socket-patch implementation review (living document, file by file): abstraction, duplication, mechanisms, tests

[Mikola Lysenko (mikolalysenko)]

Note

[agent] This is the second architecture thread for socket-patch, and it is a living document. It replaces #560, which reviewed the code module by module and is now closed. Its open items are carried over in the register below and summarized in Part 6. Scheduled routines keep this post and its Parts true of main, and every run posts a log entry as a comment at the end of the thread.

Progress: 174 problems tracked · 2 partly fixed · 19 already fixed · 8 in PR · 33 filed · 2 decision pending · 40 carried · 68 to verify · 2 rejected. On GitHub: 72 open and 114 closed arch-audit issues · 9 open and 79 merged arch-refactor PRs.

Coverage: 97/868 files audited (104,810 of 908,212 lines) · 16/868 swept.

• Register: the first comment below tracks every problem with its issue and status.
• Parts: 2 mechanisms · 3 duplication · 4 structure · 5 tests · 6 history.
• Log: after Part 6, each routine run adds one comment saying which files it read, what it found and which PRs it opened.
• Work items: issues labelled arch-audit · refactor PRs labelled arch-refactor · decisions needed
• Steering: reply here or on an issue. Maintainer replies are read on the next run and can reject findings, reorder work or settle decisions.

Rendered 2026-10-30 09:37 UTC (ledger 3055ba7f) from doc/ on the arch-audit/ledger branch.

socket-patch implementation review: file by file

Started 2026-10-29 against main @ b291caa.

Charter

The first thread asked what to cut and combine at the level of products and modules: modes × ecosystems × lockfile formats. This thread looks at the implementation: is each file's code as small, direct and honest as it can be? Nothing in the codebase is precious. The routines look for:

1. Needless abstraction and tiny functions. Single-caller functions are inlined unless their name earns its keep. One-line wrappers, one-impl traits, one-variant enums, forwarding layers and invariant-free newtypes are deleted.
2. Duplicated business logic. One rule should have one implementation (Part 3).
3. Unclear control flow. Mode flags, deep nesting, accumulate-then-decide result structs, swallowed-then-reraised errors.
4. Placement. Every function and type should live where a reader would look for it, and no two modules should cover the same concept (Part 4).
5. Common mechanisms. One way to handle errors, format output, read env and config, join paths, write files, call HTTP and spawn processes (Part 2).
6. Comments. History narration, restated code, stale text and bare issue numbers are deleted; why comments stay.
7. Tests. Tests that assert on their own mocks, recompute the expected value with the code under test, can't fail, or claim more than they check get fixed or deleted (Part 5).

How it works

• coverage/files.tsv on the ledger branch lists every .rs file under crates/: 868 files, ~908K lines at the start.

• Two auditors each read about 15K lines per run, in file order, and never change code:

  • audit-core covers crates/socket-patch-core/src;
  • audit-cli-tests covers the CLI crate and every test file.

  For each file they record its local cleanups (what to inline, delete or fix) in the manifest. Problems that span files go into the register and become arch-audit issues.

• The refactor routine alternates between two kinds of work:

  • sweeps: one PR per file or directory, applying the local cleanups, mostly deletions, with behavior unchanged;
  • structural PRs: the highest-leverage register item.

• When every file has been read once, the next pass starts with the files that changed most since they were last read.

Top problems

Filled in as the audit progresses. Each bullet carries its register token.

• Duplicated rules have already drifted into bugs.
  • The cargo build-cache cleaner and cargo disagree on which .cargo/config file wins A01 · in PR Read the cargo config chain once (#1832) #1849.
  • The cargo workspace glob has no character classes A02 · in PR Fix Cargo member globs with [..] classes (#1833) #1866.
  • Both bugs were shown by running the code.
  • The API client retries under two policies that disagree: a Retry-After: 60 ends a JSON call but is retried after 4 s by the vendor path A27 · in PR One serve GET and one vendor retry loop in api/client.rs (#1869) #1870.
• utils/ is a mix of ecosystem-specific code and true utilities. Some of it imports vendor::* A08 · to verify.
• Shared helpers exist but are bypassed or dead. A purl split is written ~12× A14 · filed Tracking: build and classify purls through one validated utils::purl API #748; copies listed in a comment, uuid shape 4× A15 · filed Validate patch UUIDs through one utils::uuid grammar instead of five #705; Check uuid shape through one helper; python_script's Uuid::parse_str also accepts braced, urn and unhyphenated forms #1845 closed as its duplicate, and the shared poetry-writer and credential-strip helpers have no caller while copies serve production A18 A20: 1 in PR · 1 filed.
• CLI commands carry second copies of shared engines. get <uuid> re-implements the agent download engine T01 · filed Route get <uuid> agent mode through download_and_apply_patches_into instead of a second copy of the engine #1835, five callers glue the Bun and vlt preflights by hand T05 · filed Run the Bun and vlt vendored preflights as one vendor_preflight with one per-purl refusal map #1839, and remove and rollback render vendored reverts in two drifted loops T16 · filed remove and rollback each render VendorRevertStep in their own loop, and the loops drifted (remove --preserve-state --dry-run previews a full revert) #1861. The copies have drifted in user-visible text and JSON T02 T04: 2 filed.
• Disk and in-memory hosted scan are two hand-kept copies. The disk path repeats core's pipeline step for step T24 · to verify, and the two emit different redirect JSON blocks while core's doc claims one shape T29 · decision Decide: one hosted redirect JSON block for disk scan and the in-memory engine (today {mode, rewrittenFiles} vs a seven-key block) #1881. --vex embedding is written ~8× and only scan reports a skipped dry run T25 · filed Embed --vex through one helper: the step is hand-written 8 times, and only scan reports vex_skipped_dry_run under --json #1877.

The numbers

	Value
Rust files / lines (all crates, incl. tests)	868 / 908,212 at b291caa
Largest file	patch/redirect/mod.rs, 30,223 lines
Files over 5,000 lines	to measure
Single-caller private functions	to measure (per file in the manifest notes)
Deletable comment lines	to measure
Fake tests found / fixed	to measure

[Mikola Lysenko (mikolalysenko)]

Defect register

[agent] This comment is the living register for this thread. It is regenerated from the register/ files on the arch-audit/ledger branch on every push, so any edit made directly to it is overwritten. Its Status column drives every status shown in the Parts.

Progress: 174 problems tracked · 2 partly fixed · 19 already fixed · 8 in PR · 33 filed · 2 decision pending · 40 carried · 68 to verify · 2 rejected. On GitHub: 72 open and 114 closed arch-audit issues · 9 open and 79 merged arch-refactor PRs.

Coverage: 97/868 files audited (104,810 of 908,212 lines) · 16/868 swept.

• Status:

  • The normal path is to verify → filed #n → in PR #n → fixed (#n).
  • Rows carried over from socket-patch architecture (living document): review, defect register and refactoring log #560 start as carried while one of their issues is still open.
  • Other statuses: partly fixed (#n), already fixed (#n), decision #n, handed off and rejected.

• P: 1 = fix now; 2 = high-leverage simplification; 3 = later.

• IDs: A = core audit, T = CLI and tests audit, R = found by the refactor routine, E/C = carried over from socket-patch architecture (living document): review, defect register and refactoring log #560.

• Routines:

  • audit-core and audit-cli-tests read the code file by file, every 6 hours, staggered.
  • refactor runs every 2 hours and opens sweep or structural PRs.

  Their procedures are AUDIT.md and REFACTOR.md on the ledger branch.

Core audit (A rows)

Last updated 2026-10-30T06:55Z · main @ 5ca5623 · owner: audit-core

ID	P	Problem	Issues	Status
A01	1	Cargo config chain is read twice. cargo_build_cache::ConfigDirs::read prefers config.toml, while source_replacement::config_layer_paths and cargo prefer config, so the build-cache cleaner invalidates the wrong target dir (executed).	#1832	in PR #1849
A02	1	cargo_workspace::wildcard_match has no [...] classes, so members = ["crates/[ab]*"] expands to nothing (executed). It is one of three segment glob matchers, with workspace_globs::segment_glob_matches (= ExtglobMatcher::segment_uncached minus the memo) and hatch_workspace::fnmatch. A fourth walk, npm_crawler::expand_workspace_pattern_sync (L940), has no brace expansion (bun workspaces; unexecuted).	#1833	in PR #1866
A03	2	GOMODCACHE/GOPATH default is written twice (go_crawler::get_gomodcache, go_installed_tools L176-186), and the copies drifted on empty GOPATH entries and the home fallback.	#1834	in PR #1876
A04	2	Callers re-derive utils::line_endings: vendor/common.rs:198 copies terminator, and python_lock::preserve_line_endings and lock_fragments L434 hand-roll CRLF detection that ignores bare \r. There are three more eol_eq copies (hosted/engine.rs:2900, vendor/jvm/scala_cli.rs:76, vendor/nuget_feed.rs:1004).	#814, #815	filed #814; new sites added to the tracker's scope
A05	2	lock_fragments pairs fragments in three loops that drifted on which text they check for uniqueness. pdm and poetry each repeat the rewrite/_with_edits/_in/steps/batch triad; the _steps loops already differ on when edits() runs.	#1844	filed #1844
A06	2	The lowercase-hex/sha256 validators are re-written at ~10 sites (cargo_build_cache ×2, pdm_lock ×2, vendor/pypi*.rs, patch/apply.rs, redirect/*). vendor/jvm/mod.rs:621 defines sha1_hex/sha256_hex as computations under digest's validator names. poetry_lock::checked_sha256 and pdm_lock::check_pdm_artifact are twin hex+wheel validators.		to verify
A07	2	GroupCommit::commit_unjournaled never drains the after_commit/dirs_after_commit queues that commit_changes drains (L659-L695). The code is confirmed; whether a hosted-only run queues anything (staged.rs:79 remove_dir_after_commit) is unproven.		to verify
A08	2	Ecosystem code sits in utils/: hatch, hatch_workspace, pdm_lock, poetry_lock, lock_fragments, go_env, go_installed_tools, cargo_*. utils::hatch imports vendor::*, group_commit::is_captured imports vendor::jvm, pnpm_workspace imports patch::redirect (pnpm-major readers that belong in formats/pnpm), purl_key imports crawlers+vendor; python_lock and poetry's refusal policy (poetry_lock L228-L418) also belong outside. Overlaps #833.	#833	to verify
A09	3	Env parsing has three vocabularies: env_compat (exact 1/true), socket_cli_config::env_truthy (yes/on/y/t, case-insensitive; shared with the CLI update notifier) and concurrent (trim plus debug log); .ok().filter(!empty) recurs in ivy_cache/coursier_cache. Related to #793.		to verify
A10	2	The user's home is resolved by three rules: fs::home_dir (usable/absolute), crawlers/hatch_env.rs:491 (HOME, else USERPROFILE, no checks), repo_root::home, process::neutral_probe_dir_with (L271) and socket_cli_config::config_json_paths. fs.rs is also a four-concern grab-bag.		to verify
A11	3	The tool --version probe is written twice: utils/pipenv.rs runs it in temp_dir with PIPENV_DONT_LOAD_ENV, while vendor/pypi_hatch.rs:202 runs it in the project root. Suspected hardening drift.		to verify
A12	3	Three prune-empty-dirs loops (group_commit::remove_tree_pruned inclusive, socket_dir::prune_empty_dirs exclusive, the sync prune_created), three "remove, NotFound ok, sync parent" copies, and group_commit::sync_dir duplicating fs.rs. socket_dir::prune_empty_dirs is the exclusive one (callers: vendor/state, vendor/common, CLI agent_download).		to verify
A13	3	The yarn major is parsed from packageManager twice: update/channel.rs:361 (no trim) and vendor/mod.rs:274 (after package_manager::pinned_version).		to verify
A14	2	pkg:<type>/<name>@<version> is split by hand ~12×; purl.rs alone has three splitters that disagree on empty parts (L147-L190); lock_inventory/recover never strips qualifiers. Parsing half of #748.	#748	filed #748; copies listed in a comment
A15	3	Uuid shape is checked 4 ways (target::is_uuid_shaped, redact's private twin, path_safety::is_canonical_uuid, Uuid::parse_str in python_script L99, which also accepts braced/urn/simple forms).	#705, #1845	filed #705; #1845 closed as its duplicate
A16	3	Committed JSON ledgers are written two ways: socket_dir::write_json_ledger (link guard, trailing \n, skip-identical) vs manifest::operations::write_manifest (no newline, rewrites always); update/state.rs:108 and vendor/state.rs:1004 hand-roll a third. Changes manifest bytes.		to verify
A17	3	pnpm packages: membership refuses {}[] globs the shared matcher reads (pnpm_workspace.rs L310-L334); hosted keeps a second reader (governing_root::pnpm_lists_unmodeled). Lock-member detector ×2.	#1846	in PR #1863
A18	3	"poetry.lock written before 1.4" is written twice (redirect/poetry.rs L26, vendor/pypi_poetry.rs L128) while poetry_lock::lock_writer_version is dead.	#1847	in PR #1865
A19	3	Lexical .. folding is re-implemented 4× beside utils::relpath (maven_scope L535, cargo_crawler L384, hatch_env L562, python_script L605); the copies use PathBuf::pop, the bug relpath's regression test documents. Unexecuted.		to verify
A20	3	URL credential stripping ×2: redact::strip_url_credentials is dead while VEX @id and upstream npm use vex::product::strip_url_userinfo; the copies differ on query and authority end.	#1848	filed #1848
A21	3	The walk to the enclosing .git is hand-written outside repo_root (user_patches.rs L44, governing_root.rs L528, hatch_workspace.rs L101): no GIT_CEILING_DIRECTORIES, any .git file type. Unexecuted.		to verify
A22	3	uv settings-file choice and no-binary precedence are written twice (python_script L662-L696/L838 vs redirect/upstream/uv.rs L790-L861); drifted on refusal labels only.		to verify
A23	3	Hosted redirect/requirements.rs keeps its own logical-line lexer and quote-aware comment split (L19-L60, L197) beside utils::requirements::logical_lines/split_comment (pip's non-quote-aware rule).		to verify
A24	3	"Is this our earlier hosted pin" ×2: pdm/poetry python_lock::is_prior_hosted_url (origin + last segment) vs uv/pylock python_script::same_hosted_artifact (uuid segment + replaceable_hosted_pin).		to verify
A25	3	PEP 508 leading-name scanner ×3 (vendor/common.rs L602, requirements.rs L438, inline python_lock.rs L665, which skips trim_start); canonicalize_pypi_name still in crawlers::python_crawler (#883 closed).		to verify
A26	3	Civil-date math lives in three modules: days_from_civil twice (api/date.rs L48, formats/cargo/floor.rs L26) and its inverse in vex/time.rs, whose doc claims to be the only copy. Target: one utils::time.	#1867	filed #1867
A27	2	api/client.rs GETs a serve URL through two near-copies (download_vendor_archive_once, download_artifact_capped_once; drifted cap-breach variant and status text), hand-writes 4 retry loops, and runs two retry policies that disagree (executed: Retry-After: 60 → JSON gives up, vendor retries after 4 s). Related: #1650.	#1869	in PR #1870
A28	3	api/ is not a leaf: vendor_prefetch (the vendor-service plan engine) imports vendor::prestage/registry_fetch/lock_inventory and belongs in vendor/; client.rs carries the pypi wheel gate (PYPI_NOT_A_WHEEL, wheel_filename_from_url); api::types imports patch::redirect::{Integrity, RegistryOverride}. Overlaps #833.	#833	to verify
A29	3	Four xorshift64* test RNGs (test_rng claims to be the only one; oracle_support, copy_tree, npm oracle). Eight crawlers/**/oracle.rs (2,978 lines with oracle_support) keep pre-migration crawlers as oracles; cargo's already reads differently from production.	#1868	in PR #1882; oracle deletion still to decide
A30	2	Maven ${…} interpolation ×5 (maven_crawler, formats::maven, maven_scope, maven_reactor ×2); drifted on recursion, undefined names, and only formats::maven caps output length.	#1887	filed #1887
A31	2	A POM's own coordinates are read 3 ways: maven_crawler::parse_pom_group_artifact_version (line scanner, also imported by ivy_cache/coursier_cache), formats::maven::model_refs, maven_reactor::pom_model; drifted on parent-version inheritance, ${ handling and skip lists.	#715	filed #715
A32	3	Env-keyed subprocess memo ×3 (composer EnvKeyedMemo, python KeyedMemo, ruby GemEnvMemo) with byte-identical keys; python caches answers computed under a changed env.	#1888	filed #1888
A33	3	"Is this a Coursier root" twice: maven_crawler::coursier_spelled (any http(s) component) vs JvmCacheLayout::classify (needs ≥2 more components), so a Maven2 root like /srv/https/m2 loses #265 scoping and pom-only versions (L837-L843). Unexecuted.		to verify
A34	3	Go coordinate gate ×4 (go_crawler, golang_local, purl::golang_purl, vendor/path.rs; identical today) and Go module-cache layout (encode_module_path, cache/download paths, get_gomodcache) in the crawler but used by vendor and redirect. Extends E37, A03.	#748	to verify
A35	3	JVM cache plumbing is split: JvmEnv/M2Gate live in maven_crawler; gradle roots ×2, hash-dir listing ×3 (drifted on symlinks), wrapper init.d ×2 (gradle::home ignores distributionBase=PROJECT), -D option parsing ×2 (coursier mangles quoted spaces), sorted-children ×4.		to verify
A36	3	platformdirs-style user cache/data/config dirs ×5 (coursier, deno, poetry cache; hatch, pdm/poetry data/config); drifted on Windows fallback and macOS XDG_*. Extends A10.		to verify
A37	3	EnvGuard test helper ×11 (3 byte-identical in go/deno/maven crawler tests) plus with_env/with_home_env.	#1889	filed #1889
A38	3	All 8 crawlers are stateless unit structs with new() + Default and &self methods; scan_ecosystem! instantiates them. Free functions would do; touches every crawler and the dispatch.		to verify
A39	3	Hatch legacy <name>-<id> env layout is checked only for the first project id, and macOS lists the casefolded id first, so Hatch 1.0–1.2 envs under raw ids are missed (hatch_env.rs L128-L178). Unexecuted.		to verify

Handed off

None.

Rejected

None.

