From b071e8ac26687038e9e1031c2cc66304e7765a71 Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Tue, 27 Oct 2026 16:35:16 -0400
Subject: [PATCH 1/9] Keep Go hosted pins after go mod tidy drops zip line

When nothing imports a package from a hosted-patched Go module (it is
only a transitive requirement), `go mod tidy` keeps just the socket
module's `/go.mod` go.sum line and drops its zip line. The build still
succeeds offline, but VEX discovery required both lines, so the patch
was skipped as `package_not_found` instead of attested.

The `/go.mod` line for the exact socket module+version is now enough to
recognise the pin. Without the zip line the ref has no locked integrity
and is not integrity-required, so it attests from the lockfile: go
compiles none of the module's packages, and the module path carries
the patch uuid. A zip line, when present, must still be the single
well-formed hash and supplies `locked_integrity`. Conflicting hashes or
a malformed line for the socket module+version still mean no pin.

The hosted writer is unchanged: it still writes both lines and refuses
a module outside the build graph.

Assisted-by: Claude Code:claude-opus-5-5
---
 crates/socket-patch-cli/CLI_CONTRACT.md       |   2 +-
 .../tests/e2e_golang_hosted_build.rs          |  94 +++++++++++
 .../tests/e2e_vex_lockfile/golang.rs          |  19 ++-
 .../src/vex/discover/golang.rs                | 150 ++++++++++++++----
 4 files changed, 228 insertions(+), 37 deletions(-)

