@@ -1062,9 +1062,13 @@ jobs:
           - {os: macos-latest, suite: e2e_vex_build, test_filter: 'pip:: --ignored', pip: '22 26'}
           # Real-Maven hosted + vendored capstones, one leg per Maven line:
           # 3.6 (pre http-blocker), 3.8 (resolver 1.6: no trusted checksums),
-          # 3.9 (trusted checksums), 4.0 rc.
+          # 3.9 (trusted checksums), 4.0 rc. Hosted also runs both sides of
+          # the trusted-checksums floor: 3.9.3 (last release that ignores
+          # the .mvn/checksums pin) and 3.9.4 (first that enforces it).
           - {os: ubuntu-latest, suite: e2e_redirect_maven_build, maven: '3.6.3'}
           - {os: ubuntu-latest, suite: e2e_redirect_maven_build, maven: '3.8.9'}
+          - {os: ubuntu-latest, suite: e2e_redirect_maven_build, maven: '3.9.3'}
+          - {os: ubuntu-latest, suite: e2e_redirect_maven_build, maven: '3.9.4'}
           - {os: ubuntu-latest, suite: e2e_redirect_maven_build, maven: '3.9.16'}
           - {os: ubuntu-latest, suite: e2e_redirect_maven_build, maven: '4.0.0-rc-6'}
           - {os: macos-latest, suite: e2e_redirect_maven_build, maven: '3.9.16'}
 
@@ -106,6 +106,12 @@ limits, and required install commands.
   twin or a `BUNDLE_GEMFILE` setting (environment or `.bundle/config`) no longer
   leads to an edit of an ignored `Gemfile` that reports success and attests an
   unpatched gem; unsupported layouts are refused before any write (#341, #390).
+- Hosted Maven warns `redirect_maven_trusted_checksums_unenforced` when
+  `.mvn/wrapper/maven-wrapper.properties` pins a Maven older than 3.9.4. Maven
+  3.9.0–3.9.3 never enforce the Trusted Checksums pin that hosted mode writes;
+  the 4.0.0 notes and docs wrongly said every 3.9 release does. The version
+  suffix still fails closed. CI runs the real-Maven hosted capstone on 3.9.3 and
+  3.9.4 (#258).
 - Patch application, reversal, and cleanup handle missing files, release variants,
   corrupt state, newer ledger formats, and unsafe manifest paths without silently
   dropping protection. File ownership restoration failures produce warnings.
@@ -127,6 +133,11 @@ limits, and required install commands.
   not build from a previous patch's modified bytes. Verified service artifacts
   keep their identity; integrity failures do not fall through to a local rebuild.
   Repair rebuilds against recorded pins and reports unavailable inputs.
+- VEX no longer attests an npm package that also ships a bundled, unpatched
+  copy of the same `name@version` (`inBundle: true`, or v1 `bundled: true`).
+  npm unpacks that copy from the parent's tarball, so no rewire reaches it; the
+  reference is now reported `patched_ref_unattributable`, naming the bundled
+  copy, in hosted and vendored mode (#325).
 - API throttling uses bounded retries, failed queries appear in JSON diagnostics,
   and hosted reference resolution handles batches larger than 500 patches.
 - Transient apply locks are removed on normal command exit; no-op scans and full
 
@@ -3551,6 +3551,7 @@ mod tests {
                 "pom.xml",
                 ".mvn/maven.config",
                 ".mvn/checksums/checksums.sha256",
+                ".mvn/wrapper/maven-wrapper.properties",
                 "settings.gradle",
                 "settings.gradle.kts",
                 "build.gradle",
 