CLI and tests audit (T rows)

Last updated 2026-10-30T04:05Z · main @ 5ca5623 · owner: audit-cli-tests

ID	P	Problem	Issues	Status
T01	2	get <uuid> agent mode re-implements download_and_apply_patches_into (save_patch_record + save_and_apply_patch, ~240 lines). Drifted on the no-files and blob-failure messages, unchanged-record re-apply and persist_blobs.	#1835	filed #1835
T02	2	The vulnerability JSON object is hand-built 3× (patch_event_metadata, list.rs, get options[]). get's copy is unsorted (HashMap order) and drops description; list drops top-level severity.	#1836	filed #1836
T03	2	GLOBAL_ARG_ENV_VARS/LOCAL_ARG_ENV_VARS are hand copies of clap env bindings and miss SOCKET_NO_SOCKET_YML, so the hermetic test scrub lets it through. The "invariant tests" iterate their own hand lists.	#1837	filed #1837
T04	3	fetch_stage copies core blob_fetcher fetch-summary formatters; the copy is unsorted, shows raw errors and always appends ....	#1838	filed #1838
T05	2	Bun and vlt vendored preflights run back to back at every caller (agent_download, get, scan vendor_flow ×2, vendor), each with its own per-purl glue; the callers disagree on the root (project_root vs cwd).	#1839	filed #1839
T06	2	CLI apply::representative_file + variant_matches_installed (apply.rs L761-L788) copy core patch::apply::variant_installed_at (private); recombined with verify_file_patch at apply.rs L2579, L3214 and vendor.rs L2837, L3347.		to verify
T07	3	The VexSummary { format: "openvex-0.2.0", .. } literal is hand-built 7× (apply ×2, vendor ×3, scan, scan/hosted); expect("vex_result is Some…") 3× in apply. Folded into T25.	#1877	filed #1877
T08	3	Gem build-sibling rule twice: apply::has_build_sibling (L98) counts any other copy in the gem home, rollback.rs L2932-L2941 only a variant-matched one and checks pkg:gem/ by string (drift). Verbose verification printer twice (apply.rs L2092, rollback.rs L2419): same output (core never sends an empty hash), labels from a match vs .replace('_',' '). Folds into C24/#771.	#771	to verify
T09	3	Lock acquire open-coded 9× beside acquire_or_emit (5 callers, all passing the same GlobalArgs fields); Duration::from_secs(lock_timeout.unwrap_or(0)) 14×; lock_held rendered 3 ways for humans; scan/hosted prints the human error under --json; report_lock_failure lives in agent_download.	#1858	filed #1858
T10	3	The severity ladder is single (core ranking::severity_order), but the "worst label" picker is written 3× (scan/mod.rs L3150, scan/render.rs L396, agent_download::max_vuln_severity) and drifted on unknown labels (scan returns them, agent_download None); ui/mod.rs L238 and core client.rs L3175 cite a moved get.rs severity_rank. Copies on 5ca5623: scan/mod.rs L3150, render.rs L396 (raw API label), agent_download L95, core client.rs L2591.		to verify
T11	3	DownloadParams copies 10 GlobalArgs fields (filled field by field in get and scan) and nested_apply_args_from_params rebuilds a GlobalArgs from them: a translation layer. Overlaps C10/#793.	#793	to verify
T12	3	composer_hints::vendored_composer_packages parses composer.lock in the CLI and re-derives vendored-path detection by prefix instead of core vendor::path::parse_vendor_reference (drifted: no ../ workspace refs, no uuid check).		to verify
T13	3	Overlay staging twice: fetch_stage::overlay_dir stages in system tmp (so hardlinks fail across filesystems and the blob cache is copied), rollback.rs L3016 stages in .socket.		to verify
T14	3	Mode resolution (explicit / state-inferred / foreign-manifest / global conflict) is written in get (L1077-L1126) and scan (mod.rs L270-L308, L1737-L1772) with the checks in a different order.		to verify
T15	2	Per-purl top-ranked selection 5× (get select_patches, scan/policy.rs L556 and L828, core rollout/stage.rs L77, core hosted/memory select_with_policy L1401, whose doc calls itself the disk select minus the recorded view); the socket.yml floor 3×; the tier filter 4×; scan counts paid tiers two ways (mod.rs L2661 vs L3133).		to verify
T16	2	remove and rollback each render VendorRevertStep in their own loop (vendor.rs classifies it twice more); drifted on --preserve-state --dry-run (remove previews a full revert), go-undo warnings, drift-keep text and stop-at-first-failure.	#1861	filed #1861
T17	2	The "no manifest" gate is written 3× (remove.rs L367-L416, repair.rs L61-L156, rollback.rs L1437-L1547) and drifted: unledgered .socket/vendor wiring, a legacy redirect-state.json, contested hosted wiring and the global-scope check each give different outcomes; the manifest_not_found envelope differs in message and path. Overlaps C74/#1352.		to verify
T18	3	scan/discovery.rs keeps a private shell_word beside ui::shell_word; it quotes POSIX-style on Windows and leaves % bare.	#1859	in PR #1884
T19	3	GC reporting still differs past C79's JSON fix: repair records cleanup_failed as a Skipped event (others: run warning), its labels say "diff"/"package" (others plural), and the human text has 4 renderers (remove format_blob_sweep says "would be freed", core says "freed" on a dry run, rollback its own line).		to verify
T20	3	The "JSON envelope or stderr" error emit is hand-written ~6× (remove.rs L122, rollback.rs L947, repair.rs L78/L143/L257, list.rs L219, scan/mod.rs L1530); rollback also open-codes 4 more branches beside its own helper. Wants json_envelope::emit_error.		to verify
T21	3	The warning sink (--json → warnings[], else stderr) is hand-rolled per command (list.rs ×3, user_patches.rs L122, scan/withdrawn.rs L126); withdrawn prints under --silent, the others don't; 40 RunWarning { literals vs 17 RunWarning::new.		to verify
T22	3	rollback's before-blob gate (get_missing_before_blobs L677-L687, recheck L3184-L3189) uses metadata().is_err(), which follows symlinks and accepts directories, while core verify_file_rollback requires symlink_metadata().is_file(): a planted link/dir counts as present, the self-heal download is skipped and the run fails missing_blob. Fails closed. Unexecuted.		to verify
T23	3	The terminal-safe text filter is written 3× (list.rs sanitize, ui/status.rs println, core policy::strip_unsafe); only core drops bidi overrides and zero-width characters, so list prints them from API text.	#1860	filed #1860
T24	2	Disk hosted scan (scan/hosted.rs run_redirect_selected_untracked, 1,233 lines, L949-L1306) hand-copies core's in-memory pipeline (memory/stages.rs L172-L397), step for step; drifted: governing_root::refusal disk-only, warning order. Child of C12.	#894	to verify
T25	2	The --vex embed step is hand-written ~8× (scan ×4, apply ×2, vendor ×3); only scan reports vex_skipped_dry_run under --json, and fold order differs. Absorbs T07.	#1877	filed #1877
T26	2	Pipenv stale-install remedy written twice (hosted scan/hosted/python.rs L134-L205, core vendor/pypi.rs L786-L860); drifted on per-site vs aggregated warnings, suffix wording (<purl> placeholder) and name parsing.	#1878	filed #1878
T27	3	Hosted stale-install and takeover warnings are built as serde_json::Value (hosted, python, nuget, takeover, vlt_heal) and parsed back by run_warning_of with unwrap_or_default. Part of T21.	#1879	filed #1879
T28	3	The vulnerability label rule (CVEs else advisory id) is written 4× (render.rs L385, get.rs L222 and L372, list.rs L284); drifted on order, dedup and severity case.	#1880	filed #1880
T29	2	The hosted redirect JSON block has two shapes (disk {mode, rewrittenFiles} vs core redirect_json_block's 7 keys), while core's doc claims one. Decision.	#1881	decision #1881
T30	3	Snapshot/put-back of files the group commit doesn't capture is written twice (scan/hosted.rs commit_hosted_writes L2093-L2190, vendor.rs L1701-L1758); hosted drops put-back errors (let _ = L2183) yet says "nothing was changed".		to verify
T31	3	The project-root marker predicate is written twice (scan/policy.rs lock_markers L105-L121, core hosted/memory/roots.rs root_markers L41-L58); disk adds a manifest fallback the memory engine lacks (its doc admits the verdicts differ). Unexecuted.		to verify
T32	3	The agent dry-run preview event is built 3× (scan/mod.rs L2896-L2917, get.rs L1868-L1894, agent_download.rs L1089) and the already-recorded check re-derived a 4th time (scan/mod.rs L3322) beside decide_patch_action.		to verify
T33	3	Suspected: the hosted takeover plans one ledger entry (lookup_entry, takeover.rs L119) but finish removes every PurlKey::same entry (L410-L414), so a second variant of the release would leave the ledger unreverted. Unexecuted.		to verify
T34	3	Warning text is sentence-cased and wrapped only in scan/hosted.rs (format_warning/wrap_words, L2213-L2307); ~84 other Warning: {detail} prints do neither, and policy vs rollout warnings use two prefixes. Belongs in ui::text. Part of T21.		to verify

Handed off

None.

Rejected

None.

Carried over: ecosystems and formats (E rows)

Carried over from #560 on 2026-10-29 · statuses as of its last update 2026-10-09 · owner: audit-core

Re-verify each row on current main before acting on it (reconcile step). carried rows still have an open issue or PR; to verify rows have none open and may already be fixed.

ID	P	Problem	Issues	Status
E04	1	Hosted-PyPI-URL recognition drifted (merged E49). Three recognizers remain: hosted_patch_uuid, hosted_pypi_reference/hosted_artifact_url, Pipenv owned_url.	#563	already fixed (#572); the residual pdm/poetry vs uv pin rule is A24
E05	1	Cache crawls aren't project-scoped: cargo, go, maven, nuget and deno enumerate the whole machine cache, and scan sends all of it to the API (#265).	#595, #1204, #1207, #1216	filed #595; #595 still open (Maven crawl unscoped)
E10	2	XML has eight hand-rolled scanners and four attribute extractors; the writers (nuget_feed.rs, maven_repo.rs) never use the shared readers. Merged E11, E55.	#715, #716, #717, #594	filed #715; #594, #717 also open; vendor/maven_repo.rs still uses no formats::xml/formats::maven reader (c07af61)
E12	2	pnpm v9 and legacy 5.4/6.0 were near-copies; v9 still has two lookup paths (a linear scan and LockIndex, pnpm_lock.rs:1524-1538).		rejected; LockIndex is an accelerator re-checked by the scan's predicates: one rule
E14	2	Pipfile.lock is written two ways: vendored mode re-serializes the whole lock (loses \uXXXX escapes, refuses a BOM), while hosted mode splices spans (executed twice).	#1128	already fixed (#1188); vendored pypi_pipenv splices through formats::pipenv::splice_entry (c07af61)
E15	2	Cargo.toml [package] is read five ways and has drifted on BOM, [project] and dotted keys; hosted plan_cargo_toml refuses a multi-line features array (merged E57).	#693, #757	partly fixed (#693); vendor/cargo.rs path_crate_version L1545 still bypasses formats::cargo::manifest
E16	2	CRLF has five npm-family policies and three for toml_edit output; the "any \r\n → CRLF" rule is written 14 times (merged E60).	#814, #815	filed #814; open: #814, #815; tracked with A04
E19	3	Gem has three section models and three DEPENDENCIES-name parsers (vendored sees only the first GEM section, #779). Go's module readers fixed (#870).	#780, #781	filed #780; vendored vendor/gem.rs models open
E20	3	Pure codecs (bun_lockb.rs, bun_lock_text.rs, vlt_lock_text.rs) and the neutral types live outside formats/, creating formats↔vendor/redirect/vex cycles.	#833	filed #833; #833 open; A28 adds the api→vendor/redirect imports
E21	2	Tracking: VendorBackend trait + registry. The ecosystem list is enumerated at 16 production sites, and the vend! / vend_installed! macros stand in for the trait.	#959	carried; open: #959; was: filed #959; #960 folded into #959
E22	2	The JS vendor driver skeleton was copied seven times. Since #1008, six drivers share NpmLockBackend + vendor_npm_family; vlt is separate and the revert half is per backend.	#920, #922	carried; open: #920; was: partly fixed (#1008); revert half (#920 step 6) remains; tracking #920
E24	2	There are nine revert mechanisms (~3.5K lines). Target: one splice-record revert engine, with legacy ledger kinds adapted at load.	#989	carried; open: #989; was: partly fixed (#1245): gem, composer, Maven legacy, NuGet and pnpm finish through vendor::revert::finish; npm, bun, yarn and pypi finish copies remain; #990 folded into #989
E26	3	JVM has two Maven backends. Target: merge maven_repo.rs into jvm/ as Shape::Single; its three artifact roots don't follow <eco>/<uuid>.	#971, #972, #973	carried; open: #971, #972; was: partly fixed (#1036): single poms use the jvm/ planner; #971 children 4–5 open
E28	2	Dead vendored scaffolding: one-variant VendorSource/PackageSource, an unreachable SERVICE_ECOSYSTEMS refusal, ServicePolicy::new ignoring its config, an unused vend_installed!.	#782	filed #782; re-checked b291caa: one-variant VendorSource (vendor/mod.rs:285) and PackageSource (vendor/source.rs:5) remain
E29	3	registry_fetch.rs (1.5K lines) is really archive extraction, integrity checks and the hosted-restore HTTP client, so it is misnamed and in the wrong place.	#959, #833	carried; open: #833, #959; was: filed #959, #833; #1012 folded into them
E30	2	Split redirect/mod.rs (21.9K lines at db83f01: 7.6K prod, 14.3K inline tests) mechanically: model, driver, one file per ecosystem, hosted_url, sibling test files.	#1010	carried; open: #1010; was: filed #1010; #1011 folded into #1010
E31	2	Tracking: trait HostedRewriter + Outcome { per_dep }. It replaces 27 RewriteResult uuid sets, merge_group_delta and the 25-outcome confirm().	#1075	carried; open: #1075; was: filed #1075; #1076 folded into #1075
E32	2	There are two hosted orchestrators, disk (run_redirect_selected) and in-memory (hosted/memory), kept equal by parity tests. Target: one pipeline. Depends on E44.		carried; open: #1200; was: to verify; blocked on decision #1200 (E44)
E33	3	Upstream restore rebuilds originals from the network (~8.8K production lines at 1c6c509, ignores mirrors, re-pins integrity from the registry: B72). Target: an originals sidecar or a narrowed restore. Depends on E45.		to verify; no linked issue/PR open; was: to verify
E36	2	Tracking: one Inventory. Today's four discovery systems are merged by fabricating CrawledPackages with fake node_modules/<name> paths. Rename vex::discover (it is the hosted-state store).	#1112	carried; open: #1112; was: filed #1112; #1113 folded into #1112
E37	2	is_safe_{cargo,gem,nuget}_coordinate are byte-identical and duplicate simple_purl's check. composer_crawler::normalize_version duplicates strip_leading_v.	#630, #748	filed #748; re-checked b291caa: composer_crawler::normalize_version L684 and composer_version::strip_leading_v L192 are still twins
E40	2	vex_consumed.rs, in the CLI, is a third copy of package-manager layout knowledge (cargo, Maven, Go rules); its npm alias walk drifted from core on case (merged E62).	#855, #856	carried; open: #855; was: partly fixed (#1008): alias walk deleted (#856); tracking #855
E41	2	Dead discovery code: lock_inventory/wired.rs has no production caller.	#782	filed #782; re-checked b291caa: PnpmLock::wired_integrity (formats/pnpm/mod.rs:475) still test-only
E42	2	The embedded --vex glue is copied per command (scan, apply, and vendor ×3), each with caller-injected bypass sets. Target: one EmbeddedVex helper.	#966	filed #1877; tracked as T25 (#966 closed)
E43	2	Fail closed on unmodeled resolution config in one shared place.	#458	to verify; no linked issue/PR open; was: partly fixed (#987 and earlier); go.work remains (#458, E81)
E44	2	Decide: is the napi addon + in-memory engine a supported product (one pipeline), or deleted (−4.5K prod)?	#1200	carried; open: #1200; was: decision #1200; contract L670 (#1029) names a future GitHub App as the caller
E45	2	Decide: hosted rollback. Is an originals sidecar acceptable, or should restore be narrowed to formats whose original is a pure function of registry data?	#1130	carried; open: #1130; was: decision #1130
E46	2	Decide: VEX evidence. Should not_affected require consumed evidence by default, so that wired-only evidence (lockfile_basis_ok) needs an opt-in? About 46 open false-attestation issues (B05).	#1099	carried; open: #1099; was: decision #1099
E47	3	Decide: support tiers for bun.lockb writes, vendored pnpm 7/8, vlt pre-1.0 encodings and hosted pnpm ≤ 6, and whether hosted JVM ships as beta.	#1156	already fixed (#1156); decision settled and closed
E50	2	Hosted rewrite_nuget and upstream restore rewrite packages.lock.json entries of the patched id at other versions (every framework); vendored locked_at filters by version. Four lock walkers.	#593	already fixed (#593); hosted and upstream re-pin only the patched version (redirect/mod.rs L7196, upstream/nuget.rs L319)
E52	3	vendor/go_sum_edit.rs: free go.sum helpers have no production caller and are re-implemented by GoSumEditor; the pure hosted codec lives in vendor/.	#631	rejected; at b291caa remove_module_prefix_lines/reinsert_lines have production callers (redirect/upstream/golang.rs); the dead remove_lines is tracked by E58/#782; the codec move to formats/ is re-raised when vendor/go_sum_edit.rs is audited
E58	3	Production pub fns with no production caller, orphaned by #277 (committed_artifact_intact, go_sum_edit::remove_lines, hosted-vlt ledger helpers, three test-only helpers).	#782	filed #782; re-checked b291caa: committed_artifact_intact, go_sum_edit::remove_lines, seed_rubygems_sha256, copy_manifest_tag have no production caller
E63	2	Hosted Maven splices the API maven_suffixed_version into pom.xml unchecked, while hosted Gradle refuses a malformed suffix; four suffix builders (executed twice).	#882	carried; open: #882; was: filed #882
E64	2	No shared BOM helper (4 strip_bom copies, ~50 inline strips); formats::pnpm's lockfileVersion readers skipped it (executed twice). Symptoms #903, #904, #623.	#905	carried; open: #905; was: partly fixed (#909, #1117, #1160, #1191, #1277); 4 files remain on PENDING_INLINE_BOMS
E65	3	Every vendored sink discards force/sources, yet vendor --force docs promise a tolerance and a warning nothing emits (executed twice).	#923	already fixed (#923); vendor --force doc now says no flag is needed (vendor.rs L80-L83)
E68	2	Vendored gem forward treats any Gemfile containing the copy path as wired, revert needs the exact line: a trailing comment leaves the lock restored and the Gemfile on path: (executed 3×).	#988	already fixed (#988); revert matches the code before # (vendor/gem.rs L2431-L2493)
E69	2	"Is this an sbt/Mill/scala-cli build" is six marker lists (#690); some roots get no Coursier roots (executed twice).	#1014	carried; open: #1014; was: partly fixed (#1032); .mill-version rule remains (#1014)
E71	1	The supersede/re-pin lifecycle had no owned-pin generation model: older generations' wiring survived a re-pin or remove.	#999, #864, #682, #266	to verify; no linked issue/PR open; was: partly fixed (#1035, #943, #1008); non-npm vendored unserved supersede is E94
E72	1	VEX attests not_affected from wiring the package manager doesn't consume: yarn Plug'n'Play loaders, pnpm bundled copies and deno.lock npm copies.	#519, #406	to verify; no linked issue/PR open; was: partly fixed (#1033); #406 in-run scan --vex path open, Maven integrity_required waits on E46
E75	2	Which lockfile governs installs is decided in ≥8 places; vendored and hosted patch different PyPI locks and a takeover restores the losers unpatched.	#612	to verify; no linked issue/PR open; was: partly fixed (#1044); #612 takeover restore scope, pdm_drives vs pylock and the inventory PyPI order (E91) remain
E79	2	Hosted mode meeting a vendored package has 4+ outcomes per ecosystem. Target: one pre-rewrite decision. Depends on C34.	#536	to verify; no linked issue/PR open; was: filed #536
E80	3	The gitignore guard for vendored artifacts covers npm and sbt/Coursier only; Maven .jar and NuGet .nupkg are dropped by stock templates.	#1061, #620	to verify; no linked issue/PR open; was: filed #1061; #620 closed not planned
E81	2	Go writers ignore go.work and go env -w, and leave a read-only module-cache copy on Windows.	#458 (+9 symptoms)	to verify; no linked issue/PR open; was: filed #458; 9 symptom issues
E82	2	Cargo dual-source registries and a user's own [patch.crates-io] aren't modelled.	#480, #506, #679, #863	to verify; no linked issue/PR open; was: filed #480, #506, #679, #863
E83	3	The Maven reactor re-implements the effective POM (properties, BOM imports, parents, profiles).	#459 (+7 symptoms)	to verify; no linked issue/PR open; was: filed #459; 7 symptom issues; Maven lower priority
E84	2	Composer vendor-dir and global-home resolution ignore the global config and the XDG home.	#439, #586	to verify; no linked issue/PR open; was: filed #439, #586
E86	3	Vendored JVM fetches upstream artifacts and checksums only from Central or SOCKET_MAVEN_REGISTRY, ignoring mirrors and the build's repositories.	#1069	carried; open: #1069; was: filed #1069
E87	2	VEX product detection has no Gradle or sbt probe, and scan --vex resolves the product only after writing.	#1064	carried; open: #1064; was: filed #1064
E90	2	Which gem homes Bundler loads has two answers: vex and agent apply use get_gem_paths (keeps gem env homes under an explicit path), only the stale guard uses bundler_install_homes (executed twice).	#1098	to verify; no linked issue/PR open; was: filed #1098
E91	3	PyPI tool-lock precedence is written twice since #1044: the inventory keys on "yielded entries", the vendored router on presence. A package-less poetry.lock/pdm.lock beside requirements.txt makes scan offer a package vendored refuses (`pypi_poetry_loc…	#1114	carried; open: #1114; was: filed #1114
E93	3	NuGet version identity: vendor normalizes (normalize_nuget_version), PurlKey/crawler only lowercase; a vendored @13.0.3.0 is judged unused, so scan --prune reverts it (executed 3×).	#1202	to verify; no linked issue/PR open; was: partly fixed (#1230, #1239); PurlKey and the crawler lookup normalize; the move of normalize_nuget_version to formats::nuget remains
E94	2	"Keep the older vendored patch while the superseding one is unserved" (#954) is npm-only: ServicePolicy::unserved carries the code only under ServiceTerminal::Failure; other backends refuse vendor_prebuilt_required, so re-runs exit 1 (Composer, execut…	#1235	to verify; no linked issue/PR open; was: filed #1235
E95	3	sbt evidence fails closed on an unreadable record; scala_evidence::discover skips one, so a truncated -test twin hides a test.dep conflict and the scala-cli gate passes (executed twice).	#1270	to verify; no linked issue/PR open; was: in PR #1358
E96	3	requirements.txt exact pins have three grammars (inventory exact_pin, hosted requirement_version, vendored parse_requirement_line); vendored refuses six (==1.16.0) that the others accept (executed twice). Symptom #604.	#1365	already fixed (#1365); one requirements::parse_requirement

Carried over: CLI, core infra and tests (C rows)

Carried over from #560 on 2026-10-29 · statuses as of its last update 2026-10-09 · owner: audit-cli-tests

Re-verify each row on current main before acting on it (reconcile step). carried rows still have an open issue or PR; to verify rows have none open and may already be fixed.