diff --git a/crates/socket-patch-cli/CLI_CONTRACT.md b/crates/socket-patch-cli/CLI_CONTRACT.md
index 86d5b7805..2c4b5d445 100644
--- a/crates/socket-patch-cli/CLI_CONTRACT.md
+++ b/crates/socket-patch-cli/CLI_CONTRACT.md
@@ -531,7 +531,7 @@ Discovery is read-only, never touches the network, and never fails the run: a ma
 | bun | `bun.lock`; `bun.lockb` only when there is no `bun.lock` (bun reads exactly one) | URL tuple / binary remote-tarball resolution; version from the URL leaf. A user URL or `file:` tarball tuple / record whose `<name>-<ver>.tgz` leaf names the same `name@version` is installed from its own spec, so every ref for that `name@version` is dropped | `.socket/vendor/npm/<uuid>/<name>-<ver>.tgz` tuple / local-tarball resolution | `sha512-…`, required. A 2-tuple that Bun < 1.3.10 re-saved without its digest is still a reference, but it attests only from an installed tree. |
 | vlt | `vlt-lock.json` (lockfileVersion absent, `0` or `1`; a BOM-prefixed, unparseable, non-object or other-version lock is not read: diagnosed, no ref). `vlt.json` (read only for its `modifiers`) and `node_modules/.vlt-lock.json` are never wiring. | a registry node (any segment) whose slot [3] is a `/patch/npm/…` URL on the patch host with the leaf `<bare>-<ver>.tgz` of its DepID's `name@version`, whose embedded `<name>/<ver>` path (when present) is that `name@version`, and slot [1] == name; version from the DepID | a `file` node `.socket/vendor/npm/<uuid>/<name>-<ver>/node_modules/<name>` (or a user-installed `<name>-<ver>.tgz`) with slot [1] == name; version from the path. A same-`name@version` registry node, or a diagnosed Socket-shaped one, beside it is diagnosed, no ref. | slot [2] `sha512-…`, required (a hosted node without one is no reference). A same-`name@version` node on another registry, or a diagnosed Socket-shaped one, keeps the reference but withholds the lockfile basis: only an installed tree whose every store copy verifies attests. So does a lock some vlt release discards, the conditions of `redirect_vlt_lockfile_version_missing`, `redirect_vlt_old_lockfile_ignored` and `redirect_vlt_scalar_registry_ignored` (which in-run `--vex` withholds too): every hosted reference in it keeps no pin, and one `patched_ref_unattributable` names them. |
 | cargo | `Cargo.lock`, `Cargo.toml`, `.cargo/config` (else `.cargo/config.toml`) | `Cargo.lock` `source = "sparse+…/<uuid>/index/"`, confirmed by `Cargo.toml`: a crate the root manifest declares must pin `registry = "socket-patch-<uuid>"`. A reverted pin is diagnosed, no ref. Another `[[package]]` of the same `name@version` from a non-Socket source (crates.io, git), which cargo locks beside the pin for a dependent added later and builds unpatched (#679), withholds the ref (`patched_ref_unattributable`, never attested) while `rollback` / `remove` still unwind it. | `[patch.<source>] <key> = { path = ".socket/vendor/cargo/<uuid>/<name>-<ver>" }` — primarily the root `Cargo.toml` (v5 `vendor`; key-agnostic: `<name>` is `package` when renamed, else the key, so `<name>-socket-<uuid8>` keys count), also the project config (pre-v5 wiring), live only while the lock holds a sourceless entry for it that is not in `[[patch.unused]]`; a manifest entry cargo ignores — the project config redefines its key with another path, or a `[patch."https://github.com/rust-lang/crates.io-index"]` table replaces `[patch.crates-io]` — is diagnosed (`patched_ref_invalid`), no ref | `checksum` (v1: `[metadata]`), required |
-| golang | `go.mod`, `go.work`, `go.sum`, `go.work.sum` | `replace M v => patch.socket.dev/gopatch/<uuid> <sver>` | `replace M v => ./.socket/vendor/golang/<uuid>/M@v` | both go.sum lines, required. A replace that `require` no longer selects (`require M v'`) is inert: diagnosed, no ref. |
+| golang | `go.mod`, `go.work`, `go.sum`, `go.work.sum` | `replace M v => patch.socket.dev/gopatch/<uuid> <sver>` | `replace M v => ./.socket/vendor/golang/<uuid>/M@v` | the socket module's `/go.mod` go.sum line, required. The zip line (`h1:` of the module tree) is the locked integrity when present; `go mod tidy` prunes it when no package of the module is loaded and the build stays green, so the `/go.mod` line alone still attests from the lockfile. A conflicting or malformed line for the socket module+version is no pin. A replace that `require` no longer selects (`require M v'`) is inert: diagnosed, no ref. |
 | pypi | `uv.lock` (confirmed by `pyproject.toml` `[tool.uv.sources]` when present), PEP 723 `<script>.py.lock`, `pylock.toml` / `pylock.<name>.toml`, `poetry.lock`, `pdm.lock`, `Pipfile.lock`, `requirements.txt` + its in-root `-r` includes, PEP 508 direct references in `pyproject.toml` / `hatch.toml` | Socket-host artifact url | `.socket/vendor/pypi/<uuid>/<wheel>` naming the entry's own dist | sha256, required |
 | gem | `Gemfile.lock` and `gems.locked` (the `Gemfile` / `gems.rb` only to cross-check a merged multi-remote `GEM` section) | a `GEM` section whose remote ends `patch-registry/gem/<token>/<uuid>` | `PATH` remote `.socket/vendor/gem/<uuid>/<name>-<ver>` | `CHECKSUMS` sha256, required only when the lock has a `CHECKSUMS` section (bundler ≥ 2.6) |
 | composer | `composer.lock` (`packages` + `packages-dev`) | `dist.url` on the patch host | `dist: {type: "path", url: ".socket/vendor/composer/<uuid>/…", reference: "<uuid>"}` | `dist.shasum`, required |
diff --git a/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs b/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs
index 4d4273eaa..b346cb88b 100644
--- a/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs
@@ -757,3 +757,97 @@ async fn golang_get_uuid_hosted_day2_machine_builds() {
             .unwrap_or_else(|e| std::panic::resume_unwind(e))
     });
 }
+
+/// A go 1.16 graph where the patched module is only a transitive
+/// requirement and nothing imports its packages: `go mod tidy` prunes the
+/// socket module's zip line from the committed pair, the build stays green
+/// on a fresh machine (the zip is never fetched), and discovery still reads
+/// the `/go.mod` line as the hosted pin.
+// #[serial]: see the capstone's note — env mutation vs env iteration.
+#[tokio::test]
+#[serial_test::serial]
+async fn tidy_pruned_zip_line_still_pins_the_hosted_replace() {
+    if !golang_e2e_matrix::toolchain_ready("e2e_golang_hosted_build") {
+        return;
+    }
+    const MID: &str = "example.com/mid";
+    let tmp = tempfile::tempdir().unwrap();
+    let _cleanup = ChmodGuard(tmp.path().to_path_buf());
+    let proxy_url = format!("file://{}", tmp.path().join("proxy").display());
+    let smod = socket_module();
+    let upstream_gomod = format!("module {UMOD}\n\ngo 1.16\n");
+    publish(tmp.path(), UMOD, UVER, &upstream_gomod, PRISTINE_LIB);
+    publish(tmp.path(), &smod, SVER, &upstream_gomod, PATCHED_LIB);
+    publish(
+        tmp.path(),
+        MID,
+        "v1.0.0",
+        &format!("module {MID}\n\ngo 1.16\n\nrequire {UMOD} {UVER}\n"),
+        "package mid\n\nfunc Hello() string { return \"hi\" }\n",
+    );
+    let (zip_h1, gomod_h1) = harvest_sums(tmp.path(), &proxy_url, &smod, SVER);
+    let (mid_zip_h1, mid_gomod_h1) = harvest_sums(tmp.path(), &proxy_url, MID, "v1.0.0");
+
+    // The hosted rewriter's committed shape: the replace plus BOTH lines.
+    let consumer = tmp.path().join("consumer");
+    std::fs::create_dir_all(&consumer).unwrap();
+    std::fs::write(
+        consumer.join("go.mod"),
+        format!(
+            "module example.com/consumer\n\ngo 1.16\n\nrequire {MID} v1.0.0\n\n\
+             replace {UMOD} {UVER} => {smod} {SVER}\n"
+        ),
+    )
+    .unwrap();
+    std::fs::write(
+        consumer.join("go.sum"),
+        format!(
+            "{MID} v1.0.0 {mid_zip_h1}\n{MID} v1.0.0/go.mod {mid_gomod_h1}\n\
+             {smod} {SVER} {zip_h1}\n{smod} {SVER}/go.mod {gomod_h1}\n"
+        ),
+    )
+    .unwrap();
+    std::fs::write(
+        consumer.join("main.go"),
+        format!("package main\n\nimport \"{MID}\"\n\nfunc main() {{ println(mid.Hello()) }}\n"),
+    )
+    .unwrap();
+
+    let env = day2_env(&proxy_url);
+    let m1 = Machine::new(tmp.path(), "machine1");
+    let tidy = go(&consumer, &m1, &["mod", "tidy"], &as_pairs(&env));
+    assert!(
+        tidy.status.success(),
+        "go mod tidy failed: {}",
+        String::from_utf8_lossy(&tidy.stderr)
+    );
+    let go_sum = std::fs::read_to_string(consumer.join("go.sum")).unwrap();
+    assert!(
+        go_sum.contains(&format!("{smod} {SVER}/go.mod {gomod_h1}\n")),
+        "{go_sum}"
+    );
+    assert!(
+        !go_sum.contains(&format!("{smod} {SVER} ")),
+        "tidy must prune the zip line: {go_sum}"
+    );
+
+    let m2 = Machine::new(tmp.path(), "machine2");
+    let build = go(&consumer, &m2, &["build", "./..."], &as_pairs(&env));
+    assert!(
+        build.status.success(),
+        "fresh-machine build after tidy failed: {}",
+        String::from_utf8_lossy(&build.stderr)
+    );
+
+    let discovery = socket_patch_core::vex::discover::discover_patched_refs(&consumer).await;
+    let purl = format!("pkg:golang/{UMOD}@{UVER}");
+    let refs: Vec<_> = discovery.refs.iter().filter(|r| r.purl == purl).collect();
+    assert_eq!(refs.len(), 1, "{:?}", discovery.refs);
+    assert_eq!(refs[0].uuid, UUID);
+    assert!(refs[0].lockfile_basis_ok(), "{:?}", refs[0]);
+    assert!(
+        discovery.diagnostics.is_empty(),
+        "{:?}",
+        discovery.diagnostics
+    );
+}
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/golang.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/golang.rs
index 440f11b83..1645eb5a0 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/golang.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/golang.rs
@@ -35,7 +35,9 @@
 //!   differs from the wiring is `record_mismatch`.
 //! * **g** (hosted) not installed → attests from the go.sum pin (design D5);
 //!   the replacement module installed-and-patched → verified; that copy
-//!   pristine → omitted; a pin-less reference needs a verifying copy.
+//!   pristine → omitted; the `/go.mod` line alone (`go mod tidy` pruned
+//!   the zip line) still attests; a pin-less reference needs a verifying
+//!   copy.
 //!
 //! Flavors: `go.mod` single-line replace, `replace ( … )` block member,
 //! hand-written `go.work` (+ `go.work.sum`), the committed hosted rewriter
@@ -711,8 +713,8 @@ fn golang_hosted_f_spoofed_references_never_attest() {
 
