@@ -0,0 +1,17 @@
+[agent] 2026-10-09: architecture refactor run
+
+- main: `e782c9a`. Since `a80b89e`, #1009, #1161, #1211, #1237 and some CI PRs merged. None of them is a refactor PR, so no rows changed and no doc rewrites were due.
+- Ranking: 31 open PRs. Every production candidate with B ≥ 1 is still blocked by file overlap:
+  - the manifest-load cluster (#931/#998/#1063/#1123), by #1049 and #1034;
+  - #1098, by #1026, #1034 and #1180;
+  - #1220, by #1254, #1259, #1026 and #1188;
+  - #761/#836, by `redirect/mod.rs`.
+  #905 slice 4 (E64: 7 free `PENDING_INLINE_BOMS` files; D ≈8, R L, score ≈14) won among the free work.
+- PR: [#1277](https://github.com/SocketDev/socket-patch/pull/1277), `state: ready`, Bugbot requested. Production +29/−31, tests +157/−7.
+  - 6 files call `strip_bom`/`split_bom`. `formats/pnpm/lines.rs` was a stale allowlist entry.
+  - `yaml_top_level_value`, the berry `npmScopes` probe and Hatch `read_toml` skipped the BOM twice (their own strip plus `top_level_key` or the TOML lexer). They now leave it to the inner reader.
+  - The only behavior change is for double-BOM inputs.
+  - Clippy is clean. Core lib: 6044 passed, plus the 4 known root-only failures. CLI suites passed: `e2e_vex` 38, `e2e_vex_redirect` 33, `e2e_redirect_yarn_berry_build` 34, `e2e_redirect_bun_build` 35.
+- Claimed: #905 (slice 4, `Refs`; 4 files remain, all changed by open PRs). Released: none.
+- Register: E64 → slice 4 in PR #1277. `doc/04` already carries `{{E64}}`.
+- Lessons: `top_level_key` and toml_parser's lexer already skip one leading BOM, so a caller that strips first accepts two. Grep the inner reader before adding `strip_bom`.
@@ -59,7 +59,7 @@ _Last updated 2026-10-09T12:58Z · main @ a80b89e_
 | E59 | 2 | Vendored gem `edit_lock` searched only the first `GEM` section. | new finding | #779 | fixed (#805) |
 | E61 | 2 | Vendored-reference scan missed NuGet/Maven/hatch wiring. | new finding | #832, #958 | fixed (#1015) |
 | E63 | 2 | Hosted Maven splices the API `maven_suffixed_version` into `pom.xml` unchecked, while hosted Gradle refuses a malformed suffix; four suffix builders (executed twice). | new finding | #882 | filed #882 |
-| E64 | 2 | No shared BOM helper (4 `strip_bom` copies, ~50 inline strips); `formats::pnpm`'s `lockfileVersion` readers skipped it (executed twice). Symptoms #903, #904, #623. | new finding; 4.4 | #905 | partly fixed (#909, #1117, #1160, #1191); 11 files remain on `PENDING_INLINE_BOMS` |
+| E64 | 2 | No shared BOM helper (4 `strip_bom` copies, ~50 inline strips); `formats::pnpm`'s `lockfileVersion` readers skipped it (executed twice). Symptoms #903, #904, #623. | new finding; 4.4 | #905 | partly fixed (#909, #1117, #1160, #1191); slice 4 in PR #1277 (7 files); 4 files remain on `PENDING_INLINE_BOMS` |
 | E65 | 3 | Every vendored sink discards `force`/`sources`, yet `vendor --force` docs promise a tolerance and a warning nothing emits (executed twice). | new finding; 5.2 | #923 | filed #923 |
 | E66 | 2 | Vendored Poetry picks its forward splicer by line ending (`utils::poetry_lock` vs the `toml_surgery` scanner), with different `files` shapes and checks (executed twice). | new finding; 5.4 | #936 | fixed (#1185) |
 | E68 | 2 | Vendored gem forward treats any Gemfile containing the copy path as wired, revert needs the exact line: a trailing comment leaves the lock restored and the Gemfile on `path:` (executed 3×). | new finding; 5.3 | #988 | filed #988 |
 
@@ -1,7 +1,8 @@
 ### Refactor routine (`refactor`, hourly, highest leverage first)
-_Last updated 2026-10-09T13:45Z · main @ a80b89e_
+_Last updated 2026-10-09T14:30Z · main @ e782c9a_
 