ID	P	Problem	Issues	Status
C05	1	SOCKET_FORCE bound three --force flags; merged C35 (deprecated spellings, embedded --vex); vendor --force promises an unimplemented tolerance (#923).	#615, #966, #923	to verify; no linked issue/PR open; was: partly fixed (#1021, #1031); embedded --vex undecided (#966); #923 open
C09	2	There is no shared with_proxy_fallback helper: scan, get and vex each handle the proxy fallback, and apply, rollback, repair blob/diff downloads and vendor eject fetches have none (merged C39). Fix: the fallback moves into ApiClient.	#647	carried; open: #647; was: filed #647
C10	2	Tracking: RunCtx { config, client, telemetry, lock }, built once in main. It would delete apply_env_toggles (flags written back into process env, called at 11 sites) and unblock removing most env-mutating #[serial].	#793, #794	carried; open: #793, #794; was: filed #793, #794; tracking #793, child 1 #794
C11	2	Tracking: split run_scan (1,540 lines on 045d7ec; JSON and human arms each dispatch all three modes) into discover → select → ModeBackend::consume → render.	#843	carried; open: #843; was: filed #843; tracking #843 (#844 folded in)
C12	2	Tracking: move engine code out of the CLI and into core behind one orchestrator over ProjectView: vendor_records_reusing, run_redirect_selected, ecosystem_dispatch.rs. Coordinate with E32.	#894	carried; open: #894; was: filed #894; tracking #894 (#895 folded in); command cycles fixed (#1043), 14 allowlisted edges remain
C13	2	Error codes are untyped. Target: a typed registry (enum Reason × Ecosystem) that generates the contract's code tables, plus a freshness test (~43 undocumented codes). One unparseable manifest gives five --json codes across commands (merged C52).	#930, #931	carried; open: #930; was: filed #930, #931; tracking #930, child 1 #931 (manifest mapper)
C15	2	There are three HTTP retry systems, and blob and diff fetches have none. A 206-line HTTP-date parser, two near-identical downloaders, and per-fetch or per-event clients round it out. Target: one retry + timeout primitive.	#676, #677	carried; open: #676; was: filed #676; #677 fixed (#889): vendor retries share parse_retry_after/jitter; blob/diff still no retry
C16	2	Batch limits are split across crates. The CLI owns 500 / 100 / 256 KiB, and search_patches_batch documents a maximum of 500 without enforcing it. The in-memory engine keeps a third copy (default 100, no body cap).	#675	carried; open: #675; was: filed #675
C17	2	Digest helpers are duplicated: inline hex::encode(Sha256::digest(..)) sites, compute-vs-validate sha256_hex copies, sha1_hex twice, SRI formatting inlined three times.	#706	to verify; no linked issue/PR open; was: partly fixed (#865); inline-digest slice deferred (#706 closed not planned)
C18	2	There are four UUID grammars. client.rs has one, CLI lib.rs a byte-identical copy, path_safety.rs accepts lowercase only, and apply.rs accepts any alphanumeric plus -/_.	#705	carried; open: #705; was: partly fixed (#1034); api/client.rs and CLI lib.rs share utils::target::is_uuid_shaped; path_safety, apply.rs archive and python_script.rs grammars remain in #705
C19	2	Env truthiness has three vocabularies (core "1"/"true", kept correct only by apply_env_toggles) and ~29 inline "empty means unset" reads; the home-directory resolvers are unified.	#793	carried; open: #793; was: partly fixed (#1038); truthiness and empty-means-unset folded into #793
C20	2	Tracking: purls have two builder families in utils/purl.rs, plus 42 hand-built pkg: strings and ~48 starts_with("pkg:<type>/") checks beside Ecosystem::from_purl. Purl equality is C63.	#748, #747	carried; open: #747, #748; was: filed #748, #747; #747 slice 1 (7 checks in free files + one-sided guard) in PR #1126; children 2–4 touch the ecosystem area
C23	2	Dead code: PatchSources::mem_blobs is never Some; VendorSource predicates are always true; group commit captures redirect-state.json, which nothing in its scope writes; the switched_off("group_commit") oracle path.	#782	carried; open: #782; was: partly fixed (#1141); hosted-vlt helpers deleted; mem_blobs, VendorSource predicates and group-commit residue remain in #782
C24	2	Apply and rollback are mirror images: the verify types are identical, and fold_copy_result, the pnpm peer fan-out and the sidecar boundary are each written twice; the folds have drifted and both drop per-file records (#756). Target: one engine.	#771, #772	carried; open: #771; was: filed #771; #772 fixed (#774), shared store_copies::fan_out; verify types + sidecar boundary remain
C25	2	--download-mode diff, the default, re-downloads every blob on a cold cache, runs sequentially with no retry, and is the only user of qbsdiff. Making file the default is a decision; removing the duplicate fetch work is a refactor.	#792	already fixed (#1049); --download-mode, the diff path and qbsdiff are gone on c8e26f6
C26	3	Taking apply.lock replays the vendored group-commit journal, so lock-free vendor --check and vex misreport a crashed run (merged C46); an interrupt left the lock file.	#808, #809	to verify; no linked issue/PR open; was: partly fixed (#1030); interrupt cleanup merged, lock stays transient; journal layering remains in #809
C29	3	The client.rs split (2.8K lines) into client, vendor_service and credentials; the debug-ordering machinery (HeldBack) has 45 call sites.	#913	carried; open: #913; was: filed #913; #871 deferred (closed not planned)
C30	2	No shared test-support: binary() is defined in 103 files and git_sha256 in 86, there are 15 scrub_socket_env (14 bodies), xorshift is implemented four times, and the VEX helpers are forked.	#824, #823	to verify; no linked issue/PR open; was: filed #824, #823; #850 deleted 8 of 15 scrub_socket_env; #824 slices merged (#1124, #1258): binary() in 15 files, git_sha256 in 26; slice 3 merged (#1366, 5 more files)
C31	3	240 test executables on f3c6313 (review: 207); target ~25. Needs C10 first.		carried; open: #794; was: to verify; count confirmed, not filed: blocked on #794 (env-mutating #[serial])
C32	3	Tracking: ~478 one-line 4+-word .contains sentence assertions (245 in the 27 covgap files, 26,086 lines, 391 tests on 05ecc6e) become --json/errorCode checks plus render suites; _json/_human twins collapse.	#1089	carried; open: #1089; was: filed #1089; tracking #1089 (#1090 folded in); child 1 fixed (#1272, tests/common/envelope.rs)
C33	3	Tracking: CLI_CONTRACT.md (417 KB on 431b818; 332 KB at review) should be a checked reference (flags, env vars, codes, exit codes) plus ≤300 lines of prose, with freshness tests.	#948	carried; open: #948; was: filed #948; tracking #948 (#949, #678 folded in)
C34	3	Decide: the command model. A read-only scan, plus fix, undo, sync and check, with mode inferred from project state (or an explicit --mode for takeovers). This folds remove, rollback and vendor --revert.	#1088	to verify; no linked issue/PR open; was: decision #1088; recommends mode-as-project-state now (Q1 option 2), new verbs next major
C38	2	The public-proxy per-package fallback keeps a private cap of 10, ignoring SOCKET_API_CONCURRENCY, the proxy cap and the fd-limit rule; SOCKET_API_CONCURRENCY and SOCKET_WALK_THREADS are documented nowhere (merged C40).	#614, #948	carried; open: #948; was: filed #614, #948; #678 folded into #948
C41	2	Hash case policy is per site: blob download compares case-insensitively and the validators accept uppercase, but agent-mode apply/rollback verify with exact ==, so an uppercase manifest hash never verifies. Vendored verify sites are split the same way.	#707	already fixed (#707); the manifest load lowercases both hashes (schema.rs L30-L36), so agent-mode == compares lowercase
C43	2	With --manifest-path into another project, rollback, remove, repair, apply --check, vex, scan and get read the vendored ledger from --cwd while list, apply and vendor --check use the manifest's project; rollback locks one `.socket/…	#745	partly fixed (#745); ledgers load at GlobalArgs::project_root (context.rs L54); scan/gc.rs L253/L372 still probe cwd for the vendor ledger (local note)
C45	3	--download-mode is an unvalidated String, parsed late in fetch_stage/repair: a typo fails apply/repair with exit 1 and apply_failed/repair_failed (and scan/get only after saving the patch), while apply --check, rollback, list and `…	#792	already fixed (#1049); --download-mode no longer exists
C47	2	10 CLI test files spawned the binary with no SOCKET_* scrub; an ambient SOCKET_DRY_RUN=true turned 18 of 19 repair_vendor_e2e tests red.	#823	to verify; no linked issue/PR open; was: filed #823; 8 of 10 hermetic since #850; the last two are unblocked (#820, #849, #774 merged)
C48	2	Child processes had no shared deadline; crawler probes called output() unbounded, so a hung gem shim hung scan.	#845, #1067	carried; open: #1067; was: partly fixed (#886, #1106); the npm_dir git exchange keeps a hand-rolled deadline (#1067)
C50	2	Artifact GC has two retention policies: after_removal (rollback, remove) keeps active patches' beforeHash blobs for offline rollback, for_apply (repair, scan --prune) drops them; offline rollback then fails and names repair, which never fetches befo…	#893	already fixed (#893); one policy, ArtifactReferences::active, keeps beforeHash blobs for repair and scan --prune (cleanup_blobs.rs L29-L42)
C51	3	Agent-mode jar verification (jvm_jar::verify_member_bytes; apply, rollback, vex) buffers each patched member before hashing, while vendored zip_bytes_match_after_hashes streams since #587: 1,067 MiB vs 26 MiB peak RSS on a 1 GiB member.	#914	to verify; no linked issue/PR open; was: filed #914; partly fixed (#1253, agent mode); vendor/common.rs caller open
C54	3	The contract documents status: paidRequired and errorCode paid_required for get and scan, but get emits legacy status: "paid_required" (two hand-written blocks) and scan reports only paidPatches; Status::PaidRequired is never constructed.	#982	already fixed (#982); get sets Status::PaidRequired on both paths (get.rs L1566, L1832)
C56	2	apply, apply --check and vendor treat any stat error on .socket/manifest.json as "no manifest" (noManifest, exit 0); repair/remove/rollback say manifest_not_found. Five metadata().is_err() probes bypass read_manifest's NotFound rule.	#998	already fixed (#998); apply probes via manifest_exists and refuses a stat error (apply.rs L965-L968)
C59	1	Credentials reach logs, --json, telemetry and third parties: hosted Composer keeps transport-options auth (B02), grant tokens and URL userinfo appear in warnings and debug output (B26), the VEX product @id carried git-remote credentials (B21).	#399	to verify; no linked issue/PR open; was: in PR #1026; B21 fixed (#1070)
C60	1	.socket containment: the symlink guard starts below .socket and guards deletes only (#887, B08); get writes inline blobs through a planted link (B24); agent writes follow links out of the package (B25); a new-file patch overwrites an existing file eve…	#726	to verify; no linked issue/PR open; was: partly fixed (#1042); #887 closed; agent writes under a linked .socket and a rollback pre-image store remain
C61	2	CI gates passed while checking nothing: unvalidated path flags (B10), Go-only apply --check (B27), no per-purl hosted pin data (B12).		to verify; no linked issue/PR open; was: partly fixed (#1029); hosted exit code for unpinned patches waits on #704; #1123 is a regression in its path check
C67	1	Main went red on stale PENDING_INLINE_DIGESTS entries (two-sided ratchet, B01); no required checks, and push CI cancels most main verdicts (B28).	#1016, #1018	to verify; no linked issue/PR open; was: partly fixed (#1016, #1018); merge queue and per-SHA push concurrency merged; a ruleset with required checks needs org admin
C68	2	11 open -g (global install) bugs share one cause: global prefixes and shared caches are patched under per-project ownership.	#422, #423, #426, #435, #437, #443, #444, #450, #489	carried; open: #426; was: filed #422, #423, #426, #435, #437, #443, #444, #450, #489; #1000 kept agent mode
C69	2	Perf regressions have no owner: bun/hosted +110% (cause pinned), npm/hosted +15%, cargo and uv hosted per-patch re-parse.	#578, #993, #761, #836	carried; open: #761, #836; was: filed #578, #993, #761, #836; links to E27
C70	3	run_scan's human arm exits 1 when every query returns no patches; the JSON arms exit 0 (and preview GC and prune differently).	#1062	already fixed (#1062); scan human arm returns finish_human(0) on an empty discovery (scan/mod.rs L3055-L3061)
C71	2	scan reads a corrupt manifest as empty: --prune skips GC and reports success, the rollout counts recorded patches as new.	#1063	already fixed (#1776); scan fails closed on an unloadable manifest in agent mode and warns manifest_invalid/manifest_unreadable otherwise (scan/mod.rs L2036-L2050)
C72	2	Self-update and install.sh trust an unsigned SHA256SUMS from the same release.	#1065	carried; open: #1065; was: filed #1065
C73	3	rollback --json counters count only the agent leg, so hosted and vendored failures report failed: 0.	#1066	already fixed (#1066); summary.failed counts vendored and hosted legs (rollback.rs test L6319)
C74	3	With no patch state (fresh project, or after a full rollback), rollback and repair exit 1 (Manifest not found/manifest_not_found) while apply, vendor, vendor --revert and list exit 0; a second v5 rollback exits 1, pinned by a test.	#1088	decision #1352; supersedes #1088; still exit 1 (see T17)
C75	2	Every HTTP client trusts only reqwest's bundled webpki roots (no platform store, SSL_CERT_FILE or extra-CA knob), so behind a TLS-inspecting proxy the documented HTTPS_PROXY route fails with UnknownIssuer on every API, registry, telemetry and self-upd…	#1107	to verify; no linked issue/PR open; was: filed #1107
C76	3	validate_paths (#1029) refuses a directory manifest only when --manifest-path is spelled differently from the default: exit 2 with no --json output vs exit 1 manifest_unreadable for the same file.	#1123	already fixed (#1123); validate_paths no longer refuses a directory manifest (args.rs L402-L406)
C78	3	The hosted upstream restore sends every public-registry lookup at once (join_all in 5 formats); utils::concurrent::registry_concurrency() (cap 4, fd-tight 1) has no caller: 40 pins → 40 in flight.	#1220	already fixed (#1220); UpstreamClient takes registry_concurrency() permits (upstream/client.rs L193)
C79	3	GC is reported in four --json shapes (repair, remove, rollback, scan --prune); the contract's summary.bytesFreed/bytesDownloaded and events[].bytes are emitted by no command, so its GC jq recipe prints null.	#1257	already fixed (#1273); one GcReport; human drift is T19

Refactor routine

Last updated 2026-10-30T09:35Z · main @ 5ca5623

In flight

PR	Kind	Scope	State
#1842	sweep	cli/src/args.rs (+ the Deno guard moved into lib.rs)	ready
#1855	sweep	cli/src/commands/{bun_preflight,composer_hints,context,fetch_stage}.rs	ready; Bugbot clean; CI lost Depot runners twice (0 steps), needs a fresh run
#1849	structural	A01 #1832: utils/cargo_build_cache.rs	ready; CI and Bugbot green
#1864	sweep	cli/src/commands/{hosted_bundle,hosted_unwind,list,lock_cli,mod,pypi_reinstall}.rs (+ dead branch in rollback.rs)	ready; CI (82 checks) and Bugbot green
#1870	structural	A27 #1869: api/client.rs, one serve GET and one vendor retry loop	ready; CI (82 checks) and Bugbot green
#1875	sweep	cli/src/commands/{remove,repair}.rs	ready; CI (82 checks) and Bugbot green
#1884	sweep	cli/src/commands/scan/discovery.rs (+ T18 #1859; tests moved to core ranking.rs, lock_inventory/tests.rs, ui/text.rs)	ready; CI (82 checks) and Bugbot green
#1892	sweep	cli/src/commands/scan/gc.rs	ready; CI (82 checks) and Bugbot green
#1897	sweep	cli/src/commands/scan/hosted.rs (all but run_redirect_selected_untracked, T24; 13 guidance tests moved to core hosted/guidance.rs, 2 to formats/pnpm/mod.rs)	ready; CI (82 checks) and Bugbot green

Merged

None.

Queue

Structural candidates, scored 3·B + 2·U + 2·D + 2·C − risk:

1. T09 #1858, lock acquire open-coded 9×: D2.6 C2, risk M. ~7 (blocked while #1864 touches lock_cli.rs and #1698 touches vendor.rs / get.rs / agent_download.rs)
2. T01 #1835, get <uuid> re-implements download_and_apply_patches_into: D2.2 C2, risk M. ~6.4 (blocked by #1698)
3. T25 #1877, --vex embed hand-written ~8×: D2 C2, risk M. ~6 (blocked by #1698: apply.rs, vendor.rs)
4. T16 #1861, remove/rollback VendorRevertStep loops: D1.75 C2, risk M. ~5.5 (blocked by #1864, #1875, #1698)
5. A30 #1887, Maven ${…} interpolation ×5: D3.35 C2, risk M. ~8.7 (blocked by #1886: maven_scope.rs, maven_reactor.rs). A05 #1844 (~8, blocked by #1865: poetry_lock.rs) and A32 #1888 (~6, blocked by #1882: all three crawlers) also wait. A20 #1848 and A26 #1867 score 4 (files free).

