@@ -96,15 +96,15 @@
 |---|---|
 | Production code (non-blank, non-comment) | **134.5K lines** in `socket-patch-core` + `socket-patch-cli` on `9c43dfc` (2026-10-06; the same script gives 117.8K at the snapshot, which the review reported as 117.6K + 34.8K comment + 9K blank). The growth is mostly the Gradle landing (#646) |
 | Inline `#[cfg(test)]` code in `src/` | ~228K lines on `9c43dfc` (~197K at the snapshot) |
-| Integration tests (`crates/*/tests`) | ~298K lines in **235 separate test executables** in core + CLI (36 core, 199 CLI: top-level files plus 12 directory binaries; recounted at `b762f41`, 2026-10-08; ~296K at `05ecc6e`; 224 and ~283K at `9c43dfc`; ~255K at the snapshot) |
+| Integration tests (`crates/*/tests`) | ~298K lines in **240 separate test executables** in core + CLI (37 core, 203 CLI: top-level files plus 12 directory binaries; recounted at `f3c6313`, 2026-10-09; 235 at `b762f41`; ~296K at `05ecc6e`; 224 and ~283K at `9c43dfc`; ~255K at the snapshot) |
 | Test : production ratio | ~2.8 : 1 overall; ~7 : 1 for the CLI crate |
-| Largest file | `patch/redirect/mod.rs`: 22,272 lines at `b762f41` (2026-10-08; 21,936 at `db83f01`; 7.6K production, 14.3K inline tests; 17,517 at the snapshot, 6.2K production then) |
+| Largest file | `patch/redirect/mod.rs`: 23,913 lines at `f3c6313` (2026-10-09; 22,272 at `b762f41`; 21,936 at `db83f01`; 7.6K production, 14.3K inline tests; 17,517 at the snapshot, 6.2K production then) |
 | Functions > 200 / > 500 lines | 74 / 11 at `1c6c509` (61 / 9 at the snapshot: `run_scan` 1,540 on `045d7ec`, now 1,577; `rollback::run` 984, `vendor_records_reusing` 962, `run_redirect_selected` 836, `remove::run` 797, `get::run` 635, memory `engine` 604, …) |
 | CLI surface | 9 visible + 2 hidden subcommands; 57 visible long flags; 27 globals on every command; 43 env bindings (84 `SOCKET_*` names in source); 156 documented `errorCode`s; ~570 code-like strings in source |
 | `--help` | 150–219 lines per subcommand; `list --help` lists 27 options, most of which do nothing for `list` |
 | CI per push | ~516 jobs; the CI workflow alone is 237 jobs and 348 runner-minutes; Windows `test` is the 28-minute critical path |
-| `CLI_CONTRACT.md` | 423 KB at `b762f41` (2026-10-08; 417 KB at `431b818`; 415 KB at `c5be5d1`, 332 KB at the snapshot); the longest *line* is 12,077 characters at `c5be5d1` |
-| Open issues | About 320 on 2026-10-08 at 03:40Z (~194 `bughunt`, ~109 `arch-audit`; 322 on 2026-10-07). At the snapshot: 88, filed mostly in the last 5 days by a bug hunt; JS 26, JVM 22, Python 18, Go 6, Cargo 5, NuGet 5, Ruby 3, Composer 3 |
+| `CLI_CONTRACT.md` | 460 KB (459,861 bytes) at `f3c6313` (2026-10-09; 423 KB at `b762f41`, 2026-10-08; 417 KB at `431b818`; 415 KB at `c5be5d1`, 332 KB at the snapshot); the longest *line* is 12,077 characters at `c5be5d1` |
+| Open issues | 287 on 2026-10-09 at 03:40Z (180 `bughunt`, 80 `arch-audit`; about 320 on 2026-10-08; 322 on 2026-10-07). At the snapshot: 88, filed mostly in the last 5 days by a bug hunt; JS 26, JVM 22, Python 18, Go 6, Cargo 5, NuGet 5, Ruby 3, Composer 3 |
 | PR size | Recent squash merges of +53K, +85K and +94K lines |
 