 /// g: only the pristine ORIGINAL `M@v` cached → not installed (the build
 /// never reads it) → the go.sum pin attests; the replacement patched →
-/// verified; the replacement pristine → omitted; no go.sum pin → needs the
-/// verifying replacement.
+/// verified; the replacement pristine → omitted; the tidy `/go.mod`-line
+/// pin → attests; no go.sum pin → needs the verifying replacement.
 #[test]
 fn golang_hosted_g_installed_copy_basis() {
     let api = Api::start(vec![(U, go_view(U))]);
@@ -740,6 +742,17 @@ fn golang_hosted_g_installed_copy_basis() {
     let run = fx.vex(&args);
     assert_omitted(&run, GO_PURL, "not_applied", "replacement pristine");
 
+    // `go mod tidy` drops the zip line when no package of the module is
+    // loaded; nothing downloads the zip, so nothing is installed.
+    let fx = Fx::new();
+    write_go_hosted(&fx, U, GoFile::GoMod);
+    fx.put(
+        "go.sum",
+        format!("{} {GO_SVER}/go.mod {GO_H1_MOD}\n", go_socket_module(U)),
+    );
+    let run = fx.vex(&args);
+    assert_attested(&fx, &run, GO_PURL, U, "redirected", "go.mod line only");
+
     // No (or an incomplete) go.sum pin.
     for (name, sum) in [
         ("no go.sum", None),
diff --git a/crates/socket-patch-core/src/vex/discover/golang.rs b/crates/socket-patch-core/src/vex/discover/golang.rs
index 991775d6c..f926d326c 100644
--- a/crates/socket-patch-core/src/vex/discover/golang.rs
+++ b/crates/socket-patch-core/src/vex/discover/golang.rs
@@ -8,7 +8,7 @@
 //!
 //! | owner | what our tools write | ref |
 //! |---|---|---|
-//! | [`ReplaceOwner::Hosted`] (`scan --mode hosted`, `rewrite_golang`) | `replace M v => patch.socket.dev/gopatch/<uuid> <sver>` + go.sum `patch.socket.dev/gopatch/<uuid> <sver> h1:…` and `…<sver>/go.mod h1:…` | hosted, `integrity_required = true` |
+//! | [`ReplaceOwner::Hosted`] (`scan --mode hosted`, `rewrite_golang`) | `replace M v => patch.socket.dev/gopatch/<uuid> <sver>` + go.sum `patch.socket.dev/gopatch/<uuid> <sver> h1:…` and `…<sver>/go.mod h1:…` (`go mod tidy` may prune the first) | hosted, `integrity_required` iff the zip line is present |
 //! | [`ReplaceOwner::Vendor`] (`vendor`, `vendor_go_module`) | `replace M v => ./.socket/vendor/golang/<uuid>/M@v` | vendored |
 //! | [`ReplaceOwner::GoPatches`] (`apply`'s redirect) | `replace M v => ./.socket/go-patches/M@v` | none — no uuid; the CLI's `synthesize_go_patches` verifies those |
 //!
@@ -32,13 +32,20 @@
 //!   `--patch-server-url` deployment does not change Go module paths, so
 //!   the origin allowlist does not apply here.
 //! * **Pin.** The hosted rewriter refuses to write the replace without BOTH
-//!   go.sum lines, so `integrity_required = true`; the ref's
-//!   `locked_integrity` is the zip line's `h1:` dirhash
-//!   ([`LockIntegrity::GoH1`]) and is set only when the sum file carries
-//!   exactly one well-formed zip hash AND the `/go.mod` line for the Socket
-//!   module+version (anything else is not what the rewriter wrote — and a
-//!   conflicting pair is a go `SECURITY ERROR`). NB for the CLI's
-//!   installed-tree basis: under a hosted replace the module cache's
+//!   go.sum lines, but `go mod tidy` then drops the zip line whenever no
+//!   package of the replaced module is loaded (a transitive module only MVS
+//!   reads keeps just its `/go.mod` line), and the build stays green. So
+//!   the pin is the `/go.mod` line for the Socket module+version: exactly
+//!   one well-formed hash for it, plus at most one well-formed zip hash.
+//!   With the zip line, `integrity_required = true` and `locked_integrity`
+//!   is its `h1:` dirhash ([`LockIntegrity::GoH1`]). Without it (the tidy
+//!   state) `integrity_required = false`: the module path carries the patch
+//!   uuid and go compiles none of its packages, so the pinned replace alone
+//!   is the attestation basis. Anything else — no `/go.mod` line, two
+//!   different hashes for one line (a go `SECURITY ERROR`), a malformed
+//!   line for the Socket module+version (go rejects the whole go.sum) — is
+//!   not a pin: `integrity_required = true`, no `locked_integrity`.
+//!   NB for the CLI's installed-tree basis: under a hosted replace the module cache's
 //!   `M@v` (if any, e.g. from before the redirect) is pristine BY
 //!   CONSTRUCTION — the build consumes `patch.socket.dev/gopatch/<uuid>@<sver>`.
 //! * **Vendored identity** comes from [`vendor_ref`] over the replace PATH
@@ -200,10 +207,12 @@ async fn extract_file(
                     }
                     sums = Some(pins);
                 }
-                let integrity = sums
-                    .as_ref()
-                    .and_then(|s| s.pin(rhs, rhs_version))
-                    .map(LockIntegrity::GoH1);
+                let (integrity, integrity_required) =
+                    match sums.as_ref().map(|s| s.pin(rhs, rhs_version)) {
+                        Some(SumPin::Zip(h1)) => (Some(LockIntegrity::GoH1(h1)), true),
+                        Some(SumPin::GoModOnly) => (None, false),
+                        Some(SumPin::Unpinned) | None => (None, true),
+                    };
                 let url = format!("{rhs}@{rhs_version}");
                 out.push(PatchedRef::hosted(
                     purl,
@@ -211,7 +220,7 @@ async fn extract_file(
                     file,
                     Some(url.as_str()),
                     integrity,
-                    true,
+                    integrity_required,
                 ));
             }
             Some(ReplaceOwner::Vendor) => {
@@ -349,22 +358,47 @@ fn replaced_purl(
 struct SumPins {
     /// Zip-line `h1:` hashes.
     zip: HashMap<(String, String), BTreeSet<String>>,
-    /// `(module, version)`s with a `/go.mod` line.
-    gomod: HashSet<(String, String)>,
+    /// `/go.mod`-line `h1:` hashes.
+    gomod: HashMap<(String, String), BTreeSet<String>>,
+    /// Keys with a line go cannot parse (wrong token count, malformed hash).
+    malformed: HashSet<(String, String)>,
+}
+
+/// What the sum files pin for one Socket `module@version`.
+#[derive(Debug, PartialEq, Eq)]
+enum SumPin {
+    /// Both lines: the zip line's `h1:`.
+    Zip(String),
+    /// Only the `/go.mod` line (`go mod tidy` pruned the zip line).
+    GoModOnly,
+    Unpinned,
 }
 
