7042acc36bb66d8b8a30c112172bc3c0139c Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 28 Sep 2026 23:09:48 +0000
Subject: [PATCH 4/6] Merge 67 CLI test binaries into command suites

The subprocess-only integration tests for apply, get, remove,
rollback, repair, scan, vendor, update and the global CLI now build
as one binary per command instead of 67, so CI links and runs 58
fewer test binaries. Each file keeps its name as a module, and the
shared helpers are declared once per suite, so their self-tests run
once per suite instead of once per file.

Binaries a workflow names, the docker e2e suites, crawl_fd_limit_e2e
and the in-process suites (which share process-global notice and
config state) stay separate. Doc links to the moved files are
updated.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N9YdJqaGiT9Jf5LN1hDFhB
---
 CHANGELOG.md                                  |  2 +-
 crates/socket-patch-cli/CLI_CONTRACT.md       |  8 +++---
 .../socket-patch-cli/src/commands/scan/mod.rs |  2 +-
 .../tests/{ => apply}/apply_invariants.rs     |  6 ++---
 .../tests/{ => apply}/apply_network.rs        |  0
 .../cli_gem_variant_mismatch_policy.rs        |  0
 .../{ => apply}/covgap_commands_apply.rs      |  3 +--
 .../{ => apply}/e2e_safety_advisories.rs      |  3 +--
 .../in_process_gem_config_warning.rs          |  0
 .../in_process_gem_fallback_home.rs           |  0
 .../{ => apply}/in_process_gem_multicopy.rs   |  0
 .../{ => apply}/in_process_npm_multicopy.rs   |  0
 .../in_process_variant_apply_failure.rs       |  0
 crates/socket-patch-cli/tests/apply/main.rs   | 21 +++++++++++++++
 .../tests/{ => cli}/api_client_errors_e2e.rs  |  0
 .../tests/{ => cli}/cli_dry_run_paths_e2e.rs  |  0
 .../tests/{ => cli}/covgap_api_client.rs      |  0
 .../tests/{ => cli}/covgap_commands_list.rs   |  9 +++----
 .../tests/{ => cli}/covgap_output.rs          |  5 +---
 .../{ => cli}/interactive_prompts_e2e.rs      |  2 --
 crates/socket-patch-cli/tests/cli/main.rs     | 21 +++++++++++++++
 .../tests/{ => cli}/output_modes_e2e.rs       |  3 +--
 .../tests/{ => cli}/telemetry_e2e.rs          |  0
 .../tests/{ => get}/cli_get_silent_errors.rs  |  3 +--
 .../{ => get}/coverage_fix_get_double_json.rs |  3 +--
 .../tests/{ => get}/get_batch_paths_e2e.rs    |  0
 .../tests/{ => get}/get_edge_cases_e2e.rs     |  3 +--
 .../tests/{ => get}/get_invariants.rs         |  3 +--
 .../tests/{ => get}/get_modes_e2e.rs          | 13 ++++------
 .../get_nested_apply_api_flags_e2e.rs         |  3 +--
 .../tests/{ => get}/get_update_summary_e2e.rs |  3 +--
 .../tests/{ => get}/global_packages_e2e.rs    |  3 +--
 crates/socket-patch-cli/tests/get/main.rs     | 21 +++++++++++++++
 .../{ => remove}/covgap_commands_remove.rs    | 11 +++-----
 crates/socket-patch-cli/tests/remove/main.rs  | 17 ++++++++++++
 .../{ => remove}/remove_duality_invariants.rs |  9 +++----
 .../tests/{ => remove}/remove_invariants.rs   |  9 +++----
 .../tests/{ => remove}/remove_network.rs      |  0
 .../coverage_fix_repair_vendor_predelete.rs   |  0
 .../{ => repair}/covgap_commands_repair.rs    |  0
 .../covgap_commands_repair_vendor.rs          |  4 ---
 crates/socket-patch-cli/tests/repair/main.rs  | 26 +++++++++++++++++++
 .../tests/{ => repair}/repair_invariants.rs   |  0
 .../tests/{ => repair}/repair_vendor_e2e.rs   | 12 +++------
 .../{ => repair}/repair_vendor_flavors_e2e.rs |  8 +++---
 .../{ => rollback}/cli_rollback_silent.rs     |  0
 .../socket-patch-cli/tests/rollback/main.rs   | 13 ++++++++++
 .../rollback_duality_invariants.rs            |  0
 .../{ => rollback}/rollback_invariants.rs     |  6 ++---
 .../rollback_multicopy_blob_gate.rs           |  0
 ...erage_fix_scan_discovery_corrupt_ledger.rs |  0
 .../{ => scan}/covgap_commands_fetch_stage.rs |  0
 .../covgap_commands_scan_vendor_flow.rs       |  6 ++---
 .../{ => scan}/covgap_ecosystem_dispatch.rs   |  0
 .../{ => scan}/hosted_management_refusals.rs  |  0
 .../{ => scan}/hosted_symlinked_files.rs      |  6 ++---
 .../{ => scan}/hosted_wheel_metadata_order.rs |  3 +--
 crates/socket-patch-cli/tests/scan/main.rs    | 25 ++++++++++++++++++
 .../tests/{ => scan}/scan_batch_sizing_e2e.rs |  0
 .../{ => scan}/scan_ecosystems_scope_e2e.rs   |  0
 .../tests/{ => scan}/scan_invariants.rs       |  6 ++---
 .../scan_ordered_concurrency_e2e.rs           |  0
 .../tests/{ => scan}/scan_paths_e2e.rs        |  0
 .../tests/{ => scan}/scan_sync_e2e.rs         |  0
 .../{ => scan}/scan_vendor_step_error_e2e.rs  |  0
 .../{ => update}/covgap_commands_update.rs    |  8 ++----
 .../{ => update}/covgap_update_download.rs    |  6 ++---
 .../tests/{ => update}/covgap_update_swap.rs  |  5 +---
 crates/socket-patch-cli/tests/update/main.rs  | 16 ++++++++++++
 .../{ => update}/self_update_channels_e2e.rs  |  6 ++---
 .../tests/{ => update}/update_notifier_e2e.rs |  6 ++---
 .../docker_vendor_common_selftest.rs          |  3 +--
 .../tests/{ => vendor}/e2e_golang_redirect.rs |  3 +--
 .../{ => vendor}/in_process_vendor_bun.rs     |  6 ++---
 crates/socket-patch-cli/tests/vendor/main.rs  | 18 +++++++++++++
 .../{ => vendor}/redirect_npm_allow_remote.rs |  3 +--
 .../vendor_gem_lockfile_only_e2e.rs           |  0
 .../vendor_pristine_fetch_order_e2e.rs        |  0
 .../vendor_rerun_no_network_e2e.rs            |  0
 docs/design/repacking-to-depscan.md           |  2 +-
 docs/testing/bun-compatibility.md             |  6 ++---
 81 files changed, 248 insertions(+), 141 deletions(-)
 rename crates/socket-patch-cli/tests/{ => apply}/apply_invariants.rs (99%)
 rename crates/socket-patch-cli/tests/{ => apply}/apply_network.rs (100%)
 rename crates/socket-patch-cli/tests/{ => apply}/cli_gem_variant_mismatch_policy.rs (100%)
 rename crates/socket-patch-cli/tests/{ => apply}/covgap_commands_apply.rs (99%)
 rename crates/socket-patch-cli/tests/{ => apply}/e2e_safety_advisories.rs (99%)
 rename crates/socket-patch-cli/tests/{ => apply}/in_process_gem_config_warning.rs (100%)
 rename crates/socket-patch-cli/tests/{ => apply}/in_process_gem_fallback_home.rs (100%)
 rename crates/socket-patch-cli/tests/{ => apply}/in_process_gem_multicopy.rs (100%)
 rename crates/socket-patch-cli/tests/{ => apply}/in_process_npm_multicopy.rs (100%)
 rename crates/socket-patch-cli/tests/{ => apply}/in_process_variant_apply_failure.rs (100%)
 create mode 100644 crates/socket-patch-cli/tests/apply/main.rs
 rename crates/socket-patch-cli/tests/{ => cli}/api_client_errors_e2e.rs (100%)
 rename crates/socket-patch-cli/tests/{ => cli}/cli_dry_run_paths_e2e.rs (100%)
 rename crates/socket-patch-cli/tests/{ => cli}/covgap_api_client.rs (100%)
 rename crates/socket-patch-cli/tests/{ => cli}/covgap_commands_list.rs (98%)
 rename crates/socket-patch-cli/tests/{ => cli}/covgap_output.rs (99%)
 rename crates/socket-patch-cli/tests/{ => cli}/interactive_prompts_e2e.rs (99%)
 create mode 100644 crates/socket-patch-cli/tests/cli/main.rs
 rename crates/socket-patch-cli/tests/{ => cli}/output_modes_e2e.rs (99%)
 rename crates/socket-patch-cli/tests/{ => cli}/telemetry_e2e.rs (100%)
 rename crates/socket-patch-cli/tests/{ => get}/cli_get_silent_errors.rs (99%)
 rename crates/socket-patch-cli/tests/{ => get}/coverage_fix_get_double_json.rs (98%)
 rename crates/socket-patch-cli/tests/{ => get}/get_batch_paths_e2e.rs (100%)
 rename crates/socket-patch-cli/tests/{ => get}/get_edge_cases_e2e.rs (99%)
 rename crates/socket-patch-cli/tests/{ => get}/get_invariants.rs (99%)
 rename crates/socket-patch-cli/tests/{ => get}/get_modes_e2e.rs (99%)
 rename crates/socket-patch-cli/tests/{ => get}/get_nested_apply_api_flags_e2e.rs (99%)
 rename crates/socket-patch-cli/tests/{ => get}/get_update_summary_e2e.rs (99%)
 rename crates/socket-patch-cli/tests/{ => get}/global_packages_e2e.rs (99%)
 create mode 100644 crates/socket-patch-cli/tests/get/main.rs
 rename crates/socket-patch-cli/tests/{ => remove}/covgap_commands_remove.rs (99%)
 create mode 100644 crates/socket-patch-cli/tests/remove/main.rs
 rename crates/socket-patch-cli/tests/{ => remove}/remove_duality_invariants.rs (99%)
 rename crates/socket-patch-cli/tests/{ => remove}/remove_invariants.rs (99%)
 rename crates/socket-patch-cli/tests/{ => remove}/remove_network.rs (100%)
 rename crates/socket-patch-cli/tests/{ => repair}/coverage_fix_repair_vendor_predelete.rs (100%)
 rename crates/socket-patch-cli/tests/{ => repair}/covgap_commands_repair.rs (100%)
 rename crates/socket-patch-cli/tests/{ => repair}/covgap_commands_repair_vendor.rs (99%)
 create mode 100644 crates/socket-patch-cli/tests/repair/main.rs
 rename crates/socket-patch-cli/tests/{ => repair}/repair_invariants.rs (100%)
 rename crates/socket-patch-cli/tests/{ => repair}/repair_vendor_e2e.rs (99%)
 rename crates/socket-patch-cli/tests/{ => repair}/repair_vendor_flavors_e2e.rs (99%)
 rename crates/socket-patch-cli/tests/{ => rollback}/cli_rollback_silent.rs (100%)
 create mode 100644 crates/socket-patch-cli/tests/rollback/main.rs
 rename crates/socket-patch-cli/tests/{ => rollback}/rollback_duality_invariants.rs (100%)
 rename crates/socket-patch-cli/tests/{ => rollback}/rollback_invariants.rs (99%)
 rename crates/socket-patch-cli/tests/{ => rollback}/rollback_multicopy_blob_gate.rs (100%)
 rename crates/socket-patch-cli/tests/{ => scan}/coverage_fix_scan_discovery_corrupt_ledger.rs (100%)
 rename crates/socket-patch-cli/tests/{ => scan}/covgap_commands_fetch_stage.rs (100%)
 rename crates/socket-patch-cli/tests/{ => scan}/covgap_commands_scan_vendor_flow.rs (99%)
 rename crates/socket-patch-cli/tests/{ => scan}/covgap_ecosystem_dispatch.rs (100%)
 rename crates/socket-patch-cli/tests/{ => scan}/hosted_management_refusals.rs (100%)
 rename crates/socket-patch-cli/tests/{ => scan}/hosted_symlinked_files.rs (99%)
 rename crates/socket-patch-cli/tests/{ => scan}/hosted_wheel_metadata_order.rs (99%)
 create mode 100644 crates/socket-patch-cli/tests/scan/main.rs
 rename crates/socket-patch-cli/tests/{ => scan}/scan_batch_sizing_e2e.rs (100%)
 rename crates/socket-patch-cli/tests/{ => scan}/scan_ecosystems_scope_e2e.rs (100%)
 rename crates/socket-patch-cli/tests/{ => scan}/scan_invariants.rs (99%)
 rename crates/socket-patch-cli/tests/{ => scan}/scan_ordered_concurrency_e2e.rs (100%)
 rename crates/socket-patch-cli/tests/{ => scan}/scan_paths_e2e.rs (100%)
 rename crates/socket-patch-cli/tests/{ => scan}/scan_sync_e2e.rs (100%)
 rename crates/socket-patch-cli/tests/{ => scan}/scan_vendor_step_error_e2e.rs (100%)
 rename crates/socket-patch-cli/tests/{ => update}/covgap_commands_update.rs (99%)
 rename crates/socket-patch-cli/tests/{ => update}/covgap_update_download.rs (96%)
 rename crates/socket-patch-cli/tests/{ => update}/covgap_update_swap.rs (98%)
 create mode 100644 crates/socket-patch-cli/tests/update/main.rs
 rename crates/socket-patch-cli/tests/{ => update}/self_update_channels_e2e.rs (99%)
 rename crates/socket-patch-cli/tests/{ => update}/update_notifier_e2e.rs (99%)
 rename crates/socket-patch-cli/tests/{ => vendor}/docker_vendor_common_selftest.rs (98%)
 rename crates/socket-patch-cli/tests/{ => vendor}/e2e_golang_redirect.rs (99%)
 rename crates/socket-patch-cli/tests/{ => vendor}/in_process_vendor_bun.rs (99%)
 create mode 100644 crates/socket-patch-cli/tests/vendor/main.rs
 rename crates/socket-patch-cli/tests/{ => vendor}/redirect_npm_allow_remote.rs (99%)
 rename crates/socket-patch-cli/tests/{ => vendor}/vendor_gem_lockfile_only_e2e.rs (100%)
 rename crates/socket-patch-cli/tests/{ => vendor}/vendor_pristine_fetch_order_e2e.rs (100%)
 rename crates/socket-patch-cli/tests/{ => vendor}/vendor_rerun_no_network_e2e.rs (100%)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4a0e67180..5bdf6bb0c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2738,7 +2738,7 @@ and regression tests were added throughout (the lib + integration suites grow by
 
 ### Tests
 
-- New `tests/telemetry_e2e.rs` end-to-end behavioral coverage:
+- New `tests/cli/telemetry_e2e.rs` end-to-end behavioral coverage:
   apply/scan/get/list emit telemetry against a wiremock recorder;
   `SOCKET_OFFLINE=1` produces zero telemetry POSTs across all four;
   scan falls back on 401 + tags the resulting event; scan does NOT
diff --git a/crates/socket-patch-cli/CLI_CONTRACT.md b/crates/socket-patch-cli/CLI_CONTRACT.md
index 4ce5cb3a7..6c06dbd5e 100644
--- a/crates/socket-patch-cli/CLI_CONTRACT.md
+++ b/crates/socket-patch-cli/CLI_CONTRACT.md
@@ -135,7 +135,7 @@ For a **9.0 root lock**, the CLI ensures `pnpm-workspace.yaml` carries `trustLoc
 
 `scan --sync` is sugar for `--mode agent --prune` — the canonical single-flag agent-mode bot invocation. `scan --json --sync` discovers, applies, and reconciles state in one pass.
 
-**`scan --ecosystems` scopes the crawl (v5.0)**: without `--prune`/`--sync`, a `scan` given `--ecosystems`/`-e` runs only the named ecosystems' crawlers — everything the run counts, queries and shows (`scannedPackages`, the batch query, `packages[]`, the table, `updates[]`, `wiringLive`, the `gem_bundle_config_path_ignored` warning) was already narrowed to them, so the skipped crawls could only be filtered away. The one visible difference: `lockfileOnlyPackages` (and the human "not yet installed" note) counts only the selected ecosystems' lockfile-only entries (a skipped crawl cannot vouch for another ecosystem's uninstalled lockfile entries). A GC run (`--prune`, or `--sync`, which implies it — in every mode, hosted included) still crawls every ecosystem, because the prune judges each manifest entry against the FULL installed set (see `scan --prune` above); its output, `lockfileOnlyPackages` included, is unchanged. Without `--ecosystems` nothing changes. Pinned by `tests/scan_ecosystems_scope_e2e.rs`.
+**`scan --ecosystems` scopes the crawl (v5.0)**: without `--prune`/`--sync`, a `scan` given `--ecosystems`/`-e` runs only the named ecosystems' crawlers — everything the run counts, queries and shows (`scannedPackages`, the batch query, `packages[]`, the table, `updates[]`, `wiringLive`, the `gem_bundle_config_path_ignored` warning) was already narrowed to them, so the skipped crawls could only be filtered away. The one visible difference: `lockfileOnlyPackages` (and the human "not yet installed" note) counts only the selected ecosystems' lockfile-only entries (a skipped crawl cannot vouch for another ecosystem's uninstalled lockfile entries). A GC run (`--prune`, or `--sync`, which implies it — in every mode, hosted included) still crawls every ecosystem, because the prune judges each manifest entry against the FULL installed set (see `scan --prune` above); its output, `lockfileOnlyPackages` included, is unchanged. Without `--ecosystems` nothing changes. Pinned by `tests/scan/scan_ecosystems_scope_e2e.rs`.
 
 **Path-scoped scans (`scan [PATHS]...`, v5.0)**: what a PATH means depends on the mode.
 
@@ -162,9 +162,9 @@ The rewriter reads a fixed set of candidate files from the project root: the npm
 **get --mode and installed narrowing (v3.6).** `get <identifier> --mode hosted|vendored` consumes the resolved patch(es) through the SAME engines as `scan --mode hosted|vendored`, so for the same selected (purl, uuid) set the on-disk result is identical by construction — the per-advisory selector for hosted/vendored (`get <id> --save-only` then `vendor` still works). **Agent mode (v5.0 lock + residue rules)**: the download phase runs under `<.socket>/apply.lock` and hands the guard to the nested apply, so download → manifest write → apply is one lock window (the nested apply never re-acquires and inherits every caller flag — `--lock-timeout` and `--verbose` included); a failed acquire is `{status: "error", errorCode: "lock_held" | "lock_io", error}` on get's legacy envelope, exit 1, before any fetch (a read-only `.socket/` fails here, naming the lock path). `.socket/` and `.socket/blobs/` are created only when a record is actually persisted — an all-skipped or all-failed run leaves no `.socket/` on a fresh project — and a same-uuid `get <uuid>` re-run rewrites neither the manifest nor the blobs. Semantics:
 
 * **Hosted** (`get GHSA-… --mode hosted`): resolves the advisory, then hands the selected (purl, uuid) pairs to scan's hosted engine — reference grants, cross-mode takeover pre-revert, lockfile rewrite (no ledger, v5.0), gem stale-install probe, warnings, confirmation rules (cargo via `confirmed_cargo_uuids`, golang via `confirmed_golang_uuids` only) all identical to `scan --mode hosted`, and (v5.0) under the same `apply.lock` acquisition — taken around the first wet write, never on `--dry-run` or when nothing would be written; a failed acquire folds as top-level `errorCode: "lock_held" | "lock_io"` + string `error` (exit 1), and `--dry-run` under a held lock still exits 0. **No manifest write, no blobs, no ledger** — the lockfile edits are the persistence. JSON: get's legacy envelope gains the same nested `redirect` sub-object as scan's (`{mode:"hosted", redirected, rewrittenFiles, skipped, warnings, dryRun}`); the top-level shape is `{status, found, patches:[<narrowing skips>], warnings?}` — `downloaded`/`applied` are absent (nothing is downloaded into `.socket/`). Exit codes follow scan's hosted semantics: skipped grants and rewriter warnings never flip the exit; infra errors (reference fetch, file writes) exit 1. Human prompt: `Redirect N packages to the hosted patch server?` (singular for one; `--yes`/`--json`/non-TTY auto-accept as usual). This confirm is get's alone: `scan` never prompts.
-* **Vendored** (`get GHSA-… --mode vendored`): the download phase is scan's vendored posture — **manifest-free (v5.0)**: the selected records are fetched into memory (`download_patch_records`; blobs held in memory; nothing under `.socket/` is written; the nested apply never runs), then scan's vendor step runs under the apply lock over exactly the selected records, like `scan --mode vendored` (no whole-manifest scope and no `[note]` about other records — that blast radius is retired with the manifest; a legacy manifest record for a vendored purl is migrated out of `.socket/manifest.json` the same way scan does it). JSON: get's envelope takes the detached download envelope's shape — `{status, found, downloaded, skipped, failed, detached: true, patches: [{purl, uuid, action: "downloaded" | "skipped" | "failed", …}], warnings?}` (`applied` is absent; `detached: true` is pinned; a `downloaded` record for a purl the vendor ledger holds at another uuid carries the additive `oldUuid`, derived from the ledger — the human `[fetch]` line reads `<purl> (replacing <short uuid>)`) — and gains the nested `vendor` Envelope exactly like scan's `result["vendor"]`; a vendor-step error folds the partial envelope + `{status:"error", error:{code,message}}` in (a pre-failure takeover reconcile may have already mutated the ledger — its events must reach the consumer). Exit: download failures or vendor `has_errors` → `partial_failure`/1. Human prompt: `Download and vendor N patches?`; `--dry-run` prints `[dry-run] Would download and vendor N patches. No changes made.` on both identifier paths (uuid and search). Telemetry mirrors scan's vendored arms (`track_outcomes_for_vendor` / `track_patch_vendor_failed`). **Bun vendored preflight (additive)** — shared by `get --mode vendored` on both its paths and `scan --mode vendored`: before ANY patch download, and only when the selection holds a `pkg:npm/` purl, the download phase reads `bun.lock`/`bun.lockb` once (`preflight_vendor`) and, when the vendor backend would refuse the project — a malformed, unreadable or unsupported `bun.lockb` → `vendor_bun_lockb_invalid`; an unreadable `bun.lock` → `vendor_lockfile_missing`; a `lockfileVersion` other than 0/1/2 or a non-canonical `packages` grammar → `vendor_lockfile_version_unsupported`; `workspace:` packages in a lock below version 2 → `vendor_bun_workspace_unsupported` — every `pkg:npm/` result becomes `{action:"failed", errorCode:<code>, error:<detail>}` with NO fetch (the patch view is never requested) and no patch record; other ecosystems' results are untouched. **Search path** (`get <purl|advisory> --mode vendored`) and `scan --mode vendored`: the records ride `patches[]` / `download.patches[]` with `downloaded: 0`, the download phase writes nothing under `.socket/` (v5.0 — a pre-existing `.socket/manifest.json`, including a record seeded for another purl, is left byte-untouched), the vendor step still runs over the remaining records (no event for the refused purl), exit `partial_failure`/1. **uuid path** (`get <uuid> --mode vendored`): the uuid lookup is the only fetch; the run exits 1 BEFORE the vendor step with exactly `{status:"error", found:1, downloaded:0, skipped:0, failed:1, error:{code, message}, patches:[{purl, uuid, action:"failed", errorCode, error}]}` (the `error` OBJECT is the vendored-mode error shape of the vendor-step fold-in above) and writes nothing — no `.socket/` on a fresh project; human mode prints `Error (<code>): <detail>` on stderr. **Already-vendored exemption**: a purl is exempt from the workspace refusal only when every instance of its `name@version` in `bun.lock` is already a `.socket/vendor/npm/…` local tuple (any uuid; the digest-less 2-tuple counts) — the engine's own criterion — so in-sync re-runs, `repair`, and a superseding patch uuid on a project vendored before it grew a workspace member all flow to the engine (re-pinning an already-local tuple adds no workspace-relative exposure); a wiped ledger alone is not a refusal (the engine path decides). UUID equality in the ledger alone never exempts a purl: `rollback --preserve-state` retains its record after unwiring. Dry-run refusal takes priority over `already_vendored`. **Unreadable vendor ledger**: a `.socket/vendor/state.json` the preflight cannot read or parse is itself the refusal — `vendor_state_unreadable` with the io/parse detail, fail-closed (nothing is exempt) — on the uuid path, the search / `scan` path and the `--dry-run` preview alike; never a Bun lock code. **`--silent`** is "errors only" and never mutes the refusal: the code-tagged `[error] <purl> (<code>): <detail>` (per-patch paths) / `Error (<code>): …` (uuid path) line stays on stderr with an empty stdout. **`--dry-run`** previews the refusal as the additive `would_refuse` action (see `--dry-run` below). Agent-mode `get --save-only` is NOT preflighted (record-only intent has no consumption precondition). Pinned by `tests/in_process_vendor_bun.rs` (exact uuid-path envelope, seeded-manifest survival, `--silent`, `--dry-run`) and `tests/scan_vendor_e2e.rs`.
+* **Vendored** (`get GHSA-… --mode vendored`): the download phase is scan's vendored posture — **manifest-free (v5.0)**: the selected records are fetched into memory (`download_patch_records`; blobs held in memory; nothing under `.socket/` is written; the nested apply never runs), then scan's vendor step runs under the apply lock over exactly the selected records, like `scan --mode vendored` (no whole-manifest scope and no `[note]` about other records — that blast radius is retired with the manifest; a legacy manifest record for a vendored purl is migrated out of `.socket/manifest.json` the same way scan does it). JSON: get's envelope takes the detached download envelope's shape — `{status, found, downloaded, skipped, failed, detached: true, patches: [{purl, uuid, action: "downloaded" | "skipped" | "failed", …}], warnings?}` (`applied` is absent; `detached: true` is pinned; a `downloaded` record for a purl the vendor ledger holds at another uuid carries the additive `oldUuid`, derived from the ledger — the human `[fetch]` line reads `<purl> (replacing <short uuid>)`) — and gains the nested `vendor` Envelope exactly like scan's `result["vendor"]`; a vendor-step error folds the partial envelope + `{status:"error", error:{code,message}}` in (a pre-failure takeover reconcile may have already mutated the ledger — its events must reach the consumer). Exit: download failures or vendor `has_errors` → `partial_failure`/1. Human prompt: `Download and vendor N patches?`; `--dry-run` prints `[dry-run] Would download and vendor N patches. No changes made.` on both identifier paths (uuid and search). Telemetry mirrors scan's vendored arms (`track_outcomes_for_vendor` / `track_patch_vendor_failed`). **Bun vendored preflight (additive)** — shared by `get --mode vendored` on both its paths and `scan --mode vendored`: before ANY patch download, and only when the selection holds a `pkg:npm/` purl, the download phase reads `bun.lock`/`bun.lockb` once (`preflight_vendor`) and, when the vendor backend would refuse the project — a malformed, unreadable or unsupported `bun.lockb` → `vendor_bun_lockb_invalid`; an unreadable `bun.lock` → `vendor_lockfile_missing`; a `lockfileVersion` other than 0/1/2 or a non-canonical `packages` grammar → `vendor_lockfile_version_unsupported`; `workspace:` packages in a lock below version 2 → `vendor_bun_workspace_unsupported` — every `pkg:npm/` result becomes `{action:"failed", errorCode:<code>, error:<detail>}` with NO fetch (the patch view is never requested) and no patch record; other ecosystems' results are untouched. **Search path** (`get <purl|advisory> --mode vendored`) and `scan --mode vendored`: the records ride `patches[]` / `download.patches[]` with `downloaded: 0`, the download phase writes nothing under `.socket/` (v5.0 — a pre-existing `.socket/manifest.json`, including a record seeded for another purl, is left byte-untouched), the vendor step still runs over the remaining records (no event for the refused purl), exit `partial_failure`/1. **uuid path** (`get <uuid> --mode vendored`): the uuid lookup is the only fetch; the run exits 1 BEFORE the vendor step with exactly `{status:"error", found:1, downloaded:0, skipped:0, failed:1, error:{code, message}, patches:[{purl, uuid, action:"failed", errorCode, error}]}` (the `error` OBJECT is the vendored-mode error shape of the vendor-step fold-in above) and writes nothing — no `.socket/` on a fresh project; human mode prints `Error (<code>): <detail>` on stderr. **Already-vendored exemption**: a purl is exempt from the workspace refusal only when every instance of its `name@version` in `bun.lock` is already a `.socket/vendor/npm/…` local tuple (any uuid; the digest-less 2-tuple counts) — the engine's own criterion — so in-sync re-runs, `repair`, and a superseding patch uuid on a project vendored before it grew a workspace member all flow to the engine (re-pinning an already-local tuple adds no workspace-relative exposure); a wiped ledger alone is not a refusal (the engine path decides). UUID equality in the ledger alone never exempts a purl: `rollback --preserve-state` retains its record after unwiring. Dry-run refusal takes priority over `already_vendored`. **Unreadable vendor ledger**: a `.socket/vendor/state.json` the preflight cannot read or parse is itself the refusal — `vendor_state_unreadable` with the io/parse detail, fail-closed (nothing is exempt) — on the uuid path, the search / `scan` path and the `--dry-run` preview alike; never a Bun lock code. **`--silent`** is "errors only" and never mutes the refusal: the code-tagged `[error] <purl> (<code>): <detail>` (per-patch paths) / `Error (<code>): …` (uuid path) line stays on stderr with an empty stdout. **`--dry-run`** previews the refusal as the additive `would_refuse` action (see `--dry-run` below). Agent-mode `get --save-only` is NOT preflighted (record-only intent has no consumption precondition). Pinned by `tests/vendor/in_process_vendor_bun.rs` (exact uuid-path envelope, seeded-manifest survival, `--silent`, `--dry-run`) and `tests/scan_vendor_e2e.rs`.
 
-**Lock-text refusals before the download (v5.0)** — shared by `get --mode vendored` on both its paths and `scan --mode vendored`, after the Bun preflight above and the ledger's `already vendored` skip: a `pkg:npm/` result in a **pnpm, yarn classic or yarn berry** project, or a `pkg:cargo/` result, that its vendor backend refuses on the project's lock and manifest text alone is refused BEFORE its patch view is fetched — the pnpm / classic / berry gates the backend runs before it reads the package (coordinates, the lock and manifest reads and their line-ending / version / `cacheKey` / `.yarnrc.yml` gates, override and `resolutions` conflicts, the lock entry present and rewritable) and cargo's `locked_version_mismatch` (only when it is the crate's FIRST refusal; an in-tree `cargo vendor` copy still refuses in the loop as `already_vendored_in_tree`). **Scope:** only a package the vendor loop would hand to its backend is refused early — one installed on disk (the loop's own qualified-aware resolver plus the npm identity lookup), or one the lockfile inventory resolves to a verifiable registry source (a lock entry with an integrity, or the ledger-recovered pre-vendor resolution — exactly the entry the pristine fetch would use). A package absent from the lock and not installed never reached its backend and is untouched: its view is fetched, it downloads, and the vendor loop skips it `skipped` / `package_not_installed` as in v4.x (so cargo's `locked_version_mismatch` is refused early only for a crate installed at the unlocked version). The result becomes `{action:"failed", errorCode:<code>, error:<detail>}` in `download.patches[]` / `patches[]` with the backend's exact code and detail, no view and no pristine fetch, no patch record, and therefore no vendor event: compared with v4.x, `download.downloaded` drops and `download.failed` rises by the number of such packages, `vendor.summary.failed` and `vendor.events` lose their `failed` events, and a lockfile-only package among them loses its `vendor_fetched_missing` event (it is never fetched). Exit code and top-level `status` are unchanged (`partial_failure`/1); the nested `vendor.status` becomes `success` when those refusals were the vendor step's only failures (observed on the depscan fixture: 3 refusals, `partialFailure` → `success`), and when every selected package is refused this way the human `scan --vendor` arm prints `Nothing was vendored: N patches failed (see above).`. **Precedence:** the lock-text refusal is decided before the view, so it wins over every view-derived outcome — a package that would also have been a paid-access 403 (`[PAID]`/no access), a failed view fetch, or a no-applicable-files skip reports the lock refusal instead (the Bun refusal and the ledger's `already vendored` skip still come first). The human `[error] <purl> (<code>): <detail>` line is printed during the download instead of the vendor step's failure line (the human (non-`--silent`) `scan --vendor` arm's baseline pre-check still fetches the views it verifies; only the download, the pristine fetch and the vendor step skip the package there). A purl the lockfiles pin hosted keeps the loop's refusal (its takeover restore rewrites the lock the gates read); other flavors (package-lock, pnpm-legacy, bun) and ecosystems are untouched, and `--dry-run` is unchanged. `vendor` (manifest-driven, no view fetch) keeps its per-package `failed` events but no longer fetches the pristine source of a lockfile-only package it refuses this way — the source is deferred to the backend, which refuses before reading it (no `vendor_fetched_missing` event and no registry request; a refused package whose registry is unreachable reports the gate's code instead of `vendor_fetch_failed`); only a package the lock resolves to a verifiable source is deferred, and one it does not resolve keeps its `package_not_installed` skip. Pinned by `tests/scan_vendor_e2e.rs` (`exact_download_plan`: scan and exact-purl get, pnpm and cargo scope), `tests/e2e_yarn_legacy_cachekey_refusal_build.rs` and `tests/vendor_rerun_no_network_e2e.rs`.
+**Lock-text refusals before the download (v5.0)** — shared by `get --mode vendored` on both its paths and `scan --mode vendored`, after the Bun preflight above and the ledger's `already vendored` skip: a `pkg:npm/` result in a **pnpm, yarn classic or yarn berry** project, or a `pkg:cargo/` result, that its vendor backend refuses on the project's lock and manifest text alone is refused BEFORE its patch view is fetched — the pnpm / classic / berry gates the backend runs before it reads the package (coordinates, the lock and manifest reads and their line-ending / version / `cacheKey` / `.yarnrc.yml` gates, override and `resolutions` conflicts, the lock entry present and rewritable) and cargo's `locked_version_mismatch` (only when it is the crate's FIRST refusal; an in-tree `cargo vendor` copy still refuses in the loop as `already_vendored_in_tree`). **Scope:** only a package the vendor loop would hand to its backend is refused early — one installed on disk (the loop's own qualified-aware resolver plus the npm identity lookup), or one the lockfile inventory resolves to a verifiable registry source (a lock entry with an integrity, or the ledger-recovered pre-vendor resolution — exactly the entry the pristine fetch would use). A package absent from the lock and not installed never reached its backend and is untouched: its view is fetched, it downloads, and the vendor loop skips it `skipped` / `package_not_installed` as in v4.x (so cargo's `locked_version_mismatch` is refused early only for a crate installed at the unlocked version). The result becomes `{action:"failed", errorCode:<code>, error:<detail>}` in `download.patches[]` / `patches[]` with the backend's exact code and detail, no view and no pristine fetch, no patch record, and therefore no vendor event: compared with v4.x, `download.downloaded` drops and `download.failed` rises by the number of such packages, `vendor.summary.failed` and `vendor.events` lose their `failed` events, and a lockfile-only package among them loses its `vendor_fetched_missing` event (it is never fetched). Exit code and top-level `status` are unchanged (`partial_failure`/1); the nested `vendor.status` becomes `success` when those refusals were the vendor step's only failures (observed on the depscan fixture: 3 refusals, `partialFailure` → `success`), and when every selected package is refused this way the human `scan --vendor` arm prints `Nothing was vendored: N patches failed (see above).`. **Precedence:** the lock-text refusal is decided before the view, so it wins over every view-derived outcome — a package that would also have been a paid-access 403 (`[PAID]`/no access), a failed view fetch, or a no-applicable-files skip reports the lock refusal instead (the Bun refusal and the ledger's `already vendored` skip still come first). The human `[error] <purl> (<code>): <detail>` line is printed during the download instead of the vendor step's failure line (the human (non-`--silent`) `scan --vendor` arm's baseline pre-check still fetches the views it verifies; only the download, the pristine fetch and the vendor step skip the package there). A purl the lockfiles pin hosted keeps the loop's refusal (its takeover restore rewrites the lock the gates read); other flavors (package-lock, pnpm-legacy, bun) and ecosystems are untouched, and `--dry-run` is unchanged. `vendor` (manifest-driven, no view fetch) keeps its per-package `failed` events but no longer fetches the pristine source of a lockfile-only package it refuses this way — the source is deferred to the backend, which refuses before reading it (no `vendor_fetched_missing` event and no registry request; a refused package whose registry is unreachable reports the gate's code instead of `vendor_fetch_failed`); only a package the lock resolves to a verifiable source is deferred, and one it does not resolve keeps its `package_not_installed` skip. Pinned by `tests/scan_vendor_e2e.rs` (`exact_download_plan`: scan and exact-purl get, pnpm and cargo scope), `tests/e2e_yarn_legacy_cachekey_refusal_build.rs` and `tests/vendor/vendor_rerun_no_network_e2e.rs`.
 * **Installed-version narrowing** (all modes, `get`'s search path): a CVE/GHSA fan-out returns one patch record per patched VERSION; get keeps only versions present here and emits calm `skipped` records (`errorCode: "package_not_installed"`) for the rest — never an error exit. Presence = installed on disk (qualified-aware resolver) ∪ already tracked in the manifest (record maintenance keeps working on hosts without an installed copy); hosted/vendored modes additionally count lockfile-resolved deps and vendor-ledger purls (mirroring scan's discovery supplements, including their `--global` gate). **Exempt** (no narrowing): UUID identifiers, exact-versioned PURL identifiers (explicit intent), `--save-only` runs (record-only has no installation precondition — the fresh-clone record→vendor flow keeps working), `--all-releases`, and the package-name path (already installed-derived). When EVERY found patch is filtered out, get exits 0 with the additive status **`not_installed`** (`{status:"not_installed", found:N, downloaded:0, applied:0, patches:[<skip records>], warnings?}`) — never `no_match`, which remains pinned to the fuzzy package-name path. PnP layouts are surfaced, not misreported: yarn-PnP npm results skip with `errorCode: "yarn_pnp_unsupported"` in every mode; pnpm-PnP skips carry `pnpm_pnp_unsupported` in agent/vendored modes; hosted mode — the refusal's own remedy — keeps ONLY the versions the raw `pnpm-lock.yaml` text actually resolves (boundary-anchored probe over the v5/v6/v9 key spellings, so a large fan-out never requests grants for every version ever patched), labels a JUDGED miss `package_not_installed` exactly like a non-PnP project (the layout blocked nothing — the lock was read and the version isn't resolved), and reserves the layout code for an unreadable lock (no judgment possible). When EVERY narrowed-out result is a PnP refusal, the human terminal names the layout instead of claiming "not installed" and never advises `--all-releases` (which cannot make PnP patchable); the JSON status stays `not_installed` — consumers dispatch on the per-record `errorCode`. Hosted mode also runs the per-release VARIANT filter (`filter_to_installed_releases`) on its search path before requesting grants — agent/vendored runs get it inside the download engines — with the same keep-all-plus-warning fallbacks (surfaced as `(release_narrowing)`-prefixed strings in `warnings[]`). An ecosystem this binary has no crawler for is likewise never judged: its results are KEPT (absence from a crawl that never looked carries no information — the same fail-safe as scan's prune GC). The human `Found N patches:` listing shows only the patches whose package version survived the narrowing (the narrowing is judged over every result, so an installed package's paid fix a free user cannot download still lists as `[PAID] (no access)`, while skip records and counts cover only accessible patches), sorted by PURL in natural version order (`4.17.2` before `4.17.10`); the narrowed-out ones are summarized on stderr in one line per reason (`Skipped N patches for M package versions not installed here (use --all-releases to include them).`), and `--verbose` adds one `[skip] <purl> (<reason>)` line per skipped version after that summary, in natural version order. When the candidates hold more patches than were selected and the pick was made without a menu (a paid user's auto-pick, `--yes`, a non-TTY run), a `Selected:` block names the patch (purl, tier, short uuid, advisories) that will be installed before the prompt. Machine output (the prompt count, the JSON envelope) uses the kept set, unchanged. The finer per-release variant narrowing (`filter_to_installed_releases`) is unchanged and still runs inside the download engines (and before an agent-mode `--dry-run` preview, so the preview names only the variants a wet run would fetch).
 * **Deliberate divergences from scan** (documented, not drift): agent-mode get keeps its `selection_required` JSON posture for free multi-patch PURLs (scan and, v5.0, hosted/vendored get auto-pick); get has no `--vex` (an ambient `SOCKET_VEX` is ignored by get's modes), no `--detached` (moot — `get --mode vendored` is manifest-free by construction), no `--prune`; get does not run scan's pre-vendor baseline annotation; and an all-narrowed-out run exits `not_installed` without entering the vendor step (heal-after-wipe re-vendoring stays `scan --mode vendored`'s job). Agent-mode `get` honors `--dry-run` too (v5.0): the search and uuid paths classify each selected patch against the manifest (read-only; an unreadable manifest fails closed like the wet run) and stop before the prompt, the download, any `.socket/` write and the apply — human `[would-add]` / `[would-update] … (replacing <short uuid>)` / `[skip] … (already in manifest)` lines then `[dry-run] Would download and apply N patches. No changes made.`; JSON `{status:"success", dryRun:true, found, downloaded:0, skipped, applied:0, patches:[{purl, uuid, action:"would_add"|"would_update"(+oldUuid)|"skipped"}, <narrowing skip records>], warnings?}`, exit 0.
 
@@ -1468,7 +1468,7 @@ socket-patch apply --json | jq '
 Exit `0` when `status` is `success`, `noManifest`, or `notFound`-with-zero-failed.
 Exit `1` when `status` is `partialFailure` (any `events[*].action == "failed"`) or `error`.
 
-`apply` with no manifest at all is a clean exit-0 no-op (`status: "noManifest"`), and an **empty** manifest (zero patches) is a plain `success` exit 0 — this is load-bearing for CI steps that run `apply` after every install. A fully rolled-back agent project therefore keeps `.socket/manifest.json` at `{"patches": {}}`: the v5.0 residue rule never deletes a zero-patch manifest, precisely so these CI exits (and `list`'s 0-vs-1 below) never flip. Pinned by `tests/in_process_edge_cases.rs` and `tests/cli_dry_run_paths_e2e.rs`. **One carve-out**: a yarn-berry Plug'n'Play layout (`.pnp.*` loader at `--cwd`) refuses with the loud `yarn_pnp_unsupported` error (exit 1) even when no manifest exists — `scan` cannot discover PnP packages (they live inside `.yarn/cache/*.zip`, no `node_modules/`) and therefore never writes a manifest, so without the carve-out the documented refusal was unreachable and a PnP project's only signal was the calm noManifest exit. Pinned by `tests/e2e_safety_yarn_pnp.rs`.
+`apply` with no manifest at all is a clean exit-0 no-op (`status: "noManifest"`), and an **empty** manifest (zero patches) is a plain `success` exit 0 — this is load-bearing for CI steps that run `apply` after every install. A fully rolled-back agent project therefore keeps `.socket/manifest.json` at `{"patches": {}}`: the v5.0 residue rule never deletes a zero-patch manifest, precisely so these CI exits (and `list`'s 0-vs-1 below) never flip. Pinned by `tests/in_process_edge_cases.rs` and `tests/cli/cli_dry_run_paths_e2e.rs`. **One carve-out**: a yarn-berry Plug'n'Play layout (`.pnp.*` loader at `--cwd`) refuses with the loud `yarn_pnp_unsupported` error (exit 1) even when no manifest exists — `scan` cannot discover PnP packages (they live inside `.yarn/cache/*.zip`, no `node_modules/`) and therefore never writes a manifest, so without the carve-out the documented refusal was unreachable and a PnP project's only signal was the calm noManifest exit. Pinned by `tests/e2e_safety_yarn_pnp.rs`.
 
 ## Exit codes
 
diff --git a/crates/socket-patch-cli/src/commands/scan/mod.rs b/crates/socket-patch-cli/src/commands/scan/mod.rs
index cf1bb5c8c..09b119e07 100644
--- a/crates/socket-patch-cli/src/commands/scan/mod.rs
+++ b/crates/socket-patch-cli/src/commands/scan/mod.rs
@@ -3282,7 +3282,7 @@ mod tests {
 
     // ---- redirectState envelope block (read-only cross-mode visibility) ----
     // The end-to-end envelope placement (report-only + agent runs carry it,
-    // hosted/vendored runs don't) is pinned by `tests/scan_invariants.rs`;
+    // hosted/vendored runs don't) is pinned by `tests/scan/scan_invariants.rs`;
     // these pin the block builder's own gates and shape.
 
