@@ -267,7 +267,7 @@ Several patterns show code that outlived its purpose:
 | 10 | C | **Retire `--download-mode` and the diff path** (decided #792, v5): `diff` re-downloads every blob anyway on a cold cache; delete the diff machinery, the flag and `qbsdiff`. | ~0.4K prod, 1K test, −1 dep | L | Part 7 | {{C25}} |
 | 11 | C | **Delete verified dead/vestigial code:** `--vendor-source`, `VendorSource`, `PackageSource`, `vend_installed!`, `mem_blobs`, `lock_inventory/wired.rs`, dead vlt ledger helpers, `save_redirect_state` + its group-commit entry, the empty Deno extractor, the `switched_off("group_commit")` oracle path. | ~1K prod, ~1K test | L | Parts 4–7 | {{E28,E41,C23}} |
 | 12 | M | **Utility consolidation:** one HTTP retry/timeout primitive; one validated purl builder family (42 hand-built `format!("pkg:…")` and 24 prefix checks in production code); one digest/SRI helper set (fixing the `sha256_hex` name collision: one copy validates, three compute); one line-ending policy; one env-truthiness vocabulary (there are three); one UUID grammar (there are four). | 1–1.5K prod | L | Parts 4, 7 | {{C15,C17,C18,C19,C20,E16}} |
-| 13 | C | **Embedded `--vex`** (15 flag instances on 3 commands, ~600 lines of glue, plus bypass sets that couple VEX correctness to each caller) → `fix && vex -O`. | 0.6K prod | L (MAJOR) | Parts 2, 6 | {{E42,C05}} (spellings half decided #966) |
+| 13 | C | **Embedded `--vex`** (15 flag instances on 3 commands, ~600 lines of glue, plus bypass sets that couple VEX correctness to each caller) → `fix && vex -O`. | 0.6K prod | L (MAJOR) | Parts 2, 6 | {{E42,C05}} (spellings half removed, #1031) |
 | 14 | S | **Simplify per-package-manager auto-config:** npm `allow-remote` (re-implements npm's `ini` and config layering, ~900 lines), pnpm `trustLockfile` (~450; three open corruption bugs), the vlt warm-tree heal (installed-tree surgery in a lockfile-only mode), parallel rewriter groups (benchmark them or drop them). | 1–1.5K prod | M | Part 3 | {{E34}} |
 | 15 | C | **Self-update:** keep the binary swap and the notifier (decided #983); harden it: retry, stall timeout, streaming download, live post-release test. **Telemetry:** one `track(Event)` + a shared client instead of 19 wrappers and ~45 token/org call sites. | ~0.3K prod | L | Parts 2, 7 | {{C22,C36}} |
 | 16 | M | **Tests:** 207 → ~25 binaries (needs `RunCtx` first, to drop the env-mutating `#[serial]`); a `socket-patch-test-support` crate (`binary()` is defined in 103 files, `git_sha256` in 86, 14 divergent `scrub_socket_env`, and 10 test files with no env scrub at all); retire the oracles; triage covgap; snapshots instead of 328 sentence assertions. | 15–25K test lines; minutes off the Windows critical path | M | Part 8 | {{C30,C31,C32,E35}} |
 
@@ -99,7 +99,7 @@ A sliding-window copy-paste detector finds little *literal* duplication. **The d
 - **Dead or vestigial flags:**
   - `--vendor-source`: core's `VendorSource` has **one variant**, and `build` is an error.