 impl SumPins {
     fn add(&mut self, text: &str) {
+        // `go_sum_lines` skips a line too short to carry a hash.
+        for line in text.lines() {
+            let tokens: Vec<&str> = line.split_whitespace().collect();
+            if let [module, version] = tokens[..] {
+                if module.starts_with(HOSTED_GO_MODULE_PREFIX) {
+                    let version = version.strip_suffix("/go.mod").unwrap_or(version);
+                    self.malformed
+                        .insert((module.to_string(), version.to_string()));
+                }
+            }
+        }
         for line in go_sum_lines(text) {
-            if line.extra_tokens
-                || !line.module.starts_with(HOSTED_GO_MODULE_PREFIX)
-                || !is_h1_dirhash(line.hash)
-            {
+            if !line.module.starts_with(HOSTED_GO_MODULE_PREFIX) {
                 continue;
             }
             let key = (line.module.to_string(), line.version.to_string());
-            if line.go_mod {
-                self.gomod.insert(key);
+            if line.extra_tokens || !is_h1_dirhash(line.hash) {
+                self.malformed.insert(key);
+            } else if line.go_mod {
+                self.gomod
+                    .entry(key)
+                    .or_default()
+                    .insert(line.hash.to_string());
             } else {
                 self.zip
                     .entry(key)
@@ -374,14 +408,21 @@ impl SumPins {
         }
     }
 
-    /// The zip `h1:` of `module@version` iff the rewriter's full pin is
-    /// present: one unambiguous zip hash plus the `/go.mod` line.
-    fn pin(&self, module: &str, version: &str) -> Option<String> {
+    /// The pin of `module@version`: one unambiguous `/go.mod` hash, and at
+    /// most one zip hash.
+    fn pin(&self, module: &str, version: &str) -> SumPin {
         let key = (module.to_string(), version.to_string());
-        let hashes = self.zip.get(&key)?;
-        (hashes.len() == 1 && self.gomod.contains(&key))
-            .then(|| hashes.iter().next().cloned())
-            .flatten()
+        let one = |hashes: Option<&BTreeSet<String>>| match hashes {
+            Some(h) if h.len() == 1 => h.iter().next().cloned(),
+            _ => None,
+        };
+        if self.malformed.contains(&key) || one(self.gomod.get(&key)).is_none() {
+            return SumPin::Unpinned;
+        }
+        match self.zip.get(&key) {
+            None => SumPin::GoModOnly,
+            some => one(some).map_or(SumPin::Unpinned, SumPin::Zip),
+        }
     }
 }
 
@@ -518,31 +559,74 @@ mod tests {
             let out = run(&p).await;
             assert_refs(&out, &[(PURL, UUID_A, WiringMode::Hosted)]);
             assert_eq!(out.refs[0].locked_integrity, None, "{go_sum:?}");
+            assert!(!out.refs[0].lockfile_basis_ok(), "{go_sum:?}");
         }
     }
 
+    /// `go mod tidy` keeps only the `/go.mod` line of a replaced module whose
+    /// packages nothing imports, and the build stays green: that line alone
+    /// is the pin, with nothing to lock the (never fetched) zip to.
     #[tokio::test]
-    async fn hosted_pin_requires_both_go_sum_lines_and_one_hash() {
+    async fn tidy_pruned_zip_line_leaves_a_go_mod_line_pin() {
+        let m = gopatch(UUID_A);
+        let sver = "v1.4.2-socketpatch.1";
+        let go_mod = format!("{BASE_GO_MOD}\nreplace {MODULE} {VERSION} => {m} {sver}\n");
+        for (file, sum_file) in [("go.mod", "go.sum"), ("go.work", "go.work.sum")] {
+            let p = Project::new();
+            if file == "go.mod" {
+                p.write("go.mod", &go_mod);
+            } else {
+                p.write("go.mod", BASE_GO_MOD).write(
+                    "go.work",
+                    format!("go 1.21\n\nuse .\n\nreplace {MODULE} {VERSION} => {m} {sver}\n"),
+                );
+            }
+            p.write(sum_file, format!("{m} {sver}/go.mod {MOD_H1}\n"));
+            let out = run(&p).await;
+            assert_refs(&out, &[(PURL, UUID_A, WiringMode::Hosted)]);
+            let r = &out.refs[0];
+            assert_eq!(r.locked_integrity, None, "{file}");
+            assert!(!r.integrity_required, "{file}");
+            assert!(r.lockfile_basis_ok(), "{file}");
+            assert!(out.diagnostics.is_empty(), "{:?}", out.diagnostics);
+        }
+    }
+
+    #[tokio::test]
+    async fn hosted_pin_requires_the_go_mod_line_and_one_hash_per_line() {
         let m = gopatch(UUID_A);
         let go_mod =
             format!("{BASE_GO_MOD}\nreplace {MODULE} {VERSION} => {m} v1.4.2-socketpatch.1\n");
         for go_sum in [
             // No go.sum at all.
             None,
-            // Zip line only / go.mod line only.
+            // Zip line only.
             Some(format!("{m} v1.4.2-socketpatch.1 {ZIP_H1}\n")),
-            Some(format!("{m} v1.4.2-socketpatch.1/go.mod {MOD_H1}\n")),
             // Conflicting zip hashes (a union-merged go.sum).
             Some(format!(
                 "{}{m} v1.4.2-socketpatch.1 {MOD_H1}\n",
                 go_sum_for(UUID_A, "v1.4.2-socketpatch.1")
             )),
-            // Pinned at another socket version.
+            // Conflicting `/go.mod` hashes, with and without the zip line.
+            Some(format!(
+                "{}{m} v1.4.2-socketpatch.1/go.mod {ZIP_H1}\n",
+                go_sum_for(UUID_A, "v1.4.2-socketpatch.1")
+            )),
+            Some(format!(
+                "{m} v1.4.2-socketpatch.1/go.mod {MOD_H1}\n{m} v1.4.2-socketpatch.1/go.mod {ZIP_H1}\n"
+            )),
+            // Pinned at another socket version (both lines, or the tidy
+            // `/go.mod` line).
             Some(go_sum_for(UUID_A, "v1.4.2-socketpatch.9")),
-            // Malformed hash.
+            Some(format!("{m} v1.4.2-socketpatch.9/go.mod {MOD_H1}\n")),
+            // Malformed hash, on either line.
             Some(format!(
                 "{m} v1.4.2-socketpatch.1 h1:short\n{m} v1.4.2-socketpatch.1/go.mod {MOD_H1}\n"
             )),
+            Some(format!(
+                "{}{m} v1.4.2-socketpatch.1/go.mod h1:short\n",
+                go_sum_for(UUID_A, "v1.4.2-socketpatch.1")
+            )),
         ] {
             let p = Project::new();
             p.write("go.mod", &go_mod);

From a1bfe6e75084e146911795fa003b247686752466 Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Tue, 27 Oct 2026 16:56:23 -0400
Subject: [PATCH 2/9] Check selection and workspace sums for tidy Go pins

A `/go.mod`-only go.sum line also exists for versions MVS reads but
does not select, so in a go < 1.17 graph a `/go.mod`-only hosted pin
whose version go.sum shows is not selected is now reported as inert
instead of attested.

