diff --git a/crates/socket-patch-cli/CLI_CONTRACT.md b/crates/socket-patch-cli/CLI_CONTRACT.md
index 86d5b7805..8f44cc567 100644
--- a/crates/socket-patch-cli/CLI_CONTRACT.md
+++ b/crates/socket-patch-cli/CLI_CONTRACT.md
@@ -323,7 +323,7 @@ For a **9.0 root lock**, the CLI ensures `pnpm-workspace.yaml` carries `trustLoc
 
 **Vendored entries and the rest of the CLI.** Because nothing is in the manifest, vendored patches are invisible to `apply` (nothing to apply in place) but fully visible to `list` (listed from the ledger, labeled `Mode: vendored (recorded in .socket/vendor/state.json)` in human mode, exit 0 on a vendored-only project), `vex` (attested from the embedded records while a lockfile still wires the artifact — see "Manifest-less VEX"), `repair` (health-checked and rebuilt from the ledger), and `scan --prune` (lockfile-driven reconcile). They are exempt from standalone `vendor`'s manifest reconcile (`reconcile_dropped` never touches `detached` entries) and exit via `remove <purl>` (which reverts them), `vendor --revert`, or `rollback`, whose vendored leg reverts every in-scope ledger entry (unscoped and identifier-scoped runs; path-scoped runs reach them only when an installed copy matches).
 
