refactor: re-rank queue, #905 taken by #909

Assisted-by: Claude Code:claude-opus-5-5

Author: claude

entries/refactor/20261006T015800Z.md

@@ -0,0 +1,5 @@
+[agent] 2026-10-06: architecture refactor run
+
+- **main:** `9c43dfc` (unchanged; nothing of ours merged).
+- **Capacity:** 3 of 3 slots used. [#876](https://github.com/SocketDev/socket-patch/pull/876), [#886](https://github.com/SocketDev/socket-patch/pull/886) and [#889](https://github.com/SocketDev/socket-patch/pull/889) are `ready`, with the burn-down routine. None is abandoned or blocked, and none has a maintainer question. No new PR, claim or push.
+- **Ranking:** re-ranked only. [#905](https://github.com/SocketDev/socket-patch/issues/905) left the queue: the fixer claimed it with #903 and #904 in [#909](https://github.com/SocketDev/socket-patch/pull/909). [#893](https://github.com/SocketDev/socket-patch/issues/893) (≈4) is still the best eligible candidate when a slot frees, then the [#906](https://github.com/SocketDev/socket-patch/issues/906) cargo/composer/go slice (≈2.5).

register/90-refactor.md

@@ -1,5 +1,5 @@
 ### Refactor routine (`refactor`, hourly, highest leverage first)
-_Last updated 2026-10-06T01:05Z · main @ 9c43dfc_
+_Last updated 2026-10-06T01:58Z · main @ 9c43dfc_
 
 **In flight:**
 - [#876](https://github.com/SocketDev/socket-patch/pull/876): registry clients (`build_registry_client`, Maven `fetch_registry_bytes`) built through one `registry_client_builder` under `ApiTimeouts`; `registry_fetch::download` onto `read_capped`. Also ports the base-red digest-ratchet fix for #646's JVM files. Issue #872 (C49). `ready`.
@@ -17,13 +17,13 @@ _Last updated 2026-10-06T01:05Z · main @ 9c43dfc_
 
 | # | Candidate | B | U | D | R | Score | Note |
 |---|---|:-:|:-:|:-:|:-:|:-:|---|
-| 1 | #905 (E64): one BOM helper; pnpm lock and workspace readers skip it (#903, #904, #623) | 3 | 0 | ≈4 | M | ≈11 | skipped: `formats/pnpm/mod.rs` changed by #901 |
-| 2 | #773 (C44): one `Ecosystem::from_cli_name` for flag, env, socket.yml, vendor | 1 | 0 | ≈2 | L | ≈5 | skipped: `commands/vendor.rs` changed by #690, #776, #825, #837, #877 |
-| 3 | #856 (E62, child 1 of #855): VEX npm aliases through the core resolver | 1 | 1 | ≈1.8 | M | ≈5 | skipped: `vex_consumed.rs` changed by #690 |
-| 4 | #883 (E39): `canonicalize_pypi_name` + `pep508_name` into one PyPI name module | 0 | 1 | ≈3 | L | ≈5 | skipped: 13 files changed by open PRs |
-| 5 | #893 (C50): `repair` and `scan --prune` keep active patches' beforeHash blobs | 1 | 0 | ≈1 | L | ≈4 | best eligible (`cleanup_blobs.rs`); take when a slot frees |
+| 1 | #773 (C44): one `Ecosystem::from_cli_name` for flag, env, socket.yml, vendor | 1 | 0 | ≈2 | L | ≈5 | skipped: `commands/vendor.rs` changed by #690, #776, #825, #837, #877 |
+| 2 | #856 (E62, child 1 of #855): VEX npm aliases through the core resolver | 1 | 1 | ≈1.8 | M | ≈5 | skipped: `vex_consumed.rs` changed by #690 |
+| 3 | #883 (E39): `canonicalize_pypi_name` + `pep508_name` into one PyPI name module | 0 | 1 | ≈3 | L | ≈5 | skipped: 13 files changed by open PRs |
+| 4 | #893 (C50): `repair` and `scan --prune` keep active patches' beforeHash blobs | 1 | 0 | ≈1 | L | ≈4 | best eligible (`cleanup_blobs.rs`); take when a slot frees |
+| 5 | #906 (E25): service-copy pipeline, cargo/composer/go slice | 0 | 1 | ≈0.5 | L | ≈2.5 | eligible; gem copy waits for #768, #776, #875 |
 
-Re-ranked 2026-10-06T01:05Z: no change on main. New: #905 (above) and #906 (E25, service-copy pipeline; cargo/composer/go slice eligible, gem waits for #768, #776, #875; ≈2.5). #871 (≈2.5) eligible after #889; then #705 (≈2.4). #780, #663, #895 still overlap open PRs. 3 of 3 slots used (#876, #886, #889 `ready`, approved). Decisions: #648, #704, #792, #808, #615; C07.
+Re-ranked 2026-10-06T01:58Z: no change on main. #905 (E64, ≈11) left the queue: the fixer claimed it with #903 and #904 in [#909](https://github.com/SocketDev/socket-patch/pull/909). #871 (≈2.5) eligible after #889; then #705 (≈2.4). #780, #663, #895 still overlap open PRs. 3 of 3 slots used (#876, #886, #889 `ready`, approved). Decisions: #648, #704, #792, #808, #615; C07.
 
 **Notes:**
 - The sandbox runs as root, so 4 core lib tests fail on main and on branches alike: `copy_tree::relax_loop_must_not_traverse_symlinked_root`, `vlt_heal::an_unremovable_hidden_lock_keeps_every_store_entry`, `pypi_poetry::wire_write_failure_maps_error_and_leaves_lock_untouched`, `pypi_requirements::wire_failure_rolls_back_already_written_files`.