A03 #1834 is the fixer's #1876. T28 #1880 and T23 #1860 wait on #1864 (list.rs) and #1698 (get.rs).

The next run is structural if a candidate scores 6 or more and its files are free, else a sweep. Next sweep files, in order: scan/hosted/{nuget,takeover}.rs (python.rs is in #1883), then scan/policy.rs and scan/render.rs once #1856/#1884 merge (policy's getters and admit_crawled are called from scan/mod.rs), then core/constants.rs, core/utils/cargo_home.rs. core/lib.rs is in #1891 and core/utils/cargo_workspace.rs in #1866. Skip agent_download.rs, apply.rs, get.rs, vendor.rs while #1698 is open, rollback.rs while #1864 is open, cargo_build_cache.rs (#1849) and api/client.rs (#1870).

Notes

• The PRs of the first thread (arch-refactor/<issue>-*) are listed in review/2026-10-v1/register/90-refactor.md.
• The args.rs note "drop api_client_overrides empty filter" was wrong: core build_proxy_fallback_client uses overrides.proxy_url unfiltered, so the CLI filter is load-bearing. Check every "redundant filter" note against all consumers of the value.
• Field doc comments on clap structs are --help output. Trimming them changes output bytes, so sweeps leave them alone.
• --cwd defaults to ., and Path::new(".").ancestors() stops at .. Any core walk up from the cwd must absolutize it first (cargo_crawler::resolve_for and nuget_config do; cargo_build_cache didn't until #1849). A test that spells the cwd as a relative path with components can't catch this: chdir under #[serial] and pass ".".
• vendor/cargo_config.rs (~L165-L190) keeps a third, async copy of the .cargo/config pick, with canonical dedup. It agrees on precedence; fold it into config_layer_paths when that file is swept.
• #1698 also touches vendor.rs, so the three bun_vendor_preflight* entry points (callers in get.rs, agent_download.rs, vendor.rs) and StageOutcome::Unavailable's payload (caller apply.rs) wait until it merges. Check every caller file against open PRs, not only the swept file.
• Build with CARGO_PROFILE_DEV_DEBUG=0 CARGO_INCREMENTAL=0: a default debug build of the CLI tests exhausts the session disk allowance. CI's clippy is --workspace --all-features without --tests; the integration tests carry pre-existing lints.
• ApiClient::with_vendor_retry is the policy builder; a new private helper with that name collides (E0592). Grep a name before you introduce it.
• tests/repair has 2 chmod-based tests that fail under the root sandbox (repair_cleanup_failure_is_reported_in_json_and_silent_modes, repair_exits_zero_and_stays_quiet_when_lock_file_unremovable); they pass in CI.
• remove's ~900-line run split (audit note) is too big for a sweep; it wants an issue alongside T16/T17/T20.
• A shared GET must keep every caller's bounds: folding an uncapped resp.text() error read into the capped PatchApi path is what /code-review caught on #1870.
• ui::shell_word has no escaping for an embedded " on Windows, and cmd still expands %VAR% inside its double quotes. Every pasteable command shares it, so fix it there (issue-worthy), not per caller.
• A test of a re-export or forwarding wrapper belongs beside the real function: move it to the defining crate and rebuild it on that module's helpers, instead of deleting coverage the target lacks (ui::shell_word had no test).
• scan/gc.rs's pre-lock ledger gate (has_ledger) probes --cwd, while run_vendor_gc reads project_root() (C43): a foreign --manifest-path skips a due vendor-only revert. Pre-existing; it wants an issue. The preview path also drops cargo_cache_patch_kept warnings.
• Pushing a branch deletion (git push origin :branch) is refused by the sandbox proxy. Name the branch right the first time: arch-refactor/sweep-scan-gc-policy is left stale.
• scan::hosted::run_redirect runs only under --json (scan/mod.rs calls it inside if args.common.json); the human arm goes through boxed_run_redirect_selected. run_redirect_selected still takes Option<Envelope> keyed on common.json; making it a value touches get.rs (#1698) and the T24 body.
• The gem stale probe (scan/hosted.rs pass 3) has two pre-existing gaps /code-review found on #1897: it dedups vendor/cache warnings by purl string (two spellings of one installed dir can warn twice), and it names the standalone archive {name}-{version}.gem, missing a platform gem's suffix. Both change output, so they want an issue.

[Mikola Lysenko (mikolalysenko)]

Part 2

Last checked against main @ 5ca5623 on 2026-10-30 by audit-cli-tests.

Common mechanisms:For each cross-cutting concern: the canonical mechanism (the one way the code should do it, with a permalink to its home), the deviations found (file, what it does instead, its register token), and a count. Concerns: error types and context; error codes and exit codes; swallowed errors and panics in non-test code; stdout/stderr and the ui layer; the JSON envelope; human text, color and progress; logging; env and config reading; paths and containment; file I/O (atomic writes, BOM/CRLF); HTTP clients, timeouts and retries; process spawning and deadlines; concurrency.

Findings

• Env and config reading (proposed canonical: one utils/env.rs with flag, non_empty and positive readers). Today there are three vocabularies: env_compat (exact 1/true), socket_cli_config::env_truthy (yes/on/y/t) and concurrent (trim plus debug log). A09 · to verify
• Home directory (proposed canonical: utils::fs::home_dir, which requires a usable absolute home). crawlers/hatch_env.rs, repo_root::home, process::neutral_probe_dir_with and socket_cli_config use their own rules. A10 · to verify
• spawn_blocking join handling (canonical: fs::run_blocking). fs::asyncify converts panics and cancellations into io::Error, which is a second policy. This is a local note on utils/fs.rs.
• Line endings (canonical: utils::line_endings). Four sites re-derive CRLF detection or the terminator, plus three eol_eq copies. A04 · filed Tracking: classify line endings in one place instead of five drifting rules #814; new sites added to the tracker's scope
• Durable directory sync: group_commit::sync_dir duplicates the fsync in fs.rs. A12 · to verify
• Env-var registry (proposed canonical: derive every scrub/hermetic list from clap's Arg::get_env() over cli_command()). Today args.rs keeps hand lists that already miss SOCKET_NO_SOCKET_YML. T03 · filed Derive the env-var scrub lists from clap's bindings; SOCKET_NO_SOCKET_YML is missing from LOCAL_ARG_ENV_VARS #1837
• Lock acquisition in the CLI (proposed canonical: one lock_cli helper taking GlobalArgs). The acquire/timeout/lock_failure sequence is open-coded 9× beside the 5 acquire_or_emit callers and the timeout conversion 14×; lock_held has 3 human renderings and scan/hosted prints it under --json. T09 · filed Acquire apply.lock through one lock_cli helper that takes &GlobalArgs; the sequence is open-coded 9 times and renders lock_held 3 ways #1858
• --json writes (canonical: ui::print_json). apply.rs alone writes 8 envelopes with println!("{}", env.to_pretty_json()) and builds RunWarning literals 12× instead of RunWarning::new. Local notes on apply.rs.
• URL credential stripping (proposed canonical: utils::redact). The live copy is vex::product::strip_url_userinfo; redact's own strip_url_credentials is dead. A20 · filed Keep one URL credential stripper: utils::redact::strip_url_credentials is dead while VEX and upstream npm use vex::product's copy #1848
• Lexical path normalization (canonical: utils::relpath::normalize_lexically_keeping_escapes). Four private PathBuf::pop copies. A19 · to verify
• Repository root walk (canonical: utils::repo_root). Three hand walks ignore GIT_CEILING_DIRECTORIES. A21 · to verify
• Committed JSON ledgers (proposed canonical: socket_dir::write_json_ledger). The manifest writer and two state markers serialize on their own. A16 · to verify
• Error emit (proposed canonical: one json_envelope::emit_error(Command, json, dry_run, EnvelopeError)). remove, rollback, repair (3×), list and scan each hand-write "envelope under --json, else stderr". T20 · to verify
• Run warnings (proposed canonical: RunWarning::new plus one ui sink with an explicit print-under---silent rule). The sink is hand-rolled in list ×3, user_patches and scan/withdrawn, which disagree on --silent; 40 RunWarning { literals vs 17 ::new. T21 · to verify
• Terminal-safe text (proposed canonical: core policy::strip_unsafe, keeping \n/\t). list::sanitize and StatusPrinter::println keep bidi and zero-width characters. T23 · filed Filter terminal-unsafe characters through one helper: list and the status printer keep bidi overrides and zero-width characters that core policy::strip_unsafe drops #1860
• Shell-quoted remedies (canonical: ui::shell_word). scan/discovery.rs keeps a POSIX-only copy. T18 · in PR Sweep scan/discovery.rs #1884
• Telemetry auth: repair copies core's token chain (api_token_available) to avoid building a client, while remove builds one eagerly (an org lookup and a proxy notice before any local work). Local notes; related to C10/Tracking: build one RunCtx in main and stop mirroring CLI flags into the process environment #793.
• HTTP retries (proposed canonical: one retry helper in api/retry.rs driven by one policy). api/client.rs runs two policies that disagree on statuses, counts, jitter and an over-cap Retry-After (executed: JSON gives up, vendor retries after 4 s), through four hand-written loops; blob GETs and the upstream registry client (Flake: nightly poetry hosted rollback fails on one transient PyPI request (UpstreamClient has no retry) #1650) retry nothing. A27 · in PR One serve GET and one vendor retry loop in api/client.rs (#1869) #1870
• Debug output (canonical: api::client::debug_log → [socket-patch debug] on stderr, deferrable per task). vendor/pypi.rs reuses its deferral; other modules print through env_compat::debug_message directly. Not yet surveyed beyond api/.
• Warnings inside a command (proposed canonical: RunWarning::new from the producer to the envelope, one human renderer in ui::text). Hosted helpers build serde_json::Value warnings and run_warning_of parses them back T27 · filed Carry hosted stale-install and takeover warnings as RunWarning, not serde_json::Value round-tripped through run_warning_of #1879; only scan/hosted.rs wraps and sentence-cases warning text, and scan prints policy and rollout warnings with two prefixes T34 · to verify. scan/mod.rs has 5 sinks with 3 --silent/--json rules, one printing to stderr under --json (L2940-L2953). Part of T21 · to verify.
• --vex embedding (proposed canonical: one commands::vex::embed). Hand-written ~8× across scan, apply and vendor; only scan reports vex_skipped_dry_run under --json. T25 · filed Embed --vex through one helper: the step is hand-written 8 times, and only scan reports vex_skipped_dry_run under --json #1877

[Mikola Lysenko (mikolalysenko)]

Part 3

Last checked against main @ 5ca5623 on 2026-10-30 by audit-core.

Duplicated business logic:One bullet per rule that has more than one implementation: the copies (permalinks), whether they have drifted, the register token, and the target home. Rules carried over from the first thread stay in the carried registers until reconciled.

Findings

• Cargo config chain: read by cargo_build_cache::ConfigDirs::read and by source_replacement::config_layer_paths. The two have drifted on which file wins, which is a bug. A01 · in PR Read the cargo config chain once (#1832) #1849
• Segment glob matching: three matchers (cargo_workspace::wildcard_match, workspace_globs::segment_glob_matches, hatch_workspace::fnmatch). The cargo one lacks classes, which is a bug. A02 · in PR Fix Cargo member globs with [..] classes (#1833) #1866
• GOMODCACHE/GOPATH default: go_crawler and go_installed_tools have drifted. A03 · in PR Fix Go module cache default read two ways (#1834) #1876
• Fragment pairing and the pdm/poetry rewrite triad: in lock_fragments, pdm_lock and poetry_lock. A05 · filed Drive pdm.lock and poetry.lock rewrites through one lock_fragments driver instead of two mirrored triads #1844
• Hex digest validators: written at about 10 sites. vendor/jvm reuses digest's names for computations. A06 · to verify
• Tool --version probe: written in utils/pipenv.rs and vendor/pypi_hatch.rs, with different hardening. A11 · to verify
• Prune-empty-dirs loops: three copies, and they disagree on whether the bound is inclusive. A12 · to verify
• Yarn major from packageManager: parsed twice. A13 · to verify
• Agent download engine: get <uuid> re-implements download_and_apply_patches_into for one patch, and the two have drifted. T01 · filed Route get <uuid> agent mode through download_and_apply_patches_into instead of a second copy of the engine #1835
• Vulnerability JSON: built 3× (agent_download, list, get); get's copy is unsorted and drops description. T02 · filed Serialize patch vulnerabilities through one helper; get's selectionRequired options[] are unsorted and drop description #1836
• Blob fetch-summary text: fetch_stage copies core blob_fetcher's formatters, drifted. T04 · filed Use core's blob fetch-summary formatter in apply's fetch_stage instead of a drifted copy #1838
• Bun/vlt vendored preflight glue: five callers, each with its own per-purl lookup. T05 · filed Run the Bun and vlt vendored preflights as one vendor_preflight with one per-purl refusal map #1839
• Release-variant gating: the CLI copies core's private variant_installed_at. T06 · to verify
• Apply/rollback mirror pieces: gem build-sibling rule (drifted: any copy vs variant-matched copy) and verbose verification printer (same output, two label sources). T08 · to verify
• Worst-severity label picker: 3 copies, drifted on unknown labels (the ladder itself is single). T10 · to verify Top-ranked patch per purl: 4 copies. T15 · to verify Overlay staging: 2 copies with different staging roots. T13 · to verify
• Mode resolution in get and scan, checks in different orders. T14 · to verify
• purl name@version split: about 12 hand copies, 3 in purl.rs alone, disagreeing on empty parts. A14 · filed Tracking: build and classify purls through one validated utils::purl API #748; copies listed in a comment
• Uuid shape: 4 checks; python_script's Uuid::parse_str accepts forms the others reject. A15 · filed Validate patch UUIDs through one utils::uuid grammar instead of five #705; Check uuid shape through one helper; python_script's Uuid::parse_str also accepts braced, urn and unhyphenated forms #1845 closed as its duplicate
• pnpm packages: membership: lists_member refuses brace/class globs that hosted reads with a second reader; the lock-member detector is written twice. A17 · in PR Fix pnpm brace and class workspace globs (#1846) #1863
• Poetry lock writer < 1.4: hosted and vendored copies; the shared reader is dead. A18 · in PR Fix Poetry lock writer read three ways (#1847) #1865
• uv settings file and no-binary precedence: python_script and redirect/upstream/uv. A22 · to verify
• requirements.txt logical lines: hosted keeps its own lexer and comment split. A23 · to verify
• "Our earlier hosted pin": pdm/poetry vs uv/pylock rules. A24 · to verify
• PEP 508 leading name: 3 scanners. A25 · to verify
• Vendored revert rendering: remove and rollback each turn VendorRevertStep into events in their own loop (vendor.rs twice more); drifted on --preserve-state --dry-run, go-undo warnings, keep text and failure handling. T16 · filed remove and rollback each render VendorRevertStep in their own loop, and the loops drifted (remove --preserve-state --dry-run previews a full revert) #1861
• "No manifest" gate: remove, repair and rollback, drifted on unledgered vendor wiring, a legacy redirect ledger, contested hosted wiring and global scope. T17 · to verify
• GC human text and warning channel: 4 renderers; repair counts cleanup_failed as a skipped event. T19 · to verify
• uuid-only PatchRecord: core ledgers::uuid_only_record beside 3 literals (list.rs L81, commands/mod.rs L388, core vendor/mod.rs L943). Local notes.
• --global/--global-prefix flag text: commands::global_scope_flag vs ui::global_scope_arg, drifted when both are set. Local note on commands/mod.rs.
• purl shape rule: CLI scan/discovery::crawled_from_purl and core hosted::memory::discover::supplement_purl (identical today; the core test asserts literals, not the CLI function). Part of A14 · filed Tracking: build and classify purls through one validated utils::purl API #748; copies listed in a comment.
• Civil-date math: days_from_civil in api/date.rs and formats/cargo/floor.rs, the inverse in vex/time.rs (which claims to be the only copy). Same values today. A26 · filed Keep civil-date math in one utils::time module: days_from_civil is written twice and vex::time claims to be the only copy #1867
• Serve-URL GET and retry loops: download_vendor_archive_once vs download_artifact_capped_once (drifted cap-breach variant and status text); 4 retry loops under 2 policies. A27 · in PR One serve GET and one vendor retry loop in api/client.rs (#1869) #1870
• Service-archive integrity gate: vendor_prefetch::ride_along re-implements service_fetch::fetch_verified_archive's sha512 + h1: checks. Local note.
• Worst-severity label picker: a fourth copy in core client.rs::convert_search_result_to_batch_info (handed to audit-cli-tests for T10 · to verify).
• Disk vs in-memory hosted pipeline: scan/hosted.rs repeats hosted/memory/stages.rs step for step; drifted on the governing-root refusal and warning order. Child of C12. T24 · to verify
• Pipenv stale-install remedy: hosted scan/hosted/python.rs and core vendor/pypi.rs; drifted on warning count, wording and name parsing. T26 · filed Build the Pipenv stale-install remedy in one core helper: hosted scan and vendored pypi each write it, and the copies drifted #1878
• Vulnerability label (CVEs else advisory id): scan render, get ×2, list; drifted on order, dedup and severity case. T28 · filed Render a patch's vulnerability labels through one ui helper: scan, get and list each write the CVE-else-advisory rule, and their order, dedup and severity case drifted #1880
• Hosted redirect JSON block: disk {mode, rewrittenFiles} vs core's seven-key block, whose doc claims to be the only spelling. T29 · decision Decide: one hosted redirect JSON block for disk scan and the in-memory engine (today {mode, rewrittenFiles} vs a seven-key block) #1881
• Snapshot/put-back of uncaptured files: scan/hosted.rs and vendor.rs eject; hosted drops put-back errors. T30 · to verify
• Root-marker predicate: scan/policy.rs lock_markers and core memory/roots.rs; disk adds a manifest fallback. T31 · to verify
• Agent dry-run preview event: scan, get and agent_download, plus a fourth already-recorded check in scan. T32 · to verify
• Patch selection: a fifth copy in core hosted/memory::select_with_policy; the socket.yml floor 3×, the tier filter 4×. T15 · to verify
• Maven ${…} interpolation: 5 copies; only formats::maven caps output length. A30 · filed Interpolate Maven ${...} properties through one formats::maven helper: five copies drifted on recursion, undefined names and the length cap #1887
• A POM's own coordinates: 3 readers, drifted on parent-version inheritance and ${ handling. A31 · filed Tracking: read and edit pom.xml through one element scanner in formats::maven #715
• Env-keyed subprocess memo: composer, python and ruby; python caches answers computed under a changed env. A32 · filed Memoize env-keyed subprocess probes through one helper: composer, python and ruby each define the same env key and drifted on when an answer is kept #1888
• Coursier-root predicate: coursier_spelled vs JvmCacheLayout::classify. A33 · to verify
• Go coordinate gate: 4 identical copies. A34 · to verify
• JVM cache plumbing: gradle roots ×2, hash-dir listing ×3, wrapper init.d ×2, -D parsing ×2. A35 · to verify
• platformdirs user dirs: 5 copies, drifted on Windows fallback and macOS XDG_*. A36 · to verify
• Small crawler twins (local notes): strip_windows_verbatim_prefix (hatch_env, python_crawler), hatch envs table choice (hatch_env, utils::hatch), PEP 503 name (hatch_env project_name, A25 · to verify), is_real_dir ×3, is_anchored (composer, relpath).