@@ -310,6 +310,19 @@ fn maven_scan_hosted_fresh_checkout_install_and_manifestless_vex() {
         return;
     };
     let pristine_pom = std::fs::read_to_string(proj.join("pom.xml")).unwrap();
+    // The project pins the Maven under test through the Maven Wrapper, so
+    // the rewriter's "your Maven ignores the Trusted Checksums pin" warning
+    // is judged against the same release that step 5b drives (#258).
+    std::fs::create_dir_all(proj.join(".mvn/wrapper")).unwrap();
+    std::fs::write(
+        proj.join(".mvn/wrapper/maven-wrapper.properties"),
+        format!(
+            "distributionUrl=https\\://repo.maven.apache.org/maven2/org/apache/maven/\
+             apache-maven/{v}/apache-maven-{v}-bin.zip\n",
+            v = mvn.version
+        ),
+    )
+    .unwrap();
 
     // 2. Patched jar + served pom + the record (real before/after hashes).
     let (_orig, patched) = patched_member(&jar, UUID);
@@ -353,6 +366,17 @@ fn maven_scan_hosted_fresh_checkout_install_and_manifestless_vex() {
     assert_eq!(env["redirect"]["mode"], "hosted", "{env}");
     assert_eq!(env["redirect"]["redirected"], 1, "{env}");
     assert_eq!(env["vex"]["statements"], 1, "{env}");
+    let unenforced = env["redirect"]["warnings"]
+        .as_array()
+        .into_iter()
+        .flatten()
+        .any(|w| w["code"] == "redirect_maven_trusted_checksums_unenforced");
+    assert_eq!(
+        unenforced,
+        !mvn.enforces_trusted_checksums(),
+        "Maven {}: the unenforced-pin warning must match what step 5b proves: {env}",
+        mvn.version
+    );
     let embedded: serde_json::Value =
         serde_json::from_slice(&std::fs::read(proj.join("embedded.vex.json")).unwrap()).unwrap();
     assert_attested(&embedded, &purl(), UUID, Marker::Redirected, &vulns());
 
@@ -1618,6 +1618,61 @@ fn a_sibling_lock_resolving_the_registry_contests_a_ledger_record() {
     }
 }
 
+/// REGRESSION (#325): the hosted rewriter rewires the hoisted
+/// `left-pad@1.3.0` and skips a parent's bundled copy of the same version
+/// (`redirect_npm_bundled_instance_skipped`: npm unpacks it from the
+/// parent's tarball, so it stays unpatched). The ledger record must be dead
+/// (`redirect_unwired`, naming the bundled copy), not attested from the
+/// lock basis. Without the bundled copy the same ledger attests.
+#[test]
+fn hosted_npm_patch_with_an_unpatched_bundled_copy_is_not_attested() {
+    let purl = "pkg:npm/left-pad@1.3.0";
+    for bundled in [false, true] {
+        let tmp = tempfile::tempdir().unwrap();
+        let cwd = tmp.path();
+        write_hosted_package_lock(cwd, &[("left-pad", "1.3.0", UUID)], true);
+        if bundled {
+            let lock_path = cwd.join("package-lock.json");
+            let mut lock: Value =
+                serde_json::from_str(&std::fs::read_to_string(&lock_path).unwrap()).unwrap();
+            let packages = lock["packages"].as_object_mut().unwrap();
+            packages.insert(
+                "node_modules/bund".to_string(),
+                serde_json::json!({ "version": "1.0.0", "resolved": "file:bund-1.0.0.tgz" }),
+            );
+            packages.insert(
+                "node_modules/bund/node_modules/left-pad".to_string(),
+                serde_json::json!({
+                    "version": "1.3.0",
+                    "resolved": "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
+                    "inBundle": true
+                }),
+            );
+            std::fs::write(&lock_path, lock.to_string()).unwrap();
+        }
+        write_redirect_ledger(
+            cwd,
+            &[(
+                purl,
+                make_record(UUID, &"b".repeat(64), "GHSA-bndl-host", &["CVE-2026-325"]),
+            )],
+            &[("package-lock.json", "npm_lock_entry")],
+        );
+        let (code, env) = vex_json(cwd, &["--offline", "--no-verify"]);
+        if !bundled {
+            assert_eq!(code, Some(0), "control: {env}");
+            continue;
+        }
+        assert_eq!(code, Some(1), "{env}");
+        assert_eq!(skipped_reason(&env, purl), "redirect_unwired", "{env}");
+        assert!(
+            env.to_string()
+                .contains("node_modules/bund/node_modules/left-pad"),
+            "the bundled copy is named: {env}"
+        );
+    }
+}
+
 /// REGRESSION: a hosted pin with NO lock at all is the rewriters' ordinary
 /// output, not a stale shape — `rewrite_nuget` edits only nuget.config for a
 /// project without RestorePackagesWithLockFile, `rewrite_cargo` only
 