-`scan --mode hosted` swaps the in-place apply for the registry-redirect pipeline: discover → resolve hosted-patch references (grant token + integrity + per-dep registry override) → rewrite ONLY the patched dependencies' lockfile / registry-config entries to point at the hosted packages. A dep counts as **redirected** only when its hosted-artifact URL (or per-dep registry index URL) actually landed in a project file — a granted reference whose rewriter found nothing to edit is neither counted nor attested. **No ledger (v5.0)**: hosted mode writes ONLY the lockfile / registry-config edits — `.socket/vendor/redirect-state.json` is never written (on success or failure), and a pre-v5 one on disk is ignored (never read for planning, never quarantined, left byte-identical). The lockfiles are the only record of a hosted patch: `list`, `vex`, `rollback`, `remove`, `vendor` and `repair` all discover the hosted pins from them (a hosted URL counts only on `https://patch.socket.dev` or the `--patch-server-url` / `SOCKET_PATCH_SERVER_URL` origin), and commit-ready output is just the lockfile / config changes. Cargo and golang are confirmed only by their rewriter's own report (`confirmed_cargo_uuids` / `confirmed_golang_uuids`): a golang dep counts only when its go.mod `replace M V => patch.socket.dev/gopatch/<uuid> <sver>` and both go.sum lines are in place, never because the patch-server origin or leftover go.sum lines appear somewhere. Gradle is confirmed the same way (`confirmed_gradle_uuids`): only when the final files hold the owned script, the index row, the live apply line in every build's settings file and the suffixed version in every lock entry of the GA (see [Gradle builds](#gradle-builds-v50)). A golang module that go.mod does not require and go.sum has no zip (`h1:` of the module tree) line for at the patched version is outside the build graph and is refused with `redirect_golang_not_in_module_graph` (nothing written); a `/go.mod`-only line doesn't count, since go writes one for every version MVS reads (#509). In a go < 1.17 graph, where `require` holds only lower bounds, the build selects the highest of the required version and go.sum's zip-line versions, and a patch for a lower version warns `redirect_golang_version_mismatch` (nothing written). Only the exact module `patch.socket.dev/gopatch/<canonical uuid>` is socket-owned; any other module path is refused with `redirect_golang_untrusted_module_path`. A vendored golang module is taken over like cargo and the npm family: its vendor wiring, committed copy and ledger entry are reverted first (`redirect_takeover_reverted_vendored`). A vendored PyPI package (requirements.txt, Poetry, Pipenv, uv, Hatch, PDM, pylock) is taken over the same way: its vendored wiring is restored to the recorded registry entry, its ledger entry and wheel are removed, and it is redirected in the same commit. The Python rewriters treat any non-registry source as user-authored, so without the revert they refused socket-patch's own vendored source and left the project vendored. A vendored Composer package is taken over the same way: its `composer.lock` entry is restored to the recorded pre-vendor entry, its ledger entry and committed copy are removed, and it is redirected in the same commit, so the lock matches a direct hosted scan and `rollback` can restore it from packagist. Without the revert the rewriter edited the vendored entry in place and kept its patch-uuid `dist.reference`, which `rollback` refused. A vendored Composer entry the takeover cannot revert (its vendored ledger entry is missing) is left vendored with `redirect_composer_vendored_entry`, never repointed in place. A takeover revert that leaves vendored wiring in place is refused with `redirect_vendored_revert_failed`. That covers a drift-skipped record (`vendor_lock_entry_drifted`) and a reverted file that still references the artifact (`vendor_revert_residual_reference`). The ledger entry and artifact are kept, and the package stays vendored and skipped. `--dry-run` predicts the same refusal from the same signals instead of previewing `redirect_would_revert_vendored`. The hosted requirements.txt rewriter only rewrites an existing pin in the root `requirements.txt`, so a vendored requirements.txt package whose wiring is a pin in a `-r` include or a `(transitive)` line vendored mode appended is kept vendored, wet and `--dry-run` alike, with `redirect_requirements_takeover_unreachable` (a top-level `warnings[]` entry, and the `errorCode` of the package's `skipped` event). Its wiring, ledger entry and wheel are kept, so it stays vendored and patched (exit 0). The uv and Poetry rewriters are covered the same way: a vendored uv package whose recorded pre-vendor `uv.lock` entry is at another version than the patch (vendored uv pins the entry down to the patch's version; the revert brings the lock's own version back, and hosted mode only pins the version the lock resolves) is kept vendored with `redirect_uv_takeover_version_unreachable`, and a vendored Poetry package on a Poetry 0.x lock (which hosted mode refuses outright) is kept vendored with `redirect_poetry_lock_unsupported`. **Staged takeover (v5.0)**: the takeover is atomic. Each purl's vendored revert is staged in memory (the run's group commit, the same journaled commit vendored mode uses), the hosted rewrite plans against the reverted project, and a staged purl the rewrite does not pin is retracted: every staged revert is undone, that purl keeps its vendored wiring, ledger entry and artifact byte-identical, and the rest are staged and rewritten again. A retracted purl is a `skipped` event whose `errorCode` is the cause: its existing skip reason (unavailable wheel metadata, …), the rewriter warning that names the package (`redirect_yarn_berry_missing_checksum`, `redirect_pypi_platform_wheel`, …), `redirect_requirements_takeover_unreachable`, the rewrite's lock-level refusal (`redirect_yarn_berry_mixed_line_endings`, `redirect_bun_lock_unsupported`, a Gradle planner refusal, …) or `redirect_takeover_not_pinned`; that warning is reported in `warnings[]`, followed by `redirect_takeover_kept_vendored` naming the package. Exit 0: the package stays vendored and patched, never unpatched in both modes. The reverts, the hosted pins and the vendored ledger then reach the disk in one commit, and the reverted artifacts are deleted only after it: a refusal or write failure before the commit writes nothing, a failed commit puts back the files it replaced, and a commit interrupted after its journal was written is finished by the next command that takes the apply lock. `--dry-run` runs the same steps and drops the staged state instead of committing, so its `verified` events and warnings are the wet run's `applied` events and warnings. A hosted run with no takeover stages its writes the same way but commits them without the journal (it writes nothing under `.socket/`): a file that fails to be replaced puts back the ones already replaced, so a failed run leaves no lock half-redirected. Re-runs over already-rewritten output plan from the current lock text and are idempotent (exit 0, lock unchanged). **Lock (v5.0)**: the hosted engine acquires `<.socket>/apply.lock` before its first wet write (the staged takeover reverts) — not on `--dry-run`, and not when the run would write nothing (zero redirects, all skipped) — so previews and no-op runs never create `.socket/`; contention is `lock_held` and a lock-file I/O fault (a read-only project root, a file squatting on `.socket/`) is `lock_io` — both exit 1, refused BEFORE any project file is written, and rendered like every other lock holder: human `Error (<code>): <message>` on stderr (+ the `--lock-timeout` hint for a live holder); JSON prints the envelope with `status: "error"` and `error: {code: "lock_held" | "lock_io", message}` (no `redirect` payload: nothing was rewritten). **Takeover symlink pre-check (v5.0)**: a vendored→hosted takeover whose recorded wiring file is a symlink is refused up front with `redirect_symlinked_file_unsupported` — wet and `--dry-run` alike, before any revert — so "nothing was written" holds. **Human mode (v5.0)**: hosted `scan` prints the results table and update detection like the other modes, then rewrites without a prompt (scan never prompts); `--dry-run` previews through the engine, and a detail fetch that leaves nothing to redirect enters the engine as a no-op (`Redirected 0 packages; rewrote 0 files.`, no lock, no `.socket/`). The detail fetch prints the same progress counter and per-package `Warning: could not fetch details for …` lines as the agent arm. An EMPTY hosted discovery prints `No patches available for installed packages.` and exits 0 without entering the engine; a discovery whose every offer is paid-tier for an org without paid access prints the table's paid nudge, then `No downloadable patches (paid subscription required).`, and exits 0 without entering the engine (parity with the agent/vendored arms). Under `--json` (v5.0, MAJOR) the outcome is recorded into the scan envelope: one event per selected patch, sorted by purl, each with `details.mode: "hosted"` — `applied` for a confirmed pin (`verified` under `--dry-run`), `skipped` with the skip reason as `errorCode` (and its detail as `reason`), or `skipped` / `redirect_unconfirmed` for a patch that was granted but no lockfile entry pinning it could be rewritten (the human output's `Not hosted <purl>: …` line) — plus a `redirect: {mode: "hosted", rewrittenFiles}` payload (the files rewritten, or that would be). A `skipped` event does not change `status` or the exit code (the hosted exit policy is an open decision, #704). Rewriter warnings carry stable `redirect_*` codes (e.g. `redirect_npm_no_lockfile`, `redirect_gradle_manual_snippet`, `redirect_golang_unsupported`); new codes are additive (MINOR). v5.0 additive codes: `redirect_composer_no_lockfile` / `redirect_gem_no_gemfile` (composer / gem: neither manifest nor lock present — once per run, after the intake gates), `redirect_gem_bundle_gemfile_unsupported` (gem: `BUNDLE_GEMFILE` — `BUNDLE_GEMFILE:` in the bundler app config, which outranks the environment variable as in `Bundler::Settings`, else the environment variable — names a manifest other than the project's `Gemfile` / `gems.rb`, so no gem is redirected or attested; a value naming one of those two selects that pair even when the other spelling is present), `redirect_gem_bundle_lockfile_unsupported` (gem: bundler 4's custom lockfile — the `BUNDLE_LOCKFILE` environment variable, else `BUNDLE_LOCKFILE:` in the bundler app config, else in the global config — names a lock other than the loaded pair's own `Gemfile.lock` / `gems.locked`, so no gem is redirected or attested rather than pinning a lock bundler ignores), `redirect_gem_twin_manifest_ambiguous` (gem: a `Gemfile` + `gems.rb` twin under default discovery; bundler 1.x loads the `Gemfile` and bundler ≥ 2 loads `gems.rb`, and a lock's `BUNDLED WITH` records which bundler wrote it, not which one installs it, so neither pair is wired or attested — remove the unused spelling or set `BUNDLE_GEMFILE` to the one in use), `redirect_gem_mirror_overrides_source` (gem: Bundler's all-source, exact patch-source or patch-hostname mirror can route the per-dep `source` block to an unpatched upstream gem. Intake reads the app config (`BUNDLE_APP_CONFIG`, where a set-but-empty value selects `<root>/config`, honoring `BUNDLE_IGNORE_CONFIG`) and all `BUNDLE_MIRROR__...` variables visible to the scan; app config overrides the environment per encoded key, then `mirror.all` takes precedence over exact source, which takes precedence over hostname. URI matching follows Bundler's whole-URI case folding, default-port/trailing-slash normalization and single slash key alias, not URL prefixes. An exact-source fallback-timeout key without a mirror URL shadows the hostname mirror and fetches that source directly; a configured URL is conservatively refused even if a timeout could bypass an unreachable mirror at install time. Like `redirect_gem_bundle_gemfile_unsupported`, the gate leaves the Gemfile pair byte-identical and confirms no gem redirect. On an embedded `scan --vex`, rediscovered older hosted gem pins may attest only from verified installed bytes: a missing tree is not excused by the lockfile, and `--vex-no-verify` omits those hosted gems with `mirror_overrides_source` rather than trusting their intercepted source. Agent/vendored evidence, unrelated ecosystems and standalone VEX behavior are unchanged. Details identify the setting form and its app/environment origin without printing mirror values or source URLs, which may contain credentials. Remove the applicable all/source/hostname setting (including any slash alias) from that origin and reuse its existing mirror URL under `mirror.https://rubygems.org` to clear the refusal; an environment setting must be unset in the scan/install environment. User-global Bundler config and mirrors set only in a later install environment are not inspected; keep those mirrors scoped to the upstream source too), `redirect_maven_no_pom` (no `pom.xml` and no Gradle build), `redirect_nuget_lock_unparseable` (a present-but-corrupt `packages.lock.json` — warned once, nothing mutated; an absent lock still proceeds; a leading UTF-8 BOM, which dotnet reads past, is not corrupt and is kept on rewrite), `redirect_nuget_lock_other_version` (the lock also resolves the patched id at another version in some target framework: the exact-id `packageSourceMapping` would route that framework to a feed that serves only the patched version, so the dep is skipped with nothing written; only lock entries at the patched version are ever re-pinned, and `resolved` is never rewritten), `redirect_nuget_mapping_set_aside` (v5.0 #462: another source's `packageSourceMapping` also named the patched id exactly — Visual Studio's mapping UI writes such lists — which ties with the Socket source so NuGet would take the package from whichever feed answers first; that pattern, or its whole `<packageSource>` when it was the only one, is commented out in a `<!-- socket-patch-<uuid> moved: … -->` comment while the patch is wired, and `remove` / `rollback` put it back byte-exact), `redirect_nuget_mapping_conflict` (such a pattern sits in markup that cannot go in a comment; the dep is skipped, nothing written). v5.0 #354: when the rewriter creates the `packageSourceMapping`, its `*` catch-all also names the sources NuGet merges in from the user config and every parent directory's config (honoring `<clear />`), since NuGet drops every source no pattern names; a fresh config only seeds `nuget.org` when those inherited configs have it (a parent that cleared it for a mirror keeps that choice); when an inherited config already has a `packageSourceMapping` (NuGet merges those too), no catch-all is written at all — only the Socket pattern — so a source the parent restricts is never widened; the exclusivity set-aside exempts only the source the run wires, so a `socket-patch-*` lookalike key or a stale uuid naming the id is set aside too, `redirect_cargo_lock_pkg_ambiguous` (several same-name+version `[[package]]` blocks and none carries the index `source` — transactional skip), `redirect_cargo_dep_overridden` (the crate does not resolve to crates.io because the user overrides it — its one `Cargo.lock` block carries a git / other-registry `source`, as a `[patch]` git or registry override in the root manifest or any cargo config leaves it, or has no `source` while the root `Cargo.toml` / project `.cargo/config*` holds a `[patch]` path entry for it; with no `Cargo.lock`, the same `[patch.crates-io]` / `[patch."https://github.com/rust-lang/crates.io-index"]` entry for the crate, by key or `package = "…"`, in the root `Cargo.toml` or the project `.cargo/config*` — transactional skip, nothing rewritten: a Socket pin would silently replace the user's fork and the then-unused `[patch]` entry breaks `cargo --locked`). Also additive: `redirect_cargo_directory_source` (#455: a cargo config replaces crates.io with an on-disk source through its `[source.crates-io] replace-with` chain — a directory source, as a `cargo vendor` project has, or a `cargo local-registry` — so the project builds every crates.io crate offline from it and a Socket registry pin would break `cargo build --frozen --offline`. The configs read are the ones cargo reads for a build in the scanned directory: the project's own `.cargo/config*`, every parent directory's (a monorepo root) and `$CARGO_HOME`'s. Every cargo dependency is skipped with nothing written, one warning each naming the crate and the config that set the replacement, and the detail points at agent mode, which patches the copy cargo builds in place. A replacement with a registry mirror is not an offline source and is still redirected). Also additive: `redirect_gem_version_not_locked` (gem: no `GEM` section of the lock lists the crawled `name (version)`, for example a version another project installed into the shared gem home; the gem is skipped with nothing written, so the user's declared constraint and the locked version are never overwritten), `redirect_gem_no_lockfile` (gem: the project has a `Gemfile` / `gems.rb` but no `Gemfile.lock` / `gems.locked`, so nothing records which version it resolves and the crawled version may be another project's copy in the shared gem home; the gem is skipped with nothing written, never pinned over the user's constraint or appended as a new dependency, and the detail asks for `bundle lock` (or `bundle install`) and a re-run). Also v5.0: a registry override of the wrong kind (or none at all) warns the arm's missing-override code for nuget/gem/golang. Refusals stay fail-closed with a diagnosis that names the actual cause: a yarn-berry lock entry resolving through a non-`npm:` protocol keeps `redirect_yarn_berry_unsupported_protocol` with the entry's ACTUAL protocol in the detail — except socket-patch's OWN vendored wiring (a `file:` range into `.socket/vendor/`), which gets the distinct `redirect_yarn_berry_vendored_entry` code whose detail names the retirement path (`remove <purl>` per package, or `vendor --revert` which unwinds every vendored package, then re-run `scan --mode hosted`). Both leave the entry byte-identical; neither changes exit code or status. **yarn berry line endings (v5.0)**: yarn writes a NEW `yarn.lock` with the OS line ending (`os.EOL` — CRLF on Windows) and keeps an existing lock's majority ending on every later write, and a `core.autocrlf` checkout turns an LF lock CRLF on any OS — so a uniformly CRLF lock is rewritten in its own ending: every untouched byte (a leading BOM included) round-trips (and `rollback`'s upstream restore keeps the lock's own ending). A lock that MIXES CRLF and LF (or holds a bare CR) has no single ending to keep — yarn's own `--immutable` check rejects it too (YN0028) — so it is refused untouched with `redirect_yarn_berry_mixed_line_endings` (the detail names `yarn install`, which normalizes it). The root `package.json`, which the rewrite re-renders to add `resolutions`, gets the same gate: a mixed one is refused untouched with the same code — the decision vendored mode takes with `vendor_yarn_berry_mixed_line_endings`, from the same shared berry gate set. This replaces v4's `redirect_yarn_berry_crlf_unsupported`, which refused every CRLF lock and is no longer emitted. A vendored→hosted takeover of a yarn-berry entry is checked against these project gates (mixed `yarn.lock` / `package.json` line endings, unsupported `cacheKey`, a non-zero `.yarnrc.yml` `compressionLevel`) on the project as it is before any revert, because the revert re-renders `package.json` in its majority ending — wet and `--dry-run` alike. A refused purl keeps its vendored wiring, ledger entry and artifact byte-identical, is skipped with the gate's code (reported in `warnings[]`, followed by `redirect_takeover_kept_vendored`) and is never announced as `redirect_takeover_reverted_vendored`.
+`scan --mode hosted` swaps the in-place apply for the registry-redirect pipeline: discover → resolve hosted-patch references (grant token + integrity + per-dep registry override) → rewrite ONLY the patched dependencies' lockfile / registry-config entries to point at the hosted packages. A dep counts as **redirected** only when its hosted-artifact URL (or per-dep registry index URL) actually landed in a project file — a granted reference whose rewriter found nothing to edit is neither counted nor attested. **No ledger (v5.0)**: hosted mode writes ONLY the lockfile / registry-config edits — `.socket/vendor/redirect-state.json` is never written (on success or failure), and a pre-v5 one on disk is ignored (never read for planning, never quarantined, left byte-identical). The lockfiles are the only record of a hosted patch: `list`, `vex`, `rollback`, `remove`, `vendor` and `repair` all discover the hosted pins from them (a hosted URL counts only on `https://patch.socket.dev` or the `--patch-server-url` / `SOCKET_PATCH_SERVER_URL` origin), and commit-ready output is just the lockfile / config changes. Cargo and golang are confirmed only by their rewriter's own report (`confirmed_cargo_uuids` / `confirmed_golang_uuids`): a golang dep counts only when its go.mod `replace M V => patch.socket.dev/gopatch/<uuid> <sver>` and both go.sum lines are in place (a re-run restores the zip line `go mod tidy` drops while no package of the module is loaded, so a later import still builds), never because the patch-server origin or leftover go.sum lines appear somewhere. Gradle is confirmed the same way (`confirmed_gradle_uuids`): only when the final files hold the owned script, the index row, the live apply line in every build's settings file and the suffixed version in every lock entry of the GA (see [Gradle builds](#gradle-builds-v50)). A golang module that go.mod does not require and go.sum has no zip (`h1:` of the module tree) line for at the patched version is outside the build graph and is refused with `redirect_golang_not_in_module_graph` (nothing written); a `/go.mod`-only line doesn't count, since go writes one for every version MVS reads (#509). In a go < 1.17 graph, where `require` holds only lower bounds, the build selects the highest of the required version and go.sum's zip-line versions, and a patch for a lower version warns `redirect_golang_version_mismatch` (nothing written). Only the exact module `patch.socket.dev/gopatch/<canonical uuid>` is socket-owned; any other module path is refused with `redirect_golang_untrusted_module_path`. A vendored golang module is taken over like cargo and the npm family: its vendor wiring, committed copy and ledger entry are reverted first (`redirect_takeover_reverted_vendored`). A vendored PyPI package (requirements.txt, Poetry, Pipenv, uv, Hatch, PDM, pylock) is taken over the same way: its vendored wiring is restored to the recorded registry entry, its ledger entry and wheel are removed, and it is redirected in the same commit. The Python rewriters treat any non-registry source as user-authored, so without the revert they refused socket-patch's own vendored source and left the project vendored. A vendored Composer package is taken over the same way: its `composer.lock` entry is restored to the recorded pre-vendor entry, its ledger entry and committed copy are removed, and it is redirected in the same commit, so the lock matches a direct hosted scan and `rollback` can restore it from packagist. Without the revert the rewriter edited the vendored entry in place and kept its patch-uuid `dist.reference`, which `rollback` refused. A vendored Composer entry the takeover cannot revert (its vendored ledger entry is missing) is left vendored with `redirect_composer_vendored_entry`, never repointed in place. A takeover revert that leaves vendored wiring in place is refused with `redirect_vendored_revert_failed`. That covers a drift-skipped record (`vendor_lock_entry_drifted`) and a reverted file that still references the artifact (`vendor_revert_residual_reference`). The ledger entry and artifact are kept, and the package stays vendored and skipped. `--dry-run` predicts the same refusal from the same signals instead of previewing `redirect_would_revert_vendored`. The hosted requirements.txt rewriter only rewrites an existing pin in the root `requirements.txt`, so a vendored requirements.txt package whose wiring is a pin in a `-r` include or a `(transitive)` line vendored mode appended is kept vendored, wet and `--dry-run` alike, with `redirect_requirements_takeover_unreachable` (a top-level `warnings[]` entry, and the `errorCode` of the package's `skipped` event). Its wiring, ledger entry and wheel are kept, so it stays vendored and patched (exit 0). The uv and Poetry rewriters are covered the same way: a vendored uv package whose recorded pre-vendor `uv.lock` entry is at another version than the patch (vendored uv pins the entry down to the patch's version; the revert brings the lock's own version back, and hosted mode only pins the version the lock resolves) is kept vendored with `redirect_uv_takeover_version_unreachable`, and a vendored Poetry package on a Poetry 0.x lock (which hosted mode refuses outright) is kept vendored with `redirect_poetry_lock_unsupported`. **Staged takeover (v5.0)**: the takeover is atomic. Each purl's vendored revert is staged in memory (the run's group commit, the same journaled commit vendored mode uses), the hosted rewrite plans against the reverted project, and a staged purl the rewrite does not pin is retracted: every staged revert is undone, that purl keeps its vendored wiring, ledger entry and artifact byte-identical, and the rest are staged and rewritten again. A retracted purl is a `skipped` event whose `errorCode` is the cause: its existing skip reason (unavailable wheel metadata, …), the rewriter warning that names the package (`redirect_yarn_berry_missing_checksum`, `redirect_pypi_platform_wheel`, …), `redirect_requirements_takeover_unreachable`, the rewrite's lock-level refusal (`redirect_yarn_berry_mixed_line_endings`, `redirect_bun_lock_unsupported`, a Gradle planner refusal, …) or `redirect_takeover_not_pinned`; that warning is reported in `warnings[]`, followed by `redirect_takeover_kept_vendored` naming the package. Exit 0: the package stays vendored and patched, never unpatched in both modes. The reverts, the hosted pins and the vendored ledger then reach the disk in one commit, and the reverted artifacts are deleted only after it: a refusal or write failure before the commit writes nothing, a failed commit puts back the files it replaced, and a commit interrupted after its journal was written is finished by the next command that takes the apply lock. `--dry-run` runs the same steps and drops the staged state instead of committing, so its `verified` events and warnings are the wet run's `applied` events and warnings. A hosted run with no takeover stages its writes the same way but commits them without the journal (it writes nothing under `.socket/`): a file that fails to be replaced puts back the ones already replaced, so a failed run leaves no lock half-redirected. Re-runs over already-rewritten output plan from the current lock text and are idempotent (exit 0, lock unchanged). **Lock (v5.0)**: the hosted engine acquires `<.socket>/apply.lock` before its first wet write (the staged takeover reverts) — not on `--dry-run`, and not when the run would write nothing (zero redirects, all skipped) — so previews and no-op runs never create `.socket/`; contention is `lock_held` and a lock-file I/O fault (a read-only project root, a file squatting on `.socket/`) is `lock_io` — both exit 1, refused BEFORE any project file is written, and rendered like every other lock holder: human `Error (<code>): <message>` on stderr (+ the `--lock-timeout` hint for a live holder); JSON prints the envelope with `status: "error"` and `error: {code: "lock_held" | "lock_io", message}` (no `redirect` payload: nothing was rewritten). **Takeover symlink pre-check (v5.0)**: a vendored→hosted takeover whose recorded wiring file is a symlink is refused up front with `redirect_symlinked_file_unsupported` — wet and `--dry-run` alike, before any revert — so "nothing was written" holds. **Human mode (v5.0)**: hosted `scan` prints the results table and update detection like the other modes, then rewrites without a prompt (scan never prompts); `--dry-run` previews through the engine, and a detail fetch that leaves nothing to redirect enters the engine as a no-op (`Redirected 0 packages; rewrote 0 files.`, no lock, no `.socket/`). The detail fetch prints the same progress counter and per-package `Warning: could not fetch details for …` lines as the agent arm. An EMPTY hosted discovery prints `No patches available for installed packages.` and exits 0 without entering the engine; a discovery whose every offer is paid-tier for an org without paid access prints the table's paid nudge, then `No downloadable patches (paid subscription required).`, and exits 0 without entering the engine (parity with the agent/vendored arms). Under `--json` (v5.0, MAJOR) the outcome is recorded into the scan envelope: one event per selected patch, sorted by purl, each with `details.mode: "hosted"` — `applied` for a confirmed pin (`verified` under `--dry-run`), `skipped` with the skip reason as `errorCode` (and its detail as `reason`), or `skipped` / `redirect_unconfirmed` for a patch that was granted but no lockfile entry pinning it could be rewritten (the human output's `Not hosted <purl>: …` line) — plus a `redirect: {mode: "hosted", rewrittenFiles}` payload (the files rewritten, or that would be). A `skipped` event does not change `status` or the exit code (the hosted exit policy is an open decision, #704). Rewriter warnings carry stable `redirect_*` codes (e.g. `redirect_npm_no_lockfile`, `redirect_gradle_manual_snippet`, `redirect_golang_unsupported`); new codes are additive (MINOR). v5.0 additive codes: `redirect_composer_no_lockfile` / `redirect_gem_no_gemfile` (composer / gem: neither manifest nor lock present — once per run, after the intake gates), `redirect_gem_bundle_gemfile_unsupported` (gem: `BUNDLE_GEMFILE` — `BUNDLE_GEMFILE:` in the bundler app config, which outranks the environment variable as in `Bundler::Settings`, else the environment variable — names a manifest other than the project's `Gemfile` / `gems.rb`, so no gem is redirected or attested; a value naming one of those two selects that pair even when the other spelling is present), `redirect_gem_bundle_lockfile_unsupported` (gem: bundler 4's custom lockfile — the `BUNDLE_LOCKFILE` environment variable, else `BUNDLE_LOCKFILE:` in the bundler app config, else in the global config — names a lock other than the loaded pair's own `Gemfile.lock` / `gems.locked`, so no gem is redirected or attested rather than pinning a lock bundler ignores), `redirect_gem_twin_manifest_ambiguous` (gem: a `Gemfile` + `gems.rb` twin under default discovery; bundler 1.x loads the `Gemfile` and bundler ≥ 2 loads `gems.rb`, and a lock's `BUNDLED WITH` records which bundler wrote it, not which one installs it, so neither pair is wired or attested — remove the unused spelling or set `BUNDLE_GEMFILE` to the one in use), `redirect_gem_mirror_overrides_source` (gem: Bundler's all-source, exact patch-source or patch-hostname mirror can route the per-dep `source` block to an unpatched upstream gem. Intake reads the app config (`BUNDLE_APP_CONFIG`, where a set-but-empty value selects `<root>/config`, honoring `BUNDLE_IGNORE_CONFIG`) and all `BUNDLE_MIRROR__...` variables visible to the scan; app config overrides the environment per encoded key, then `mirror.all` takes precedence over exact source, which takes precedence over hostname. URI matching follows Bundler's whole-URI case folding, default-port/trailing-slash normalization and single slash key alias, not URL prefixes. An exact-source fallback-timeout key without a mirror URL shadows the hostname mirror and fetches that source directly; a configured URL is conservatively refused even if a timeout could bypass an unreachable mirror at install time. Like `redirect_gem_bundle_gemfile_unsupported`, the gate leaves the Gemfile pair byte-identical and confirms no gem redirect. On an embedded `scan --vex`, rediscovered older hosted gem pins may attest only from verified installed bytes: a missing tree is not excused by the lockfile, and `--vex-no-verify` omits those hosted gems with `mirror_overrides_source` rather than trusting their intercepted source. Agent/vendored evidence, unrelated ecosystems and standalone VEX behavior are unchanged. Details identify the setting form and its app/environment origin without printing mirror values or source URLs, which may contain credentials. Remove the applicable all/source/hostname setting (including any slash alias) from that origin and reuse its existing mirror URL under `mirror.https://rubygems.org` to clear the refusal; an environment setting must be unset in the scan/install environment. User-global Bundler config and mirrors set only in a later install environment are not inspected; keep those mirrors scoped to the upstream source too), `redirect_maven_no_pom` (no `pom.xml` and no Gradle build), `redirect_nuget_lock_unparseable` (a present-but-corrupt `packages.lock.json` — warned once, nothing mutated; an absent lock still proceeds; a leading UTF-8 BOM, which dotnet reads past, is not corrupt and is kept on rewrite), `redirect_nuget_lock_other_version` (the lock also resolves the patched id at another version in some target framework: the exact-id `packageSourceMapping` would route that framework to a feed that serves only the patched version, so the dep is skipped with nothing written; only lock entries at the patched version are ever re-pinned, and `resolved` is never rewritten), `redirect_nuget_mapping_set_aside` (v5.0 #462: another source's `packageSourceMapping` also named the patched id exactly — Visual Studio's mapping UI writes such lists — which ties with the Socket source so NuGet would take the package from whichever feed answers first; that pattern, or its whole `<packageSource>` when it was the only one, is commented out in a `<!-- socket-patch-<uuid> moved: … -->` comment while the patch is wired, and `remove` / `rollback` put it back byte-exact), `redirect_nuget_mapping_conflict` (such a pattern sits in markup that cannot go in a comment; the dep is skipped, nothing written). v5.0 #354: when the rewriter creates the `packageSourceMapping`, its `*` catch-all also names the sources NuGet merges in from the user config and every parent directory's config (honoring `<clear />`), since NuGet drops every source no pattern names; a fresh config only seeds `nuget.org` when those inherited configs have it (a parent that cleared it for a mirror keeps that choice); when an inherited config already has a `packageSourceMapping` (NuGet merges those too), no catch-all is written at all — only the Socket pattern — so a source the parent restricts is never widened; the exclusivity set-aside exempts only the source the run wires, so a `socket-patch-*` lookalike key or a stale uuid naming the id is set aside too, `redirect_cargo_lock_pkg_ambiguous` (several same-name+version `[[package]]` blocks and none carries the index `source` — transactional skip), `redirect_cargo_dep_overridden` (the crate does not resolve to crates.io because the user overrides it — its one `Cargo.lock` block carries a git / other-registry `source`, as a `[patch]` git or registry override in the root manifest or any cargo config leaves it, or has no `source` while the root `Cargo.toml` / project `.cargo/config*` holds a `[patch]` path entry for it; with no `Cargo.lock`, the same `[patch.crates-io]` / `[patch."https://github.com/rust-lang/crates.io-index"]` entry for the crate, by key or `package = "…"`, in the root `Cargo.toml` or the project `.cargo/config*` — transactional skip, nothing rewritten: a Socket pin would silently replace the user's fork and the then-unused `[patch]` entry breaks `cargo --locked`). Also additive: `redirect_cargo_directory_source` (#455: a cargo config replaces crates.io with an on-disk source through its `[source.crates-io] replace-with` chain — a directory source, as a `cargo vendor` project has, or a `cargo local-registry` — so the project builds every crates.io crate offline from it and a Socket registry pin would break `cargo build --frozen --offline`. The configs read are the ones cargo reads for a build in the scanned directory: the project's own `.cargo/config*`, every parent directory's (a monorepo root) and `$CARGO_HOME`'s. Every cargo dependency is skipped with nothing written, one warning each naming the crate and the config that set the replacement, and the detail points at agent mode, which patches the copy cargo builds in place. A replacement with a registry mirror is not an offline source and is still redirected). Also additive: `redirect_gem_version_not_locked` (gem: no `GEM` section of the lock lists the crawled `name (version)`, for example a version another project installed into the shared gem home; the gem is skipped with nothing written, so the user's declared constraint and the locked version are never overwritten), `redirect_gem_no_lockfile` (gem: the project has a `Gemfile` / `gems.rb` but no `Gemfile.lock` / `gems.locked`, so nothing records which version it resolves and the crawled version may be another project's copy in the shared gem home; the gem is skipped with nothing written, never pinned over the user's constraint or appended as a new dependency, and the detail asks for `bundle lock` (or `bundle install`) and a re-run). Also v5.0: a registry override of the wrong kind (or none at all) warns the arm's missing-override code for nuget/gem/golang. Refusals stay fail-closed with a diagnosis that names the actual cause: a yarn-berry lock entry resolving through a non-`npm:` protocol keeps `redirect_yarn_berry_unsupported_protocol` with the entry's ACTUAL protocol in the detail — except socket-patch's OWN vendored wiring (a `file:` range into `.socket/vendor/`), which gets the distinct `redirect_yarn_berry_vendored_entry` code whose detail names the retirement path (`remove <purl>` per package, or `vendor --revert` which unwinds every vendored package, then re-run `scan --mode hosted`). Both leave the entry byte-identical; neither changes exit code or status. **yarn berry line endings (v5.0)**: yarn writes a NEW `yarn.lock` with the OS line ending (`os.EOL` — CRLF on Windows) and keeps an existing lock's majority ending on every later write, and a `core.autocrlf` checkout turns an LF lock CRLF on any OS — so a uniformly CRLF lock is rewritten in its own ending: every untouched byte (a leading BOM included) round-trips (and `rollback`'s upstream restore keeps the lock's own ending). A lock that MIXES CRLF and LF (or holds a bare CR) has no single ending to keep — yarn's own `--immutable` check rejects it too (YN0028) — so it is refused untouched with `redirect_yarn_berry_mixed_line_endings` (the detail names `yarn install`, which normalizes it). The root `package.json`, which the rewrite re-renders to add `resolutions`, gets the same gate: a mixed one is refused untouched with the same code — the decision vendored mode takes with `vendor_yarn_berry_mixed_line_endings`, from the same shared berry gate set. This replaces v4's `redirect_yarn_berry_crlf_unsupported`, which refused every CRLF lock and is no longer emitted. A vendored→hosted takeover of a yarn-berry entry is checked against these project gates (mixed `yarn.lock` / `package.json` line endings, unsupported `cacheKey`, a non-zero `.yarnrc.yml` `compressionLevel`) on the project as it is before any revert, because the revert re-renders `package.json` in its majority ending — wet and `--dry-run` alike. A refused purl keeps its vendored wiring, ledger entry and artifact byte-identical, is skipped with the gate's code (reported in `warnings[]`, followed by `redirect_takeover_kept_vendored`) and is never announced as `redirect_takeover_reverted_vendored`.
 