[Mikola Lysenko (mikolalysenko)]

Part 4

Last checked against main @ 5ca5623 on 2026-10-30 by audit-core.

Structure, abstraction and placement:Needless layers (one-impl traits, forwarding modules, invariant-free newtypes), tiny-function clusters, unclear control flow (mode flags, giant functions, accumulate-then-decide), and misplaced code (with its destination). Per-directory tallies of single-caller functions, wrappers and deletable comment lines go here as the audit covers each directory.

Findings

• utils/ holds ecosystem code, and some of it imports vendor::*: hatch ×2, pdm/poetry/lock_fragments, go ×2, cargo ×3, pnpm_workspace (imports patch::redirect), purl_key (imports crawlers/vendor) and python_lock. A08 · to verify
• utils/fs.rs is a grab-bag of four concerns: dir helpers, FIFO-safe readers, home resolution and the atomic writer. A10 · to verify
• GroupCommit::commit_unjournaled skips the post-commit removal queues that commit_changes drains. A07 · to verify
• Tally for utils/ (first 28 files, 14.5K lines):
  • about 75 single-caller functions;
  • about 30 trivial wrappers;
  • 0 one-implementation traits;
  • about 30 pub items with no caller outside their file (mostly in go_installed_tools, cargo_build_cache and concurrent), plus one dead function (pdm_lock::wheel_matches);
  • about 280 deletable comment lines.
• DownloadParams re-copies GlobalArgs field by field, and the nested apply rebuilds a GlobalArgs from it. T11 · to verify
• composer.lock parsing lives in the CLI (composer_hints), beside a prefix re-parse of vendored paths. T12 · to verify
• Tally for crates/socket-patch-cli/src (first 8 files, 15.9K lines: args.rs, commands/agent_download.rs → commands/get.rs):
  • about 74 single-caller functions (≈25 worth inlining; the rest are long or tested);
  • about 21 trivial wrappers or forwarders;
  • dead code: --vendor-source plumbing (one-variant VendorSource, C23), FetchBatch.already_recorded, apply's args.check branch and two unreachable variant arms;
  • about 760 deletable comment lines (apply.rs alone: 909 of 3,542 production lines are comments, 32 bare #NNN refs).
• Giant functions: get::run (~760 lines), apply::apply_patches_inner (~700), apply::run_locked (~510, folds the same results three times), agent_download::fetch_selected_patches (~280, branches on the store in 5 places).
• Tally for the rest of utils/ (20 files, 16.4K lines, pnpm_workspace.rs → workspace_globs.rs):
  • about 28 single-caller functions worth inlining;
  • about 36 trivial wrappers (7 bare build_*_purl format!s, 4 refuse_uv_* forwarders);
  • dead pub code: poetry_lock::lock_writer_version, python_lock::complete_python_lock_metadata(+_in), redact::strip_url_credentials/url_userinfo, target::Target::ambiguity, pnpm_workspace::shared_lockfile_disabled/git_branch_lockfile_setting;
  • toml_edit_ext.rs is a two-function module whose functions each have one caller elsewhere;
  • about 210 deletable comment lines.
• Module docs that claim a monopoly they don't have: relpath ("every normalizer") A19 · to verify, repo_root ("the one walk") A21 · to verify, redact (VEX @id) A20 · filed Keep one URL credential stripper: utils::redact::strip_url_credentials is dead while VEX and upstream npm use vex::product's copy #1848.
• Tally for crates/socket-patch-cli/src/commands (next 10 files, 15.5K lines: hosted_bundle.rs → scan/discovery.rs):
  • about 57 single-caller functions (≈20 worth inlining; the rest are tested formatters);
  • about 12 trivial wrappers or shims (patch_server_origins, HostedUnwindError, 2 pub use re-exports in discovery);
  • dead code: HostedLegOutcome::unsupported (never written; rollback still branches on it), InnerSelection::Identifier(None) (test-only), repair's ArtifactNoun parameter (always BLOB);
  • about 380 deletable comment lines.
• Giant functions (cont.): rollback::run (~1,210 lines), rollback::rollback_patches_inner (~830), remove::run (~920). C11/Tracking: split run_scan into discover, select, one mode dispatch and render phases #843 covers run_scan only.
• rollback.rs is remove's helper library: remove imports 12 items from it (text helpers such as join_clauses/as_question belong in ui; hosted ones such as retire_legacy_redirect_ledger in hosted_unwind). Local notes.
• scan/discovery.rs is a grab-bag: discovery, update detection, severity helpers and hosted/vendored nested-project policy (nested_project_skips, which belongs in scan/hosted.rs). Local note; C11.
• api/ is not a leaf layer: vendor_prefetch belongs in vendor/, the pypi wheel gate sits in client.rs, and api::types imports patch::redirect. A28 · to verify
• Tally for api/ (8 files, 12.0K lines) and crawlers/cargo_crawler* (1.7K):
  • about 20 single-caller functions worth inlining (fetch_binary/binary_url, format_fetch_result_for, the download_vendor_archive* chain, verify_crate_at_path);
  • about 12 trivial wrappers (identity ranking::merged_coverage, org_slug/uses_public_proxy over route(), CargoCrawler::cargo_home);
  • dead code: get_api_client_from_env (no caller), blob_fetcher's on_progress parameter (every caller passes None), CargoCrawler's Default;
  • about 140 deletable comment lines (mostly vendor_prefetch's 110-line module doc and client.rs history notes).
• Tally for crawlers/ (13 files, 13.3K lines: composer_crawler.rs → maven_crawler.rs, without maven_crawler/ and maven_scope.rs):
  • about 45 single-caller functions worth inlining;
  • about 47 trivial wrappers (the scan_maven_repo four-layer chain, is_safe_* one-line forwarders, test-only async shims);
  • dead code: maven is_ro_root (free fn), gradle_m2_ignored, maven_local_undetermined; jvm_cache::project_dependency_set (iterates &[]); DerivedIndex::incomplete; ivy's ignored _os parameter; fuzzy_match's limit (one caller passes usize::MAX);
  • about 330 deletable comment lines.
• Crawlers are stateless unit structs with new() + Default. A38 · to verify
• Codecs inside crawlers: deno_crawler's deno.lock readers (used by vex, hosted and vendor) belong in formats/deno, gradle_cache::parse_properties in formats/, the POM line scanner in formats::maven (A31 · filed Tracking: read and edit pom.xml through one element scanner in formats::maven #715), and JvmEnv/M2Gate in jvm_cache (A35 · to verify).
• Tally for crates/socket-patch-cli/src/commands/scan/ (8 files, 15.5K lines: gc.rs, hosted.rs, hosted/{nuget,python,takeover}.rs, mod.rs, policy.rs, render.rs):
  • about 90 single-caller functions (≈25 worth inlining; render's byte-tested builders stay);
  • about 26 trivial wrappers or shims (count, run_warning_of, emit_json_error, 4 re-export shims in mod.rs, 3 policy getters over a pub field);
  • dead code: selection_args (its only caller always takes the branch that ignores it), run_redirect's non-JSON arm and Option<Envelope> (called only from the JSON arm);
  • about 335 deletable comment lines.
• Giant functions (cont.): run_scan is now 1,864 lines (C11/Tracking: split run_scan into discover, select, one mode dispatch and render phases #843; it calls discover_selected twice in a row in its JSON arm), run_redirect_selected_untracked 1,233 T24 · to verify.
• Engine code in scan/: hosted/takeover.rs (a 425-line plan/stage/retract/finish engine over GroupCommit) and hosted/nuget.rs belong in core; scan imports commands::vendor::{dispatch_revert_one, run_vendor_gc, unused_vendored_manifest_keys}. C12. takeover.rs also parses core warning prose (residual_only_keep), and npm_allow_remote_one_line matches guidance sentences.
• Misplaced in scan/mod.rs: the takeover section (L926-L1123, used only by hosted.rs) and gradle_scan (L1194-L1387, Maven-specific). policy_bypass_warnings is get-only policy evaluation that belongs in core policy.

[Mikola Lysenko (mikolalysenko)]

Part 5

Last checked against main @ 5ca5623 on 2026-10-30 by audit-core.

Tests:Fake tests (asserting on their own mocks, recomputing expected values with the code under test, unable to fail, claiming more than they check), mock overuse where a tempdir or a real install is cheap, sentence-matching assertions, duplicate tests, and real coverage gaps. Per-directory tallies and the fixes that landed.

Findings

• Tally for utils/ (first 28 files): 17 fake or weak tests.
  • Tautologies: constants.rs ×3.
  • The expected value is recomputed with the code under test: concurrent per-window cap.
  • The test name overclaims:
    • durability vanished-file test;
    • group_commit journal test;
    • http production_builder_builds;
    • go_installed_tools unlistable-dir test (asserts the opposite when go is on PATH).
  • Duplicates:
    • pipenv ×3, copying process.rs tests;
    • pdm_lock shape-change test, copying a lock_fragments test;
    • fs entry_file_type ×2, which only exercise tokio.
  • Sentence matching where a typed error exists: http cap tests.
  • Only is_err() asserted: pdm_lock unsafe-sources test.
• Root-skip tests pass silently under root (group_commit ×2, fs ×3).
• Coverage gaps:
  • http mid-stream cap and Truncated;
  • cargo_build_cache warning text;
  • the cargo config precedence, now covered by A01 · in PR Read the cargo config chain once (#1832) #1849's acceptance criteria.
• Tally for crates/socket-patch-cli/src (first 8 files): about 38 fake, duplicate or misplaced tests.
  • Duplicates of core tests: get's 10 detect_* (core target.rs) and 9 select_* ranking tests (core ranking.rs).
  • Duplicates of tests/cli_global_args.rs: 6 inline tests in args.rs.
  • Can't fail: fetch_stage obsolete diff/package archive tests ×2; get apply_failed_line_is_an_error_even_when_silent (a const equals its literal); args env-list and VendorSource tests ×3.
  • Name overclaims: get select_json_mode_multi_free_options_serialize_vulnerabilities asserts only Err(1). T02 · filed Serialize patch vulnerabilities through one helper; get's selectionRequired options[] are unsorted and drop description #1836
  • Misplaced: ~63 agent_download tests (~2,800 lines) live in get.rs.
• Coverage gaps: no assert on any Gradle detail text in apply (a broken string continuation at apply.rs L3111 ships 17-space runs); no 401 test on get's search path; no test ties the env lists to clap. T03 · filed Derive the env-var scrub lists from clap's bindings; SOCKET_NO_SOCKET_YML is missing from LOCAL_ARG_ENV_VARS #1837
• Tally for the rest of utils/ (20 files): 23 fake or weak tests.
  • Tautologies: purl.rs ×15 (7 test_build_*_purl, 7 *_round_trip, test_is_purl); process.rs ×2 (assert std's Command::new).
  • Expected value recomputed with the code under test: purl_key nuget_key_agrees_with_the_vendored_version_match.
  • Duplicates: poetry_lock shape-change test (third copy) A05 · filed Drive pdm.lock and poetry.lock rewrites through one lock_fragments driver instead of two mirrored triads #1844; uri.rs's asserts repeated byte for byte in yarn_berry_lock.rs.
  • Weak asserts: poetry_lock malformed-integrity (!err.is_empty()), python_lock "ours" test (is_ok() passes on Ok(None)).
  • Misplaced: purl_key_nuget_vendor_tests.rs (an end-to-end vendor test), redact's lint of vendor/service_fetch.rs.
• Coverage gaps: python_script refuse_uv_no_binary/no_sources (project form) have no unit test.
• Tally for crates/socket-patch-cli/src/commands (next 10 files): about 30 fake, duplicate or misplaced tests.
  • Can't fail: list ordering_is_deterministic_across_builds (iterates one HashMap twice); remove dry_run_footer_matches_repair and repair's HOSTED_ONLY_REASON assert (a const equals its literal).
  • Asserts the test's own stub: rollback rollback_patches_missing_manifest_is_identifier_error (the message comes from the test helper's ok_or_else).
  • Duplicates of core tests: discovery's 5 severity_order tests (core ranking.rs), 4 candidate_supersedes and 1 unsupported_layout_warnings test of core functions; ~5 remove remove_matching tests repeat core Target tests.
  • Subset or overclaiming tests: lock_cli ×4, repair ×3, mod.rs ×3 (only is_err() or a .contains that a sibling message also satisfies).
• Coverage gaps: no test of remove --preserve-state --dry-run over a vendored entry T16 · filed remove and rollback each render VendorRevertStep in their own loop, and the loops drifted (remove --preserve-state --dry-run previews a full revert) #1861; no test that scan --json keeps stderr empty on a held lock T09 · filed Acquire apply.lock through one lock_cli helper that takes &GlobalArgs; the sequence is open-coded 9 times and renders lock_held 3 ways #1858; no bidi/zero-width test for list T23 · filed Filter terminal-unsafe characters through one helper: list and the status printer keep bidi overrides and zero-width characters that core policy::strip_unsafe drops #1860.
• Tally for api/ and cargo_crawler*: about 40 fake, duplicate or misplaced tests.
  • Tautologies: ranking merged_coverage_is_the_advisory_count (identity fn) and same_patch_dates_across_different_packages_do_not_interact (the key has no purl); date parsed_order_is_chronological_in_both_formats's monotonic assert (its own loop counter); types published_at_is_per_patch_not_per_package (its own fixture); tests/api_timeout_e2e.rs const == literal.
  • Duplicates: types ×10 serde serialize/roundtrip tests; ranking ×4 rung tests; blob_fetcher ×5 format tests.
  • Misplaced: client.rs tests is_hex ×5, severity_order ×2, is_uuid_shaped ×2; cargo_crawler tests package_name_version ×7 (covered in formats/cargo/manifest.rs).
  • Env mutation without a guard: client test_get_api_client_from_env_no_token (and it reads the user's socket-cli config).
  • Test scaffolding: four xorshift64* RNGs and eight legacy crawler oracles. A29 · in PR Build: share one test RNG across randomized tests (#1868) #1882; oracle deletion still to decide
• Strong: vendor_prefetch's serial-differential tests and client's wiremock retry tests assert request counts and outcomes, not mocks.
• Tally for crawlers/ (13 files): about 45 fake, duplicate or weak tests.
  • Can't fail: coursier_cache host_os_is_one_of_the_tables; deno default_and_new_construct_cleanly; go and maven test_crawl_all_deduplication (one package staged); go test_crawl_all_skips_cache_dir (no @ dir under cache/); maven comment_pom_falls_back_to_path (the fallback never runs).
  • Recomputes the expected value: hatch_env default_data_dir_and_config_dirs_env_virtual.
  • Vacuous FIFO tests: coursier_cache repo_roots_read_poms_fifo_safe and half of ivy_cache readers_are_fifo_safe never open the FIFO.
  • Duplicates of e2e tests: fuzzy_match ×9, go_crawler ×8, composer_crawler ×5.
  • Oracles that share the production helpers they check (composer, go): A29 · in PR Build: share one test RNG across randomized tests (#1868) #1882; oracle deletion still to decide. EnvGuard copied 11×: A37 · filed Share one scoped env-var test guard: EnvGuard is copy-pasted 11 times across core unit and integration tests #1889.
• Tally for commands/scan/ (8 files): about 40 fake, duplicate or misplaced tests.
  • Can't fail: scan/mod.rs 3 takeover_detail_* tests' negative asserts (phrases the string never had), an assert_ne! between constants, vex_error_warnings_append_to_scan_json (tests Vec::extend); hosted.rs a constant tautology (L4534).
  • Duplicates: hosted.rs L3836/L3853 exact; gc's composer/encoded/PEP 503 tests re-test core PurlKey; gc's corrupt-manifest tests ×2 repeat L966; render highest_severity_picks_worst copies core ranking.rs; package_specs_match_names_and_purls copies core policy/tests.rs.
  • Misplaced: 17 tests of core code in hosted.rs (~700 lines, 15 of hosted::guidance, reached through a cfg(test) re-export of 20 items); 2 Discovery tests in mod.rs.
  • Sentence matching: policy L988, render L856.
• Coverage gaps: takeover.rs plan/stage/retract/finish and hosted/nuget.rs have no unit test; redirect_takeover_not_pinned is in no test; scan's path_outside_repo and multi-directory --json/--vex refusals are untested; no test asserts disk and memory redirect keys agree T29 · decision Decide: one hosted redirect JSON block for disk scan and the in-memory engine (today {mode, rewrittenFiles} vs a seven-key block) #1881.

[Mikola Lysenko (mikolalysenko)]

Part 6: History — what carried over from #560

The first thread, #560 (2026-10-01 to 2026-10-09, 151 comments), reviewed the code module by module. Its living document, register, procedures and run entries are archived read-only under review/2026-10-v1/ on the ledger branch, and the original snapshot under review/2026-10/.

Carried over: every row that wasn't fixed, already fixed, rejected or handed off. These are 54 ecosystem and format rows (E) and 47 CLI, core and test rows (C), with their issue links. Each one is carried while one of its issues or PRs is still open, and to verify when none is. The auditors reconcile a few each run against current main, and an item that no longer fits this charter is rejected with a reason.

• Ecosystems and formats: E04 E05 E10 E12 E14 E15 E16 E19 E20 E21 E22 E24 E26 E28 E29 E30 E31 E32 E33 E36 E37 E40 E41 E42 E43 E44 E45 E46 E47 E50 E52 E58 E63 E64 E65 E68 E69 E71 E72 E75 E79 E80 E81 E82 E83 E84 E86 E87 E90 E91 E93 E94 E95 E96: 1 partly fixed · 7 already fixed · 10 filed · 19 carried · 15 to verify · 2 rejected
• CLI, core and tests: C05 C09 C10 C11 C12 C13 C15 C16 C17 C18 C19 C20 C23 C24 C25 C26 C29 C30 C31 C32 C33 C34 C38 C41 C43 C45 C47 C48 C50 C51 C54 C56 C59 C60 C61 C67 C68 C69 C70 C71 C72 C73 C74 C75 C76 C78 C79: 1 partly fixed · 12 already fixed · 1 decision pending · 21 carried · 12 to verify

What #560 concluded (its TL;DR as of 2026-10-09; the numbers are from then):

1. socket-patch is a product matrix implemented cell by cell. The matrix is 3 modes × 9 ecosystems × ~25 package-manager and lockfile generations × 6 operations (discover, apply/wire, verify, attest, revert, mode-takeover). There is no shared abstraction on any axis:

   • no lockfile codec;
   • no mode backend;
   • no vendor-backend trait;
   • no hosted-rewriter trait;
   • no single inventory.

   Each cell is hand-written text surgery. As a result, the same file format is parsed and spliced two to five times with different rules, and those rules have already drifted. For example, there are five different CRLF policies for the npm lockfile family alone.

2. Most of the open bug backlog has one shape: "reported success, but the build consumes unpatched code". Of the 88 issues open at the snapshot, roughly 29 were a success or a not_affected VEX attestation that the installed bytes don't back up (about 46 such false attestations are open on 2026-10-07; Stop VEX attesting over yarn PnP, pnpm bundled and deno.lock copies #1033 and Fix VEX attesting beside an unpatched same-lock copy (#935, #938, #939) #940 address the largest groups). Another 15 were discovery missing what the package manager actually installed. The root cause is architectural:

   • the tool re-implements package-manager behavior (install layouts, venv naming, config layering, resolution precedence);
   • it then reports success based on its own model of what the package manager will do;
   • every package-manager release or config knob it doesn't model becomes a silent false negative.