In workspace mode go verifies against go.work.sum and every member's
go.sum, so discovery now reads those too (in-root members only) and a
member's zip line still supplies the locked integrity.

go.sum parsing now follows go: a line of other than three tokens makes
the whole file unusable, a non-dirhash `h1:` breaks that module's pin,
and hashes of other algorithms are ignored.

Re-running the hosted rewrite over a project `go mod tidy` pruned to
the `/go.mod` line now leaves go.sum alone instead of re-adding the zip
line the next tidy removes again.

Assisted-by: Claude Code:claude-opus-5-5
---
 .../tests/e2e_golang_hosted_build.rs          |  38 +++
 .../src/patch/redirect/mod.rs                 |  40 ++-
 .../src/vendor/go_sum_edit.rs                 |  30 ++
 .../src/vex/discover/golang.rs                | 315 +++++++++++++++---
 .../socket-patch-core/src/vex/discover/mod.rs |  22 +-
 5 files changed, 384 insertions(+), 61 deletions(-)

diff --git a/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs b/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs
index b346cb88b..0e9502e76 100644
--- a/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs
@@ -839,6 +839,44 @@ async fn tidy_pruned_zip_line_still_pins_the_hosted_replace() {
         String::from_utf8_lossy(&build.stderr)
     );
 
+    // Re-running the hosted rewrite leaves the tidy pair alone.
+    let ovr = DepOverride {
+        ecosystem: "golang".into(),
+        name: UMOD.into(),
+        namespace: None,
+        version: UVER.into(),
+        token: String::new(),
+        patch_uuid: UUID.into(),
+        artifact_url: format!("{proxy_url}/{smod}/@v/{SVER}.zip"),
+        registry_override: Some(RegistryOverride {
+            kind: "goproxy".into(),
+            index_url: proxy_url.clone(),
+            identifiers: RegistryOverrideIdentifiers {
+                name: UMOD.into(),
+                version: UVER.into(),
+                go_module_path: Some(smod.clone()),
+                go_module_version: Some(SVER.into()),
+                ..Default::default()
+            },
+        }),
+        integrity: Integrity {
+            dirhash_h1: Some(zip_h1),
+            go_mod_h1: Some(gomod_h1),
+            ..Default::default()
+        },
+    };
+    let files: std::collections::BTreeMap<String, String> = ["go.mod", "go.sum"]
+        .into_iter()
+        .map(|name| {
+            let text = std::fs::read_to_string(consumer.join(name)).unwrap();
+            (name.to_string(), text)
+        })
+        .collect();
+    let rerun = rewrite_registry_redirect(&files, std::slice::from_ref(&ovr));
+    assert!(rerun.warnings.is_empty(), "{:?}", rerun.warnings);
+    assert!(rerun.files.is_empty(), "{:?}", rerun.files);
+    assert!(rerun.confirmed_golang_uuids.contains(UUID));
+
     let discovery = socket_patch_core::vex::discover::discover_patched_refs(&consumer).await;
     let purl = format!("pkg:golang/{UMOD}@{UVER}");
     let refs: Vec<_> = discovery.refs.iter().filter(|r| r.purl == purl).collect();
diff --git a/crates/socket-patch-core/src/patch/redirect/mod.rs b/crates/socket-patch-core/src/patch/redirect/mod.rs
index 0b1e6e400..246a705b2 100644
--- a/crates/socket-patch-core/src/patch/redirect/mod.rs
+++ b/crates/socket-patch-core/src/patch/redirect/mod.rs
@@ -9410,7 +9410,16 @@ fn rewrite_golang(
                 }
             }
         }
-        if go_sum.upsert_module_lines(rhs_module, rhs_version, zip_h1, gomod_h1) {
+        // A re-run over a project `go mod tidy` left with only the `/go.mod`
+        // line (no package of the module is loaded) is already pinned:
+        // re-adding the zip line would only churn the next tidy.
+        let tidied = prior.is_some_and(|e| {
+            e.owner == Some(go_mod_edit::ReplaceOwner::Hosted)
+                && e.version.as_deref() == Some(dep.version.as_str())
+                && e.rhs_module.as_deref() == Some(rhs_module.as_str())
+                && e.rhs_version.as_deref() == Some(rhs_version.as_str())
+        }) && go_sum.holds_only_go_mod_line(rhs_module, rhs_version, gomod_h1);
+        if !tidied && go_sum.upsert_module_lines(rhs_module, rhs_version, zip_h1, gomod_h1) {
             sum_changed = true;
             result.edits.push(FileEdit {
                 path: "go.sum".into(),
@@ -23111,6 +23120,35 @@ packages:
         assert!(refused.confirmed_golang_uuids.is_empty());
     }
 
+    /// `go mod tidy` drops the socket module's zip line when no package of it
+    /// is loaded; a re-run leaves that pair alone and still confirms.
+    #[test]
+    fn golang_rerun_keeps_a_tidy_pruned_pair() {
+        let files = golang_files();
+        let ovr = golang_override();
+        let first = rewrite_registry_redirect(&files, std::slice::from_ref(&ovr));
+        let zip_prefix = format!("{} v1.4.2-socketpatch.1 ", golang_socket_module());
+        let tidied: String = first.files["go.sum"]
+            .lines()
+            .filter(|l| !l.starts_with(&zip_prefix))
+            .map(|l| format!("{l}\n"))
+            .collect();
+        assert_ne!(tidied, first.files["go.sum"]);
+        let mut again = files.clone();
+        again.extend(first.files.clone());
+        again.insert("go.sum".to_string(), tidied.clone());
+        let second = rewrite_registry_redirect(&again, std::slice::from_ref(&ovr));
+        assert!(second.files.is_empty(), "{:?}", second.files);
+        assert!(second.confirmed_golang_uuids.contains(GO_UUID));
+
+        // A `/go.mod` line with another hash is not the pin: rewritten.
+        let mod_h1 = ovr.integrity.go_mod_h1.clone().unwrap();
+        let wrong = tidied.replace(&mod_h1, "h1:CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC=");
+        again.insert("go.sum".to_string(), wrong);
+        let third = rewrite_registry_redirect(&again, std::slice::from_ref(&ovr));
+        assert_eq!(third.files["go.sum"], first.files["go.sum"]);
+    }
+
     /// Only `patch.socket.dev/gopatch/<canonical uuid>` is a hosted module;
     /// anything deeper would be written but never recognized as ours again.
     #[test]
diff --git a/crates/socket-patch-core/src/vendor/go_sum_edit.rs b/crates/socket-patch-core/src/vendor/go_sum_edit.rs
index 6c5fcceb4..c0c2b9a8e 100644
--- a/crates/socket-patch-core/src/vendor/go_sum_edit.rs
+++ b/crates/socket-patch-core/src/vendor/go_sum_edit.rs
@@ -223,6 +223,22 @@ impl GoSumEditor {
             .chain(lines.into_iter().flatten())
     }
 