 **Attribution gate (v5.0).** A hosted run never leaves wiring that lockfile discovery calls contested: before the rewrite writes any lockfile, the same discovery `vex`, `list`, `rollback`, `remove` and `vendor` read runs over the project as the rewrite would leave it. A candidate whose pin discovery reads but cannot attribute to one package version (a requirements `-r` include resolving the same version from the registry beside a rewired `Pipfile.lock`, #567; a Maven pin in a `<profile>`, #260) is left out of the rewrite and reported as a `skipped` event with `errorCode` `redirect_unattributable` (nothing written for it; exit code unchanged). Unchanged: a pin in a file discovery does not read (a pre-2.6 bundler `Gemfile`, locked by the next `bundle install`) keeps the rewriter's verdict, and so does a deliberate partial redirect the run already reports (a bundled or `bun patch`-ed copy left on the registry, a yarn `npm:` alias entry left on the registry with `redirect_yarn_classic_alias_skipped` / `redirect_yarn_berry_alias_skipped` while the package's direct entry is pinned, a dep withheld from the vlt rewrite while a sibling lock takes it), and so does a vendored→hosted takeover: its vendored wiring is reverted in the run's staged overlay before the rewrite plans, and it is redirected when the rewriters pin it (otherwise it is retracted and stays vendored), in a `--dry-run` preview the same. A pin whose own pnpm or yarn lock also installs an unpatched copy of the same `name@version` (a pnpm `file:` directory or tarball dependency; a yarn `file:` / URL / berry `portal:` / `link:` dependency declared under another name) is written too, with a `redirect_copy_unpatched` warning naming that entry, and is not attested. A lockless NuGet / Cargo pin (an exclusive Socket source mapping without `packages.lock.json`, a Cargo registry pin without `Cargo.lock`) is still written, with a `redirect_pin_lockless` warning: no lockfile records its version, so `vex` cannot attest it and `rollback` / `remove` / `vendor` refuse it until the lockfile exists (whether such pins should be written at all is an open decision). The rollout's recorded view uses the same discovery: a uuid a file merely mentions (a stale `package.json` field, an inactive `pdm.lock`, a comment) is not a pin and does not count as already patched.
 