3. Support breadth has outrun the architecture. The long tail is disproportionately expensive:

   Long-tail target	Cost
   vlt	~6.5K production lines, ~22K total, ~123 CI jobs per push
   JVM (Maven/Gradle)	~9K production lines, 22 of the 88 open bugs
   bun.lockb	~2.8K production lines for a format Bun itself replaced
   vendored pnpm 7/8	1.85K lines, ~96% a copy of the v9 backend

   A support-tier policy would let the core get simpler.

4. The code is large for what it does, and much of the size is duplication and scaffolding.

   • ~134K lines of production code on 9c43dfc (~118K at the snapshot, plus 35K comment lines then).
   • ~450K lines of tests.
   • Nine functions over 500 lines; run_scan alone is 1,540 (on 045d7ec).
   • A 21.9K-line redirect/mod.rs on db83f01 (17.5K at the snapshot).
   • Two hosted orchestrators kept equal by parity tests.
   • Four discovery systems.
   • Nine different revert mechanisms.
   • Two JSON envelope shapes, 27 global flags silently accepted by every command, and 156 documented error codes.

   We estimate 25–35K production lines (20–30%) and 50K+ test lines could go. Roughly 20K of that comes from consolidation that keeps every capability; the rest comes from the support-tier and product decisions in §5.

5. The user model is harder than it needs to be. It has:

   • 9 verbs, 2 hidden subcommands, 2 aliases and 3 hidden flag spellings;
   • defaults that change with unrelated flags;
   • scan writing lockfiles by default;
   • mode that is not project state: a plain scan performs the documented "mode takeover" and switches vendored npm, Cargo, Go, PyPI and Gradle-built Maven packages back to hosted (made atomic in Make the vendored-to-hosted takeover atomic #1039, E70);
   • remove, rollback and vendor --revert as three ways to undo.

   A seven-verb model (scan read-only, fix, undo, sync, check, list, vex) with mode inferred from the project would cover everything (§4).

6. There are a few real defects to fix now (§1), regardless of any refactor:

   • no HTTP timeouts on the main API client (fixed, Bound patch API connects and stalled reads (#570) #581);
   • a ledger-loss bug in the vendored→hosted takeover (fixed, Fix PyPI vendored→hosted takeover stranding unreachable pins (#699) #708);
   • a planted-binary spawn (fixed, Fix vendored Hatch running a planted hatch (#613) #617);
   • a comment-blind NuGet config reader (fixed, Unify hosted NuGet routing and XML splice anchors #597);
   • a stale digest ratchet that turned main red for every PR (fixed, Fix main CI red on stale digest pending-list entries #1016; a merge queue follows in Run CI on the merge queue and stop cancelling main push runs #1018).

   The October 7 audit added credential leaks (C59), .socket containment (C60) and the non-atomic takeover (E70); each has a PR. SOCKET_FORCE (Decide: give SOCKET_FORCE per-command names so forcing a self-update doesn't also force apply and vendor #615, PR Remove the SOCKET_FORCE env binding; --force is flag-only (#615) #1021) and the bun.lockb registry override (E02, fixed by Resolve vlt registry bases through one shared function (#562) #574) are no longer open defects.

---

[github-actions[bot]]

[agent] 2026-10-29: architecture audit (audit-core)

main @ b291caa. This is the first run of the file-by-file thread. I read 28 files, about 14.5K lines, all of them complete with no partial: constants.rs, lib.rs, and utils/ from cargo_build_cache.rs through pipenv.rs.

Per file

Counts are single-caller functions / wrappers / deletable comment lines / fake tests.

File	Lines	Counts	Note
constants.rs	108	0 / 0 / ~8 / 3	The 3 fake tests are tautologies.
lib.rs	22	clean
utils/cargo_build_cache.rs	483	6 / 1 / ~4 / 0	7 needless pub items.
utils/cargo_home.rs	191	1 / 0 / ~6 / 0
utils/cargo_workspace.rs	690	4 / 2 / ~12 / 0
utils/composer_version.rs	415	5 / 0 / ~8 / 0	Dead composer_version_identity_key.
utils/concurrent.rs	429	3 / 2 / ~8 / 1
utils/containment.rs	216	3 / 2 / ~3 / 0
utils/digest.rs	224	0 / 2 / ~5 / 0
utils/durability.rs	365	3 / 4 / ~25 / 1
utils/env_compat.rs	193	2 / 1 / ~3 / 0
utils/failpoint.rs	87	0 / 0 / 0 / 0	Small hit() cleanups.
utils/fs.rs	1991	7 / 5 / ~65 / 5	The 5 fake tests are redundant.
utils/go_env.rs	287	3 / 1 / ~3 / 0
utils/go_installed_tools.rs	644	7 / 2 / ~2 / 1	12 needless pub items.
utils/group_commit.rs	2163	4 / 2 / ~20 / 2
utils/hatch.rs	1738	7 / 3 / ~12 / 1
utils/hatch_workspace.rs	604	6 / 1 / ~8 / 0
utils/http.rs	546	1 / 2 / ~6 / 1
utils/line_endings.rs	238	clean	Callers re-derive it: A04.
utils/lock_fragments.rs	654	2 / 1 / ~4 / 0
utils/mod.rs	45	visibility only
utils/notice.rs	99	1 / 0 / 0 / 0
utils/npm_range.rs	117	2 / 0 / 0 / 0
utils/package_manager.rs	31	0 / 0 / 0 / 0	One-function module: A13.
utils/pdm_lock.rs	1315	4 / 3 / ~10 / 2	Dead wheel_matches.
utils/pep440.rs	347	0 / 1 / ~1 / 0
utils/pipenv.rs	224	2 / 1 / ~8 / 3	The 3 fake tests duplicate process.rs tests.

The detailed cleanup lists are in each file's notes in coverage/files.tsv.

Structural findings

Both bugs were shown by scratch tests in a throwaway worktree. No product code was changed.

• A01, bug, filed #1832. The build-cache cleaner reads .cargo/config.toml where cargo reads .cargo/config. Run with both files present, it resolved ws/modern where cargo uses ws/legacy.
• A02, bug, filed #1833. members = ["crates/[ab]*"] resolves to [].
• A03, refactor, filed #1834. GOMODCACHE/GOPATH resolution is written twice, and the copies have drifted.
• A04 → Tracking: classify line endings in one place instead of five drifting rules #814. Line-ending re-derivations.
• To verify:
  • A05: fragment pairing ×3 and the pdm/poetry triad. Confirm when poetry_lock.rs is read.
  • A06: hex validators about 10×.
  • A07: commit_unjournaled skips the post-commit queues. The code is confirmed; reachability is not.
  • A08: ecosystem code in utils/.
  • A09: three env vocabularies.
  • A10: three home rules.
  • A11: version probe ×2.
  • A12: prune loops ×3.
  • A13: yarn major ×2.

Carried rows reconciled (5)

• E28: filed #782. Still real.
• E37: filed #748. The normalize_version and strip_leading_v twins remain.
• E41: filed #782. wired_integrity is still test-only.
• E52: rejected. The free go.sum helpers now have production callers, and the dead remove_lines is tracked by E58.
• E58: filed #782. All four functions still have no production caller.

Ruled out

• fs.rs's let _ = swallows (L785, L846, L856) are documented best-effort.
• go_env::user_config_dir reading only HOME is correct: it matches Go's os.UserConfigDir on Unix.
• cargo_home trims CARGO_HOME and only empty-checks HOME. The comments say this is deliberate.
• The hardcoded .socket/manifest.json literals in the CLI are all inside test modules.
• group_commit's catch_unwind is justified, because the profile is panic=unwind.
• The hatch batch-vs-sequential helper is backed by an exact-bytes test.

Next files

utils/pnpm_workspace.rs (1682), poetry_lock.rs, process.rs, purl.rs, purl_key.rs, purl_key_nuget_vendor_tests.rs, python_lock.rs, python_script.rs, redact.rs, relpath.rs, repo_root.rs, requirements.rs, and the rest of utils/ through workspace_globs.rs. That is about 16.4K lines.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-10-29: architecture audit (audit-cli-tests)

main @ c07af61. This is the first run of audit-cli-tests. I read 8 files, 15,949 lines, all complete with no partial: args.rs, then commands/agent_download.rs through commands/get.rs. The manifest needed no sync: since b291caa, main only modified 3 existing files, and none was added or deleted.

Per file

Counts are single-caller functions / wrappers / deletable comment lines / fake tests.

File	Lines	Counts	Note
args.rs	1810	5 / 5 / ~75 / 9	Dead --vendor-source plumbing. 6 inline tests duplicate tests/cli_global_args.rs.
commands/agent_download.rs	1909	9 / 4 / ~110 / 1	Its tests live in get.rs. Dead FetchBatch.already_recorded.
commands/apply.rs	4324	27 / 4 / ~250 / 2	Broken string continuation at L3111. Three dead branches.
commands/bun_preflight.rs	425	3 / 3 / ~25 / 0	Three forwarders and a lazy-load mode.
commands/composer_hints.rs	314	4 / 0 / ~6 / 0
commands/context.rs	109	0 / 1 / ~6 / 0	Stale module doc, otherwise clean.
commands/fetch_stage.rs	649	5 / 1 / ~20 / 3	Orphan doc comment. 2 tests can't fail.
commands/get.rs	6409	21 / 4 / ~160 / 23	19 tests copy core tests. ~2,800 lines of agent_download tests.

Each file's detailed cleanup list is in its notes column in coverage/files.tsv.

apply.rs L3111 bug, shown by cat -A. The gradle_m2_may_be_unconsumed detail lost its \ line continuations, so the message carries three runs of 17 spaces. I put it in the local notes because it is a one-line fix inside the file.

Structural findings

• T01 → #1835. get <uuid> in agent mode re-implements download_and_apply_patches_into.
• T02 → #1836. The vulnerability JSON is built three times. Get's options[] copy is unsorted and drops description. This is from reading the code: it iterates a HashMap. I did not execute it.
• T03 → #1837. The env scrub lists are hand copies, and SOCKET_NO_SOCKET_YML is missing from them.
• T04 → #1838. fetch_stage keeps a drifted copy of core's fetch-summary formatter.
• T05 → #1839. The Bun and vlt preflight glue is repeated at 5 callers.
• To verify:
  • T06: variant gating copies core.
  • T07: the VexSummary literal is written 7 times.
  • T08: apply/rollback mirror pieces, under Tracking: one agent-mode patch engine for apply and rollback #771.
  • T09: the lock-acquire sequence.
  • T10: the severity ladder.
  • T11: DownloadParams copies GlobalArgs, under Tracking: build one RunCtx in main and stop mirroring CLI flags into the process environment #793.
  • T12: composer.lock parsing in the CLI.
  • T13: overlay staging root.
  • T14: mode resolution in get and scan.
  • T15: top-ranked selection is written 4 times.

Carried rows reconciled (5)

Each was checked against the code on c07af61:

• C54: already fixed (#982). Get sets Status::PaidRequired on both paths.
• C56: already fixed (#998). apply probes with manifest_exists and refuses a stat error.
• C70: already fixed (#1062). Scan's human arm exits 0 on an empty discovery.
• C73: already fixed (#1066). rollback's summary.failed counts the hosted and vendored legs.
• C76: already fixed (#1123). validate_paths no longer refuses a directory manifest.

Already covered, not re-filed

• Get's search path has no 401/403 proxy fallback. That is C09, #647.
• apply_env_toggles is called at 10 command entry points. That is C10, #794.
• The three boolean env vocabularies are A09 and C19, #793.
• The one-variant VendorSource is C23, #782.
• rollback.rs's metadata().is_err() probes (L682, L1455, L3186) will be checked when rollback.rs is audited.

Ruled out

• apply.rs manifest probing is correct (C56 is fixed).
• synthesize_vendor_owned_results has a documented stack-frame reason to stay a separate function.
• composer_hints .contains asserts on hint prose are acceptable, because the output is prose with no code.

Next files

commands/hosted_bundle.rs, hosted_unwind.rs, list.rs, lock_cli.rs, mod.rs, pypi_reinstall.rs, remove.rs, repair.rs and rollback.rs (6,525). That is about 13K lines.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-10-29: architecture refactor (sweep)

main @ c07af61. This is the first run of the refactor routine on this thread. No earlier entry existed and no maintainer steering was posted, so I swept the first audited, unswept row in coverage/files.tsv: crates/socket-patch-cli/src/args.rs (1810 lines). Open PRs don't touch it. #1698 touches agent_download.rs, apply.rs and get.rs, so those wait.

PR: #1842, ready for review, with CI and Bugbot pending.

args.rs

• Inlined: 3 functions. unsupported_ecosystem_message, telemetry_credentials, and refuse_unloaded_deno_prefix (into its one caller, Commands::validate_paths).
• Flattened: 1. validate_paths uses one require_dir instead of two copies of the same block.
• Comments: about 110 lines removed. These were history notes, bare #444 / #745 / #1123 references and text that restated the code. --help doc comments are untouched.
• Tests: 12 deleted, 4 fixed.
  • 9 deleted as duplicates of tests/cli_global_args.rs or of another inline test.
  • 3 deleted because they can't fail: two assert constant VendorSource predicates, and one checks a hand-written list against itself.
  • The 4 fixed tests (ecosystem messages, telemetry_auth, use_public_proxy threading, and the vendor-source test name and comments) each fail when the code is broken; I checked that for the non-trivial ones.
• Net lines: production −94 (args.rs −117, lib.rs +23), tests −232.

Merges recorded

None.

Lessons

• The coverage note "drop api_client_overrides empty filter" was wrong. build_proxy_fallback_client uses proxy_url without filtering empties, so the filter is load-bearing. I kept it and documented why.
• Clap field doc comments are --help text, so a sweep must not trim them.

Next

Structural work, per the alternation rule. The top candidates are A01 (#1832) and A02 (#1833), both scoring 7.

[github-actions[bot]]

[agent] 2026-10-29: handover from audit-core to audit-cli-tests

Found while auditing crates/socket-patch-core/src/utils/ at c07af61. Both are in your files.

• crates/socket-patch-cli/tests/e2e_vex_lockfile/yarn.rs L185 re-implements encode_uri_component instead of importing core's utils::uri helper (uri.rs).
• crates/socket-patch-cli/src/lib.rs L475-L562: 14 looks_like_uuid_* tests re-test core's uuid rule. That rule is being consolidated by A15 (#1845), so one smoke test is enough.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-10-29: architecture audit (audit-core)

main @ c07af61. I read 20 files, about 16.4K lines, all complete with no partial: the rest of utils/, from pnpm_workspace.rs through workspace_globs.rs. utils/ is now fully audited. No product code was changed and nothing was executed: every finding below comes from reading the code, with permalinks. Where a finding would need a run to prove a behavior claim, it stays to verify.

Per file

Counts are single-caller functions / wrappers / deletable comment lines / fake or weak tests.

File	Lines	Counts	Note
pnpm_workspace.rs	1682	3 / 4 / ~12 / 0	Two dead pub wrappers. A17, A08
poetry_lock.rs	1859	3 / 3 (+2 aliases) / ~8 / 2	Dead lock_writer_version. A05, A18
process.rs	783	1 / 2 / ~25 / 2	Stale stderr docs
purl.rs	1428	2 / 9 / ~25 / 15	15 tautology tests. A14
purl_key.rs	633	4 / 1 / ~8 / 1
purl_key_nuget_vendor_tests.rs	151	0 / 0 / ~6 / 0	Misplaced end-to-end test
python_lock.rs	2283	4 / 4 / ~15 / 2	Dead complete_python_lock_metadata. A24, A25
python_script.rs	1768	1 / 5 / ~30 / 0	Always-None parameter. A15, A22
redact.rs	552	0 / 0 / ~6 / 1	Dead strip_url_credentials. A20
relpath.rs	232	0 / 0 / ~4 / 0	Clean code, false doc. A19
repo_root.rs	363	3 / 1 / ~3 / 0	A21
requirements.rs	1125	1 / 2 / ~14 / 0	Stale module doc. A23
serde.rs	21	0 / 0 / ~6 / 0
socket_cli_config.rs	527	1 / 1 / ~8 / 0	A09, A10
socket_dir.rs	492	0 / 0 / ~8 / 0	A12, A16
target.rs	762	3 / 1 / ~6 / 0	Dead Target::ambiguity
toml_edit_ext.rs	42	2 / 0 / ~2 / 0	Delete the module
uri.rs	49	clean
uv_workspace.rs	214	1 / 0 / ~11 / 0
workspace_globs.rs	1445	2 / 2 / ~15 / 0	Duplicate segment_glob_matches. A02

The detailed cleanup lists are in each file's notes in coverage/files.tsv.

Structural findings

Filed (5):

• A05: confirmed. #1844 asks for one lock_fragments driver for pdm and poetry.
• A15: #1845, uuid shape is checked 4 ways.
• A17: #1846, pnpm packages: refuses brace and class globs the shared matcher reads.
• A18: #1847, the poetry pre-1.4 writer rule is written twice and the shared reader is dead.
• A20: #1848, the redact credential stripper is dead while vex::product's copy serves production.

Added to an open tracker: A14, purl name@version split ×12. I commented on #748 instead of filing a new issue.

New rows left to verify:

• A16: JSON ledgers are written 2–3 ways. Fixing it changes manifest bytes.
• A19: four .. folders.
• A21: three .git walks.
• A22: uv settings ×2.
• A23: hosted requirements lexer.
• A24: two hosted-pin rules.
• A25: PEP 508 name ×3.

Existing rows extended:

• A02: npm_crawler::expand_workspace_pattern_sync has no brace expansion. I did not execute this.
• A06: poetry and pdm artifact validators.
• A08: pnpm_workspace → redirect, purl_key → crawlers/vendor, and python_lock.
• A09, A10: process and socket_cli_config each add another home or env reader.
• A12: socket_dir::prune_empty_dirs callers.

Handover: two CLI test duplicates went to audit-cli-tests.

Carried rows reconciled (5)

• E04: already fixed (#572). One recognizer stack remains; the residual pdm/poetry vs uv rule is now A24.
• E05: filed #595. The issue is open, and the Maven crawl is still unscoped.
• E10: filed #715. maven_repo.rs still uses no shared XML reader.
• E12: rejected. The LockIndex path is an accelerator that is re-checked by the scan's own predicates, so it is one rule, not two copies.
• E14: already fixed (#1188). Vendored Pipenv splices through formats::pipenv.
• Next carried row: E96 looks fixed. Every reader goes through requirements::parse_requirement, and the vendored parse_requirement_line is gone. I will reconcile it next run.

Ruled out

• CommandRunner has two production impls, so it is a real seam.
• pnpm env_setting and pnpm_env_setting encode different coercions on purpose.
• same_hosted_artifact is not a fourth E04 recognizer: it delegates to replaceable_hosted_pin first.
• PEP 503 canonicalization has one implementation.
• SourcesLayout changes bytes and is pinned by tests.
• Picomatch { negated } carries meaning as an Option.
• The ExtglobMatcher memo key is sound.
• The write_json_ledger failure tests use real filesystem errors, not mocks.

Next files

All of api/:

File	Lines
blob_fetcher.rs	1191
client.rs	6356
date.rs	528
mod.rs	7
ranking.rs	986
retry.rs	561
types.rs	663
vendor_prefetch.rs	1705

That is about 12K lines. After that come crawlers/cargo_crawler.rs and onward, to about 15K lines.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-10-29: architecture refactor (structural)

main @ c07af61. The previous run was a sweep, so this run was structural. A01 #1832 and A02 #1833 both score 7. A02 is blocked: the open #1829 touches workspace_globs.rs and npm_crawler.rs. So I took A01. There was no maintainer steering.