   - `--download-mode` is an unvalidated `String`, checked only where it is used. That breaks the "fail loud on typo" posture the same file applies to `--ecosystems`. On `045d7ec` a bad value fails `apply` and `repair` with exit 1 and `apply_failed`/`repair_failed`, while `apply --check`, `rollback`, `list` and `vendor` exit 0; `--vendor-source bogus` is a clap usage error (exit 2). {{C45}}
-- **Deprecated spellings and aliases:** `scan --apply` (hidden), `scan --vendor` (hidden), `get --no-apply`, and the `download` and `gc` aliases. `resolve_mode_flags` (`scan/mod.rs:184–246` on `9c43dfc`) exists mainly to reconcile these. Only `--apply`/`--vendor` are called deprecated, and nothing warns: on `9c43dfc` both run silently with no removal date, while the contract makes `--no-apply`, `download` and `gc` permanent (MAJOR to remove). `--sync` is a documented shorthand, not a deprecated spelling. **Decided (#966):** all five are removed in v5 with no warning release; `resolve_mode_flags` shrinks to the `--sync` vs `--mode` check, the hosted default and the global-scope check; `--sync` stays. {{C05}}
+- **Deprecated spellings and aliases:** `scan --apply` (hidden), `scan --vendor` (hidden), `get --no-apply`, and the `download` and `gc` aliases. **Removed in v5 (#966, #1031):** all five are gone with no warning release and are now clap usage errors (exit 2); `resolve_mode_flags` keeps only the `--sync` vs `--mode` check, the hosted default and the global-scope check. `--sync` stays as the shorthand for `--mode agent --prune`. {{C05}}
 - **Name collisions:**
   - `--package` is a value list on `scan` but a boolean type-forcer (`-p`) on `get`.
   - `--check` on `apply` audits *Go `replace` redirects only*; on `vendor` it audits artifacts and JVM wiring.
 
@@ -203,7 +203,7 @@ For uv, pylock, poetry, pdm, hatch, vlt, maven and bun.lockb, the module's own f
 ### New findings since the review
 
 - {{E50}}: hosted `rewrite_nuget` and upstream restore rewrite every `packages.lock.json` entry of the patched id, in every target framework, whatever its `resolved` version; vendored `locked_at` only touches entries at the patched version. `packages.lock.json` has four walkers (hosted, restore, vendored, VEX).
-- {{E52}}: `vendor/go_sum_edit.rs` keeps free `upsert_module_lines` / `has_module_version` / `remove_exact_module_version_lines` with no production caller, re-implemented by the `GoSumEditor` the hosted Go rewriter uses; the free copies survive only as a test oracle, and the pure hosted codec lives in `vendor/`.
+- {{E52}}: every go.sum edit goes through the `GoSumEditor` the hosted Go rewriter uses; the free oracle-only copies were deleted (#1103). The pure hosted codec still lives in `vendor/go_sum_edit.rs`, not `formats/`.
 - {{E15}}: the hosted cargo planner `plan_cargo_toml` is a line scanner, gated by a second `toml_edit` classifier of the same declarations. It refuses `serde = { version = "1", features = [⏎ "derive",⏎] }` as "inline table does not close on its line", although cargo and `toml_edit` accept it, so hosted skips a crate that vendored mode handles. Upstream restore unpins with a third, line-level grammar.
 - {{E58}}: the hosted-vlt ledger helpers left without a caller by #277 were deleted (#1141); `UpstreamClient::seed_rubygems_sha256` is still a test helper compiled into production.
 - {{E73}} October 7: "is this hosted patch pinned" is decided four ways (`confirm`, `mark_pinned`, `memory_recorded`, discovery); lockless NuGet/Cargo pins are attested in-run then reported contested forever (PR #1058).
 
@@ -0,0 +1,9 @@
+[agent] 2026-10-09: architecture refactor run
+
+- main: `16106b1`.
+- Merged since the last entry: #1103 (E52 slice) and maintainer draft #1031 (#966); #1185 was recorded by the 23:52Z run. Register: E52 → partly fixed (#1103); C05 → partly fixed (#1021, #1031). Living document rewritten line-locally: `doc/03-hosted.md` (E52 bullet: free go.sum copies deleted), `doc/02-cli.md` (legacy spellings removed in v5), `doc/01-summary.md` (§3 row 13).
+- Ranking: 14 open `arch-refactor/*` / `agent/fix-*` PRs change 304 files; every CLI command module except a few still sits in one. #989, #717, #1098 (`ecosystem_dispatch.rs`, `vex_consumed.rs`) and #1129 (`npm_crawler.rs`) stay blocked. Among free items, #905 slice 3 scored highest (D ≈4, L): `redirect/vlt.rs`, `go_mod_edit.rs`, `jvm/gradle.rs` and `lock_inventory/pypi.rs` left the open PRs' file sets. The #595 cargo child (S 3) ranks next.