@@ -1343,6 +1343,135 @@ fn vendored_live_tree_out_of_sync_warns_but_attests() {
     );
 }
 
+/// REGRESSION (#325): the lock rewires the hoisted `lodash@4.17.21` to the
+/// vendored tarball, but a parent package also BUNDLES `lodash@4.17.21`
+/// (`inBundle: true`). npm unpacks that copy from the parent's tarball, so
+/// no rewire reaches it and the build ships it unpatched. `vex` must not
+/// attest the purl, from the lock basis (no `node_modules`) or after an
+/// install whose hoisted copy is patched and bundled copy is not. The
+/// same lock without the bundled copy is the control and still attests.
+#[test]
+fn vendored_npm_patch_with_an_unpatched_bundled_copy_is_not_attested() {
+    let purl = "pkg:npm/lodash@4.17.21";
+    let uuid = "0a0a0a0a-1111-4111-8111-0a0a0a0a0a0a";
+    let patched = b"patched npm bytes\n";
+    let after_hash = compute_git_sha256_from_bytes(patched);
+    for (label, bundled, installed) in [
+        ("control, lock basis", false, false),
+        ("bundled, lock basis", true, false),
+        ("bundled, installed", true, true),
+    ] {
+        let tmp = tempfile::tempdir().expect("create tempdir");
+        let cwd = tmp.path();
+        let rel = format!(".socket/vendor/npm/{uuid}/lodash-4.17.21.tgz");
+        let sha256 = sha256_hex(&write_member_tgz(
+            &cwd.join(&rel),
+            "package/index.js",
+            patched,
+        ));
+        let record = make_record(
+            uuid,
+            "package/index.js",
+            &after_hash,
+            "GHSA-bndl-aaaa",
+            &["CVE-2026-325"],
+        );
+        let wiring = write_matrix_wiring(cwd, "npm", uuid, &rel);
+        if bundled {
+            let lock_path = cwd.join("package-lock.json");
+            let mut lock: Value =
+                serde_json::from_str(&std::fs::read_to_string(&lock_path).unwrap()).unwrap();
+            let packages = lock["packages"].as_object_mut().unwrap();
+            packages.insert(
+                "node_modules/bund".to_string(),
+                serde_json::json!({ "version": "1.0.0", "resolved": "file:bund-1.0.0.tgz" }),
+            );
+            packages.insert(
+                "node_modules/bund/node_modules/lodash".to_string(),
+                serde_json::json!({
+                    "version": "4.17.21",
+                    "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
+                    "integrity": "sha512-T1JJR0lOQUw=",
+                    "inBundle": true
+                }),
+            );
+            std::fs::write(&lock_path, lock.to_string()).unwrap();
+        }
+        let mut state = VendorState::new();
+        state.entries.insert(
+            purl.to_string(),
+            detached_matrix_entry("npm", purl, uuid, &rel, sha256, record, wiring),
+        );
+        let dir = cwd.join(".socket/vendor");
+        std::fs::create_dir_all(&dir).unwrap();
+        std::fs::write(
+            dir.join("state.json"),
+            serde_json::to_string_pretty(&state).unwrap(),
+        )
+        .unwrap();
+        if installed {
+            for (pkg_dir, bytes) in [
+                ("node_modules/lodash", &patched[..]),
+                (
+                    "node_modules/bund/node_modules/lodash",
+                    b"original unpatched bytes\n",
+                ),
+            ] {
+                let nm = cwd.join(pkg_dir);
+                std::fs::create_dir_all(&nm).unwrap();
+                std::fs::write(
+                    nm.join("package.json"),
+                    r#"{"name":"lodash","version":"4.17.21"}"#,
+                )
+                .unwrap();
+                std::fs::write(nm.join("index.js"), bytes).unwrap();
+            }
+        }
+
+        let vex_path = cwd.join("out.vex.json");
+        let out = cli()
+            .args([
+                "vex",
+                "--cwd",
+                cwd.to_str().unwrap(),
+                "--json",
+                "--output",
+                vex_path.to_str().unwrap(),
+                "--product",
+                "pkg:npm/app@1.0.0",
+            ])
+            .output()
+            .expect("invoke vex");
+        let env: Value = serde_json::from_slice(&out.stdout).unwrap_or_else(|e| {
+            panic!(
+                "{label}: envelope JSON on stdout ({e}): {}",
+                String::from_utf8_lossy(&out.stdout)
+            )
+        });
+        if !bundled {
+            assert!(out.status.success(), "{label}: {env}");
+            let doc: Value =
+                serde_json::from_str(&std::fs::read_to_string(&vex_path).unwrap()).unwrap();
+            assert_eq!(
+                doc["statements"].as_array().unwrap().len(),
+                1,
+                "{label}: {doc}"
+            );
+            continue;
+        }
+        assert_eq!(out.status.code(), Some(1), "{label}: {env}");
+        assert!(
+            !vex_path.exists(),
+            "{label}: no VEX document may attest the purl: {env}"
+        );
+        assert!(
+            env.to_string()
+                .contains("node_modules/bund/node_modules/lodash"),
+            "{label}: the envelope names the bundled copy: {env}"
+        );
+    }
+}
+
 // ──────────────────────────────────────────────────────────────────────
 // 8. an applied, byte-verified agent-mode patch attests whether or not its
 // ecosystem has an install hook (there is no setup-state filter).
 