@@ -531,7 +531,7 @@ Discovery is read-only, never touches the network, and never fails the run: a ma
 | bun | `bun.lock`; `bun.lockb` only when there is no `bun.lock` (bun reads exactly one) | URL tuple / binary remote-tarball resolution; version from the URL leaf. A user URL or `file:` tarball tuple / record whose `<name>-<ver>.tgz` leaf names the same `name@version` is installed from its own spec, so every ref for that `name@version` is dropped | `.socket/vendor/npm/<uuid>/<name>-<ver>.tgz` tuple / local-tarball resolution | `sha512-…`, required. A 2-tuple that Bun < 1.3.10 re-saved without its digest is still a reference, but it attests only from an installed tree. |
 | vlt | `vlt-lock.json` (lockfileVersion absent, `0` or `1`; a BOM-prefixed, unparseable, non-object or other-version lock is not read: diagnosed, no ref). `vlt.json` (read only for its `modifiers`) and `node_modules/.vlt-lock.json` are never wiring. | a registry node (any segment) whose slot [3] is a `/patch/npm/…` URL on the patch host with the leaf `<bare>-<ver>.tgz` of its DepID's `name@version`, whose embedded `<name>/<ver>` path (when present) is that `name@version`, and slot [1] == name; version from the DepID | a `file` node `.socket/vendor/npm/<uuid>/<name>-<ver>/node_modules/<name>` (or a user-installed `<name>-<ver>.tgz`) with slot [1] == name; version from the path. A same-`name@version` registry node, or a diagnosed Socket-shaped one, beside it is diagnosed, no ref. | slot [2] `sha512-…`, required (a hosted node without one is no reference). A same-`name@version` node on another registry, or a diagnosed Socket-shaped one, keeps the reference but withholds the lockfile basis: only an installed tree whose every store copy verifies attests. So does a lock some vlt release discards, the conditions of `redirect_vlt_lockfile_version_missing`, `redirect_vlt_old_lockfile_ignored` and `redirect_vlt_scalar_registry_ignored` (which in-run `--vex` withholds too): every hosted reference in it keeps no pin, and one `patched_ref_unattributable` names them. |
 | cargo | `Cargo.lock`, `Cargo.toml`, `.cargo/config` (else `.cargo/config.toml`) | `Cargo.lock` `source = "sparse+…/<uuid>/index/"`, confirmed by `Cargo.toml`: a crate the root manifest declares must pin `registry = "socket-patch-<uuid>"`. A reverted pin is diagnosed, no ref. Another `[[package]]` of the same `name@version` from a non-Socket source (crates.io, git), which cargo locks beside the pin for a dependent added later and builds unpatched (#679), withholds the ref (`patched_ref_unattributable`, never attested) while `rollback` / `remove` still unwind it. | `[patch.<source>] <key> = { path = ".socket/vendor/cargo/<uuid>/<name>-<ver>" }` — primarily the root `Cargo.toml` (v5 `vendor`; key-agnostic: `<name>` is `package` when renamed, else the key, so `<name>-socket-<uuid8>` keys count), also the project config (pre-v5 wiring), live only while the lock holds a sourceless entry for it that is not in `[[patch.unused]]`; a manifest entry cargo ignores — the project config redefines its key with another path, or a `[patch."https://github.com/rust-lang/crates.io-index"]` table replaces `[patch.crates-io]` — is diagnosed (`patched_ref_invalid`), no ref | `checksum` (v1: `[metadata]`), required |
-| golang | `go.mod`, `go.work`, `go.sum`, `go.work.sum` | `replace M v => patch.socket.dev/gopatch/<uuid> <sver>` | `replace M v => ./.socket/vendor/golang/<uuid>/M@v` | both go.sum lines, required. A replace that `require` no longer selects (`require M v'`) is inert: diagnosed, no ref. |
+| golang | `go.mod`, `go.work`, `go.sum`, `go.work.sum` | `replace M v => patch.socket.dev/gopatch/<uuid> <sver>` | `replace M v => ./.socket/vendor/golang/<uuid>/M@v` | the socket module's `/go.mod` go.sum line, required. The zip line (`h1:` of the module tree) is the locked integrity when present; `go mod tidy` prunes it when no package of the module is loaded and the build stays green, so the `/go.mod` line alone still attests from the lockfile, unless the main modules' `require`s or go.sum show the build selects another version (MVS keeps the `/go.mod` line of versions it only reads): then the replace is inert. With a `go.work` a `/go.mod`-only pin never attests from the lockfile: go builds a workspace without keeping any member's `go.mod` tidy and writes missing sums to `go.work.sum` itself, so a member's dependency can select a higher version that no file shows (the replace then needs a verifying installed copy). A higher version in an in-root `use` member's `require` or in a zip line of a member's `go.sum` makes such a replace inert; `go.work.sum` zip lines do not, since go never drops a line from it once the requirement that raised the module is gone. The sum files are the ones go reads: the root `go.sum`, or with a `go.work`, `go.work.sum` and each in-root `use` member's `go.sum` (the root's only when `.` is a member); under `GOWORK=off`, `go.work` and its replaces are ignored. A conflicting hash or a malformed `h1:` for the socket module+version, or a line of other than three tokens anywhere in a sum file, is no pin. A replace that `require` no longer selects (`require M v'`) is inert: diagnosed, no ref. |
 | pypi | `uv.lock` (confirmed by `pyproject.toml` `[tool.uv.sources]` when present), PEP 723 `<script>.py.lock`, `pylock.toml` / `pylock.<name>.toml`, `poetry.lock`, `pdm.lock`, `Pipfile.lock`, `requirements.txt` + its in-root `-r` includes, PEP 508 direct references in `pyproject.toml` / `hatch.toml` | Socket-host artifact url | `.socket/vendor/pypi/<uuid>/<wheel>` naming the entry's own dist | sha256, required |
 | gem | `Gemfile.lock` and `gems.locked` (the `Gemfile` / `gems.rb` only to cross-check a merged multi-remote `GEM` section) | a `GEM` section whose remote ends `patch-registry/gem/<token>/<uuid>` | `PATH` remote `.socket/vendor/gem/<uuid>/<name>-<ver>` | `CHECKSUMS` sha256, required only when the lock has a `CHECKSUMS` section (bundler ≥ 2.6) |
 | composer | `composer.lock` (`packages` + `packages-dev`) | `dist.url` on the patch host | `dist: {type: "path", url: ".socket/vendor/composer/<uuid>/…", reference: "<uuid>"}` | `dist.shasum`, required |
diff --git a/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs b/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs
index 4d4273eaa..15df680c8 100644
--- a/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs
@@ -757,3 +757,402 @@ async fn golang_get_uuid_hosted_day2_machine_builds() {
             .unwrap_or_else(|e| std::panic::resume_unwind(e))
     });
 }
+
+/// A go 1.16 graph where the patched module is only a transitive
+/// requirement and nothing imports its packages: `go mod tidy` prunes the
+/// socket module's zip line from the committed pair, the build stays green
+/// on a fresh machine (the zip is never fetched), and discovery still reads
+/// the `/go.mod` line as the hosted pin. Once the project imports the
+/// module that state no longer builds, and re-running the hosted rewrite
+/// restores the zip line so it builds the patched module again.
+// #[serial]: see the capstone's note — env mutation vs env iteration.
+#[tokio::test]
+#[serial_test::serial]
+async fn tidy_pruned_zip_line_pins_and_a_rerun_restores_it() {
+    if !golang_e2e_matrix::toolchain_ready("e2e_golang_hosted_build") {
+        return;
+    }
+    const MID: &str = "example.com/mid";
+    let tmp = tempfile::tempdir().unwrap();
+    let _cleanup = ChmodGuard(tmp.path().to_path_buf());
+    let proxy_url = format!("file://{}", tmp.path().join("proxy").display());
+    let smod = socket_module();
+    let upstream_gomod = format!("module {UMOD}\n\ngo 1.16\n");
+    publish(tmp.path(), UMOD, UVER, &upstream_gomod, PRISTINE_LIB);
+    publish(tmp.path(), &smod, SVER, &upstream_gomod, PATCHED_LIB);
+    publish(
+        tmp.path(),
+        MID,
+        "v1.0.0",
+        &format!("module {MID}\n\ngo 1.16\n\nrequire {UMOD} {UVER}\n"),
+        "package mid\n\nfunc Hello() string { return \"hi\" }\n",
+    );
+    let (zip_h1, gomod_h1) = harvest_sums(tmp.path(), &proxy_url, &smod, SVER);
+    let (mid_zip_h1, mid_gomod_h1) = harvest_sums(tmp.path(), &proxy_url, MID, "v1.0.0");
+
+    // The hosted rewriter's committed shape: the replace plus BOTH lines.
+    let consumer = tmp.path().join("consumer");
+    std::fs::create_dir_all(&consumer).unwrap();
+    std::fs::write(
+        consumer.join("go.mod"),
+        format!(
+            "module example.com/consumer\n\ngo 1.16\n\nrequire {MID} v1.0.0\n\n\
+             replace {UMOD} {UVER} => {smod} {SVER}\n"
+        ),
+    )
+    .unwrap();
+    std::fs::write(
+        consumer.join("go.sum"),
+        format!(
+            "{MID} v1.0.0 {mid_zip_h1}\n{MID} v1.0.0/go.mod {mid_gomod_h1}\n\
+             {smod} {SVER} {zip_h1}\n{smod} {SVER}/go.mod {gomod_h1}\n"
+        ),
+    )
+    .unwrap();
+    std::fs::write(
+        consumer.join("main.go"),
+        format!("package main\n\nimport \"{MID}\"\n\nfunc main() {{ println(mid.Hello()) }}\n"),
+    )
+    .unwrap();
+
+    let env = day2_env(&proxy_url);
+    let m1 = Machine::new(tmp.path(), "machine1");
+    let tidy = go(&consumer, &m1, &["mod", "tidy"], &as_pairs(&env));
+    assert!(
+        tidy.status.success(),
+        "go mod tidy failed: {}",
+        String::from_utf8_lossy(&tidy.stderr)
+    );
+    let go_sum = std::fs::read_to_string(consumer.join("go.sum")).unwrap();
+    assert!(
+        go_sum.contains(&format!("{smod} {SVER}/go.mod {gomod_h1}\n")),
+        "{go_sum}"
+    );
+    assert!(
+        !go_sum.contains(&format!("{smod} {SVER} ")),
+        "tidy must prune the zip line: {go_sum}"
+    );
+
+    let m2 = Machine::new(tmp.path(), "machine2");
+    let build = go(&consumer, &m2, &["build", "./..."], &as_pairs(&env));
+    assert!(
+        build.status.success(),
+        "fresh-machine build after tidy failed: {}",
+        String::from_utf8_lossy(&build.stderr)
+    );
+
+    let discovery = socket_patch_core::vex::discover::discover_patched_refs(&consumer).await;
+    let purl = format!("pkg:golang/{UMOD}@{UVER}");
+    let refs: Vec<_> = discovery.refs.iter().filter(|r| r.purl == purl).collect();
+    assert_eq!(refs.len(), 1, "{:?}", discovery.refs);
+    assert_eq!(refs[0].uuid, UUID);
+    assert!(refs[0].lockfile_basis_ok(), "{:?}", refs[0]);
+    assert!(
+        discovery.diagnostics.is_empty(),
+        "{:?}",
+        discovery.diagnostics
+    );
+
+    // The project starts importing the patched module (and requires it, as
+    // go 1.16 wants for a directly imported module): the tidy state no
+    // longer builds.
+    let go_mod = std::fs::read_to_string(consumer.join("go.mod")).unwrap();
+    std::fs::write(
+        consumer.join("go.mod"),
+        format!("{go_mod}\nrequire {UMOD} {UVER}\n"),
+    )
+    .unwrap();
+    std::fs::write(
+        consumer.join("main.go"),
+        format!(
+            "package main\n\nimport (\n\t\"{MID}\"\n\t\"{UMOD}\"\n)\n\n\
+             func main() {{ println(mid.Hello(), upstream.Greeting()) }}\n"
+        ),
+    )
+    .unwrap();
+    let m3 = Machine::new(tmp.path(), "machine3");
+    let broken = go(&consumer, &m3, &["build", "./..."], &as_pairs(&env));
+    let stderr = String::from_utf8_lossy(&broken.stderr);
+    assert!(!broken.status.success(), "{stderr}");
+    assert!(stderr.contains("missing go.sum entry"), "{stderr}");
+
+    let ovr = DepOverride {
+        ecosystem: "golang".into(),
+        name: UMOD.into(),
+        namespace: None,
+        version: UVER.into(),
+        token: String::new(),
+        patch_uuid: UUID.into(),
+        artifact_url: format!("{proxy_url}/{smod}/@v/{SVER}.zip"),
+        registry_override: Some(RegistryOverride {
+            kind: "goproxy".into(),
+            index_url: proxy_url.clone(),
+            identifiers: RegistryOverrideIdentifiers {
+                name: UMOD.into(),
+                version: UVER.into(),
+                go_module_path: Some(smod.clone()),
+                go_module_version: Some(SVER.into()),
+                ..Default::default()
+            },
+        }),
+        integrity: Integrity {
+            dirhash_h1: Some(zip_h1.clone()),
+            go_mod_h1: Some(gomod_h1.clone()),
+            ..Default::default()
+        },
+    };
+    let files: std::collections::BTreeMap<String, String> = ["go.mod", "go.sum"]
+        .into_iter()
+        .map(|name| {
+            let text = std::fs::read_to_string(consumer.join(name)).unwrap();
+            (name.to_string(), text)
+        })
+        .collect();
+    let rerun = rewrite_registry_redirect(&files, std::slice::from_ref(&ovr));
+    assert!(rerun.warnings.is_empty(), "{:?}", rerun.warnings);
+    assert!(rerun.confirmed_golang_uuids.contains(UUID));
+    assert_eq!(
+        rerun.files.keys().collect::<Vec<_>>(),
+        ["go.sum"],
+        "{:?}",
+        rerun.files
+    );
+    let restored = &rerun.files["go.sum"];
+    assert!(
+        restored.contains(&format!("{smod} {SVER} {zip_h1}\n")),
+        "{restored}"
+    );
+    std::fs::write(consumer.join("go.sum"), restored).unwrap();
+
+    let m4 = Machine::new(tmp.path(), "machine4");
+    let run = go(&consumer, &m4, &["run", "."], &as_pairs(&env));
+    let stderr = String::from_utf8_lossy(&run.stderr);
+    assert!(
+        run.status.success(),
+        "fresh-machine run after re-run failed: {stderr}"
+    );
+    assert!(stderr.contains("hi PATCHED"), "{stderr}");
+}
+
+/// A go.work whose other `use` member requires a higher version of the
+/// patched module: go builds that version, so `go.work.sum` keeps only the
+/// socket module's `/go.mod` line and the replace is inert. Discovery must
+/// not attest it, neither when that member is in the project root (its
+/// `require` shows the build selects the higher version) nor when it is
+/// outside it (its `require` cannot be read).
+// #[serial]: see the capstone's note — env mutation vs env iteration.
+#[tokio::test]
+#[serial_test::serial]
+async fn workspace_member_selecting_another_version_never_attests() {
+    if !golang_e2e_matrix::toolchain_ready("e2e_golang_hosted_build") {
+        return;
+    }
+    const NEXT: &str = "v1.1.0";
+    let tmp = tempfile::tempdir().unwrap();
+    let _cleanup = ChmodGuard(tmp.path().to_path_buf());
+    let proxy_url = format!("file://{}", tmp.path().join("proxy").display());
+    let smod = socket_module();
+    let upstream_gomod = format!("module {UMOD}\n\ngo 1.21\n");
+    publish(tmp.path(), UMOD, UVER, &upstream_gomod, PRISTINE_LIB);
+    publish(
+        tmp.path(),
+        UMOD,
+        NEXT,
+        &upstream_gomod,
+        "package upstream\n\nfunc Greeting() string { return \"PRISTINE-NEXT\" }\n",
+    );
+    publish(tmp.path(), &smod, SVER, &upstream_gomod, PATCHED_LIB);
+    let (_, gomod_h1) = harvest_sums(tmp.path(), &proxy_url, &smod, SVER);
+    let (next_zip_h1, next_gomod_h1) = harvest_sums(tmp.path(), &proxy_url, UMOD, NEXT);
+    let next_pair = format!("{UMOD} {NEXT} {next_zip_h1}\n{UMOD} {NEXT}/go.mod {next_gomod_h1}\n");
+    let env = day2_env(&proxy_url);
+    let purl = format!("pkg:golang/{UMOD}@{UVER}");
+
+    for (name, svc_rel) in [("in-root", "svc"), ("out-of-root", "../svc")] {
+        let app = tmp.path().join(name).join("app");
+        let svc = app.join(svc_rel);
+        std::fs::create_dir_all(&svc).unwrap();
+        std::fs::write(
+            app.join("go.mod"),
+            format!("module example.com/app\n\ngo 1.21\n\nrequire {UMOD} {UVER}\n"),
+        )
+        .unwrap();
+        std::fs::write(app.join("go.sum"), &next_pair).unwrap();
+        std::fs::write(
+            app.join("main.go"),
+            format!(
+                "package main\n\nimport \"{UMOD}\"\n\nfunc main() {{ println(upstream.Greeting()) }}\n"
+            ),
+        )
+        .unwrap();
+        std::fs::write(
+            svc.join("go.mod"),
+            format!("module example.com/svc\n\ngo 1.21\n\nrequire {UMOD} {NEXT}\n"),
+        )
+        .unwrap();
+        std::fs::write(svc.join("go.sum"), &next_pair).unwrap();
+        std::fs::write(
+            svc.join("svc.go"),
+            format!("package svc\n\nimport \"{UMOD}\"\n\nvar X = upstream.Greeting()\n"),
+        )
+        .unwrap();
+        std::fs::write(
+            app.join("go.work"),
+            format!(
+                "go 1.21\n\nuse (\n\t.\n\t./{svc_rel}\n)\n\n\
+                 replace {UMOD} {UVER} => {smod} {SVER}\n"
+            ),
+        )
+        .unwrap();
+        std::fs::write(
+            app.join("go.work.sum"),
+            format!("{smod} {SVER}/go.mod {gomod_h1}\n"),
+        )
+        .unwrap();
+
+        let machine = Machine::new(tmp.path(), &format!("{name}-machine"));
+        let run = go(&app, &machine, &["run", "."], &as_pairs(&env));
+        let stderr = String::from_utf8_lossy(&run.stderr);
+        assert!(run.status.success(), "{name}: {stderr}");
+        assert!(stderr.contains("PRISTINE-NEXT"), "{name}: {stderr}");
+        let list = go(&app, &machine, &["list", "-m", UMOD], &as_pairs(&env));
+        assert_eq!(
+            String::from_utf8_lossy(&list.stdout).trim(),
+            format!("{UMOD} {NEXT}"),
+            "{name}: {}",
+            String::from_utf8_lossy(&list.stderr)
+        );
+
+        let discovery = socket_patch_core::vex::discover::discover_patched_refs(&app).await;
+        let attested: Vec<_> = discovery
+            .refs
+            .iter()
+            .filter(|r| r.purl == purl && r.lockfile_basis_ok())
+            .collect();
+        assert!(attested.is_empty(), "{name}: {attested:?}");
+        if name == "in-root" {
+            assert!(
+                discovery
+                    .diagnostics
+                    .iter()
+                    .any(|d| d.detail.contains("is inert")),
+                "{name}: {:?}",
+                discovery.diagnostics
+            );
+        }
+    }
+}
+
+/// A go.work member's dependency requires a higher version of the patched
+/// module than any member's go.mod names. go builds that version without
+/// asking for a go.mod update and writes its sums to `go.work.sum` itself,
+/// so the `/go.mod`-only pin is never the attestation basis, before or
+/// after the build. The higher zip line go then records proves nothing on
+/// its own: go never drops it once the requirement is gone.
+// #[serial]: see the capstone's note — env mutation vs env iteration.
+#[tokio::test]
+#[serial_test::serial]
+async fn workspace_transitive_raise_never_attests() {
+    if !golang_e2e_matrix::toolchain_ready("e2e_golang_hosted_build") {
+        return;
+    }
+    const NEXT: &str = "v1.1.0";
+    const MID: &str = "example.com/mid";
+    let tmp = tempfile::tempdir().unwrap();
+    let _cleanup = ChmodGuard(tmp.path().to_path_buf());
+    let proxy_url = format!("file://{}", tmp.path().join("proxy").display());
+    let smod = socket_module();
+    let upstream_gomod = format!("module {UMOD}\n\ngo 1.21\n");
+    publish(tmp.path(), UMOD, UVER, &upstream_gomod, PRISTINE_LIB);
+    publish(
+        tmp.path(),
+        UMOD,
+        NEXT,
+        &upstream_gomod,
+        "package upstream\n\nfunc Greeting() string { return \"PRISTINE-NEXT\" }\n",
+    );
+    publish(tmp.path(), &smod, SVER, &upstream_gomod, PATCHED_LIB);
+    publish(
+        tmp.path(),
+        MID,
+        "v1.0.0",
+        &format!("module {MID}\n\ngo 1.21\n\nrequire {UMOD} {NEXT}\n"),
+        "package mid\n\nfunc Hello() string { return \"hi\" }\n",
+    );
+    let (_, gomod_h1) = harvest_sums(tmp.path(), &proxy_url, &smod, SVER);
+
+    let app = tmp.path().join("app");
+    let svc = app.join("svc");
+    std::fs::create_dir_all(&svc).unwrap();
+    std::fs::write(
+        app.join("go.mod"),
+        format!("module example.com/app\n\ngo 1.21\n\nrequire {UMOD} {UVER}\n"),
+    )
+    .unwrap();
+    std::fs::write(
+        app.join("main.go"),
+        format!(
+            "package main\n\nimport \"{UMOD}\"\n\nfunc main() {{ println(upstream.Greeting()) }}\n"
+        ),
+    )
+    .unwrap();
+    std::fs::write(
+        svc.join("go.mod"),
+        format!("module example.com/svc\n\ngo 1.21\n\nrequire {MID} v1.0.0\n"),
+    )
+    .unwrap();
+    std::fs::write(
+        svc.join("svc.go"),
+        format!("package svc\n\nimport \"{MID}\"\n\nvar X = mid.Hello()\n"),
+    )
+    .unwrap();
+    std::fs::write(
+        app.join("go.work"),
+        format!("go 1.21\n\nuse (\n\t.\n\t./svc\n)\n\nreplace {UMOD} {UVER} => {smod} {SVER}\n"),
+    )
+    .unwrap();
+    std::fs::write(
+        app.join("go.work.sum"),
+        format!("{smod} {SVER}/go.mod {gomod_h1}\n"),
+    )
+    .unwrap();
+
+    let purl = format!("pkg:golang/{UMOD}@{UVER}");
+    let discovery = socket_patch_core::vex::discover::discover_patched_refs(&app).await;
+    let refs: Vec<_> = discovery.refs.iter().filter(|r| r.purl == purl).collect();
+    assert_eq!(refs.len(), 1, "{:?}", discovery.refs);
+    assert!(!refs[0].lockfile_basis_ok(), "{:?}", refs[0]);
+    assert!(
+        discovery.diagnostics.is_empty(),
+        "{:?}",
+        discovery.diagnostics
+    );
+
+    // A fresh checkout has no sums for the dependencies; skip the checksum
+    // database for this file:// proxy so go records them as it would.
+    let mut env = day2_env(&proxy_url);
+    env.retain(|(k, _)| *k != "GONOSUMDB");
+    env.push(("GONOSUMDB", "example.com".to_string()));
+    let machine = Machine::new(tmp.path(), "machine");
+    let run = go(&app, &machine, &["run", "."], &as_pairs(&env));
+    let stderr = String::from_utf8_lossy(&run.stderr);
+    assert!(run.status.success(), "{stderr}");
+    assert!(stderr.contains("PRISTINE-NEXT"), "{stderr}");
+    let list = go(&app, &machine, &["list", "-m", UMOD], &as_pairs(&env));
+    assert_eq!(
+        String::from_utf8_lossy(&list.stdout).trim(),
+        format!("{UMOD} {NEXT}"),
+        "{}",
+        String::from_utf8_lossy(&list.stderr)
+    );
+    let work_sum = std::fs::read_to_string(app.join("go.work.sum")).unwrap();
+    assert!(
+        work_sum.contains(&format!("{UMOD} {NEXT} h1:")),
+        "{work_sum}"
+    );
+
+    let discovery = socket_patch_core::vex::discover::discover_patched_refs(&app).await;
+    let refs: Vec<_> = discovery.refs.iter().filter(|r| r.purl == purl).collect();
+    assert_eq!(refs.len(), 1, "{:?}", discovery.refs);
+    assert!(!refs[0].lockfile_basis_ok(), "{:?}", refs[0]);
+}
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/golang.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/golang.rs
index 440f11b83..1645eb5a0 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/golang.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/golang.rs
@@ -35,7 +35,9 @@
 //!   differs from the wiring is `record_mismatch`.
 //! * **g** (hosted) not installed → attests from the go.sum pin (design D5);
 //!   the replacement module installed-and-patched → verified; that copy
-//!   pristine → omitted; a pin-less reference needs a verifying copy.
+//!   pristine → omitted; the `/go.mod` line alone (`go mod tidy` pruned
+//!   the zip line) still attests; a pin-less reference needs a verifying
+//!   copy.
 //!
 //! Flavors: `go.mod` single-line replace, `replace ( … )` block member,
 //! hand-written `go.work` (+ `go.work.sum`), the committed hosted rewriter
@@ -711,8 +713,8 @@ fn golang_hosted_f_spoofed_references_never_attest() {
 