+    /// True when the only line for `module@version` is exactly its wanted
+    /// `/go.mod` line: what `go mod tidy` leaves of the pair when no package
+    /// of the module is loaded.
+    pub(crate) fn holds_only_go_mod_line(
+        &self,
+        module: &str,
+        version: &str,
+        gomod_h1: &str,
+    ) -> bool {
+        let want = format!("{module} {version}/go.mod {gomod_h1}");
+        let mut key_lines = self
+            .current_lines()
+            .filter(|l| is_version_line(l, module, version));
+        key_lines.next() == Some(want.as_str()) && key_lines.next().is_none()
+    }
+
     /// Upsert the two `go.sum` lines for `module@version`. Any existing lines
     /// for exactly that module+version (either suffix form) are replaced;
     /// everything else — including stale lines for the *replaced* original
@@ -452,6 +468,20 @@ mod tests {
         Some((editor.into_string(), removed))
     }
 
+    #[test]
+    fn only_the_exact_go_mod_line_is_the_tidy_pair() {
+        let gomod = format!("{MOD} {VER}/go.mod {GOMOD_H1}\n");
+        let holds = |text: &str| {
+            GoSumEditor::new(text.to_string()).holds_only_go_mod_line(MOD, VER, GOMOD_H1)
+        };
+        assert!(holds(&gomod));
+        assert!(holds(&format!("a.com/x v1.0.0 h1:x=\n{gomod}")));
+        assert!(!holds(""));
+        assert!(!holds(&format!("{MOD} {VER} {ZIP_H1}\n{gomod}")));
+        assert!(!holds(&format!("{MOD} {VER}/go.mod {ZIP_H1}\n")));
+        assert!(!holds(&format!("{gomod}{gomod}")));
+    }
+
     #[test]
     fn creates_from_empty_and_is_idempotent() {
         let out = upsert_module_lines("", MOD, VER, ZIP_H1, GOMOD_H1).unwrap();
diff --git a/crates/socket-patch-core/src/vex/discover/golang.rs b/crates/socket-patch-core/src/vex/discover/golang.rs
index f926d326c..7470b96a5 100644
--- a/crates/socket-patch-core/src/vex/discover/golang.rs
+++ b/crates/socket-patch-core/src/vex/discover/golang.rs
@@ -41,10 +41,18 @@
 //!   is its `h1:` dirhash ([`LockIntegrity::GoH1`]). Without it (the tidy
 //!   state) `integrity_required = false`: the module path carries the patch
 //!   uuid and go compiles none of its packages, so the pinned replace alone
-//!   is the attestation basis. Anything else — no `/go.mod` line, two
-//!   different hashes for one line (a go `SECURITY ERROR`), a malformed
-//!   line for the Socket module+version (go rejects the whole go.sum) — is
-//!   not a pin: `integrity_required = true`, no `locked_integrity`.
+//!   is the attestation basis — but MVS also keeps the `/go.mod` line of a
+//!   version it reads and does not select, so a `/go.mod`-only pin whose
+//!   version go.sum shows is not selected ([`go_build_list::select`]) is
+//!   inert: diagnosed, no ref. Anything else — no `/go.mod` line, two
+//!   different hashes for one line, a non-dirhash `h1:` (both a go
+//!   `SECURITY ERROR`), a line of other than three tokens anywhere in a
+//!   sum file (go rejects the whole file) — is not a pin:
+//!   `integrity_required = true`, no `locked_integrity`. Hashes of other
+//!   algorithms are ignored, as go ignores them. The sum files are the
+//!   root `go.sum` and, with a `go.work`, `go.work.sum` and each in-root
+//!   `use` member's `go.sum` (go verifies against all of them, so a
+//!   member's go.sum may hold the zip line).
 //!   NB for the CLI's installed-tree basis: under a hosted replace the module cache's
 //!   `M@v` (if any, e.g. from before the redirect) is pristine BY
 //!   CONSTRUCTION — the build consumes `patch.socket.dev/gopatch/<uuid>@<sver>`.
@@ -73,10 +81,11 @@
 //!   `replace` grammar and paths relative to the (root) workspace dir; its
 //!   refs are emitted with `source_file = "go.work"`, versions checked
 //!   against the ROOT `go.mod`'s `require` (the only one discovery reads),
-//!   and hosted pins looked up in `go.work.sum`, then `go.sum`. go.work
+//!   and hosted pins looked up in the sum files above. go.work
 //!   replaces override go.mod replaces in Go, but rule 10 leaves
 //!   cross-file precedence to the CLI's `wiring_conflict` gate. Nested
-//!   workspace members' go.mod files are not read (root-only, rule 1).
+//!   workspace members' go.mod files are not read (root-only, rule 1);
+//!   only their go.sum pins are.
 //! * **Hand-edit tolerance**: a UTF-8 BOM, CRLF line ends, tab-separated
 //!   tokens, `replace(` without a space, `// comments`, and Go string
 //!   literals (`"github.com/foo/bar"`, `` `…` ``) around escape- and
@@ -93,7 +102,9 @@ use super::{
     golang_purl, vendor_ref, vendored_leaf_purl, DiscoverCtx, Discovery, PatchedRef,
     DIAG_LOCKFILE_UNPARSEABLE, DIAG_REF_INVALID, DIAG_REF_UNATTRIBUTABLE,
 };
+use crate::patch::apply::is_safe_relative_subpath;
 use crate::patch::path_safety::is_safe_single_segment;
+use crate::vendor::go_build_list;
 use crate::vendor::go_mod_edit::{
     self, block_structure_error, hosted_module_uuid, normalize_for_read, ReplaceEntry,
     ReplaceOwner, HOSTED_GO_MODULE_PREFIX,
@@ -111,23 +122,50 @@ pub(crate) async fn extract(ctx: &DiscoverCtx<'_>, out: &mut Discovery) {
         Some(text) => parse_go_file(GO_MOD, &text, out),
         None => None,
     };
-    // `require` of the root module: the version the build selects (as far
-    // as a root-only reader can tell).
     let required: HashMap<String, String> = go_mod
         .as_deref()
         .map(go_mod_edit::parse_required_versions)
         .unwrap_or_default();
 