 ---
 
@@ -2,7 +2,7 @@
 
 ## Part 2: CLI command layer and user experience
 
-_Last checked against main @ 830749f on 2026-10-08 by audit-core. Owner: audit-core._ Re-checked on `830749f` (21:40Z run): the command-module graph after #1043 (14 allowlisted edges in `tests/command_module_layering.rs`), the interactive-prompt gates (`confirm_waits`, `select_one`; one production `select_one` caller) and the hidden `self-update`/`hosted-bundle` subcommands. Re-checked on `823810a` (15:40Z run): `validate_paths` (C76, unchanged) and the socket.yml policy callers (only `scan`); C44, C45 and C58 were closed by the 2026-10-08 backlog review, and their passages still describe main. Re-checked on `b96a785` (09:40Z run): the path-flag validation #1029 added (`validate_paths`, C76), the `--manifest-path` ledger roots (C43, unchanged) and `remove`'s identifier matching after #1035. Re-checked on `05ecc6e` (21:40Z run): the 2.9 mode-folding premises (`scan`/`get` defaults, socket.yml `mode` refusal, takeover scope), the no-state exit codes of every command, and lock contention under `--json` (consistent `lock_held`). Earlier: `431b818` by the October 7 reconciliation (command cycles, takeover scope, envelope shapes and client sites re-checked; function sizes from `1c6c509`); `c5be5d1` by audit-core. Re-checked on `c5be5d1` (15:50Z run): the exit codes of a corrupt and a missing manifest across commands, and the command-model premises of 2.9 (unchanged). Re-checked on `9c43dfc` (09:56Z run): manifest-presence probes per command and `remove`'s per-store identifier matching. Re-checked on `9c43dfc`: the paid-tier `--json` output of `get` and `scan` against the contract (2.8), the manifest-load error codes of every command and the exit-2 usage-error output under `--json` (2.8), the legacy mode spellings and embedded `--vex` (2.7), the god-function sizes for `vendor_records_reusing`, `run_redirect_selected` and `rollback::run`, the get ↔ scan cycle, `ecosystem_dispatch`'s size and the takeover bypass; the rest is as of `045d7ec` or earlier.
+_Last checked against main @ f3c6313 on 2026-10-09 by audit-core. Owner: audit-core._ Re-checked on `f3c6313` (03:40Z run): `scan`'s human-arm `fetched == 0` exit (C70, unchanged), the removed v4 spellings after #1031 (docs and wrappers clean) and the hand-written `--json` status strings of `get`. Re-checked on `830749f` (21:40Z run): the command-module graph after #1043 (14 allowlisted edges in `tests/command_module_layering.rs`), the interactive-prompt gates (`confirm_waits`, `select_one`; one production `select_one` caller) and the hidden `self-update`/`hosted-bundle` subcommands. Re-checked on `823810a` (15:40Z run): `validate_paths` (C76, unchanged) and the socket.yml policy callers (only `scan`); C44, C45 and C58 were closed by the 2026-10-08 backlog review, and their passages still describe main. Re-checked on `b96a785` (09:40Z run): the path-flag validation #1029 added (`validate_paths`, C76), the `--manifest-path` ledger roots (C43, unchanged) and `remove`'s identifier matching after #1035. Re-checked on `05ecc6e` (21:40Z run): the 2.9 mode-folding premises (`scan`/`get` defaults, socket.yml `mode` refusal, takeover scope), the no-state exit codes of every command, and lock contention under `--json` (consistent `lock_held`). Earlier: `431b818` by the October 7 reconciliation (command cycles, takeover scope, envelope shapes and client sites re-checked; function sizes from `1c6c509`); `c5be5d1` by audit-core. Re-checked on `c5be5d1` (15:50Z run): the exit codes of a corrupt and a missing manifest across commands, and the command-model premises of 2.9 (unchanged). Re-checked on `9c43dfc` (09:56Z run): manifest-presence probes per command and `remove`'s per-store identifier matching. Re-checked on `9c43dfc`: the paid-tier `--json` output of `get` and `scan` against the contract (2.8), the manifest-load error codes of every command and the exit-2 usage-error output under `--json` (2.8), the legacy mode spellings and embedded `--vex` (2.7), the god-function sizes for `vendor_records_reusing`, `run_redirect_selected` and `rollback::run`, the get ↔ scan cycle, `ecosystem_dispatch`'s size and the takeover bypass; the rest is as of `045d7ec` or earlier.
 
 > Scope: `crates/socket-patch-cli/src/` — `args.rs`, `lib.rs`/`main.rs`, `ecosystem_dispatch.rs`, `json_envelope.rs`, `ui/*`, `update_notifier.rs`, and every `commands/*` module.
 