 /// g: only the pristine ORIGINAL `M@v` cached → not installed (the build
 /// never reads it) → the go.sum pin attests; the replacement patched →
-/// verified; the replacement pristine → omitted; no go.sum pin → needs the
-/// verifying replacement.
+/// verified; the replacement pristine → omitted; the tidy `/go.mod`-line
+/// pin → attests; no go.sum pin → needs the verifying replacement.
 #[test]
 fn golang_hosted_g_installed_copy_basis() {
     let api = Api::start(vec![(U, go_view(U))]);
@@ -740,6 +742,17 @@ fn golang_hosted_g_installed_copy_basis() {
     let run = fx.vex(&args);
     assert_omitted(&run, GO_PURL, "not_applied", "replacement pristine");
 
+    // `go mod tidy` drops the zip line when no package of the module is
+    // loaded; nothing downloads the zip, so nothing is installed.
+    let fx = Fx::new();
+    write_go_hosted(&fx, U, GoFile::GoMod);
+    fx.put(
+        "go.sum",
+        format!("{} {GO_SVER}/go.mod {GO_H1_MOD}\n", go_socket_module(U)),
+    );
+    let run = fx.vex(&args);
+    assert_attested(&fx, &run, GO_PURL, U, "redirected", "go.mod line only");
+
     // No (or an incomplete) go.sum pin.
     for (name, sum) in [
         ("no go.sum", None),
diff --git a/crates/socket-patch-core/src/patch/redirect/mod.rs b/crates/socket-patch-core/src/patch/redirect/mod.rs
index 0b1e6e400..bb3acdd33 100644
--- a/crates/socket-patch-core/src/patch/redirect/mod.rs
+++ b/crates/socket-patch-core/src/patch/redirect/mod.rs
@@ -9410,6 +9410,10 @@ fn rewrite_golang(
                 }
             }
         }
+        // Always both lines, even over the `/go.mod` line alone that `go mod
+        // tidy` leaves while no package of the module is loaded: the
+        // rewriter cannot see imports, and without the zip line a later
+        // import fails `missing go.sum entry` with nothing else to restore it.
         if go_sum.upsert_module_lines(rhs_module, rhs_version, zip_h1, gomod_h1) {
             sum_changed = true;
             result.edits.push(FileEdit {
@@ -23111,6 +23115,29 @@ packages:
         assert!(refused.confirmed_golang_uuids.is_empty());
     }
 
+    /// `go mod tidy` drops the socket module's zip line when no package of it
+    /// is loaded; a re-run restores it, so a later import still builds.
+    #[test]
+    fn golang_rerun_restores_a_tidy_pruned_zip_line() {
+        let files = golang_files();
+        let ovr = golang_override();
+        let first = rewrite_registry_redirect(&files, std::slice::from_ref(&ovr));
+        let zip_prefix = format!("{} v1.4.2-socketpatch.1 ", golang_socket_module());
+        let tidied: String = first.files["go.sum"]
+            .lines()
+            .filter(|l| !l.starts_with(&zip_prefix))
+            .map(|l| format!("{l}\n"))
+            .collect();
+        assert_ne!(tidied, first.files["go.sum"]);
+        let mut again = files.clone();
+        again.extend(first.files.clone());
+        again.insert("go.sum".to_string(), tidied);
+        let second = rewrite_registry_redirect(&again, std::slice::from_ref(&ovr));
+        assert_eq!(second.files.keys().collect::<Vec<_>>(), ["go.sum"]);
+        assert_eq!(second.files["go.sum"], first.files["go.sum"]);
+        assert!(second.confirmed_golang_uuids.contains(GO_UUID));
+    }
+
     /// Only `patch.socket.dev/gopatch/<canonical uuid>` is a hosted module;
     /// anything deeper would be written but never recognized as ours again.
     #[test]
diff --git a/crates/socket-patch-core/src/vex/discover/golang.rs b/crates/socket-patch-core/src/vex/discover/golang.rs
index 991775d6c..6375452b9 100644
--- a/crates/socket-patch-core/src/vex/discover/golang.rs
+++ b/crates/socket-patch-core/src/vex/discover/golang.rs
@@ -8,7 +8,7 @@
 //!
 //! | owner | what our tools write | ref |
 //! |---|---|---|
-//! | [`ReplaceOwner::Hosted`] (`scan --mode hosted`, `rewrite_golang`) | `replace M v => patch.socket.dev/gopatch/<uuid> <sver>` + go.sum `patch.socket.dev/gopatch/<uuid> <sver> h1:…` and `…<sver>/go.mod h1:…` | hosted, `integrity_required = true` |
+//! | [`ReplaceOwner::Hosted`] (`scan --mode hosted`, `rewrite_golang`) | `replace M v => patch.socket.dev/gopatch/<uuid> <sver>` + go.sum `patch.socket.dev/gopatch/<uuid> <sver> h1:…` and `…<sver>/go.mod h1:…` (`go mod tidy` may prune the first) | hosted, `integrity_required` iff the zip line is present |
 //! | [`ReplaceOwner::Vendor`] (`vendor`, `vendor_go_module`) | `replace M v => ./.socket/vendor/golang/<uuid>/M@v` | vendored |
 //! | [`ReplaceOwner::GoPatches`] (`apply`'s redirect) | `replace M v => ./.socket/go-patches/M@v` | none — no uuid; the CLI's `synthesize_go_patches` verifies those |
 //!
@@ -32,15 +32,40 @@
 //!   `--patch-server-url` deployment does not change Go module paths, so
 //!   the origin allowlist does not apply here.
 //! * **Pin.** The hosted rewriter refuses to write the replace without BOTH
-//!   go.sum lines, so `integrity_required = true`; the ref's
-//!   `locked_integrity` is the zip line's `h1:` dirhash
-//!   ([`LockIntegrity::GoH1`]) and is set only when the sum file carries
-//!   exactly one well-formed zip hash AND the `/go.mod` line for the Socket
-//!   module+version (anything else is not what the rewriter wrote — and a
-//!   conflicting pair is a go `SECURITY ERROR`). NB for the CLI's
-//!   installed-tree basis: under a hosted replace the module cache's
-//!   `M@v` (if any, e.g. from before the redirect) is pristine BY
-//!   CONSTRUCTION — the build consumes `patch.socket.dev/gopatch/<uuid>@<sver>`.
+//!   go.sum lines, but `go mod tidy` then drops the zip line whenever no
+//!   package of the replaced module is loaded (a transitive module only MVS
+//!   reads keeps just its `/go.mod` line), and the build stays green. So
+//!   the pin is the `/go.mod` line for the Socket module+version: exactly
+//!   one well-formed hash for it, plus at most one well-formed zip hash.
+//!   With the zip line, `integrity_required = true` and `locked_integrity`
+//!   is its `h1:` dirhash ([`LockIntegrity::GoH1`]). Without it (the tidy
+//!   state) `integrity_required = false`: the module path carries the patch
+//!   uuid and go compiles none of its packages, so the pinned replace alone
+//!   is the attestation basis — but MVS also keeps the `/go.mod` line of a
+//!   version it reads and does not select, so a `/go.mod`-only pin whose
+//!   version go.mod's `require` or go.sum show is not selected
+//!   ([`go_build_list::select`]) is inert: diagnosed, no ref. A `go.work`
+//!   build keeps no member's go.mod tidy and adds missing sums to
+//!   `go.work.sum` itself, so a dependency's requirement can raise the
+//!   version past everything discovery reads: there a `/go.mod`-only pin
+//!   is never the basis (`integrity_required = true`), and a higher
+//!   version in a member's `require` or a member go.sum's zip line makes
+//!   it inert. go only ever appends to `go.work.sum`, so its zip lines
+//!   outlive the requirement that raised a module and prove nothing.
+//!   Anything else — no `/go.mod` line, two
+//!   different hashes for one line, a non-dirhash `h1:` (both a go
+//!   `SECURITY ERROR`), a line of other than three tokens anywhere in a
+//!   sum file (go rejects the whole file) — is not a pin:
+//!   `integrity_required = true`, no `locked_integrity`. Hashes of other
+//!   algorithms are ignored, as go ignores them. The sum files are the
+//!   ones go verifies against: the root `go.sum`, or with a `go.work`,
+//!   `go.work.sum` and each in-root `use` member's `go.sum` (the root's
+//!   only when `.` is a member). Under `GOWORK=off` go ignores `go.work`,
+//!   so discovery reads neither it nor its sum files.
+//!   NB for the CLI's installed-tree basis: under a hosted replace the
+//!   module cache's `M@v` (if any, e.g. from before the redirect) is
+//!   pristine BY CONSTRUCTION — the build consumes
+//!   `patch.socket.dev/gopatch/<uuid>@<sver>`.
 //! * **Vendored identity** comes from [`vendor_ref`] over the replace PATH
 //!   (root-anchored: a `../…/.socket/vendor/golang/…` or absolute target —
 //!   which `detect_owner` still classifies as `Vendor` — points the build at
@@ -66,10 +91,12 @@
 //!   `replace` grammar and paths relative to the (root) workspace dir; its
 //!   refs are emitted with `source_file = "go.work"`, versions checked
 //!   against the ROOT `go.mod`'s `require` (the only one discovery reads),
-//!   and hosted pins looked up in `go.work.sum`, then `go.sum`. go.work
+//!   and hosted pins looked up in the sum files above. go.work
 //!   replaces override go.mod replaces in Go, but rule 10 leaves
-//!   cross-file precedence to the CLI's `wiring_conflict` gate. Nested
-//!   workspace members' go.mod files are not read (root-only, rule 1).
+//!   cross-file precedence to the CLI's `wiring_conflict` gate. In-root
+//!   workspace members' go.mod files are read only for their `require`s
+//!   (a `/go.mod`-only pin's inert check) and their go.sum for pins; their
+//!   replaces are not (root-only, rule 1).
 //! * **Hand-edit tolerance**: a UTF-8 BOM, CRLF line ends, tab-separated
 //!   tokens, `replace(` without a space, `// comments`, and Go string
 //!   literals (`"github.com/foo/bar"`, `` `…` ``) around escape- and
@@ -80,18 +107,22 @@
 //! * `vendor/modules.txt` (`go mod vendor`) only mirrors go.mod's replaces
 //!   and is not read.
 