     /// Pins present ⇒ the block exists with each pin's canonical purl +
diff --git a/crates/socket-patch-cli/tests/apply_invariants.rs b/crates/socket-patch-cli/tests/apply/apply_invariants.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/apply_invariants.rs
rename to crates/socket-patch-cli/tests/apply/apply_invariants.rs
index ba9861ed1..2878ec307 100644
--- a/crates/socket-patch-cli/tests/apply_invariants.rs
+++ b/crates/socket-patch-cli/tests/apply/apply_invariants.rs
@@ -682,10 +682,8 @@ fn unmatched_purl_exit_semantics_are_pinned() {
     assert_eq!(v2["status"], "partialFailure", "{v2}");
 }
 
-#[path = "vlt_hosted_common/mod.rs"]
-mod vlt_hosted_common;
-#[path = "vlt_hosted_common/vendored.rs"]
-mod vlt_vendored;
+use crate::vlt_hosted_common;
+use crate::vlt_vendored;
 
 /// A vlt-vendored purl: `apply` yields it to the vendor ledger (the
 /// committed dir artifact is what vlt installs), leaves `.socket/`
diff --git a/crates/socket-patch-cli/tests/apply_network.rs b/crates/socket-patch-cli/tests/apply/apply_network.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/apply_network.rs
rename to crates/socket-patch-cli/tests/apply/apply_network.rs
diff --git a/crates/socket-patch-cli/tests/cli_gem_variant_mismatch_policy.rs b/crates/socket-patch-cli/tests/apply/cli_gem_variant_mismatch_policy.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/cli_gem_variant_mismatch_policy.rs
rename to crates/socket-patch-cli/tests/apply/cli_gem_variant_mismatch_policy.rs
diff --git a/crates/socket-patch-cli/tests/covgap_commands_apply.rs b/crates/socket-patch-cli/tests/apply/covgap_commands_apply.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/covgap_commands_apply.rs
rename to crates/socket-patch-cli/tests/apply/covgap_commands_apply.rs
index 28d0caa33..035a48da9 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_apply.rs
+++ b/crates/socket-patch-cli/tests/apply/covgap_commands_apply.rs
@@ -39,8 +39,7 @@ use serde_json::{json, Value};
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-#[path = "common/mod.rs"]
-mod common;
+use crate::common;
 
 use common::{git_sha256, parse_json_envelope, run_with_env};
 
diff --git a/crates/socket-patch-cli/tests/e2e_safety_advisories.rs b/crates/socket-patch-cli/tests/apply/e2e_safety_advisories.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/e2e_safety_advisories.rs
rename to crates/socket-patch-cli/tests/apply/e2e_safety_advisories.rs
index 359ffae47..284d07098 100644
--- a/crates/socket-patch-cli/tests/e2e_safety_advisories.rs
+++ b/crates/socket-patch-cli/tests/apply/e2e_safety_advisories.rs
@@ -27,8 +27,7 @@
 
 use std::path::Path;
 
-#[path = "common/mod.rs"]
-mod common;
+use crate::common;
 
 use common::{
     git_sha256, parse_json_envelope, run_with_env, write_blob, write_minimal_manifest, PatchEntry,
diff --git a/crates/socket-patch-cli/tests/in_process_gem_config_warning.rs b/crates/socket-patch-cli/tests/apply/in_process_gem_config_warning.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/in_process_gem_config_warning.rs
rename to crates/socket-patch-cli/tests/apply/in_process_gem_config_warning.rs
diff --git a/crates/socket-patch-cli/tests/in_process_gem_fallback_home.rs b/crates/socket-patch-cli/tests/apply/in_process_gem_fallback_home.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/in_process_gem_fallback_home.rs
rename to crates/socket-patch-cli/tests/apply/in_process_gem_fallback_home.rs
diff --git a/crates/socket-patch-cli/tests/in_process_gem_multicopy.rs b/crates/socket-patch-cli/tests/apply/in_process_gem_multicopy.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/in_process_gem_multicopy.rs
rename to crates/socket-patch-cli/tests/apply/in_process_gem_multicopy.rs
diff --git a/crates/socket-patch-cli/tests/in_process_npm_multicopy.rs b/crates/socket-patch-cli/tests/apply/in_process_npm_multicopy.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/in_process_npm_multicopy.rs
rename to crates/socket-patch-cli/tests/apply/in_process_npm_multicopy.rs
diff --git a/crates/socket-patch-cli/tests/in_process_variant_apply_failure.rs b/crates/socket-patch-cli/tests/apply/in_process_variant_apply_failure.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/in_process_variant_apply_failure.rs
rename to crates/socket-patch-cli/tests/apply/in_process_variant_apply_failure.rs
diff --git a/crates/socket-patch-cli/tests/apply/main.rs b/crates/socket-patch-cli/tests/apply/main.rs
new file mode 100644
index 000000000..52d02b457
--- /dev/null
+++ b/crates/socket-patch-cli/tests/apply/main.rs
@@ -0,0 +1,21 @@
+//! `apply`: invariants, network behavior, silent/exit modes and the gem and npm multi-copy apply paths.
+//!
+//! One test binary per command: each module was its own binary.
+
+#[path = "../common/mod.rs"]
+mod common;
+#[path = "../vlt_hosted_common/mod.rs"]
+mod vlt_hosted_common;
+#[path = "../vlt_hosted_common/vendored.rs"]
+mod vlt_vendored;
+
+mod apply_invariants;
+mod apply_network;
+mod cli_gem_variant_mismatch_policy;
+mod covgap_commands_apply;
+mod e2e_safety_advisories;
+mod in_process_gem_config_warning;
+mod in_process_gem_fallback_home;
+mod in_process_gem_multicopy;
+mod in_process_npm_multicopy;
+mod in_process_variant_apply_failure;
diff --git a/crates/socket-patch-cli/tests/api_client_errors_e2e.rs b/crates/socket-patch-cli/tests/cli/api_client_errors_e2e.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/api_client_errors_e2e.rs
rename to crates/socket-patch-cli/tests/cli/api_client_errors_e2e.rs
diff --git a/crates/socket-patch-cli/tests/cli_dry_run_paths_e2e.rs b/crates/socket-patch-cli/tests/cli/cli_dry_run_paths_e2e.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/cli_dry_run_paths_e2e.rs
rename to crates/socket-patch-cli/tests/cli/cli_dry_run_paths_e2e.rs
diff --git a/crates/socket-patch-cli/tests/covgap_api_client.rs b/crates/socket-patch-cli/tests/cli/covgap_api_client.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/covgap_api_client.rs
rename to crates/socket-patch-cli/tests/cli/covgap_api_client.rs
diff --git a/crates/socket-patch-cli/tests/covgap_commands_list.rs b/crates/socket-patch-cli/tests/cli/covgap_commands_list.rs
similarity index 98%
rename from crates/socket-patch-cli/tests/covgap_commands_list.rs
rename to crates/socket-patch-cli/tests/cli/covgap_commands_list.rs
index a41fceeaa..2e337c01e 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_list.rs
+++ b/crates/socket-patch-cli/tests/cli/covgap_commands_list.rs
@@ -20,12 +20,9 @@ use std::process::Command;
 use base64::Engine as _;
 use wiremock::MockServer;
 
-#[path = "common/mod.rs"]
-mod common;
-#[path = "vlt_hosted_common/mod.rs"]
-mod vlt_hosted_common;
-#[path = "vlt_hosted_common/vendored.rs"]
-mod vlt_vendored;
+use crate::common;
+use crate::vlt_hosted_common;
+use crate::vlt_vendored;
 
 // ---------------------------------------------------------------------------
 // `--debug` provenance echoes (GlobalArgs::telemetry_credentials, config layer)
diff --git a/crates/socket-patch-cli/tests/covgap_output.rs b/crates/socket-patch-cli/tests/cli/covgap_output.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/covgap_output.rs
rename to crates/socket-patch-cli/tests/cli/covgap_output.rs
index b629bb8e3..25acecde0 100644
--- a/crates/socket-patch-cli/tests/covgap_output.rs
+++ b/crates/socket-patch-cli/tests/cli/covgap_output.rs
@@ -14,8 +14,6 @@
 
 #![cfg(unix)]
 
-#[path = "common/pty_io.rs"]
-mod pty_io;
 use std::path::{Path, PathBuf};
 use std::time::Duration;
 
@@ -26,8 +24,7 @@ use wiremock::{Mock, MockServer, ResponseTemplate};
 // Pulled in for `git_sha256` (the patch-view blob fixture below must clear
 // the "patch has no applicable files" guardrail with a real blob
 // hash). Read-only reuse of the shared helper module.
-#[path = "common/mod.rs"]
-mod common;
+use crate::common;
 
 const ORG_SLUG: &str = "test-org";
 const UUID_A: &str = "11111111-1111-4111-8111-111111111111";
diff --git a/crates/socket-patch-cli/tests/interactive_prompts_e2e.rs b/crates/socket-patch-cli/tests/cli/interactive_prompts_e2e.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/interactive_prompts_e2e.rs
rename to crates/socket-patch-cli/tests/cli/interactive_prompts_e2e.rs
index 25da2f439..6f744bfe4 100644
--- a/crates/socket-patch-cli/tests/interactive_prompts_e2e.rs
+++ b/crates/socket-patch-cli/tests/cli/interactive_prompts_e2e.rs
@@ -7,8 +7,6 @@
 
 #![cfg(unix)]
 
-#[path = "common/pty_io.rs"]
-mod pty_io;
 use std::path::{Path, PathBuf};
 use std::time::Duration;
 
diff --git a/crates/socket-patch-cli/tests/cli/main.rs b/crates/socket-patch-cli/tests/cli/main.rs
new file mode 100644
index 000000000..9ef09285e
--- /dev/null
+++ b/crates/socket-patch-cli/tests/cli/main.rs
@@ -0,0 +1,21 @@
+//! Global CLI behavior: API client errors, dry-run paths, output modes, prompts, telemetry and `list`.
+//!
+//! One test binary per command: each module was its own binary.
+
+#[path = "../common/mod.rs"]
+mod common;
+#[path = "../common/pty_io.rs"]
+mod pty_io;
+#[path = "../vlt_hosted_common/mod.rs"]
+mod vlt_hosted_common;
+#[path = "../vlt_hosted_common/vendored.rs"]
+mod vlt_vendored;
+
+mod api_client_errors_e2e;
+mod cli_dry_run_paths_e2e;
+mod covgap_api_client;
+mod covgap_commands_list;
+mod covgap_output;
+mod interactive_prompts_e2e;
+mod output_modes_e2e;
+mod telemetry_e2e;
diff --git a/crates/socket-patch-cli/tests/output_modes_e2e.rs b/crates/socket-patch-cli/tests/cli/output_modes_e2e.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/output_modes_e2e.rs
rename to crates/socket-patch-cli/tests/cli/output_modes_e2e.rs
index aab9ef8bc..31291661d 100644
--- a/crates/socket-patch-cli/tests/output_modes_e2e.rs
+++ b/crates/socket-patch-cli/tests/cli/output_modes_e2e.rs
@@ -15,8 +15,7 @@ use std::path::Path;
 
 use sha2::{Digest, Sha256};
 
-#[path = "common/mod.rs"]
-mod common;
+use crate::common;
 
 fn git_sha256(content: &[u8]) -> String {
     let header = format!("blob {}\0", content.len());
diff --git a/crates/socket-patch-cli/tests/telemetry_e2e.rs b/crates/socket-patch-cli/tests/cli/telemetry_e2e.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/telemetry_e2e.rs
rename to crates/socket-patch-cli/tests/cli/telemetry_e2e.rs
diff --git a/crates/socket-patch-cli/tests/cli_get_silent_errors.rs b/crates/socket-patch-cli/tests/get/cli_get_silent_errors.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/cli_get_silent_errors.rs
rename to crates/socket-patch-cli/tests/get/cli_get_silent_errors.rs
index 61dd38188..32b620431 100644
--- a/crates/socket-patch-cli/tests/cli_get_silent_errors.rs
+++ b/crates/socket-patch-cli/tests/get/cli_get_silent_errors.rs
@@ -12,8 +12,7 @@
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-#[path = "common/mod.rs"]
-mod common;
+use crate::common;
 
 const ORG: &str = "test-org";
 const UUID: &str = "22222222-2222-4222-8222-222222222222";
diff --git a/crates/socket-patch-cli/tests/coverage_fix_get_double_json.rs b/crates/socket-patch-cli/tests/get/coverage_fix_get_double_json.rs
similarity index 98%
rename from crates/socket-patch-cli/tests/coverage_fix_get_double_json.rs
rename to crates/socket-patch-cli/tests/get/coverage_fix_get_double_json.rs
index 2c84264b0..430895942 100644
--- a/crates/socket-patch-cli/tests/coverage_fix_get_double_json.rs
+++ b/crates/socket-patch-cli/tests/get/coverage_fix_get_double_json.rs
@@ -12,8 +12,7 @@
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-#[path = "common/mod.rs"]
-mod common;
+use crate::common;
 
 const ORG: &str = "test-org";
 const GHSA: &str = "GHSA-dbld-json-once";
diff --git a/crates/socket-patch-cli/tests/get_batch_paths_e2e.rs b/crates/socket-patch-cli/tests/get/get_batch_paths_e2e.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/get_batch_paths_e2e.rs
rename to crates/socket-patch-cli/tests/get/get_batch_paths_e2e.rs
diff --git a/crates/socket-patch-cli/tests/get_edge_cases_e2e.rs b/crates/socket-patch-cli/tests/get/get_edge_cases_e2e.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/get_edge_cases_e2e.rs
rename to crates/socket-patch-cli/tests/get/get_edge_cases_e2e.rs
index b1e540182..8a8d57bfb 100644
--- a/crates/socket-patch-cli/tests/get_edge_cases_e2e.rs
+++ b/crates/socket-patch-cli/tests/get/get_edge_cases_e2e.rs
@@ -13,8 +13,7 @@ use wiremock::{Mock, MockServer, ResponseTemplate};
 // every `get` here, `SOCKET_PROXY_URL` outranks the proxy these tests pin,
 // and `SOCKET_MANIFEST_PATH` makes a *passing* test write its manifest and
 // blobs into whatever real project the variable points at.
-#[path = "common/mod.rs"]
-mod common;
+use crate::common;
 
 const ORG_SLUG: &str = "test-org";
 const UUID_A: &str = "11111111-1111-4111-8111-111111111111";
diff --git a/crates/socket-patch-cli/tests/get_invariants.rs b/crates/socket-patch-cli/tests/get/get_invariants.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/get_invariants.rs
rename to crates/socket-patch-cli/tests/get/get_invariants.rs
index a96531b04..798ae20db 100644
--- a/crates/socket-patch-cli/tests/get_invariants.rs
+++ b/crates/socket-patch-cli/tests/get/get_invariants.rs
@@ -8,8 +8,7 @@ use std::path::Path;
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-#[path = "common/mod.rs"]
-mod common;
+use crate::common;
 
 const ORG_SLUG: &str = "test-org";
 const UUID: &str = "11111111-1111-4111-8111-111111111111";
diff --git a/crates/socket-patch-cli/tests/get_modes_e2e.rs b/crates/socket-patch-cli/tests/get/get_modes_e2e.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/get_modes_e2e.rs
rename to crates/socket-patch-cli/tests/get/get_modes_e2e.rs
index 0390330d5..8ba3bd979 100644
--- a/crates/socket-patch-cli/tests/get_modes_e2e.rs
+++ b/crates/socket-patch-cli/tests/get/get_modes_e2e.rs
@@ -21,12 +21,9 @@ use std::path::Path;
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-#[path = "common/mod.rs"]
-mod common;
-#[path = "npm_e2e_common/manifestless.rs"]
-mod npm_e2e_common;
-#[path = "vex_e2e_common/mod.rs"]
-mod vex_e2e_common;
+use crate::common;
+use crate::npm_e2e_common;
+use crate::vex_e2e_common;
 
 const ORG: &str = "test-org";
 const NAME: &str = "getmodes-pkg";
@@ -235,7 +232,7 @@ async fn get_uuid_hosted_json_envelope_nests_redirect() {
     // committed the run writes no `.npmrc` (so `rewrittenFiles` stays the
     // lock alone) and emits exactly the already-set
     // `redirect_npm_allow_remote` caveat (the auto-config has its own suite:
-    // tests/redirect_npm_allow_remote.rs).
+    // tests/vendor/redirect_npm_allow_remote.rs).
     std::fs::write(tmp.path().join(".npmrc"), "allow-remote=all\n").unwrap();
 
     let (code, stdout, stderr) = run_get(
@@ -594,7 +591,7 @@ async fn get_hosted_dry_run_json_envelope() {
     // committed the run writes no `.npmrc` (so `rewrittenFiles` stays the
     // lock alone) and emits exactly the already-set
     // `redirect_npm_allow_remote` caveat (the auto-config has its own suite:
-    // tests/redirect_npm_allow_remote.rs).
+    // tests/vendor/redirect_npm_allow_remote.rs).
     std::fs::write(tmp.path().join(".npmrc"), "allow-remote=all\n").unwrap();
     let lock_before = std::fs::read_to_string(tmp.path().join("package-lock.json")).unwrap();
 
diff --git a/crates/socket-patch-cli/tests/get_nested_apply_api_flags_e2e.rs b/crates/socket-patch-cli/tests/get/get_nested_apply_api_flags_e2e.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/get_nested_apply_api_flags_e2e.rs
rename to crates/socket-patch-cli/tests/get/get_nested_apply_api_flags_e2e.rs
index e55906b76..f16b21893 100644
--- a/crates/socket-patch-cli/tests/get_nested_apply_api_flags_e2e.rs
+++ b/crates/socket-patch-cli/tests/get/get_nested_apply_api_flags_e2e.rs
@@ -22,8 +22,7 @@
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-#[path = "common/mod.rs"]
-mod common;
+use crate::common;
 
 const ORG: &str = "test-org";
 const UUID: &str = "11111111-1111-4111-8111-111111111111";
diff --git a/crates/socket-patch-cli/tests/get_update_summary_e2e.rs b/crates/socket-patch-cli/tests/get/get_update_summary_e2e.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/get_update_summary_e2e.rs
rename to crates/socket-patch-cli/tests/get/get_update_summary_e2e.rs
index 973839fd4..e68000d30 100644
--- a/crates/socket-patch-cli/tests/get_update_summary_e2e.rs
+++ b/crates/socket-patch-cli/tests/get/get_update_summary_e2e.rs
@@ -16,8 +16,7 @@
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-#[path = "common/mod.rs"]
-mod common;
+use crate::common;
 
 const ORG: &str = "test-org";
 const OLD_UUID: &str = "00000000-0000-4000-8000-000000000000";
diff --git a/crates/socket-patch-cli/tests/global_packages_e2e.rs b/crates/socket-patch-cli/tests/get/global_packages_e2e.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/global_packages_e2e.rs
rename to crates/socket-patch-cli/tests/get/global_packages_e2e.rs
index 61d0f7d38..25bdadd21 100644
--- a/crates/socket-patch-cli/tests/global_packages_e2e.rs
+++ b/crates/socket-patch-cli/tests/get/global_packages_e2e.rs
@@ -24,8 +24,7 @@
 use std::path::{Path, PathBuf};
 use std::process::Command;
 
-#[path = "common/cache_env.rs"]
-mod cache_env;
+use crate::cache_env;
 
 fn binary() -> PathBuf {
     env!("CARGO_BIN_EXE_socket-patch").into()
diff --git a/crates/socket-patch-cli/tests/get/main.rs b/crates/socket-patch-cli/tests/get/main.rs
new file mode 100644
index 000000000..a06c0915a
--- /dev/null
+++ b/crates/socket-patch-cli/tests/get/main.rs
@@ -0,0 +1,21 @@
+//! `get`: batch paths, edge cases, invariants, modes, nested apply flags, update summaries and global packages.
+//!
+//! One test binary per command: each module was its own binary.
+
+#[path = "../common/mod.rs"]
+mod common;
+#[path = "../npm_e2e_common/manifestless.rs"]
+mod npm_e2e_common;
+#[path = "../vex_e2e_common/mod.rs"]
+mod vex_e2e_common;
+use common::cache_env;
+
+mod cli_get_silent_errors;
+mod coverage_fix_get_double_json;
+mod get_batch_paths_e2e;
+mod get_edge_cases_e2e;
+mod get_invariants;
+mod get_modes_e2e;
+mod get_nested_apply_api_flags_e2e;
+mod get_update_summary_e2e;
+mod global_packages_e2e;
diff --git a/crates/socket-patch-cli/tests/covgap_commands_remove.rs b/crates/socket-patch-cli/tests/remove/covgap_commands_remove.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/covgap_commands_remove.rs
rename to crates/socket-patch-cli/tests/remove/covgap_commands_remove.rs
index de10372f9..1f5776505 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_remove.rs
+++ b/crates/socket-patch-cli/tests/remove/covgap_commands_remove.rs
@@ -13,16 +13,11 @@
 //! remove_invariants.rs / remove_duality_invariants.rs /
 //! interactive_prompts_e2e.rs.
 
-#[path = "common/pty_io.rs"]
-mod pty_io;
 use std::path::{Path, PathBuf};
 
-#[path = "common/mod.rs"]
-mod common;
-#[path = "vlt_hosted_common/mod.rs"]
-mod vlt_hosted_common;
-#[path = "vlt_hosted_common/vendored.rs"]
-mod vlt_vendored;
+use crate::common;
+use crate::vlt_hosted_common;
+use crate::vlt_vendored;
 
 /// Spawn `socket-patch remove` with the scrubbed env plus telemetry
 /// disabled; `env` entries land last so per-test injections survive.
diff --git a/crates/socket-patch-cli/tests/remove/main.rs b/crates/socket-patch-cli/tests/remove/main.rs
new file mode 100644
index 000000000..ae74e97c5
--- /dev/null
+++ b/crates/socket-patch-cli/tests/remove/main.rs
@@ -0,0 +1,17 @@
+//! `remove`: invariants, duality with rollback, and network behavior.
+//!
+//! One test binary per command: each module was its own binary.
+
+#[path = "../common/mod.rs"]
+mod common;
+#[path = "../common/pty_io.rs"]
+mod pty_io;
+#[path = "../vlt_hosted_common/mod.rs"]
+mod vlt_hosted_common;
+#[path = "../vlt_hosted_common/vendored.rs"]
+mod vlt_vendored;
+
+mod covgap_commands_remove;
+mod remove_duality_invariants;
+mod remove_invariants;
+mod remove_network;
diff --git a/crates/socket-patch-cli/tests/remove_duality_invariants.rs b/crates/socket-patch-cli/tests/remove/remove_duality_invariants.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/remove_duality_invariants.rs
rename to crates/socket-patch-cli/tests/remove/remove_duality_invariants.rs
index 8cb2efb1f..8ebff9e88 100644
--- a/crates/socket-patch-cli/tests/remove_duality_invariants.rs
+++ b/crates/socket-patch-cli/tests/remove/remove_duality_invariants.rs
@@ -15,8 +15,7 @@
 
 use std::path::{Path, PathBuf};
 
-#[path = "common/mod.rs"]
-mod common;
+use crate::common;
 
 /// Spawn `socket-patch remove` with the scrubbed env (`common::run_with_env`)
 /// plus telemetry disabled; `env` entries land last so per-test injections
@@ -866,10 +865,8 @@ fn drift_kept_vendored_remove_is_partial_failure() {
     );
 }
 
-#[path = "vlt_hosted_common/mod.rs"]
-mod vlt_hosted_common;
-#[path = "vlt_hosted_common/vendored.rs"]
-mod vlt_vendored;
+use crate::vlt_hosted_common;
+use crate::vlt_vendored;
 
 /// `remove --preserve-state` of a vlt-vendored purl restores the registry
 /// lock and package.json but keeps the directory artifact and the ledger
diff --git a/crates/socket-patch-cli/tests/remove_invariants.rs b/crates/socket-patch-cli/tests/remove/remove_invariants.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/remove_invariants.rs
rename to crates/socket-patch-cli/tests/remove/remove_invariants.rs
index 33ff85597..2a92ba270 100644
--- a/crates/socket-patch-cli/tests/remove_invariants.rs
+++ b/crates/socket-patch-cli/tests/remove/remove_invariants.rs
@@ -7,8 +7,7 @@
 
 use std::path::{Path, PathBuf};
 
-#[path = "common/mod.rs"]
-mod common;
+use crate::common;
 
 const TWO_PATCH_MANIFEST: &str = r#"{
   "patches": {
@@ -1039,10 +1038,8 @@ fn remove_dry_run_with_rollback_does_not_create_blobs_dir() {
     assert!(litter.is_empty(), "no stage litter: {litter:?}");
 }
 
-#[path = "vlt_hosted_common/mod.rs"]
-mod vlt_hosted_common;
-#[path = "vlt_hosted_common/vendored.rs"]
-mod vlt_vendored;
+use crate::vlt_hosted_common;
+use crate::vlt_vendored;
 
 /// `remove --skip-rollback` of a vlt-vendored purl drops the manifest
 /// record only: the vlt wiring, the directory artifact and the ledger entry
diff --git a/crates/socket-patch-cli/tests/remove_network.rs b/crates/socket-patch-cli/tests/remove/remove_network.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/remove_network.rs
rename to crates/socket-patch-cli/tests/remove/remove_network.rs
diff --git a/crates/socket-patch-cli/tests/coverage_fix_repair_vendor_predelete.rs b/crates/socket-patch-cli/tests/repair/coverage_fix_repair_vendor_predelete.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/coverage_fix_repair_vendor_predelete.rs
rename to crates/socket-patch-cli/tests/repair/coverage_fix_repair_vendor_predelete.rs
diff --git a/crates/socket-patch-cli/tests/covgap_commands_repair.rs b/crates/socket-patch-cli/tests/repair/covgap_commands_repair.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/covgap_commands_repair.rs
rename to crates/socket-patch-cli/tests/repair/covgap_commands_repair.rs
diff --git a/crates/socket-patch-cli/tests/covgap_commands_repair_vendor.rs b/crates/socket-patch-cli/tests/repair/covgap_commands_repair_vendor.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/covgap_commands_repair_vendor.rs
rename to crates/socket-patch-cli/tests/repair/covgap_commands_repair_vendor.rs
index 647172917..bf4baf458 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_repair_vendor.rs
+++ b/crates/socket-patch-cli/tests/repair/covgap_commands_repair_vendor.rs
@@ -1762,7 +1762,3 @@ async fn repair_inventory_refresh_persist_failure_stays_loud() {
     );
 }
 
-#[path = "vlt_hosted_common/mod.rs"]
-mod vlt_hosted_common;
-#[path = "vlt_hosted_common/vendored.rs"]
-mod vlt_vendored;
diff --git a/crates/socket-patch-cli/tests/repair/main.rs b/crates/socket-patch-cli/tests/repair/main.rs
new file mode 100644
index 000000000..861a4d1dd
--- /dev/null
+++ b/crates/socket-patch-cli/tests/repair/main.rs
@@ -0,0 +1,26 @@
+//! `repair`: invariants and vendored-tree repair across flavors.
+//!
+//! One test binary per command: each module was its own binary.
+
+#[path = "../common/mod.rs"]
+mod common;
+// `bun.rs` embeds its own copy of `vex_e2e_common`, which
+// `repair_vendor_e2e` also loads directly.
+#[allow(clippy::duplicate_mod)]
+#[path = "../vex_e2e_common/bun.rs"]
+mod bun_vex;
+#[path = "../npm_e2e_common/manifestless.rs"]
+mod npm_e2e_common;
+#[path = "../vex_e2e_common/mod.rs"]
+mod vex_e2e_common;
+#[path = "../vlt_hosted_common/mod.rs"]
+mod vlt_hosted_common;
+#[path = "../vlt_hosted_common/vendored.rs"]
+mod vlt_vendored;
+
+mod coverage_fix_repair_vendor_predelete;
+mod covgap_commands_repair;
+mod covgap_commands_repair_vendor;
+mod repair_invariants;
+mod repair_vendor_e2e;
+mod repair_vendor_flavors_e2e;
diff --git a/crates/socket-patch-cli/tests/repair_invariants.rs b/crates/socket-patch-cli/tests/repair/repair_invariants.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/repair_invariants.rs
rename to crates/socket-patch-cli/tests/repair/repair_invariants.rs
diff --git a/crates/socket-patch-cli/tests/repair_vendor_e2e.rs b/crates/socket-patch-cli/tests/repair/repair_vendor_e2e.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/repair_vendor_e2e.rs
rename to crates/socket-patch-cli/tests/repair/repair_vendor_e2e.rs
index ca3f90b3f..a12a741d9 100644
--- a/crates/socket-patch-cli/tests/repair_vendor_e2e.rs
+++ b/crates/socket-patch-cli/tests/repair/repair_vendor_e2e.rs
@@ -16,10 +16,8 @@ use sha2::{Digest, Sha256};
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-#[path = "npm_e2e_common/manifestless.rs"]
-mod npm_e2e_common;
-#[path = "vex_e2e_common/mod.rs"]
-mod vex_e2e_common;
+use crate::npm_e2e_common;
+use crate::vex_e2e_common;
 
 fn binary() -> PathBuf {
     env!("CARGO_BIN_EXE_socket-patch").into()
@@ -1263,10 +1261,8 @@ async fn repaired_vendored_state_attests_manifest_less() {
     }
 }
 
-#[path = "vlt_hosted_common/mod.rs"]
-mod vlt_hosted_common;
-#[path = "vlt_hosted_common/vendored.rs"]
-mod vlt_vendored;
+use crate::vlt_hosted_common;
+use crate::vlt_vendored;
 
 /// `repair --dry-run` over a deleted vlt directory artifact previews the
 /// rebuild (`wouldRebuild`, the dir path) and writes nothing; the wet run
diff --git a/crates/socket-patch-cli/tests/repair_vendor_flavors_e2e.rs b/crates/socket-patch-cli/tests/repair/repair_vendor_flavors_e2e.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/repair_vendor_flavors_e2e.rs
rename to crates/socket-patch-cli/tests/repair/repair_vendor_flavors_e2e.rs
index f12d2aaff..44620f494 100644
--- a/crates/socket-patch-cli/tests/repair_vendor_flavors_e2e.rs
+++ b/crates/socket-patch-cli/tests/repair/repair_vendor_flavors_e2e.rs
@@ -27,11 +27,9 @@ use sha2::{Digest, Sha256};
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-#[path = "vex_e2e_common/bun.rs"]
-mod bun_vex;
-#[path = "common/mod.rs"]
-mod common;
-#[path = "repair_vendor_flavors_e2e/vlt.rs"]
+use crate::bun_vex;
+use crate::common;
+#[path = "../repair_vendor_flavors_e2e/vlt.rs"]
 mod vlt;
 
 const ORG_SLUG: &str = "test-org";
diff --git a/crates/socket-patch-cli/tests/cli_rollback_silent.rs b/crates/socket-patch-cli/tests/rollback/cli_rollback_silent.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/cli_rollback_silent.rs
rename to crates/socket-patch-cli/tests/rollback/cli_rollback_silent.rs
diff --git a/crates/socket-patch-cli/tests/rollback/main.rs b/crates/socket-patch-cli/tests/rollback/main.rs
new file mode 100644
index 000000000..46ae232be
--- /dev/null
+++ b/crates/socket-patch-cli/tests/rollback/main.rs
@@ -0,0 +1,13 @@
+//! `rollback`: invariants, duality with remove, silent mode and the multi-copy blob gate.
+//!
+//! One test binary per command: each module was its own binary.
+
+#[path = "../vlt_hosted_common/mod.rs"]
+mod vlt_hosted_common;
+#[path = "../vlt_hosted_common/vendored.rs"]
+mod vlt_vendored;
+
+mod cli_rollback_silent;
+mod rollback_duality_invariants;
+mod rollback_invariants;
+mod rollback_multicopy_blob_gate;
diff --git a/crates/socket-patch-cli/tests/rollback_duality_invariants.rs b/crates/socket-patch-cli/tests/rollback/rollback_duality_invariants.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/rollback_duality_invariants.rs
rename to crates/socket-patch-cli/tests/rollback/rollback_duality_invariants.rs
diff --git a/crates/socket-patch-cli/tests/rollback_invariants.rs b/crates/socket-patch-cli/tests/rollback/rollback_invariants.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/rollback_invariants.rs
rename to crates/socket-patch-cli/tests/rollback/rollback_invariants.rs
index a447e0684..3a2f711c4 100644
--- a/crates/socket-patch-cli/tests/rollback_invariants.rs
+++ b/crates/socket-patch-cli/tests/rollback/rollback_invariants.rs
@@ -1194,10 +1194,8 @@ fn rollback_honors_manifest_path_override() {
     );
 }
 
-#[path = "vlt_hosted_common/mod.rs"]
-mod vlt_hosted_common;
-#[path = "vlt_hosted_common/vendored.rs"]
-mod vlt_vendored;
+use crate::vlt_hosted_common;
+use crate::vlt_vendored;
 
 /// An unscoped `rollback` over a vlt-vendored project reverts the `file`
 /// node, its edges and package.json to the registry bytes and removes the
diff --git a/crates/socket-patch-cli/tests/rollback_multicopy_blob_gate.rs b/crates/socket-patch-cli/tests/rollback/rollback_multicopy_blob_gate.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/rollback_multicopy_blob_gate.rs
rename to crates/socket-patch-cli/tests/rollback/rollback_multicopy_blob_gate.rs
diff --git a/crates/socket-patch-cli/tests/coverage_fix_scan_discovery_corrupt_ledger.rs b/crates/socket-patch-cli/tests/scan/coverage_fix_scan_discovery_corrupt_ledger.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/coverage_fix_scan_discovery_corrupt_ledger.rs
rename to crates/socket-patch-cli/tests/scan/coverage_fix_scan_discovery_corrupt_ledger.rs
diff --git a/crates/socket-patch-cli/tests/covgap_commands_fetch_stage.rs b/crates/socket-patch-cli/tests/scan/covgap_commands_fetch_stage.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/covgap_commands_fetch_stage.rs
rename to crates/socket-patch-cli/tests/scan/covgap_commands_fetch_stage.rs
diff --git a/crates/socket-patch-cli/tests/covgap_commands_scan_vendor_flow.rs b/crates/socket-patch-cli/tests/scan/covgap_commands_scan_vendor_flow.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/covgap_commands_scan_vendor_flow.rs
rename to crates/socket-patch-cli/tests/scan/covgap_commands_scan_vendor_flow.rs
index cf23ca755..decd65db1 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_scan_vendor_flow.rs
+++ b/crates/socket-patch-cli/tests/scan/covgap_commands_scan_vendor_flow.rs
@@ -660,10 +660,8 @@ async fn scan_vendor_staging_error_interactive_prints_error_line() {
     );
 }
 
-#[path = "vlt_hosted_common/mod.rs"]
-mod vlt_hosted_common;
-#[path = "vlt_hosted_common/vendored.rs"]
-mod vlt_vendored;
+use crate::vlt_hosted_common;
+use crate::vlt_vendored;
 
 /// The dry-run preview over a vlt project already vendored at the offered
 /// uuid: the lock's `file` node is ours, so the vlt preflight exempts it
diff --git a/crates/socket-patch-cli/tests/covgap_ecosystem_dispatch.rs b/crates/socket-patch-cli/tests/scan/covgap_ecosystem_dispatch.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/covgap_ecosystem_dispatch.rs
rename to crates/socket-patch-cli/tests/scan/covgap_ecosystem_dispatch.rs
diff --git a/crates/socket-patch-cli/tests/hosted_management_refusals.rs b/crates/socket-patch-cli/tests/scan/hosted_management_refusals.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/hosted_management_refusals.rs
rename to crates/socket-patch-cli/tests/scan/hosted_management_refusals.rs
diff --git a/crates/socket-patch-cli/tests/hosted_symlinked_files.rs b/crates/socket-patch-cli/tests/scan/hosted_symlinked_files.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/hosted_symlinked_files.rs
rename to crates/socket-patch-cli/tests/scan/hosted_symlinked_files.rs
index 4ab06e221..431211e70 100644
--- a/crates/socket-patch-cli/tests/hosted_symlinked_files.rs
+++ b/crates/socket-patch-cli/tests/scan/hosted_symlinked_files.rs
@@ -28,10 +28,8 @@ use serde_json::{json, Value};
 use wiremock::matchers::{method, path, path_regex};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-#[path = "common/mod.rs"]
-mod common;
-#[path = "vlt_hosted_common/mod.rs"]
-mod vlt_hosted_common;
+use crate::common;
+use crate::vlt_hosted_common;
 
 const ORG: &str = "test-org";
 const CODE: &str = "redirect_symlinked_file_unsupported";
diff --git a/crates/socket-patch-cli/tests/hosted_wheel_metadata_order.rs b/crates/socket-patch-cli/tests/scan/hosted_wheel_metadata_order.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/hosted_wheel_metadata_order.rs
rename to crates/socket-patch-cli/tests/scan/hosted_wheel_metadata_order.rs
index c6fe0ab6d..1d48d1e72 100644
--- a/crates/socket-patch-cli/tests/hosted_wheel_metadata_order.rs
+++ b/crates/socket-patch-cli/tests/scan/hosted_wheel_metadata_order.rs
@@ -23,8 +23,7 @@ use serde_json::{json, Value};
 use wiremock::matchers::{method, path, path_regex};
 use wiremock::{Mock, MockServer, Request, Respond, ResponseTemplate};
 
-#[path = "common/mod.rs"]
-mod common;
+use crate::common;
 
 const ORG: &str = "test-org";
 
diff --git a/crates/socket-patch-cli/tests/scan/main.rs b/crates/socket-patch-cli/tests/scan/main.rs
new file mode 100644
index 000000000..5e0ce94f0
--- /dev/null
+++ b/crates/socket-patch-cli/tests/scan/main.rs
@@ -0,0 +1,25 @@
+//! `scan`: batching, ecosystem scope, ordering, paths, sync, hosted refusals and the vendor flow.
+//!
+//! One test binary per command: each module was its own binary.
+
+#[path = "../common/mod.rs"]
+mod common;
+#[path = "../vlt_hosted_common/mod.rs"]
+mod vlt_hosted_common;
+#[path = "../vlt_hosted_common/vendored.rs"]
+mod vlt_vendored;
+
+mod coverage_fix_scan_discovery_corrupt_ledger;
+mod covgap_commands_fetch_stage;
+mod covgap_commands_scan_vendor_flow;
+mod covgap_ecosystem_dispatch;
+mod hosted_management_refusals;
+mod hosted_symlinked_files;
+mod hosted_wheel_metadata_order;
+mod scan_batch_sizing_e2e;
+mod scan_ecosystems_scope_e2e;
+mod scan_invariants;
+mod scan_ordered_concurrency_e2e;
+mod scan_paths_e2e;
+mod scan_sync_e2e;
+mod scan_vendor_step_error_e2e;
diff --git a/crates/socket-patch-cli/tests/scan_batch_sizing_e2e.rs b/crates/socket-patch-cli/tests/scan/scan_batch_sizing_e2e.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/scan_batch_sizing_e2e.rs
rename to crates/socket-patch-cli/tests/scan/scan_batch_sizing_e2e.rs
diff --git a/crates/socket-patch-cli/tests/scan_ecosystems_scope_e2e.rs b/crates/socket-patch-cli/tests/scan/scan_ecosystems_scope_e2e.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/scan_ecosystems_scope_e2e.rs
rename to crates/socket-patch-cli/tests/scan/scan_ecosystems_scope_e2e.rs
diff --git a/crates/socket-patch-cli/tests/scan_invariants.rs b/crates/socket-patch-cli/tests/scan/scan_invariants.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/scan_invariants.rs
rename to crates/socket-patch-cli/tests/scan/scan_invariants.rs
index 25616c2ab..abdf9d775 100644
--- a/crates/socket-patch-cli/tests/scan_invariants.rs
+++ b/crates/socket-patch-cli/tests/scan/scan_invariants.rs
@@ -2112,10 +2112,8 @@ async fn ecosystems_filter_keeps_records_but_not_wiring_live() {
     );
 }
 
-#[path = "vlt_hosted_common/mod.rs"]
-mod vlt_hosted_common;
-#[path = "vlt_hosted_common/vendored.rs"]
-mod vlt_vendored;
+use crate::vlt_hosted_common;
+use crate::vlt_vendored;
 
 /// vlt twin of `scan_agent_over_vendored_purl_surfaces_run_level_warning`:
 /// an agent scan over a purl a vlt directory artifact vendors skips it
diff --git a/crates/socket-patch-cli/tests/scan_ordered_concurrency_e2e.rs b/crates/socket-patch-cli/tests/scan/scan_ordered_concurrency_e2e.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/scan_ordered_concurrency_e2e.rs
rename to crates/socket-patch-cli/tests/scan/scan_ordered_concurrency_e2e.rs
diff --git a/crates/socket-patch-cli/tests/scan_paths_e2e.rs b/crates/socket-patch-cli/tests/scan/scan_paths_e2e.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/scan_paths_e2e.rs
rename to crates/socket-patch-cli/tests/scan/scan_paths_e2e.rs
diff --git a/crates/socket-patch-cli/tests/scan_sync_e2e.rs b/crates/socket-patch-cli/tests/scan/scan_sync_e2e.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/scan_sync_e2e.rs
rename to crates/socket-patch-cli/tests/scan/scan_sync_e2e.rs
diff --git a/crates/socket-patch-cli/tests/scan_vendor_step_error_e2e.rs b/crates/socket-patch-cli/tests/scan/scan_vendor_step_error_e2e.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/scan_vendor_step_error_e2e.rs
rename to crates/socket-patch-cli/tests/scan/scan_vendor_step_error_e2e.rs
diff --git a/crates/socket-patch-cli/tests/covgap_commands_update.rs b/crates/socket-patch-cli/tests/update/covgap_commands_update.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/covgap_commands_update.rs
rename to crates/socket-patch-cli/tests/update/covgap_commands_update.rs
index 809bb3c72..b2d75aafc 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_update.rs
+++ b/crates/socket-patch-cli/tests/update/covgap_commands_update.rs
@@ -9,12 +9,8 @@
 //! itself must never be a swap target. Fixture shapes are copied from
 //! self_update_e2e.rs / interactive_prompts_e2e.rs.
 
-#[path = "common/pty_io.rs"]
-mod pty_io;
-#[path = "common/mod.rs"]
-mod common;
-#[path = "common/update_fixture.rs"]
-mod update_fixture;
+use crate::common;
+use crate::update_fixture;
 
 use update_fixture::{make_served_binary, run_installed, staged_install, FakeReleaseBuilder};
 
diff --git a/crates/socket-patch-cli/tests/covgap_update_download.rs b/crates/socket-patch-cli/tests/update/covgap_update_download.rs
similarity index 96%
rename from crates/socket-patch-cli/tests/covgap_update_download.rs
rename to crates/socket-patch-cli/tests/update/covgap_update_download.rs
index 6bf578edf..18cf2e018 100644
--- a/crates/socket-patch-cli/tests/covgap_update_download.rs
+++ b/crates/socket-patch-cli/tests/update/covgap_update_download.rs
@@ -9,10 +9,8 @@
 //! a failed update must leave the install byte-identical with no stage
 //! droppings.
 
-#[path = "common/mod.rs"]
-mod common;
-#[path = "common/update_fixture.rs"]
-mod update_fixture;
+use crate::common;
+use crate::update_fixture;
 
 use wiremock::matchers::{method, path as urlpath};
 use wiremock::{Mock, ResponseTemplate};
diff --git a/crates/socket-patch-cli/tests/covgap_update_swap.rs b/crates/socket-patch-cli/tests/update/covgap_update_swap.rs
similarity index 98%
rename from crates/socket-patch-cli/tests/covgap_update_swap.rs
rename to crates/socket-patch-cli/tests/update/covgap_update_swap.rs
index 2730744a1..bb9c4f8b6 100644
--- a/crates/socket-patch-cli/tests/covgap_update_swap.rs
+++ b/crates/socket-patch-cli/tests/update/covgap_update_swap.rs
@@ -16,10 +16,7 @@
 //! `CARGO_BIN_EXE_socket-patch` itself must never be a swap target — and
 //! re-verifies the real artifact at the end.
 
-#[path = "common/mod.rs"]
-mod common;
-#[path = "common/update_fixture.rs"]
-mod update_fixture;
+use crate::update_fixture;
 
 use std::path::Path;
 
diff --git a/crates/socket-patch-cli/tests/update/main.rs b/crates/socket-patch-cli/tests/update/main.rs
new file mode 100644
index 000000000..0b4629b5b
--- /dev/null
+++ b/crates/socket-patch-cli/tests/update/main.rs
@@ -0,0 +1,16 @@
+//! Self-update channels, downloads, swaps and the update notifier.
+//!
+//! One test binary per command: each module was its own binary.
+
+#[path = "../common/mod.rs"]
+mod common;
+#[path = "../common/pty_io.rs"]
+mod pty_io;
+#[path = "../common/update_fixture.rs"]
+mod update_fixture;
+
+mod covgap_commands_update;
+mod covgap_update_download;
+mod covgap_update_swap;
+mod self_update_channels_e2e;
+mod update_notifier_e2e;
diff --git a/crates/socket-patch-cli/tests/self_update_channels_e2e.rs b/crates/socket-patch-cli/tests/update/self_update_channels_e2e.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/self_update_channels_e2e.rs
rename to crates/socket-patch-cli/tests/update/self_update_channels_e2e.rs
index a13fb56f6..526100ba9 100644
--- a/crates/socket-patch-cli/tests/self_update_channels_e2e.rs
+++ b/crates/socket-patch-cli/tests/update/self_update_channels_e2e.rs
@@ -16,10 +16,8 @@
 //! the prefix comparison never fires — which is exactly the behavior the
 //! real cargo/launcher installers see, since they resolve real paths.
 
-#[path = "common/mod.rs"]
-mod common;
-#[path = "common/update_fixture.rs"]
-mod update_fixture;
+use crate::common;
+use crate::update_fixture;
 
 use sha2::{Digest, Sha256};
 use update_fixture::{
diff --git a/crates/socket-patch-cli/tests/update_notifier_e2e.rs b/crates/socket-patch-cli/tests/update/update_notifier_e2e.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/update_notifier_e2e.rs
rename to crates/socket-patch-cli/tests/update/update_notifier_e2e.rs
index 6589c99f9..4e679d76a 100644
--- a/crates/socket-patch-cli/tests/update_notifier_e2e.rs
+++ b/crates/socket-patch-cli/tests/update/update_notifier_e2e.rs
@@ -11,10 +11,8 @@
 //! without a manifest, and `--version`/`--help` never dispatch (clap
 //! handles them before the hook), so none of those can carry the notifier.
 