 
@@ -2,7 +2,7 @@
 
 ## Part 7: Core infrastructure and agent (in-place) mode
 
-_Last checked against main @ 830749f on 2026-10-08 by audit-core. Owner: audit-core._ Re-checked on `830749f` (21:40Z run): `apply.lock` after #1030 (interrupt cleanup), the HTTP client builders and timeouts, the FIFO-safe readers of every `.socket` store, and lock acquisition per command (all through `lock_cli`). Re-checked on `823810a` (15:40Z run): production file writes outside `utils::fs` (only the VEX document, C77, plus self-update, `apply.lock` and blob-fetch staging), PATH resolution of spawned tools (all through `resolve_tool`), the GC retention split (C50, unchanged), and the C60/C63 passages after #887's close and #1045. Re-checked on `b96a785` (09:40Z run): env truthiness and home-directory resolvers after #1038, and the test-telemetry boundary after #1046. Re-checked on `b762f41` (03:40Z run): 7.3 atomic writes and the 7.7 containment and credentials rows after #1042 and #1070, hash-case verify sites, and the TLS trust roots of every HTTP client (C75). Earlier: `431b818` by the October 7 reconciliation (7.3 spawn deadlines, the 7.4 safety model and the new 7.7 security boundaries); `c5be5d1` by audit-core. Re-checked on `c5be5d1` (15:50Z run): 7.2 retry table and registry timeouts after #889 and #876. Re-checked on `9c43dfc` (09:56Z run): the 7.4 agent-mode footprint, the sidecar list (Maven rewriter from #646) and which ecosystems need agent mode. Re-checked on `9c43dfc`: the self-update footprint and its overlap with `install.sh` (7.5), the credentials block of `client.rs`, agent-mode jar member verification, the apply/rollback store-copy fold and the artifact-retention (GC) policies. Re-checked on `0d302dc`: the `api/*` size row, the `client.rs` breakdown, the retry table, the registry-client timeout, process spawning and hash case. The timeout, blob/diff body, zip-read, process-spawning, API-pacing, URL-builder, retry, batching, hashing, UUID, env/home-dir, atomic-write, purl, dead-code, telemetry, apply/rollback-engine, diff-download, `apply.lock`, Maven-sidecar, group-commit-reader, socket.yml and spawn-deadline passages were re-checked on `045d7ec`; the rest is as of `2463257`. 2026-10-07 14:00Z: 7.2, 7.4, 7.5 and 7.6 record the maintainer's decisions on #648, #792, #808, #983 and #1000 (no code re-check).
+_Last checked against main @ f3c6313 on 2026-10-09 by audit-core. Owner: audit-core._ Re-checked on `f3c6313` (03:40Z run): public-registry fan-out against `utils::concurrent` (C78), and dead `pub fn`s in `utils/`, `api/` and `update/`. Re-checked on `830749f` (21:40Z run): `apply.lock` after #1030 (interrupt cleanup), the HTTP client builders and timeouts, the FIFO-safe readers of every `.socket` store, and lock acquisition per command (all through `lock_cli`). Re-checked on `823810a` (15:40Z run): production file writes outside `utils::fs` (only the VEX document, C77, plus self-update, `apply.lock` and blob-fetch staging), PATH resolution of spawned tools (all through `resolve_tool`), the GC retention split (C50, unchanged), and the C60/C63 passages after #887's close and #1045. Re-checked on `b96a785` (09:40Z run): env truthiness and home-directory resolvers after #1038, and the test-telemetry boundary after #1046. Re-checked on `b762f41` (03:40Z run): 7.3 atomic writes and the 7.7 containment and credentials rows after #1042 and #1070, hash-case verify sites, and the TLS trust roots of every HTTP client (C75). Earlier: `431b818` by the October 7 reconciliation (7.3 spawn deadlines, the 7.4 safety model and the new 7.7 security boundaries); `c5be5d1` by audit-core. Re-checked on `c5be5d1` (15:50Z run): 7.2 retry table and registry timeouts after #889 and #876. Re-checked on `9c43dfc` (09:56Z run): the 7.4 agent-mode footprint, the sidecar list (Maven rewriter from #646) and which ecosystems need agent mode. Re-checked on `9c43dfc`: the self-update footprint and its overlap with `install.sh` (7.5), the credentials block of `client.rs`, agent-mode jar member verification, the apply/rollback store-copy fold and the artifact-retention (GC) policies. Re-checked on `0d302dc`: the `api/*` size row, the `client.rs` breakdown, the retry table, the registry-client timeout, process spawning and hash case. The timeout, blob/diff body, zip-read, process-spawning, API-pacing, URL-builder, retry, batching, hashing, UUID, env/home-dir, atomic-write, purl, dead-code, telemetry, apply/rollback-engine, diff-download, `apply.lock`, Maven-sidecar, group-commit-reader, socket.yml and spawn-deadline passages were re-checked on `045d7ec`; the rest is as of `2463257`. 2026-10-07 14:00Z: 7.2, 7.4, 7.5 and 7.6 record the maintainer's decisions on #648, #792, #808, #983 and #1000 (no code re-check).
 
 > Scope: `api/*`, `manifest/*`, `ledgers.rs`, `constants.rs`, `patch/` (excluding `redirect/`), `policy/*`, `rollout*`, `update/*`, the CLI `update_notifier.rs`/`update.rs`, `telemetry.rs`, and the generic `utils/*` and `hash/*`.
 