PR: #1849, ready for review, with CI and Bugbot pending.

What changed

• cargo_build_cache::ConfigDirs::read now takes its files from source_replacement::config_layer_paths, and I deleted its own walk and file pick. When both files exist, the cleaner now reads .cargo/config over config.toml, as cargo 1.93 does (checked with real cargo).
• /code-review high found that build_dirs_with walked the ancestors of the cwd as given. With the default --cwd ., from a workspace member, it found no build dir. It now walks std::path::absolute(cwd).
• The file probe consults group_commit::exists, so it agrees with the capture-aware read.
• Tests: 2 added, each shown red→green. My first version of the relative-cwd test could not fail, because a relative path with components still walks upward. I replaced it with a chdir under #[serial].
• Net lines: production about −7, tests +56.

Merges recorded

None. #1842 is still open.

Lessons

• See the Notes in the register: absolutize --cwd before any upward walk, and test that with "." after a chdir.
• vendor/cargo_config.rs keeps a third .cargo/config pick. I left it for that file's sweep.

Next

A sweep: commands/bun_preflight.rs onward.

[github-actions[bot]]

[agent] 2026-10-29: architecture refactor (sweep)

main @ c8e26f6. The previous run was structural, so this run was a sweep. There was no maintainer steering, and no PR of mine merged or closed. The next audited, unswept rows were four files in cli/src/commands/: bun_preflight.rs, composer_hints.rs, context.rs and fetch_stage.rs. No open PR touches them.

PR: #1855, ready for review, with CI and Bugbot pending.

Per file

• bun_preflight.rs: 1 function inlined (refusal_with_exemptions), plus one is_npm helper in place of 3 copies of the npm purl check. The no-op probe loop now runs only for the workspace-gate code. About 45 comment lines removed. Production −41, tests 0.
• composer_hints.rs: 3 bare #658 references removed. 4 tests now assert exact strings instead of .contains, including the relocated vendor dir on both hosted_reinstall_hint branches. Tests +11.
• context.rs: the wrong users in the module doc and a wrong doc link fixed, #745 dropped. −2.
• fetch_stage.rs: 1 function inlined (report_offline_missing) and 2 single-use constants inlined. The orphaned vendor-stager doc deleted. 2 tests deleted because they can't fail (they cover archive stores nothing reads). 1 test fixed: the fully-cached test now also runs online, and it fails red when the missing_blobs.is_empty() fast path is broken. Production −39, tests −51.
• Net: production about −82, tests about −40.

Not done

The audit notes' collapse of the three bun_vendor_preflight* entry points and the StageOutcome::Unavailable payload both need edits in get.rs / agent_download.rs / vendor.rs / apply.rs, which #1698 touches.

Merges recorded

None.

Lessons

• Check every caller file a signature change reaches against open PRs, not only the file being swept: vendor.rs turned out to be in Fix Go patch delivery, audits, and reinstalls #1698.

[github-actions[bot]]

[agent] 2026-10-29: architecture audit (audit-cli-tests)

main @ c8e26f6. I read 10 files, 15,560 lines, all complete with no partial: commands/hosted_bundle.rs through commands/rollback.rs, then commands/scan/discovery.rs. The manifest needed no sync: since c07af61, main changed only CI files, and no .rs file was added or deleted. There was no maintainer steering on the discussion.

Per file

Counts are single-caller functions / wrappers / deletable comment lines / fake or weak tests. Each file's cleanup list is in its notes column in coverage/files.tsv.

File	Lines	Counts	Note
hosted_bundle.rs	182	1 / 0 / ~2 / 0	Stale stdin schema. Ad-hoc json! error. Hand-built ApiClient skips api_client_overrides.
hosted_unwind.rs	170	0 / 1 / ~3 / 0	Dead HostedLegOutcome::unsupported, which rollback still branches on (C23).
list.rs	1102	1 / 1 / ~20 / 1	ordering_is_deterministic_across_builds can't fail. Hand-built uuid-only record.
lock_cli.rs	596	4 / 0 / ~30 / 4	Most sites bypass the wrapper (T09).
mod.rs	675	3 / 1 / ~8 / 3	global_scope_flag duplicates ui::global_scope_arg and has drifted.
pypi_reinstall.rs	206	clean
remove.rs	2184	10 / 3 / ~90 / 1 + 5 dup	run is 924 lines.
repair.rs	1349	8 / 1 / ~45 / 1 + 3 dup	The ArtifactNoun parameter only ever takes one value.
rollback.rs	6525	25 / 2 / ~120 / 1 + 3 weak	run is 1,214 lines. The file doubles as remove's helper library.
scan/discovery.rs	2571	4 / 4 / ~35 / 11	Copies of core tests. Its shell_word copy has drifted (T18).

Structural findings

• T09 → #1858, lock acquisition.
  • Re-verified with counts. The sequence is open-coded at 9 sites, and the timeout conversion appears 14 times.
  • lock_held has 3 different human renderings.
  • scan/hosted prints the human error to stderr even under --json.
• T16 → #1861, vendored revert rendering. remove and rollback each render VendorRevertStep in their own loop.
  • remove has no WouldRevert if preserve arm. So remove --preserve-state --dry-run previews vendor_would_revert where the wet run reports vendor_state_preserved.
  • I confirmed this by reading the code: remove.rs L1421-L1438 vs rollback.rs L1039. I did not run it; a cold build was stopped to save time.
• T18 → #1859, shell_word. discovery's private copy quotes POSIX-style on Windows and leaves % bare.
• T23 → #1860, terminal-safe text filter. Only core drops bidi and zero-width characters, so list passes them through from API text.
• To verify:
  • T17: the "no manifest" gate is written 3 times and has drifted. It overlaps the open decision Decide (post-v5): fix/undo/sync command model and exit 0 when there is nothing to undo #1352.
  • T19: GC human text and warning channel.
  • T20: the error-emit helper.
  • T21: the warning sink and its --silent rule.
  • T22: rollback's before-blob gate uses metadata(), where the engine uses symlink_metadata().is_file(). It fails closed. Not executed.
• Rewritten rows:
  • T08: the printer-drift claim was wrong. Core never sends an empty hash, so the output is the same. The build-sibling rule has drifted in meaning: apply counts any copy in the gem home, rollback only a variant-matched copy.
  • T10: the severity ladder exists once. The "worst label" picker has 3 copies, and they have drifted on unknown labels.

Carried rows reconciled (5)

• C25: already fixed (#1049). --download-mode, the diff path and qbsdiff are gone.
• C45: already fixed (#1049).
• C74: decision #1352. That issue supersedes Decide: make the command model read-only scan plus fix/undo/sync, with mode taken from project state, and make "nothing to undo" exit 0 #1088. remove, repair and rollback still exit 1.
• C78: already fixed (#1220). UpstreamClient now takes registry_concurrency() permits.
• C79: already fixed (#1273). GC now reports through one GcReport. The remaining human and warning drift is T19.

Next to reconcile, from the reading:

• C50 looks fixed. ArtifactReferences::active keeps beforeHash blobs.
• C43 looks fixed for remove and repair. Both use project_root().

Handover

To audit-core:

• the uuid-only record in vendor/mod.rs;
• supplement_purl, which duplicates the CLI's shape rule (A14);
• a stale client.rs comment;
• policy::strip_unsafe for T23.

Ruled out

• T10's ladder: every copy already delegates to core severity_order.
• rollback.rs L1440 manifest probe: it uses manifest_exists, so it is fixed. The ledger probe at L1454 (metadata(state.json).is_ok()) is a residual of C56. It is a local note.
• discovery's debug_assert!(false) refetch: it can't be reached.
• C09, C16 and C38: discovery has no proxy fallback, no batch constants and no private cap.
• C73: it stays fixed.

Next files

• commands/scan/gc.rs, scan/hosted.rs, scan/hosted/{nuget,python,takeover}.rs, then scan/mod.rs (5,264). That is about 13.4K lines.
• If time allows, scan/policy.rs.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-10-29: handover from audit-cli-tests to audit-core

Found while auditing crates/socket-patch-cli/src/commands/ at c8e26f6. All four sites are in your files.

• vendor/mod.rs L943-L951 hand-builds a uuid-only PatchRecord in a closure. It should call ledgers::uuid_only_record. The CLI copies are in the notes for list.rs and commands/mod.rs.
• hosted/memory/discover.rs L162-L171: supplement_purl copies the CLI's scan/discovery::crawled_from_purl shape rule. The two are identical today. Its test asserts hand-written literals instead of the shared rule, so nothing stops them drifting. This belongs with A14 / Tracking: build and classify purls through one validated utils::purl API #748.
• api/client.rs L3175-L3179 cites "get.rs severity_rank", which has moved to agent_download.rs (T10).
• policy::strip_unsafe is the target helper of T23 (#1860). Generalizing it to keep \n/\t touches policy/mod.rs.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-10-29: architecture refactor (sweep)

main @ 5ca5623. The previous run was a sweep, so this run looked for structural work first. No eligible candidate scored 6 or more:

• A02 #1833 is still blocked: Fix hidden npm workspace members left unpatched (#1827) #1829 and Fix pnpm brace and class workspace globs (#1846) #1863 touch workspace_globs.rs.
• T01 #1835 and T05 #1839 are blocked by Fix Go patch delivery, audits, and reinstalls #1698.
• The new T16 #1861 scores about 5.5 (D1.75 C2, risk M; its drift is unexecuted, so B0).

So I ran a sweep, per the rule. There was no maintainer steering, and no PR of mine merged or closed.

PR: #1864, ready for review. CI and Bugbot are pending.

Per file

• hosted_unwind.rs:
  • Deleted the never-written HostedLegOutcome::unsupported, along with rollback's dead hosted_unsupported loop and exit-code conjunct.
  • Merged the two post-flush blocks.
  • A dry run no longer reads bun patch keys.
  • Removed 3 bare # references.
  • Net about −11, plus −11 in rollback.rs.
• hosted_bundle.rs: take() instead of clone(), and the doc now lists policySha256. Net 0.
• list.rs:
  • 1 fn inlined (vendor_state_lenient, from mod.rs).
  • 1 alias dropped.
  • uuid_only_record, and 3 RunWarning::new.
  • About 12 comment lines removed.
  • 1 can't-fail test deleted.
  • Net about −23.
• lock_cli.rs:
  • 3 fns inlined (emit, held_hint, held_message). The human error now goes through format_lock_error.
  • About 40 comment lines removed.
  • Tests: 3 merged into 1, and 1 duplicate deleted.
  • Net about −104.
• mod.rs:
  • mod user_patches moved up, and uuid_only_record used.
  • 3 weak tests fixed (exact usage errors), shown red→green.
  • Net about −1.
• pypi_reinstall.rs: clean.
• Total: +160 / −300. Production about −105, tests about −35.

Merges recorded

None.

Lessons

• An unconstrained cargo build of the CLI test binaries fills the session's disk allowance. Build with CARGO_PROFILE_DEV_DEBUG=0 CARGO_INCREMENTAL=0, and run only the CI clippy command (--workspace --all-features, no --tests; the integration tests carry pre-existing lints).
• hosted_bundle's json! error and its hand-built ApiClient change output or behavior, so a sweep can't touch them. They need an issue.

[github-actions[bot]]

[agent] 2026-10-30: handover from audit-core to audit-cli-tests

Found while auditing crates/socket-patch-core/src/api/ at 5ca5623.

• T10, a fourth worst-severity picker. It is in core: api/client.rs convert_search_result_to_batch_info L2591-L2658.
  • It keeps the worst label by hand through an alias of ranking::severity_order (get_severity_order).
  • Ties go to the first label in GHSA-id order, and an unknown label is never chosen over None.
  • Fold it into whatever helper T10 settles on.
  • The stale "get.rs severity_rank" citation at client.rs L3175-L3179 is in a test that my notes already mark for deletion (it duplicates ranking.rs).
• tests/api_timeout_e2e.rs L326-L329 asserts API_CONNECT_TIMEOUT == 10 s and API_READ_TIMEOUT == 60 s, each a constant compared with its own literal. The constants are pub only for this test.
• The discovery.rs severity_order wrapper (L576) wraps ranking::severity_order(Some(s)). Its 5 tests duplicate ranking.rs's, which is already in your Part 5 tally.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-10-30: architecture audit (audit-core)

main @ 5ca5623. This run read 10 files, about 13.7K lines, all complete with no partial: all of api/, then crawlers/cargo_crawler.rs and its oracle. No product code was changed. Two existing unit tests were run on main to prove A27's behavior claim; every other finding comes from reading the code. The coverage manifest is in sync with main: no files were added or deleted.

Per file

Counts are single-caller functions / wrappers / deletable comment lines / fake or weak tests.

File	Lines	Counts	Note
api/blob_fetcher.rs	1191	2 / 1 / ~10 / 5	Dead on_progress parameter; two stage+rename writers have drifted
api/client.rs	6356	8 / 6 / ~40 / 11	Dead get_api_client_from_env. A27, A28
api/date.rs	528	0 / 0 / ~4 / 1	A26
api/mod.rs	7	clean
api/ranking.rs	986	0 / 1 / ~6 / 6	Identity fn merged_coverage
api/retry.rs	561	3 / 0 / ~15 / 1	A27
api/types.rs	663	0 / 0 / ~5 / 11	Unread required OrganizationInfo.plan
api/vendor_prefetch.rs	1705	1 / 0 / ~30 / 0	Belongs in vendor/ (A28); duplicate integrity gate
crawlers/cargo_crawler.rs	1593	3 / 2 / ~20 / 8	Stateless unit struct; A19, A29
crawlers/cargo_crawler/oracle.rs	79	test-only	Not verbatim any more. A29

The detailed cleanup lists are in each file's notes in coverage/files.tsv.

Structural findings

Filed (3):

• A26: #1867. Civil-date math lives in three modules (api/date, formats/cargo/floor, vex/time); the target is one utils::time.
• A27: #1869. client.rs has two near-copy serve GETs, four retry loops and two retry policies.
  • Executed on main: api::retry::tests::delay_caps_retry_after_and_jitters_backoff_into_the_upper_half and api::client::vendor_retry_tests::delay_is_exponential_jittered_and_capped both pass.
  • Together they pin that a Retry-After over the cap ends a JSON call (None), while the vendor path retries after 4 s.
• A29: #1868. There are four xorshift64* test RNGs. Deleting the eight legacy crawler oracles is left to decide.

New row left to verify: A28, api/ imports vendor/redirect. It overlaps #833.

Register statuses refreshed:

• A02 is in PR #1866.
• A17 is in PR #1863.
• A18 is in PR #1865.
• A01 is still in PR #1849.
• No arch-audit issue was resolved by a merged PR.

Handover: core's convert_search_result_to_batch_info is a fourth worst-severity label picker, sent to audit-cli-tests for T10.

Carried rows reconciled (5)

• E96: already fixed (#1365). Every reader goes through utils::requirements::parse_requirement.
• E15: partly fixed (#693). Read Cargo.toml package name and version through one shared toml_edit reader #693 and Hosted cargo redirect refuses a dependency whose inline table has a multi-line features array, because it plans Cargo.toml pins with a line scanner #757 are closed. vendor/cargo.rs path_crate_version (L1545) still reads [package].version with toml_edit, bypassing formats::cargo::manifest. It has no BOM handling and no [project] fallback; this is a local note for when that file is audited.
• E16: filed #814. It is tracked with A04.
• E19: filed #780. Read Gemfile.lock sections and DEPENDENCIES entries through formats::gem in hosted and vendored modes #780 is still open; Read the go.mod module directive through go_mod_edit and delete the crawler's unused parse_go_mod_module #781 is closed.
• E20: filed #833. A28 adds the api imports.

I also shortened the E04 and E12 statuses to keep 50-carried-ecosystems.md under 15,000 characters.

Ruled out

• vendor_prefetch tests: they compare every planned run against the serial run's outcomes and request counts on a real HTTP mock. That is a differential test, not a mock assertion.
• date.rs RFC 2822 vs RFC 3339 offset leniency: the difference is deliberate and pinned by tests on both sides.
• ruby_crawler::parse_dir_name_version vs cargo's: gem and crate directory names follow different boundary rules (last dotted vs first dotted), so they are not one rule. Re-check when ruby_crawler.rs is audited.
• HeldBack/with_deferred_debug: one mechanism with two users (vendor_prefetch, vendor/pypi.rs), not a duplicate.
• update/download.rs's retry loop: it rides out ETXTBSY on exec, not HTTP, so it is not part of A27.

Next files

crawlers/composer_crawler.rs (2573), composer_crawler/oracle.rs (137), coursier_cache.rs (712), deno_crawler.rs (1102), fuzzy_match.rs (325), go_crawler.rs (1883), go_crawler/oracle.rs (163), gradle_cache.rs (995), hatch_env.rs (998), ivy_cache.rs (696), jvm_cache.rs (413), listing.rs (108), then maven_crawler.rs (3145). That is about 13.3K lines, or 16.4K with maven_crawler.rs.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-10-30: architecture refactor (structural)

main @ 5ca5623. The previous run was a sweep, so this run was structural. A27 #1869 scored about 7.5 (D2.75 C2, risk M), and no open PR touches api/client.rs. The other candidates were blocked or scored lower:

• T09 #1858, about 7, is blocked by Sweep hosted_unwind, lock_cli, list, commands/mod (+ rollback dead branch) #1864 and Fix Go patch delivery, audits, and reinstalls #1698.
• A02 is now the fixer's Fix Cargo member globs with [..] classes (#1833) #1866.
• T01 is blocked by Fix Go patch delivery, audits, and reinstalls #1698.

There was no maintainer steering, and no PR of mine merged or closed.

PR: #1870, ready for review. CI and Bugbot are pending.

What changed (api/client.rs)

• serve_get_once(url, max_bytes, noun) replaces the two serve GETs (download_vendor_archive_once, download_artifact_capped_once).
• retry_vendor replaces the three hand-written vendor retry loops. It also takes a split download's deferred first attempt, so a split still spends one budget.
• Deleted: download_vendor_archive_retrying, download_vendor_archive_from, vendor_download_retry, download_artifact_capped, download_artifact_capped_once, CappedAttempt and ServeDownload::Failed.
• Error text unified, as the issue asked:
  • A cap breach is now Other("<noun> exceeds the N-byte limit").
  • Status errors go through status_error.
  • The error body is read under the caller's cap. /code-review caught that the first version read it uncapped on the PatchApi path.
• Policy values unchanged. The Retry-After-over-cap disagreement is left for a follow-up.
• Tests:
  • 1 added (trait_download_error_body_is_capped, shown red→green).
  • 1 tightened (cap_breach_is_not_retried now asserts the exact error).
  • 1 renamed and re-pointed (every_vendor_retry_path_…).
  • The merged loop was shown red by ignoring deferred: 2 tests failed.
• Net lines: production +119 / −238 (−119), tests +36 / −6.

Merges recorded

None.

Lessons

• Grep a new helper's name first: with_vendor_retry is already the public builder.
• When two code paths are merged, keep each caller's resource bounds.
• The core lib suite has 4 root-only failures in the sandbox (copy_tree, vlt_heal, pypi_poetry, pypi_requirements).

[github-actions[bot]]

[agent] 2026-10-30: architecture refactor (sweep)

main @ 5ca5623. The previous run was structural, so this run was a sweep. There was no maintainer steering, and no PR of mine merged or closed. The next audited, unswept rows were cli/src/commands/remove.rs and repair.rs. No open PR touches either file (rollback.rs, the next row, is in #1864).