-#[path = "common/mod.rs"]
-mod common;
-#[path = "common/update_fixture.rs"]
-mod update_fixture;
+use crate::common;
+use crate::update_fixture;
 
 use std::path::Path;
 use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
diff --git a/crates/socket-patch-cli/tests/docker_vendor_common_selftest.rs b/crates/socket-patch-cli/tests/vendor/docker_vendor_common_selftest.rs
similarity index 98%
rename from crates/socket-patch-cli/tests/docker_vendor_common_selftest.rs
rename to crates/socket-patch-cli/tests/vendor/docker_vendor_common_selftest.rs
index 729f77838..4677da7ea 100644
--- a/crates/socket-patch-cli/tests/docker_vendor_common_selftest.rs
+++ b/crates/socket-patch-cli/tests/vendor/docker_vendor_common_selftest.rs
@@ -15,8 +15,7 @@ use std::process::{Command, Output, Stdio};
 
 use sha2::{Digest, Sha256};
 
-#[path = "docker_vendor_common/mod.rs"]
-mod docker_vendor_common;
+use crate::docker_vendor_common;
 
 use docker_vendor_common::{bash_prelude, stage_patch_fn};
 
diff --git a/crates/socket-patch-cli/tests/e2e_golang_redirect.rs b/crates/socket-patch-cli/tests/vendor/e2e_golang_redirect.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/e2e_golang_redirect.rs
rename to crates/socket-patch-cli/tests/vendor/e2e_golang_redirect.rs
index 666220ce1..3bcfee7d5 100644
--- a/crates/socket-patch-cli/tests/e2e_golang_redirect.rs
+++ b/crates/socket-patch-cli/tests/vendor/e2e_golang_redirect.rs
@@ -12,8 +12,7 @@
 use std::os::unix::fs::PermissionsExt;
 use std::path::Path;
 
-#[path = "common/mod.rs"]
-mod common;
+use crate::common;
 
 use common::{binary, git_sha256, git_sha256_file, write_blob, write_minimal_manifest, PatchEntry};
 
diff --git a/crates/socket-patch-cli/tests/in_process_vendor_bun.rs b/crates/socket-patch-cli/tests/vendor/in_process_vendor_bun.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/in_process_vendor_bun.rs
rename to crates/socket-patch-cli/tests/vendor/in_process_vendor_bun.rs
index 33cf99ded..b5f5a8fa8 100644
--- a/crates/socket-patch-cli/tests/in_process_vendor_bun.rs
+++ b/crates/socket-patch-cli/tests/vendor/in_process_vendor_bun.rs
@@ -39,10 +39,8 @@ use std::time::{Duration, Instant};
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-#[path = "vex_e2e_common/bun.rs"]
-mod bun_vex;
-#[path = "common/mod.rs"]
-mod common;
+use crate::bun_vex;
+use crate::common;
 
 const ORG: &str = "test-org";
 const UUID: &str = "11111111-1111-4111-8111-111111111111";
diff --git a/crates/socket-patch-cli/tests/vendor/main.rs b/crates/socket-patch-cli/tests/vendor/main.rs
new file mode 100644
index 000000000..41bd1f72b
--- /dev/null
+++ b/crates/socket-patch-cli/tests/vendor/main.rs
@@ -0,0 +1,18 @@
+//! `vendor`: lockfile-only gems, pristine fetch order, no-network re-runs, bun and the hosted redirects.
+//!
+//! One test binary per command: each module was its own binary.
+
+#[path = "../vex_e2e_common/bun.rs"]
+mod bun_vex;
+#[path = "../common/mod.rs"]
+mod common;
+#[path = "../docker_vendor_common/mod.rs"]
+mod docker_vendor_common;
+
+mod docker_vendor_common_selftest;
+mod e2e_golang_redirect;
+mod in_process_vendor_bun;
+mod redirect_npm_allow_remote;
+mod vendor_gem_lockfile_only_e2e;
+mod vendor_pristine_fetch_order_e2e;
+mod vendor_rerun_no_network_e2e;
diff --git a/crates/socket-patch-cli/tests/redirect_npm_allow_remote.rs b/crates/socket-patch-cli/tests/vendor/redirect_npm_allow_remote.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/redirect_npm_allow_remote.rs
rename to crates/socket-patch-cli/tests/vendor/redirect_npm_allow_remote.rs
index 1c38ab3b2..6314f1687 100644
--- a/crates/socket-patch-cli/tests/redirect_npm_allow_remote.rs
+++ b/crates/socket-patch-cli/tests/vendor/redirect_npm_allow_remote.rs
@@ -33,8 +33,7 @@ use serde_json::{json, Value};
 use wiremock::matchers::{method, path, path_regex};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-#[path = "common/mod.rs"]
-mod common;
+use crate::common;
 
 const ORG: &str = "test-org";
 const NAME: &str = "allow-remote-dep";
diff --git a/crates/socket-patch-cli/tests/vendor_gem_lockfile_only_e2e.rs b/crates/socket-patch-cli/tests/vendor/vendor_gem_lockfile_only_e2e.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/vendor_gem_lockfile_only_e2e.rs
rename to crates/socket-patch-cli/tests/vendor/vendor_gem_lockfile_only_e2e.rs
diff --git a/crates/socket-patch-cli/tests/vendor_pristine_fetch_order_e2e.rs b/crates/socket-patch-cli/tests/vendor/vendor_pristine_fetch_order_e2e.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/vendor_pristine_fetch_order_e2e.rs
rename to crates/socket-patch-cli/tests/vendor/vendor_pristine_fetch_order_e2e.rs
diff --git a/crates/socket-patch-cli/tests/vendor_rerun_no_network_e2e.rs b/crates/socket-patch-cli/tests/vendor/vendor_rerun_no_network_e2e.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/vendor_rerun_no_network_e2e.rs
rename to crates/socket-patch-cli/tests/vendor/vendor_rerun_no_network_e2e.rs
diff --git a/docs/design/repacking-to-depscan.md b/docs/design/repacking-to-depscan.md
index fc516a540..a8f5acc7f 100644
--- a/docs/design/repacking-to-depscan.md
+++ b/docs/design/repacking-to-depscan.md
@@ -757,7 +757,7 @@ land, because WS5 rewrites vendor.rs by ±318 lines.
 | vendor.rs pristine ladder: `fetch_pristine_package`, `missing_local_rung`, `MissingRung::Fetch` | `commands/vendor.rs` | ~147 | — |
 | `VendorSource::Build` outside maven/nuget, args plumbing | `vendor/mod.rs`, `args.rs` | ~30 | — |
 | `berry_zip_url` plumbing (F33; re-measure on #280, which adds another `berry_zip_url: None` site at upstream/bun_lockb.rs:154) | redirect/hosted | ~3 | 41 |
-| Pristine fetch-order e2e | `tests/vendor_pristine_fetch_order_e2e.rs` | — | 228 |
+| Pristine fetch-order e2e | `tests/vendor/vendor_pristine_fetch_order_e2e.rs` | — | 228 |
 | **Total (CLI)** | | **~2,050** | **~1,260** |
 
 Rewritten, not deleted or counted:
diff --git a/docs/testing/bun-compatibility.md b/docs/testing/bun-compatibility.md
index 53ad0febd..cd06621d8 100644
--- a/docs/testing/bun-compatibility.md
+++ b/docs/testing/bun-compatibility.md
@@ -23,12 +23,12 @@ does not list as lagging — the cases authored Rust-first here lag until
 `bun.ts` is ported, see [depscan TS parity](#depscan-ts-parity); refusal
 fixtures pin their warning code through `expected-warnings.json`) and by
 hermetic CLI suites that
-need no Bun binary (`tests/in_process_vendor_bun.rs`,
+need no Bun binary (`tests/vendor/in_process_vendor_bun.rs`,
 `tests/in_process_vendor_bun_takeover.rs`, the bun cases of
 `tests/in_process_redirect.rs`, `tests/covgap_commands_scan_hosted.rs`,
 `tests/covgap_commands_scan_mod.rs`, `tests/covgap_commands_rollback.rs`,
-`tests/scan_vendor_e2e.rs`, `tests/get_modes_e2e.rs`,
-`tests/repair_vendor_flavors_e2e.rs`). The
+`tests/scan_vendor_e2e.rs`, `tests/get/get_modes_e2e.rs`,
+`tests/repair/repair_vendor_flavors_e2e.rs`). The
 [machine contract](../../crates/socket-patch-cli/CLI_CONTRACT.md) is the
 authority on envelopes and codes; this page is the measured matrix behind it.
 See the [ecosystem matrix](../ecosystems.md#mode--ecosystem-matrix) for the

From 4535e9658221bab2333f61c4068e0958608376c9 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 28 Sep 2026 23:13:17 +0000
Subject: [PATCH 5/6] Point docs at the merged test suites

Rows that named a moved test binary now name its suite and module.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N9YdJqaGiT9Jf5LN1hDFhB
---
 docs/design/nuget-vendoring-research/code-map.md | 2 +-
 docs/testing/bun-compatibility.md                | 6 +++---
 docs/testing/vlt-compatibility.md                | 2 +-
 tests/docker/fixtures/npm/README.md              | 2 +-
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/docs/design/nuget-vendoring-research/code-map.md b/docs/design/nuget-vendoring-research/code-map.md
index c96fd65ce..3ef66df0b 100644
--- a/docs/design/nuget-vendoring-research/code-map.md
+++ b/docs/design/nuget-vendoring-research/code-map.md
@@ -192,7 +192,7 @@ Run everything from `/home/user/socket-patch`.
 | `docker_e2e_nuget.rs` (apply chain, `:570`, `:607`) | Docker image `socket-patch-test-nuget:latest` | `#![cfg(feature="docker-e2e")]`; soft-skips if the image is missing (`:482`); `cargo test -p socket-patch-cli --features docker-e2e --test docker_e2e_nuget` |
 | `docker_e2e_vendor_nuget.rs` (`:472`: 3-stage vendor → cold offline `--locked-mode` restore → RED/TAMPER(NU1403) → idempotence and revert) | Docker (SDK 8.0) | `--features docker-e2e --test docker_e2e_vendor_nuget` |
 | `setup_matrix_nuget.rs` | host guard runs; `dotnet()` is `#[ignore]` (baseline gap) | `--features setup-e2e --test setup_matrix_nuget` |
-| Other hermetic CLI tests (`in_process_get_hosted_ecosystems.rs:532`, `in_process_scan.rs:1374`, `in_process_rollback_all_ecosystems.rs:552`, `e2e_safety_advisories.rs:412-671`, `ecosystem_dispatch_e2e.rs:310,986`, `vendor_ecosystem_fixtures/mod.rs:748`, `e2e_vex_vendor.rs`, `e2e_vendored_production.rs`) | nothing (production suites are canaries) | normal `cargo test -p socket-patch-cli --test <name>` |
+| Other hermetic CLI tests (`in_process_get_hosted_ecosystems.rs:532`, `in_process_scan.rs:1374`, `in_process_rollback_all_ecosystems.rs:552`, `apply/e2e_safety_advisories.rs`, `ecosystem_dispatch_e2e.rs:310,986`, `vendor_ecosystem_fixtures/mod.rs:748`, `e2e_vex_vendor.rs`, `e2e_vendored_production.rs`) | nothing (production suites are canaries) | normal `cargo test -p socket-patch-cli --test <name>` |
 
 **Docker images:** build `tests/docker/Dockerfile.base` tagged `socket-patch-test-base:latest`, then `tests/docker/Dockerfile.nuget` (FROM `mcr.microsoft.com/dotnet/sdk:8.0`, copies the binary from base) tagged `socket-patch-test-nuget:latest`.
 
diff --git a/docs/testing/bun-compatibility.md b/docs/testing/bun-compatibility.md
index cd06621d8..90b30702e 100644
--- a/docs/testing/bun-compatibility.md
+++ b/docs/testing/bun-compatibility.md
@@ -466,14 +466,14 @@ table above.
 | Text lock 0 / 1 / 2 rewritten and installed, both modes | 1.1.39–1.4.2 | `e2e_redirect_bun_build` + `e2e_vendor_bun_build` on 1.4.2 (3 OS), 1.1.45 and 1.2.23 (Linux); the fixture asserts the lock version matches the era table, the v1-on-1.4 leg proves a committed v1 lock keeps installing | goldens `lock-v0`, `basic` (v1), `lock-v2`; `bun_lock.rs`, `lock_inventory/bun.rs` |
 | Native binary formats 1 / 2 / 3: inventory, hosted, vendored, repair, takeovers, rollback | `direct`, `legacy-lockb`, conversion shapes; dedicated `backtest-bun-lockb.py` | `e2e_bun_lockb` across writer / reader revisions | `bun_lockb.rs` and committed real binary fixtures; native CLI tests |
 | Version-0 workspace hosted refusal + remedy | `text-workspace` (1.1.39–1.1.45) | — | golden `lock-v0-workspace-refusal` (+ `expected-warnings.json`), `redirect/mod.rs` unit tests |
-| Pre-v2 workspace vendored refusal (policy) + remedy; version 2 supported incl. nested | v1: 1.2.0–1.3.14 `workspace*`; v0: `text-workspace`; v2: 1.4.x | `e2e_vendor_bun_build` scoped leg (deps + bin meta survive) | `bun_lock.rs` (`legacy_workspace_tarballs_refuse_before_writes`, in-sync / rebuild exemptions), `in_process_vendor_bun`, `repair_vendor_flavors_e2e` over {0, 1, 2} × workspace shapes |
+| Pre-v2 workspace vendored refusal (policy) + remedy; version 2 supported incl. nested | v1: 1.2.0–1.3.14 `workspace*`; v0: `text-workspace`; v2: 1.4.x | `e2e_vendor_bun_build` scoped leg (deps + bin meta survive) | `bun_lock.rs` (`legacy_workspace_tarballs_refuse_before_writes`, in-sync / rebuild exemptions), `vendor::in_process_vendor_bun`, `repair::repair_vendor_flavors_e2e` over {0, 1, 2} × workspace shapes |
 | Digest boundary 1.3.10 (registry tuples 1.2.0) | 1.3.9 vs 1.3.10 cells, `registryDigestEnforced` | tampered twins in both suites, pinned from both sides | — |
-| Digest-less re-saves below 1.3.10 recognised, healed and unwound (both modes, takeovers, scoped unwinds, `repair`) | `already-vendored-workspace` on 1.2.0–1.3.9 (`digestDroppedOnResave`; `resaveKeepsDigest` from 1.3.10) | `bun_redirect_survives_a_digest_dropping_lock_resave`, `bun_vendor_survives_a_digest_dropping_lock_resave` (real `file:`-dep re-save; the era's spelling asserted from both sides) | goldens `digestless-hosted-already-wired`, `digestless-hosted-stale-url-repin`; `bun_lock_text.rs` (`same_wiring_modulo_integrity`), `redirect/mod.rs`, `replay.rs`, `takeover.rs`, `bun_lock.rs` unit tests; `in_process_redirect`, `in_process_vendor_bun`, `in_process_vendor_bun_takeover` |
+| Digest-less re-saves below 1.3.10 recognised, healed and unwound (both modes, takeovers, scoped unwinds, `repair`) | `already-vendored-workspace` on 1.2.0–1.3.9 (`digestDroppedOnResave`; `resaveKeepsDigest` from 1.3.10) | `bun_redirect_survives_a_digest_dropping_lock_resave`, `bun_vendor_survives_a_digest_dropping_lock_resave` (real `file:`-dep re-save; the era's spelling asserted from both sides) | goldens `digestless-hosted-already-wired`, `digestless-hosted-stale-url-repin`; `bun_lock_text.rs` (`same_wiring_modulo_integrity`), `redirect/mod.rs`, `replay.rs`, `takeover.rs`, `bun_lock.rs` unit tests; `in_process_redirect`, `vendor::in_process_vendor_bun`, `in_process_vendor_bun_takeover` |
 | Mode conversion both directions; scoped `rollback` / `remove` | `hosted-then-vendored`, `vendored-then-hosted` | `mode_migration_bun` (1.4.2 × 3 OS, 1.3.14) | `in_process_vendor_bun_takeover`, `takeover.rs`, `covgap_commands_rollback` |
 | CRLF lockfiles preserved (hosted line, vendored, rollback) | `crlf-lock` | — | golden `lock-v2-crlf`, `bun_lock.rs` |
 | Bun 0.8.1 / 1.0.0 peer / transitive upstream limitation | recorded per cell; no selected target is installed, exit 0 and lock unchanged | — | — |
 | Manifest-less VEX: attested `(redirected)` / `(vendored)` from the lock with no `.socket/manifest.json` (ledgers kept, then deleted too), `--offline` → `record_unavailable`, reverted lock → not attested (also `--no-verify`), embedded `apply --vex` / `vendor --vex` | every supported cell after its installs (`vex*` checks; public patch API) | `vex_e2e_common/bun.rs` step at the end of every `e2e_redirect_bun_build` / `e2e_vendor_bun_build` / `mode_migration_bun` / `e2e_bun_lockb` flow (fresh checkout + real frozen install, wiremock API with a zero-request oracle offline); tampered install / artifact → `hash_mismatch` / `vendor_hash_mismatch`; stale takeover manifest → the wired uuid wins; production `bun_*_install_proof` legs | `e2e_vex_lockfile::bun` (text v0/1/2 + `bun.lockb` × both modes: spoofed hosts, record mismatch, pristine / tampered / alias installs, stale lockb); `in_process_vendor_bun*` lockfile-only twins |
-| Pre-download preflight envelopes, `--silent`, `--dry-run` `would_refuse`, manifest-free footprint | `get-uuid` / `get-search` / `workspace-get-uuid` / `workspace-get-search` refusals (exit codes, `downloaded == 0`) | — | `in_process_vendor_bun` (exact uuid-path envelope), `scan_vendor_e2e`, `get_modes_e2e`, `vendor_flow.rs` |
+| Pre-download preflight envelopes, `--silent`, `--dry-run` `would_refuse`, manifest-free footprint | `get-uuid` / `get-search` / `workspace-get-uuid` / `workspace-get-search` refusals (exit codes, `downloaded == 0`) | — | `vendor::in_process_vendor_bun` (exact uuid-path envelope), `scan_vendor_e2e`, `get::get_modes_e2e`, `vendor_flow.rs` |
 
 Not measured: a `--cwd <workspace member>` run (the member holds no
 `bun.lock`, so the preflight passes and the engine refuses
diff --git a/docs/testing/vlt-compatibility.md b/docs/testing/vlt-compatibility.md
index 9778689b0..edb3b466f 100644
--- a/docs/testing/vlt-compatibility.md
+++ b/docs/testing/vlt-compatibility.md
@@ -40,7 +40,7 @@ socket-patch alike.
 | Layer | Where | What it proves |
 |---|---|---|
 | Unit and golden | `socket-patch-core` lib tests; `tests/redirect_golden.rs` (`npm/vlt/*`, shared with depscan's TS rewriter), `tests/redirect_golden_reverse_replay.rs`, `tests/vlt_locks.rs` (captured locks of every era, and vendored wiring byte for byte against what real `vlt ci`, `vlt install --frozen-lockfile` and `vlt install <new>` keep on 1.2.0, 1.0.10, 1.0.4, 1.0.0-rc.32 and 1.0.0-rc.14) | DepID codec, collation (`tests/fixtures/vlt/collation-golden.json`), the node-line grammar, the hosted slot rewrite and its slot revert, vendored lock surgery and its inverse, lock inventory, VEX discovery |
-| Hermetic suites | `in_process_redirect`, `in_process_vendor`, `in_process_rollback_hosted`, `in_process_vendor_bun_takeover`, `repair_vendor_flavors_e2e`, `e2e_vex_lockfile`, … (the 3-OS `test` job) | every code of the vlt support, the artifact preflight against a wiremock server, the heal, takeovers, repair, the CLI surface |
+| Hermetic suites | `in_process_redirect`, `in_process_vendor`, `in_process_rollback_hosted`, `in_process_vendor_bun_takeover`, `repair::repair_vendor_flavors_e2e`, `e2e_vex_lockfile`, … (the 3-OS `test` job) | every code of the vlt support, the artifact preflight against a wiremock server, the heal, takeovers, repair, the CLI surface |
 | Real-vlt capstones | the five binaries below plus the vlt legs of `e2e_hosted_production` / `e2e_vendored_production` | real installs: `vlt ci` and frozen installs of patched locks, byte-stable locks, integrity enforcement, the heal on a warm tree, re-saves, upgrades, the hardlinked global store |
 | Native backtest | `scripts/backtest-vlt.py` | the production service end to end, per release, mode and project shape, against an oracle of the documented boundaries |
 
diff --git a/tests/docker/fixtures/npm/README.md b/tests/docker/fixtures/npm/README.md
index cfb4da937..eb693f087 100644
--- a/tests/docker/fixtures/npm/README.md
+++ b/tests/docker/fixtures/npm/README.md
@@ -8,7 +8,7 @@ with the bytes in `blobs/<after_hash>`. The test uses `--force` to skip the
 beforeHash check (we don't bother synthesizing a believable beforeHash —
 the goal is to validate the install + scan + apply dispatch end to end,
 not to test the hash-verification logic which is already covered by
-`apply_invariants.rs`).
+`apply/apply_invariants.rs`).
 
 To regenerate after editing the patched-content marker:
 

From 912d00514d21693338edef3542a8ffc66bda7d8e Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 28 Sep 2026 23:19:31 +0000
Subject: [PATCH 6/6] Keep the crawler oracles

A crawler's output follows the directory order the filesystem hands
back, which differs between filesystems: every crawler golden blessed
on ext4 failed when replayed on tmpfs, and macOS and Windows skipped
them. The per-call oracles walk the same tree as the crawler, so they
check the parallel walk on every platform; restore them and drop the
crawler goldens. The rewriter goldens are pure text and stay.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N9YdJqaGiT9Jf5LN1hDFhB
---
 .../src/crawlers/cargo_crawler.rs             |   44 +-
 .../src/crawlers/cargo_crawler/oracle.rs      |   79 +
 .../src/crawlers/composer_crawler.rs          |   45 +-
 .../src/crawlers/composer_crawler/oracle.rs   |  117 ++
 .../src/crawlers/go_crawler.rs                |   63 +-
 .../src/crawlers/go_crawler/oracle.rs         |  163 ++
 .../src/crawlers/maven_crawler.rs             |  105 +-
 .../src/crawlers/maven_crawler/oracle.rs      |  172 ++
 crates/socket-patch-core/src/crawlers/mod.rs  |    4 +-
 .../src/crawlers/npm_crawler.rs               |    2 +-
 .../src/crawlers/npm_crawler/oracle.rs        | 1846 +++++++++++++++++
 .../src/crawlers/npm_crawler/sweep_tests.rs   |  954 ---------
 .../src/crawlers/nuget_crawler.rs             |   66 +-
 .../src/crawlers/nuget_crawler/oracle.rs      |  207 ++
 .../{test_tree.rs => oracle_support.rs}       |  147 +-
 .../src/crawlers/python_crawler.rs            |   65 +-
 .../src/crawlers/python_crawler/oracle.rs     |   96 +
 .../src/crawlers/ruby_crawler.rs              |    3 +-
 crates/socket-patch-core/src/vex/verify.rs    |    3 +-
 .../equivalence/crawl_cargo_sources.golden    |   66 -
 .../equivalence/crawl_cargo_vendor.golden     |    3 -
 .../equivalence/crawl_composer_vendor.golden  |   66 -
 .../equivalence/crawl_go_absent_root.golden   |    3 -
 .../equivalence/crawl_go_module_cache.golden  |   50 -
 .../equivalence/crawl_maven_consistent.golden |   66 -
 .../equivalence/crawl_maven_misrooted.golden  |  357 ----
 .../equivalence/crawl_maven_no_pool.golden    |   18 -
 .../crawl_maven_parse_chunks.golden           |   98 -
 .../equivalence/crawl_maven_repos.golden      |   66 -
 .../crawl_npm_foreign_identity.golden         |    3 -
 .../equivalence/crawl_npm_kitchen_sink.golden |    3 -
 .../equivalence/crawl_npm_no_pool.golden      |   18 -
 .../tests/equivalence/crawl_npm_trees.golden  |   66 -
 .../crawl_nuget_legacy_fallback.golden        |    3 -
 .../equivalence/crawl_nuget_packages.golden   |   66 -
 .../crawl_python_site_packages.golden         |   66 -
 36 files changed, 2870 insertions(+), 2329 deletions(-)
 create mode 100644 crates/socket-patch-core/src/crawlers/cargo_crawler/oracle.rs
 create mode 100644 crates/socket-patch-core/src/crawlers/composer_crawler/oracle.rs
 create mode 100644 crates/socket-patch-core/src/crawlers/go_crawler/oracle.rs
 create mode 100644 crates/socket-patch-core/src/crawlers/maven_crawler/oracle.rs
 create mode 100644 crates/socket-patch-core/src/crawlers/npm_crawler/oracle.rs
 delete mode 100644 crates/socket-patch-core/src/crawlers/npm_crawler/sweep_tests.rs
 create mode 100644 crates/socket-patch-core/src/crawlers/nuget_crawler/oracle.rs
 rename crates/socket-patch-core/src/crawlers/{test_tree.rs => oracle_support.rs} (51%)
 create mode 100644 crates/socket-patch-core/src/crawlers/python_crawler/oracle.rs
 delete mode 100644 crates/socket-patch-core/tests/equivalence/crawl_cargo_sources.golden
 delete mode 100644 crates/socket-patch-core/tests/equivalence/crawl_cargo_vendor.golden
 delete mode 100644 crates/socket-patch-core/tests/equivalence/crawl_composer_vendor.golden
 delete mode 100644 crates/socket-patch-core/tests/equivalence/crawl_go_absent_root.golden
 delete mode 100644 crates/socket-patch-core/tests/equivalence/crawl_go_module_cache.golden
 delete mode 100644 crates/socket-patch-core/tests/equivalence/crawl_maven_consistent.golden
 delete mode 100644 crates/socket-patch-core/tests/equivalence/crawl_maven_misrooted.golden
 delete mode 100644 crates/socket-patch-core/tests/equivalence/crawl_maven_no_pool.golden
 delete mode 100644 crates/socket-patch-core/tests/equivalence/crawl_maven_parse_chunks.golden
 delete mode 100644 crates/socket-patch-core/tests/equivalence/crawl_maven_repos.golden
 delete mode 100644 crates/socket-patch-core/tests/equivalence/crawl_npm_foreign_identity.golden
 delete mode 100644 crates/socket-patch-core/tests/equivalence/crawl_npm_kitchen_sink.golden
 delete mode 100644 crates/socket-patch-core/tests/equivalence/crawl_npm_no_pool.golden
 delete mode 100644 crates/socket-patch-core/tests/equivalence/crawl_npm_trees.golden
 delete mode 100644 crates/socket-patch-core/tests/equivalence/crawl_nuget_legacy_fallback.golden
 delete mode 100644 crates/socket-patch-core/tests/equivalence/crawl_nuget_packages.golden
 delete mode 100644 crates/socket-patch-core/tests/equivalence/crawl_python_site_packages.golden

diff --git a/crates/socket-patch-core/src/crawlers/cargo_crawler.rs b/crates/socket-patch-core/src/crawlers/cargo_crawler.rs
index a34aa05c8..808876b76 100644
--- a/crates/socket-patch-core/src/crawlers/cargo_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/cargo_crawler.rs
@@ -6,6 +6,9 @@ use super::types::{CrawledPackage, CrawlerOptions};
 use crate::patch::path_safety;
 use crate::utils::fs::{is_dir, run_blocking};
 
+#[cfg(test)]
+mod oracle;
+
 // ---------------------------------------------------------------------------
 // Cargo.toml minimal parser
 // ---------------------------------------------------------------------------
@@ -1123,15 +1126,12 @@ version = "fake"
         assert_eq!(packages[0].purl, "pkg:cargo/serde@1.0.200");
     }
 
-    // ── Seeded source trees, pinned by golden ────────────────────────
+    // ── Equivalence with the per-call async scan (oracle) ─────────────
 
-    mod sweep {
+    mod equivalence {
+        use super::super::oracle::LegacyCargoCrawler;
         use super::*;
-        use crate::crawlers::test_tree::{
-            crawl_goldens_apply, mkdir, rel_rows, symlink, tree_listing, write, PermGuard,
-        };
-        use crate::golden::Golden;
-        use crate::test_rng::Rng;
+        use crate::crawlers::oracle_support::{mkdir, rows, symlink, write, PermGuard, Rng};
 
         const NAMES: &[&str] = &["serde", "serde-json", "sha-1", "tokio", "dup", "a_b"];
         const VERSIONS: &[&str] = &["1.0.0", "1.0.0-rc.1", "0.2.3", "5", "1.0.0+build"];
@@ -1184,19 +1184,14 @@ version = "fake"
         }
 
         #[tokio::test]
-        async fn randomized_sources_match_golden() {
+        async fn randomized_sources_match_the_async_oracle() {
             let mut total = 0;
-            let mut g = Golden::new(
-                "crawl_cargo_sources",
-                "One seeded crate source tree, crawled.",
-            );
             for seed in 0..64u64 {
                 let tmp = tempfile::tempdir().unwrap();
                 let mut perms = PermGuard::default();
                 let mut rng = Rng::new(seed);
                 let root = tmp.path().join("src");
                 tree(&mut rng, &root, &tmp.path().join("outside"), &mut perms);
-                let input = (tree_listing(tmp.path()), perms.planned(tmp.path()));
                 perms.apply();
                 let options = CrawlerOptions {
                     cwd: tmp.path().to_path_buf(),
@@ -1204,18 +1199,16 @@ version = "fake"
                     global_prefix: Some(root.clone()),
                 };
                 let new = CargoCrawler::new().crawl_all(&options).await;
-                g.case(seed, &input, &rel_rows(tmp.path(), &new));
-                total += new.len();
+                let old = LegacyCargoCrawler::crawl_all(&options).await;
+                assert_eq!(rows(&new), rows(&old), "seed {seed}");
+                total += old.len();
             }
             assert!(total > 200, "vacuous fixtures: {total}");
-            if crawl_goldens_apply(true) {
-                g.finish();
-            }
         }
 
         /// Local mode: a Cargo project with a `vendor/` tree.
         #[tokio::test]
-        async fn vendor_tree_matches_golden() {
+        async fn vendor_tree_matches_the_async_oracle() {
             let tmp = tempfile::tempdir().unwrap();
             let mut perms = PermGuard::default();
             let mut rng = Rng::new(7);
@@ -1226,7 +1219,6 @@ version = "fake"
                 &tmp.path().join("outside"),
                 &mut perms,
             );
-            let input = (tree_listing(tmp.path()), perms.planned(tmp.path()));
             perms.apply();
             let options = CrawlerOptions {
                 cwd: tmp.path().to_path_buf(),
@@ -1234,15 +1226,9 @@ version = "fake"
                 global_prefix: None,
             };
             let new = CargoCrawler::new().crawl_all(&options).await;
-            assert!(!new.is_empty());
-            let mut g = Golden::new(
-                "crawl_cargo_vendor",
-                "A seeded Cargo project vendor/ tree, crawled locally.",
-            );
-            g.case(7, &input, &rel_rows(tmp.path(), &new));
-            if crawl_goldens_apply(true) {
-                g.finish();
-            }
+            let old = LegacyCargoCrawler::crawl_all(&options).await;
+            assert!(!old.is_empty());
+            assert_eq!(rows(&new), rows(&old));
         }
     }
 }
diff --git a/crates/socket-patch-core/src/crawlers/cargo_crawler/oracle.rs b/crates/socket-patch-core/src/crawlers/cargo_crawler/oracle.rs
new file mode 100644
index 000000000..6513c4d86
--- /dev/null
+++ b/crates/socket-patch-core/src/crawlers/cargo_crawler/oracle.rs
@@ -0,0 +1,79 @@
+//! The pre-blocking-pool (one tokio hop per readdir/stat/read) crate source
+//! scan, kept verbatim as the equivalence oracle for the parallel scan in
+//! the parent module. Test-only; never compiled into the binary.
+
+use std::collections::HashSet;
+use std::path::Path;
+
+use super::{parse_cargo_toml_name_version, CargoCrawler};
+use crate::crawlers::types::{CrawledPackage, CrawlerOptions};
+
+pub(super) struct LegacyCargoCrawler;
+
+impl LegacyCargoCrawler {
+    pub(super) async fn crawl_all(options: &CrawlerOptions) -> Vec<CrawledPackage> {
+        let mut packages = Vec::new();
+        let mut seen = HashSet::new();
+
+        let src_paths = CargoCrawler::new()
+            .get_crate_source_paths(options)
+            .await
+            .unwrap_or_default();
+
+        for src_path in &src_paths {
+            let found = Self::scan_crate_source(src_path, &mut seen).await;
+            packages.extend(found);
+        }
+
+        packages
+    }
+
+    async fn scan_crate_source(src_path: &Path, seen: &mut HashSet<String>) -> Vec<CrawledPackage> {
+        let mut results = Vec::new();
+
+        for entry in crate::utils::fs::list_dir_entries(src_path).await {
+            if !crate::utils::fs::entry_is_dir(&entry).await {
+                continue;
+            }
+
+            let dir_name = entry.file_name();
+            let dir_name_str = dir_name.to_string_lossy();
+
+            if dir_name_str.starts_with('.') {
+                continue;
+            }
+
+            let crate_path = src_path.join(&*dir_name_str);
+            if let Some(pkg) = Self::read_crate_cargo_toml(&crate_path, &dir_name_str, seen).await {
+                results.push(pkg);
+            }
+        }
+
+        results
+    }
+
+    async fn read_crate_cargo_toml(
+        crate_path: &Path,
+        dir_name: &str,
+        seen: &mut HashSet<String>,
+    ) -> Option<CrawledPackage> {
+        let cargo_toml_path = crate_path.join("Cargo.toml");
+        let content = tokio::fs::read_to_string(&cargo_toml_path).await.ok()?;
+
+        let (name, version) = parse_cargo_toml_name_version(&content)
+            .or_else(|| CargoCrawler::parse_dir_name_version(dir_name))?;
+
+        let purl = crate::utils::purl::build_cargo_purl(&name, &version);
+        if !seen.insert(purl.clone()) {
+            return None;
+        }
+
+        Some(CrawledPackage {
+            name,
+            version,
+            namespace: None,
+            purl,
+            path: crate_path.to_path_buf(),
+        })
+    }
+}
diff --git a/crates/socket-patch-core/src/crawlers/composer_crawler.rs b/crates/socket-patch-core/src/crawlers/composer_crawler.rs
index 2e244d491..38d060184 100644
--- a/crates/socket-patch-core/src/crawlers/composer_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/composer_crawler.rs
@@ -7,6 +7,9 @@ use crate::patch::path_safety;
 use crate::utils::fs::{is_dir, is_dir_sync, is_file, normalize_lexically, run_blocking};
 use crate::utils::process::{CommandRunner, SystemCommandRunner};
 
+#[cfg(test)]
+mod oracle;
+
 /// PHP/Composer ecosystem crawler for discovering packages in Composer
 /// vendor directories.
 pub struct ComposerCrawler;
@@ -1726,16 +1729,12 @@ mod tests {
         );
     }
 
-    // ── Seeded vendor trees, pinned by golden ────────────────────────
+    // ── Equivalence with the per-package async stats (oracle) ─────────
 
-    mod sweep {
+    mod equivalence {
+        use super::super::oracle::LegacyComposerCrawler;
         use super::*;
-        use crate::crawlers::test_tree::{
-            crawl_goldens_apply, mkdir, rel_map_rows, rel_rows, symlink,
-            tree_listing, write,
-        };
-        use crate::golden::Golden;
-        use crate::test_rng::Rng;
+        use crate::crawlers::oracle_support::{map_rows, mkdir, rows, symlink, write, Rng};
 
         const NAMES: &[&str] = &[
             "monolog/monolog",
@@ -1793,26 +1792,23 @@ mod tests {
         }
 
         #[tokio::test]
-        async fn randomized_vendor_trees_match_golden() {
+        async fn randomized_vendor_trees_match_the_async_oracle() {
             let (mut crawled, mut found) = (0, 0);
-            let mut g = Golden::new(
-                "crawl_composer_vendor",
-                "One seeded vendor/composer tree: crawl_all, then find_by_purls.",
-            );
             for seed in 0..64u64 {
                 let mut rng = Rng::new(seed);
                 let tmp = tempfile::tempdir().unwrap();
                 let root = tmp.path().join("proj");
                 let packages = project(&mut rng, &root);
-                let input = tree_listing(tmp.path());
                 let options = CrawlerOptions {
                     cwd: root.clone(),
                     global: false,
                     global_prefix: None,
                 };
                 let new = ComposerCrawler::new().crawl_all(&options).await;
+                let old = LegacyComposerCrawler::crawl_all(&options).await;
+                assert_eq!(rows(&new), rows(&old), "seed {seed}: crawl_all");
 
-                let mut purls: Vec<String> = new.iter().map(|p| p.purl.clone()).collect();
+                let mut purls: Vec<String> = old.iter().map(|p| p.purl.clone()).collect();
                 for (name, version) in &packages {
                     purls.push(format!("pkg:composer/{name}@{version}"));
                     purls.push(format!(
@@ -1826,24 +1822,19 @@ mod tests {
                     .find_by_purls(&vendor, &purls)
                     .await
                     .unwrap();
-                g.case(
-                    seed,
-                    &input,
-                    &(
-                        rel_rows(tmp.path(), &new),
-                        rel_map_rows(tmp.path(), &new_found),
-                    ),
+                let old_found = LegacyComposerCrawler::find_by_purls(&vendor, &purls).await;
+                assert_eq!(
+                    map_rows(&new_found),
+                    map_rows(&old_found),
+                    "seed {seed}: find_by_purls"
                 );
-                crawled += new.len();
-                found += new_found.len();
+                crawled += old.len();
+                found += old_found.len();
             }
             assert!(
                 crawled > 50 && found > 50,
                 "vacuous fixtures: {crawled}/{found}"
             );
-            if crawl_goldens_apply(false) {
-                g.finish();
-            }
         }
 
         /// The `composer global config home` memo re-runs only when the
diff --git a/crates/socket-patch-core/src/crawlers/composer_crawler/oracle.rs b/crates/socket-patch-core/src/crawlers/composer_crawler/oracle.rs
new file mode 100644
index 000000000..84077d52c
--- /dev/null
+++ b/crates/socket-patch-core/src/crawlers/composer_crawler/oracle.rs
@@ -0,0 +1,117 @@
+//! The pre-batching (one tokio `is_dir` hop per package) Composer crawl and
+//! PURL lookup, kept verbatim as the equivalence oracle for the parent
+//! module. Test-only; never compiled into the binary.
+
+use std::collections::{HashMap, HashSet};
+use std::path::Path;
+
+use super::{
+    normalize_version, read_installed_json, resolve_package_dir, resolve_project_root,
+    ComposerCrawler, ComposerPackageEntry,
+};
+use crate::crawlers::types::{CrawledPackage, CrawlerOptions};
+use crate::utils::fs::is_dir;
+
+pub(super) struct LegacyComposerCrawler;
+
+impl LegacyComposerCrawler {
+    pub(super) async fn crawl_all(options: &CrawlerOptions) -> Vec<CrawledPackage> {
+        let mut packages = Vec::new();
+        let mut seen = HashSet::new();
+
+        let vendor_paths = ComposerCrawler::new()
+            .get_vendor_paths(options)
+            .await
+            .unwrap_or_default();
+
+        for vendor_path in &vendor_paths {
+            let project_root = resolve_project_root(vendor_path).await;
+            let entries = read_installed_json(vendor_path).await;
+            for entry in entries {
+                if let Some((namespace, name)) = entry.name.split_once('/') {
+                    let Some(pkg_path) = resolve_package_dir(vendor_path, &project_root, &entry)
+                    else {
+                        continue;
+                    };
+                    if !is_dir(&pkg_path).await {
+                        continue;
+                    }
+
+                    let version = normalize_version(&entry.version).to_string();
+
+                    let ns_canon = namespace.to_ascii_lowercase();
+                    let name_canon = name.to_ascii_lowercase();
+                    let purl =
+                        crate::utils::purl::build_composer_purl(&ns_canon, &name_canon, &version);
+
+                    if !seen.insert(purl.clone()) {
+                        continue;
+                    }
+
+                    packages.push(CrawledPackage {
+                        name: name_canon,
+                        version,
+                        namespace: Some(ns_canon),
+                        purl,
+                        path: pkg_path,
+                    });
+                }
+            }
+        }
+
+        packages
+    }
+
+    pub(super) async fn find_by_purls(
+        vendor_path: &Path,
+        purls: &[String],
+    ) -> HashMap<String, CrawledPackage> {
+        let mut result: HashMap<String, CrawledPackage> = HashMap::new();
+
+        let entries = read_installed_json(vendor_path).await;
+        let installed: HashMap<String, ComposerPackageEntry> = entries
+            .into_iter()
+            .map(|e| (e.name.to_ascii_lowercase(), e))
+            .collect();
+        let project_root = resolve_project_root(vendor_path).await;
+
+        for purl in purls {
+            if let Some(((namespace, name), version)) =
+                crate::utils::purl::parse_composer_purl(purl)
+            {
+                let (namespace, name, version) =
+                    (namespace.as_ref(), name.as_ref(), version.as_ref());
+                let full_name = format!("{namespace}/{name}").to_ascii_lowercase();
+
+                let Some(entry) = installed.get(&full_name) else {
+                    continue;
+                };
+
+                if normalize_version(&entry.version) != normalize_version(version) {
+                    continue;
+                }
+
+                let Some(pkg_dir) = resolve_package_dir(vendor_path, &project_root, entry) else {
+                    continue;
+                };
+
+                if !is_dir(&pkg_dir).await {
+                    continue;
+                }
+
+                result.insert(
+                    purl.clone(),
+                    CrawledPackage {
+                        name: name.to_ascii_lowercase(),
+                        version: version.to_string(),
+                        namespace: Some(namespace.to_ascii_lowercase()),
+                        purl: purl.clone(),
+                        path: pkg_dir,
+                    },
+                );
+            }
+        }
+
+        result
+    }
+}
diff --git a/crates/socket-patch-core/src/crawlers/go_crawler.rs b/crates/socket-patch-core/src/crawlers/go_crawler.rs
index d9f6a2363..fd1aaa66d 100644
--- a/crates/socket-patch-core/src/crawlers/go_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/go_crawler.rs
@@ -6,6 +6,9 @@ use super::types::{CrawledPackage, CrawlerOptions};
 use crate::patch::path_safety;
 use crate::utils::fs::{is_dir_sync, run_blocking};
 
+#[cfg(test)]
+mod oracle;
+
 // ---------------------------------------------------------------------------
 // Case-encoding helpers
 // ---------------------------------------------------------------------------
@@ -1365,16 +1368,14 @@ mod tests {
         assert_eq!(pkg.path, module_dir);
     }
 
-    // ── Seeded module caches, pinned by golden ───────────────────────
+    // ── Equivalence with the per-call async walk (oracle) ─────────────
 
-    mod sweep {
+    mod equivalence {
+        use super::super::oracle::LegacyGoCrawler;
         use super::*;
-        use crate::crawlers::test_tree::{
-            crawl_goldens_apply, mkdir, rel_map_rows, rel_rows, symlink, tree_listing, write,
-            PermGuard,
+        use crate::crawlers::oracle_support::{
+            map_rows, mkdir, rows, symlink, write, PermGuard, Rng,
         };
-        use crate::golden::Golden;
-        use crate::test_rng::Rng;
 
         const NAMES: &[&str] = &[
             "github.com",
@@ -1487,39 +1488,33 @@ mod tests {
 
         /// Returns (packages crawled, PURLs found) so the caller can check
         /// the fixtures are not vacuous.
-        async fn check(
-            g: &mut Golden,
-            input: &impl serde::Serialize,
-            gen: &Gen,
-            label: &str,
-        ) -> (usize, usize) {
+        async fn assert_equivalent(gen: &Gen, label: &str) -> (usize, usize) {
             let options = CrawlerOptions {
                 cwd: gen.root.clone(),
                 global: false,
                 global_prefix: Some(gen.root.clone()),
             };
             let new = GoCrawler::new().crawl_all(&options).await;
-            let purls = probe_purls(gen, &new);
+            let old = LegacyGoCrawler::crawl_all(&options).await;
+            assert_eq!(rows(&new), rows(&old), "{label}: crawl_all");
+
+            let purls = probe_purls(gen, &old);
             let new_found = GoCrawler::new()
                 .find_by_purls(&gen.root, &purls)
                 .await
                 .unwrap();
-            let base = gen.root.parent().unwrap();
-            g.case(
-                label.replace(' ', "_"),
-                input,
-                &(rel_rows(base, &new), rel_map_rows(base, &new_found)),
+            let old_found = LegacyGoCrawler::find_by_purls(&gen.root, &purls).await;
+            assert_eq!(
+                map_rows(&new_found),
+                map_rows(&old_found),
+                "{label}: find_by_purls"
             );
-            (new.len(), new_found.len())
+            (old.len(), old_found.len())
         }
 
         #[tokio::test]
-        async fn randomized_caches_match_golden() {
+        async fn randomized_caches_match_the_async_oracle() {
             let (mut crawled, mut found) = (0, 0);
-            let mut g = Golden::new(
-                "crawl_go_module_cache",
-                "One seeded GOMODCACHE tree: crawl_all, then find_by_purls.",
-            );
             // At least 48 seeds, and more until the fixtures clear the
             // non-vacuity bar below: a case-insensitive filesystem folds
             // `Azure`/`!azure`-style siblings together and Windows ignores
@@ -1537,13 +1532,8 @@ mod tests {
                 };
                 let root = gen.root.clone();
                 gen.dir(&root, 0);
-                let input = (
-                    tree_listing(tmp.path()),
-                    gen.perms.planned(tmp.path()),
-                    gen.versioned.clone(),
-                );
                 gen.perms.apply();
-                let (c, f) = check(&mut g, &input, &gen, &format!("seed {seed}")).await;
+                let (c, f) = assert_equivalent(&gen, &format!("seed {seed}")).await;
                 crawled += c;
                 found += f;
                 seed += 1;
@@ -1552,13 +1542,10 @@ mod tests {
                 crawled > 100 && found > 100,
                 "vacuous fixtures: {crawled}/{found}"
             );
-            if crawl_goldens_apply(true) {
-                g.finish();
-            }
         }
 
         #[tokio::test]
-        async fn missing_cache_root_matches_golden() {
+        async fn missing_cache_root_matches_the_async_oracle() {
             let tmp = tempfile::tempdir().unwrap();
             let gen = Gen {
                 rng: Rng::new(0),
@@ -1567,11 +1554,7 @@ mod tests {
                 perms: PermGuard::default(),
                 versioned: vec!["mod@v1.0.0".to_string()],
             };
-            let mut g = Golden::new("crawl_go_absent_root", "An absent GOMODCACHE root.");
-            check(&mut g, &(), &gen, "absent root").await;
-            if crawl_goldens_apply(false) {
-                g.finish();
-            }
+            assert_equivalent(&gen, "absent root").await;
         }
     }
 }
diff --git a/crates/socket-patch-core/src/crawlers/go_crawler/oracle.rs b/crates/socket-patch-core/src/crawlers/go_crawler/oracle.rs
new file mode 100644
index 000000000..a80793c47
--- /dev/null
+++ b/crates/socket-patch-core/src/crawlers/go_crawler/oracle.rs
@@ -0,0 +1,163 @@
+//! The pre-blocking-pool (one tokio hop per readdir/stat) Go module cache
+//! walk and PURL lookup, kept verbatim as the equivalence oracle for the
+//! synchronous walkers in the parent module. Test-only; never compiled into
+//! the binary.
+
+use std::collections::{HashMap, HashSet};
+use std::path::Path;
+
+use super::{
+    decode_module_path, encode_module_path, is_safe_module_coordinate, split_module_path, GoCrawler,
+};
+use crate::crawlers::types::{CrawledPackage, CrawlerOptions};
+use crate::utils::fs::is_dir;
+
+pub(super) struct LegacyGoCrawler;
+
+impl LegacyGoCrawler {
+    pub(super) async fn crawl_all(options: &CrawlerOptions) -> Vec<CrawledPackage> {
+        let mut packages = Vec::new();
+        let mut seen = HashSet::new();
+
+        let cache_paths = GoCrawler::new()
+            .get_module_cache_paths(options)
+            .await
+            .unwrap_or_default();
+
+        for cache_path in &cache_paths {
+            Self::scan_dir_recursive(cache_path, cache_path, &mut seen, &mut packages).await;
+        }
+
+        packages
+    }
+
+    pub(super) async fn find_by_purls(
+        cache_path: &Path,
+        purls: &[String],
+    ) -> HashMap<String, CrawledPackage> {
+        let mut result: HashMap<String, CrawledPackage> = HashMap::new();
+
+        for purl in purls {
+            if let Some((module_path, version)) = crate::utils::purl::parse_golang_purl(purl) {
+                let (module_path, version) = (module_path.as_ref(), version.as_ref());
+                if !is_safe_module_coordinate(module_path, version) {
+                    continue;
+                }
+                let encoded = encode_module_path(module_path);
+                let encoded_version = encode_module_path(version);
+
+                let module_dir = cache_path.join(format!("{encoded}@{encoded_version}"));
+
+                if is_dir(&module_dir).await {
+                    if is_partially_extracted(cache_path, &encoded, &encoded_version).await {
+                        continue;
+                    }
+                    let (namespace, name) = split_module_path(module_path);
+
+                    result.insert(
+                        purl.clone(),
+                        CrawledPackage {
+                            name: name.to_string(),
+                            version: version.to_string(),
+                            namespace: Some(namespace.to_string()),
+                            purl: purl.clone(),
+                            path: module_dir,
+                        },
+                    );
+                }
+            }
+        }
+
+        result
+    }
+
+    fn scan_dir_recursive<'a>(
+        base_path: &'a Path,
+        current_path: &'a Path,
+        seen: &'a mut HashSet<String>,
+        results: &'a mut Vec<CrawledPackage>,
+    ) -> std::pin::Pin<Box<dyn std::future::Future<Output = ()> + 'a>> {
+        Box::pin(async move {
+            for entry in crate::utils::fs::list_dir_entries(current_path).await {
+                if !crate::utils::fs::entry_is_dir(&entry).await {
+                    continue;
+                }
+
+                let dir_name = entry.file_name();
+                let dir_name_str = dir_name.to_string_lossy();
+
+                if dir_name_str.starts_with('.')
+                    || (dir_name_str == "cache" && current_path == base_path)
+                {
+                    continue;
+                }
+
+                let full_path = current_path.join(&dir_name);
+
+                if dir_name_str.contains('@') {
+                    if let Some(pkg) = Self::parse_versioned_dir(base_path, &full_path, seen).await
+                    {
+                        results.push(pkg);
+                    }
+                } else {
+                    Self::scan_dir_recursive(base_path, &full_path, seen, results).await;
+                }
+            }
+        })
+    }
+
+    async fn parse_versioned_dir(
+        base_path: &Path,
+        dir_path: &Path,
+        seen: &mut HashSet<String>,
+    ) -> Option<CrawledPackage> {
+        let rel_path = dir_path.strip_prefix(base_path).ok()?;
+        let rel_str = rel_path.to_string_lossy().replace('\\', "/");
+
+        let at_idx = rel_str.rfind('@')?;
+        let encoded_module_path = &rel_str[..at_idx];
+        let version = &rel_str[at_idx + 1..];
+
+        if encoded_module_path.is_empty() || version.is_empty() {
+            return None;
+        }
+
+        if is_partially_extracted(base_path, encoded_module_path, version).await {
+            return None;
+        }
+
+        let module_path = decode_module_path(encoded_module_path);
+        let version = decode_module_path(version);
+
+        let purl = crate::utils::purl::build_golang_purl(&module_path, &version);
+
+        if seen.contains(&purl) {
+            return None;
+        }
+        seen.insert(purl.clone());
+
+        let (namespace, name) = split_module_path(&module_path);
+
+        Some(CrawledPackage {
+            name: name.to_string(),
+            version: version.to_string(),
+            namespace: Some(namespace.to_string()),
+            purl,
+            path: dir_path.to_path_buf(),
+        })
+    }
+}
+
+async fn is_partially_extracted(
+    cache_path: &Path,
+    encoded_module: &str,
+    encoded_version: &str,
+) -> bool {
+    let marker = cache_path
+        .join("cache")
+        .join("download")
+        .join(encoded_module)
+        .join("@v")
+        .join(format!("{encoded_version}.partial"));
+    tokio::fs::metadata(&marker).await.is_ok()
+}
diff --git a/crates/socket-patch-core/src/crawlers/maven_crawler.rs b/crates/socket-patch-core/src/crawlers/maven_crawler.rs
index 137acf0be..da2a15846 100644
--- a/crates/socket-patch-core/src/crawlers/maven_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/maven_crawler.rs
@@ -7,6 +7,9 @@ use super::walk_pool::{par_map, run_walk};
 use crate::patch::path_safety;
 use crate::utils::fs::is_dir;
 