@@ -171,7 +171,7 @@ Added on 2026-10-07 by the October 7 reconciliation; owned by `audit-core`. Thes
 ### New findings since the review
 
 - {{C37}} Patch blob and diff downloads (`fetch_blob` / `fetch_diff`, via `fetch_binary`) return a `BinaryBody` stream, and one `blob_fetcher::download_entries` loop stages each body chunk by chunk to disk (`stage_body`), verifies blobs against their git-sha256 name and renames into place; no artifact body is held in memory, per the maintainer's stream-don't-cap steering. Vendor and self-update downloads keep the shared `read_capped` (256 MiB).
-- {{C38}} API pacing has one policy (`utils::concurrent`: proxy cap 4, `SOCKET_API_CONCURRENCY` override, fd-limit rule), and every CLI window uses it, except the client's own public-proxy per-package fallback. That fallback keeps a private `PROXY_BATCH_PATH_CONCURRENCY = 10`, and on `045d7ec` it ran 10 GETs in flight with `SOCKET_API_CONCURRENCY=1`. `registry_concurrency()` has no caller.
+- {{C38}} API pacing has one policy (`utils::concurrent`: proxy cap 4, `SOCKET_API_CONCURRENCY` override, fd-limit rule), and every CLI window uses it, except the client's own public-proxy per-package fallback. That fallback keeps a private `PROXY_BATCH_PATH_CONCURRENCY = 10`, and on `045d7ec` it ran 10 GETs in flight with `SOCKET_API_CONCURRENCY=1`. `registry_concurrency()` has no caller (C78).
 - {{C41}} Manifest hashes load as lowercase hex (`manifest::schema` `deserialize_hash`, #1163), so agent-mode apply and rollback `==` checks, blob names and vendored pins share one case rule and an uppercase manifest applies and is written back lowercase. `api::blob_fetcher::blob_hash_matches` still compares case-insensitively; it becomes plain `==` once its file is free.
 - {{C42}} `get` stored a patch view's inline `blobContent` under its claimed hash without checking it, in place; both `.socket/blobs` writers now verify and stage, and the hand-rolled base64 decoder is gone (#1042).
 - {{C75}} Every HTTP client (API, plain proxy, telemetry, self-update metadata and download, registry fetch) trusts only reqwest's bundled webpki roots: no platform store, `SSL_CERT_FILE` or extra-CA knob. Behind a TLS-inspecting proxy, the documented `HTTPS_PROXY` route fails with `UnknownIssuer` while curl, `install.sh` and the spawned package managers succeed. Target: one client constructor with webpki ∪ native roots.
@@ -181,6 +181,7 @@ Added on 2026-10-07 by the October 7 reconciliation; owned by `audit-core`. Thes
 - {{C51}} Agent-mode jar verification (`jvm_jar::verify_member_bytes`, used by `apply`, `rollback` and `vex` for Maven/Gradle member records) inflates each patched member into a `Vec` before hashing, while its vendored twin `zip_bytes_match_after_hashes` streams since #587. On `9c43dfc`, a jar with one deflated 1 GiB member peaked at 1,067 MiB RSS through the agent routine and 26 MiB through the vendored one (twice). One streaming member-hash helper replaces both.
 - {{C48}} Child processes share one deadline: `utils::process::output_within` bounds the crawler probe runners (`run_resolved`, `PROBE_TIMEOUT` 10 s), `pipenv`, `hatch`, the self-update `sanity_exec` (#886) and the PDM site probe (#1106), so a `gem` shim that never answers no longer hangs a local `scan`. Only the `git check-ignore` exchange in `vendor/npm_dir.rs` still hand-rolls its timeout (#1067).
 - {{C77}} The OpenVEX document (`vex --output` and the embedded `--vex` of `apply`/`vendor`/`scan`) is the one CLI write outside `utils::fs`: `generate_vex` calls `tokio::fs::write`, which truncates in place, so a failed write (ENOSPC on `823810a`) leaves a truncated document that starts with an OpenVEX header, and the stale-document cleanup, which removes only a parseable document, keeps it. That breaks the documented failure contract and `durability.rs`'s claim that every write is staged.
+- {{C78}} The hosted upstream restore (`rollback`/`remove` of hosted pins, the hosted → vendored takeover and eject) re-resolves every pin from the public registry with an unbounded `join_all` in five formats (npm/vlt, PyPI, cargo, Go, Composer), while `utils::concurrent::registry_concurrency()` (cap 4; 1 under a tight fd limit), added for public registries in #1039, has no caller. On `f3c6313`, 40 npm pins put 40 requests in flight (twice); the registry client has no 429 handling.
 
 ---
 _Generated by [Claude Code](https://claude.ai/code)_