PR: #1875, ready for review. CI and Bugbot are pending.

Per file

• remove.rs:
  • 2 fns inlined (emit_not_found, hosted_unwind_error), and 1 newtype deleted (HostedUnwindError).
  • The hosted_reverted event and the kept-exit tail are each built once now, by hosted_reverted_event and kept_exit_code.
  • Renamed print_hosted_leg_warnings to print_run_warnings.
  • 6 envelopes now go through ui::print_json, and 2 warning literals use RunWarning::new.
  • About 15 comment lines removed.
  • 1 can't-fail test deleted. 1 test now asserts exact lines instead of .contains.
  • Net: production −62, tests +4.
• repair.rs:
  • The always-BLOB noun parameter is dropped from 5 formatters.
  • About 35 comment lines removed.
  • 1 tautological assert and 2 duplicate multibyte tests deleted.
  • 2 offline tests merged into 1 that covers the wet and dry runs, shown red→green by dropping the !offline conjunct.
  • Net: production −52, tests −108.
• Total: +188 / −406.

Not done

• The split of remove's 924-line run: too big for a sweep.
• T16, T17, T19, T20: structural.
• The typed vendor-reference tuple: it lives in vendored_backend/repair.rs.

Merges recorded

None.

Lessons

• Before deleting a single-caller formatter's test, check that the wording it pins is covered somewhere else. format_found_missing stayed for that reason.
• print_json(&env.to_value()) is byte-identical to to_pretty_json() only because the workspace builds serde_json with preserve_order.

[github-actions[bot]]

[agent] 2026-10-30: architecture audit (audit-cli-tests)

main @ 5ca5623. I read 8 files, 15,505 lines, all complete with no partial: commands/scan/gc.rs, scan/hosted.rs, scan/hosted/{nuget,python,takeover}.rs, scan/mod.rs, scan/policy.rs and scan/render.rs.

• The manifest needed no sync: no .rs file was added or deleted.
• There was no maintainer steering on the discussion.
• The reading was split across four parallel readers. I re-checked each structural claim before filing it.

Per file

Counts are single-caller functions / wrappers / deletable comment lines / fake or weak tests. Each file's cleanup list is in its notes column in coverage/files.tsv.

File	Lines	Counts	Note
scan/gc.rs	1840	2 / 2 / ~30 / 8	Lock block twice. The vendor-ledger gate probes cwd (C43). The preview drops the cargo-kept warnings.
scan/hosted.rs	4955	24 / 9 / ~120 / 3 + 17 misplaced	A 1,233-line copy of core's memory pipeline (T24).
scan/hosted/nuget.rs	88	1 / 0 / ~2 / 0	A one-function module. Crawler errors are swallowed.
scan/hosted/python.rs	550	1 / 0 / ~4 / 1	A drifted copy of core's Pipenv remedy (T26).
scan/hosted/takeover.rs	721	8 / 2 / ~12 / 0	An engine in the CLI. It parses core warning prose. No unit tests.
scan/mod.rs	5264	18 / 8 / ~150 / 7	run_scan is now 1,864 lines. selection_args has no effect.
scan/policy.rs	1051	14 / 4 / ~10 / 1	Selection copy (T15), marker copy (T31).
scan/render.rs	1036	22 / 1 / ~8 / 2	Vulnerability-label copy (T28). API text printed unfiltered (T23).

Structural findings

• T25 → #1877, the --vex embed step. It is hand-written about 8 times across scan, apply and vendor. Only scan pushes vex_skipped_dry_run under --json; apply and vendor drop the request silently. Confirmed by reading apply.rs L1011-L1070 and vendor.rs L1119. T07 is folded in.
• T26 → #1878, the Pipenv stale-install remedy. Hosted python.rs and core vendor/pypi.rs each build it, and they have drifted on warning count, suffix (a literal <purl> placeholder) and name parsing. I read both copies side by side.
• T27 → #1879. Hosted warnings travel as serde_json::Value and are parsed back by run_warning_of. Part of T21.
• T28 → #1880, the vulnerability label. It is written 4 times, and the copies have drifted on order, dedup and severity case.
• T29 → #1881, decision. Disk and memory hosted scan emit different redirect blocks, yet core's doc claims there is one spelling. I confirmed redirect_json_block has only memory-path callers.
• To verify:
  • T24: the disk/memory hosted pipeline copy (child of C12/Tracking: move the patch engines out of the CLI command modules into core #894).
  • T30: snapshot/put-back written twice. Hosted swallows put-back errors.
  • T31: the root-marker predicate, written twice.
  • T32: the agent dry-run preview event, built 3 times.
  • T33 (suspected): the takeover removes every same-release ledger entry. Unexecuted.
  • T34: the warning renderer is scan-only.
• Extended rows:
  • T10: current line numbers.
  • T15: raised to P2. There is a 5th selection copy in core memory, the floor is written 3 times, the tier filter 4 times, and paid tiers are counted two ways.
  • T20: 4 more sites in scan/mod.rs and 3 in hosted.rs. The hosted.rs sites print stderr under --json.
  • T21: scan/mod.rs has 5 sinks. One prints to stderr under --json (L2940-L2953); the nested-project warnings print under --silent.
  • C11: run_scan has grown from 1,540 to 1,864 lines. run_redirect's non-JSON arm is dead.

Carried rows reconciled (4)

• C41: already fixed (#707). The manifest load lowercases both hashes.
• C43: partly fixed (#745). Ledgers load at project_root, but scan/gc.rs still probes cwd; that is a local note.
• C50: already fixed (#893). There is one retention policy, ArtifactReferences::active.
• C71: already fixed (#1776). scan fails closed in agent mode and warns otherwise.

Handover

To audit-core:

• hosted/render.rs's false doc;
• select_with_policy;
• roots::root_markers;
• 15 guidance tests that live in the CLI;
• another xorshift copy (A29).

Ruled out

• policy.print_human printing twice: it is idempotent through a flag.
• The agent GC running on a non-zero exit: both arms do it, so they agree.
• RunWarning literals and to_pretty_json in hosted.rs/mod.rs: there are none.
• takeover's names_package: it is not a copy of the core helpers of that name; each does a different job.
• boxed_run_redirect_selected: its stack-size reason holds.

Next files

scan/rollout.rs, rollout_args.rs, socket_yml_args.rs, vendor_flow.rs, withdrawn.rs, then commands/update.rs, user_patches.rs and vendor.rs (7,937 lines). That is about 12.5K lines.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-10-30: handover from audit-cli-tests to audit-core

Found while auditing crates/socket-patch-cli/src/commands/scan/ at 5ca5623.

• Wrong doc in hosted/render.rs. render.rs L22-L26 says redirect_json_block is shared by every hosted path. Only hosted/memory/mod.rs calls it; disk scan emits {mode, rewrittenFiles}. The decision is #1881 (T29).
• A fifth selection copy. hosted/memory/mod.rs select_with_policy L1401-L1453 re-implements the socket.yml floor beside the CLI's ScanPolicy::select. Tracked in T15.
• The root-marker predicate, in two places. hosted/memory/roots.rs root_markers L41-L58 and CLI scan/policy.rs lock_markers share one predicate, and the disk copy adds a manifest fallback. T31.
• hosted::guidance is tested from the CLI. 15 of its tests live in CLI scan/hosted.rs (L2829-L3361, L4682, L4775-L4909), reached through a cfg(test) re-export, while guidance.rs itself has 2. Move them when you audit guidance.rs.
• Another xorshift64* copy (A29). It is inline in CLI scan/hosted.rs L3184-L3190. grep also finds copies in go_sum_edit.rs, go_mod_edit.rs and cargo_lock_equivalence_tests.rs.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-10-30: architecture refactor (sweep)

main @ 5ca5623. The previous run was a sweep, so this run looked for structural work first. No candidate scoring 6 or more has free files:

• T09 #1858 (~7) is blocked by Sweep hosted_unwind, lock_cli, list, commands/mod (+ rollback dead branch) #1864 and Fix Go patch delivery, audits, and reinstalls #1698.
• T01 #1835 (~6.4) and the new T25 #1877 (~6) are blocked by Fix Go patch delivery, audits, and reinstalls #1698.
• T16 #1861 scores about 5.5.

So I ran a sweep, per the rule. The next audited, unswept row with free files is scan/discovery.rs; agent_download.rs, apply.rs, get.rs and rollback.rs are held by open PRs. T18 #1859 is local to that file, so I claimed it and folded it in. There was no maintainer steering, and no PR of mine merged or closed.

PR: #1884, ready for review. CI and Bugbot are pending; /code-review high ran first.

Per file

• scan/discovery.rs:
  • 2 re-export shims deleted (unsupported_layout_warnings, merge_ledger_records_for_updates).
  • 2 wrappers inlined (candidate_supersedes, severity_order), plus the duplicate shell_word (T18).
  • About 20 comment lines removed, including 8 test banners.
  • 5 duplicate tests deleted (severity_order). 5 tests moved to their code's module: 3 to core ranking.rs, 1 to lock_inventory/tests.rs and 1 to ui/text.rs, the last two shown red→green.
  • 1 single-use test helper deleted.
  • Net: production −40, tests −195.
• Callers: scan/mod.rs, render.rs and get.rs (L911) import from core; net about +2.
• Total: +127 / −283. Production +25 / −63, tests +102 / −220.

Behavior

Only the nested_project_skipped remedy changes, as #1859 asks: % is quoted, and Windows gets double quotes.

Merges recorded

None.

Lessons

• ui::shell_word had no unit test of its own; only the private copy was tested. Before deleting a duplicate's tests, check that the survivor is covered.
• ui::shell_word's Windows branch doesn't escape an embedded ", and cmd expands %VAR% inside double quotes. Both are shared by every caller and are worth an issue.

[github-actions[bot]]

[agent] 2026-10-30: architecture audit (audit-core)

main @ 5ca5623 (unchanged since the last run). This run read 13 files, about 13.3K lines, all complete with no partial: crawlers/composer_crawler.rs through crawlers/maven_crawler.rs, in coverage order, excluding the maven_crawler/ subfiles. No product code was changed, and nothing was built or executed. Every behavior claim below is marked unexecuted. The coverage manifest is in sync with main: no files were added or deleted.

Per file

Counts are single-caller functions / wrappers / deletable comment lines / fake or duplicate tests.

File	Lines	Counts	Note
crawlers/composer_crawler.rs	2573	10 / 6 / ~90 / 8	Dead new()+Default; memo A32
crawlers/composer_crawler/oracle.rs	137	test-only	Shares every helper it checks (A29)
crawlers/coursier_cache.rs	712	3 / 2 / ~6 / 2	-D parser mangles quoted spaces (A35)
crawlers/deno_crawler.rs	1102	5 / 3 / ~35 / 7	Lock readers belong in formats/; jsr_lock_scope skips the BOM strip (E64)
crawlers/fuzzy_match.rs	325	3 / 1 / ~6 / 9	9 unit tests duplicate the e2e tests 1:1
crawlers/go_crawler.rs	1883	8 / 5 / ~60 / 10	A34, A03
crawlers/go_crawler/oracle.rs	163	test-only	Circular: imports 4 production helpers (A29)
crawlers/gradle_cache.rs	995	2 / 7 / ~12 / 0	Dead DerivedIndex::incomplete; A35
crawlers/hatch_env.rs	998	12 / 4 / ~12 / 1	A36, A39
crawlers/ivy_cache.rs	696	1 / 1 / ~5 / 2	Ignored _os parameter
crawlers/jvm_cache.rs	413	0 / 3 / ~6 / 1	Dead project_dependency_set
crawlers/listing.rs	108	clean
crawlers/maven_crawler.rs	3145	11 / 15 / ~95 / 4	3 dead pub fns; A30, A31, A33, A35

The detailed cleanup lists are in each file's notes in coverage/files.tsv.

Structural findings

Filed (3):

• A30: #1887. Maven ${…} interpolation is written 5×. The copies drifted on recursion and on undefined names, and only formats::maven caps the output length.
• A32: #1888. The env-keyed subprocess memo is written 3× (composer, python, ruby). Python caches answers computed under a changed environment.
• A37: #1889. The EnvGuard test helper is copied 11×.

Under an existing issue:

• A31 goes under the open tracker #715 (one pom.xml element scanner). A POM's own coordinates are read three ways, and the readers drifted on parent-version inheritance.

New rows left to verify:

• A33: the coursier_spelled vs classify bug. Unexecuted.
• A34: the Go coordinate gate (4 copies) and the misplaced module-cache layout. Extends E37 and Tracking: build and classify purls through one validated utils::purl API #748.
• A35: JVM cache plumbing split across maven_crawler, jvm_cache, gradle_cache and gradle::home.
• A36: platformdirs-style user dirs (5 copies).
• A38: stateless unit-struct crawlers.
• A39: the Hatch legacy env layout missed for raw ids on macOS. Unexecuted.

Register statuses refreshed:

• A03 is in PR #1876.
• A29 is in PR #1882.
• A15 is filed #705: the janitor closed Check uuid shape through one helper; python_script's Uuid::parse_str also accepts braced, urn and unhyphenated forms #1845 as a duplicate of Validate patch UUIDs through one utils::uuid grammar instead of five #705.
• No arch-audit issue was resolved by a merged PR. No maintainer steering is on the discussion.

Carried rows reconciled (5)

• E42: filed #1877. Decide: warn on and then remove scan --apply/--vendor, and whether --vex stays embedded #966 is closed, and the embed glue is T25.
• E47: already fixed (#1156). The decision was settled.
• E50: already fixed (#593). The version filter is in both hosted and upstream.
• E65: already fixed (#923). The vendor --force doc no longer promises a tolerance.
• E68: already fixed (#988). Gem revert compares the code before #.

Ruled out

• listing::names_memoized expect: it cannot fire, and an if let early return hits the NLL borrow limitation.
• LayoutTrust sampling: it is needed for misrooted --global-prefix scans and is pinned by tests.
• holds_artifact vs gradle_cache::has_module_file: they are different layout rules.
• Global vs local COMPOSER_HOME existence rules: the difference is deliberate and pinned by an e2e test. If it matters, it belongs under E84.
• go_workspace reading .mod downloads without the .partial check: this is correct, because the marker guards only the extracted directory.
• Crawler Results that never error: the shared scan_ecosystem! shape requires them. A38 covers the shape itself.

Next files

• crawlers/maven_crawler/local_repo_tests.rs (309), maven_crawler/oracle.rs (181), maven_crawler/scala_cache_tests.rs (535)
• maven_pom_equivalence_tests.rs (154), maven_scope.rs (900), mod.rs (99)
• npm_crawler.rs (8796, likely partial), then npm_crawler/oracle.rs (1938) and nuget_crawler.rs (2784)

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-10-30: architecture refactor (sweep)

main @ 5ca5623. The previous run was a sweep, so this run looked for structural work first. Every candidate scoring 6 or more has files held by an open PR:

• A30 #1887 (~8.7) is blocked by Fix Maven 4 implicit subprojects missed outside vendored (#1809) #1886 (maven_scope.rs, maven_reactor.rs).
• A05 #1844 (~8) is blocked by Fix Poetry lock writer read three ways (#1847) #1865 (poetry_lock.rs).
• T09 (~7), T01 (~6.4) and T25 (~6) are still blocked by Sweep hosted_unwind, lock_cli, list, commands/mod (+ rollback dead branch) #1864 and Fix Go patch delivery, audits, and reinstalls #1698.
• A32 #1888 (~6) is blocked by Build: share one test RNG across randomized tests (#1868) #1882, which touches all three crawlers.

So I ran a sweep, per the rule. The next audited, unswept row with free files is scan/gc.rs. scan/policy.rs was skipped because its getters are called from scan/mod.rs, which #1856 and #1884 hold. There was no maintainer steering, and no PR of mine merged or closed.

PR: #1892, ready for review. /code-review high ran first; CI and Bugbot are pending.

Per file

• scan/gc.rs:
  • 1 wrapper deleted (count → ui::plural).
  • The duplicated pre-lock ledger gate and lock acquire are now written once each (has_ledger, lock).
  • 4 fields and total_bytes made private.
  • About 40 comment lines removed, including 6 test banners and the bare #998, #1063, #1278 and B20 references. One stale contract doc was fixed.
  • Tests: 12 deleted or merged, leaving 17.
    • The 5 PurlKey spelling tests became 1, which now also covers the empty-scan and short-composer cases. Shown red→green.
    • The vendored pair became 1, shown red→green.
    • The vendored-lines, preview/parity and corrupt-manifest duplicates were folded into their siblings with exact assertions.
  • Net: production −37, tests −232 (+173 / −442 total).
• Callers: none changed. print_gc_vendored_line (vendor_flow) and gc_into's dry_run parameter wait on Fix vendored dry-run counting in-sync patches (#1850) #1856.

Behavior

None.

Merges recorded

None.

Lessons

• /code-review found the ledger gate's cwd-vs-project_root() mismatch (C43, pre-existing). It is left for an issue because the fix changes behavior.
• When merging tests, keep each test's negative half: the review caught that merging dropped the "gone variant still prunes" cases.
• The sandbox proxy refuses branch deletions. The stale arch-refactor/sweep-scan-gc-policy needs a maintainer to delete it.

[github-actions[bot]]

[agent] 2026-10-30: architecture refactor (sweep)

main @ 5ca5623. The previous run was a sweep, so this run looked for structural work first. Every candidate scoring 6 or more still has files held by an open PR:

• A30 (Fix Maven 4 implicit subprojects missed outside vendored (#1809) #1886), A05 (Fix Poetry lock writer read three ways (#1847) #1865) and A32 (Build: share one test RNG across randomized tests (#1868) #1882, and now the fixer's Fix env-keyed probe memo written three ways (#1888) #1895);
• T09, T01 and T25 (Sweep hosted_unwind, lock_cli, list, commands/mod (+ rollback dead branch) #1864, Fix Go patch delivery, audits, and reinstalls #1698).

The free candidates, A20 and A26, score about 4. So I ran a sweep, per the rule. The next audited, unswept row with free files is scan/hosted.rs. There was no maintainer steering, and no PR of mine merged or closed.

PR: #1897, ready for review. /code-review high ran first and found no bugs in the diff. CI and Bugbot were pending at handoff.

Per file

• scan/hosted.rs (all but the 1,233-line run_redirect_selected_untracked, which is T24):
  • 1 fn inlined (emit_json_error), and run_redirect's dead human arm deleted (it runs only under --json).
  • 1 test-only wrapper deleted (installed_stale_positive_evidence), and 1 #[cfg(test)] re-export shim of 17 core items deleted.
  • The gem probe's vendor/cache fold is flattened. Shown red→green.
  • About 120 comment lines removed, including 3 banners and bare issue references.
  • Tests: 13 guidance tests moved to core hosted/guidance.rs, and 2 pnpm lock-sniff tests moved to formats/pnpm/mod.rs.
    • 1 duplicate test deleted.
    • 1 test's missing \/-escaped assertion added, shown red→green.
  • Net: production −147, tests −595 in the file. Repository-wide: +696 / −847, most of it the move.
• Callers: scan/mod.rs passes the envelope by value (±1).

Behavior

None.

Merges recorded

None.

Lessons

• /code-review found two pre-existing gaps in the gem stale probe's pass 3:

  • it dedups vendor/cache warnings by purl string;
  • it builds the archive name without the platform suffix.

  Both change output, so they were noted for an issue rather than fixed in the sweep.

• When a doc comment claims a case, check that an assert covers it. The moved heal-probe test documented three URL spellings but asserted only two.