+#[cfg(test)]
+mod oracle;
+
 /// How many `.pom` paths the parallel parse takes at a time. Every phase
 /// stays in walk order whatever the chunk, so this only bounds peak
 /// memory: a real `~/.m2` holds 10-50k artifacts (corporate caches many
@@ -2162,16 +2165,14 @@ mod tests {
         assert_eq!(paths[0], dir.path().to_path_buf());
     }
 
-    // ── Seeded repositories, pinned by golden ────────────────────────
+    // ── Equivalence with the serial scan (oracle) ────────────────────
 
-    mod sweep {
+    mod equivalence {
+        use super::super::oracle::LegacyMavenCrawler;
         use super::*;
-        use crate::crawlers::test_tree::{
-            crawl_goldens_apply, mkdir, rel, rel_rows, rows, symlink, tree_listing, write,
-            write_bytes, PermGuard,
+        use crate::crawlers::oracle_support::{
+            mkdir, rows, symlink, write, write_bytes, PermGuard, Rng,
         };
-        use crate::golden::Golden;
-        use crate::test_rng::Rng;
 
         const GROUPS: &[&str] = &["org/apache/commons", "com/google/guava", "io/netty"];
         const ARTIFACTS: &[&str] = &["commons-lang3", "guava", "netty-all", "dup"];
@@ -2242,15 +2243,11 @@ mod tests {
 
         /// Chunking the parallel parse changes nothing: the walk, the
         /// parse and the dedup each stay in walk order, so every chunk
-        /// size — one POM at a time included — produces the same rows,
-        /// with the first-seen version dir still winning across a chunk
-        /// boundary.
+        /// size — one POM at a time included — produces the serial
+        /// oracle's rows, with the first-seen version dir still winning
+        /// across a chunk boundary.
         #[tokio::test]
-        async fn every_parse_chunk_size_matches_golden() {
-            let mut g = Golden::new(
-                "crawl_maven_parse_chunks",
-                "One seeded ~/.m2 repository, scanned at one parse chunk size.",
-            );
+        async fn every_parse_chunk_size_matches_the_serial_oracle() {
             let mut total = 0;
             for seed in 0..16u64 {
                 let tmp = tempfile::tempdir().unwrap();
@@ -2258,44 +2255,31 @@ mod tests {
                 let mut rng = Rng::new(seed);
                 let root = tmp.path().join("repository");
                 repo(&mut rng, &root, &tmp.path().join("outside"), &mut perms);
-                let input = (tree_listing(tmp.path()), perms.planned(tmp.path()));
                 perms.apply();
                 let options = CrawlerOptions {
                     cwd: tmp.path().to_path_buf(),
                     global: false,
                     global_prefix: Some(root.clone()),
                 };
-                let crawled = MavenCrawler::new().crawl_all(&options).await;
+                let old = LegacyMavenCrawler::crawl_all(&options).await;
                 for chunk in [0usize, 1, 2, 3, 7, 4096] {
                     let mut seen = HashSet::new();
                     let found = MavenCrawler.scan_maven_repo_chunked(&root, &mut seen, chunk);
-                    assert_eq!(rows(&found), rows(&crawled), "seed {seed}, chunk {chunk}");
-                    g.case(
-                        format!("{seed}/{chunk}"),
-                        &input,
-                        &rel_rows(tmp.path(), &found),
-                    );
+                    assert_eq!(rows(&found), rows(&old), "seed {seed}, chunk {chunk}");
                 }
-                total += crawled.len();
+                total += old.len();
             }
             assert!(total > 50, "vacuous fixtures: {total}");
-            if crawl_goldens_apply(true) {
-                g.finish();
-            }
         }
 
         /// The no-walk-pool fallback (the OS refused even one walk thread,
         /// so `run_walk` runs the walk on the calling blocking-pool thread)
-        /// scans exactly as the pooled walk does. A bare rayon iterator
+        /// scans exactly as the serial oracle does. A bare rayon iterator
         /// here would instead build rayon's GLOBAL pool from that thread —
         /// which needs the threads the OS just refused, and panics when it
         /// cannot get them — where the serial scan simply finished.
         #[tokio::test]
-        async fn no_pool_repos_match_golden() {
-            let mut g = Golden::new(
-                "crawl_maven_no_pool",
-                "One seeded ~/.m2 repository, crawled with no walk pool.",
-            );
+        async fn no_pool_repos_match_the_serial_oracle() {
             let _off = crate::crawlers::walk_pool::test_hooks::DisablePool::new();
             let mut total = 0;
             for seed in 0..16u64 {
@@ -2304,7 +2288,6 @@ mod tests {
                 let mut rng = Rng::new(seed);
                 let root = tmp.path().join("repository");
                 repo(&mut rng, &root, &tmp.path().join("outside"), &mut perms);
-                let input = (tree_listing(tmp.path()), perms.planned(tmp.path()));
                 perms.apply();
                 let options = CrawlerOptions {
                     cwd: tmp.path().to_path_buf(),
@@ -2312,13 +2295,11 @@ mod tests {
                     global_prefix: Some(root.clone()),
                 };
                 let new = MavenCrawler::new().crawl_all(&options).await;
-                g.case(seed, &input, &rel_rows(tmp.path(), &new));
-                total += new.len();
+                let old = LegacyMavenCrawler::crawl_all(&options).await;
+                assert_eq!(rows(&new), rows(&old), "no pool, seed {seed}");
+                total += old.len();
             }
             assert!(total > 50, "vacuous fixtures: {total}");
-            if crawl_goldens_apply(true) {
-                g.finish();
-            }
         }
 
         /// MVN-1 changes nothing on a repository whose canonically placed
@@ -2328,11 +2309,7 @@ mod tests {
         /// included (`extra.pom`, unreadable and non-UTF-8 files, parent-only
         /// and comment-only POMs).
         #[tokio::test]
-        async fn consistent_repos_match_golden() {
-            let mut g = Golden::new(
-                "crawl_maven_consistent",
-                "One seeded ~/.m2 repository whose POMs agree with their dirs, crawled.",
-            );
+        async fn consistent_repos_match_the_content_first_scan() {
             let mut total = 0;
             for seed in 0..64u64 {
                 let tmp = tempfile::tempdir().unwrap();
@@ -2346,7 +2323,6 @@ mod tests {
                     &mut perms,
                     true,
                 );
-                let input = (tree_listing(tmp.path()), perms.planned(tmp.path()));
                 perms.apply();
                 let options = CrawlerOptions {
                     cwd: tmp.path().to_path_buf(),
@@ -2354,13 +2330,11 @@ mod tests {
                     global_prefix: Some(root.clone()),
                 };
                 let new = MavenCrawler::new().crawl_all(&options).await;
-                g.case(seed, &input, &rel_rows(tmp.path(), &new));
-                total += new.len();
+                let old = super::super::oracle::crawl_all_content_first(&options).await;
+                assert_eq!(rows(&new), rows(&old), "seed {seed}");
+                total += old.len();
             }
             assert!(total > 200, "vacuous fixtures: {total}");
-            if crawl_goldens_apply(true) {
-                g.finish();
-            }
         }
 
         /// The path-first step is only as right as the scan root: from a
@@ -2370,11 +2344,7 @@ mod tests {
         /// scan exactly as the content-first scan had it — the parse and
         /// path-rescue arms included.
         #[tokio::test]
-        async fn misrooted_repos_match_golden() {
-            let mut g = Golden::new(
-                "crawl_maven_misrooted",
-                "One seeded ~/.m2 repository, crawled from a misplaced root.",
-            );
+        async fn misrooted_repos_match_the_content_first_scan() {
             let mut total = 0;
             for seed in 0..64u64 {
                 let tmp = tempfile::tempdir().unwrap();
@@ -2388,7 +2358,6 @@ mod tests {
                     &mut perms,
                     true,
                 );
-                let input = (tree_listing(tmp.path()), perms.planned(tmp.path()));
                 perms.apply();
                 let mut misroots = vec![tmp.path().to_path_buf()];
                 misroots.extend(
@@ -2404,23 +2373,16 @@ mod tests {
                         global_prefix: Some(misroot.clone()),
                     };
                     let new = MavenCrawler::new().crawl_all(&options).await;
-                    g.case(
-                        format!("{seed}/{}", rel(tmp.path(), &misroot)),
-                        &input,
-                        &rel_rows(tmp.path(), &new),
-                    );
-                    total += new.len();
+                    let old = super::super::oracle::crawl_all_content_first(&options).await;
+                    assert_eq!(rows(&new), rows(&old), "seed {seed}, {}", misroot.display());
+                    total += old.len();
                 }
             }
             assert!(total > 400, "vacuous fixtures: {total}");
-            if crawl_goldens_apply(true) {
-                g.finish();
-            }
         }
 
         #[tokio::test]
-        async fn randomized_repos_match_golden() {
-            let mut g = Golden::new("crawl_maven_repos", "One seeded ~/.m2 repository, crawled.");
+        async fn randomized_repos_match_the_serial_oracle() {
             let mut total = 0;
             for seed in 0..64u64 {
                 let tmp = tempfile::tempdir().unwrap();
@@ -2428,7 +2390,6 @@ mod tests {
                 let mut rng = Rng::new(seed);
                 let root = tmp.path().join("repository");
                 repo(&mut rng, &root, &tmp.path().join("outside"), &mut perms);
-                let input = (tree_listing(tmp.path()), perms.planned(tmp.path()));
                 perms.apply();
                 let options = CrawlerOptions {
                     cwd: tmp.path().to_path_buf(),
@@ -2436,13 +2397,11 @@ mod tests {
                     global_prefix: Some(root.clone()),
                 };
                 let new = MavenCrawler::new().crawl_all(&options).await;
-                g.case(seed, &input, &rel_rows(tmp.path(), &new));
-                total += new.len();
+                let old = LegacyMavenCrawler::crawl_all(&options).await;
+                assert_eq!(rows(&new), rows(&old), "seed {seed}");
+                total += old.len();
             }
             assert!(total > 200, "vacuous fixtures: {total}");
-            if crawl_goldens_apply(true) {
-                g.finish();
-            }
         }
     }
 }
diff --git a/crates/socket-patch-core/src/crawlers/maven_crawler/oracle.rs b/crates/socket-patch-core/src/crawlers/maven_crawler/oracle.rs
new file mode 100644
index 000000000..1f37c3dcd
--- /dev/null
+++ b/crates/socket-patch-core/src/crawlers/maven_crawler/oracle.rs
@@ -0,0 +1,172 @@
+//! The serial (walk, read and parse one POM at a time) local-repository
+//! scan, kept as the equivalence oracle for the parallel scan in the parent
+//! module. Verbatim but for MVN-1's path-first step, which it spells out on
+//! its own (not through the parent's `canonical_layout_coordinates` /
+//! `LayoutTrust`, so a bug there cannot hide on both sides): a POM at its
+//! canonical `<group>/<a>/<v>/<a>-<v>.pom` path takes its coordinates from
+//! that path once the first such POM of its top-level group directory whose
+//! content parses has agreed with its own path. Test-only; never compiled
+//! into the binary.
+
+use std::collections::{HashMap, HashSet};
+use std::path::Path;
+
+use super::{
+    parse_path_coordinates, parse_pom_group_artifact_version, MavenCrawler, LAYOUT_TRUST_ATTEMPTS,
+};
+use crate::crawlers::types::{CrawledPackage, CrawlerOptions};
+use crate::utils::fs::run_blocking;
+
+pub(super) struct LegacyMavenCrawler;
+
+impl LegacyMavenCrawler {
+    pub(super) async fn crawl_all(options: &CrawlerOptions) -> Vec<CrawledPackage> {
+        let mut packages = Vec::new();
+        let mut seen = HashSet::new();
+
+        let repo_paths = MavenCrawler::new()
+            .get_maven_repo_paths(options)
+            .await
+            .unwrap_or_default();
+
+        for repo_path in repo_paths {
+            let (found, returned_seen) = run_blocking(move || {
+                let found = scan_maven_repo(&repo_path, &mut seen);
+                (found, seen)
+            })
+            .await;
+            seen = returned_seen;
+            packages.extend(found);
+        }
+
+        packages
+    }
+}
+
+/// The scan as it stood before MVN-1, verbatim: every POM is read and its
+/// content decides, the directory path only rescuing an unparseable one.
+/// On a repository whose POMs all agree with their directories it must
+/// report exactly what the path-first scan reports.
+pub(super) async fn crawl_all_content_first(options: &CrawlerOptions) -> Vec<CrawledPackage> {
+    let mut packages = Vec::new();
+    let mut seen = HashSet::new();
+    let repo_paths = MavenCrawler::new()
+        .get_maven_repo_paths(options)
+        .await
+        .unwrap_or_default();
+    for repo_path in repo_paths {
+        let (found, returned_seen) = run_blocking(move || {
+            let found = scan(&repo_path, &mut seen, false);
+            (found, seen)
+        })
+        .await;
+        seen = returned_seen;
+        packages.extend(found);
+    }
+    packages
+}
+
+fn scan_maven_repo(repo_path: &Path, seen: &mut HashSet<String>) -> Vec<CrawledPackage> {
+    scan(repo_path, seen, true)
+}
+
+/// The canonical-layout coordinates of `path` under `repo_path`, spelled
+/// independently of the parent module: the group directories (at least
+/// one, none dotted), then `<a>/<v>/`, then a file named exactly
+/// `<a>-<v>.pom`.
+fn canonical_gav(path: &Path, repo_path: &Path) -> Option<(String, String, String)> {
+    let rel = path.strip_prefix(repo_path).ok()?;
+    let mut names = Vec::new();
+    for component in rel.components() {
+        let std::path::Component::Normal(name) = component else {
+            return None;
+        };
+        names.push(name.to_str()?.to_string());
+    }
+    if names.len() < 4 {
+        return None;
+    }
+    let file = names.pop()?;
+    let version = names.pop()?;
+    let artifact = names.pop()?;
+    if file != format!("{artifact}-{version}.pom") || names.iter().any(|n| n.contains('.')) {
+        return None;
+    }
+    Some((names.join("."), artifact, version))
+}
+
+/// Per top-level group directory: `Some(agreed)` once a POM's content
+/// parsed, else how many canonical POMs were read without one parsing.
+type Trust = HashMap<String, (Option<bool>, u8)>;
+
+fn scan(repo_path: &Path, seen: &mut HashSet<String>, path_first: bool) -> Vec<CrawledPackage> {
+    let mut results = Vec::new();
+    let mut trust: Trust = HashMap::new();
+
+    for entry in walkdir::WalkDir::new(repo_path)
+        .follow_links(false)
+        .into_iter()
+        .filter_map(|e| e.ok())
+    {
+        if !entry.file_type().is_file() {
+            continue;
+        }
+        let path = entry.path();
+        if path.extension().is_none_or(|ext| ext != "pom") {
+            continue;
+        }
+
+        let version_dir = match path.parent() {
+            Some(p) => p,
+            None => continue,
+        };
+
+        let content_first = || {
+            std::fs::read_to_string(path)
+                .ok()
+                .and_then(|content| parse_pom_group_artifact_version(&content))
+                .or_else(|| parse_path_coordinates(version_dir, repo_path))
+        };
+        let canonical = path_first.then(|| canonical_gav(path, repo_path)).flatten();
+        let coords = match canonical {
+            None => content_first(),
+            Some(gav) => {
+                let top = gav.0.split('.').next().unwrap_or_default().to_string();
+                let state = trust.entry(top).or_insert((None, 0));
+                match *state {
+                    (Some(true), _) => Some(gav),
+                    (Some(false), _) => content_first(),
+                    (None, read) if read >= LAYOUT_TRUST_ATTEMPTS => content_first(),
+                    (None, read) => match std::fs::read_to_string(path)
+                        .ok()
+                        .and_then(|content| parse_pom_group_artifact_version(&content))
+                    {
+                        Some(content) => {
+                            *state = (Some(content == gav), read);
+                            Some(content)
+                        }
+                        None => {
+                            *state = (None, read + 1);
+                            parse_path_coordinates(version_dir, repo_path)
+                        }
+                    },
+                }
+            }
+        };
+
+        if let Some((group_id, artifact_id, version)) = coords {
+            let purl = crate::utils::purl::build_maven_purl(&group_id, &artifact_id, &version);
+            if seen.insert(purl.clone()) {
+                results.push(CrawledPackage {
+                    name: artifact_id,
+                    version,
+                    namespace: Some(group_id),
+                    purl,
+                    path: version_dir.to_path_buf(),
+                });
+            }
+        }
+    }
+
+    results
+}
diff --git a/crates/socket-patch-core/src/crawlers/mod.rs b/crates/socket-patch-core/src/crawlers/mod.rs
index 7ce56ed2e..b0c257f50 100644
--- a/crates/socket-patch-core/src/crawlers/mod.rs
+++ b/crates/socket-patch-core/src/crawlers/mod.rs
@@ -9,11 +9,11 @@ pub mod maven_crawler;
 mod maven_pom_equivalence_tests;
 pub mod npm_crawler;
 pub mod nuget_crawler;
+#[cfg(test)]
+pub(crate) mod oracle_support;
 pub mod pkg_managers;
 pub mod python_crawler;
 pub mod ruby_crawler;
-#[cfg(test)]
-pub(crate) mod test_tree;
 pub mod types;
 pub mod walk_pool;
 
diff --git a/crates/socket-patch-core/src/crawlers/npm_crawler.rs b/crates/socket-patch-core/src/crawlers/npm_crawler.rs
index dcca60f22..146e53a99 100644
--- a/crates/socket-patch-core/src/crawlers/npm_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/npm_crawler.rs
@@ -13,7 +13,7 @@ use crate::utils::purl::{percent_decode_purl_component, strip_purl_qualifiers};
 use crate::vendor::vlt_lock_text::decode_vlt_dep_id;
 
 #[cfg(test)]
-mod sweep_tests;
+mod oracle;
 
