@@ -0,0 +1,8 @@
+[agent] 2026-10-09: architecture refactor run
+
+- main: `a80b89e` (unchanged since the last entry; nothing merged).
+- Ranking: 30 open PRs change 131 production files. #989's remaining backends, the manifest-load cluster, #717, #1220, #1114 (E91), #1129 (E92), #1098 (E90) and E12 are skipped by file overlap. #1144 (C77, B 1, D 1, R L) won among free files: `commands/vex.rs` and `utils/fs.rs` are unchanged by open PRs; the free production alternatives (#905 slice 4, E37, E16 `maven_reactor.rs`, C17 digests) are D ≈1 with no bug closed.
+- PR: [#1262](https://github.com/SocketDev/socket-patch/pull/1262), `state: ready`, Bugbot requested. Production +34/−1, tests +148. `utils::fs::write_user_output` (stage + rename, mode kept, symlinks written through, `/dev/stdout`/FIFOs/devices in place, never captured by a group commit); `generate_vex` drops its `tokio::fs::write`. New `e2e_vex::failed_output_write_leaves_no_partial_document` is red on `main` (512-byte truncated document left) and green on the branch. Clippy clean; core lib 5982 passed plus the 4 known root-only failures; `e2e_vex` 39, `e2e_embedded_vex` 32, `e2e_vex_redirect` 31, `covgap_commands_vex` 12, `spawn_env_hygiene` 15 passed.
+- Claimed: #1144. Released: none.
+- Register: C77 → in PR #1262; `doc/07` already carries `{{C77}}`.
+- Lessons: `RLIMIT_FSIZE` set in `pre_exec` with `SIGXFSZ` ignored reproduces a part-way write failure as root, where read-only directories and full tmpfs mounts are unavailable or ignored.
@@ -73,7 +73,7 @@ _Last updated 2026-10-09T09:55Z · main @ a80b89e_
 | C74 | 3 | With no patch state (fresh project, or after a full `rollback`), `rollback` and `repair` exit 1 (`Manifest not found`/`manifest_not_found`) while `apply`, `vendor`, `vendor --revert` and `list` exit 0; a second v5 `rollback` exits 1, pinned by a test. | new finding | #1088 | decision #1088 (Q2) |
 | C75 | 2 | Every HTTP client trusts only reqwest's bundled webpki roots (no platform store, `SSL_CERT_FILE` or extra-CA knob), so behind a TLS-inspecting proxy the documented `HTTPS_PROXY` route fails with `UnknownIssuer` on every API, registry, telemetry and self-update call. | new finding | #1107 | filed #1107 |
 | C76 | 3 | `validate_paths` (#1029) refuses a directory manifest only when `--manifest-path` is spelled differently from the default: exit 2 with no `--json` output vs exit 1 `manifest_unreadable` for the same file. | new finding | #1123 | filed #1123 |
-| C77 | 3 | The VEX document is written with `tokio::fs::write`, not stage + rename: a failed write leaves a truncated OpenVEX file the cleanup keeps. | new finding | #1144 | filed #1144 |
+| C77 | 3 | The VEX document is written with `tokio::fs::write`, not stage + rename: a failed write leaves a truncated OpenVEX file the cleanup keeps. | new finding | #1144 | filed #1144; in PR #1262 (`utils::fs::write_user_output`) |
 | C78 | 3 | The hosted upstream restore sends every public-registry lookup at once (`join_all` in 5 formats); `utils::concurrent::registry_concurrency()` (cap 4, fd-tight 1) has no caller: 40 pins → 40 in flight. | new finding | #1220 | filed #1220 |
 | C79 | 3 | GC is reported in four `--json` shapes (repair, remove, rollback, `scan --prune`); the contract's `summary.bytesFreed`/`bytesDownloaded` and `events[].bytes` are emitted by no command, so its GC jq recipe prints `null`. | new finding | #1257 | filed #1257 |
 
 
@@ -1,7 +1,8 @@
 ### Refactor routine (`refactor`, hourly, highest leverage first)
-_Last updated 2026-10-09T10:15Z · main @ a80b89e_
+_Last updated 2026-10-09T11:20Z · main @ a80b89e_
 