+use std::cmp::Ordering;
 use std::collections::{BTreeSet, HashMap, HashSet};
 
 use super::{
     golang_purl, vendor_ref, vendored_leaf_purl, DiscoverCtx, Discovery, PatchedRef,
     DIAG_LOCKFILE_UNPARSEABLE, DIAG_REF_INVALID, DIAG_REF_UNATTRIBUTABLE,
 };
+use crate::patch::apply::is_safe_relative_subpath;
 use crate::patch::path_safety::is_safe_single_segment;
+use crate::utils::go_env::go_env;
+use crate::vendor::go_build_list::{self, Selection};
 use crate::vendor::go_mod_edit::{
     self, block_structure_error, hosted_module_uuid, normalize_for_read, ReplaceEntry,
     ReplaceOwner, HOSTED_GO_MODULE_PREFIX,
 };
-use crate::vendor::go_sum_edit::{go_sum_lines, is_h1_dirhash};
+use crate::vendor::go_sum_edit::{go_semver_cmp, go_sum_lines, is_h1_dirhash};
 use crate::vendor::lock_inventory::LockIntegrity;
 
 const GO_MOD: &str = "go.mod";
@@ -100,25 +131,149 @@ const GO_WORK: &str = "go.work";
 const GO_WORK_SUM: &str = "go.work.sum";
 
 pub(crate) async fn extract(ctx: &DiscoverCtx<'_>, out: &mut Discovery) {
+    let workspaces = go_env("GOWORK").as_deref() != Some("off");
+    extract_with(ctx, out, workspaces).await;
+}
+
+/// [`extract`], with `workspaces` false under `GOWORK=off`: go then ignores
+/// `go.work`, its replaces and its sum files.
+async fn extract_with(ctx: &DiscoverCtx<'_>, out: &mut Discovery, workspaces: bool) {
     let go_mod = match ctx.read_text(GO_MOD, out).await {
         Some(text) => parse_go_file(GO_MOD, &text, out),
         None => None,
     };
-    // `require` of the root module: the version the build selects (as far
-    // as a root-only reader can tell).
     let required: HashMap<String, String> = go_mod
         .as_deref()
         .map(go_mod_edit::parse_required_versions)
         .unwrap_or_default();
 
-    if let Some(text) = go_mod.as_deref() {
-        extract_file(ctx, out, GO_MOD, text, &required, &[GO_SUM]).await;
+    let go_work = if workspaces {
+        ctx.read_text(GO_WORK, out).await
+    } else {
+        None
+    };
+    let go_work = go_work.and_then(|text| parse_go_file(GO_WORK, &text, out));
+    let files: Vec<(&str, Vec<ReplaceEntry>)> = [(GO_MOD, &go_mod), (GO_WORK, &go_work)]
+        .into_iter()
+        .filter_map(|(file, text)| {
+            Some((file, go_mod_edit::parse_replace_entries(text.as_deref()?)))
+        })
+        .collect();
+    let any_hosted = files
+        .iter()
+        .flat_map(|(_, entries)| entries)
+        .any(|e| e.owner == Some(ReplaceOwner::Hosted));
+    let mut graph = Graph {
+        required,
+        mains: vec![MainModule::new(go_mod.as_deref().unwrap_or_default())],
+        workspace: go_work.is_some(),
+    };
+    let mut sums = SumPins::default();
+    if any_hosted {
+        let sum_files = match go_work.as_deref() {
+            Some(work) => {
+                let (mains, files) = read_workspace(ctx, out, go_mod.as_deref(), work).await;
+                graph.mains = mains;
+                files
+            }
+            None => vec![GO_SUM.to_string()],
+        };
+        sums = SumPins::read(ctx, out, &sum_files).await;
+    }
+    for (file, entries) in &files {
+        extract_file(out, file, entries, &graph, &sums);
+    }
+}
+
+/// The build list's evidence: the main modules' `require`s.
+struct Graph {
+    /// `require` of the root module: the version the build selects (as far
+    /// as a root-only reader can tell).
+    required: HashMap<String, String>,
+    /// The main modules: the root module, or every readable in-root
+    /// `go.work` `use` member.
+    mains: Vec<MainModule>,
+    /// A `go.work` is in effect.
+    workspace: bool,
+}
+
+struct MainModule {
+    /// go >= 1.17: `require` lists every module that provides a package.
+    pruned: bool,
+    required: HashMap<String, String>,
+}
+
+impl MainModule {
+    fn new(go_mod: &str) -> Self {
+        MainModule {
+            pruned: go_mod_edit::prunes_module_graph(go_mod),
+            required: go_mod_edit::parse_required_versions(go_mod),
+        }
+    }
+}
+
+impl Graph {
+    /// [`go_build_list::select`] over the main modules. A workspace never
+    /// proves [`Selection::Selected`]: go builds it from the full module
+    /// graph without requiring any member's go.mod to be tidy, and fills in
+    /// `go.work.sum` itself, so a dependency's own requirement can raise the
+    /// module past every `require` and sum line discovery reads. Only a
+    /// higher version in that evidence proves the replace inert.
+    fn select(&self, module: &str, version: &str, zips: &[&str]) -> Selection {
+        let mains = &self.mains;
+        let required = mains
+            .iter()
+            .filter_map(|m| m.required.get(module).map(String::as_str))
+            .max_by(|a, b| go_semver_cmp(a, b));
+        if !self.workspace {
+            let pruned = mains.iter().all(|m| m.pruned);
+            return go_build_list::select(pruned, required, zips, version);
+        }
+        required
+            .into_iter()
+            .chain(zips.iter().copied())
+            .filter(|v| go_semver_cmp(v, version) == Ordering::Greater)
+            .max_by(|a, b| go_semver_cmp(a, b))
+            .map_or(Selection::Unknown, |v| Selection::Other(v.to_string()))
     }
-    if let Some(text) = ctx.read_text(GO_WORK, out).await {
-        if let Some(text) = parse_go_file(GO_WORK, &text, out) {
-            extract_file(ctx, out, GO_WORK, &text, &required, &[GO_WORK_SUM, GO_SUM]).await;
+}
+
+/// The `use` members of `go.work` as main modules, and the sum files go
+/// verifies against in workspace mode: `go.work.sum` and each member's
+/// `go.sum` (the root's only when `.` is a member). A member whose go.mod
+/// is outside the root or unreadable adds no main module; the others still
+/// count, since in a workspace their `require`s only ever prove a replace
+/// inert, never selected.
+async fn read_workspace(
+    ctx: &DiscoverCtx<'_>,
+    out: &mut Discovery,
+    go_mod: Option<&str>,
+    go_work: &str,
+) -> (Vec<MainModule>, Vec<String>) {
+    let mut mains = Vec::new();
+    let mut files = vec![GO_WORK_SUM.to_string()];
+    for dir in go_mod_edit::parse_use_dirs(go_work) {
+        let Some(dir) = member_dir(&dir) else {
+            continue;
+        };
+        let text = if dir.is_empty() {
+            go_mod.map(str::to_string)
+        } else {
+            let rel = member_file(&dir, GO_MOD);
+            match ctx.read_text(&rel, out).await {
+                Some(text) => parse_go_file(&rel, &text, out),
+                None => None,
+            }
+        };
+        if let Some(text) = text {
+            mains.push(MainModule::new(&text));
+        }
+        let sum = member_file(&dir, GO_SUM);
+        if !files.contains(&sum) {
+            files.push(sum);
         }
     }
+    (mains, files)
 }
 
 /// Normalize a go.mod-grammar file (BOM, simple string literals) and check
@@ -138,24 +293,21 @@ fn parse_go_file(file: &str, text: &str, out: &mut Discovery) -> Option<String>
 }
 
 /// Emit the refs of one parsed file's Socket-owned `replace` directives.
-async fn extract_file(
-    ctx: &DiscoverCtx<'_>,
+fn extract_file(
     out: &mut Discovery,
     file: &str,
-    text: &str,
-    required: &HashMap<String, String>,
-    sum_files: &[&str],
+    entries: &[ReplaceEntry],
+    graph: &Graph,
+    sums: &SumPins,
 ) {
-    let entries = go_mod_edit::parse_replace_entries(text);
+    let required = &graph.required;
     // Versioned directives of ANY owner: they shadow a version-less replace
     // of the same module at that version.
     let versioned: HashSet<(&str, &str)> = entries
         .iter()
         .filter_map(|e| Some((e.module.as_str(), e.version.as_deref()?)))
         .collect();
-    let mut sums: Option<SumPins> = None;
-
-    for entry in &entries {
+    for entry in entries {
         match entry.owner {
             Some(ReplaceOwner::Hosted) => {
                 let Some(rhs) = entry.rhs_module.as_deref() else {
@@ -191,19 +343,42 @@ async fn extract_file(
                 let Some(purl) = replaced_purl(entry, required, &versioned, file, out) else {
                     continue;
                 };
-                if sums.is_none() {
-                    let mut pins = SumPins::default();
-                    for sum in sum_files {
-                        if let Some(sum_text) = ctx.read_text(sum, out).await {
-                            pins.add(&sum_text);
-                        }
+                let pin = sums.pin(rhs, rhs_version);
+                // MVS reads (and go.sum keeps the `/go.mod` line of) versions
+                // it does not select, so a `/go.mod`-only pin needs proof the
+                // replaced version is the one built. In a workspace a zip
+                // line is no proof either: a sum file is only appended to, so
+                // a member that later raises the module leaves the socket zip
+                // line in place while go builds the higher version.
+                let check = match pin {
+                    SumPin::GoModOnly => true,
+                    SumPin::Zip(_) => graph.workspace,
+                    SumPin::Unpinned => false,
+                };
+                if check {
+                    let req = required.get(&entry.module).map(String::as_str);
+                    // `replaced_purl` resolved one of the two.
+                    let version = entry.version.as_deref().or(req).unwrap_or_default();
+                    let zips = sums.zip_versions(&entry.module);
+                    let selected = graph.select(&entry.module, version, &zips);
+                    if let Some(other) = selected.other_version() {
+                        out.diag(
+                            DIAG_REF_INVALID,
+                            file,
+                            format!(
+                                "{file}: replace {} {version} is inert: the build \
+                                 selects {other}, so it uses the unpatched module",
+                                entry.module
+                            ),
+                        );
+                        continue;
                     }
-                    sums = Some(pins);
                 }
-                let integrity = sums
-                    .as_ref()
-                    .and_then(|s| s.pin(rhs, rhs_version))
-                    .map(LockIntegrity::GoH1);
+                let (integrity, integrity_required) = match pin {
+                    SumPin::Zip(h1) => (Some(LockIntegrity::GoH1(h1)), true),
+                    SumPin::GoModOnly => (None, graph.workspace),
+                    SumPin::Unpinned => (None, true),
+                };
                 let url = format!("{rhs}@{rhs_version}");
                 out.push(PatchedRef::hosted(
                     purl,
@@ -211,7 +386,7 @@ async fn extract_file(
                     file,
                     Some(url.as_str()),
                     integrity,
-                    true,
+                    integrity_required,
                 ));
             }
             Some(ReplaceOwner::Vendor) => {
@@ -344,27 +519,76 @@ fn replaced_purl(
     purl
 }
 