-    if let Some(text) = go_mod.as_deref() {
-        extract_file(ctx, out, GO_MOD, text, &required, &[GO_SUM]).await;
-    }
-    if let Some(text) = ctx.read_text(GO_WORK, out).await {
-        if let Some(text) = parse_go_file(GO_WORK, &text, out) {
-            extract_file(ctx, out, GO_WORK, &text, &required, &[GO_WORK_SUM, GO_SUM]).await;
-        }
+    let go_work = match ctx.read_text(GO_WORK, out).await {
+        Some(text) => parse_go_file(GO_WORK, &text, out),
+        None => None,
+    };
+    let files: Vec<(&str, Vec<ReplaceEntry>)> = [(GO_MOD, &go_mod), (GO_WORK, &go_work)]
+        .into_iter()
+        .filter_map(|(file, text)| {
+            Some((file, go_mod_edit::parse_replace_entries(text.as_deref()?)))
+        })
+        .collect();
+    let any_hosted = files
+        .iter()
+        .flat_map(|(_, entries)| entries)
+        .any(|e| e.owner == Some(ReplaceOwner::Hosted));
+    let sums = if any_hosted {
+        SumPins::read(ctx, out, go_work.as_deref()).await
+    } else {
+        SumPins::default()
+    };
+    let graph = Graph {
+        pruned: go_mod
+            .as_deref()
+            .is_some_and(go_mod_edit::prunes_module_graph),
+        required,
+    };
+    for (file, entries) in &files {
+        extract_file(out, file, entries, &graph, &sums);
     }
 }
 
+/// The root module's build-list evidence.
+struct Graph {
+    /// go >= 1.17: `require` lists every module that provides a package.
+    pruned: bool,
+    /// `require` of the root module: the version the build selects (as far
+    /// as a root-only reader can tell).
+    required: HashMap<String, String>,
+}
+
 /// Normalize a go.mod-grammar file (BOM, simple string literals) and check
 /// its block structure; `None` (with a diagnostic) when go could not parse
 /// it at all.
@@ -145,24 +183,21 @@ fn parse_go_file(file: &str, text: &str, out: &mut Discovery) -> Option<String>
 }
 
 /// Emit the refs of one parsed file's Socket-owned `replace` directives.
-async fn extract_file(
-    ctx: &DiscoverCtx<'_>,
+fn extract_file(
     out: &mut Discovery,
     file: &str,
-    text: &str,
-    required: &HashMap<String, String>,
-    sum_files: &[&str],
+    entries: &[ReplaceEntry],
+    graph: &Graph,
+    sums: &SumPins,
 ) {
-    let entries = go_mod_edit::parse_replace_entries(text);
+    let required = &graph.required;
     // Versioned directives of ANY owner: they shadow a version-less replace
     // of the same module at that version.
     let versioned: HashSet<(&str, &str)> = entries
         .iter()
         .filter_map(|e| Some((e.module.as_str(), e.version.as_deref()?)))
         .collect();
-    let mut sums: Option<SumPins> = None;
-
-    for entry in &entries {
+    for entry in entries {
         match entry.owner {
             Some(ReplaceOwner::Hosted) => {
                 let Some(rhs) = entry.rhs_module.as_deref() else {
@@ -198,21 +233,33 @@ async fn extract_file(
                 let Some(purl) = replaced_purl(entry, required, &versioned, file, out) else {
                     continue;
                 };
-                if sums.is_none() {
-                    let mut pins = SumPins::default();
-                    for sum in sum_files {
-                        if let Some(sum_text) = ctx.read_text(sum, out).await {
-                            pins.add(&sum_text);
+                let (integrity, integrity_required) = match sums.pin(rhs, rhs_version) {
+                    SumPin::Zip(h1) => (Some(LockIntegrity::GoH1(h1)), true),
+                    SumPin::GoModOnly => {
+                        // MVS reads (and go.sum keeps the `/go.mod` line of)
+                        // versions it does not select; only a zip line shows
+                        // the replaced version is the one built.
+                        let req = required.get(&entry.module).map(String::as_str);
+                        // `replaced_purl` resolved one of the two.
+                        let version = entry.version.as_deref().or(req).unwrap_or_default();
+                        let zips = sums.zip_versions(&entry.module);
+                        let selected = go_build_list::select(graph.pruned, req, &zips, version);
+                        if let Some(other) = selected.other_version() {
+                            out.diag(
+                                DIAG_REF_INVALID,
+                                file,
+                                format!(
+                                    "{file}: replace {} {version} is inert: go.sum shows the \
+                                     build selects {other}, so it uses the unpatched module",
+                                    entry.module
+                                ),
+                            );
+                            continue;
                         }
+                        (None, false)
                     }
-                    sums = Some(pins);
-                }
-                let (integrity, integrity_required) =
-                    match sums.as_ref().map(|s| s.pin(rhs, rhs_version)) {
-                        Some(SumPin::Zip(h1)) => (Some(LockIntegrity::GoH1(h1)), true),
-                        Some(SumPin::GoModOnly) => (None, false),
-                        Some(SumPin::Unpinned) | None => (None, true),
-                    };
+                    SumPin::Unpinned => (None, true),
+                };
                 let url = format!("{rhs}@{rhs_version}");
                 out.push(PatchedRef::hosted(
                     purl,
@@ -353,15 +400,21 @@ fn replaced_purl(
     purl
 }
 
-/// go.sum pins of Socket hosted modules, keyed `(module, version)`.
+/// go.sum pins of Socket hosted modules, keyed `(module, version)`, from
+/// every sum file go verifies against.
 #[derive(Default)]
 struct SumPins {
     /// Zip-line `h1:` hashes.
     zip: HashMap<(String, String), BTreeSet<String>>,
     /// `/go.mod`-line `h1:` hashes.
     gomod: HashMap<(String, String), BTreeSet<String>>,
-    /// Keys with a line go cannot parse (wrong token count, malformed hash).
+    /// Keys with an `h1:` hash that is not a dirhash: go fails the
+    /// comparison with a `SECURITY ERROR`.
     malformed: HashSet<(String, String)>,
+    /// A sum file has a line go cannot parse, so every build fails.
+    unparseable: bool,
+    /// Every module's zip-line versions (the build-list evidence).
+    zip_versions: HashMap<String, Vec<String>>,
 }
 