 /// Directories to skip when searching for workspace node_modules.
 const SKIP_DIRS: &[&str] = &[
diff --git a/crates/socket-patch-core/src/crawlers/npm_crawler/oracle.rs b/crates/socket-patch-core/src/crawlers/npm_crawler/oracle.rs
new file mode 100644
index 000000000..d71a02127
--- /dev/null
+++ b/crates/socket-patch-core/src/crawlers/npm_crawler/oracle.rs
@@ -0,0 +1,1846 @@
+//! The pre-parallel (one tokio `spawn_blocking` hop per filesystem call)
+//! npm crawler, kept verbatim as the equivalence oracle for the
+//! blocking-pool walkers in the parent module: the randomized fixture
+//! tests assert both produce identical `crawl_all` / `find_by_purls` /
+//! store-enumeration output. Test-only; never compiled into the binary.
+
+use std::collections::{HashMap, HashSet, VecDeque};
+use std::ffi::OsString;
+use std::path::{Path, PathBuf};
+
+use super::{
+    build_npm_purl, is_legacy_pnpm_store_dir_name,
+    is_safe_npm_component, parse_package_name, read_package_json, NpmCrawler, StoreEntry,
+    Target, NESTED_STORE_MAX_DEPTH, NESTED_STORE_MAX_DIRS, SKIP_DIRS, VLT_STORE_NAME,
+};
+use crate::crawlers::types::{CrawledPackage, CrawlerOptions};
+use crate::utils::fs::is_dir;
+
+/// Which kind of `node_modules` directory a scan pass is walking — the one
+/// traversal-policy bit that differs between them.
+#[derive(Clone, Copy)]
+enum ScanPolicy<'a> {
+    /// An importer's or package's `node_modules`: symlinked entries are
+    /// recorded (pnpm and vlt link direct deps; `npm link` targets) but
+    /// never traversed into, and a `.pnpm` or `.vlt` child is the virtual
+    /// store, scanned in a deferred pass.
+    Importer,
+    /// One pnpm or vlt store entry's `node_modules`: only REAL
+    /// directories are inventoried — a symlinked (or, on Windows,
+    /// junctioned) entry here is the package's dependency pointing at a
+    /// sibling store entry, which is inventoried via that entry; following
+    /// it would record the same package under a path owned by a different
+    /// store entry.
+    /// `identity_seen` optionally carries the entry's own package name
+    /// (what the store dir name decodes to) when its name@version is
+    /// already inventoried — the importer pass wins the `seen` dedup for
+    /// every root-linked direct dep — so that child's package.json is not
+    /// read a second time; everything below it is still scanned.
+    StoreEntry { identity_seen: Option<&'a str> },
+}
+
+pub(super) struct LegacyNpmCrawler;
+
+/// Whether every component of `dir_key` (`name` or `@scope/name`) below
+/// `nm_path` is a real directory: links and junctions do not count.
+async fn is_real_package_dir(nm_path: &Path, dir_key: &str) -> bool {
+    let mut path = nm_path.to_path_buf();
+    for component in dir_key.split('/') {
+        path.push(component);
+        let real = tokio::fs::symlink_metadata(&path)
+            .await
+            .is_ok_and(|m| m.is_dir());
+        if !real {
+            return false;
+        }
+    }
+    true
+}
+
+/// Whether `pkg_path` is the physical dir one of `copies` resolves to.
+async fn resolves_to_any(pkg_path: &Path, copies: &[CrawledPackage]) -> bool {
+    let Ok(canon) = tokio::fs::canonicalize(pkg_path).await else {
+        return false;
+    };
+    for copy in copies {
+        if tokio::fs::canonicalize(&copy.path).await.ok().as_ref() == Some(&canon) {
+            return true;
+        }
+    }
+    false
+}
+
+impl LegacyNpmCrawler {
+    /// The old `NpmCrawler::crawl_all`: global roots come from the (shared,
+    /// unchanged) global-path logic; local roots from the old async walk.
+    pub(super) async fn crawl_all(options: &CrawlerOptions) -> Vec<CrawledPackage> {
+        let mut packages = Vec::new();
+        let mut seen = HashSet::new();
+
+        let nm_paths = if options.global || options.global_prefix.is_some() {
+            NpmCrawler::new()
+                .get_node_modules_paths(options)
+                .await
+                .unwrap_or_default()
+        } else {
+            Self::find_local_node_modules_dirs(&options.cwd).await
+        };
+
+        for nm_path in &nm_paths {
+            let found = Self::scan_node_modules(nm_path, &mut seen, ScanPolicy::Importer).await;
+            packages.extend(found);
+        }
+
+        packages
+    }
+
+    pub(super) async fn find_by_purls(
+        node_modules_path: &Path,
+        purls: &[String],
+    ) -> Result<HashMap<String, Vec<CrawledPackage>>, std::io::Error> {
+        let mut result: HashMap<String, Vec<CrawledPackage>> = HashMap::new();
+
+        let mut pending: Vec<Target> = Vec::new();
+        for purl in purls {
+            let Some((namespace, name, version)) = NpmCrawler::parse_purl_components(purl) else {
+                continue;
+            };
+
+            // SECURITY: `namespace`/`name` come straight from the (untrusted)
+            // manifest PURL and are joined onto `node_modules_path` below,
+            // then patched in place. A real npm scope/name is a single
+            // path segment, so reject any that could traverse out of the
+            // tree (`pkg:npm/../../evil@1.0.0`). Fail closed — twin of the
+            // deno/go/maven coordinate gates.
+            let ns_safe = namespace
+                .as_deref()
+                .map(is_safe_npm_component)
+                .unwrap_or(true);
+            if !ns_safe || !is_safe_npm_component(&name) {
+                continue;
+            }
+
+            let dir_key = match &namespace {
+                Some(ns) => format!("{ns}/{name}"),
+                None => name.clone(),
+            };
+            pending.push(Target {
+                namespace,
+                name,
+                version,
+                purl: purl.clone(),
+                dir_key,
+            });
+        }
+
+        // Pass 1 — filtered: `.pnpm` virtual-store entries are enqueued
+        // only when their dir name decodes to a still-pending target's
+        // name (a manifest routinely lists packages that simply aren't
+        // installed here, and probing every entry of a large monorepo
+        // store for them would add a readdir+stat storm to every
+        // apply/rollback run).
+        let pending =
+            Self::resolve_pending_targets(node_modules_path, pending, &mut result, true).await;
+
+        // Pass 2 — unfiltered fallback, only for targets pass 1 could not
+        // resolve: a target can physically exist ONLY inside another
+        // package's store entry (a bundled dependency at
+        // `.pnpm/host@1.0.0/node_modules/host/node_modules/<target>`),
+        // whose entry name decodes to the HOST's name — the pass-1 filter
+        // skips it, leaving an installed, scan-visible package invisible
+        // to apply (fail-open: apply reported it not installed). Probe
+        // every store entry for just the leftovers; the common all-
+        // resolved case never reaches this pass, so its perf is intact.
+        if !pending.is_empty() {
+            Self::resolve_pending_targets(node_modules_path, pending, &mut result, false).await;
+        }
+
+        Ok(result)
+    }
+
+    /// One breadth-first resolution pass over the tree rooted at
+    /// `node_modules_path`: the root `node_modules` first (so a root-level
+    /// install always wins), then — only while targets remain unresolved —
+    /// each nested `node_modules`. npm nests a conflicting version under
+    /// the dependent package, so a patched version can exist *only*
+    /// nested; CLI_CONTRACT ("Deeply nested transitive dependencies are
+    /// fully supported") promises those are patched identically to direct
+    /// deps, and `crawl_all` (scan) already discovers them at unbounded
+    /// depth.
+    ///
+    /// EVERY matching physical copy of each target lands in `result`
+    /// (keyed by the target's verbatim PURL, root-copy-first). Targets are
+    /// kept live across the whole walk — a duplicate copy can live at any
+    /// depth — so the traversal continues past the first match rather than
+    /// stopping. Targets for which NO copy was found anywhere are returned
+    /// (the pass-2 fallback re-probes them with the unfiltered store walk).
+    /// `filter_store_entries` selects whether pnpm virtual-store entries are
+    /// bounded by the still-unmatched-name filter (pass 1) or all probed
+    /// (the pass-2 fallback) — see `find_by_purls`.
+    async fn resolve_pending_targets(
+        node_modules_path: &Path,
+        mut pending: Vec<Target>,
+        result: &mut HashMap<String, Vec<CrawledPackage>>,
+        filter_store_entries: bool,
+    ) -> Vec<Target> {
+        if pending.is_empty() {
+            return pending;
+        }
+        let mut queue: VecDeque<(PathBuf, bool)> =
+            VecDeque::from([(node_modules_path.to_path_buf(), false)]);
+        while let Some((nm_path, store_entry)) = queue.pop_front() {
+            for target in &pending {
+                let pkg_path = nm_path.join(&target.dir_key);
+                // Inside a store entry a link is a dependency edge into a
+                // sibling entry, whose own probe records that copy.
+                if store_entry && !is_real_package_dir(&nm_path, &target.dir_key).await {
+                    continue;
+                }
+                let pkg_json_path = pkg_path.join("package.json");
+
+                match read_package_json(&pkg_json_path).await {
+                    // The on-disk *name* must match too: an alias install
+                    // (`npm i foo@npm:bar@1.0.0`) puts a different package
+                    // in `node_modules/foo`, so matching on version alone
+                    // would misidentify it and patch the wrong package's
+                    // files.
+                    Some((found_name, found_version))
+                        if found_name == target.dir_key && found_version == target.version =>
+                    {
+                        let copies = result.entry(target.purl.clone()).or_default();
+                        // Record each physical copy once — a path reached
+                        // twice (defensive against overlapping walks) is not
+                        // double-counted, and a store copy an importer link
+                        // already resolves to keeps the importer path.
+                        let recorded = copies.iter().any(|c| c.path == pkg_path)
+                            || (store_entry && resolves_to_any(&pkg_path, copies).await);
+                        if !recorded {
+                            copies.push(CrawledPackage {
+                                name: target.name.clone(),
+                                version: found_version,
+                                namespace: target.namespace.clone(),
+                                purl: target.purl.clone(),
+                                path: pkg_path,
+                            });
+                        }
+                    }
+                    _ => {}
+                }
+            }
+            // Descend importer-tree nested `node_modules` for ALL targets
+            // (a duplicate copy lives at an unknown depth), but probe the
+            // pnpm virtual store only for targets NOT YET found anywhere: a
+            // matched direct dep's store peer-variants are the apply
+            // engine's fan-out job, and re-probing the store for it would
+            // add a readdir storm. A target with no importer-tree copy
+            // (transitive-only) still gets its store entries probed.
+            let unmatched_names: HashSet<&str> = pending
+                .iter()
+                .filter(|t| !result.contains_key(&t.purl))
+                .map(|t| t.dir_key.as_str())
+                .collect();
+            let filter = filter_store_entries.then_some(&unmatched_names);
+            Self::collect_nested_node_modules(&nm_path, filter, &mut queue).await;
+        }
+        // Only the targets with zero copies remain "pending" for pass 2.
+        pending.retain(|t| !result.contains_key(&t.purl));
+        pending
+    }
+
+    /// Append the `node_modules` dirs living one level below `nm_path`
+    /// (inside each of its package dirs, scoped or not) to `queue`, each
+    /// tagged `true` when it is a store entry's (see `ScanPolicy::StoreEntry`).
+    /// Mirrors `scan_node_modules`' traversal policy: hidden entries are
+    /// skipped and symlinked packages are never traversed — a symlink here
+    /// points into pnpm's content-addressed store or an `npm link` target
+    /// outside the project. The one exception is pnpm's `.pnpm` virtual
+    /// store (see below); `pending_names` — `Some(the still-unresolved
+    /// targets' full package names)` — bounds which store entries get
+    /// enqueued, while `None` (the pass-2 fallback of `find_by_purls`)
+    /// enqueues every store entry.
+    async fn collect_nested_node_modules(
+        nm_path: &Path,
+        pending_names: Option<&HashSet<&str>>,
+        queue: &mut VecDeque<(PathBuf, bool)>,
+    ) {
+        for entry in crate::utils::fs::list_dir_entries(nm_path).await {
+            let name = entry.file_name();
+            let name_str = name.to_string_lossy();
+            // pnpm's virtual store. Under the isolated linker the store is
+            // the ONLY physical home of transitive dependencies: the
+            // importer's node_modules holds symlinks for direct deps only,
+            // so a transitive-only target (installed at
+            // `.pnpm/<x>/node_modules/<name>`, runtime-loaded) is
+            // unreachable through the symlink-free walk above — invisible
+            // to apply despite being importable. Probe REAL store entries'
+            // `node_modules`; the name+version match in `find_by_purls`
+            // keeps aliases and multi-version store entries distinct, and
+            // BFS order guarantees a root-linked install has already been
+            // probed (and removed from `pending`) before these are
+            // dequeued, so a package is never resolved twice.
+            if name_str == ".pnpm" {
+                let Some(file_type) = crate::utils::fs::entry_file_type(&entry).await else {
+                    continue;
+                };
+                if !file_type.is_dir() {
+                    continue;
+                }
+                let store_path = nm_path.join(&name);
+                let entries = Self::list_pnpm_store_entries(&store_path).await;
+                Self::enqueue_pending_store_entries(
+                    StoreEntry::pnpm(entries),
+                    pending_names,
+                    queue,
+                );
+                continue;
+            }
+            // vlt's store has the same transitive-only-home property: every
+            // package lives at `.vlt/<DepID>/node_modules/<name>` and the
+            // importer holds only links into it.
+            if name_str == VLT_STORE_NAME {
+                let Some(file_type) = crate::utils::fs::entry_file_type(&entry).await else {
+                    continue;
+                };
+                if !file_type.is_dir() {
+                    continue;
+                }
+                let entries = Self::list_vlt_store_entries(&nm_path.join(&name)).await;
+                Self::enqueue_pending_store_entries(StoreEntry::vlt(entries), pending_names, queue);
+                continue;
+            }
+            // pnpm <=3: the virtual store is a hidden `.<registry-host>` dir
+            // (there is no `.pnpm` at all) with the same
+            // transitive-only-deps property, so it gets the same probing.
+            // Must run before the generic hidden-entry skip below, which
+            // would otherwise swallow it — leaving every transitive-only
+            // install unpatchable on those layouts.
+            if is_legacy_pnpm_store_dir_name(&name_str) {
+                let Some(file_type) = crate::utils::fs::entry_file_type(&entry).await else {
+                    continue;
+                };
+                if !file_type.is_dir() {
+                    continue;
+                }
+                let mut entries = Vec::new();
+                Self::collect_nested_store_entries(&nm_path.join(&name), &mut entries).await;
+                Self::enqueue_pending_store_entries(
+                    StoreEntry::pnpm(entries),
+                    pending_names,
+                    queue,
+                );
+                continue;
+            }
+            if name_str.starts_with('.') || name_str == "node_modules" {
+                continue;
+            }
+            let Some(file_type) = crate::utils::fs::entry_file_type(&entry).await else {
+                continue;
+            };
+            if !file_type.is_dir() {
+                continue;
+            }
+            let entry_path = nm_path.join(&name);
+
+            if name_str.starts_with('@') {
+                for scoped in crate::utils::fs::list_dir_entries(&entry_path).await {
+                    let scoped_name = scoped.file_name();
+                    if scoped_name.to_string_lossy().starts_with('.') {
+                        continue;
+                    }
+                    let Some(scoped_type) = crate::utils::fs::entry_file_type(&scoped).await else {
+                        continue;
+                    };
+                    if !scoped_type.is_dir() {
+                        continue;
+                    }
+                    let nested = entry_path.join(&scoped_name).join("node_modules");
+                    if is_dir(&nested).await {
+                        queue.push_back((nested, false));
+                    }
+                }
+            } else {
+                let nested = entry_path.join("node_modules");
+                if is_dir(&nested).await {
+                    queue.push_back((nested, false));
+                }
+            }
+        }
+    }
+
+    /// Enqueue virtual-store entries that can still hold a pending target.
+    /// A manifest routinely lists packages that simply aren't installed
+    /// here, and probing every entry of a large monorepo store for them
+    /// would add a readdir+stat storm to every apply/rollback run. The
+    /// entry name advertises the entry's package, so filter by PENDING
+    /// NAME only — the version is deliberately NOT matched at this stage
+    /// (dir-name versions can carry peer/build decorations; the
+    /// package.json probe stays the authority). An undecodable name
+    /// (truncated/hash-suffixed dirs, git/URL deps, `_`-bearing names)
+    /// reveals nothing about what's inside, so it stays probeable.
+    ///
+    /// `pending_names = None` disables the filter entirely: the entry name
+    /// only advertises the entry's OWN package, so a target present solely
+    /// as a bundled dependency INSIDE another package's entry hides behind
+    /// a non-matching name — `find_by_purls`' pass-2 fallback probes every
+    /// entry for exactly those. Both enumerators only yield entries whose
+    /// `node_modules` exists, so no re-stat here.
+    fn enqueue_pending_store_entries(
+        entries: Vec<StoreEntry>,
+        pending_names: Option<&HashSet<&str>>,
+        queue: &mut VecDeque<(PathBuf, bool)>,
+    ) {
+        for entry in entries {
+            if let (Some(filter), Some((entry_pkg, _version))) = (pending_names, &entry.advertised)
+            {
+                if !filter.contains(entry_pkg.as_str()) {
+                    continue;
+                }
+            }
+            queue.push_back((entry.node_modules, true));
+        }
+    }
+
+    /// Find `node_modules` directories within the project root.
+    /// Recursively searches for workspace `node_modules` but stays within the
+    /// project.
+    async fn find_local_node_modules_dirs(start_path: &Path) -> Vec<PathBuf> {
+        let mut results = Vec::new();
+
+        // Direct node_modules in start_path
+        let direct = start_path.join("node_modules");
+        if is_dir(&direct).await {
+            results.push(direct);
+        }
+
+        // Recursively search for workspace node_modules
+        Self::find_workspace_node_modules(start_path, &mut results).await;
+
+        results
+    }
+
+    /// Recursively find `node_modules` in subdirectories (for monorepos / workspaces).
+    /// Skips symlinks, hidden dirs, and well-known non-workspace dirs.
+    fn find_workspace_node_modules<'a>(
+        dir: &'a Path,
+        results: &'a mut Vec<PathBuf>,
+    ) -> std::pin::Pin<Box<dyn std::future::Future<Output = ()> + 'a>> {
+        Box::pin(async move {
+            for entry in crate::utils::fs::list_dir_entries(dir).await {
+                let Some(file_type) = crate::utils::fs::entry_file_type(&entry).await else {
+                    continue;
+                };
+                if !file_type.is_dir() {
+                    continue;
+                }
+
+                let name = entry.file_name();
+                let name_str = name.to_string_lossy();
+
+                // Skip node_modules, hidden dirs, and well-known build dirs
+                if name_str == "node_modules"
+                    || name_str.starts_with('.')
+                    || SKIP_DIRS.contains(&name_str.as_ref())
+                {
+                    continue;
+                }
+
+                let full_path = dir.join(&name);
+
+                // Check if this subdirectory has its own node_modules
+                let sub_nm = full_path.join("node_modules");
+                if is_dir(&sub_nm).await {
+                    results.push(sub_nm);
+                }
+
+                // Recurse
+                Self::find_workspace_node_modules(&full_path, results).await;
+            }
+        })
+    }
+
+    // ------------------------------------------------------------------
+    // Private helpers – scanning
+    // ------------------------------------------------------------------
+
+    /// Scan a `node_modules` directory, returning all valid packages found.
+    /// Recurses into each package's own nested `node_modules`. The one
+    /// policy bit distinguishing an importer/package tree from a pnpm
+    /// virtual-store entry is carried by [`ScanPolicy`].
+    fn scan_node_modules<'a>(
+        node_modules_path: &'a Path,
+        seen: &'a mut HashSet<String>,
+        policy: ScanPolicy<'a>,
+    ) -> std::pin::Pin<Box<dyn std::future::Future<Output = Vec<CrawledPackage>> + 'a>> {
+        Box::pin(async move {
+            let mut results = Vec::new();
+            let mut pnpm_store: Option<PathBuf> = None;
+            let mut vlt_store: Option<PathBuf> = None;
+            let mut legacy_stores: Vec<PathBuf> = Vec::new();
+            let (store_entry, identity_seen) = match policy {
+                ScanPolicy::Importer => (false, None),
+                ScanPolicy::StoreEntry { identity_seen } => (true, identity_seen),
+            };
+
+            for entry in crate::utils::fs::list_dir_entries(node_modules_path).await {
+                let name = entry.file_name();
+                let name_str = name.to_string_lossy().to_string();
+
+                // pnpm's virtual store: under the isolated linker it is the
+                // ONLY physical home of transitive dependencies (the
+                // importer's node_modules symlinks direct deps only), so
+                // skipping it as just-another-hidden-dir leaves every
+                // transitive-only install invisible to scan. Deferred until
+                // after this loop so root-level entries are inventoried
+                // first and win the `seen` name@version dedup at their
+                // importer-root paths. (A store entry's own children never
+                // include a nested `.pnpm`; under `StoreEntry` policy the
+                // name falls through to the hidden-entry skip below.)
+                if !store_entry && name_str == ".pnpm" {
+                    let Some(file_type) = crate::utils::fs::entry_file_type(&entry).await else {
+                        continue;
+                    };
+                    if file_type.is_dir() {
+                        pnpm_store = Some(node_modules_path.join(&name_str));
+                    }
+                    continue;
+                }
+
+                // vlt's store, deferred for the same reason: importer links
+                // win the `seen` dedup at their importer-root paths.
+                if !store_entry && name_str == VLT_STORE_NAME {
+                    let Some(file_type) = crate::utils::fs::entry_file_type(&entry).await else {
+                        continue;
+                    };
+                    if file_type.is_dir() {
+                        vlt_store = Some(node_modules_path.join(&name_str));
+                    }
+                    continue;
+                }
+
+                // pnpm <=3 virtual store (a hidden `.<registry-host>` dir;
+                // no `.pnpm` exists on those layouts): same
+                // transitive-only-home property, same deferred scan so
+                // root-level entries win the `seen` dedup. Must run before
+                // the hidden-entry skip below, which would otherwise leave
+                // every transitive-only install invisible to scan.
+                if !store_entry && is_legacy_pnpm_store_dir_name(&name_str) {
+                    let Some(file_type) = crate::utils::fs::entry_file_type(&entry).await else {
+                        continue;
+                    };
+                    if file_type.is_dir() {
+                        legacy_stores.push(node_modules_path.join(&name_str));
+                    }
+                    continue;
+                }
+
+                // Skip hidden files and node_modules
+                if name_str.starts_with('.') || name_str == "node_modules" {
+                    continue;
+                }
+
+                let Some(file_type) = crate::utils::fs::entry_file_type(&entry).await else {
+                    continue;
+                };
+
+                // Importer trees allow both directories and symlinks (pnpm
+                // links direct deps); a store entry accepts REAL dirs only
+                // (see `ScanPolicy::StoreEntry`).
+                let acceptable = if store_entry {
+                    file_type.is_dir()
+                } else {
+                    file_type.is_dir() || file_type.is_symlink()
+                };
+                if !acceptable {
+                    continue;
+                }
+
+                let entry_path = node_modules_path.join(&name_str);
+
+                if name_str.starts_with('@') {
+                    // Scoped packages
+                    let scoped = Self::scan_scoped_packages(&entry_path, seen, policy).await;
+                    results.extend(scoped);
+                } else {
+                    // Regular package. `identity_seen` marks this exact dir
+                    // as already inventoried by the importer pass — skip
+                    // the redundant package.json read, but still descend
+                    // below: bundled dependencies are real dirs nested
+                    // inside the package itself (pnpm cannot link them
+                    // out), physically present only here.
+                    if identity_seen != Some(name_str.as_str()) {
+                        if let Some(pkg) = Self::check_package(&entry_path, seen).await {
+                            results.push(pkg);
+                        }
+                    }
+                    // Recurse into nested node_modules only for real
+                    // directories (not symlinks). Following a symlink here
+                    // would walk into pnpm's content-addressed store (or an
+                    // `npm link` target outside the project).
+                    if file_type.is_dir() {
+                        let nested = Self::scan_node_modules(
+                            &entry_path.join("node_modules"),
+                            seen,
+                            ScanPolicy::Importer,
+                        )
+                        .await;
+                        results.extend(nested);
+                    }
+                }
+            }
+
+            if let Some(store_path) = pnpm_store {
+                let entries = Self::list_pnpm_store_entries(&store_path).await;
+                results.extend(Self::scan_store_entries(StoreEntry::pnpm(entries), seen).await);
+            }
+            for store_path in legacy_stores {
+                let mut entries = Vec::new();
+                Self::collect_nested_store_entries(&store_path, &mut entries).await;
+                results.extend(Self::scan_store_entries(StoreEntry::pnpm(entries), seen).await);
+            }
+            if let Some(store_path) = vlt_store {
+                let entries = Self::list_vlt_store_entries(&store_path).await;
+                results.extend(Self::scan_store_entries(StoreEntry::vlt(entries), seen).await);
+            }
+
+            results
+        })
+    }
+
+    /// Enumerate pnpm virtual-store (`node_modules/.pnpm`) entries,
+    /// yielding `(entry_name, <entry>/node_modules)` for every entry whose
+    /// `node_modules` actually exists. The child literally named
+    /// `node_modules` is pnpm's internal hoist dir (nothing but symlinks
+    /// into sibling entries) and hidden children are store metadata — both
+    /// skipped. A REAL directory child with a `node_modules` of its own is
+    /// a flat (pnpm 6+) entry; one *without* is the pnpm 4/5 nested layout
+    /// — the child is a registry-host dir
+    /// (`.pnpm/<registry-host>/<name>/<version>/node_modules/<name>`), so
+    /// treating it as an empty entry silently hid every transitive-only
+    /// install (apply exited 0 claiming success with nothing written) —
+    /// descend it instead. Shared by the resolver
+    /// (`collect_nested_node_modules`) and the scan pass
+    /// (`scan_store_entries` callers) so the store-layout policy lives
+    /// once.
+    pub(super) async fn list_pnpm_store_entries(store_path: &Path) -> Vec<(String, PathBuf)> {
+        let mut entries = Vec::new();
+        for entry in crate::utils::fs::list_dir_entries(store_path).await {
+            let name = entry.file_name();
+            let name_str = name.to_string_lossy();
+            if name_str.starts_with('.') || name_str == "node_modules" {
+                continue;
+            }
+            let Some(file_type) = crate::utils::fs::entry_file_type(&entry).await else {
+                continue;
+            };
+            if !file_type.is_dir() {
+                continue;
+            }
+            let entry_path = store_path.join(&name);
+            let entry_nm = entry_path.join("node_modules");
+            if is_dir(&entry_nm).await {
+                entries.push((name_str.into_owned(), entry_nm));
+            } else {
+                Self::collect_nested_store_entries(&entry_path, &mut entries).await;
+            }
+        }
+        entries
+    }
+
+    /// Enumerate vlt's store (`node_modules/.vlt`), yielding the lossless
+    /// entry name and `<entry>/node_modules` for every REAL entry dir whose
+    /// `node_modules` is a real dir. Skipped: dot-names (store metadata and
+    /// the `.VLT.DELETE.<key>.<DepID>` rollback staging that lingers on
+    /// Windows), the `node_modules` child (vlt's internal hoist dir: links
+    /// plus real `@scope` dirs holding links), files (`vlt.json`) and links.
+    /// The store is always flat; every entry holds exactly one real package
+    /// dir named after the package (never the alias).
+    pub(super) async fn list_vlt_store_entries(store_path: &Path) -> Vec<(OsString, PathBuf)> {
+        let mut entries = Vec::new();
+        for entry in crate::utils::fs::list_dir_entries(store_path).await {
+            let name = entry.file_name();
+            if name.as_encoded_bytes().starts_with(b".") || name == "node_modules" {
+                continue;
+            }
+            let Some(file_type) = crate::utils::fs::entry_file_type(&entry).await else {
+                continue;
+            };
+            if !file_type.is_dir() {
+                continue;
+            }
+            let entry_nm = store_path.join(&name).join("node_modules");
+            let real_nm = tokio::fs::symlink_metadata(&entry_nm)
+                .await
+                .is_ok_and(|m| m.is_dir());
+            if real_nm {
+                entries.push((name, entry_nm));
+            }
+        }
+        entries
+    }
+
+    /// Descend a *nested* virtual-store host dir, yielding
+    /// `(name@version, <version-dir>/node_modules)` for each package home
+    /// found. Covers the two pre-flat layouts (both confirmed against
+    /// captured real installs):
+    /// - pnpm 4/5: `.pnpm/<registry-host>/…` — called on a `.pnpm` child
+    ///   that has no `node_modules` of its own;
+    /// - pnpm <=3: `node_modules/.<registry-host>/…` — called on the
+    ///   hidden store root directly.
+    ///
+    /// Below the host, path components are registry coordinates (`@scope`,
+    /// name, version), NOT package dirs, so the importer-walk hidden-name
+    /// skip does not apply here — but symlinks are never traversed (a link
+    /// inside the store points at a sibling entry or out of tree, and
+    /// following one could cycle), and both depth and total fan-out are
+    /// bounded. Each found dir's host-relative path is synthesized into
+    /// the flat `name@version` entry-name form so downstream consumers
+    /// (the pending-name filter, the `identity_seen` dedup) treat nested
+    /// and flat entries identically; a shape that doesn't fit stays an
+    /// undecodable — always-probed — name, the conservative direction.
+    pub(super) async fn collect_nested_store_entries(
+        host_path: &Path,
+        entries: &mut Vec<(String, PathBuf)>,
+    ) {
+        let mut remaining = NESTED_STORE_MAX_DIRS;
+        let mut queue: VecDeque<(PathBuf, String, usize)> =
+            VecDeque::from([(host_path.to_path_buf(), String::new(), 0)]);
+        while let Some((dir, rel, depth)) = queue.pop_front() {
+            for entry in crate::utils::fs::list_dir_entries(&dir).await {
+                let name = entry.file_name();
+                let name_str = name.to_string_lossy();
+                // A `node_modules` here belongs to a parent entry (already
+                // yielded), never a name/version coordinate.
+                if name_str == "node_modules" {
+                    continue;
+                }
+                let Some(file_type) = crate::utils::fs::entry_file_type(&entry).await else {
+                    continue;
+                };
+                if !file_type.is_dir() {
+                    continue;
+                }
+                if remaining == 0 {
+                    return;
+                }
+                remaining -= 1;
+                let child = dir.join(&name);
+                let child_rel = if rel.is_empty() {
+                    name_str.into_owned()
+                } else {
+                    format!("{rel}/{name_str}")
+                };
+                let child_nm = child.join("node_modules");
+                if is_dir(&child_nm).await {
+                    // `<name>/<version>/node_modules` — a package home.
+                    // Anything deeper belongs to that package's own tree,
+                    // which the store-entry scan walks itself.
+                    let entry_name = match child_rel.rsplit_once('/') {
+                        Some((pkg, version)) => format!("{pkg}@{version}"),
+                        // Directly under the host there is no name/version
+                        // split; the raw component stays the entry name
+                        // (undecodable ⇒ probed).
+                        None => child_rel,
+                    };
+                    entries.push((entry_name, child_nm));
+                    continue;
+                }
+                if depth + 1 < NESTED_STORE_MAX_DEPTH {
+                    queue.push_back((child, child_rel, depth + 1));
+                }
+            }
+        }
+    }
+
+    /// Inventory the packages under each virtual-store entry's
+    /// `node_modules` (entries come from `list_pnpm_store_entries`,
+    /// `collect_nested_store_entries` or `list_vlt_store_entries`). An
+    /// entry whose name decodes to a name@version the importer pass already
+    /// inventoried (every root-linked direct dep) skips the redundant
+    /// package.json re-read via `identity_seen` — the entry is still
+    /// walked, because bundled/injected dependencies are real dirs that
+    /// physically live only inside the store entry.
+    async fn scan_store_entries(
+        entries: Vec<StoreEntry>,
+        seen: &mut HashSet<String>,
+    ) -> Vec<CrawledPackage> {
+        let mut results = Vec::new();
+
+        for StoreEntry {
+            advertised,
+            node_modules: entry_nm,
+        } in entries
+        {
+            let identity_seen = advertised
+                .filter(|(full_name, version)| {
+                    let (ns, bare) = parse_package_name(full_name);
+                    seen.contains(&build_npm_purl(ns.as_deref(), &bare, version))
+                })
+                .map(|(full_name, _version)| full_name);
+            let found = Self::scan_node_modules(
+                &entry_nm,
+                seen,
+                ScanPolicy::StoreEntry {
+                    identity_seen: identity_seen.as_deref(),
+                },
+            )
+            .await;
+            results.extend(found);
+        }
+
+        results
+    }
+
+    /// Scan a scoped packages directory (`@scope/`). `policy` carries the
+    /// caller's traversal rules (see [`ScanPolicy`]); nested `node_modules`
+    /// below a scoped package are always regular importer-style trees.
+    fn scan_scoped_packages<'a>(
+        scope_path: &'a Path,
+        seen: &'a mut HashSet<String>,
+        policy: ScanPolicy<'a>,
+    ) -> std::pin::Pin<Box<dyn std::future::Future<Output = Vec<CrawledPackage>> + 'a>> {
+        Box::pin(async move {
+            let mut results = Vec::new();
+            let (store_entry, identity_seen) = match policy {
+                ScanPolicy::Importer => (false, None),
+                ScanPolicy::StoreEntry { identity_seen } => (true, identity_seen),
+            };
+            // `identity_seen` names the full `@scope/name`; this dir is the
+            // `@scope` half.
+            let scope_name = scope_path
+                .file_name()
+                .map(|s| s.to_string_lossy().into_owned())
+                .unwrap_or_default();
+
+            for entry in crate::utils::fs::list_dir_entries(scope_path).await {
+                let name = entry.file_name();
+                let name_str = name.to_string_lossy().to_string();
+
+                if name_str.starts_with('.') {
+                    continue;
+                }
+
+                let Some(file_type) = crate::utils::fs::entry_file_type(&entry).await else {
+                    continue;
+                };
+
+                let acceptable = if store_entry {
+                    file_type.is_dir()
+                } else {
+                    file_type.is_dir() || file_type.is_symlink()
+                };
+                if !acceptable {
+                    continue;
+                }
+
+                let pkg_path = scope_path.join(&name_str);
+                let already_inventoried =
+                    identity_seen.is_some_and(|full| full == format!("{scope_name}/{name_str}"));
+                if !already_inventoried {
+                    if let Some(pkg) = Self::check_package(&pkg_path, seen).await {
+                        results.push(pkg);
+                    }
+                }
+
+                // Nested node_modules only for real directories
+                if file_type.is_dir() {
+                    let nested = Self::scan_node_modules(
+                        &pkg_path.join("node_modules"),
+                        seen,
+                        ScanPolicy::Importer,
+                    )
+                    .await;
+                    results.extend(nested);
+                }
+            }
+
+            results
+        })
+    }
+
+    /// Check a package directory and return `CrawledPackage` if valid.
+    /// Deduplicates by PURL via the `seen` set.
+    async fn check_package(pkg_path: &Path, seen: &mut HashSet<String>) -> Option<CrawledPackage> {
+        let pkg_json_path = pkg_path.join("package.json");
+        let (full_name, version) = read_package_json(&pkg_json_path).await?;
+        let (namespace, name) = parse_package_name(&full_name);
+        let purl = build_npm_purl(namespace.as_deref(), &name, &version);
+
+        if seen.contains(&purl) {
+            return None;
+        }
+        seen.insert(purl.clone());
+
+        Some(CrawledPackage {
+            name,
+            version,
+            namespace,
+            purl,
+            path: pkg_path.to_path_buf(),
+        })
+    }
+}
+
+/// Equivalence of the blocking-pool walkers against the oracle above, over
+/// randomized fixture trees exercising every layout rule the walks encode:
+/// flat/nested/legacy pnpm stores, scoped packages, symlinks (live,
+/// dangling, into the store), duplicate identities, aliases, broken / BOM'd
+/// / FIFO / directory package.json, unreadable and unsearchable dirs, and
+/// case variants of `node_modules`.
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::collections::BTreeMap;
+
+    type Row = (String, String, String, Option<String>, PathBuf);
+
+    fn rows(pkgs: &[CrawledPackage]) -> Vec<Row> {
+        pkgs.iter()
+            .map(|p| {
+                (
+                    p.purl.clone(),
+                    p.name.clone(),
+                    p.version.clone(),
+                    p.namespace.clone(),
+                    p.path.clone(),
+                )
+            })
+            .collect()
+    }
+
+    fn map_rows(map: &HashMap<String, Vec<CrawledPackage>>) -> BTreeMap<String, Vec<Row>> {
+        map.iter().map(|(k, v)| (k.clone(), rows(v))).collect()
+    }
+
+    const NAMES: &[&str] = &[
+        "foo",
+        "bar",
+        "baz",
+        "dup",
+        "Foo",
+        "lodash._x",
+        "@s/a",
+        "@s/b",
+        "@t/c",
+    ];
+    const VERSIONS: &[&str] = &["1.0.0", "1.0.1", "2.0.0"];
+    const WS_NAMES: &[&str] = &[
+        "packages", "apps", "a", "b", "lib", "dist", "vendor", ".git", "tmp",
+    ];
+
+    /// Restores permissions the generator stripped, before the tempdir is
+    /// removed (declare it AFTER the tempdir so it drops first). Only Unix
+    /// strips permissions.
+    #[cfg_attr(not(unix), allow(dead_code))]
+    struct PermGuard(Vec<PathBuf>);
+    impl Drop for PermGuard {
+        fn drop(&mut self) {
+            #[cfg(unix)]
+            for p in self.0.iter().rev() {
+                use std::os::unix::fs::PermissionsExt as _;
+                let _ = std::fs::set_permissions(p, std::fs::Permissions::from_mode(0o755));
+            }
+        }
+    }
+
+    // Symlinks, FIFOs and permission stripping are generated on Unix only.
+    #[cfg_attr(not(unix), allow(dead_code))]
+    struct Gen {
+        state: u64,
+        /// Out-of-tree dir for symlink targets that get traversed.
+        scratch: PathBuf,
+        /// Real package dirs created so far (symlink targets).
+        pkg_dirs: Vec<PathBuf>,
+        /// Real `node_modules` dirs created so far (symlink targets).
+        nm_dirs: Vec<PathBuf>,
+        /// Dirs whose permissions were stripped; applied at the END (a
+        /// stripped dir must not block the rest of the generation).
+        lock_plan: Vec<(PathBuf, u32)>,
+        uniq: usize,
+    }
+
+    impl Gen {
+        fn new(seed: u64, scratch: PathBuf) -> Self {
+            Self {
+                state: seed.wrapping_mul(0x9E37_79B9_7F4A_7C15) | 1,
+                scratch,
+                pkg_dirs: Vec::new(),
+                nm_dirs: Vec::new(),
+                lock_plan: Vec::new(),
+                uniq: 0,
+            }
+        }
+
+        fn next(&mut self) -> u64 {
+            // xorshift64*
+            let mut x = self.state;
+            x ^= x >> 12;
+            x ^= x << 25;
+            x ^= x >> 27;
+            self.state = x;
+            x.wrapping_mul(0x2545_F491_4F6C_DD1D)
+        }
+
+        fn below(&mut self, n: usize) -> usize {
+            (self.next() % n as u64) as usize
+        }
+
+        fn chance(&mut self, pct: usize) -> bool {
+            self.below(100) < pct
+        }
+
+        fn pick<'a>(&mut self, items: &'a [&'a str]) -> &'a str {
+            items[self.below(items.len())]
+        }
+
+        fn uniq(&mut self) -> usize {
+            self.uniq += 1;
+            self.uniq
+        }
+
+        #[allow(unused_variables)]
+        fn symlink(target: &Path, link: &Path) {
+            #[cfg(unix)]
+            {
+                if let Some(parent) = link.parent() {
+                    let _ = std::fs::create_dir_all(parent);
+                }
+                let _ = std::os::unix::fs::symlink(target, link);
+            }
+        }
+
+        #[allow(unused_variables)]
+        fn plan_lock(&mut self, dir: &Path, mode: u32) {
+            #[cfg(unix)]
+            self.lock_plan.push((dir.to_path_buf(), mode));
+        }
+
+        fn apply_locks(&mut self, guard: &mut PermGuard) {
+            #[cfg(unix)]
+            {
+                use std::os::unix::fs::PermissionsExt as _;
+                // Deepest first, so a stripped parent never blocks a child.
+                let mut plan = std::mem::take(&mut self.lock_plan);
+                plan.sort_by_key(|(p, _)| std::cmp::Reverse(p.components().count()));
+                for (dir, mode) in plan {
+                    if std::fs::symlink_metadata(&dir).is_ok_and(|m| m.is_dir())
+                        && std::fs::set_permissions(&dir, std::fs::Permissions::from_mode(mode))
+                            .is_ok()
+                    {
+                        guard.0.push(dir);
+                    }
+                }
+            }
+            #[cfg(not(unix))]
+            let _ = guard;
+        }
+
+        /// Write `dir/package.json` in one of many shapes.
+        fn package_json(&mut self, dir: &Path, name: &str, version: &str) {
+            let _ = std::fs::create_dir_all(dir);
+            let pj = dir.join("package.json");
+            if pj.symlink_metadata().is_ok() {
+                // Never write through an existing one (it may be a FIFO).
+                return;
+            }
+            let valid = format!(r#"{{"name": "{name}", "version": "{version}"}}"#);
+            match self.below(100) {
+                0..=69 => {
+                    let _ = std::fs::write(&pj, valid);
+                }
+                70..=74 => {
+                    let _ = std::fs::write(&pj, format!("\u{feff}{valid}"));
+                }
+                75..=78 => {
+                    let _ = std::fs::write(&pj, "not json");
+                }
+                79..=82 => {
+                    let _ = std::fs::write(&pj, format!(r#"{{"name": "{name}"}}"#));
+                }
+                83..=85 => {
+                    let _ =
+                        std::fs::write(&pj, format!(r#"{{"name": "", "version": "{version}"}}"#));
+                }
+                86..=90 => {
+                    #[cfg(unix)]
+                    {
+                        let c = std::ffi::CString::new(pj.to_str().unwrap()).unwrap();
+                        // SAFETY: plain libc call on a valid C string.
+                        unsafe { libc::mkfifo(c.as_ptr(), 0o644) };
+                    }
+                    #[cfg(not(unix))]
+                    let _ = std::fs::write(&pj, valid);
+                }
+                91..=93 => {
+                    let _ = std::fs::create_dir_all(&pj);
+                }
+                _ => {}
+            }
+        }
+
+        /// A package dir `nm/<dir_name>` (maybe with nested node_modules).
+        fn package(&mut self, nm: &Path, depth: usize) {
+            let dir_name = self.pick(NAMES).to_string();
+            // Mostly the dir's own name; sometimes an alias install.
+            let pkg_name = if self.chance(88) {
+                dir_name.clone()
+            } else {
+                self.pick(NAMES).to_string()
+            };
+            let version = self.pick(VERSIONS).to_string();
+            let dir = nm.join(&dir_name);
+            if dir.exists() {
+                return;
+            }
+            self.package_json(&dir, &pkg_name, &version);
+            self.pkg_dirs.push(dir.clone());
+            if depth < 3 && self.chance(30) {
+                let store_ok = self.chance(10);
+                self.node_modules(&dir.join("node_modules"), depth + 1, store_ok);
+            }
+            if self.chance(4) {
+                self.plan_lock(&dir, 0o000);
+            }
+        }
+
+        fn node_modules(&mut self, nm: &Path, depth: usize, store_ok: bool) {
+            let _ = std::fs::create_dir_all(nm);
+            self.nm_dirs.push(nm.to_path_buf());
+            let mut store_pkgs: Vec<(String, PathBuf)> = Vec::new();
+            if store_ok && self.chance(60) {
+                store_pkgs = self.pnpm_store(&nm.join(".pnpm"), depth);
+            } else if self.chance(5) {
+                let _ = std::fs::write(nm.join(".pnpm"), "not a store");
+            }
+            if store_ok && self.chance(15) {
+                self.legacy_store(&nm.join(".registry.npmjs.org"), depth);
+            }
+            if store_ok && self.chance(20) {
+                let vlt_pkgs = self.vlt_store(&nm.join(".vlt"), depth);
+                store_pkgs.extend(vlt_pkgs);
+            }
+            let n = self.below(6);
+            for _ in 0..n {
+                match self.below(100) {
+                    0..=54 => self.package(nm, depth),
+                    55..=62 => {
+                        // Symlinked entry: live, into the store, or dangling.
+                        let name = self.pick(NAMES);
+                        let link = nm.join(name);
+                        if link.symlink_metadata().is_ok() {
+                            continue;
+                        }
+                        let target = if !store_pkgs.is_empty() && self.chance(50) {
+                            {
+                                let i = self.below(store_pkgs.len());
+                                store_pkgs[i].1.clone()
+                            }
+                        } else if !self.pkg_dirs.is_empty() && self.chance(80) {
+                            {
+                                let i = self.below(self.pkg_dirs.len());
+                                self.pkg_dirs[i].clone()
+                            }
+                        } else {
+                            nm.join(format!("dangling-{}", self.uniq()))
+                        };
+                        Self::symlink(&target, &link);
+                    }
+                    63..=66 => {
+                        let hidden = nm.join(format!(".cache{}", self.uniq()));
+                        self.package_json(&hidden.join("foo"), "foo", "1.0.0");
+                    }
+                    67..=70 => {
+                        let _ = std::fs::write(nm.join(format!("README{}", self.uniq())), "x");
+                    }
+                    71..=74 => {
+                        // A symlinked scope dir (to a scope living outside
+                        // the tree, so the followed walk cannot cycle).
+                        let id = self.uniq();
+                        let target = self.scratch.join(format!("scope{id}"));
+                        let version = self.pick(VERSIONS).to_string();
+                        self.package_json(&target.join("x"), "@link/x", &version);
+                        let link = nm.join(format!("@link{}", self.uniq()));
+                        Self::symlink(&target, &link);
+                    }
+                    75..=79 => {
+                        let bin = nm.join(".bin");
+                        let _ = std::fs::create_dir_all(&bin);
+                        if let Some(target) = self.pkg_dirs.first().cloned() {
+                            let link = bin.join(format!("tool{}", self.uniq()));
+                            Self::symlink(&target, &link);
+                        }
+                    }
+                    80..=82 => {
+                        // A nested `node_modules` entry inside node_modules.
+                        self.package_json(&nm.join("node_modules").join("foo"), "foo", "1.0.0");
+                    }
+                    _ => {
+                        let scoped = self.pick(&["@s/a", "@s/b", "@t/c"]).to_string();
+                        let dir = nm.join(&scoped);
+                        if !dir.exists() {
+                            let version = self.pick(VERSIONS).to_string();
+                            self.package_json(&dir, &scoped, &version);
+                            self.pkg_dirs.push(dir.clone());
+                            if depth < 3 && self.chance(25) {
+                                self.node_modules(&dir.join("node_modules"), depth + 1, false);
+                            }
+                        }
+                    }
+                }
+            }
+            // Root-linked direct deps: importer symlinks into the store.
+            for (name, target) in store_pkgs {
+                let link = nm.join(&name);
+                if self.chance(50) && link.symlink_metadata().is_err() {
+                    Self::symlink(&target, &link);
+                }
+            }
+            if self.chance(3) {
+                self.plan_lock(nm, 0o000);
+            }
+        }
+
+        /// A `.vlt` store; returns `(name, package dir)` of the entries'
+        /// own packages (importer link targets). DepIDs of every era and
+        /// shape, with the store's hoist dir, rollback staging, metadata
+        /// file, dependency links and a linked `node_modules` mixed in.
+        fn vlt_store(&mut self, store: &Path, depth: usize) -> Vec<(String, PathBuf)> {
+            let _ = std::fs::create_dir_all(store);
+            let _ = std::fs::write(store.join("vlt.json"), "{}");
+            let mut own = Vec::new();
+            for _ in 0..1 + self.below(6) {
+                let name = self.pick(NAMES).to_string();
+                let version = self.pick(VERSIONS).to_string();
+                let escaped = name.replace('/', "+");
+                let id = match self.below(10) {
+                    0 => format!("~npm~{escaped}@{version}~peer.{}", self.uniq()),
+                    1 => format!("··{}@{version}", name.replace('/', "§")),
+                    2 => format!("·npm·{}@{version}", name.replace('/', "§")),
+                    3 => format!("git~github_cu+r~v{}", self.uniq()),
+                    4 => format!(".VLT.DELETE.{}.~npm~{escaped}@{version}", self.uniq()),
+                    5 => "node_modules".to_string(),
+                    _ => format!("~npm~{escaped}@{version}"),
+                };
+                let entry = store.join(&id);
+                if entry.symlink_metadata().is_ok() {
+                    continue;
+                }
+                let entry_nm = entry.join("node_modules");
+                if self.chance(5) {
+                    let _ = std::fs::create_dir_all(&entry);
+                    let id = self.uniq();
+                    let elsewhere = self.scratch.join(format!("vlt-nm{id}"));
+                    self.package_json(&elsewhere.join(&name), &name, &version);
+                    Self::symlink(&elsewhere, &entry_nm);
+                    continue;
+                }
+                let pkg_name = if self.chance(90) {
+                    name.clone()
+                } else {
+                    self.pick(NAMES).to_string()
+                };
+                let pkg = entry_nm.join(&name);
+                self.package_json(&pkg, &pkg_name, &version);
+                self.pkg_dirs.push(pkg.clone());
+                own.push((name.clone(), pkg.clone()));
+                for _ in 0..self.below(3) {
+                    if let Some((dep, target)) = own.first().cloned() {
+                        Self::symlink(&target, &entry_nm.join(&dep));
+                    }
+                }
+                if depth < 2 && self.chance(25) {
+                    self.node_modules(&pkg.join("node_modules"), depth + 1, false);
+                }
+                if self.chance(4) {
+                    self.plan_lock(&entry_nm, 0o000);
+                }
+            }
+            own
+        }
+
+        fn store_entry_name(&mut self, name: &str, version: &str) -> String {
+            let escaped = name.replace('/', "+");
+            match self.below(10) {
+                0 => format!("{escaped}@{version}(peer@1.0.0)"),
+                1 => format!("{escaped}@{version}_peer@1.0.0"),
+                2 => format!("{escaped}@github.com+u+r@abc{}", self.uniq()),
+                3 => format!("truncated-{}_abcdef", self.uniq()),
+                _ => format!("{escaped}@{version}"),
+            }
+        }
+
+        /// A `.pnpm` virtual store; returns `(name, package dir)` of the
+        /// flat entries' own packages (importer symlink targets).
+        fn pnpm_store(&mut self, store: &Path, depth: usize) -> Vec<(String, PathBuf)> {
+            let _ = std::fs::create_dir_all(store);
+            let _ = std::fs::write(store.join("lock.yaml"), "x");
+            let mut own = Vec::new();
+            let n = 1 + self.below(6);
+            for _ in 0..n {
+                let name = self.pick(NAMES).to_string();
+                let version = self.pick(VERSIONS).to_string();
+                match self.below(100) {
+                    0..=59 => {
+                        let entry = store.join(self.store_entry_name(&name, &version));
+                        let entry_nm = entry.join("node_modules");
+                        let pkg_name = if self.chance(90) {
+                            name.clone()
+                        } else {
+                            self.pick(NAMES).to_string()
+                        };
+                        let pkg = entry_nm.join(&name);
+                        self.package_json(&pkg, &pkg_name, &version);
+                        self.pkg_dirs.push(pkg.clone());
+                        own.push((name.clone(), pkg.clone()));
+                        // Dependencies: symlinks to sibling entries.
+                        for _ in 0..self.below(3) {
+                            if let Some((dep, target)) = own.first().cloned() {
+                                Self::symlink(&target, &entry_nm.join(format!("{dep}-dep")));
+                            }
+                        }
+                        // Another real package in the entry (injected dep).
+                        if self.chance(20) {
+                            self.package(&entry_nm, depth + 1);
+                        }
+                        // Bundled deps below the package itself.
+                        if depth < 2 && self.chance(25) {
+                            self.node_modules(&pkg.join("node_modules"), depth + 1, false);
+                        }
+                        match self.below(100) {
+                            0..=3 => self.plan_lock(&entry_nm, 0o000),
+                            4..=6 => self.plan_lock(&entry, 0o000),
+                            7..=9 => self.plan_lock(&entry_nm, 0o300),
+                            _ => {}
+                        }
+                    }
+                    60..=67 => {
+                        // pnpm 4/5 nested host layout.
+                        let pkg = store
+                            .join("registry.npmjs.org")
+                            .join(&name)
+                            .join(&version)
+                            .join("node_modules")
+                            .join(&name);
+                        self.package_json(&pkg, &name, &version);
+                        self.pkg_dirs.push(pkg);
+                    }
+                    68..=71 => {
+                        let _ = std::fs::create_dir_all(
+                            store.join(format!("empty{}@1.0.0", self.uniq())),
+                        );
+                    }
+                    72..=75 => {
+                        let entry = store.join(self.store_entry_name(&name, &version));
+                        let _ = std::fs::create_dir_all(&entry);
+                        let _ = std::fs::write(entry.join("node_modules"), "file");
+                    }
+                    76..=79 => {
+                        // An entry whose node_modules is a symlink.
+                        if let Some(target) = self.nm_dirs.first().cloned() {
+                            let entry = store.join(self.store_entry_name(&name, &version));
+                            let _ = std::fs::create_dir_all(&entry);
+                            Self::symlink(&target, &entry.join("node_modules"));
+                        }
+                    }
+                    80..=83 => {
+                        // The entry itself is a symlink (skipped).
+                        if let Some(target) = self.pkg_dirs.first().cloned() {
+                            let link = store.join(format!("{name}@9.9.{}", self.uniq()));
+                            Self::symlink(&target, &link);
+                        }
+                    }
+                    84..=89 => {
+                        // pnpm's hoist dir: symlinks only.
+                        let hoist = store.join("node_modules");
+                        let _ = std::fs::create_dir_all(&hoist);
+                        if let Some((dep, target)) = own.first().cloned() {
+                            Self::symlink(&target, &hoist.join(dep));
+                        }
+                    }
+                    _ => {
+                        // Nested host with a scoped coordinate.
+                        let pkg = store
+                            .join("registry.npmjs.org")
+                            .join("@s")
+                            .join("a")
+                            .join(&version)
+                            .join("node_modules")
+                            .join("@s")
+                            .join("a");
+                        self.package_json(&pkg, "@s/a", &version);
+                    }
+                }
+            }
+            own
+        }
+
+        /// A pnpm <=3 `.registry.npmjs.org` store.
+        fn legacy_store(&mut self, store: &Path, depth: usize) {
+            for _ in 0..1 + self.below(4) {
+                let name = self.pick(NAMES).to_string();
+                let version = self.pick(VERSIONS).to_string();
+                let home = store.join(&name).join(&version).join("node_modules");
+                self.package_json(&home.join(&name), &name, &version);
+                if depth < 2 && self.chance(20) {
+                    self.package(&home, depth + 1);
+                }
+            }
+        }
+
+        fn workspace(&mut self, dir: &Path, depth: usize) {
+            let _ = std::fs::create_dir_all(dir);
+            if self.chance(70) {
+                self.node_modules(&dir.join("node_modules"), 0, true);
+            }
+            if depth >= 3 {
+                return;
+            }
+            for _ in 0..self.below(5) {
+                let child = dir.join(format!("{}{}", self.pick(WS_NAMES), self.uniq()));
+                match self.below(100) {
+                    0..=49 => self.workspace(&child, depth + 1),
+                    50..=57 => {
+                        // Skipped by name (dist/vendor/.git/tmp as-is).
+                        let skipped = dir.join(self.pick(&["dist", "vendor", ".git", "tmp"]));
+                        self.workspace(&skipped, depth + 1);
+                    }
+                    58..=63 => {
+                        // A symlinked workspace dir (never walked).
+                        if let Some(target) = self.nm_dirs.first().and_then(|p| p.parent()) {
+                            let target = target.to_path_buf();
+                            Self::symlink(&target, &child);
+                        }
+                    }
+                    64..=69 => {
+                        // node_modules itself a symlink.
+                        let _ = std::fs::create_dir_all(&child);
+                        if let Some(target) = self.nm_dirs.first().cloned() {
+                            Self::symlink(&target, &child.join("node_modules"));
+                        }
+                    }
+                    70..=73 => {
+                        let _ = std::fs::create_dir_all(&child);
+                        let _ = std::fs::write(child.join("node_modules"), "file");
+                    }
+                    74..=79 => {
+                        // Case variant (aliases node_modules on APFS/NTFS).
+                        let _ = std::fs::create_dir_all(&child);
+                        let variant = self.pick(&["Node_Modules", "NODE_MODULES"]);
+                        self.node_modules(&child.join(variant), 1, false);
+                    }
+                    80..=85 => {
+                        self.workspace(&child, depth + 1);
+                        self.plan_lock(&child, 0o000);
+                    }
+                    86..=91 => {
+                        // Readable but not searchable: lists fine, stats fail.
+                        self.workspace(&child, depth + 1);
+                        self.plan_lock(&child, 0o600);
+                    }
+                    _ => {
+                        let _ = std::fs::create_dir_all(&child);
+                        let _ = std::fs::write(child.join("package.json"), "{}");
+                    }
+                }
+            }
+        }
+    }
+
+    /// Every purl worth resolving against a tree: all crawled identities,
+    /// qualified / percent-encoded spellings, absent versions, and names
+    /// that only exist inside store entries or aliases.
+    fn probe_purls(crawled: &[CrawledPackage]) -> Vec<String> {
+        let mut purls: Vec<String> = crawled.iter().map(|p| p.purl.clone()).collect();
+        for name in NAMES {
+            for version in VERSIONS {
+                purls.push(format!("pkg:npm/{name}@{version}"));
+            }
+        }
+        purls.push("pkg:npm/%40s/a@1.0.0".to_string());
+        purls.push("pkg:npm/foo@1.0.0?vcs_url=git@x".to_string());
+        purls.push("pkg:npm/absent@1.0.0".to_string());
+        purls.push("pkg:npm/casedir@1.0.0".to_string());
+        purls.push("pkg:npm/@cs/x@1.0.0".to_string());
+        purls.push("pkg:npm/../evil@1.0.0".to_string());
+        purls.sort();
+        purls.dedup();
+        purls
+    }
+
+    async fn assert_equivalent(root: &Path, label: &str) {
+        let options = CrawlerOptions {
+            cwd: root.to_path_buf(),
+            global: false,
+            global_prefix: None,
+        };
+        let crawler = NpmCrawler::new();
+
+        let new_paths = crawler.get_node_modules_paths(&options).await.unwrap();
+        let old_paths = LegacyNpmCrawler::find_local_node_modules_dirs(root).await;
+        assert_eq!(new_paths, old_paths, "{label}: node_modules roots differ");
+
+        let new_pkgs = crawler.crawl_all(&options).await;
+        let old_pkgs = LegacyNpmCrawler::crawl_all(&options).await;
+        assert_eq!(
+            rows(&new_pkgs),
+            rows(&old_pkgs),
+            "{label}: crawl_all differs"
+        );
+
+        let purls = probe_purls(&new_pkgs);
+        for nm in &new_paths {
+            let new_found = crawler.find_by_purls(nm, &purls).await.unwrap();
+            let old_found = LegacyNpmCrawler::find_by_purls(nm, &purls).await.unwrap();
+            assert_eq!(
+                map_rows(&new_found),
+                map_rows(&old_found),
+                "{label}: find_by_purls differs under {}",
+                nm.display()
+            );
+
+            let store = nm.join(".pnpm");
+            assert_eq!(
+                NpmCrawler::list_pnpm_store_entries(&store).await,
+                LegacyNpmCrawler::list_pnpm_store_entries(&store).await,
+                "{label}: store entries differ under {}",
+                store.display()
+            );
+            let vlt = nm.join(".vlt");
+            assert_eq!(
+                NpmCrawler::list_vlt_store_entries(&vlt).await,
+                LegacyNpmCrawler::list_vlt_store_entries(&vlt).await,
+                "{label}: vlt store entries differ under {}",
+                vlt.display()
+            );
+            let legacy = nm.join(".registry.npmjs.org");
+            let mut new_nested = Vec::new();
+            NpmCrawler::collect_nested_store_entries(&legacy, &mut new_nested).await;
+            let mut old_nested = Vec::new();
+            LegacyNpmCrawler::collect_nested_store_entries(&legacy, &mut old_nested).await;
+            assert_eq!(
+                new_nested, old_nested,
+                "{label}: nested store entries differ"
+            );
+        }
+    }
+
+    #[tokio::test(flavor = "multi_thread")]
+    async fn randomized_trees_match_the_sequential_oracle() {
+        let mut nonempty = 0;
+        for seed in 0..64u64 {
+            let tmp = tempfile::tempdir().unwrap();
+            let mut guard = PermGuard(Vec::new());
+            let root = tmp.path().join("proj");
+            let mut gen = Gen::new(seed, tmp.path().join("scratch"));
+            gen.workspace(&root, 0);
+            gen.apply_locks(&mut guard);
+
+            assert_equivalent(&root, &format!("seed {seed}")).await;
+            let options = CrawlerOptions {
+                cwd: root.clone(),
+                global: false,
+                global_prefix: None,
+            };
+            if !NpmCrawler::new().crawl_all(&options).await.is_empty() {
+                nonempty += 1;
+            }
+            drop(guard);
+        }
+        // The generator must actually produce packages most of the time,
+        // or the comparison above is vacuous.
+        assert!(nonempty > 32, "only {nonempty} non-empty trees");
+    }
+
+    /// A store entry whose own child's package.json disagrees with the
+    /// entry's name@version, for a root-installed package: the sequential
+    /// walk skips that child by name (`identity_seen`) without reading it,
+    /// so the foreign identity must never surface.
+    #[tokio::test]
+    async fn store_entry_child_with_a_foreign_identity_is_skipped_like_the_oracle() {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path().join("proj");
+        let nm = root.join("node_modules");
+        let write = |dir: &Path, name: &str, version: &str| {
+            std::fs::create_dir_all(dir).unwrap();
+            std::fs::write(
+                dir.join("package.json"),
+                format!(r#"{{"name": "{name}", "version": "{version}"}}"#),
+            )
+            .unwrap();
+        };
+        write(&nm.join("qux"), "qux", "1.0.0");
+        write(&nm.join("@s").join("q"), "@s/q", "1.0.0");
+        let store = nm.join(".pnpm");
+        let q = store.join("qux@1.0.0").join("node_modules");
+        write(&q.join("qux"), "qux", "9.9.9");
+        // Below the skipped child is still walked.
+        write(
+            &q.join("qux").join("node_modules").join("inner"),
+            "inner",
+            "1.0.0",
+        );
+        // A sibling of the skipped child is not skipped.
+        write(&q.join("sib"), "sib", "1.0.0");
+        write(
+            &store
+                .join("@s+q@1.0.0")
+                .join("node_modules")
+                .join("@s")
+                .join("q"),
+            "@s/q",
+            "9.9.9",
+        );
+        // Not root-installed: its child is read, foreign identity and all.
+        write(
+            &store.join("free@1.0.0").join("node_modules").join("free"),
+            "free",
+            "7.7.7",
+        );
+
+        assert_equivalent(&root, "foreign identity").await;
+
+        let options = CrawlerOptions {
+            cwd: root.clone(),
+            global: false,
+            global_prefix: None,
+        };
+        let purls: Vec<String> = NpmCrawler::new()
+            .crawl_all(&options)
+            .await
+            .into_iter()
+            .map(|p| p.purl)
+            .collect();
+        for present in [
+            "pkg:npm/qux@1.0.0",
+            "pkg:npm/@s/q@1.0.0",
+            "pkg:npm/inner@1.0.0",
+            "pkg:npm/sib@1.0.0",
+            "pkg:npm/free@7.7.7",
+        ] {
+            assert!(
+                purls.iter().any(|p| p == present),
+                "missing {present}: {purls:?}"
+            );
+        }
+        for absent in ["pkg:npm/qux@9.9.9", "pkg:npm/@s/q@9.9.9"] {
+            assert!(
+                !purls.iter().any(|p| p == absent),
+                "{absent} must be skipped: {purls:?}"
+            );
+        }
+    }
+
+    /// With no walk pool (the OS refused every walk thread) the walk runs
+    /// sequentially on the calling thread and still matches the oracle.
+    #[tokio::test]
+    async fn walk_without_a_pool_matches_the_sequential_oracle() {
+        let _off = crate::crawlers::walk_pool::test_hooks::DisablePool::new();
+        for seed in 0..16u64 {
+            let tmp = tempfile::tempdir().unwrap();
+            let mut guard = PermGuard(Vec::new());
+            let root = tmp.path().join("proj");
+            let mut gen = Gen::new(seed, tmp.path().join("scratch"));
+            gen.workspace(&root, 0);
+            gen.apply_locks(&mut guard);
+            assert_equivalent(&root, &format!("no pool, seed {seed}")).await;
+            drop(guard);
+        }
+    }
+
+    /// Hand-built tree with one of every tricky shape (so each is covered
+    /// regardless of what the random generator happens to draw), asserting
+    /// equivalence and pinning a few load-bearing outcomes.
+    #[tokio::test]
+    async fn kitchen_sink_tree_matches_the_sequential_oracle() {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path().join("proj");
+        let nm = root.join("node_modules");
+        let write = |dir: &Path, name: &str, version: &str| {
+            std::fs::create_dir_all(dir).unwrap();
+            std::fs::write(
+                dir.join("package.json"),
+                format!(r#"{{"name": "{name}", "version": "{version}"}}"#),
+            )
+            .unwrap();
+        };
+        // Importer tree: plain, scoped, nested duplicate, alias.
+        write(&nm.join("foo"), "foo", "1.0.0");
+        write(&nm.join("@s").join("a"), "@s/a", "1.0.0");
+        write(
+            &nm.join("bar").join("node_modules").join("foo"),
+            "foo",
+            "1.0.0",
+        );
+        write(&nm.join("bar"), "bar", "1.0.0");
+        write(&nm.join("alias"), "baz", "2.0.0");
+        // Flat store: a root-linked dep's own entry (identity_seen skip) with
+        // a bundled dep, a transitive-only entry, peer variants.
+        let store = nm.join(".pnpm");
+        let q = store.join("qux@1.0.0").join("node_modules");
+        write(&q.join("qux"), "qux", "1.0.0");
+        write(
+            &q.join("qux").join("node_modules").join("bundled"),
+            "bundled",
+            "3.0.0",
+        );
+        write(
+            &store.join("t@1.0.0").join("node_modules").join("t"),
+            "t",
+            "1.0.0",
+        );
+        write(
+            &store
+                .join("p@1.0.0(r@17.0.0)")
+                .join("node_modules")
+                .join("p"),
+            "p",
+            "1.0.0",
+        );
+        write(
+            &store
+                .join("p@1.0.0(r@18.0.0)")
+                .join("node_modules")
+                .join("p"),
+            "p",
+            "1.0.0",
+        );
+        write(
+            &store
+                .join("@s+b@1.0.0")
+                .join("node_modules")
+                .join("@s")
+                .join("b"),
+            "@s/b",
+            "1.0.0",
+        );
+        // Nested (pnpm 4/5) host and legacy (pnpm <=3) store.
+        write(
+            &store
+                .join("registry.npmjs.org")
+                .join("n")
+                .join("1.0.0")
+                .join("node_modules")
+                .join("n"),
+            "n",
+            "1.0.0",
+        );
+        write(
+            &nm.join(".registry.npmjs.org")
+                .join("l")
+                .join("1.0.0")
+                .join("node_modules")
+                .join("l"),
+            "l",
+            "1.0.0",
+        );
+        // A dir whose spelling differs from its package's name only by case
+        // (resolves under the lowercase name on case-insensitive volumes),
+        // and a scope spelled likewise.
+        write(&nm.join("CaseDir"), "casedir", "1.0.0");
+        write(&nm.join("@Cs").join("x"), "@cs/x", "1.0.0");
+        // Broken / BOM'd package.json.
+        std::fs::create_dir_all(nm.join("broken")).unwrap();
+        std::fs::write(nm.join("broken").join("package.json"), "{").unwrap();
+        std::fs::create_dir_all(nm.join("bom")).unwrap();
+        std::fs::write(
+            nm.join("bom").join("package.json"),
+            "\u{feff}{\"name\":\"bom\",\"version\":\"1.0.0\"}",
+        )
+        .unwrap();
+        // Workspaces: plain, skipped, case variant, node_modules-as-file.
+        write(
+            &root
+                .join("packages")
+                .join("w")
+                .join("node_modules")
+                .join("w"),
+            "w",
+            "1.0.0",
+        );
+        write(
+            &root.join("dist").join("node_modules").join("d"),
+            "d",
+            "1.0.0",
+        );
+        write(
+            &root.join("cv").join("Node_Modules").join("cv"),
+            "cv",
+            "1.0.0",
+        );
+        std::fs::create_dir_all(root.join("nf")).unwrap();
+        std::fs::write(root.join("nf").join("node_modules"), "file").unwrap();
+
+        let tmp_guard;
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::{symlink, PermissionsExt as _};
+            // Root-linked direct dep into the store, a dangling link.
+            symlink(q.join("qux"), nm.join("qux")).unwrap();
+            symlink(root.join("nowhere"), nm.join("dangling")).unwrap();
+            // FIFO package.json.
+            std::fs::create_dir_all(nm.join("fifo")).unwrap();
+            let c = std::ffi::CString::new(nm.join("fifo").join("package.json").to_str().unwrap())
+                .unwrap();
+            // SAFETY: plain libc call on a valid C string.
+            assert_eq!(unsafe { libc::mkfifo(c.as_ptr(), 0o644) }, 0);
+            // A workspace whose node_modules is a symlink.
+            std::fs::create_dir_all(root.join("ln")).unwrap();
+            symlink(
+                root.join("packages").join("w").join("node_modules"),
+                root.join("ln").join("node_modules"),
+            )
+            .unwrap();
+            // Unreadable store entry node_modules; unsearchable workspace.
+            let locked_nm = store.join("z@1.0.0").join("node_modules");
+            write(&locked_nm.join("z"), "z", "1.0.0");
+            write(
+                &root.join("rw").join("node_modules").join("r"),
+                "r",
+                "1.0.0",
+            );
+            std::fs::set_permissions(&locked_nm, std::fs::Permissions::from_mode(0o000)).unwrap();
+            std::fs::set_permissions(root.join("rw"), std::fs::Permissions::from_mode(0o600))
+                .unwrap();
+            tmp_guard = PermGuard(vec![locked_nm, root.join("rw")]);
+        }
+        #[cfg(not(unix))]
+        {
+            tmp_guard = PermGuard(Vec::new());
+        }
+
+        assert_equivalent(&root, "kitchen sink").await;
+
+        let options = CrawlerOptions {
+            cwd: root.clone(),
+            global: false,
+            global_prefix: None,
+        };
+        let purls: Vec<String> = NpmCrawler::new()
+            .crawl_all(&options)
+            .await
+            .into_iter()
+            .map(|p| p.purl)
+            .collect();
+        for expected in [
+            "pkg:npm/foo@1.0.0",
+            "pkg:npm/@s/a@1.0.0",
+            "pkg:npm/bundled@3.0.0",
+            "pkg:npm/t@1.0.0",
+            "pkg:npm/p@1.0.0",
+            "pkg:npm/@s/b@1.0.0",
+            "pkg:npm/n@1.0.0",
+            "pkg:npm/l@1.0.0",
+            "pkg:npm/bom@1.0.0",
+            "pkg:npm/w@1.0.0",
+        ] {
+            assert!(
+                purls.iter().any(|p| p == expected),
+                "missing {expected}: {purls:?}"
+            );
+        }
+        assert!(
+            !purls.iter().any(|p| p == "pkg:npm/d@1.0.0"),
+            "dist/ must be skipped"
+        );
+        drop(tmp_guard);
+    }
+}
diff --git a/crates/socket-patch-core/src/crawlers/npm_crawler/sweep_tests.rs b/crates/socket-patch-core/src/crawlers/npm_crawler/sweep_tests.rs
deleted file mode 100644
index 4ae3b5901..000000000
--- a/crates/socket-patch-core/src/crawlers/npm_crawler/sweep_tests.rs
+++ /dev/null
@@ -1,954 +0,0 @@
-//! Seeded npm project trees, pinned by golden (see `crate::golden`):
-//! flat/nested/legacy pnpm stores, scoped packages, symlinks (live,
-//! dangling, into the store), duplicate identities, aliases, broken / BOM'd
-//! / FIFO / directory package.json, unreadable and unsearchable dirs, and
-//! case variants of `node_modules`.
-
-use std::collections::BTreeMap;
-use std::path::{Path, PathBuf};
-
-use super::NpmCrawler;
-use crate::crawlers::types::{CrawledPackage, CrawlerOptions};
-use crate::test_rng::Rng;
-
-const NAMES: &[&str] = &[
-    "foo",
-    "bar",
-    "baz",
-    "dup",
-    "Foo",
-    "lodash._x",
-    "@s/a",
-    "@s/b",
-    "@t/c",
-];
-const VERSIONS: &[&str] = &["1.0.0", "1.0.1", "2.0.0"];
-const WS_NAMES: &[&str] = &[
-    "packages", "apps", "a", "b", "lib", "dist", "vendor", ".git", "tmp",
-];
-
-/// Restores permissions the generator stripped, before the tempdir is
-/// removed (declare it AFTER the tempdir so it drops first). Only Unix
-/// strips permissions.
-#[cfg_attr(not(unix), allow(dead_code))]
-struct PermGuard(Vec<PathBuf>);
-impl Drop for PermGuard {
-    fn drop(&mut self) {
-        #[cfg(unix)]
-        for p in self.0.iter().rev() {
-            use std::os::unix::fs::PermissionsExt as _;
-            let _ = std::fs::set_permissions(p, std::fs::Permissions::from_mode(0o755));
-        }
-    }
-}
-
-// Symlinks, FIFOs and permission stripping are generated on Unix only.
-#[cfg_attr(not(unix), allow(dead_code))]
-struct Gen {
-    rng: Rng,
-    /// Out-of-tree dir for symlink targets that get traversed.
-    scratch: PathBuf,
-    /// Real package dirs created so far (symlink targets).
-    pkg_dirs: Vec<PathBuf>,
-    /// Real `node_modules` dirs created so far (symlink targets).
-    nm_dirs: Vec<PathBuf>,
-    /// Dirs whose permissions were stripped; applied at the END (a
-    /// stripped dir must not block the rest of the generation).
-    lock_plan: Vec<(PathBuf, u32)>,
-    uniq: usize,
-}
-
-impl Gen {
-    fn new(seed: u64, scratch: PathBuf) -> Self {
-        Self {
-            rng: Rng::new(seed),
-            scratch,
-            pkg_dirs: Vec::new(),
-            nm_dirs: Vec::new(),
-            lock_plan: Vec::new(),
-            uniq: 0,
-        }
-    }
-
-    fn below(&mut self, n: usize) -> usize {
-        self.rng.below(n)
-    }
-
-    fn chance(&mut self, percent: u64) -> bool {
-        self.rng.chance(percent)
-    }
-
-    fn pick<'a>(&mut self, items: &[&'a str]) -> &'a str {
-        self.rng.pick(items)
-    }
-
-    fn uniq(&mut self) -> usize {
-        self.uniq += 1;
-        self.uniq
-    }
-
-    #[allow(unused_variables)]
-    fn symlink(target: &Path, link: &Path) {
-        #[cfg(unix)]
-        {
-            if let Some(parent) = link.parent() {
-                let _ = std::fs::create_dir_all(parent);
-            }
-            let _ = std::os::unix::fs::symlink(target, link);
-        }
-    }
-
-    #[allow(unused_variables)]
-    fn plan_lock(&mut self, dir: &Path, mode: u32) {
-        #[cfg(unix)]
-        self.lock_plan.push((dir.to_path_buf(), mode));
-    }
-
-    fn apply_locks(&mut self, guard: &mut PermGuard) {
-        #[cfg(unix)]
-        {
-            use std::os::unix::fs::PermissionsExt as _;
-            // Deepest first, so a stripped parent never blocks a child.
-            let mut plan = std::mem::take(&mut self.lock_plan);
-            plan.sort_by_key(|(p, _)| std::cmp::Reverse(p.components().count()));
-            for (dir, mode) in plan {
-                if std::fs::symlink_metadata(&dir).is_ok_and(|m| m.is_dir())
-                    && std::fs::set_permissions(&dir, std::fs::Permissions::from_mode(mode))
-                        .is_ok()
-                {
-                    guard.0.push(dir);
-                }
-            }
-        }
-        #[cfg(not(unix))]
-        let _ = guard;
-    }
-
-    /// Write `dir/package.json` in one of many shapes.
-    fn package_json(&mut self, dir: &Path, name: &str, version: &str) {
-        let _ = std::fs::create_dir_all(dir);
-        let pj = dir.join("package.json");
-        if pj.symlink_metadata().is_ok() {
-            // Never write through an existing one (it may be a FIFO).
-            return;
-        }
-        let valid = format!(r#"{{"name": "{name}", "version": "{version}"}}"#);
-        match self.below(100) {
-            0..=69 => {
-                let _ = std::fs::write(&pj, valid);
-            }
-            70..=74 => {
-                let _ = std::fs::write(&pj, format!("\u{feff}{valid}"));
-            }
-            75..=78 => {
-                let _ = std::fs::write(&pj, "not json");
-            }
-            79..=82 => {
-                let _ = std::fs::write(&pj, format!(r#"{{"name": "{name}"}}"#));
-            }
-            83..=85 => {
-                let _ =
-                    std::fs::write(&pj, format!(r#"{{"name": "", "version": "{version}"}}"#));
-            }
-            86..=90 => {
-                #[cfg(unix)]
-                {
-                    let c = std::ffi::CString::new(pj.to_str().unwrap()).unwrap();
-                    // SAFETY: plain libc call on a valid C string.
-                    unsafe { libc::mkfifo(c.as_ptr(), 0o644) };
-                }
-                #[cfg(not(unix))]
-                let _ = std::fs::write(&pj, valid);
-            }
-            91..=93 => {
-                let _ = std::fs::create_dir_all(&pj);
-            }
-            _ => {}
-        }
-    }
-
-    /// A package dir `nm/<dir_name>` (maybe with nested node_modules).
-    fn package(&mut self, nm: &Path, depth: usize) {
-        let dir_name = self.pick(NAMES).to_string();
-        // Mostly the dir's own name; sometimes an alias install.
-        let pkg_name = if self.chance(88) {
-            dir_name.clone()
-        } else {
-            self.pick(NAMES).to_string()
-        };
-        let version = self.pick(VERSIONS).to_string();
-        let dir = nm.join(&dir_name);
-        if dir.exists() {
-            return;
-        }
-        self.package_json(&dir, &pkg_name, &version);
-        self.pkg_dirs.push(dir.clone());
-        if depth < 3 && self.chance(30) {
-            let store_ok = self.chance(10);
-            self.node_modules(&dir.join("node_modules"), depth + 1, store_ok);
-        }
-        if self.chance(4) {
-            self.plan_lock(&dir, 0o000);
-        }
-    }
-
-    fn node_modules(&mut self, nm: &Path, depth: usize, store_ok: bool) {
-        let _ = std::fs::create_dir_all(nm);
-        self.nm_dirs.push(nm.to_path_buf());
-        let mut store_pkgs: Vec<(String, PathBuf)> = Vec::new();
-        if store_ok && self.chance(60) {
-            store_pkgs = self.pnpm_store(&nm.join(".pnpm"), depth);
-        } else if self.chance(5) {
-            let _ = std::fs::write(nm.join(".pnpm"), "not a store");
-        }
-        if store_ok && self.chance(15) {
-            self.legacy_store(&nm.join(".registry.npmjs.org"), depth);
-        }
-        if store_ok && self.chance(20) {
-            let vlt_pkgs = self.vlt_store(&nm.join(".vlt"), depth);
-            store_pkgs.extend(vlt_pkgs);
-        }
-        let n = self.below(6);
-        for _ in 0..n {
-            match self.below(100) {
-                0..=54 => self.package(nm, depth),
-                55..=62 => {
-                    // Symlinked entry: live, into the store, or dangling.
-                    let name = self.pick(NAMES);
-                    let link = nm.join(name);
-                    if link.symlink_metadata().is_ok() {
-                        continue;
-                    }
-                    let target = if !store_pkgs.is_empty() && self.chance(50) {
-                        {
-                            let i = self.below(store_pkgs.len());
-                            store_pkgs[i].1.clone()
-                        }
-                    } else if !self.pkg_dirs.is_empty() && self.chance(80) {
-                        {
-                            let i = self.below(self.pkg_dirs.len());
-                            self.pkg_dirs[i].clone()
-                        }
-                    } else {
-                        nm.join(format!("dangling-{}", self.uniq()))
-                    };
-                    Self::symlink(&target, &link);
-                }
-                63..=66 => {
-                    let hidden = nm.join(format!(".cache{}", self.uniq()));
-                    self.package_json(&hidden.join("foo"), "foo", "1.0.0");
-                }
-                67..=70 => {
-                    let _ = std::fs::write(nm.join(format!("README{}", self.uniq())), "x");
-                }
-                71..=74 => {
-                    // A symlinked scope dir (to a scope living outside
-                    // the tree, so the followed walk cannot cycle).
-                    let id = self.uniq();
-                    let target = self.scratch.join(format!("scope{id}"));
-                    let version = self.pick(VERSIONS).to_string();
-                    self.package_json(&target.join("x"), "@link/x", &version);
-                    let link = nm.join(format!("@link{}", self.uniq()));
-                    Self::symlink(&target, &link);
-                }
-                75..=79 => {
-                    let bin = nm.join(".bin");
-                    let _ = std::fs::create_dir_all(&bin);
-                    if let Some(target) = self.pkg_dirs.first().cloned() {
-                        let link = bin.join(format!("tool{}", self.uniq()));
-                        Self::symlink(&target, &link);
-                    }
-                }
-                80..=82 => {
-                    // A nested `node_modules` entry inside node_modules.
-                    self.package_json(&nm.join("node_modules").join("foo"), "foo", "1.0.0");
-                }
-                _ => {
-                    let scoped = self.pick(&["@s/a", "@s/b", "@t/c"]).to_string();
-                    let dir = nm.join(&scoped);
-                    if !dir.exists() {
-                        let version = self.pick(VERSIONS).to_string();
-                        self.package_json(&dir, &scoped, &version);
-                        self.pkg_dirs.push(dir.clone());
-                        if depth < 3 && self.chance(25) {
-                            self.node_modules(&dir.join("node_modules"), depth + 1, false);
-                        }
-                    }
-                }
-            }
-        }
-        // Root-linked direct deps: importer symlinks into the store.
-        for (name, target) in store_pkgs {
-            let link = nm.join(&name);
-            if self.chance(50) && link.symlink_metadata().is_err() {
-                Self::symlink(&target, &link);
-            }
-        }
-        if self.chance(3) {
-            self.plan_lock(nm, 0o000);
-        }
-    }
-
-    /// A `.vlt` store; returns `(name, package dir)` of the entries'
-    /// own packages (importer link targets). DepIDs of every era and
-    /// shape, with the store's hoist dir, rollback staging, metadata
-    /// file, dependency links and a linked `node_modules` mixed in.
-    fn vlt_store(&mut self, store: &Path, depth: usize) -> Vec<(String, PathBuf)> {
-        let _ = std::fs::create_dir_all(store);
-        let _ = std::fs::write(store.join("vlt.json"), "{}");
-        let mut own = Vec::new();
-        for _ in 0..1 + self.below(6) {
-            let name = self.pick(NAMES).to_string();
-            let version = self.pick(VERSIONS).to_string();
-            let escaped = name.replace('/', "+");
-            let id = match self.below(10) {
-                0 => format!("~npm~{escaped}@{version}~peer.{}", self.uniq()),
-                1 => format!("··{}@{version}", name.replace('/', "§")),
-                2 => format!("·npm·{}@{version}", name.replace('/', "§")),
-                3 => format!("git~github_cu+r~v{}", self.uniq()),
-                4 => format!(".VLT.DELETE.{}.~npm~{escaped}@{version}", self.uniq()),
-                5 => "node_modules".to_string(),
-                _ => format!("~npm~{escaped}@{version}"),
-            };
-            let entry = store.join(&id);
-            if entry.symlink_metadata().is_ok() {
-                continue;
-            }
-            let entry_nm = entry.join("node_modules");
-            if self.chance(5) {
-                let _ = std::fs::create_dir_all(&entry);
-                let id = self.uniq();
-                let elsewhere = self.scratch.join(format!("vlt-nm{id}"));
-                self.package_json(&elsewhere.join(&name), &name, &version);
-                Self::symlink(&elsewhere, &entry_nm);
-                continue;
-            }
-            let pkg_name = if self.chance(90) {
-                name.clone()
-            } else {
-                self.pick(NAMES).to_string()
-            };
-            let pkg = entry_nm.join(&name);
-            self.package_json(&pkg, &pkg_name, &version);
-            self.pkg_dirs.push(pkg.clone());
-            own.push((name.clone(), pkg.clone()));
-            for _ in 0..self.below(3) {
-                if let Some((dep, target)) = own.first().cloned() {
-                    Self::symlink(&target, &entry_nm.join(&dep));
-                }
-            }
-            if depth < 2 && self.chance(25) {
-                self.node_modules(&pkg.join("node_modules"), depth + 1, false);
-            }
-            if self.chance(4) {
-                self.plan_lock(&entry_nm, 0o000);
-            }
-        }
-        own
-    }
-
-    fn store_entry_name(&mut self, name: &str, version: &str) -> String {
-        let escaped = name.replace('/', "+");
-        match self.below(10) {
-            0 => format!("{escaped}@{version}(peer@1.0.0)"),
-            1 => format!("{escaped}@{version}_peer@1.0.0"),
-            2 => format!("{escaped}@github.com+u+r@abc{}", self.uniq()),
-            3 => format!("truncated-{}_abcdef", self.uniq()),
-            _ => format!("{escaped}@{version}"),
-        }
-    }
-
-    /// A `.pnpm` virtual store; returns `(name, package dir)` of the
-    /// flat entries' own packages (importer symlink targets).
-    fn pnpm_store(&mut self, store: &Path, depth: usize) -> Vec<(String, PathBuf)> {
-        let _ = std::fs::create_dir_all(store);
-        let _ = std::fs::write(store.join("lock.yaml"), "x");
-        let mut own = Vec::new();
-        let n = 1 + self.below(6);
-        for _ in 0..n {
-            let name = self.pick(NAMES).to_string();
-            let version = self.pick(VERSIONS).to_string();
-            match self.below(100) {
-                0..=59 => {
-                    let entry = store.join(self.store_entry_name(&name, &version));
-                    let entry_nm = entry.join("node_modules");
-                    let pkg_name = if self.chance(90) {
-                        name.clone()
-                    } else {
-                        self.pick(NAMES).to_string()
-                    };
-                    let pkg = entry_nm.join(&name);
-                    self.package_json(&pkg, &pkg_name, &version);
-                    self.pkg_dirs.push(pkg.clone());
-                    own.push((name.clone(), pkg.clone()));
-                    // Dependencies: symlinks to sibling entries.
-                    for _ in 0..self.below(3) {
-                        if let Some((dep, target)) = own.first().cloned() {
-                            Self::symlink(&target, &entry_nm.join(format!("{dep}-dep")));
-                        }
-                    }
-                    // Another real package in the entry (injected dep).
-                    if self.chance(20) {
-                        self.package(&entry_nm, depth + 1);
-                    }
-                    // Bundled deps below the package itself.
-                    if depth < 2 && self.chance(25) {
-                        self.node_modules(&pkg.join("node_modules"), depth + 1, false);
-                    }
-                    match self.below(100) {
-                        0..=3 => self.plan_lock(&entry_nm, 0o000),
-                        4..=6 => self.plan_lock(&entry, 0o000),
-                        7..=9 => self.plan_lock(&entry_nm, 0o300),
-                        _ => {}
-                    }
-                }
-                60..=67 => {
-                    // pnpm 4/5 nested host layout.
-                    let pkg = store
-                        .join("registry.npmjs.org")
-                        .join(&name)
-                        .join(&version)
-                        .join("node_modules")
-                        .join(&name);
-                    self.package_json(&pkg, &name, &version);
-                    self.pkg_dirs.push(pkg);
-                }
-                68..=71 => {
-                    let _ = std::fs::create_dir_all(
-                        store.join(format!("empty{}@1.0.0", self.uniq())),
-                    );
-                }
-                72..=75 => {
-                    let entry = store.join(self.store_entry_name(&name, &version));
-                    let _ = std::fs::create_dir_all(&entry);
-                    let _ = std::fs::write(entry.join("node_modules"), "file");
-                }
-                76..=79 => {
-                    // An entry whose node_modules is a symlink.
-                    if let Some(target) = self.nm_dirs.first().cloned() {
-                        let entry = store.join(self.store_entry_name(&name, &version));
-                        let _ = std::fs::create_dir_all(&entry);
-                        Self::symlink(&target, &entry.join("node_modules"));
-                    }
-                }
-                80..=83 => {
-                    // The entry itself is a symlink (skipped).
-                    if let Some(target) = self.pkg_dirs.first().cloned() {
-                        let link = store.join(format!("{name}@9.9.{}", self.uniq()));
-                        Self::symlink(&target, &link);
-                    }
-                }
-                84..=89 => {
-                    // pnpm's hoist dir: symlinks only.
-                    let hoist = store.join("node_modules");
-                    let _ = std::fs::create_dir_all(&hoist);
-                    if let Some((dep, target)) = own.first().cloned() {
-                        Self::symlink(&target, &hoist.join(dep));
-                    }
-                }
-                _ => {
-                    // Nested host with a scoped coordinate.
-                    let pkg = store
-                        .join("registry.npmjs.org")
-                        .join("@s")
-                        .join("a")
-                        .join(&version)
-                        .join("node_modules")
-                        .join("@s")
-                        .join("a");
-                    self.package_json(&pkg, "@s/a", &version);
-                }
-            }
-        }
-        own
-    }
-
-    /// A pnpm <=3 `.registry.npmjs.org` store.
-    fn legacy_store(&mut self, store: &Path, depth: usize) {
-        for _ in 0..1 + self.below(4) {
-            let name = self.pick(NAMES).to_string();
-            let version = self.pick(VERSIONS).to_string();
-            let home = store.join(&name).join(&version).join("node_modules");
-            self.package_json(&home.join(&name), &name, &version);
-            if depth < 2 && self.chance(20) {
-                self.package(&home, depth + 1);
-            }
-        }
-    }
-
-    fn workspace(&mut self, dir: &Path, depth: usize) {
-        let _ = std::fs::create_dir_all(dir);
-        if self.chance(70) {
-            self.node_modules(&dir.join("node_modules"), 0, true);
-        }
-        if depth >= 3 {
-            return;
-        }
-        for _ in 0..self.below(5) {
-            let child = dir.join(format!("{}{}", self.pick(WS_NAMES), self.uniq()));
-            match self.below(100) {
-                0..=49 => self.workspace(&child, depth + 1),
-                50..=57 => {
-                    // Skipped by name (dist/vendor/.git/tmp as-is).
-                    let skipped = dir.join(self.pick(&["dist", "vendor", ".git", "tmp"]));
-                    self.workspace(&skipped, depth + 1);
-                }
-                58..=63 => {
-                    // A symlinked workspace dir (never walked).
-                    if let Some(target) = self.nm_dirs.first().and_then(|p| p.parent()) {
-                        let target = target.to_path_buf();
-                        Self::symlink(&target, &child);
-                    }
-                }
-                64..=69 => {
-                    // node_modules itself a symlink.
-                    let _ = std::fs::create_dir_all(&child);
-                    if let Some(target) = self.nm_dirs.first().cloned() {
-                        Self::symlink(&target, &child.join("node_modules"));
-                    }
-                }
-                70..=73 => {
-                    let _ = std::fs::create_dir_all(&child);
-                    let _ = std::fs::write(child.join("node_modules"), "file");
-                }
-                74..=79 => {
-                    // Case variant (aliases node_modules on APFS/NTFS).
-                    let _ = std::fs::create_dir_all(&child);
-                    let variant = self.pick(&["Node_Modules", "NODE_MODULES"]);
-                    self.node_modules(&child.join(variant), 1, false);
-                }
-                80..=85 => {
-                    self.workspace(&child, depth + 1);
-                    self.plan_lock(&child, 0o000);
-                }
-                86..=91 => {
-                    // Readable but not searchable: lists fine, stats fail.
-                    self.workspace(&child, depth + 1);
-                    self.plan_lock(&child, 0o600);
-                }
-                _ => {
-                    let _ = std::fs::create_dir_all(&child);
-                    let _ = std::fs::write(child.join("package.json"), "{}");
-                }
-            }
-        }
-    }
-}
-
-/// Every purl worth resolving against a tree: all crawled identities,
-/// qualified / percent-encoded spellings, absent versions, and names
-/// that only exist inside store entries or aliases.
-fn probe_purls(crawled: &[CrawledPackage]) -> Vec<String> {
-    let mut purls: Vec<String> = crawled.iter().map(|p| p.purl.clone()).collect();
-    for name in NAMES {
-        for version in VERSIONS {
-            purls.push(format!("pkg:npm/{name}@{version}"));
-        }
-    }
-    purls.push("pkg:npm/%40s/a@1.0.0".to_string());
-    purls.push("pkg:npm/foo@1.0.0?vcs_url=git@x".to_string());
-    purls.push("pkg:npm/absent@1.0.0".to_string());
-    purls.push("pkg:npm/casedir@1.0.0".to_string());
-    purls.push("pkg:npm/@cs/x@1.0.0".to_string());
-    purls.push("pkg:npm/../evil@1.0.0".to_string());
-    purls.sort();
-    purls.dedup();
-    purls
-}
-
-async fn check(root: &Path) {
-    let base = root.parent().unwrap();
-    let rel = |p: &Path| crate::crawlers::test_tree::rel(base, p);
-    let rel_rows = |pkgs: &[CrawledPackage]| crate::crawlers::test_tree::rel_rows(base, pkgs);
-    let rel_pairs = |v: &[(String, PathBuf)]| -> Vec<(String, String)> {
-        v.iter().map(|(k, p)| (k.clone(), rel(p))).collect()
-    };
-    let input = crate::crawlers::test_tree::tree_listing(base);
-    let mut per_nm = Vec::new();
-    let options = CrawlerOptions {
-        cwd: root.to_path_buf(),
-        global: false,
-        global_prefix: None,
-    };
-    let crawler = NpmCrawler::new();
-
-    let new_paths = crawler.get_node_modules_paths(&options).await.unwrap();
-    let new_pkgs = crawler.crawl_all(&options).await;
-
-    let purls = probe_purls(&new_pkgs);
-    for nm in &new_paths {
-        let new_found = crawler.find_by_purls(nm, &purls).await.unwrap();
-        let store = nm.join(".pnpm");
-        let vlt = nm.join(".vlt");
-        let legacy = nm.join(".registry.npmjs.org");
-        let mut new_nested = Vec::new();
-        NpmCrawler::collect_nested_store_entries(&legacy, &mut new_nested).await;
-        let found: BTreeMap<String, Vec<_>> = new_found
-            .iter()
-            .map(|(k, v)| (k.clone(), rel_rows(v)))
-            .collect();
-        let vlt: Vec<(String, String)> = NpmCrawler::list_vlt_store_entries(&vlt)
-            .await
-            .iter()
-            .map(|(k, p)| (k.to_string_lossy().into_owned(), rel(p)))
-            .collect();
-        per_nm.push((
-            rel(nm),
-            found,
-            rel_pairs(&NpmCrawler::list_pnpm_store_entries(&store).await),
-            vlt,
-            rel_pairs(&new_nested),
-        ));
-    }
-    let paths: Vec<String> = new_paths.iter().map(|p| rel(p)).collect();
-    crate::golden::record(&input, &(paths, rel_rows(&new_pkgs), per_nm));
-}
-
-#[tokio::test(flavor = "multi_thread")]
-async fn randomized_trees_match_golden() {
-    let sweep = crate::golden::Sweep::start(
-        "crawl_npm_trees",
-        "One seeded project tree: node_modules roots, crawl_all, find_by_purls and store listings.",
-    );
-    let mut nonempty = 0;
-    for seed in 0..64u64 {
-        let tmp = tempfile::tempdir().unwrap();
-        let mut guard = PermGuard(Vec::new());
-        let root = tmp.path().join("proj");
-        let mut gen = Gen::new(seed, tmp.path().join("scratch"));
-        gen.workspace(&root, 0);
-        gen.apply_locks(&mut guard);
-
-        check(&root).await;
-        let options = CrawlerOptions {
-            cwd: root.clone(),
-            global: false,
-            global_prefix: None,
-        };
-        if !NpmCrawler::new().crawl_all(&options).await.is_empty() {
-            nonempty += 1;
-        }
-        drop(guard);
-    }
-    // The generator must actually produce packages most of the time,
-    // or the golden above is vacuous.
-    assert!(nonempty > 32, "only {nonempty} non-empty trees");
-    if crate::crawlers::test_tree::crawl_goldens_apply(true) {
-        sweep.finish();
-    }
-}
-
-/// A store entry whose own child's package.json disagrees with the
-/// entry's name@version, for a root-installed package: the sequential
-/// walk skips that child by name (`identity_seen`) without reading it,
-/// so the foreign identity must never surface.
-#[tokio::test]
-async fn store_entry_child_with_a_foreign_identity_is_skipped() {
-    let tmp = tempfile::tempdir().unwrap();
-    let root = tmp.path().join("proj");
-    let nm = root.join("node_modules");
-    let write = |dir: &Path, name: &str, version: &str| {
-        std::fs::create_dir_all(dir).unwrap();
-        std::fs::write(
-            dir.join("package.json"),
-            format!(r#"{{"name": "{name}", "version": "{version}"}}"#),
-        )
-        .unwrap();
-    };
-    write(&nm.join("qux"), "qux", "1.0.0");
-    write(&nm.join("@s").join("q"), "@s/q", "1.0.0");
-    let store = nm.join(".pnpm");
-    let q = store.join("qux@1.0.0").join("node_modules");
-    write(&q.join("qux"), "qux", "9.9.9");
-    // Below the skipped child is still walked.
-    write(
-        &q.join("qux").join("node_modules").join("inner"),
-        "inner",
-        "1.0.0",
-    );
-    // A sibling of the skipped child is not skipped.
-    write(&q.join("sib"), "sib", "1.0.0");
-    write(
-        &store
-            .join("@s+q@1.0.0")
-            .join("node_modules")
-            .join("@s")
-            .join("q"),
-        "@s/q",
-        "9.9.9",
-    );
-    // Not root-installed: its child is read, foreign identity and all.
-    write(
-        &store.join("free@1.0.0").join("node_modules").join("free"),
-        "free",
-        "7.7.7",
-    );
-
-    let sweep = crate::golden::Sweep::start(
-        "crawl_npm_foreign_identity",
-        "A pnpm store entry whose child names a foreign identity.",
-    );
-    check(&root).await;
-    if crate::crawlers::test_tree::crawl_goldens_apply(false) {
-        sweep.finish();
-    }
-
-    let options = CrawlerOptions {
-        cwd: root.clone(),
-        global: false,
-        global_prefix: None,
-    };
-    let purls: Vec<String> = NpmCrawler::new()
-        .crawl_all(&options)
-        .await
-        .into_iter()
-        .map(|p| p.purl)
-        .collect();
-    for present in [
-        "pkg:npm/qux@1.0.0",
-        "pkg:npm/@s/q@1.0.0",
-        "pkg:npm/inner@1.0.0",
-        "pkg:npm/sib@1.0.0",
-        "pkg:npm/free@7.7.7",
-    ] {
-        assert!(
-            purls.iter().any(|p| p == present),
-            "missing {present}: {purls:?}"
-        );
-    }
-    for absent in ["pkg:npm/qux@9.9.9", "pkg:npm/@s/q@9.9.9"] {
-        assert!(
-            !purls.iter().any(|p| p == absent),
-            "{absent} must be skipped: {purls:?}"
-        );
-    }
-}
-
-/// With no walk pool (the OS refused every walk thread) the walk runs
-/// sequentially on the calling thread and still matches the golden.
-#[tokio::test]
-async fn walk_without_a_pool_matches_golden() {
-    let _off = crate::crawlers::walk_pool::test_hooks::DisablePool::new();
-    let sweep = crate::golden::Sweep::start(
-        "crawl_npm_no_pool",
-        "One seeded project tree, walked with no walk pool.",
-    );
-    for seed in 0..16u64 {
-        let tmp = tempfile::tempdir().unwrap();
-        let mut guard = PermGuard(Vec::new());
-        let root = tmp.path().join("proj");
-        let mut gen = Gen::new(seed, tmp.path().join("scratch"));
-        gen.workspace(&root, 0);
-        gen.apply_locks(&mut guard);
-        check(&root).await;
-        drop(guard);
-    }
-    if crate::crawlers::test_tree::crawl_goldens_apply(true) {
-        sweep.finish();
-    }
-}
-
-/// Hand-built tree with one of every tricky shape (so each is covered
-/// regardless of what the random generator happens to draw), pinned by
-/// golden, with a few load-bearing outcomes asserted outright.
-#[tokio::test]
-async fn kitchen_sink_tree_matches_golden() {
-    let tmp = tempfile::tempdir().unwrap();
-    let root = tmp.path().join("proj");
-    let nm = root.join("node_modules");
-    let write = |dir: &Path, name: &str, version: &str| {
-        std::fs::create_dir_all(dir).unwrap();
-        std::fs::write(
-            dir.join("package.json"),
-            format!(r#"{{"name": "{name}", "version": "{version}"}}"#),
-        )
-        .unwrap();
-    };
-    // Importer tree: plain, scoped, nested duplicate, alias.
-    write(&nm.join("foo"), "foo", "1.0.0");
-    write(&nm.join("@s").join("a"), "@s/a", "1.0.0");
-    write(
-        &nm.join("bar").join("node_modules").join("foo"),
-        "foo",
-        "1.0.0",
-    );
-    write(&nm.join("bar"), "bar", "1.0.0");
-    write(&nm.join("alias"), "baz", "2.0.0");
-    // Flat store: a root-linked dep's own entry (identity_seen skip) with
-    // a bundled dep, a transitive-only entry, peer variants.
-    let store = nm.join(".pnpm");
-    let q = store.join("qux@1.0.0").join("node_modules");
-    write(&q.join("qux"), "qux", "1.0.0");
-    write(
-        &q.join("qux").join("node_modules").join("bundled"),
-        "bundled",
-        "3.0.0",
-    );
-    write(
-        &store.join("t@1.0.0").join("node_modules").join("t"),
-        "t",
-        "1.0.0",
-    );
-    write(
-        &store
-            .join("p@1.0.0(r@17.0.0)")
-            .join("node_modules")
-            .join("p"),
-        "p",
-        "1.0.0",
-    );
-    write(
-        &store
-            .join("p@1.0.0(r@18.0.0)")
-            .join("node_modules")
-            .join("p"),
-        "p",
-        "1.0.0",
-    );
-    write(
-        &store
-            .join("@s+b@1.0.0")
-            .join("node_modules")
-            .join("@s")
-            .join("b"),
-        "@s/b",
-        "1.0.0",
-    );
-    // Nested (pnpm 4/5) host and legacy (pnpm <=3) store.
-    write(
-        &store
-            .join("registry.npmjs.org")
-            .join("n")
-            .join("1.0.0")
-            .join("node_modules")
-            .join("n"),
-        "n",
-        "1.0.0",
-    );
-    write(
-        &nm.join(".registry.npmjs.org")
-            .join("l")
-            .join("1.0.0")
-            .join("node_modules")
-            .join("l"),
-        "l",
-        "1.0.0",
-    );
-    // A dir whose spelling differs from its package's name only by case
-    // (resolves under the lowercase name on case-insensitive volumes),
-    // and a scope spelled likewise.
-    write(&nm.join("CaseDir"), "casedir", "1.0.0");
-    write(&nm.join("@Cs").join("x"), "@cs/x", "1.0.0");
-    // Broken / BOM'd package.json.
-    std::fs::create_dir_all(nm.join("broken")).unwrap();
-    std::fs::write(nm.join("broken").join("package.json"), "{").unwrap();
-    std::fs::create_dir_all(nm.join("bom")).unwrap();
-    std::fs::write(
-        nm.join("bom").join("package.json"),
-        "\u{feff}{\"name\":\"bom\",\"version\":\"1.0.0\"}",
-    )
-    .unwrap();
-    // Workspaces: plain, skipped, case variant, node_modules-as-file.
-    write(
-        &root
-            .join("packages")
-            .join("w")
-            .join("node_modules")
-            .join("w"),
-        "w",
-        "1.0.0",
-    );
-    write(
-        &root.join("dist").join("node_modules").join("d"),
-        "d",
-        "1.0.0",
-    );
-    write(
-        &root.join("cv").join("Node_Modules").join("cv"),
-        "cv",
-        "1.0.0",
-    );
-    std::fs::create_dir_all(root.join("nf")).unwrap();
-    std::fs::write(root.join("nf").join("node_modules"), "file").unwrap();
-
-    let tmp_guard;
-    #[cfg(unix)]
-    {
-        use std::os::unix::fs::{symlink, PermissionsExt as _};
-        // Root-linked direct dep into the store, a dangling link.
-        symlink(q.join("qux"), nm.join("qux")).unwrap();
-        symlink(root.join("nowhere"), nm.join("dangling")).unwrap();
-        // FIFO package.json.
-        std::fs::create_dir_all(nm.join("fifo")).unwrap();
-        let c = std::ffi::CString::new(nm.join("fifo").join("package.json").to_str().unwrap())
-            .unwrap();
-        // SAFETY: plain libc call on a valid C string.
-        assert_eq!(unsafe { libc::mkfifo(c.as_ptr(), 0o644) }, 0);
-        // A workspace whose node_modules is a symlink.
-        std::fs::create_dir_all(root.join("ln")).unwrap();
-        symlink(
-            root.join("packages").join("w").join("node_modules"),
-            root.join("ln").join("node_modules"),
-        )
-        .unwrap();
-        // Unreadable store entry node_modules; unsearchable workspace.
-        let locked_nm = store.join("z@1.0.0").join("node_modules");
-        write(&locked_nm.join("z"), "z", "1.0.0");
-        write(
-            &root.join("rw").join("node_modules").join("r"),
-            "r",
-            "1.0.0",
-        );
-        std::fs::set_permissions(&locked_nm, std::fs::Permissions::from_mode(0o000)).unwrap();
-        std::fs::set_permissions(root.join("rw"), std::fs::Permissions::from_mode(0o600))
-            .unwrap();
-        tmp_guard = PermGuard(vec![locked_nm, root.join("rw")]);
-    }
-    #[cfg(not(unix))]
-    {
-        tmp_guard = PermGuard(Vec::new());
-    }
-
-    let sweep = crate::golden::Sweep::start(
-        "crawl_npm_kitchen_sink",
-        "A hand-built project tree with one of every tricky shape.",
-    );
-    check(&root).await;
-    if crate::crawlers::test_tree::crawl_goldens_apply(true) {
-        sweep.finish();
-    }
-
-    let options = CrawlerOptions {
-        cwd: root.clone(),
-        global: false,
-        global_prefix: None,
-    };
-    let purls: Vec<String> = NpmCrawler::new()
-        .crawl_all(&options)
-        .await
-        .into_iter()
-        .map(|p| p.purl)
-        .collect();
-    for expected in [
-        "pkg:npm/foo@1.0.0",
-        "pkg:npm/@s/a@1.0.0",
-        "pkg:npm/bundled@3.0.0",
-        "pkg:npm/t@1.0.0",
-        "pkg:npm/p@1.0.0",
-        "pkg:npm/@s/b@1.0.0",
-        "pkg:npm/n@1.0.0",
-        "pkg:npm/l@1.0.0",
-        "pkg:npm/bom@1.0.0",
-        "pkg:npm/w@1.0.0",
-    ] {
-        assert!(
-            purls.iter().any(|p| p == expected),
-            "missing {expected}: {purls:?}"
-        );
-    }
-    assert!(
-        !purls.iter().any(|p| p == "pkg:npm/d@1.0.0"),
-        "dist/ must be skipped"
-    );
-    drop(tmp_guard);
-}
diff --git a/crates/socket-patch-core/src/crawlers/nuget_crawler.rs b/crates/socket-patch-core/src/crawlers/nuget_crawler.rs
index 5f0c4040d..582277309 100644
--- a/crates/socket-patch-core/src/crawlers/nuget_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/nuget_crawler.rs
@@ -6,6 +6,9 @@ use super::types::{CrawledPackage, CrawlerOptions};
 use crate::patch::path_safety;
 use crate::utils::fs::{is_dir, is_dir_sync, run_blocking};
 
