@@ -9,7 +9,7 @@ _Last updated 2026-10-09T11:20Z · main @ a80b89e_
 - [#1239](https://github.com/SocketDev/socket-patch/pull/1239): NuGet crawler `find_by_purls` looks up the global folder and legacy `<Id>.<Version>/` folders by the normalized version (`1.0.0.0` = `1.0.0`) through `normalize_nuget_version`. #1202 crawler slice (E93). +47/−19 prod, +116/−4 tests. `state: ready`.
 - [#1188](https://github.com/SocketDev/socket-patch/pull/1188): one `Pipfile.lock` writer (`formats::pipenv::splice_entry`, `formats::json`). Issue #1128 (E14). +303/−235 production. `redirect/mod.rs` wrapper `pipenv_reserialized_around_reference` left for when that file is free. `state: ready`.
 - [#1126](https://github.com/SocketDev/socket-patch/pull/1126): 7 inline purl-type checks through `Ecosystem::from_purl` + guard. Issue #747 (C20, slice 1). `state: ready`.
-- Maintainer drafts (decided issues): #1049 (#792). #1036 (#973), #1041 (#648), #1027, #1030, #1031 and #1051 merged.
+- Maintainer draft: #1049 (#792).
 
 **Merged:** #1227 (E16 slice 2, +25/−44 prod), #1221 (E19 hosted gem sections, +213/−140 prod), #1230 (E93 `PurlKey`, +37/−7 prod), #1217 (E05 Deno crawl, +108/−43 prod), #1209 (E05 Go crawl, +132/−44 prod), #1205 (E05 cargo crawl), #1183 (E05 NuGet crawl); 32 earlier PRs (#572 … #1191, see `entries/refactor/`). Leftovers: `blob_hash_matches` (#1163), dead `eco == "maven2"` arm in `commands/vendor.rs` (#1015).
 
@@ -30,7 +30,6 @@ Re-ranked 2026-10-09T11:00Z at `a80b89e` against 30 open PRs (131 production fil
 - Revert finish (#1245): new backends end their revert with `revert::finish(outcome, root, rel, opts, KeepPolicy::…)`; the npm family keeps its bare `cannot remove <rel>` failure (warnings dropped), the rest keep warnings with `failed to remove <abs>`. Yarn berry/classic and npm add a still-wired refusal before the delete: extend the policy, do not re-copy the sequence.
 - `bench.yml` gates +10% per scenario: time a per-dep reader (hosted converge) in release against `main` before pushing.
 - Gem lock edits locate through `formats::gem::parse` since #1221: `Section::lines()` / `end`, `remote_line_nos`, `GemfileLock::dependencies` (entries with one name rule). Whitespace-only lines are blank separators. The vendored slice should read the same fields, not add a fourth walker.
-- Real bundler 4.0.18 is in the sandbox: `e2e_redirect_gem_build -- --ignored`, `e2e_vendor_gem_build -- --include-ignored` run in ~30 s.
 - `golang_rewrite.golden`'s go.sum generator injects a stray CRLF line, so its inputs are mixed even with the `line_endings` mixer off; any terminator-rule change re-blesses it.
 - Deno crawl scope (#1217): only a parseable `<cwd>/deno.lock` with a `version` scopes; no `jsr` section = no JSR package. Fixtures must lock a cached JSR package (or omit `deno.lock`).
 - Go crawl scope (#1209): only a readable `<cwd>/go.sum` with no workspace (`go.work`, or `GOWORK` set to a file) scopes. A CLI fixture that needs the crawl to vouch for a cached module must list it in `go.sum` or drop `go.sum`.
@@ -49,7 +48,6 @@ Re-ranked 2026-10-09T11:00Z at `a80b89e` against 30 open PRs (131 production fil
 - 2026-10-08: ~40 refactor issues were closed `not_planned` into trackers ("Consolidated work"); that is scheduling, not rejection. Claim/`Fixes` the item's issue only if still open, else reference the tracker.
 - NuGet identity (#1230): `PurlKey` folds versions through `vendor::nuget_feed::normalize_nuget_version` (a utils→vendor import until `nuget_feed.rs` frees for the `formats::nuget` move). `test_support::service_fixture` builds its NuGet grant from `<id>.<purl version>.nupkg`, so a test vendoring a non-normalized version needs that file too.
 - NuGet crawl identity (#1239): `find_by_purls` runs main's probes first (`<id>/<as-written>`, exact legacy, case-insensitive legacy) and the normalized ones only after (`<id>/<normalized>`, `legacy_dir_is`), so a cache with two spellings keeps main's pick. The `oracle.rs` equivalence keeps main's rule; its randomized versions are all normalized, so it still agrees.
-- Pushes need verified signatures: commit with the session's default git identity, never an overridden `user.email`.
 - Steering (2026-10-02, #569/#571): no size caps on trusted upstream data; stream, don't buffer.
 - `tests/spawn_env_hygiene.rs` allowlists (`PENDING_RAW_SPAWNS` / `PENDING_SCRUB_COPIES`) fail on new **and** stale entries: drop a file when you migrate it.
 - Probe spawns go through `utils::process::output_within` since #886 (blocking; async callers wrap it in `utils::fs::run_blocking`). It nulls stderr; don't add a new `tokio::time::timeout` + `kill_on_drop` site.