 **In flight:**
+- [#1277](https://github.com/SocketDev/socket-patch/pull/1277): 7 more files read the leading BOM through `formats::text` (`npm_crawler`, `governing_root`, `npmrc`, `upstream/npm`, `vex/discover/{npm,pypi_other}`, `pnpm/workspace`); 2 double skips removed. #905 slice 4 (E64). +29/−31 prod, +157/−7 tests. `state: ready`.
 - [#1272](https://github.com/SocketDev/socket-patch/pull/1272): `tests/common/envelope.rs` owns the `--json` envelope readers (parse, `events`, `find_event`, event/warning codes); ~25 private copies in 24 test files deleted, ratchet `cli/envelope_helper_copies.rs`. #1089 child 1 helpers (C32). 0 prod. `state: ready`.
 - [#1264](https://github.com/SocketDev/socket-patch/pull/1264): Gradle (vendored + hosted) and the Maven reactor pick inserted-line terminators through `line_endings::terminator`; `gradle/eol.rs` deleted (`eol_eq` and `respell` in `line_endings`). #815 slice 3 (E16). +67/−97 prod, +67/−37 tests. `state: ready`.
 - [#1262](https://github.com/SocketDev/socket-patch/pull/1262): the OpenVEX document is written through `utils::fs::write_user_output` (stage + rename; links through, devices in place). #1144 (C77). +57/−1 prod, +185 tests; CI green, Bugbot clean. `state: ready`.
@@ -19,15 +20,16 @@ _Last updated 2026-10-09T13:45Z · main @ a80b89e_
 
 | # | Candidate | B | U | D | R | Score | Note |
 |---|---|:-:|:-:|:-:|:-:|:-:|---|
-| 1 | #1089 child 1 (C32): shared `common::envelope` readers | 0 | 1 | ≈25 (tests) | L | ≈12 | **taken: #1272**; remove covgap file waits on #1258 |
-| 2 | #905 slice 4 (E64): `formats/pnpm/lines.rs`, `redirect/npmrc.rs`, `vex/discover/pypi_other.rs` onto `formats::text` | 0 | 0 | ≈3 | L | ≈6 | free |
-| 3 | #1098 (E90): one Bundler-homes answer in `ruby_crawler.rs` | 1 | 0 | ≈1 | M | ≈3 | free in core; `vex_consumed.rs`/`ecosystem_dispatch.rs` busy |
-| 4 | #931 + #998 + #1063 + #1123: one manifest load + error mapper | 4 | 1 | ≈6 | M | ≈24 | skipped: `apply.rs`, `vendor.rs`, `rollback.rs`, `remove.rs`, `repair.rs` (#1009, #1034, #1049) |
-| 5 | #761/#836 (C69, S 3): parse/serialize the cargo and uv locks once per run | 0 | 0 | ≈2 | M | ≈5+S | skipped: `redirect/mod.rs` (6 PRs) |
+| 1 | #905 slice 4 (E64): 7 free `PENDING_INLINE_BOMS` files onto `formats::text` | 0 | 0 | ≈8 | L | ≈14 | **taken: #1277**; 4 files left (open PRs) |
+| 2 | #931 + #998 + #1063 + #1123: one manifest load + error mapper | 4 | 1 | ≈6 | M | ≈24 | skipped: `apply.rs`, `vendor.rs`, `scan/mod.rs` (#1049), `rollback.rs`, `remove.rs`, `repair.rs` (#1034 …) |
+| 3 | #1098 (E90): one Bundler-homes answer | 1 | 0 | ≈1 | M | ≈3 | skipped: `vex_consumed.rs` (#1026), `ecosystem_dispatch.rs` (#1034), `scan/hosted.rs` (#1180) |
+| 4 | #1220 (C78): upstream restore through `utils::concurrency` | 1 | 0 | ≈5 | M | ≈11 | skipped: upstream `cargo.rs` (#1254, #1259), `composer.rs` (#1026), `pypi.rs` (#1188) |
+| 5 | #761/#836 (C69, S 3): parse the cargo and uv locks once per run | 0 | 0 | ≈2 | M | ≈5+S | skipped: `redirect/mod.rs` (6 PRs) |
 
-Re-ranked 2026-10-09T13:00Z at `a80b89e` against 35 open PRs (144 production files). Still skipped by file overlap: #705, #717, #882 (E63), #823, #675, #1220, #1114, #1129, #1098's CLI half. #1270 (E95) is a pure fix for the fixer. Free but low: E37 composer `normalize_version`, C17 `yarn_berry_lock.rs` digest.
+Re-ranked 2026-10-09T14:00Z at `e782c9a` against 31 open PRs. Still skipped by file overlap: #705, #717, #882, #823, #675, #647/#614 (`scan/mod.rs`, `get.rs`, `api/client.rs`), #782 leftovers (`commands/vendor.rs`, `vendor/state.rs`, `group_commit.rs`). Free but low: E37 composer `normalize_version`, C17 `yarn_berry_lock.rs` digest.
 