+#[cfg(test)]
+mod oracle;
+
 /// NuGet/.NET ecosystem crawler for discovering packages in global cache,
 /// legacy `packages/` folders, and `obj/` restore layouts.
 pub struct NuGetCrawler;
@@ -1286,16 +1289,14 @@ mod tests {
         );
     }
 
-    // ── Seeded package roots, pinned by golden ───────────────────────
+    // ── Equivalence with the per-call async scan (oracle) ─────────────
 
-    mod sweep {
+    mod equivalence {
+        use super::super::oracle::LegacyNuGetCrawler;
         use super::*;
-        use crate::crawlers::test_tree::{
-            crawl_goldens_apply, mkdir, rel_map_rows, rel_rows, symlink, tree_listing, write,
-            PermGuard,
+        use crate::crawlers::oracle_support::{
+            map_rows, mkdir, rows, symlink, write, PermGuard, Rng,
         };
-        use crate::golden::Golden;
-        use crate::test_rng::Rng;
 
         const IDS: &[&str] = &["Newtonsoft.Json", "xunit", "System.Text.Json", "Dup", "dup"];
         const VERSIONS: &[&str] = &["13.0.3", "2.0.0-RC1", "8.0.0", "1.0.0"];
@@ -1394,13 +1395,13 @@ mod tests {
         /// The case-insensitive legacy fallback — the only reader of the
         /// package root's memoized listing — over several PURLs in one
         /// call: the listing is built on the first PURL that needs it and
-        /// reused by the rest, answering as a per-PURL lookup would.
+        /// reused by the rest, matching the per-PURL oracle either way.
         ///
         /// The fallback can only MATCH on a case-sensitive filesystem:
         /// where `Foo.1.0` and `foo.1.0` are one directory, the exact-case
         /// probe above it already resolves every case variant, so nothing
-        /// reaches the fallback with a name to find (the randomized sweep
-        /// has the same blind spot locally — it distinguishes the two
+        /// reaches the fallback with a name to find (the randomized oracle
+        /// test has the same blind spot locally — it distinguishes the two
         /// layouts by case alone). The on-disk spelling below is therefore
         /// asserted only where the filesystem can tell them apart, and CI
         /// is where that happens.
@@ -1430,19 +1431,9 @@ mod tests {
                 .find_by_purls(&root, &purls)
                 .await
                 .unwrap();
+            let old = LegacyNuGetCrawler::find_by_purls(&root, &purls).await;
+            assert_eq!(map_rows(&new), map_rows(&old));
             assert_eq!(new.len(), 2, "{new:?}");
-            let mut g = Golden::new(
-                "crawl_nuget_legacy_fallback",
-                "A legacy packages/ root probed by case-variant PURLs.",
-            );
-            g.case(
-                0,
-                &tree_listing(tmp.path()),
-                &rel_map_rows(tmp.path(), &new),
-            );
-            if crawl_goldens_apply(false) {
-                g.finish();
-            }
             for purl in [
                 "pkg:nuget/NEWTONSOFT.JSON@13.0.3",
                 "pkg:nuget/SeriLog@2.12.0",
@@ -1484,19 +1475,14 @@ mod tests {
         }
 
         #[tokio::test]
-        async fn randomized_package_dirs_match_golden() {
+        async fn randomized_package_dirs_match_the_async_oracle() {
             let (mut crawled, mut found) = (0, 0);
-            let mut g = Golden::new(
-                "crawl_nuget_packages",
-                "One seeded NuGet packages root: crawl_all, then find_by_purls.",
-            );
             for seed in 0..64u64 {
                 let tmp = tempfile::tempdir().unwrap();
                 let mut perms = PermGuard::default();
                 let mut rng = Rng::new(seed);
                 let root = tmp.path().join("packages");
                 tree(&mut rng, &root, &tmp.path().join("outside"), &mut perms);
-                let input = (tree_listing(tmp.path()), perms.planned(tmp.path()));
                 perms.apply();
                 let options = CrawlerOptions {
                     cwd: tmp.path().to_path_buf(),
@@ -1504,29 +1490,27 @@ mod tests {
                     global_prefix: Some(root.clone()),
                 };
                 let new = NuGetCrawler::new().crawl_all(&options).await;
-                let purls = probe_purls(&mut rng, &new);
+                let old = LegacyNuGetCrawler::crawl_all(&options).await;
+                assert_eq!(rows(&new), rows(&old), "seed {seed}: crawl_all");
+
+                let purls = probe_purls(&mut rng, &old);
                 let new_found = NuGetCrawler::new()
                     .find_by_purls(&root, &purls)
                     .await
                     .unwrap();
-                g.case(
-                    seed,
-                    &(input, &purls),
-                    &(
-                        rel_rows(tmp.path(), &new),
-                        rel_map_rows(tmp.path(), &new_found),
-                    ),
+                let old_found = LegacyNuGetCrawler::find_by_purls(&root, &purls).await;
+                assert_eq!(
+                    map_rows(&new_found),
+                    map_rows(&old_found),
+                    "seed {seed}: find_by_purls"
                 );
-                crawled += new.len();
-                found += new_found.len();
+                crawled += old.len();
+                found += old_found.len();
             }
             assert!(
                 crawled > 100 && found > 100,
                 "vacuous fixtures: {crawled}/{found}"
             );
-            if crawl_goldens_apply(true) {
-                g.finish();
-            }
         }
     }
 }
diff --git a/crates/socket-patch-core/src/crawlers/nuget_crawler/oracle.rs b/crates/socket-patch-core/src/crawlers/nuget_crawler/oracle.rs
new file mode 100644
index 000000000..7c9602e31
--- /dev/null
+++ b/crates/socket-patch-core/src/crawlers/nuget_crawler/oracle.rs
@@ -0,0 +1,207 @@
+//! The pre-blocking-pool (one tokio hop per readdir/stat) NuGet package
+//! scan and PURL lookup, kept verbatim as the equivalence oracle for the
+//! synchronous walkers in the parent module. Test-only; never compiled into
+//! the binary.
+
+use std::collections::{HashMap, HashSet};
+use std::path::{Path, PathBuf};
+
+use super::{is_safe_nuget_coordinate, parse_legacy_dir_name, NuGetCrawler};
+use crate::crawlers::types::{CrawledPackage, CrawlerOptions};
+use crate::utils::fs::is_dir;
+
+pub(super) struct LegacyNuGetCrawler;
+
+impl LegacyNuGetCrawler {
+    pub(super) async fn crawl_all(options: &CrawlerOptions) -> Vec<CrawledPackage> {
+        let mut packages = Vec::new();
+        let mut seen = HashSet::new();
+
+        let pkg_paths = NuGetCrawler::new()
+            .get_nuget_package_paths(options)
+            .await
+            .unwrap_or_default();
+
+        for pkg_path in &pkg_paths {
+            let found = Self::scan_package_dir(pkg_path, &mut seen).await;
+            packages.extend(found);
+        }
+
+        packages
+    }
+
+    pub(super) async fn find_by_purls(
+        pkg_path: &Path,
+        purls: &[String],
+    ) -> HashMap<String, CrawledPackage> {
+        let mut result: HashMap<String, CrawledPackage> = HashMap::new();
+
+        for purl in purls {
+            let Some((name, version)) = crate::utils::purl::parse_nuget_purl(purl) else {
+                continue;
+            };
+            let (name, version) = (name.as_ref(), version.as_ref());
+            if !is_safe_nuget_coordinate(name, version) {
+                continue;
+            }
+
+            let global_dir = pkg_path
+                .join(name.to_lowercase())
+                .join(version.to_lowercase());
+            let legacy_dir = pkg_path.join(format!("{name}.{version}"));
+
+            let found = if Self::verify_nuget_package(&global_dir).await {
+                Some(global_dir)
+            } else if Self::verify_nuget_package(&legacy_dir).await {
+                Some(legacy_dir)
+            } else {
+                Self::find_legacy_dir_case_insensitive(pkg_path, name, version).await
+            };
+
+            if let Some(path) = found {
+                result.insert(
+                    purl.clone(),
+                    CrawledPackage {
+                        name: name.to_string(),
+                        version: version.to_string(),
+                        namespace: None,
+                        purl: purl.clone(),
+                        path,
+                    },
+                );
+            }
+        }
+
+        result
+    }
+
+    async fn scan_package_dir(pkg_path: &Path, seen: &mut HashSet<String>) -> Vec<CrawledPackage> {
+        let mut results = Vec::new();
+
+        for entry in crate::utils::fs::list_dir_entries(pkg_path).await {
+            if !crate::utils::fs::entry_is_dir(&entry).await {
+                continue;
+            }
+
+            let dir_name = entry.file_name();
+            let dir_name_str = dir_name.to_string_lossy();
+
+            if dir_name_str.starts_with('.') {
+                continue;
+            }
+
+            let entry_path = pkg_path.join(&*dir_name_str);
+
+            if let Some(pkgs) =
+                Self::scan_global_cache_package(&entry_path, &dir_name_str, seen).await
+            {
+                results.extend(pkgs);
+                continue;
+            }
+
+            if let Some((name, version)) = parse_legacy_dir_name(&dir_name_str) {
+                if Self::verify_nuget_package(&entry_path).await {
+                    let purl = crate::utils::purl::build_nuget_purl(&name, &version);
+                    if !seen.contains(&purl) {
+                        seen.insert(purl.clone());
+                        results.push(CrawledPackage {
+                            name,
+                            version,
+                            namespace: None,
+                            purl,
+                            path: entry_path,
+                        });
+                    }
+                }
+            }
+        }
+
+        results
+    }
+
+    async fn scan_global_cache_package(
+        name_dir: &Path,
+        name: &str,
+        seen: &mut HashSet<String>,
+    ) -> Option<Vec<CrawledPackage>> {
+        let mut found_any = false;
+        let mut results = Vec::new();
+
+        for ver_entry in crate::utils::fs::list_dir_entries(name_dir).await {
+            if !crate::utils::fs::entry_is_dir(&ver_entry).await {
+                continue;
+            }
+
+            let ver_name = ver_entry.file_name();
+            let ver_str = ver_name.to_string_lossy();
+
+            if !ver_str.starts_with(|c: char| c.is_ascii_digit()) {
+                continue;
+            }
+
+            let ver_path = name_dir.join(&*ver_str);
+
+            if Self::verify_nuget_package(&ver_path).await {
+                found_any = true;
+                let purl = crate::utils::purl::build_nuget_purl(name, &ver_str);
+                if !seen.contains(&purl) {
+                    seen.insert(purl.clone());
+                    results.push(CrawledPackage {
+                        name: name.to_string(),
+                        version: ver_str.to_string(),
+                        namespace: None,
+                        purl,
+                        path: ver_path,
+                    });
+                }
+            }
+        }
+
+        if found_any {
+            Some(results)
+        } else {
+            None
+        }
+    }
+
+    async fn verify_nuget_package(path: &Path) -> bool {
+        if !is_dir(path).await {
+            return false;
+        }
+
+        if is_dir(&path.join("lib")).await {
+            return true;
+        }
+
+        for entry in crate::utils::fs::list_dir_entries(path).await {
+            if let Some(name) = entry.file_name().to_str() {
+                if name.ends_with(".nuspec") {
+                    return true;
+                }
+            }
+        }
+
+        false
+    }
+
+    async fn find_legacy_dir_case_insensitive(
+        pkg_path: &Path,
+        name: &str,
+        version: &str,
+    ) -> Option<PathBuf> {
+        let target = format!("{}.{}", name.to_lowercase(), version.to_lowercase());
+
+        for entry in crate::utils::fs::list_dir_entries(pkg_path).await {
+            let dir_name = entry.file_name();
+            let dir_name_str = dir_name.to_string_lossy();
+            if dir_name_str.to_lowercase() == target {
+                let path = pkg_path.join(&*dir_name_str);
+                if Self::verify_nuget_package(&path).await {
+                    return Some(path);
+                }
+            }
+        }
+
+        None
+    }
+}
diff --git a/crates/socket-patch-core/src/crawlers/test_tree.rs b/crates/socket-patch-core/src/crawlers/oracle_support.rs
similarity index 51%
rename from crates/socket-patch-core/src/crawlers/test_tree.rs
rename to crates/socket-patch-core/src/crawlers/oracle_support.rs
index e9b38ac1e..bc62a0256 100644
--- a/crates/socket-patch-core/src/crawlers/test_tree.rs
+++ b/crates/socket-patch-core/src/crawlers/oracle_support.rs
@@ -1,11 +1,42 @@
-//! Test-only scaffolding for the randomized crawler sweeps: generators build
-//! fixture trees with these helpers, and the crawl output is pinned by a
-//! golden snapshot (see [`crate::golden`]).
+//! Test-only scaffolding shared by the crawler equivalence tests: each
+//! crawler whose async walk moved onto the blocking pool keeps its previous
+//! implementation as a `#[cfg(test)]` oracle, and randomized fixture trees
+//! built with these helpers assert both produce identical output.
 