 **In flight:**
+- [#1262](https://github.com/SocketDev/socket-patch/pull/1262): the OpenVEX document is written through `utils::fs::write_user_output` (stage + rename, mode kept, links written through, devices/FIFOs in place, never captured). #1144 (C77). +34/−1 prod, +148 tests. `state: ready`.
 - [#1258](https://github.com/SocketDev/socket-patch/pull/1258): 40 more CLI test files import `tests/common`'s `binary()` / `git_sha256` (31 + 25 copies deleted). #824 children 2–3 slice 2 (C30). +142/−401 tests, 0 prod. `state: ready`.
 - [#1253](https://github.com/SocketDev/socket-patch/pull/1253): agent-mode `jvm_jar::verify_member_bytes` streams members through `hash::git_sha256::zip_member_git_sha256` (302 → 30 MiB peak on a 256 MiB member). #914 slice (C51); `vendor/common.rs` caller is free since #1227 merged; it needs #1253's helper. +17/−11 prod, +85 tests. `state: ready`.
 - [#1245](https://github.com/SocketDev/socket-patch/pull/1245): `vendor::revert::finish` + `KeepPolicy` (`OnDrift`, `OnDriftWhileReferenced`, `NpmFamily`); gem, composer, Maven legacy, NuGet and pnpm finish through it. #989 item 1 slice (E24). +133/−157 prod (helper 90), +271 tests. `state: ready`.
@@ -17,14 +18,15 @@ _Last updated 2026-10-09T10:15Z · main @ a80b89e_
 | # | Candidate | B | U | D | R | Score | Note |
 |---|---|:-:|:-:|:-:|:-:|:-:|---|
 | 1 | #989 item 1: one `vendor::revert::finish` for the 12 copied finish blocks | 0 | 1 | ≈12 | L | ≈26 | **taken: #1245**; bun ×2 (#1009), npm (#1161, #1187), vlt (#1161), pypi (#1026), yarn classic (#1242) and berry remain |
-| 2 | #931 + #998 + #1063 + #1123: one manifest load + error mapper for every command | 4 | 1 | ≈6 | M | ≈24 | skipped: `apply.rs`, `vendor.rs`, `rollback.rs` (#1009, #1049), `remove.rs` (#1034, #1049), `repair.rs` (#1049) |
-| 3 | #717 (E10): hosted pom edits + restore through `formats::maven` | 3 | 1 | ≈4 | M | ≈17 | skipped: `redirect/mod.rs` (#1009, #1026, #1180, #1242, #1254) |
-| 4 | #1220 (C78): bound upstream-restore fan-out through `utils::concurrent::registry_concurrency` | 1 | 0 | ≈4 | L | ≈11 | skipped: the `join_all` sites in upstream `cargo.rs` (#1254), `pypi.rs` (#1188), `composer.rs` (#1026), `npm.rs` (#1009); `upstream/mod.rs` (#1009, #1211) |
-| 5 | #824 children 2–3 slice 2 (C30): 56 test-helper copies onto `tests/common` | 0 | 0 | 56 test | L | test-only | **taken: #1258**; 27 files changed by open PRs + 4 shared modules remain |
+| 2 | #931 + #998 + #1063 + #1123: one manifest load + error mapper for every command | 4 | 1 | ≈6 | M | ≈24 | skipped: `apply.rs`, `vendor.rs` (#1009, #1049), `rollback.rs`, `remove.rs` (#1034, #1049), `repair.rs` (#1049) |
+| 3 | #717 (E10): hosted pom edits + restore through `formats::maven` | 3 | 1 | ≈4 | M | ≈17 | skipped: `redirect/mod.rs` (#1009, #1026, #1180, #1242, #1254, #1259) |
+| 4 | #1220 (C78): bound upstream-restore fan-out through `utils::concurrent::registry_concurrency` | 1 | 0 | ≈4 | L | ≈11 | skipped: `join_all` sites in upstream `cargo.rs` (#1254, #1259), `pypi.rs` (#1188), `composer.rs` (#1026), `npm.rs` (#1009) |
+| 5 | #1144 (C77): VEX document through the shared stage + rename writer | 1 | 0 | 1 | L | ≈5 | **taken: #1262** |
 
-Re-ranked 2026-10-09T10:00Z at `a80b89e` against 27 open PRs (17 agent PRs change 294 files). #1227 merged and frees `vendor/common.rs` for #914's last caller, but that needs #1253's helper first. Also skipped: #675 (`scan/mod.rs` #1049/#1211, `client.rs` #1026/#1034/#1049), #705 (`client.rs`, CLI `lib.rs` #1034), #794 (command files), #594/#1202 move (`nuget_feed.rs` #1245, `redirect/mod.rs`), #757/E15 (`redirect/mod.rs`, `vendor/cargo.rs` #1026), #782 remainder (`state.rs`, `wired.rs` #1009/#1034). Free but low: E64 BOM in `formats/pnpm/lines.rs`, `vex/discover/pypi_other.rs` (D ≈1 each), E37, #833 `vlt_lock_text.rs` move.
+Re-ranked 2026-10-09T11:00Z at `a80b89e` against 30 open PRs (131 production files changed). Nothing merged since 10:15Z. Also skipped by file overlap: #1114/E91 (`vendor/pypi.rs` #1026, `lock_inventory/tests.rs`), #1129/E92 (`npm_crawler.rs` #1009), #1098/E90 (`ecosystem_dispatch.rs`, `vex_consumed.rs`), E12 (`pnpm_lock.rs` #1245), #675, #705, #794, #594, #757, #782 remainder. Free but low: #905 slice 4 (`redirect/npmrc.rs` split copy, `vex/discover/pypi_other.rs` trim; `formats/pnpm/lines.rs` is a stale `PENDING_INLINE_BOMS` entry), E37 composer `normalize_version`, E16 `maven_reactor.rs`, C17 digests in `vendor/jvm/mod.rs`, `redownload.rs`, `yarn_berry_lock.rs`.
 
 **Notes:**
+- User-named output paths (`--output`, `--vex <path>`) go through `utils::fs::write_user_output` since #1262; do not stage-and-rename over `/dev/stdout` or a FIFO with the commit-point writers. `RLIMIT_FSIZE` + ignored `SIGXFSZ` in a `pre_exec` gives a root-proof part-way write failure for red→green tests.
 - Revert finish (#1245): new backends end their revert with `revert::finish(outcome, root, rel, opts, KeepPolicy::…)`; the npm family keeps its bare `cannot remove <rel>` failure (warnings dropped), the rest keep warnings with `failed to remove <abs>`. Yarn berry/classic and npm add a still-wired refusal before the delete: extend the policy, do not re-copy the sequence.
 - `bench.yml` gates +10% per scenario: time a per-dep reader (hosted converge) in release against `main` before pushing.
 - Gem lock edits locate through `formats::gem::parse` since #1221: `Section::lines()` / `end`, `remote_line_nos`, `GemfileLock::dependencies` (entries with one name rule). Whitespace-only lines are blank separators. The vendored slice should read the same fields, not add a fourth walker.