@@ -179,13 +179,15 @@ impl Mvn {
         self.numeric()[0]
     }
 
-    /// Maven ≥ 3.9 (resolver ≥ 1.9) enforces the trusted-checksums summary
-    /// file the hosted rewriter commits under `.mvn/checksums/`; older
-    /// lines ignore the `aether.*` properties and only the transport
-    /// `checksumPolicy=fail` sidecar check protects the download.
+    /// Maven ≥ 3.9.4 enforces the trusted-checksums summary file the hosted
+    /// rewriter commits under `.mvn/checksums/` (#258). 3.9.0 / 3.9.1 leave
+    /// `${session.rootDirectory}` in `maven.config` uninterpolated, so the
+    /// file is never found; 3.9.2 / 3.9.3 ignore `checksumAlgorithms=SHA-256`
+    /// and check SHA-1 only; older lines have no trusted-checksums support.
+    /// Below 3.9.4 only the transport `checksumPolicy=fail` sidecar check
+    /// protects the download.
     pub fn enforces_trusted_checksums(&self) -> bool {
-        let v = self.numeric();
-        v[0] > 3 || (v[0] == 3 && v[1] >= 9)
+        self.numeric() >= vec![3, 9, 4]
     }
 
     /// `mvn -B <args>` in `cwd` against the local repository `m2`, with the
 
@@ -140,6 +140,14 @@ const REGISTRY: &[FormatFile] = &[
     // into (read so an existing user config / checksum set is preserved).
     row(".mvn/maven.config", "maven", HOSTED),
     row(".mvn/checksums/checksums.sha256", "maven", HOSTED),
+    // Never edited: its `distributionUrl` names the project's Maven, which
+    // the maven planner checks against the Trusted Checksums floor (3.9.4)
+    // to warn when the `.mvn/*` pin above would be inert.
+    row(
+        ".mvn/wrapper/maven-wrapper.properties",
+        "maven",
+        HOSTED | PRESENCE_ONLY,
+    ),
     // Gradle build scripts are never edited — their presence only feeds the
     // maven planner's paste-able `exclusiveContent` snippet warning.
     row("settings.gradle", "maven", HOSTED | PRESENCE_ONLY),