 use std::path::{Path, PathBuf};
 
 use super::types::CrawledPackage;
 
+/// Deterministic xorshift64* generator (no `rand` dependency).
+pub(crate) struct Rng(u64);
+
+impl Rng {
+    pub(crate) fn new(seed: u64) -> Self {
+        Self(seed.wrapping_mul(0x9E37_79B9_7F4A_7C15) | 1)
+    }
+
+    pub(crate) fn next(&mut self) -> u64 {
+        let mut x = self.0;
+        x ^= x >> 12;
+        x ^= x << 25;
+        x ^= x >> 27;
+        self.0 = x;
+        x.wrapping_mul(0x2545_F491_4F6C_DD1D)
+    }
+
+    pub(crate) fn below(&mut self, n: usize) -> usize {
+        (self.next() % n as u64) as usize
+    }
+
+    pub(crate) fn chance(&mut self, pct: usize) -> bool {
+        self.below(100) < pct
+    }
+
+    pub(crate) fn pick<'a>(&mut self, items: &[&'a str]) -> &'a str {
+        items[self.below(items.len())]
+    }
+}
+
 /// Restores permissions a generator stripped before the tempdir is removed
 /// (declare it AFTER the tempdir so it drops first). Only Unix strips
 /// permissions; everywhere else the plan is recorded and ignored.
@@ -19,11 +50,6 @@ impl PermGuard {
         self.0.push((dir.to_path_buf(), mode));
     }
 
-    /// The queued `(path relative to base, mode)` pairs, for a sweep's input.
-    pub(crate) fn planned(&self, base: &Path) -> Vec<(String, u32)> {
-        self.0.iter().map(|(p, m)| (rel(base, p), *m)).collect()
-    }
-
     /// Apply every queued mode, deepest paths first.
     pub(crate) fn apply(&mut self) {
         let mut plan = std::mem::take(&mut self.0);
@@ -124,97 +150,22 @@ pub(crate) fn rows(pkgs: &[CrawledPackage]) -> Vec<Row> {
         .collect()
 }
 
-/// A crawled package as a row with its path relative to `base` (the sweep's
-/// tempdir), so the row is the same on every run.
-pub(crate) type RelRow = (String, String, Option<String>, String, String);
-
-pub(crate) fn rel(base: &Path, path: &Path) -> String {
-    match path.strip_prefix(base) {
-        Ok(rest) => rest.to_string_lossy().replace('\\', "/"),
-        Err(_) => format!("<abs>{}", path.display()),
-    }
-}
-
-pub(crate) fn rel_rows(base: &Path, pkgs: &[CrawledPackage]) -> Vec<RelRow> {
-    pkgs.iter().map(|p| rel_row(base, p)).collect()
-}
-
-fn rel_row(base: &Path, p: &CrawledPackage) -> RelRow {
-    (
-        p.name.clone(),
-        p.version.clone(),
-        p.namespace.clone(),
-        p.purl.clone(),
-        rel(base, &p.path),
-    )
-}
-
-/// A `find_by_purls` map as sorted [`RelRow`]s.
-pub(crate) fn rel_map_rows(
-    base: &Path,
+/// A `find_by_purls` map as sorted comparable rows.
+pub(crate) fn map_rows(
     map: &std::collections::HashMap<String, CrawledPackage>,
-) -> std::collections::BTreeMap<String, RelRow> {
+) -> std::collections::BTreeMap<String, Row> {
     map.iter()
-        .map(|(k, p)| (k.clone(), rel_row(base, p)))
+        .map(|(k, p)| {
+            (
+                k.clone(),
+                (
+                    p.name.clone(),
+                    p.version.clone(),
+                    p.namespace.clone(),
+                    p.purl.clone(),
+                    p.path.clone(),
+                ),
+            )
+        })
         .collect()
 }
-
-/// Every entry under `root` — path, kind, mode, file bytes, link target —
-/// as the input a sweep case records, so generator drift shows up as such.
-pub(crate) fn tree_listing(root: &Path) -> Vec<(String, String)> {
-    fn walk(base: &Path, dir: &Path, out: &mut Vec<(String, String)>) {
-        let Ok(entries) = std::fs::read_dir(dir) else {
-            return;
-        };
-        for entry in entries.flatten() {
-            let path = entry.path();
-            let Ok(meta) = std::fs::symlink_metadata(&path) else {
-                continue;
-            };
-            #[cfg(unix)]
-            let mode = {
-                use std::os::unix::fs::PermissionsExt as _;
-                meta.permissions().mode() & 0o7777
-            };
-            #[cfg(not(unix))]
-            let mode = 0;
-            let what = if meta.file_type().is_symlink() {
-                let target = std::fs::read_link(&path).unwrap_or_default();
-                format!("link {mode:o} {}", rel(base, &target))
-            } else if meta.is_dir() {
-                format!("dir {mode:o}")
-            } else if meta.is_file() {
-                // Generators may write the tempdir's own path into a file.
-                let text = String::from_utf8_lossy(&std::fs::read(&path).unwrap_or_default())
-                    .replace(&*base.to_string_lossy(), "<base>");
-                format!("file {mode:o} {}", crate::golden::digest(&text))
-            } else {
-                format!("other {mode:o}")
-            };
-            out.push((rel(base, &path), what));
-            if meta.is_dir() && !meta.file_type().is_symlink() {
-                walk(base, &path, out);
-            }
-        }
-    }
-    let mut out = Vec::new();
-    walk(root, root, &mut out);
-    out.sort();
-    out
-}
-
-/// Whether this run can replay a crawler golden: they were blessed on Linux
-/// (case-sensitive, symlinks), and a sweep that strips permissions as a
-/// non-root user, where the stripped modes are honored.
-pub(crate) fn crawl_goldens_apply(strips_permissions: bool) -> bool {
-    #[cfg(target_os = "linux")]
-    {
-        // SAFETY: geteuid has no preconditions.
-        !strips_permissions || unsafe { libc::geteuid() != 0 }
-    }
-    #[cfg(not(target_os = "linux"))]
-    {
-        let _ = strips_permissions;
-        false
-    }
-}
diff --git a/crates/socket-patch-core/src/crawlers/python_crawler.rs b/crates/socket-patch-core/src/crawlers/python_crawler.rs
index a475a1603..03814ab23 100644
--- a/crates/socket-patch-core/src/crawlers/python_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/python_crawler.rs
@@ -8,6 +8,9 @@ use crate::utils::fs::{
 };
 use crate::utils::process::{CommandRunner, SystemCommandRunner};
 
+#[cfg(test)]
+mod oracle;
+
 // ---------------------------------------------------------------------------
 // Python command discovery
 // ---------------------------------------------------------------------------
@@ -2729,16 +2732,14 @@ mod tests {
         assert!(!result.contains_key("pkg:pypi/flask@3.0.0"));
     }
 
-    // ── Seeded site-packages, pinned by golden ───────────────────────
+    // ── Equivalence with the per-call async scan (oracle) ─────────────
 
-    mod sweep {
+    mod equivalence {
+        use super::super::oracle::{self, LegacyPythonCrawler};
         use super::*;
-        use crate::crawlers::test_tree::{
-            crawl_goldens_apply, fifo, mkdir, rel_map_rows, rel_rows, rows, symlink, tree_listing,
-            write, write_bytes, PermGuard,
+        use crate::crawlers::oracle_support::{
+            fifo, map_rows, mkdir, rows, symlink, write, write_bytes, PermGuard, Rng,
         };
-        use crate::golden::Golden;
-        use crate::test_rng::Rng;
 
         const NAMES: &[&str] = &["requests", "Flask_Cors", "zope.interface", "dup", "Dup"];
         const VERSIONS: &[&str] = &["1.0", "2.31.0", "1.0+local", "3.0a1"];
@@ -2782,30 +2783,31 @@ mod tests {
         }
 
         #[tokio::test]
-        async fn randomized_site_packages_match_golden() {
+        async fn randomized_site_packages_match_the_async_oracle() {
             let (mut crawled, mut found) = (0, 0);
-            let mut g = Golden::new(
-                "crawl_python_site_packages",
-                "One seeded site-packages: the dist-info listing, crawl_all, find_by_purls and find_each_by_purl.",
-            );
             for seed in 0..64u64 {
                 let tmp = tempfile::tempdir().unwrap();
                 let mut perms = PermGuard::default();
                 let mut rng = Rng::new(seed);
                 let root = tmp.path().join("site-packages");
                 site(&mut rng, &root, &tmp.path().join("outside"), &mut perms);
-                let input = (tree_listing(tmp.path()), perms.planned(tmp.path()));
                 perms.apply();
 
-                let listing = list_dist_info_packages(&root).await;
+                assert_eq!(
+                    list_dist_info_packages(&root).await,
+                    oracle::list_dist_info_packages(&root).await,
+                    "seed {seed}: listing"
+                );
                 let options = CrawlerOptions {
                     cwd: tmp.path().to_path_buf(),
                     global: false,
                     global_prefix: Some(root.clone()),
                 };
                 let new = PythonCrawler::new().crawl_all(&options).await;
+                let old = LegacyPythonCrawler::crawl_all(&options).await;
+                assert_eq!(rows(&new), rows(&old), "seed {seed}: crawl_all");
 
-                let mut purls: Vec<String> = new.iter().map(|p| p.purl.clone()).collect();
+                let mut purls: Vec<String> = old.iter().map(|p| p.purl.clone()).collect();
                 purls.push("pkg:pypi/Flask-Cors@1.0".to_string());
                 purls.push("pkg:pypi/requests@1.0%2Blocal".to_string());
                 purls.push("pkg:pypi/DUP@1.0".to_string());
@@ -2815,47 +2817,26 @@ mod tests {
                     .find_by_purls(&root, &purls)
                     .await
                     .unwrap();
-                // Each PURL on its own, from one listing, answers as a
-                // one-PURL lookup would.
+                let found_old = LegacyPythonCrawler::find_by_purls(&root, &purls).await;
+                assert_eq!(map_rows(&found_new), map_rows(&found_old));
+                // Each PURL on its own, from one listing.
                 let each = PythonCrawler::new().find_each_by_purl(&root, &purls).await;
                 for (purl, got) in purls.iter().zip(&each) {
-                    let single = PythonCrawler::new()
-                        .find_by_purls(&root, std::slice::from_ref(purl))
-                        .await
-                        .unwrap();
+                    let single =
+                        LegacyPythonCrawler::find_by_purls(&root, std::slice::from_ref(purl)).await;
                     assert_eq!(
                         got.as_ref().map(|p| rows(std::slice::from_ref(p))),
                         single.get(purl).map(|p| rows(std::slice::from_ref(p))),
                         "seed {seed}: find_each_by_purl {purl}"
                     );
                 }
-                let each_rows: Vec<_> = each
-                    .iter()
-                    .map(|p| {
-                        p.as_ref()
-                            .map(|p| rel_rows(tmp.path(), std::slice::from_ref(p)))
-                    })
-                    .collect();
-                g.case(
-                    seed,
-                    &input,
-                    &(
-                        &listing,
-                        rel_rows(tmp.path(), &new),
-                        rel_map_rows(tmp.path(), &found_new),
-                        each_rows,
-                    ),
-                );
-                crawled += new.len();
+                crawled += old.len();
                 found += found_new.len();
             }
             assert!(
                 crawled > 100 && found > 100,
                 "vacuous fixtures: {crawled}/{found}"
             );
-            if crawl_goldens_apply(true) {
-                g.finish();
-            }
         }
     }
 
diff --git a/crates/socket-patch-core/src/crawlers/python_crawler/oracle.rs b/crates/socket-patch-core/src/crawlers/python_crawler/oracle.rs
new file mode 100644
index 000000000..4aab29ea4
--- /dev/null
+++ b/crates/socket-patch-core/src/crawlers/python_crawler/oracle.rs
@@ -0,0 +1,96 @@
+//! The pre-blocking-pool (one tokio hop per readdir/stat/read)
+//! `site-packages` scan, kept verbatim as the equivalence oracle for the
+//! parallel scan in the parent module. Test-only; never compiled into the
+//! binary.
+
+use std::collections::{HashMap, HashSet};
+use std::path::Path;
+
+use super::{canonicalize_pypi_name, read_python_metadata, PythonCrawler};
+use crate::crawlers::types::{CrawledPackage, CrawlerOptions};
+
+pub(super) struct LegacyPythonCrawler;
+
+impl LegacyPythonCrawler {
+    pub(super) async fn crawl_all(options: &CrawlerOptions) -> Vec<CrawledPackage> {
+        let mut packages = Vec::new();
+        let mut seen = HashSet::new();
+
+        let sp_paths = PythonCrawler::new()
+            .get_site_packages_paths(options)
+            .await
+            .unwrap_or_default();
+
+        for sp_path in &sp_paths {
+            for (name, version) in list_dist_info_packages(sp_path).await {
+                let purl = format!("pkg:pypi/{name}@{version}");
+                if !seen.insert(purl.clone()) {
+                    continue;
+                }
+                packages.push(CrawledPackage {
+                    name,
+                    version,
+                    namespace: None,
+                    purl,
+                    path: sp_path.clone(),
+                });
+            }
+        }
+
+        packages
+    }
+
+    pub(super) async fn find_by_purls(
+        site_packages_path: &Path,
+        purls: &[String],
+    ) -> HashMap<String, CrawledPackage> {
+        let mut result = HashMap::new();
+
+        let mut purl_lookup: HashMap<String, &str> = HashMap::new();
+        for purl in purls {
+            if let Some((name, version)) = crate::utils::purl::parse_pypi_purl(purl) {
+                let key = format!("{}@{}", canonicalize_pypi_name(&name), version);
+                purl_lookup.insert(key, purl.as_str());
+            }
+        }
+
+        if purl_lookup.is_empty() {
+            return result;
+        }
+
+        for (name, version) in list_dist_info_packages(site_packages_path).await {
+            let key = format!("{name}@{version}");
+            if let Some(&matched_purl) = purl_lookup.get(&key) {
+                result.insert(
+                    matched_purl.to_string(),
+                    CrawledPackage {
+                        name,
+                        version,
+                        namespace: None,
+                        purl: matched_purl.to_string(),
+                        path: site_packages_path.to_path_buf(),
+                    },
+                );
+            }
+        }
+
+        result
+    }
+}
+
+/// The old per-entry async `list_dist_info_packages`.
+pub(super) async fn list_dist_info_packages(site_packages_path: &Path) -> Vec<(String, String)> {
+    let mut out = Vec::new();
+    for entry in crate::utils::fs::list_dir_entries(site_packages_path).await {
+        let name = entry.file_name();
+        let name_str = name.to_string_lossy();
+        if !name_str.ends_with(".dist-info") {
+            continue;
+        }
+        let dist_info_path = site_packages_path.join(&*name_str);
+        if let Some((raw_name, version)) = read_python_metadata(&dist_info_path).await {
+            out.push((canonicalize_pypi_name(&raw_name), version));
+        }
+    }
+    out
+}
diff --git a/crates/socket-patch-core/src/crawlers/ruby_crawler.rs b/crates/socket-patch-core/src/crawlers/ruby_crawler.rs
index 9ab81569f..8c2a1744e 100644
--- a/crates/socket-patch-core/src/crawlers/ruby_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/ruby_crawler.rs
@@ -2815,8 +2815,7 @@ mod tests {
 
     #[tokio::test]
     async fn find_each_by_purl_matches_per_purl_find_by_purls() {
-        use crate::crawlers::test_tree::{mkdir, symlink, write, PermGuard};
-        use crate::test_rng::Rng;
+        use crate::crawlers::oracle_support::{mkdir, symlink, write, PermGuard, Rng};
 
         const GEMS: &[&str] = &["rails", "nokogiri", "rack", "rails-html"];
         const VERSIONS: &[&str] = &["7.1.0", "1.16.5", "3.0.0"];
diff --git a/crates/socket-patch-core/src/vex/verify.rs b/crates/socket-patch-core/src/vex/verify.rs
index e594c44e0..3227b7e27 100644
--- a/crates/socket-patch-core/src/vex/verify.rs
+++ b/crates/socket-patch-core/src/vex/verify.rs
@@ -1754,8 +1754,7 @@ mod tests {
 
     #[tokio::test]
     async fn judge_installed_record_matches_verify_and_evidence_scan() {
-        use crate::crawlers::test_tree::{fifo, mkdir, write};
-        use crate::test_rng::Rng;
+        use crate::crawlers::oracle_support::{fifo, mkdir, write, Rng};
 