+- PR: [#1191](https://github.com/SocketDev/socket-patch/pull/1191), `state: ready`, Bugbot requested. Clippy clean; core lib 5839 passed (only the 4 known root-only failures); CLI `e2e_vex_lockfile` 343, `e2e_vlt` 27, `gradle_agent_cli` 52, `in_process_redirect_pipenv` 11 passed.
+- Claimed: #905. Released: none.
+- Register: E64 → slice 3 in PR #1191.
+- Lessons: the BOM guard cuts "production" at the first `#[cfg(test)]\nmod tests`; a test module with any other name placed earlier in a file counts as production, so name a new one `tests`.
@@ -51,15 +51,15 @@ _Last updated 2026-10-08T18:49Z · main @ cf8b164_
 | E47 | 3 | Decide: support tiers for `bun.lockb` writes, vendored pnpm 7/8, vlt pre-1.0 encodings and hosted pnpm ≤ 6, and whether hosted JVM ships as beta. | §5; §6 Q3; 4.6 | #1156 | decision #1156 |
 | E48 | 3 | Discovery re-implements package-manager layouts (venv-name hashing, global prefixes, the pnpm store). Target: ask the package manager (`poetry env info -p`, `pipenv --venv`, `npm query`, …). | 2.2 #2; 6.6 |  | rejected; not adopted (#1000) |
 | E50 | 2 | Hosted `rewrite_nuget` and upstream restore rewrite `packages.lock.json` entries of the patched id at other versions (every framework); vendored `locked_at` filters by version. Four lock walkers. | new finding | #593 | filed #593 |
-| E52 | 3 | `vendor/go_sum_edit.rs`: free go.sum helpers have no production caller and are re-implemented by `GoSumEditor`; the pure hosted codec lives in `vendor/`. | new finding | #631 | in PR #1103; slice: oracle copies deleted, the move to `formats/golang/sum.rs` remains |
+| E52 | 3 | `vendor/go_sum_edit.rs`: free go.sum helpers have no production caller and are re-implemented by `GoSumEditor`; the pure hosted codec lives in `vendor/`. | new finding | #631 | partly fixed (#1103): the oracle-only free helpers are deleted and every go.sum edit goes through `GoSumEditor`; the move to `formats/golang/sum.rs` remains |
 | E53 | 2 | Vendored pnpm wrote the root `package.json` with `serialize_json`. | new finding | #662 | fixed (#810) |
 | E54 | 3 | Poetry and PDM restored line endings with two rules. | new finding | #695 | fixed (#703) |
 | E56 | 2 | Lock inventory ignored `gems.locked`. | new finding | #736 | fixed (#750) |
 | E58 | 3 | Production `pub fn`s with no production caller, orphaned by #277 (`committed_artifact_intact`, `go_sum_edit::remove_lines`, hosted-vlt ledger helpers, three test-only helpers). | new finding; 3.6 | #782 | partly fixed (#1141: hosted-vlt ledger helpers, `read_project_file` gated); `committed_artifact_intact`, `remove_lines`, `seed_rubygems_sha256`, `copy_manifest_tag` remain in open-PR files |
 | E59 | 2 | Vendored gem `edit_lock` searched only the first `GEM` section. | new finding | #779 | fixed (#805) |
 | E61 | 2 | The vendored-reference scan missed NuGet, Maven and `hatch.toml` wiring. | new finding | #832, #958 | fixed (#1015) |
 | E63 | 2 | Hosted Maven splices the API `maven_suffixed_version` into `pom.xml` unchecked, while hosted Gradle refuses a malformed suffix; four suffix builders (executed twice). | new finding | #882 | filed #882 |
-| E64 | 2 | No shared BOM helper (4 `strip_bom` copies, ~50 inline strips); `formats::pnpm`'s `lockfileVersion` readers skipped it (executed twice). Symptoms #903, #904, #623. | new finding; 4.4 | #905 | partly fixed (#909, #1117, #1160): `formats::text` helper, pnpm readers and 19 inline strips moved; 15 files remain on `PENDING_INLINE_BOMS` |