-/// go.sum pins of Socket hosted modules, keyed `(module, version)`.
+/// go.sum pins of Socket hosted modules, keyed `(module, version)`, from
+/// every sum file go verifies against.
 #[derive(Default)]
 struct SumPins {
     /// Zip-line `h1:` hashes.
     zip: HashMap<(String, String), BTreeSet<String>>,
-    /// `(module, version)`s with a `/go.mod` line.
-    gomod: HashSet<(String, String)>,
+    /// `/go.mod`-line `h1:` hashes.
+    gomod: HashMap<(String, String), BTreeSet<String>>,
+    /// Keys with an `h1:` hash that is not a dirhash: go fails the
+    /// comparison with a `SECURITY ERROR`.
+    malformed: HashSet<(String, String)>,
+    /// A sum file has a line go cannot parse, so every build fails.
+    unparseable: bool,
+    /// Every module's zip-line versions (the build-list evidence).
+    zip_versions: HashMap<String, Vec<String>>,
+}
+
+/// What the sum files pin for one Socket `module@version`.
+#[derive(Debug, PartialEq, Eq)]
+enum SumPin {
+    /// Both lines: the zip line's `h1:`.
+    Zip(String),
+    /// Only the `/go.mod` line (`go mod tidy` pruned the zip line).
+    GoModOnly,
+    Unpinned,
 }
 
 impl SumPins {
-    fn add(&mut self, text: &str) {
+    async fn read(ctx: &DiscoverCtx<'_>, out: &mut Discovery, files: &[String]) -> Self {
+        let mut pins = SumPins::default();
+        for file in files {
+            if let Some(text) = ctx.read_text(file, out).await {
+                pins.add(&text, file != GO_WORK_SUM);
+            }
+        }
+        pins
+    }
+
+    /// `selects`: whether the file's zip lines show what the build selects.
+    /// go only ever appends to `go.work.sum`, so its lines outlive the
+    /// requirement that raised a module.
+    fn add(&mut self, text: &str, selects: bool) {
+        // go rejects a whole go.sum with any non-blank line of other than
+        // three tokens (only `go mod tidy` skips it).
+        if text
+            .lines()
+            .any(|l| !matches!(l.split_whitespace().count(), 0 | 3))
+        {
+            self.unparseable = true;
+            return;
+        }
         for line in go_sum_lines(text) {
-            if line.extra_tokens
-                || !line.module.starts_with(HOSTED_GO_MODULE_PREFIX)
-                || !is_h1_dirhash(line.hash)
-            {
+            if !line.go_mod && selects {
+                self.zip_versions
+                    .entry(line.module.to_string())
+                    .or_default()
+                    .push(line.version.to_string());
+            }
+            // go ignores hashes of algorithms it does not know.
+            if !line.module.starts_with(HOSTED_GO_MODULE_PREFIX) || !line.hash.starts_with("h1:") {
                 continue;
             }
             let key = (line.module.to_string(), line.version.to_string());
-            if line.go_mod {
-                self.gomod.insert(key);
+            if !is_h1_dirhash(line.hash) {
+                self.malformed.insert(key);
+            } else if line.go_mod {
+                self.gomod
+                    .entry(key)
+                    .or_default()
+                    .insert(line.hash.to_string());
             } else {
                 self.zip
                     .entry(key)
@@ -374,14 +598,50 @@ impl SumPins {
         }
     }
 
-    /// The zip `h1:` of `module@version` iff the rewriter's full pin is
-    /// present: one unambiguous zip hash plus the `/go.mod` line.
-    fn pin(&self, module: &str, version: &str) -> Option<String> {
+    /// The pin of `module@version`: one unambiguous `/go.mod` hash, and at
+    /// most one zip hash.
+    fn pin(&self, module: &str, version: &str) -> SumPin {
         let key = (module.to_string(), version.to_string());
-        let hashes = self.zip.get(&key)?;
-        (hashes.len() == 1 && self.gomod.contains(&key))
-            .then(|| hashes.iter().next().cloned())
-            .flatten()
+        let one = |hashes: Option<&BTreeSet<String>>| match hashes {
+            Some(h) if h.len() == 1 => h.iter().next().cloned(),
+            _ => None,
+        };
+        if self.unparseable || self.malformed.contains(&key) || one(self.gomod.get(&key)).is_none()
+        {
+            return SumPin::Unpinned;
+        }
+        match self.zip.get(&key) {
+            None => SumPin::GoModOnly,
+            some => one(some).map_or(SumPin::Unpinned, SumPin::Zip),
+        }
+    }
+
+    fn zip_versions(&self, module: &str) -> Vec<&str> {
+        self.zip_versions
+            .get(module)
+            .map(|v| v.iter().map(String::as_str).collect())
+            .unwrap_or_default()
+    }
+}
+
+/// Root-relative directory of a `go.work` `use` member (`""` for the root
+/// itself); `None` for a member outside the root.
+fn member_dir(dir: &str) -> Option<String> {
+    let dir = dir.replace('\\', "/");
+    if !is_safe_relative_subpath(&dir) {
+        return None;
+    }
+    let segments: Vec<&str> = dir
+        .split('/')
+        .filter(|s| !s.is_empty() && *s != ".")
+        .collect();
+    Some(segments.join("/"))
+}
+
+fn member_file(dir: &str, file: &str) -> String {
+    match dir {
+        "" => file.to_string(),
+        dir => format!("{dir}/{file}"),
     }
 }
 
@@ -406,7 +666,13 @@ mod tests {
         "module example.com/app\n\ngo 1.21\n\nrequire github.com/foo/bar v1.4.2\n";
 
     async fn run(p: &Project) -> Discovery {
-        p.run(|c, o| Box::pin(super::extract(c, o))).await
+        p.run(|c, o| Box::pin(super::extract_with(c, o, true)))
+            .await
+    }
+
+    async fn gowork_off(p: &Project) -> Discovery {
+        p.run(|c, o| Box::pin(super::extract_with(c, o, false)))
+            .await
     }
 
     fn gopatch(uuid: &str) -> String {
@@ -518,31 +784,76 @@ mod tests {
             let out = run(&p).await;
             assert_refs(&out, &[(PURL, UUID_A, WiringMode::Hosted)]);
             assert_eq!(out.refs[0].locked_integrity, None, "{go_sum:?}");
+            assert!(!out.refs[0].lockfile_basis_ok(), "{go_sum:?}");
+        }
+    }
+
+    /// `go mod tidy` keeps only the `/go.mod` line of a replaced module whose
+    /// packages nothing imports, and the build stays green: that line alone
+    /// is the pin, with nothing to lock the (never fetched) zip to. Not in a
+    /// workspace, whose selection go.mod cannot show.
+    #[tokio::test]
+    async fn tidy_pruned_zip_line_leaves_a_go_mod_line_pin() {
+        let m = gopatch(UUID_A);
+        let sver = "v1.4.2-socketpatch.1";
+        let go_mod = format!("{BASE_GO_MOD}\nreplace {MODULE} {VERSION} => {m} {sver}\n");
+        for (file, sum_file) in [("go.mod", "go.sum"), ("go.work", "go.work.sum")] {
+            let p = Project::new();
+            if file == "go.mod" {
+                p.write("go.mod", &go_mod);
+            } else {
+                p.write("go.mod", BASE_GO_MOD).write(
+                    "go.work",
+                    format!("go 1.21\n\nuse .\n\nreplace {MODULE} {VERSION} => {m} {sver}\n"),
+                );
+            }
+            p.write(sum_file, format!("{m} {sver}/go.mod {MOD_H1}\n"));
+            let out = run(&p).await;
+            assert_refs(&out, &[(PURL, UUID_A, WiringMode::Hosted)]);
+            let r = &out.refs[0];
+            let attests = file == "go.mod";
+            assert_eq!(r.locked_integrity, None, "{file}");
+            assert_eq!(r.integrity_required, !attests, "{file}");
+            assert_eq!(r.lockfile_basis_ok(), attests, "{file}");
+            assert!(out.diagnostics.is_empty(), "{:?}", out.diagnostics);
         }
     }
 
     #[tokio::test]
-    async fn hosted_pin_requires_both_go_sum_lines_and_one_hash() {
+    async fn hosted_pin_requires_the_go_mod_line_and_one_hash_per_line() {
         let m = gopatch(UUID_A);
         let go_mod =
             format!("{BASE_GO_MOD}\nreplace {MODULE} {VERSION} => {m} v1.4.2-socketpatch.1\n");
         for go_sum in [
             // No go.sum at all.
             None,
-            // Zip line only / go.mod line only.
+            // Zip line only.
             Some(format!("{m} v1.4.2-socketpatch.1 {ZIP_H1}\n")),
-            Some(format!("{m} v1.4.2-socketpatch.1/go.mod {MOD_H1}\n")),
             // Conflicting zip hashes (a union-merged go.sum).
             Some(format!(
                 "{}{m} v1.4.2-socketpatch.1 {MOD_H1}\n",
                 go_sum_for(UUID_A, "v1.4.2-socketpatch.1")
             )),
-            // Pinned at another socket version.
+            // Conflicting `/go.mod` hashes, with and without the zip line.
+            Some(format!(
+                "{}{m} v1.4.2-socketpatch.1/go.mod {ZIP_H1}\n",
+                go_sum_for(UUID_A, "v1.4.2-socketpatch.1")
+            )),
+            Some(format!(
+                "{m} v1.4.2-socketpatch.1/go.mod {MOD_H1}\n{m} v1.4.2-socketpatch.1/go.mod {ZIP_H1}\n"
+            )),
+            // Pinned at another socket version (both lines, or the tidy
+            // `/go.mod` line).
             Some(go_sum_for(UUID_A, "v1.4.2-socketpatch.9")),
-            // Malformed hash.
+            Some(format!("{m} v1.4.2-socketpatch.9/go.mod {MOD_H1}\n")),
+            // Malformed hash, on either line.
             Some(format!(
                 "{m} v1.4.2-socketpatch.1 h1:short\n{m} v1.4.2-socketpatch.1/go.mod {MOD_H1}\n"
             )),
+            Some(format!(
+                "{}{m} v1.4.2-socketpatch.1/go.mod h1:short\n",
+                go_sum_for(UUID_A, "v1.4.2-socketpatch.1")
+            )),
         ] {
             let p = Project::new();
             p.write("go.mod", &go_mod);
@@ -652,6 +963,408 @@ mod tests {
         assert!(r.lockfile_basis_ok());
     }
 