 **Notes:**
+- BOM (#905, #1277): `top_level_key` and the TOML lexer (toml_parser) already skip one leading BOM; never strip before them (that accepts two).
 - CLI tests read `--json` through `common::envelope` since #1272 (`parse_json_envelope`, strict `events`, `find_event`, `event_triples`, lenient `event_codes`/`codes_in`, recursive `all_codes`); `cli/envelope_helper_copies.rs` fails on new private copies, stale entries allowed.
 - Gradle line endings (#1264): `gradle::eol` is gone; Gradle writers insert with `line_endings::terminator` and find what they wrote with `line_endings::respell(text, terminator(current))`, compare owned files with `line_endings::eol_eq`. Keep forward and revert on the same rule.
 - User-named output paths (`--output`, `--vex <path>`) go through `utils::fs::write_user_output` since #1262; do not stage-and-rename over `/dev/stdout` or a FIFO with the commit-point writers. `RLIMIT_FSIZE` + ignored `SIGXFSZ` in `pre_exec` gives a root-proof part-way write failure; set `LLVM_PROFILE_FILE=/dev/null` on that child or `coverage` fails on a truncated `.profraw`.
@@ -40,14 +42,14 @@ Re-ranked 2026-10-09T13:00Z at `a80b89e` against 35 open PRs (144 production fil
 - NuGet crawl scope (#1183): only a `cwd` with a project file is scoped; a solution root keeps the walk (restores at any depth). Extend through `PackageRoots::scope`, not a second assets reader.
 - A hash read from a manifest is lowercase after #1163; `api::blob_fetcher::blob_hash_matches` and vendored `eq_ignore_ascii_case` sites become plain `==` once their files are free (#707 remainder).
 - `formats::xml` (#1145) is the shared XML element scanner (comment + CDATA blanking, `elements`, `children`, `attr`); route new XML readers (NuGet, pom writers) through it instead of a private masker.
-- The skip rule names `arch-refactor/*` and `agent/fix-*` PRs only; still check `arch-fix/*` and `ci*` hunks before touching the same lines.
+- Skip rule: also check `arch-fix/*` and `ci*` hunks.
 - Test-helper migrations (#824): directory binaries import via `crate::common`. `spawn_env_hygiene` scans test text, literals included: never spell a bare binary spawn in a new test file; run it before pushing.
 - Equivalence goldens (`tests/equivalence/*.golden`, bless with `SOCKET_PATCH_BLESS_GOLDEN=1`) include mixed-ending inputs: prove only mixed cases move before re-blessing a line-ending change.
-- The sandbox runs as root, so 4 core lib tests fail on main and on branches alike: `copy_tree::relax_loop_must_not_traverse_symlinked_root`, `vlt_heal::an_unremovable_hidden_lock_keeps_every_store_entry`, `pypi_poetry::wire_write_failure_maps_error_and_leaves_lock_untouched`, `pypi_requirements::wire_failure_rolls_back_already_written_files`.
+- Root sandbox: 4 core lib tests fail on main too (`relax_loop_must_not_traverse_symlinked_root`, `an_unremovable_hidden_lock_keeps_every_store_entry`, `wire_write_failure_maps_error_and_leaves_lock_untouched`, `wire_failure_rolls_back_already_written_files`).
 - `redirect/pipenv.rs`, `vendor/pypi.rs` and `vendor/lock_inventory/vlt.rs` aren't rustfmt-clean on main: format only your own hunks there. Check `rustfmt --check` on the `main` copy before formatting a whole file.
 - `lock_inventory/mod.rs` `architecture_tests` forbid `hosted_patch_uuid*` in a format file's model section. Origin-policy helpers go after the `// ── registry view ──` marker.
 - NuGet identity (#1230): `PurlKey` folds versions through `vendor::nuget_feed::normalize_nuget_version` (a utils→vendor import until `nuget_feed.rs` frees for the `formats::nuget` move). `test_support::service_fixture` builds its NuGet grant from `<id>.<purl version>.nupkg`, so a test vendoring a non-normalized version needs that file too.
-- NuGet crawl identity (#1239): `find_by_purls` runs main's probes first (`<id>/<as-written>`, exact legacy, case-insensitive legacy) and the normalized ones only after (`<id>/<normalized>`, `legacy_dir_is`), so a cache with two spellings keeps main's pick. The `oracle.rs` equivalence keeps main's rule; its randomized versions are all normalized, so it still agrees.
+- NuGet crawl identity (#1239): `find_by_purls` tries main's probes first, normalized ones after, so a two-spelling cache keeps main's pick.
 - Steering (2026-10-02, #569/#571): no size caps on trusted upstream data; stream, don't buffer.
 - `tests/spawn_env_hygiene.rs` allowlists (`PENDING_RAW_SPAWNS` / `PENDING_SCRUB_COPIES`) fail on new **and** stale entries: drop a file when you migrate it.
 - Probe spawns go through `utils::process::output_within` since #886 (blocking; async callers wrap it in `utils::fs::run_blocking`). It nulls stderr; don't add a new `tokio::time::timeout` + `kill_on_drop` site.