         let patched = compute_git_sha256_from_bytes(b"patched");
         let upstream = compute_git_sha256_from_bytes(b"upstream");
diff --git a/crates/socket-patch-core/tests/equivalence/crawl_cargo_sources.golden b/crates/socket-patch-core/tests/equivalence/crawl_cargo_sources.golden
deleted file mode 100644
index fbf194271..000000000
--- a/crates/socket-patch-core/tests/equivalence/crawl_cargo_sources.golden
+++ /dev/null
@@ -1,66 +0,0 @@
-# One seeded crate source tree, crawled.
-# <case> <input digest> <output digest>
-0 0789b0fe8b73ff39 26407d0bc68ec44f
-1 8bac33558d2e9c8a 1c6204aa67affd23
-2 334bc0a5ba5e0056 95fb19c76b6253b2
-3 ed9843cdccf5d2f5 ae8d5d10e962d0e5
-4 3a80295d499c52d1 42dac0066a840f62
-5 4e125142985d6dbb 4f53cda18c2baa0c
-6 1d11cc4b9ea1dc0d 4f4c3c5a87ddbf8a
-7 3a8cdd959d248d21 e4e1bd3d1c0dcafc
-8 0e54a4ca2380d229 ec72075a9aa2f2ff
-9 7dd7687e80d48f22 5b07dbbd4d12dea8
-10 1c2a95c1dcc301b2 83cdac95f0d5fbe5
-11 fce2a9624e41d8e4 2e11a56c24d2a20f
-12 429f723ce8e5a3bd 9e7381a2686cbe42
-13 50f887399b68e021 8e835d8347df9a85
-14 abdc31e79f3b17b2 7cdf2e446f7df102
-15 b6b6d92bfbe487b1 932027f62b0faae7
-16 5203efc6092a4f49 1b8a15f18f4f512d
-17 0b66e5dc06bb2db3 70abd289095a42c0
-18 e9940f05110f39de a78cf316bac0eefb
-19 40a040eef2a66e72 19da56940c131faf
-20 c67bd7f2dc3c5abf 7eccc6a15afb7dd4
-21 ad0111618920c3be b991cb2f8d95107a
-22 8613465a2a5b00b0 271162fec3450d38
-23 7c4227f4c13d9cdb b790937907a0a884
-24 d9ee84bc98d5c20c de7dbb8f9f7df675
-25 0f810904ad2b699a 21aaa408e25a9f70
-26 fe27fb2b759ee457 690d94cc02b1c57b
-27 a5531d9628b39668 4675c971e48988c9
-28 6832492e0914c1df 2b6d084c9fa89f0e
-29 0d36ad3df7134460 6bcee1ce2cb1c5b4
-30 85b1ec5ebe8de0e6 f5e92dbd85e88e4a
-31 1c9fde0f9c823576 02bbd127070319f0
-32 092e40669b384b51 60ec706237b1b295
-33 4bf3e8e64b011eb7 c7e09e300f6c1c68
-34 ec210082c86d62f5 4a50eed552242ab3
-35 b390dd445a292a53 93d66ea9d9d7e1c5
-36 2c1f6008abadfd74 09471d64aac5a7be
-37 a971203608212569 a02305d78a3ba2c0
-38 3f5b96371387fddc 5c521fb090047b81
-39 2b064398698adfa2 a32181ccbe73d0bd
-40 aec74fa566406c8a 8b90b6b7308dc8c6
-41 1153d86dfc58efb8 81a9fe3cf62777f9
-42 06186b908205f06b 4b2d7bc4f02fa53d
-43 5aff639d08feb168 b42d8bce860dc1b4
-44 8bf60977ce4a90ad aecf0be7223e9559
-45 e5e367cf4e4c30bb 183174b984fad6eb
-46 2ef905ea70d3c74f 7f7b5ac489348046
-47 5953f2b486633801 f01725d6c91e9397
-48 d7a37c8ea8b08c98 4f53cda18c2baa0c
-49 a143f7b3b011c6fd 35159302f163c290
-50 c83513d4747c1154 ca560c122aa1d9a2
-51 b0d4bf4641ac2026 bde1d5d64ec04489
-52 674927cd33943bfb 43ec5342779e682f
-53 9080a3f0502d620e 618fd9f82adbc40f
-54 54d4a010e58a81a0 587fed7b06512843
-55 c512ebe218d497cf b42d8bce860dc1b4
-56 4f122e1df4dc5d91 08c09ce10b8fd1ab
-57 71e1c312c060b652 2946402fb230caa5
-58 c86ddcfede19c23e 4f53cda18c2baa0c
-59 25e239384415c870 938e97cb0010242f
-60 e1bd11aa60296f0a 5e6421bf4400360e
-61 556b26b148d45ece 1155e51f7d4cf976
-62 d1f951b1df677147 6598c35bd955be15
-63 c86ddcfede19c23e 4f53cda18c2baa0c
diff --git a/crates/socket-patch-core/tests/equivalence/crawl_cargo_vendor.golden b/crates/socket-patch-core/tests/equivalence/crawl_cargo_vendor.golden
deleted file mode 100644
index 2060c02b6..000000000
--- a/crates/socket-patch-core/tests/equivalence/crawl_cargo_vendor.golden
+++ /dev/null
@@ -1,3 +0,0 @@
-# A seeded Cargo project vendor/ tree, crawled locally.
-# <case> <input digest> <output digest>
-7 a815ebc03ce3ff32 3cb969673348ada9
diff --git a/crates/socket-patch-core/tests/equivalence/crawl_composer_vendor.golden b/crates/socket-patch-core/tests/equivalence/crawl_composer_vendor.golden
deleted file mode 100644
index 0f540b5c6..000000000
--- a/crates/socket-patch-core/tests/equivalence/crawl_composer_vendor.golden
+++ /dev/null
@@ -1,66 +0,0 @@
-# One seeded vendor/composer tree: crawl_all, then find_by_purls.
-# <case> <input digest> <output digest>
-0 481ee51952ffe8dc 23ee912aa8ee0590
-1 27509876a53013ca f5cfd2c59c23469b
-2 bd5be17b059039a5 3987f0890a3ec641
-3 86453c294c4f9c99 2081bed25e05ae17
-4 3720aab1955f47ce b8f25b20ecb3409f
-5 85d8f5e067d99b6c 6b25fcd85bbb1433
-6 9b83c4e955737a81 11759140a0efd967
-7 cf8ab23dbaec622a bca2667df0003231
-8 3c42accbb09dd278 35332e95e2bed8a3
-9 0db6aa6600b9357f 10a4beead0128ce6
-10 81f5c24a4fc44a9a 3c516ad10b7bdeef
-11 3f434a118dc59d0a b239673923670c96
-12 6119ea4e4da0228a 5eed25f9aa1c6813
-13 f80159f839dd2fc7 c9837778da4dbbe7
-14 3570e2e9003ca1a5 863955e31c1a9bd9
-15 5d8b9d6475bcd81c f08502a70190fb06
-16 a3b70f7a2c9fdb7c bf47bbb8c8d108f4
-17 a229a6dbc1567436 eb4a332864b1cd1d
-18 a1f6345d930155ad ae98db734423df60
-19 99bb5b30993fdbf8 11e9eda7d6b2cd42
-20 131f2d6a2dc1af9a d097456cc89f52cd
-21 12eebac61ad8ae13 2a219b6ce8a6de9d
-22 0c9a06f215eac815 4772996b67bc47ee
-23 e0f36e5724c4fb1d 88251caf97a1c1d4
-24 0f7e0776633c49c1 59ebe69baf1858b6
-25 c468482bc9609750 adcd2213921370d3
-26 f30333ab141b9a00 6b4ff2abfeb1cebb
-27 ce71fb28c4d3615b 89ea06f0d32e6d30
-28 e254ce011dd6da66 71d95338d2b8a58e
-29 7a0955d1bee8f873 5eed25f9aa1c6813
-30 727a63507e938cc2 a9c3a7259f18a266
-31 d9779f1f2851771d 5eed25f9aa1c6813
-32 128f30148c0558fa a4e55a181be914e9
-33 61ca773f3c054e9b 1ab87b7c322707e3
-34 06fe2ec9fc3bf501 d33b8fa533247d93
-35 1a34b1bd4e469182 b30be1ffa61304cf
-36 8bbd9fc3e83d9407 5eed25f9aa1c6813
-37 e2fe845fbb4c290d 428a34dc27031df6
-38 c74d445edcf070cb 6d72e0d5dab5184a
-39 77dca03d65926964 e9e4ce73d722162e
-40 fbc66261e0c10d53 5eed25f9aa1c6813
-41 4ae2a78ca42d0ce4 ec579eb182f1396a
-42 b2e6ea2a7a8c52bc 063a130d58371e62
-43 0232d7bb196cc1b3 0895447b7cbdfd1e
-44 fa6b981e90a5572e 2f66b04582d2032f
-45 a294d01ec0ba8123 a08c74681bd99240
-46 eb9588b645aecf1f 46825b82fd7f7565
-47 237a52594c771ccf 4dfd3ababe9f0b10
-48 6544ab8f35963a3f a122194b5da3390c
-49 9531acad33a2345c e149928e30dcecfa
-50 a72a53201cf0da6e c6950f2efafad17a
-51 1fbfc38110d4ea4b 9c49d33a48bffbf1
-52 468b8f772dd06fcf f0dde94279624310
-53 01e076cf13883c93 4de1a998178a6d6c
-54 99b991038eb415fa 5eed25f9aa1c6813
-55 40b779cca6fcabd6 5eed25f9aa1c6813
-56 e671ec5361b7fab1 2d5e9efb8713dbdd
-57 4d17a695c60bcf12 af7cc3cf949dcf13
-58 7a0955d1bee8f873 5eed25f9aa1c6813
-59 7a0955d1bee8f873 5eed25f9aa1c6813
-60 d3ae9f865ec4b638 ea2d4b73350194b8
-61 42fd3da563789da5 5164e7f6f430a622
-62 5926efccfc90678a 5eed25f9aa1c6813
-63 1e34e88cfa154309 bad6fbdd33aafef3
diff --git a/crates/socket-patch-core/tests/equivalence/crawl_go_absent_root.golden b/crates/socket-patch-core/tests/equivalence/crawl_go_absent_root.golden
deleted file mode 100644
index 0deb8c207..000000000
--- a/crates/socket-patch-core/tests/equivalence/crawl_go_absent_root.golden
+++ /dev/null
@@ -1,3 +0,0 @@
-# An absent GOMODCACHE root.
-# <case> <input digest> <output digest>
-absent_root 74234e98afe7498f 5eed25f9aa1c6813
diff --git a/crates/socket-patch-core/tests/equivalence/crawl_go_module_cache.golden b/crates/socket-patch-core/tests/equivalence/crawl_go_module_cache.golden
deleted file mode 100644
index e3219fb42..000000000
--- a/crates/socket-patch-core/tests/equivalence/crawl_go_module_cache.golden
+++ /dev/null
@@ -1,50 +0,0 @@
-# One seeded GOMODCACHE tree: crawl_all, then find_by_purls.
-# <case> <input digest> <output digest>
-seed_0 09dc43c2bd39e22f 5eed25f9aa1c6813
-seed_1 00772a0786c4f36a 5eed25f9aa1c6813
-seed_2 e1509a6dfaeb9d05 619799f8074ddd2e
-seed_3 d70377a81b173ac6 6efa72d795922324
-seed_4 c7c8df366af126d5 8287e2010e95b57a
-seed_5 293d9b53851181fc 79d8bcb340b3a6e0
-seed_6 3b35080f289a936f 5eed25f9aa1c6813
-seed_7 d30e64fe21a8b734 82c8498a74955ed8
-seed_8 1c3ecb63d8547fa6 c77270617c92afde
-seed_9 6ef37162cf4a9866 ac48d04966a2fe4a
-seed_10 00772a0786c4f36a 5eed25f9aa1c6813
-seed_11 217c77d756638d79 563b76b1f6ef7fb9
-seed_12 d17d424e043f6cf0 5eed25f9aa1c6813
-seed_13 c22a392f48d0cb5a b834592fa44e36fb
-seed_14 76c86c0677f93138 5224fd044a742e29
-seed_15 294f44ea2c246e7c e35b3c196c32933b
-seed_16 279643999c89b149 680b0ad0add4f786
-seed_17 75c24791e38b2505 9d81a409eb191f76
-seed_18 00772a0786c4f36a 5eed25f9aa1c6813
-seed_19 5679325c7877931f 5eed25f9aa1c6813
-seed_20 b945a5ad20fef508 4721164372d3867a
-seed_21 d966f4c16ae89283 7a7c9305f573dfcf
-seed_22 4ba673f6c1ffc0fc 4503e988627f2258
-seed_23 0895264a85e189cb 0a7b2e12f26935d0
-seed_24 00772a0786c4f36a 5eed25f9aa1c6813
-seed_25 00772a0786c4f36a 5eed25f9aa1c6813
-seed_26 a8bd6da0ecd79da3 30b42134e8432116
-seed_27 ad9a096c40156a09 a0447b566366142e
-seed_28 c558e9381eec8498 177ac34fd1f53863
-seed_29 b692ddc36361d23c 3cb2e0a7ededc924
-seed_30 d7e3db2a7601177f 5eed25f9aa1c6813
-seed_31 00772a0786c4f36a 5eed25f9aa1c6813
-seed_32 bd7288f41494818b 4709622ab336b624
-seed_33 b4d20d774545956e 2c7e345753062082
-seed_34 4a3cabc641101595 82c8498a74955ed8
-seed_35 e2a1cce0ad0e106b d07d7ee9c5dcf23a
-seed_36 00772a0786c4f36a 5eed25f9aa1c6813
-seed_37 9b0b0506e709a900 f44d704466afc919
-seed_38 c8eea4a77e6b5cfe e68639bf967e5bde
-seed_39 4f334c24c990696c 711a211f8450fbb4
-seed_40 d17d424e043f6cf0 5eed25f9aa1c6813
-seed_41 50c68eb563e66117 37769ceabaa50bef
-seed_42 75dc7908ca2a18a3 8102d0fe4af8ac84
-seed_43 3ce27d6fe36eecea 8435a1ad1d43a4b3
-seed_44 d30e64fe21a8b734 82c8498a74955ed8
-seed_45 97114e2e0ddb3ea6 69f0ffcc0e2397c9
-seed_46 fad4e893f24a9a20 5cb2d57e0c7b6e2b
-seed_47 1cea6d8c747a8291 7b64f1a0b048997e
diff --git a/crates/socket-patch-core/tests/equivalence/crawl_maven_consistent.golden b/crates/socket-patch-core/tests/equivalence/crawl_maven_consistent.golden
deleted file mode 100644
index 4b32801a1..000000000
--- a/crates/socket-patch-core/tests/equivalence/crawl_maven_consistent.golden
+++ /dev/null
@@ -1,66 +0,0 @@
-# One seeded ~/.m2 repository whose POMs agree with their dirs, crawled.
-# <case> <input digest> <output digest>
-0 83185147d1312c61 c27298d200b3dc0e
-1 3ae7d693d22a2bc4 4f53cda18c2baa0c
-2 6d5d0daf2c58c795 92e8c5c82527e482
-3 7882c3ee0e0577c8 9066b78e07521109
-4 184d09b2a9c71c1d 3251f4abb2b78a61
-5 55d474e3ffb547fe f043128a968499cd
-6 c9f5f5ee8be09506 611a683040dc53d1
-7 40d9fde22c82df2d a0346060bfe11d31
-8 5ed72b6859fb88cf c3d04a179319ec00
-9 1989d3ce6d60ccc8 53a58ed0288b0ead
-10 c1951452b4bea696 16453eca18438dbf
-11 c89f440d0033e327 ec17a49a388e3dc9
-12 dcd0dbf319356eaa fdab50efeee9816f
-13 f7664df72a4c7bff 02ec0aae539e7dec
-14 28ff5e5c3fa4168f ae256498106d1869
-15 a7cddacabbabbcc8 a1349576e333b951
-16 2b022dea196c0759 631514d669b583b6
-17 56481c19967eda63 67ed98779ef0094e
-18 3ae7d693d22a2bc4 4f53cda18c2baa0c
-19 d22982401d63c72f 5eae4d1326caa792
-20 4b6e0dc9f3273a89 1d4d63bf11b386fc
-21 2b90bb6b6b334f7f 1d0de1f3f7b16133
-22 f9fb106aca5b4abe 74c1c68a16f0f1e6
-23 7ab1eb3f97b4b205 f38bd759e63b6a04
-24 6e1b34117f644804 806682cc4e106046
-25 3ae7d693d22a2bc4 4f53cda18c2baa0c
-26 aee88a61f2440dbe 39d56051cb3bf3d9
-27 20eba6ee1b4c8a5c f8570186c608dfe0
-28 ecd34acbe2d9f61a 63a2cefb8d003327
-29 b9f82b40d0730e3a 152bafc06a1bc3f8
-30 333cc7bdf7764e14 e34675ebc50f1f4c
-31 34c4efc2186d4884 9a832c0f61089ea4
-32 67e1f3a54ab15478 76c1e5a74d52ff50
-33 cfda0865198f2cee 37499f6e20710bc9
-34 3da4180d551416ee e261f0ae7c2886f4
-35 b4c5060b4bf5e79a 2ef03f759bf644ad
-36 d9c3733f3e5ea710 7fe3696c1a2825ad
-37 166abb4840b02066 cb7dbd277f46cc1e
-38 cbdeca620e029c9e f5c39a7fecb7d967
-39 4c56ac7be8e6cce9 b578620afea9a905
-40 6e60a101a67bc65e f4a6a52cd1cb4874
-41 d86304526feee83b 35216dfdf9f41281
-42 837e7c80e830f846 72255ac587d2f3dd
-43 3113d81e4b804bbe 3b0dc70c5bf85a3b
-44 34b7036fe87982d8 51886e3c0da09cc3
-45 34682e1bb48d59fc 7aa48fc0a5a6ae76
-46 458da35494f15f79 48fe121af1f3b26c
-47 5f9fbd69acae51fd e0bbf43efef9b495
-48 d84adc28a627e49c e69ca7268c7538c2
-49 cb2f6dc03fb2e8ad 2caa518b926e9140
-50 91218a0318c84c33 542c79207bfcfab8
-51 0e2b582c1d294bba c349d1e525cc3fbb
-52 f7d27badc4ba3eec f931d8d02eec2153
-53 16705daea7213a94 36530719e0d429df
-54 c1929ddebf99ed81 efee665e3135a883
-55 6dd2cc4ce022d960 d4327690b20c733c
-56 6ed5305060283e6b 29e0dcc28f618d97
-57 45447e9dc92cade0 3af6a0a5dd177e65
-58 3ae7d693d22a2bc4 4f53cda18c2baa0c
-59 31993051ed82029e 7e6bbaf00c9433ba
-60 b7cd6723d50daa88 4a9e5e31b989bb3a
-61 8e6aab531a34d949 d48045c3756653dc
-62 f1496c0187c801ba 6c1ba12ad6e6052f
-63 b2e5c1f97b7da4c8 fdd406a1137ec3c0
diff --git a/crates/socket-patch-core/tests/equivalence/crawl_maven_misrooted.golden b/crates/socket-patch-core/tests/equivalence/crawl_maven_misrooted.golden
deleted file mode 100644
index d58503833..000000000
--- a/crates/socket-patch-core/tests/equivalence/crawl_maven_misrooted.golden
+++ /dev/null
@@ -1,357 +0,0 @@
-# One seeded ~/.m2 repository, crawled from a misplaced root.
-# <case> <input digest> <output digest>
-0/ 83185147d1312c61 a71304c85035417c
-0/repository/org 83185147d1312c61 8be53deb0d5b8a83
-0/repository/com 83185147d1312c61 e6a175052ff9b719
-0/repository/io 83185147d1312c61 d549186a0a371376
-0/repository/org/apache 83185147d1312c61 0f0825f5d1f4b700
-0/repository/com/google 83185147d1312c61 98064dc329ea4f04
-1/ 3ae7d693d22a2bc4 4f53cda18c2baa0c
-2/ 6d5d0daf2c58c795 3f501c3d7d4aa0a7
-2/repository/org 6d5d0daf2c58c795 2987bb8101517ad0
-2/repository/com 6d5d0daf2c58c795 4936683c859b18ae
-2/repository/io 6d5d0daf2c58c795 f681b96f337e64d0
-2/repository/org/apache 6d5d0daf2c58c795 ba1e19ac7c744bad
-2/repository/com/google 6d5d0daf2c58c795 4936683c859b18ae
-3/ 7882c3ee0e0577c8 fc06dce5178766dc
-3/repository/org 7882c3ee0e0577c8 db0460f62a7ff49c
-3/repository/com 7882c3ee0e0577c8 83f40b6ee567a416
-3/repository/io 7882c3ee0e0577c8 a4032586b953e8fd
-3/repository/org/apache 7882c3ee0e0577c8 9ed6e24533d903e5
-3/repository/com/google 7882c3ee0e0577c8 4674f14eb046f592
-4/ 184d09b2a9c71c1d fa9432f0ec915656
-4/repository/org 184d09b2a9c71c1d 88f6a59bcff150c8
-4/repository/com 184d09b2a9c71c1d 719b3014757e8a96
-4/repository/io 184d09b2a9c71c1d b53146816a67f697
-4/repository/org/apache 184d09b2a9c71c1d 211fac8876e484cf
-4/repository/com/google 184d09b2a9c71c1d 9d234653c04cb805
-5/ 55d474e3ffb547fe c80eee3f38836f1f
-5/repository/org 55d474e3ffb547fe b8d001c2b8f9c8b0
-5/repository/com 55d474e3ffb547fe d40ff808b713af79
-5/repository/io 55d474e3ffb547fe 16bbf52ab9465038
-5/repository/org/apache 55d474e3ffb547fe 75520f619fe067c0
-5/repository/com/google 55d474e3ffb547fe cb204ead909772db
-6/ c9f5f5ee8be09506 ea7c43fd9289085b
-6/repository/org c9f5f5ee8be09506 8147cd641759a00f
-6/repository/com c9f5f5ee8be09506 e52c2847409a3e86
-6/repository/io c9f5f5ee8be09506 ee32a06fc2bd9699
-6/repository/org/apache c9f5f5ee8be09506 7a1a7ec8298344df
-6/repository/com/google c9f5f5ee8be09506 696f5b2db94323d9
-7/ 40d9fde22c82df2d 0d7c3583ed62d137
-7/repository/org 40d9fde22c82df2d b5e4928bbceeebb1
-7/repository/com 40d9fde22c82df2d db60c32c4dc30dac
-7/repository/io 40d9fde22c82df2d 85c811a6814bdaf4
-7/repository/org/apache 40d9fde22c82df2d af72a76ea431c997
-7/repository/com/google 40d9fde22c82df2d 139185fc7b71cf5a
-8/ 5ed72b6859fb88cf 879f0c2ba500c813
-8/repository/org 5ed72b6859fb88cf 2da03ad46c7fc426
-8/repository/com 5ed72b6859fb88cf 158d805263fc0c65
-8/repository/io 5ed72b6859fb88cf ee6c0e4d39a4e279
-8/repository/org/apache 5ed72b6859fb88cf 93828b506baff47d
-8/repository/com/google 5ed72b6859fb88cf 0188e76580349c97
-9/ 1989d3ce6d60ccc8 5558be13299029b2
-9/repository/org 1989d3ce6d60ccc8 2b6e4b1286e9b600
-9/repository/com 1989d3ce6d60ccc8 c767da1e27822b78
-9/repository/io 1989d3ce6d60ccc8 45dde3fcdf7abd83
-9/repository/org/apache 1989d3ce6d60ccc8 99d05bfef6a3eec1
-9/repository/com/google 1989d3ce6d60ccc8 ccdf4b68fcd972d4
-10/ c1951452b4bea696 85fc00aa66d34c5f
-10/repository/org c1951452b4bea696 88197fe9d77578bf
-10/repository/com c1951452b4bea696 d1227d2c1fe65ce9
-10/repository/org/apache c1951452b4bea696 65df3c08604d6f6c
-10/repository/com/google c1951452b4bea696 bb3b73ca733e4fd3
-11/ c89f440d0033e327 c25d3c0cf1558716
-11/repository/org c89f440d0033e327 5f570eec669d4e03
-11/repository/com c89f440d0033e327 32042fe53a328f52
-11/repository/io c89f440d0033e327 7e692302141a7b6f
-11/repository/org/apache c89f440d0033e327 6c80335d07a02e76
-11/repository/com/google c89f440d0033e327 45b5c24acc80e4b2
-12/ dcd0dbf319356eaa b565822b197f0332
-12/repository/org dcd0dbf319356eaa 25266133c46b0df2
-12/repository/com dcd0dbf319356eaa 0f2094596889dd59
-12/repository/io dcd0dbf319356eaa 5ab41a117c0eaa23
-12/repository/org/apache dcd0dbf319356eaa 25266133c46b0df2
-12/repository/com/google dcd0dbf319356eaa aa80fceecc0220ca
-13/ f7664df72a4c7bff ef0b1cc104dab6ce
-13/repository/org f7664df72a4c7bff 6297d43fb8e3052d
-13/repository/com f7664df72a4c7bff 8bfe2e0695cd7b1c
-13/repository/io f7664df72a4c7bff 3fd8de76cb50314b
-13/repository/org/apache f7664df72a4c7bff 989a8b617fa4db56
-13/repository/com/google f7664df72a4c7bff 4169ba0a767f564a
-14/ 28ff5e5c3fa4168f 00a01c97323f3e1d
-14/repository/org 28ff5e5c3fa4168f f8b00e6bc927b366
-14/repository/com 28ff5e5c3fa4168f 266d52f552d17b6c
-14/repository/io 28ff5e5c3fa4168f 2bc110e78e754e40
-14/repository/org/apache 28ff5e5c3fa4168f 327348b9cae2ce58
-14/repository/com/google 28ff5e5c3fa4168f d78d795efc89cb8d
-15/ a7cddacabbabbcc8 8d22078fe0256c75
-15/repository/org a7cddacabbabbcc8 ee7d5b4bbcf81590
-15/repository/com a7cddacabbabbcc8 26eb419e633df174
-15/repository/io a7cddacabbabbcc8 a3d4f52ad169157d
-15/repository/org/apache a7cddacabbabbcc8 4d9dd798f648c0eb
-15/repository/com/google a7cddacabbabbcc8 517faa777350fab4
-16/ 2b022dea196c0759 5813f23d4a560667
-16/repository/org 2b022dea196c0759 6541795e3c9508a2
-16/repository/com 2b022dea196c0759 20e75af30aa9070c
-16/repository/io 2b022dea196c0759 36d75c74fbf84937
-16/repository/org/apache 2b022dea196c0759 0bb8e8d849c64583
-16/repository/com/google 2b022dea196c0759 f375dc3054f19999
-17/ 56481c19967eda63 3211ea46bdffedc1
-17/repository/org 56481c19967eda63 fc53bd7dff7b6553
-17/repository/com 56481c19967eda63 4f53cda18c2baa0c
-17/repository/io 56481c19967eda63 e1d6105b6705a88d
-17/repository/org/apache 56481c19967eda63 15432e01c8d11334
-17/repository/com/google 56481c19967eda63 4f53cda18c2baa0c
-18/ 3ae7d693d22a2bc4 4f53cda18c2baa0c
-19/ d22982401d63c72f 260ae2554c22843a
-19/repository/org d22982401d63c72f e31694c060810bc8
-19/repository/com d22982401d63c72f 98c3f8932c6af6ad
-19/repository/io d22982401d63c72f 8d2178a38389c045
-19/repository/org/apache d22982401d63c72f e31694c060810bc8
-19/repository/com/google d22982401d63c72f b5aecce8321464c5
-20/ 4b6e0dc9f3273a89 5cd451bba627e7ab
-20/repository/org 4b6e0dc9f3273a89 e2a168eb5d8b9367
-20/repository/com 4b6e0dc9f3273a89 ea9899706b5163d7
-20/repository/io 4b6e0dc9f3273a89 a2be4cebe49cb281
-20/repository/org/apache 4b6e0dc9f3273a89 09bd89df59e27687
-20/repository/com/google 4b6e0dc9f3273a89 d19b557eb168b3f3
-21/ 2b90bb6b6b334f7f 50cff148046ccc47
-21/repository/org 2b90bb6b6b334f7f 4ad58e3cd3c0c473
-21/repository/com 2b90bb6b6b334f7f 56a072ea97443f47
-21/repository/io 2b90bb6b6b334f7f a25ee8f9d6f00761
-21/repository/org/apache 2b90bb6b6b334f7f 4ad58e3cd3c0c473
-21/repository/com/google 2b90bb6b6b334f7f 8451e87e6b899f13
-22/ f9fb106aca5b4abe cfa45d2524492f9e
-22/repository/org f9fb106aca5b4abe a5fadba5add8aec1
-22/repository/com f9fb106aca5b4abe aad2df5bbf9ae28a
-22/repository/io f9fb106aca5b4abe 70dd3a9bbb6a5e62
-22/repository/org/apache f9fb106aca5b4abe 74d8d4007b48540b
-22/repository/com/google f9fb106aca5b4abe 2468fb7e6bfc4bfc
-23/ 7ab1eb3f97b4b205 b6055192d11532a4
-23/repository/org 7ab1eb3f97b4b205 0b0c9f81cc3453bf
-23/repository/com 7ab1eb3f97b4b205 964e6c7d70f23769
-23/repository/io 7ab1eb3f97b4b205 497dfc941da50f4a
-23/repository/org/apache 7ab1eb3f97b4b205 a8a87a4d945b401c
-23/repository/com/google 7ab1eb3f97b4b205 49980d320d5fc6b0
-24/ 6e1b34117f644804 bfa6a6778f7996de
-24/repository/org 6e1b34117f644804 b8f1296b857d981d
-24/repository/com 6e1b34117f644804 64d8153c379e8db5
-24/repository/io 6e1b34117f644804 42ced11487a4f43e
-24/repository/org/apache 6e1b34117f644804 cc41a238dff9d490
-24/repository/com/google 6e1b34117f644804 4132c43999e9d5d6
-25/ 3ae7d693d22a2bc4 4f53cda18c2baa0c
-26/ aee88a61f2440dbe bfc98950e2ff6f95
-26/repository/org aee88a61f2440dbe 4f53cda18c2baa0c
-26/repository/com aee88a61f2440dbe 008466e04349d1ac
-26/repository/org/apache aee88a61f2440dbe 4f53cda18c2baa0c
-26/repository/com/google aee88a61f2440dbe 488f70405d310bb7
-27/ 20eba6ee1b4c8a5c 517670e7b5486ec0
-27/repository/org 20eba6ee1b4c8a5c 4c5887c54d34b1d5
-27/repository/com 20eba6ee1b4c8a5c 1edaa0736638ed84
-27/repository/io 20eba6ee1b4c8a5c 22f8d5c6de070f19
-27/repository/org/apache 20eba6ee1b4c8a5c 707a8fef61845e66
-27/repository/com/google 20eba6ee1b4c8a5c e79649991c29ba5c
-28/ ecd34acbe2d9f61a 780b0257da62e1cb
-28/repository/org ecd34acbe2d9f61a 4ab53a2da4225100
-28/repository/com ecd34acbe2d9f61a 4ad4baf33da5ebc8
-28/repository/io ecd34acbe2d9f61a 83492b0e721c5659
-28/repository/org/apache ecd34acbe2d9f61a 0e0b8ff56fb77423
-28/repository/com/google ecd34acbe2d9f61a a971f93fea0c322c
-29/ b9f82b40d0730e3a 58fb7deabc1d25c7
-29/repository/io b9f82b40d0730e3a dc2cb0580f07669d
-30/ 333cc7bdf7764e14 69be247cc02cc775
-30/repository/org 333cc7bdf7764e14 d92b47d474e0ff3c
-30/repository/com 333cc7bdf7764e14 e00d719658a957e1
-30/repository/io 333cc7bdf7764e14 2990c0f6d2e3554b
-30/repository/org/apache 333cc7bdf7764e14 a6b35bb6a35446c7
-30/repository/com/google 333cc7bdf7764e14 8010b6e9239548a8
-31/ 34c4efc2186d4884 b60e80d12522d1bd
-31/repository/org 34c4efc2186d4884 cadc7e8cae342a21
-31/repository/com 34c4efc2186d4884 fb9bfa15f0e301c5
-31/repository/io 34c4efc2186d4884 09ee21a36f719298
-31/repository/org/apache 34c4efc2186d4884 f481f94ccfd4c1e5
-31/repository/com/google 34c4efc2186d4884 19d9a439234799c1
-32/ 67e1f3a54ab15478 de412c8d492e24a2
-32/repository/org 67e1f3a54ab15478 2d52e9caeb65f3d6
-32/repository/com 67e1f3a54ab15478 5281a0e8c04cbd40
-32/repository/io 67e1f3a54ab15478 f629f0580ad1ae6c
-32/repository/org/apache 67e1f3a54ab15478 2b4d4757962ffdd3
-32/repository/com/google 67e1f3a54ab15478 12604b5268fddc15
-33/ cfda0865198f2cee 35fddec816c2613d
-33/repository/org cfda0865198f2cee f21af7192c04efc0
-33/repository/com cfda0865198f2cee 1f4ab7ebedfd141b
-33/repository/io cfda0865198f2cee 7561d407effd17df
-33/repository/org/apache cfda0865198f2cee cdaf670b34429b5b
-33/repository/com/google cfda0865198f2cee fced9194c59f9347
-34/ 3da4180d551416ee 9e2cf4b26cce5036
-34/repository/org 3da4180d551416ee 88a4911a0fb52ccf
-34/repository/com 3da4180d551416ee 607ba0c14fe4c7fe
-34/repository/io 3da4180d551416ee 02752e0622d5ccc9
-34/repository/org/apache 3da4180d551416ee 9c6582cad449bb5b
-34/repository/com/google 3da4180d551416ee 9f11b123efc33af6
-35/ b4c5060b4bf5e79a 636e90de0a26bca9
-35/repository/org b4c5060b4bf5e79a b22728486ed404bf
-35/repository/com b4c5060b4bf5e79a a5518e136fab400e
-35/repository/io b4c5060b4bf5e79a 99059b326317540e
-35/repository/org/apache b4c5060b4bf5e79a e7a66eaabc426dde
-35/repository/com/google b4c5060b4bf5e79a 99d91e64704e1968
-36/ d9c3733f3e5ea710 75f35b17bea558aa
-36/repository/org d9c3733f3e5ea710 52629f7058e6e3d2
-36/repository/com d9c3733f3e5ea710 748a130317093d92
-36/repository/io d9c3733f3e5ea710 4b14ae2f88ff979d
-36/repository/org/apache d9c3733f3e5ea710 52629f7058e6e3d2
-36/repository/com/google d9c3733f3e5ea710 34f86376535b0813
-37/ 166abb4840b02066 3af95524a427f535
-37/repository/org 166abb4840b02066 c57b9f04fa3813f1
-37/repository/com 166abb4840b02066 2bb9897649e015b7
-37/repository/io 166abb4840b02066 b828271aa9a17731
-37/repository/org/apache 166abb4840b02066 2e360600483d0b19
-37/repository/com/google 166abb4840b02066 14576a20b438644d
-38/ cbdeca620e029c9e 8a9382fa8af7f368
-38/repository/org cbdeca620e029c9e 1ac4f4526eb7c44f
-38/repository/com cbdeca620e029c9e 4f53cda18c2baa0c
-38/repository/io cbdeca620e029c9e fc4d3052ba0640f8
-38/repository/org/apache cbdeca620e029c9e f434b09e3e034670
-38/repository/com/google cbdeca620e029c9e 4f53cda18c2baa0c
-39/ 4c56ac7be8e6cce9 2e648a04af4184fc
-39/repository/org 4c56ac7be8e6cce9 e5102c595b0b9927
-39/repository/com 4c56ac7be8e6cce9 55ffc202d3b7526a
-39/repository/io 4c56ac7be8e6cce9 e23216c9b5f269d5
-39/repository/org/apache 4c56ac7be8e6cce9 e569758edd22073b
-39/repository/com/google 4c56ac7be8e6cce9 40f0f8771f9ecd63
-40/ 6e60a101a67bc65e 60bdeb92249370b1
-40/repository/org 6e60a101a67bc65e b1bdf553a580e894
-40/repository/com 6e60a101a67bc65e 2df904e4b436b513
-40/repository/io 6e60a101a67bc65e 01949d14fdb95f66
-40/repository/org/apache 6e60a101a67bc65e 90bcb8412ce2d94f
-40/repository/com/google 6e60a101a67bc65e b084b99cbcbe6279
-41/ d86304526feee83b 35216dfdf9f41281
-41/repository/org d86304526feee83b 4f53cda18c2baa0c
-41/repository/io d86304526feee83b 35216dfdf9f41281
-41/repository/org/apache d86304526feee83b 4f53cda18c2baa0c
-42/ 837e7c80e830f846 518895e643927a7c
-42/repository/org 837e7c80e830f846 a8a940e6d8b7ddb6
-42/repository/com 837e7c80e830f846 9be2698cea6e3c34
-42/repository/io 837e7c80e830f846 4cdf9e14c320bf8d
-42/repository/org/apache 837e7c80e830f846 ecbd8e9a49ca7963
-42/repository/com/google 837e7c80e830f846 2d7b917cef12dc43
-43/ 3113d81e4b804bbe bd43767c8df590a7
-43/repository/org 3113d81e4b804bbe 6dfa14b0856a8b23
-43/repository/com 3113d81e4b804bbe b695f223c26cacba
-43/repository/io 3113d81e4b804bbe de8a971e80c014bf
-43/repository/org/apache 3113d81e4b804bbe 4959b0985dddf72b
-43/repository/com/google 3113d81e4b804bbe e492979f86550b99
-44/ 34b7036fe87982d8 969832c017dd2741
-44/repository/org 34b7036fe87982d8 4f53cda18c2baa0c
-44/repository/com 34b7036fe87982d8 4f53cda18c2baa0c
-44/repository/io 34b7036fe87982d8 0136a2841e08a759
-44/repository/org/apache 34b7036fe87982d8 4f53cda18c2baa0c
-44/repository/com/google 34b7036fe87982d8 4f53cda18c2baa0c
-45/ 34682e1bb48d59fc 5b92947be3a7594d
-45/repository/org 34682e1bb48d59fc 4e8098f4a223a8cb
-45/repository/com 34682e1bb48d59fc f623eceece1cca68
-45/repository/io 34682e1bb48d59fc 2e45c9703f790798
-45/repository/org/apache 34682e1bb48d59fc 4e8098f4a223a8cb
-45/repository/com/google 34682e1bb48d59fc e2bc666ba158f6e2
-46/ 458da35494f15f79 3c1fe2ed75756069
-46/repository/org 458da35494f15f79 5e9db7cdcda190c1
-46/repository/com 458da35494f15f79 eb0ae4b074542677
-46/repository/io 458da35494f15f79 4f53cda18c2baa0c
-46/repository/org/apache 458da35494f15f79 4e365fb29f3f2d46
-46/repository/com/google 458da35494f15f79 b1eb90878036f78c
-47/ 5f9fbd69acae51fd 22dd6297a05d74a3
-47/repository/org 5f9fbd69acae51fd 32fbd5276fbbceba
-47/repository/com 5f9fbd69acae51fd 9f6d0e5ab889a1d0
-47/repository/io 5f9fbd69acae51fd 4f53cda18c2baa0c
-47/repository/org/apache 5f9fbd69acae51fd cb81cd68d05a624a
-47/repository/com/google 5f9fbd69acae51fd 89750523973d719a
-48/ d84adc28a627e49c 3bad9d67d052be90
-48/repository/org d84adc28a627e49c d0d9025b393e8319
-48/repository/com d84adc28a627e49c b4b385819582bf1b
-48/repository/io d84adc28a627e49c 35216dfdf9f41281
-48/repository/org/apache d84adc28a627e49c 167e0d5197a9910f
-48/repository/com/google d84adc28a627e49c 832939faf8547b27
-49/ cb2f6dc03fb2e8ad 9868923c09faee3c
-49/repository/org cb2f6dc03fb2e8ad 7fa1c7567b9a99cf
-49/repository/com cb2f6dc03fb2e8ad a290677fd4b7e401
-49/repository/io cb2f6dc03fb2e8ad 4f53cda18c2baa0c
-49/repository/org/apache cb2f6dc03fb2e8ad 8ca9217a5e914a27
-49/repository/com/google cb2f6dc03fb2e8ad 32f4eceedb038380
-50/ 91218a0318c84c33 dcf050eff1d11ecc
-50/repository/org 91218a0318c84c33 f880fda94fe16b27
-50/repository/com 91218a0318c84c33 47ef8dd579883682
-50/repository/io 91218a0318c84c33 b39fdefa6000fa67
-50/repository/org/apache 91218a0318c84c33 6c5c7d9b2f404185
-50/repository/com/google 91218a0318c84c33 16c14b77db190d11
-51/ 0e2b582c1d294bba 051cecee24bc8f8a
-51/repository/org 0e2b582c1d294bba b9d7f249eb46b0e3
-51/repository/com 0e2b582c1d294bba 97e5d710e00e586f
-51/repository/io 0e2b582c1d294bba a422baa2def94db7
-51/repository/org/apache 0e2b582c1d294bba 596ecaaf1ca10ed8
-51/repository/com/google 0e2b582c1d294bba 3b7f6676b5b10d70
-52/ f7d27badc4ba3eec 2d1468be2e57bae5
-52/repository/org f7d27badc4ba3eec cd1233a10848c564
-52/repository/com f7d27badc4ba3eec ee632848925ebfdb
-52/repository/io f7d27badc4ba3eec 105c1dd8bec40412
-52/repository/org/apache f7d27badc4ba3eec cd1233a10848c564
-52/repository/com/google f7d27badc4ba3eec ee632848925ebfdb
-53/ 16705daea7213a94 16977e3caa0fa454
-53/repository/org 16705daea7213a94 33ab9ee916b4f645
-53/repository/com 16705daea7213a94 32d68356c4afe51e
-53/repository/io 16705daea7213a94 3a667530c7ef6120
-53/repository/org/apache 16705daea7213a94 f934392eadd3d7e3
-53/repository/com/google 16705daea7213a94 7eab7f0a3fb69bac
-54/ c1929ddebf99ed81 f0197ce125d81dff
-54/repository/org c1929ddebf99ed81 f4bbbb8e2be1ee18
-54/repository/com c1929ddebf99ed81 f708664485c0320e
-54/repository/io c1929ddebf99ed81 c47f976f27482541
-54/repository/org/apache c1929ddebf99ed81 371081c0e0dba54d
-54/repository/com/google c1929ddebf99ed81 11a0eed6acc32f44
-55/ 6dd2cc4ce022d960 258ccb6ddf0447eb
-55/repository/org 6dd2cc4ce022d960 63da2dded56f3d50
-55/repository/com 6dd2cc4ce022d960 5879ac1867ff615d
-55/repository/io 6dd2cc4ce022d960 9aeaa5ffab1c4afc
-55/repository/org/apache 6dd2cc4ce022d960 8e9046201a466b8a
-55/repository/com/google 6dd2cc4ce022d960 ed8e69468a009151
-56/ 6ed5305060283e6b a14a35d36b15ebff
-56/repository/org 6ed5305060283e6b 4757e759cb2bb8c2
-56/repository/com 6ed5305060283e6b e68adfc5993e9c25
-56/repository/io 6ed5305060283e6b 85c811a6814bdaf4
-56/repository/org/apache 6ed5305060283e6b abd7198e92fbce2e
-56/repository/com/google 6ed5305060283e6b 6ac2b789124d81ca
-57/ 45447e9dc92cade0 6a6c23a6b0729655
-57/repository/org 45447e9dc92cade0 35518a5ff40d9085
-57/repository/com 45447e9dc92cade0 70543d7138284a87
-57/repository/io 45447e9dc92cade0 c679134eb5812a71
-57/repository/org/apache 45447e9dc92cade0 b48383ee0af91cae
-57/repository/com/google 45447e9dc92cade0 46d0c049c2be7326
-58/ 3ae7d693d22a2bc4 4f53cda18c2baa0c
-59/ 31993051ed82029e 9b82fc8f671b2aef
-59/repository/org 31993051ed82029e 37d3a224198a1f09
-59/repository/com 31993051ed82029e d87f5919a76f7b48
-59/repository/org/apache 31993051ed82029e d9a51d50e62baf1a
-59/repository/com/google 31993051ed82029e 454c72696b8f8ce6
-60/ b7cd6723d50daa88 bc205b48358b4f94
-60/repository/org b7cd6723d50daa88 dde41ca18fe070e6
-60/repository/com b7cd6723d50daa88 1037e2b674257aaa
-60/repository/io b7cd6723d50daa88 ac3951cdfd8cdd5d
-60/repository/org/apache b7cd6723d50daa88 dde41ca18fe070e6
-60/repository/com/google b7cd6723d50daa88 59ff33a45ebd2c8e
-61/ 8e6aab531a34d949 5f5afa3fb079b526
-61/repository/org 8e6aab531a34d949 ffb701d8d7016bb9
-61/repository/com 8e6aab531a34d949 4b867e62ab6cada9
-61/repository/io 8e6aab531a34d949 aab2eddec4a28ddd
-61/repository/org/apache 8e6aab531a34d949 ffb701d8d7016bb9
-61/repository/com/google 8e6aab531a34d949 11251de57d7061d5
-62/ f1496c0187c801ba f6733d19c3289000
-62/repository/org f1496c0187c801ba 1d9771b71389dfc9
-62/repository/com f1496c0187c801ba 09b609e11c9be817
-62/repository/io f1496c0187c801ba e35706651dc1108d
-62/repository/org/apache f1496c0187c801ba 088bf01bf2579d5b
-62/repository/com/google f1496c0187c801ba c90792dc54c2b93b
-63/ b2e5c1f97b7da4c8 b634c5c1237cccfc
-63/repository/org b2e5c1f97b7da4c8 bba01dca9f951c91
-63/repository/com b2e5c1f97b7da4c8 b8d7a4239fa34964
-63/repository/io b2e5c1f97b7da4c8 74727eb3aba9f452
-63/repository/org/apache b2e5c1f97b7da4c8 8d3167d8afa17dd1
-63/repository/com/google b2e5c1f97b7da4c8 b8d7a4239fa34964
diff --git a/crates/socket-patch-core/tests/equivalence/crawl_maven_no_pool.golden b/crates/socket-patch-core/tests/equivalence/crawl_maven_no_pool.golden
deleted file mode 100644
index d072a0e4c..000000000
--- a/crates/socket-patch-core/tests/equivalence/crawl_maven_no_pool.golden
+++ /dev/null
@@ -1,18 +0,0 @@
-# One seeded ~/.m2 repository, crawled with no walk pool.
-# <case> <input digest> <output digest>
-0 5b5654a14f7365bb c7e1c0a57131c767
-1 3ae7d693d22a2bc4 4f53cda18c2baa0c
-2 ee48f75088974079 5301e71c28240cde
-3 7e7d77307da2ccbb cde58c16c037f5c9
-4 d98b379559cbee49 e689eedb5fdb6ea8
-5 317df3f5558ce26f 08704999b65006f3
-6 11a97846afdffab4 1e082cf6879ab372
-7 40d9fde22c82df2d a0346060bfe11d31
-8 ae42cfa775a23966 248f603a5f0ecb72
-9 91942a182e6f86f0 e6d4e6e5635dd32c
-10 c1951452b4bea696 16453eca18438dbf
-11 0a2d97ca91ac61e4 1accd4fc0d578579
-12 107f6a82d14cf8d0 37eafd42bf6225a3
-13 954630fc63779ed4 0eb6039d9e3a8952
-14 c0700cc52558dd7f 2a437d79c4fa7ed2
-15 6a626c3695e3e954 687ef5b00c0dd8b2
diff --git a/crates/socket-patch-core/tests/equivalence/crawl_maven_parse_chunks.golden b/crates/socket-patch-core/tests/equivalence/crawl_maven_parse_chunks.golden
deleted file mode 100644
index 412aa6be0..000000000
--- a/crates/socket-patch-core/tests/equivalence/crawl_maven_parse_chunks.golden
+++ /dev/null
@@ -1,98 +0,0 @@
-# One seeded ~/.m2 repository, scanned at one parse chunk size.
-# <case> <input digest> <output digest>
-0/0 5b5654a14f7365bb c7e1c0a57131c767
-0/1 5b5654a14f7365bb c7e1c0a57131c767
-0/2 5b5654a14f7365bb c7e1c0a57131c767
-0/3 5b5654a14f7365bb c7e1c0a57131c767
-0/7 5b5654a14f7365bb c7e1c0a57131c767
-0/4096 5b5654a14f7365bb c7e1c0a57131c767
-1/0 3ae7d693d22a2bc4 4f53cda18c2baa0c
-1/1 3ae7d693d22a2bc4 4f53cda18c2baa0c
-1/2 3ae7d693d22a2bc4 4f53cda18c2baa0c
-1/3 3ae7d693d22a2bc4 4f53cda18c2baa0c
-1/7 3ae7d693d22a2bc4 4f53cda18c2baa0c
-1/4096 3ae7d693d22a2bc4 4f53cda18c2baa0c
-2/0 ee48f75088974079 5301e71c28240cde
-2/1 ee48f75088974079 5301e71c28240cde
-2/2 ee48f75088974079 5301e71c28240cde
-2/3 ee48f75088974079 5301e71c28240cde
-2/7 ee48f75088974079 5301e71c28240cde
-2/4096 ee48f75088974079 5301e71c28240cde
-3/0 7e7d77307da2ccbb cde58c16c037f5c9
-3/1 7e7d77307da2ccbb cde58c16c037f5c9
-3/2 7e7d77307da2ccbb cde58c16c037f5c9
-3/3 7e7d77307da2ccbb cde58c16c037f5c9
-3/7 7e7d77307da2ccbb cde58c16c037f5c9
-3/4096 7e7d77307da2ccbb cde58c16c037f5c9
-4/0 d98b379559cbee49 e689eedb5fdb6ea8
-4/1 d98b379559cbee49 e689eedb5fdb6ea8
-4/2 d98b379559cbee49 e689eedb5fdb6ea8
-4/3 d98b379559cbee49 e689eedb5fdb6ea8
-4/7 d98b379559cbee49 e689eedb5fdb6ea8
-4/4096 d98b379559cbee49 e689eedb5fdb6ea8
-5/0 317df3f5558ce26f 08704999b65006f3
-5/1 317df3f5558ce26f 08704999b65006f3
-5/2 317df3f5558ce26f 08704999b65006f3
-5/3 317df3f5558ce26f 08704999b65006f3
-5/7 317df3f5558ce26f 08704999b65006f3
-5/4096 317df3f5558ce26f 08704999b65006f3
-6/0 11a97846afdffab4 1e082cf6879ab372
-6/1 11a97846afdffab4 1e082cf6879ab372
-6/2 11a97846afdffab4 1e082cf6879ab372
-6/3 11a97846afdffab4 1e082cf6879ab372
-6/7 11a97846afdffab4 1e082cf6879ab372
-6/4096 11a97846afdffab4 1e082cf6879ab372
-7/0 40d9fde22c82df2d a0346060bfe11d31
-7/1 40d9fde22c82df2d a0346060bfe11d31
-7/2 40d9fde22c82df2d a0346060bfe11d31
-7/3 40d9fde22c82df2d a0346060bfe11d31
-7/7 40d9fde22c82df2d a0346060bfe11d31
-7/4096 40d9fde22c82df2d a0346060bfe11d31
-8/0 ae42cfa775a23966 248f603a5f0ecb72
-8/1 ae42cfa775a23966 248f603a5f0ecb72
-8/2 ae42cfa775a23966 248f603a5f0ecb72
-8/3 ae42cfa775a23966 248f603a5f0ecb72
-8/7 ae42cfa775a23966 248f603a5f0ecb72
-8/4096 ae42cfa775a23966 248f603a5f0ecb72
-9/0 91942a182e6f86f0 e6d4e6e5635dd32c
-9/1 91942a182e6f86f0 e6d4e6e5635dd32c
-9/2 91942a182e6f86f0 e6d4e6e5635dd32c
-9/3 91942a182e6f86f0 e6d4e6e5635dd32c
-9/7 91942a182e6f86f0 e6d4e6e5635dd32c
-9/4096 91942a182e6f86f0 e6d4e6e5635dd32c
-10/0 c1951452b4bea696 16453eca18438dbf
-10/1 c1951452b4bea696 16453eca18438dbf
-10/2 c1951452b4bea696 16453eca18438dbf
-10/3 c1951452b4bea696 16453eca18438dbf
-10/7 c1951452b4bea696 16453eca18438dbf
-10/4096 c1951452b4bea696 16453eca18438dbf
-11/0 0a2d97ca91ac61e4 1accd4fc0d578579
-11/1 0a2d97ca91ac61e4 1accd4fc0d578579
-11/2 0a2d97ca91ac61e4 1accd4fc0d578579
-11/3 0a2d97ca91ac61e4 1accd4fc0d578579
-11/7 0a2d97ca91ac61e4 1accd4fc0d578579
-11/4096 0a2d97ca91ac61e4 1accd4fc0d578579
-12/0 107f6a82d14cf8d0 37eafd42bf6225a3
-12/1 107f6a82d14cf8d0 37eafd42bf6225a3
-12/2 107f6a82d14cf8d0 37eafd42bf6225a3
-12/3 107f6a82d14cf8d0 37eafd42bf6225a3
-12/7 107f6a82d14cf8d0 37eafd42bf6225a3
-12/4096 107f6a82d14cf8d0 37eafd42bf6225a3
-13/0 954630fc63779ed4 0eb6039d9e3a8952
-13/1 954630fc63779ed4 0eb6039d9e3a8952
-13/2 954630fc63779ed4 0eb6039d9e3a8952
-13/3 954630fc63779ed4 0eb6039d9e3a8952
-13/7 954630fc63779ed4 0eb6039d9e3a8952
-13/4096 954630fc63779ed4 0eb6039d9e3a8952
-14/0 c0700cc52558dd7f 2a437d79c4fa7ed2
-14/1 c0700cc52558dd7f 2a437d79c4fa7ed2
-14/2 c0700cc52558dd7f 2a437d79c4fa7ed2
-14/3 c0700cc52558dd7f 2a437d79c4fa7ed2
-14/7 c0700cc52558dd7f 2a437d79c4fa7ed2
-14/4096 c0700cc52558dd7f 2a437d79c4fa7ed2
-15/0 6a626c3695e3e954 687ef5b00c0dd8b2
-15/1 6a626c3695e3e954 687ef5b00c0dd8b2
-15/2 6a626c3695e3e954 687ef5b00c0dd8b2
-15/3 6a626c3695e3e954 687ef5b00c0dd8b2
-15/7 6a626c3695e3e954 687ef5b00c0dd8b2
-15/4096 6a626c3695e3e954 687ef5b00c0dd8b2
diff --git a/crates/socket-patch-core/tests/equivalence/crawl_maven_repos.golden b/crates/socket-patch-core/tests/equivalence/crawl_maven_repos.golden
deleted file mode 100644
index 76aaa8af7..000000000
--- a/crates/socket-patch-core/tests/equivalence/crawl_maven_repos.golden
+++ /dev/null
@@ -1,66 +0,0 @@
-# One seeded ~/.m2 repository, crawled.
-# <case> <input digest> <output digest>
-0 5b5654a14f7365bb c7e1c0a57131c767
-1 3ae7d693d22a2bc4 4f53cda18c2baa0c
-2 ee48f75088974079 5301e71c28240cde
-3 7e7d77307da2ccbb cde58c16c037f5c9
-4 d98b379559cbee49 e689eedb5fdb6ea8
-5 317df3f5558ce26f 08704999b65006f3
-6 11a97846afdffab4 1e082cf6879ab372
-7 40d9fde22c82df2d a0346060bfe11d31
-8 ae42cfa775a23966 248f603a5f0ecb72
-9 91942a182e6f86f0 e6d4e6e5635dd32c
-10 c1951452b4bea696 16453eca18438dbf
-11 0a2d97ca91ac61e4 1accd4fc0d578579
-12 107f6a82d14cf8d0 37eafd42bf6225a3
-13 954630fc63779ed4 0eb6039d9e3a8952
-14 c0700cc52558dd7f 2a437d79c4fa7ed2
-15 6a626c3695e3e954 687ef5b00c0dd8b2
-16 1a7e9e314c4af5af 697f54cd7726b65c
-17 56481c19967eda63 67ed98779ef0094e
-18 3ae7d693d22a2bc4 4f53cda18c2baa0c
-19 20210d2df560de82 aa7639a08098c8fd
-20 803a0fbd33a97439 1d4d63bf11b386fc
-21 6d3d1cef30d3ae73 340ab953f2951e59
-22 e579439e0feefa00 6f50304a47540681
-23 7ab1eb3f97b4b205 f38bd759e63b6a04
-24 4ea7f34c0b9236de bcba33bb0e6b26bf
-25 3ae7d693d22a2bc4 4f53cda18c2baa0c
-26 aee88a61f2440dbe 39d56051cb3bf3d9
-27 dcb76fc05f6c4f96 01a79cce28c17d13
-28 559271e56082798b 2ac797cd92ab556e
-29 b9f82b40d0730e3a 152bafc06a1bc3f8
-30 ef2c07d7f7f14721 e34675ebc50f1f4c
-31 9277538b0ca68ad9 9a832c0f61089ea4
-32 67e1f3a54ab15478 76c1e5a74d52ff50
-33 e8ad95ab962c10a9 37499f6e20710bc9
-34 7870de94ede7cb29 e261f0ae7c2886f4
-35 5cd929154d38e553 2ef03f759bf644ad
-36 8508a9663c02315e f4b4b054b07ac39f
-37 166abb4840b02066 cb7dbd277f46cc1e
-38 cbdeca620e029c9e f5c39a7fecb7d967
-39 c3126b7c5fc1b7f1 dfffaba76f1d3b06
-40 126c91c93ae6a280 b0a3c6e8d2a9e63d
-41 d86304526feee83b 35216dfdf9f41281
-42 837e7c80e830f846 72255ac587d2f3dd
-43 58e3727fdce896ad 19023fe778c318eb
-44 b9a55aa1fea0ebb8 51886e3c0da09cc3
-45 34682e1bb48d59fc 7aa48fc0a5a6ae76
-46 844110f591e06935 48fe121af1f3b26c
-47 70c91166bc4ede3c 02c33ee163a6dd96
-48 cc79c82b6b5a2fd3 4f134a8185ed741c
-49 69e48839abc4fd4b 0e1820b383ff90a1
-50 6c3cc6e6aed1c46a d32ee23b7e07ba8c
-51 5b6e8b24b02bee14 807ce06f3806e86b
-52 f7d27badc4ba3eec f931d8d02eec2153
-53 56db33e29e6a8aba ee50019e34d8d3d7
-54 130204b8b7d55365 1922164f817bfb76
-55 f785d74c4f308a92 8a6d5d0b588e6d15
-56 f08e499aff937dea 81cac89174f186c0
-57 969a8256e04f109a 703322284ffe7a3a
-58 3ae7d693d22a2bc4 4f53cda18c2baa0c
-59 31993051ed82029e 7e6bbaf00c9433ba
-60 14df89c190cdca14 898a9f15a3f2f41a
-61 f35e04ed656c9caf 9c28c739a5edf0bd
-62 0469139586a500e5 a5e78d233078f30a
-63 b2e5c1f97b7da4c8 fdd406a1137ec3c0
diff --git a/crates/socket-patch-core/tests/equivalence/crawl_npm_foreign_identity.golden b/crates/socket-patch-core/tests/equivalence/crawl_npm_foreign_identity.golden
deleted file mode 100644
index 6f819a925..000000000
--- a/crates/socket-patch-core/tests/equivalence/crawl_npm_foreign_identity.golden
+++ /dev/null
@@ -1,3 +0,0 @@
-# A pnpm store entry whose child names a foreign identity.
-# <case> <input digest> <output digest>
-0 ba28487ce0d2cf60 c5c151111ff2d527
diff --git a/crates/socket-patch-core/tests/equivalence/crawl_npm_kitchen_sink.golden b/crates/socket-patch-core/tests/equivalence/crawl_npm_kitchen_sink.golden
deleted file mode 100644
index 2ea93a8e6..000000000
--- a/crates/socket-patch-core/tests/equivalence/crawl_npm_kitchen_sink.golden
+++ /dev/null
@@ -1,3 +0,0 @@
-# A hand-built project tree with one of every tricky shape.
-# <case> <input digest> <output digest>
-0 008e2c070f7b2f08 2fc6b55231b85ae1
diff --git a/crates/socket-patch-core/tests/equivalence/crawl_npm_no_pool.golden b/crates/socket-patch-core/tests/equivalence/crawl_npm_no_pool.golden
deleted file mode 100644
index 40af4c7d4..000000000
--- a/crates/socket-patch-core/tests/equivalence/crawl_npm_no_pool.golden
+++ /dev/null
@@ -1,18 +0,0 @@
-# One seeded project tree, walked with no walk pool.
-# <case> <input digest> <output digest>
-0 9332dd1f4f3b1b5a 42a50cf96cfb1f93
-1 87f0231ea83751e5 9a7b731e9bc9302e
-2 325bedbaf0777e73 235643586618b8e6
-3 bec280310ecbaa49 3ce9b0814058bbc1
-4 71207105c5707828 5ae1625b488b3935
-5 7976073fca1abd2c 73b59f3c4a8c7f71
-6 73c8485afafbbc15 82655d71c989fd9e
-7 0826b0e516996d93 49b1abd2bb54c67e
-8 95c85184f2512021 aad4389f1a42210a
-9 5779eb343cdfbe0c 41371a72e1b32fcb
-10 e940aad08464f8c1 76d8debaa890f0d6
-11 954d051d92e7ec76 9627aec81df769d1
-12 2b97495c5ba2408a 5f0c8138f62257fc
-13 3e20ddb2daa13324 3b3e8a11a33ab72f
-14 57180066dc248df7 c369a3535442d8c8
-15 9a726d40880c7687 4c1d73af9ca8ad7e
diff --git a/crates/socket-patch-core/tests/equivalence/crawl_npm_trees.golden b/crates/socket-patch-core/tests/equivalence/crawl_npm_trees.golden
deleted file mode 100644
index a2b5ec199..000000000
--- a/crates/socket-patch-core/tests/equivalence/crawl_npm_trees.golden
+++ /dev/null
@@ -1,66 +0,0 @@
-# One seeded project tree: node_modules roots, crawl_all, find_by_purls and store listings.
-# <case> <input digest> <output digest>
-0 9332dd1f4f3b1b5a 42a50cf96cfb1f93
-1 87f0231ea83751e5 9a7b731e9bc9302e
-2 325bedbaf0777e73 235643586618b8e6
-3 bec280310ecbaa49 3ce9b0814058bbc1
-4 71207105c5707828 5ae1625b488b3935
-5 7976073fca1abd2c 73b59f3c4a8c7f71
-6 73c8485afafbbc15 82655d71c989fd9e
-7 0826b0e516996d93 49b1abd2bb54c67e
-8 95c85184f2512021 aad4389f1a42210a
-9 5779eb343cdfbe0c 41371a72e1b32fcb
-10 e940aad08464f8c1 76d8debaa890f0d6
-11 954d051d92e7ec76 9627aec81df769d1
-12 2b97495c5ba2408a 5f0c8138f62257fc
-13 3e20ddb2daa13324 3b3e8a11a33ab72f
-14 57180066dc248df7 c369a3535442d8c8
-15 9a726d40880c7687 4c1d73af9ca8ad7e
-16 ec40803a19fe496c 044587c7242ea8f4
-17 4b56b28914d9ae02 5ae1625b488b3935
-18 ead6918dac95eada cc6e150ed45d0502
-19 b2e88f4f8b020265 8cc585830b36bd2c
-20 1e0aed07d0286073 edd708f1ea326759
-21 75076a2c50864cc7 f2c5163578631080
-22 8ada91e69bf14cbd d890f6a8bca7f9f5
-23 9378572222695a01 5ae1625b488b3935
-24 33eddb513026f0d6 93051b96b0369514
-25 5ad5c432b8e9d1e9 035cc1d3229df742
-26 a2881647fcfd24ab 37193750dab63e2b
-27 85b5c79ce9ea9def 7b980a03d22f4733
-28 7fa1bb6dcd7a6b27 a6fef4d0403085ad
-29 ae980398fd035e11 0406b9335cf583e3
-30 164c4300a9475cf0 dd9bd5916b04bc09
-31 956c42f0c77d6406 64fb2bf619c3a873
-32 2cab3988ee1fa3bd 47b8ffbc2abeb7ae
-33 a28c48e5298d7a27 2a31c268899342d4
-34 a43320e49eee8007 64fa87cd24370217
-35 fc95ae83bd368052 5ae1625b488b3935
-36 4fbf5c8e27ef5bf1 9da5dcfa926f25d9
-37 eae8bd963b3c9b71 9442382403da0b4f
-38 341fa3590814bc17 2904ac711f04277b
-39 5cfd56f4ba53ccbf d9011f18b1c95a7d
-40 71207105c5707828 5ae1625b488b3935
-41 3ecf3a58e6e37f42 dc026dd4f088ed54
-42 fca4c0eb17dbeede 415342b0ea9e4f9d
-43 f79087f59560df61 5b23ba7782c47a57
-44 71207105c5707828 5ae1625b488b3935
-45 93f89af59050e022 e46fa8096b1b88ad
-46 8fbc2b78892e9d56 c22705acb08e924c
-47 d7850d919297b355 15882bcf35b80986
-48 93d8817d0718939a e7f6d6567b1cff18
-49 9060244769799b4b d26f0abefdf367f0
-50 8fe7013f64aab256 bfa9f22b3ee1c9db
-51 7228fe322169222f ccfd29c90be765d2
-52 b68f26cf2787440e 0eebe9711043ad2a
-53 ad70b8b14804c6d5 5ae1625b488b3935
-54 a31637fd6d8011d8 6e90a2b10778bc89
-55 0f711526b87fb5cd d6c4215fd15a9110
-56 71207105c5707828 5ae1625b488b3935
-57 a57aa4656ce7750e 5d72a89d7ce3e344
-58 6cfcbaaba6c2c14c bd7e05ac768d23ba
-59 51c7acfacde543e3 5ae1625b488b3935
-60 c6e68358c6fcafa5 47441e0e3efbd16a
-61 d378272354c7a3b4 5ae1625b488b3935
-62 81e72e06e6f4d422 02318419e13d92cb
-63 dc16be9eaf8be272 e3e9e309e9cec2f7
diff --git a/crates/socket-patch-core/tests/equivalence/crawl_nuget_legacy_fallback.golden b/crates/socket-patch-core/tests/equivalence/crawl_nuget_legacy_fallback.golden
deleted file mode 100644
index 4239d0367..000000000
--- a/crates/socket-patch-core/tests/equivalence/crawl_nuget_legacy_fallback.golden
+++ /dev/null
@@ -1,3 +0,0 @@
-# A legacy packages/ root probed by case-variant PURLs.
-# <case> <input digest> <output digest>
-0 36ae401955e34281 afcd4f7d169b9926
diff --git a/crates/socket-patch-core/tests/equivalence/crawl_nuget_packages.golden b/crates/socket-patch-core/tests/equivalence/crawl_nuget_packages.golden
deleted file mode 100644
index 0b5e0ced5..000000000
--- a/crates/socket-patch-core/tests/equivalence/crawl_nuget_packages.golden
+++ /dev/null
@@ -1,66 +0,0 @@
-# One seeded NuGet packages root: crawl_all, then find_by_purls.
-# <case> <input digest> <output digest>
-0 3ed5c68bfd238745 aad8979de1b2e503
-1 69aca2d82ac7fdf8 afa054faa29dfaa3
-2 22270f6d715524c1 2a98660a38e39f1e
-3 8a45ea040c012203 f7ad263cda326355
-4 d50c0fedf83f0ab1 d5dcd09017c194f8
-5 6e505aec00e47600 7c7a4da8741c771e
-6 b9ca5a9849f2a8d4 5eed25f9aa1c6813
-7 a5ee3b8f619bc4d1 cf27e7d683455f82
-8 551ac3f79e5c3484 b59dc2a7eee036cb
-9 5e7ec527fd679fd3 24cf5fb29b9983d3
-10 cac677008911f6f5 86aad81ad926fb3f
-11 7249e892a298cf34 4038050f3e3db2ac
-12 3c4ec8b8b14204a8 a29ab8b13b251bee
-13 0d063bd73d928425 dd1b9589155f9c1a
-14 75ae733cc6d5fb9a 2943ba0095ad1e5d
-15 efeda9556a8a553e cf3f759216372ae0
-16 6f86dc2f3fbd887d 45a8ef5f4991acb7
-17 71524ffec2f0163a 717cf21307145b30
-18 e4f31dcf05599c40 5eed25f9aa1c6813
-19 e05e0775945ff4f0 f4cb530d3ca447a9
-20 78d23fd67bfbc949 611a1919df025a84
-21 01e8261b5135bf05 8ea4e7912d815a92
-22 57655d43bfd313df 8c0921c8cf0bfd98
-23 3fc5b11684fbfd17 918dc654fcf8559f
-24 41faff7e584bb646 cea826e330ea4599
-25 53e16564fccccee1 5eed25f9aa1c6813
-26 572647525bfe1665 5eed25f9aa1c6813
-27 4456f55fe1089c71 a4c5674461db4473
-28 dff37130f2679566 17d19a0e527daeee
-29 beb8f92823e3479c d6ea0fa9422be99c
-30 0eab2dd35efe9a29 bbe9add2c1db81e5
-31 78fd6295fe3f58f2 01f1ec9a720940ce
-32 80f7021977fd6ec5 200aba7779ac75ee
-33 ec487d6badc02d68 ae5fb20fca28d7f3
-34 44b4b1927f52067b b56086bbd1bff829
-35 c3835d306801db2c 144d6962f78c694f
-36 fcaf05cf8ce9cdce 6b1ceda1182f2123
-37 30f7f7e53118623c 8a864af6323035e2
-38 3efaf00433287504 1b017222f32f54b4
-39 5cf2a0e1d3db99c0 06b9b79381c1e95d
-40 7a4eb8234eba06f9 a24c79acf272b25d
-41 c965d7ca845ddf8e 88e8cbe8a457f908
-42 76839b11488b9183 4bb6f776b375cbed
-43 c58c93123184fb12 5eed25f9aa1c6813
-44 0347b2710c0b54eb 5916e980c6853c4a
-45 fdf83c377b9ee589 5eed25f9aa1c6813
-46 1d113406e9b45128 414cca03cbc09201
-47 3839c27816c7629d 1b6e32e3cff823ad
-48 0899e6140f4c6120 87d4bdd91d341564
-49 0e1b7aacee9a7fc8 611c123eae958f7a
-50 1fc64d2e334bd2bd 3342ef2cda27e822
-51 100c5a70fb719f91 a7ea1adc385153cd
-52 05b9234969171aa5 f8f5b13750c8e079
-53 41c15a8bdf3a668b c92ee243df48ecc3
-54 96093cbf36093a41 6ea4fbfccbe916a0
-55 bf6831c35e5af859 806a3368f7218af7
-56 e51cbd96fe8a9fa6 a3735a2d9e10ed0c
-57 cff669a1bfeb6031 474f9821105dd114
-58 8d5f4f9af8e920e5 5eed25f9aa1c6813
-59 faa4bbdf65418651 32cefe9711f750ff
-60 aab16b8c720350e5 5eed25f9aa1c6813
-61 673a0fdb7a5681d1 bd7763e7b2776eef
-62 a87f51a0fa3cbd3f 1eabdbc0af1d32db
-63 8aa48e03aa4966b4 ea7b412234cc3d75
diff --git a/crates/socket-patch-core/tests/equivalence/crawl_python_site_packages.golden b/crates/socket-patch-core/tests/equivalence/crawl_python_site_packages.golden
deleted file mode 100644
index 31f75a84c..000000000
--- a/crates/socket-patch-core/tests/equivalence/crawl_python_site_packages.golden
+++ /dev/null
@@ -1,66 +0,0 @@
-# One seeded site-packages: the dist-info listing, crawl_all, find_by_purls and find_each_by_purl.
-# <case> <input digest> <output digest>
-0 198016d750fe9101 e8d93ecbbb02df49
-1 d2acae82860bdcd9 0e256ad9eafd9ba1
-2 e24a68678fc0cef8 53fbfbe5d2e0a22a
-3 95ae92892c2424ab a43b919fe8b68264
-4 5c9d8f0446166269 4cc13cdadef780a7
-5 06a4e4ff72f9418d b8b691a2aee89232
-6 4a3de3ce09375ef1 068db66866295cb8
-7 2428d8ac2bd74e6d d1de5ff399a4b134
-8 0283d9e5ae898e37 b2ea74e40b7a40bd
-9 9d55dc729fcccf80 8edf93ca455c07c2
-10 1fc2ce4fad28b48f 97592ff14fc2e007
-11 e592d8197ae88181 acebcfacf1982d28
-12 4aa0415164a41abb 3b7904637a910c6c
-13 5df1ff28b8710467 b6016b20babe139d
-14 b515a33eb3859f27 b5928355ba9c89b8
-15 32b44e5486ec8e47 1d310fbdad691744
-16 2115aca4dfc41f81 5e18ee9de13ce5dc
-17 a5c1fcec68e54bb7 4a7b5fc1ca158522
-18 7c0743865e227e6b 7e5ba6fb0f1e24eb
-19 c32b2329da7770b9 a88833e56cb9a8dc
-20 8778f67a16fb68cb 680d3a2df7e892fe
-21 64c4df60b43116be 49dea01a1538cb98
-22 df350b75002e36b1 86787a55c69c2df7
-23 abb3a2b5cce8a495 3aee53c827b01757
-24 02b1aa8344eec2b0 e3680d26eaaba9ee
-25 72bf43de7665f1d1 1e90542621296098
-26 7092370a1e0f78ef 79d0205edc7fc477
-27 63f3f845aa3927fa 2ad70e37b03396fd
-28 895926e5e0a8a510 0da0d2c9e7129f36
-29 2b9451525e7077f2 fc4490115352643b
-30 8b29f5eb5cfc82d0 400e6a022de63170
-31 10489bf517542a88 14fce84a889fcea2
-32 ddf44ec548ef3814 731915cdb72d06c1
-33 77ae548a02c773c8 0787d2e73e3fad5a
-34 d3a69850470f8bc6 cb3d44715bc1184d
-35 c8cc54db540a284c 483eb953fd28ac31
-36 784ded8d8adf5b3e 6ebb851606a7d6a3
-37 dcdb78324c2ad9e1 d5e50adf4a6ae00c
-38 af80f0acab34ae92 02903f199c21d896
-39 682c4572f2485ab3 4409b63524b1f636
-40 87cec8cbf714a32d f7c4a7338ee4169f
-41 0798f2d44ba97d30 3842d792fff5ff64
-42 ec0b6750635ce4be 99243d00c64721b3
-43 1aa636c56f2142cf 268f922aacc40634
-44 6e2dfaa8c93b4ad4 cc110895d8bd24d5
-45 2df7bf3e9f77a150 0a4829981088eaa7
-46 0789e6ce0c6ea93c a0f72f52e9f74cbf
-47 b1db1a2b62e6640f b626bdd6f135dedf
-48 6abcb187e9e0e6ba e72384338256569c
-49 7503e0f2639a6f75 2624c7902626b5d6
-50 24d2df3005be76dd cd13e182f95aaed0
-51 56a76b18f3fa4326 650c186ab1ef8b78
-52 38af01370ac937d1 b9033260451a5853
-53 e9d72fab580421be 3cdb0607a3205f63
-54 33a5036ff50edef3 ee5338153080178d
-55 1edf45d032e41a8b 4a2e125d0ebbb949
-56 d97d1665e545bcc7 0d0e7d5a8450817a
-57 98081f0eaa3f3ba6 27438a16dd114f63
-58 851ddf1f98e18c3f ccce651e903b957c
-59 5f72261172180301 f67d0f3c246f40c6
-60 03669bdd3d8945ba ebed8b047d70d6e7
-61 17d5ff764f35a61b f8d269181d04be6e
-62 93758d178863dc32 9a82c8e1d2fc8f00
-63 851ddf1f98e18c3f ccce651e903b957c