+    /// In workspace mode go verifies against every member's go.sum, so the
+    /// zip line may live there; a member outside the root is not read.
+    #[tokio::test]
+    async fn workspace_member_go_sum_holds_the_zip_line() {
+        let m = gopatch(UUID_A);
+        let sver = "v1.4.2-socketpatch.1";
+        let go_mod = format!("{BASE_GO_MOD}\nreplace {MODULE} {VERSION} => {m} {sver}\n");
+        for (use_dir, member_sum, pinned) in [
+            ("./svc", "svc/go.sum", true),
+            ("svc/", "svc/go.sum", true),
+            ("../svc", "../svc/go.sum", false),
+        ] {
+            let p = Project::new();
+            p.write("go.mod", &go_mod)
+                .write(
+                    "go.work",
+                    format!("go 1.21\n\nuse (\n\t.\n\t{use_dir}\n)\n"),
+                )
+                .write("go.sum", format!("{m} {sver}/go.mod {MOD_H1}\n"));
+            if pinned {
+                p.write(member_sum, format!("{m} {sver} {ZIP_H1}\n"));
+            }
+            let out = run(&p).await;
+            assert_refs(&out, &[(PURL, UUID_A, WiringMode::Hosted)]);
+            let r = &out.refs[0];
+            if pinned {
+                assert_eq!(
+                    r.locked_integrity,
+                    Some(LockIntegrity::GoH1(ZIP_H1.to_string())),
+                    "{use_dir}"
+                );
+                assert!(r.integrity_required);
+                assert!(r.lockfile_basis_ok(), "{use_dir}");
+            } else {
+                assert_eq!(r.locked_integrity, None, "{use_dir}");
+                // Nor can its `require` show the `/go.mod` line's version
+                // is the one the workspace selects.
+                assert!(!r.lockfile_basis_ok(), "{use_dir}");
+            }
+        }
+    }
+
+    /// A workspace builds the union of its members' requirements, and a
+    /// member's dependency can raise the module past every `require` while
+    /// go writes the missing sums to `go.work.sum` itself: a `/go.mod`-only
+    /// pin there is never the basis, and a higher `require` or member
+    /// go.sum zip line makes it inert. A `go.work.sum` zip line does not:
+    /// go never drops one once nothing raises the module any more.
+    #[tokio::test]
+    async fn workspace_go_mod_only_pin_is_never_the_basis() {
+        let m = gopatch(UUID_A);
+        let sver = "v1.4.2-socketpatch.1";
+        let svc = |go: &str, require: &str| format!("module example.com/svc\n\ngo {go}\n{require}");
+        let req = |v: &str| format!("\nrequire {MODULE} {v}\n");
+        let zip = |v: &str| format!("{MODULE} {v} {ZIP_H1}\n{MODULE} {v}/go.mod {MOD_H1}\n");
+        let mid = "\nrequire example.com/mid v1.0.0\n";
+        for (name, uses, svc_mod, svc_sum, work_sum, inert) in [
+            (
+                "member requires it too",
+                ". ./svc",
+                Some(svc("1.21", &req(VERSION))),
+                None,
+                None,
+                false,
+            ),
+            (
+                "member does not require it",
+                ". ./svc",
+                Some(svc("1.21", "")),
+                None,
+                None,
+                false,
+            ),
+            (
+                "member requires a lower version",
+                ". ./svc",
+                Some(svc("1.21", &req("v1.4.1"))),
+                None,
+                None,
+                false,
+            ),
+            (
+                "member's dependency, sums not yet written",
+                ". ./svc",
+                Some(svc("1.21", mid)),
+                None,
+                None,
+                false,
+            ),
+            (
+                "member's dependency, go.work.sum written",
+                ". ./svc",
+                Some(svc("1.21", mid)),
+                None,
+                Some(zip("v1.5.0")),
+                false,
+            ),
+            (
+                "stale go.work.sum zip line, member requires it",
+                ". ./svc",
+                Some(svc("1.21", &req(VERSION))),
+                None,
+                Some(zip("v1.5.0")),
+                false,
+            ),
+            (
+                "member's dependency, member go.sum",
+                ". ./svc",
+                Some(svc("1.21", mid)),
+                Some(zip("v1.5.0")),
+                None,
+                true,
+            ),
+            (
+                "member requires a higher version",
+                ". ./svc",
+                Some(svc("1.21", &req("v1.5.0"))),
+                Some(zip("v1.5.0")),
+                None,
+                true,
+            ),
+            (
+                "go 1.16 member builds a higher zip",
+                ". ./svc",
+                Some(svc("1.16", &req("v1.4.1"))),
+                Some(zip("v1.5.0")),
+                None,
+                true,
+            ),
+            (
+                "only a higher /go.mod line",
+                ". ./svc",
+                Some(svc("1.21", mid)),
+                None,
+                Some(format!("{MODULE} v1.5.0/go.mod {MOD_H1}\n")),
+                false,
+            ),
+            ("member go.mod missing", ". ./svc", None, None, None, false),
+            (
+                "member outside the root",
+                ". ../svc",
+                None,
+                None,
+                None,
+                false,
+            ),
+            (
+                "member outside the root, higher zip",
+                ". ../svc",
+                None,
+                None,
+                Some(zip("v1.5.0")),
+                false,
+            ),
+            (
+                "root not a member",
+                "./svc",
+                Some(svc("1.21", &req(VERSION))),
+                None,
+                None,
+                false,
+            ),
+            (
+                "root not a member, nothing requires it",
+                "./svc",
+                Some(svc("1.21", "")),
+                None,
+                None,
+                false,
+            ),
+        ] {
+            let p = Project::new();
+            p.write("go.mod", BASE_GO_MOD)
+                .write(
+                    "go.work",
+                    format!(
+                        "go 1.21\n\nuse (\n{}\n)\n\nreplace {MODULE} {VERSION} => {m} {sver}\n",
+                        uses.replace(' ', "\n")
+                    ),
+                )
+                .write(
+                    "go.work.sum",
+                    format!(
+                        "{m} {sver}/go.mod {MOD_H1}\n{}",
+                        work_sum.unwrap_or_default()
+                    ),
+                );
+            if let Some(text) = &svc_mod {
+                p.write("svc/go.mod", text);
+            }
+            if let Some(text) = &svc_sum {
+                p.write("svc/go.sum", text);
+            }
+            let out = run(&p).await;
+            if inert {
+                assert_refs(&out, &[]);
+                assert_eq!(out.diagnostics.len(), 1, "{name}");
+                assert_eq!(out.diagnostics[0].code, DIAG_REF_INVALID, "{name}");
+                assert!(
+                    out.diagnostics[0].detail.contains("selects v1.5.0"),
+                    "{name}"
+                );
+            } else {
+                assert_refs(&out, &[(PURL, UUID_A, WiringMode::Hosted)]);
+                assert!(out.refs[0].integrity_required, "{name}");
+                assert!(!out.refs[0].lockfile_basis_ok(), "{name}");
+                assert_eq!(out.refs[0].locked_integrity, None, "{name}");
+                assert!(out.diagnostics.is_empty(), "{name}: {:?}", out.diagnostics);
+            }
+        }
+    }
+
+    /// A workspace's sum files are only appended to, so the socket zip line
+    /// can outlive the build that wrote it: a member that requires a higher
+    /// version makes even a zip-pinned replace inert.
+    #[tokio::test]
+    async fn workspace_zip_pin_is_inert_under_a_higher_member_require() {
+        let m = gopatch(UUID_A);
+        let sver = "v1.4.2-socketpatch.1";
+        for (member_version, inert) in [(VERSION, false), ("v1.4.1", false), ("v1.5.0", true)] {
+            let p = Project::new();
+            p.write("go.mod", BASE_GO_MOD)
+                .write(
+                    "go.work",
+                    format!(
+                        "go 1.21\n\nuse (\n\t.\n\t./svc\n)\n\nreplace {MODULE} {VERSION} => {m} {sver}\n"
+                    ),
+                )
+                .write(
+                    "go.work.sum",
+                    format!("{m} {sver} {ZIP_H1}\n{m} {sver}/go.mod {MOD_H1}\n"),
+                )
+                .write(
+                    "svc/go.mod",
+                    format!("module example.com/svc\n\ngo 1.21\n\nrequire {MODULE} {member_version}\n"),
+                );
+            let out = run(&p).await;
+            if inert {
+                assert_refs(&out, &[]);
+                assert_eq!(out.diagnostics.len(), 1, "{member_version}");
+                assert_eq!(out.diagnostics[0].code, DIAG_REF_INVALID);
+                assert!(out.diagnostics[0].detail.contains("selects v1.5.0"));
+            } else {
+                assert_refs(&out, &[(PURL, UUID_A, WiringMode::Hosted)]);
+                assert_eq!(
+                    out.refs[0].locked_integrity,
+                    Some(LockIntegrity::GoH1(ZIP_H1.to_string())),
+                    "{member_version}"
+                );
+                assert!(out.diagnostics.is_empty(), "{:?}", out.diagnostics);
+            }
+        }
+    }
+
+    /// A member that cannot be read (outside the root, or missing its
+    /// go.mod) does not hide another member's higher require.
+    #[tokio::test]
+    async fn workspace_unreadable_member_keeps_other_members_requires() {
+        let m = gopatch(UUID_A);
+        let sver = "v1.4.2-socketpatch.1";
+        for extra in ["../outside", "./missing"] {
+            let p = Project::new();
+            p.write("go.mod", BASE_GO_MOD)
+                .write(
+                    "go.work",
+                    format!(
+                        "go 1.21\n\nuse (\n\t.\n\t{extra}\n\t./svc\n)\n\nreplace {MODULE} {VERSION} => {m} {sver}\n"
+                    ),
+                )
+                .write(
+                    "go.work.sum",
+                    format!("{m} {sver} {ZIP_H1}\n{m} {sver}/go.mod {MOD_H1}\n"),
+                )
+                .write(
+                    "svc/go.mod",
+                    format!("module example.com/svc\n\ngo 1.21\n\nrequire {MODULE} v1.5.0\n"),
+                );
+            let out = run(&p).await;
+            assert_refs(&out, &[]);
+            assert!(
+                out.diagnostics
+                    .iter()
+                    .any(|d| d.code == DIAG_REF_INVALID && d.detail.contains("selects v1.5.0")),
+                "{extra}: {:?}",
+                out.diagnostics
+            );
+        }
+    }
+
+    /// go verifies against the sum files of the mode it builds in: in
+    /// workspace mode `go.work.sum` and the members' go.sum (the root's only
+    /// when `.` is a member); under `GOWORK=off` the root go.sum alone, with
+    /// go.work and its replaces ignored.
+    #[tokio::test]
+    async fn sum_files_follow_the_build_mode() {
+        let m = gopatch(UUID_A);
+        let sver = "v1.4.2-socketpatch.1";
+        let pair = go_sum_for(UUID_A, sver);
+        let replace = format!("replace {MODULE} {VERSION} => {m} {sver}\n");
+        let svc = format!("module example.com/svc\n\ngo 1.21\n\nrequire {MODULE} {VERSION}\n");
+        let pinned = |out: &Discovery| {
+            assert_refs(out, &[(PURL, UUID_A, WiringMode::Hosted)]);
+            out.refs[0].locked_integrity.is_some()
+        };
+
+        // Root not a member: its go.sum is not consulted.
+        let p = Project::new();
+        p.write("go.mod", BASE_GO_MOD)
+            .write("go.work", format!("go 1.21\n\nuse ./svc\n\n{replace}"))
+            .write("svc/go.mod", &svc)
+            .write("go.sum", &pair);
+        let out = run(&p).await;
+        assert!(!pinned(&out));
+        assert!(!out.refs[0].lockfile_basis_ok());
+        p.write("svc/go.sum", &pair);
+        assert!(pinned(&run(&p).await));
+
+        // GOWORK=off: the go.work replace does not apply at all.
+        let p = Project::new();
+        p.write("go.mod", BASE_GO_MOD)
+            .write("go.work", format!("go 1.21\n\nuse .\n\n{replace}"))
+            .write("go.work.sum", &pair)
+            .write("go.sum", &pair);
+        assert_refs(&gowork_off(&p).await, &[]);
+        // A go.mod replace is pinned by the root go.sum only.
+        let p = Project::new();
+        p.write("go.mod", format!("{BASE_GO_MOD}\n{replace}"))
+            .write("go.work", "go 1.21\n\nuse .\n")
+            .write("go.work.sum", &pair);
+        assert!(!pinned(&gowork_off(&p).await));
+        p.write("go.sum", &pair);
+        assert!(pinned(&gowork_off(&p).await));
+    }
+
+    /// In a go < 1.17 graph MVS keeps the `/go.mod` line of a version it only
+    /// reads: a `/go.mod`-only pin whose version go.sum shows is not the one
+    /// selected is inert.
+    #[tokio::test]
+    async fn go_mod_line_only_pin_of_an_unselected_version_is_inert() {
+        let m = gopatch(UUID_A);
+        let sver = "v1.4.2-socketpatch.1";
+        let go_mod = format!(
+            "module example.com/app\n\ngo 1.16\n\nrequire example.com/mid v1.0.0\n\n\
+             replace {MODULE} {VERSION} => {m} {sver}\n"
+        );
+        let pin = format!("{m} {sver}/go.mod {MOD_H1}\n");
+        for (extra, inert) in [
+            (
+                format!("{MODULE} v1.5.0 {ZIP_H1}\n{MODULE} v1.5.0/go.mod {MOD_H1}\n"),
+                true,
+            ),
+            (format!("{MODULE} v1.5.0/go.mod {MOD_H1}\n"), false),
+            (format!("{MODULE} v1.4.1 {ZIP_H1}\n"), true),
+            (String::new(), false),
+        ] {
+            let p = Project::new();
+            p.write("go.mod", &go_mod)
+                .write("go.sum", format!("{extra}{pin}"));
+            let out = run(&p).await;
+            if inert {
+                assert_refs(&out, &[]);
+                assert_eq!(out.diagnostics.len(), 1, "{extra}");
+                assert_eq!(out.diagnostics[0].code, DIAG_REF_INVALID);
+                assert!(out.diagnostics[0].detail.contains("is inert"));
+            } else {
+                assert_refs(&out, &[(PURL, UUID_A, WiringMode::Hosted)]);
+                assert!(out.refs[0].lockfile_basis_ok(), "{extra}");
+            }
+        }
+        // With the zip line the socket module is loaded, so it is selected.
+        let p = Project::new();
+        p.write("go.mod", &go_mod).write(
+            "go.sum",
+            format!("{MODULE} v1.5.0 {ZIP_H1}\n{}", go_sum_for(UUID_A, sver)),
+        );
+        assert_refs(&run(&p).await, &[(PURL, UUID_A, WiringMode::Hosted)]);
+    }
+
+    /// go rejects a whole go.sum over one line of the wrong token count, and
+    /// ignores hashes of algorithms it does not know.
+    #[tokio::test]
+    async fn sum_file_parse_rules_follow_go() {
+        let m = gopatch(UUID_A);
+        let sver = "v1.4.2-socketpatch.1";
+        let go_mod = format!("{BASE_GO_MOD}\nreplace {MODULE} {VERSION} => {m} {sver}\n");
+        let pair = go_sum_for(UUID_A, sver);
+        for (go_sum, pinned) in [
+            (format!("a.com/x v1.0.0 h1:x= extra\n{pair}"), false),
+            (format!("a.com/x v1.0.0\n{pair}"), false),
+            (format!("\n  \n{pair}"), true),
+            (format!("{pair}{m} {sver} h2:whatever\n"), true),
+            (format!("{pair}{m} {sver}/go.mod h1:short\n"), false),
+        ] {
+            let p = Project::new();
+            p.write("go.mod", &go_mod).write("go.sum", &go_sum);
+            let out = run(&p).await;
+            assert_refs(&out, &[(PURL, UUID_A, WiringMode::Hosted)]);
+            assert_eq!(out.refs[0].lockfile_basis_ok(), pinned, "{go_sum:?}");
+            assert_eq!(out.refs[0].locked_integrity.is_some(), pinned, "{go_sum:?}");
+        }
+    }
+
     #[tokio::test]
     async fn go_mod_and_go_work_both_wiring_emit_both_refs() {
         // Rule 10: no cross-file precedence — the CLI gates the conflict.
diff --git a/crates/socket-patch-core/src/vex/discover/mod.rs b/crates/socket-patch-core/src/vex/discover/mod.rs
index fd3755207..7f75ab844 100644
--- a/crates/socket-patch-core/src/vex/discover/mod.rs
+++ b/crates/socket-patch-core/src/vex/discover/mod.rs
@@ -103,11 +103,14 @@
 //!    diagnostic) and dedupes. `source_file` is the root-relative name of the
 //!    file the reference was read from.
 //! 8. **Integrity.** Set `locked_integrity` whenever the lock pins the
-//!    artifact bytes. For hosted refs set `integrity_required` iff that
-//!    format's hosted rewriter ALWAYS writes a pin: a pin-less entry is then
-//!    not Socket-written and must not use the not-installed lockfile basis
-//!    (see [`PatchedRef::lockfile_basis_ok`]). Document the per-format
-//!    choice in the extractor. Vendored refs ignore it (the artifact is
+//!    artifact bytes. For hosted refs set `integrity_required` iff a
+//!    pin-less entry in this lock state is not Socket-written: the
+//!    format's hosted rewriter always writes a pin there, and no tool
+//!    legitimately drops it. Such an entry must not use the not-installed
+//!    lockfile basis (see [`PatchedRef::lockfile_basis_ok`]). The choice
+//!    may depend on the lock state (a gem lock without `CHECKSUMS`, a Go
+//!    pin `go mod tidy` pruned to its `/go.mod` line); document it in the
+//!    extractor. Vendored refs ignore it (the artifact is
 //!    hashed).
 //! 9. **Tests** live in the extractor's own file and use the `testing`
 //!    module below (`Project` tempdir builder with fixture copy,
@@ -273,10 +276,11 @@ pub struct PatchedRef {
     /// The content pin the lock records for the wired artifact, if any.
     /// Never `Some(LockIntegrity::None)` (push normalizes it to `None`).
     pub locked_integrity: Option<LockIntegrity>,
-    /// Hosted only: this format's hosted rewriter ALWAYS writes an
-    /// integrity pin, so a missing `locked_integrity` means the entry was
-    /// not Socket-written (hand-edited / degraded) and must not be attested
-    /// from the lockfile alone.
+    /// Hosted only: in this lock state the hosted rewriter always writes an
+    /// integrity pin and no tool legitimately drops it, so a missing
+    /// `locked_integrity` means the entry was not Socket-written
+    /// (hand-edited / degraded) and must not be attested from the lockfile
+    /// alone.
     pub integrity_required: bool,
     /// Hosted only: the Socket URL (artifact, registry index, or source url)
     /// the reference was recovered from, for diagnostics.
diff --git a/docs/ecosystems.md b/docs/ecosystems.md
index 62b0b8556..90ef261f5 100644
--- a/docs/ecosystems.md
+++ b/docs/ecosystems.md
@@ -1443,6 +1443,13 @@ replacement. Go uses committed `go.sum` entries without consulting the checksum
 database for those entries, so a fresh checkout needs no per-machine checksum
 exemption. A mismatched checksum still fails the build. The rewriter removes the
 replaced version's original sum lines to keep the result stable under `go mod tidy`.
+When no package of the patched module is imported, `go mod tidy` drops the zip-hash
+line and the build still works; re-running `scan --mode hosted` writes it back, so a
+later import of the module builds without a `missing go.sum entry` error.
+In a `go.work` workspace `vex` does not attest a pin with only the `/go.mod` line:
+go builds a workspace without keeping each member's `go.mod` complete, so a member's
+dependency can select a newer version of the module that no committed file shows.
+`vex` then needs the patched module in the module cache to attest it.
 A re-pin to a newer patch (a superseding patch uuid, or the same patch republished
 at a new `-socketpatch.<n>` version) also removes the previous Socket module's sum
 lines, so `go mod tidy -diff` stays clean after a patch update.