+| E64 | 2 | No shared BOM helper (4 `strip_bom` copies, ~50 inline strips); `formats::pnpm`'s `lockfileVersion` readers skipped it (executed twice). Symptoms #903, #904, #623. | new finding; 4.4 | #905 | partly fixed (#909, #1117, #1160): `formats::text` helper, pnpm readers and 19 inline strips moved; 15 files remain on `PENDING_INLINE_BOMS`; slice 3 (4 files) in PR #1191 |
 | E65 | 3 | Every vendored sink discards `force`/`sources`, yet `vendor --force` docs promise a tolerance and a warning nothing emits (executed twice). | new finding; 5.2 | #923 | filed #923 |
 | E66 | 2 | Vendored Poetry picks its forward splicer by line ending (`utils::poetry_lock` vs the `toml_surgery` scanner), with different `files` shapes and checks (executed twice). | new finding; 5.4 | #936 | fixed (#1185) |
 | E68 | 2 | Vendored gem forward treats any Gemfile containing the copy path as wired, revert needs the exact line: a trailing comment leaves the lock restored and the Gemfile on `path:` (executed 3×). | new finding; 5.3 | #988 | filed #988 |
 
@@ -7,7 +7,7 @@ _Last updated 2026-10-08T21:47Z · main @ 830749f_
 | C02 | 1 | The patch API clients set no HTTP timeout. | §1 #2 | #570 | fixed (#581) |
 | C03 | 1 | `vendored_takeover` ignored `kept_artifact` on a drift-keep. | §1 #3; 2.4 | #568 | fixed (#708) |
 | C04 | 1 | Vendored Hatch ran a planted `hatch`. | §1 #4; 7.3 | #613 | fixed (#617) |
-| C05 | 1 | `SOCKET_FORCE` is bound to `vendor --force`, `apply --force` and `self-update --force`, so forcing a self-update also forces past hash checks. Merged C35: drop the deprecated spellings and decide embedded `--vex`. `vendor --force` promises a tolerance nothing implements (#923). | §1 #6; R9; R10 | #615, #966, #923 | partly fixed (#1021); in PR #1031; decided 2026-10-07: `SOCKET_FORCE` binding removed (#615), v5 removes legacy spellings (#966); embedded `--vex` undecided |
+| C05 | 1 | `SOCKET_FORCE` is bound to `vendor --force`, `apply --force` and `self-update --force`, so forcing a self-update also forces past hash checks. Merged C35: drop the deprecated spellings and decide embedded `--vex`. `vendor --force` promises a tolerance nothing implements (#923). | §1 #6; R9; R10 | #615, #966, #923 | partly fixed (#1021, #1031); decided 2026-10-07: `SOCKET_FORCE` binding removed (#615), legacy spellings removed in v5 (#966, #1031); embedded `--vex` undecided |
 | C06 | 1 | `get` round-trips its arguments through `DownloadParams` and `..GlobalArgs::default()`, which silently resets `offline`, `patch_server_url` and more. `get` also builds a fake `ApplyArgs`, and `get` and `scan` call each other. | 2.1; 2.3; R7 | | rejected; resets inert on 045d7ec, cycle folded into C12 |
 | C07 | 1 | The URL builders disagree. When org auto-resolve fails, `patches_path` sends JSON calls to `/v0/orgs/default/…`, while `binary_url` and `vendor_package_url` send the same client to the public proxy. Telemetry has a fourth copy of this logic. | 7.2 | #648 | in PR #1041; decided 2026-10-07: org resolved once per run, failed auto-resolve → whole run on the proxy |
 | C08 | 2 | Repo hygiene: a stray `.github/actions/actions/cache/<sha>/.vscode/launch.json`, a README that documents v5 but whose installer installs v4, and 39 references to a "DESIGN §" document that doesn't exist. (The dead CI path filters go to the CI janitor.) | §1 #8; 8.5 J | #649 | rejected; #649 closed not planned 2026-10-08 |