 /// What the sum files pin for one Socket `module@version`.
@@ -375,24 +428,52 @@ enum SumPin {
 }
 
 impl SumPins {
-    fn add(&mut self, text: &str) {
-        // `go_sum_lines` skips a line too short to carry a hash.
-        for line in text.lines() {
-            let tokens: Vec<&str> = line.split_whitespace().collect();
-            if let [module, version] = tokens[..] {
-                if module.starts_with(HOSTED_GO_MODULE_PREFIX) {
-                    let version = version.strip_suffix("/go.mod").unwrap_or(version);
-                    self.malformed
-                        .insert((module.to_string(), version.to_string()));
+    /// The root `go.sum`; in workspace mode also `go.work.sum` and each
+    /// in-root `use` member's `go.sum`, which go verifies against too.
+    async fn read(ctx: &DiscoverCtx<'_>, out: &mut Discovery, go_work: Option<&str>) -> Self {
+        let mut files = vec![GO_SUM.to_string()];
+        if let Some(work) = go_work {
+            files.push(GO_WORK_SUM.to_string());
+            for dir in go_mod_edit::parse_use_dirs(work) {
+                if let Some(rel) = member_go_sum(&dir) {
+                    if !files.contains(&rel) {
+                        files.push(rel);
+                    }
                 }
             }
         }
+        let mut pins = SumPins::default();
+        for file in &files {
+            if let Some(text) = ctx.read_text(file, out).await {
+                pins.add(&text);
+            }
+        }
+        pins
+    }
+
+    fn add(&mut self, text: &str) {
+        // go rejects a whole go.sum with any non-blank line of other than
+        // three tokens (only `go mod tidy` skips it).
+        if text
+            .lines()
+            .any(|l| !matches!(l.split_whitespace().count(), 0 | 3))
+        {
+            self.unparseable = true;
+            return;
+        }
         for line in go_sum_lines(text) {
-            if !line.module.starts_with(HOSTED_GO_MODULE_PREFIX) {
+            if !line.go_mod {
+                self.zip_versions
+                    .entry(line.module.to_string())
+                    .or_default()
+                    .push(line.version.to_string());
+            }
+            // go ignores hashes of algorithms it does not know.
+            if !line.module.starts_with(HOSTED_GO_MODULE_PREFIX) || !line.hash.starts_with("h1:") {
                 continue;
             }
             let key = (line.module.to_string(), line.version.to_string());
-            if line.extra_tokens || !is_h1_dirhash(line.hash) {
+            if !is_h1_dirhash(line.hash) {
                 self.malformed.insert(key);
             } else if line.go_mod {
                 self.gomod
@@ -416,7 +497,8 @@ impl SumPins {
             Some(h) if h.len() == 1 => h.iter().next().cloned(),
             _ => None,
         };
-        if self.malformed.contains(&key) || one(self.gomod.get(&key)).is_none() {
+        if self.unparseable || self.malformed.contains(&key) || one(self.gomod.get(&key)).is_none()
+        {
             return SumPin::Unpinned;
         }
         match self.zip.get(&key) {
@@ -424,6 +506,30 @@ impl SumPins {
             some => one(some).map_or(SumPin::Unpinned, SumPin::Zip),
         }
     }
+
+    fn zip_versions(&self, module: &str) -> Vec<&str> {
+        self.zip_versions
+            .get(module)
+            .map(|v| v.iter().map(String::as_str).collect())
+            .unwrap_or_default()
+    }
+}
+
+/// Root-relative `go.sum` of a `go.work` `use` member; `None` for the root
+/// itself (already read) and for a member outside the root.
+fn member_go_sum(dir: &str) -> Option<String> {
+    let dir = dir.replace('\\', "/");
+    if !is_safe_relative_subpath(&dir) {
+        return None;
+    }
+    let segments: Vec<&str> = dir
+        .split('/')
+        .filter(|s| !s.is_empty() && *s != ".")
+        .collect();
+    if segments.is_empty() {
+        return None;
+    }
+    Some(format!("{}/{GO_SUM}", segments.join("/")))
 }
 
 #[cfg(test)]
@@ -736,6 +842,113 @@ mod tests {
         assert!(r.lockfile_basis_ok());
     }
 
+    /// In workspace mode go verifies against every member's go.sum, so the
+    /// zip line may live there; a member outside the root is not read.
+    #[tokio::test]
+    async fn workspace_member_go_sum_holds_the_zip_line() {
+        let m = gopatch(UUID_A);
+        let sver = "v1.4.2-socketpatch.1";
+        let go_mod = format!("{BASE_GO_MOD}\nreplace {MODULE} {VERSION} => {m} {sver}\n");
+        for (use_dir, member_sum, pinned) in [
+            ("./svc", "svc/go.sum", true),
+            ("svc/", "svc/go.sum", true),
+            ("../svc", "../svc/go.sum", false),
+        ] {
+            let p = Project::new();
+            p.write("go.mod", &go_mod)
+                .write(
+                    "go.work",
+                    format!("go 1.21\n\nuse (\n\t.\n\t{use_dir}\n)\n"),
+                )
+                .write("go.sum", format!("{m} {sver}/go.mod {MOD_H1}\n"));
+            if pinned {
+                p.write(member_sum, format!("{m} {sver} {ZIP_H1}\n"));
+            }
+            let out = run(&p).await;
+            assert_refs(&out, &[(PURL, UUID_A, WiringMode::Hosted)]);
+            let r = &out.refs[0];
+            if pinned {
+                assert_eq!(
+                    r.locked_integrity,
+                    Some(LockIntegrity::GoH1(ZIP_H1.to_string())),
+                    "{use_dir}"
+                );
+                assert!(r.integrity_required);
+            } else {
+                assert_eq!(r.locked_integrity, None, "{use_dir}");
+            }
+            assert!(r.lockfile_basis_ok(), "{use_dir}");
+        }
+    }
+
+    /// In a go < 1.17 graph MVS keeps the `/go.mod` line of a version it only
+    /// reads: a `/go.mod`-only pin whose version go.sum shows is not the one
+    /// selected is inert.
+    #[tokio::test]
+    async fn go_mod_line_only_pin_of_an_unselected_version_is_inert() {
+        let m = gopatch(UUID_A);
+        let sver = "v1.4.2-socketpatch.1";
+        let go_mod = format!(
+            "module example.com/app\n\ngo 1.16\n\nrequire example.com/mid v1.0.0\n\n\
+             replace {MODULE} {VERSION} => {m} {sver}\n"
+        );
+        let pin = format!("{m} {sver}/go.mod {MOD_H1}\n");
+        for (extra, inert) in [
+            (
+                format!("{MODULE} v1.5.0 {ZIP_H1}\n{MODULE} v1.5.0/go.mod {MOD_H1}\n"),
+                true,
+            ),
+            (format!("{MODULE} v1.5.0/go.mod {MOD_H1}\n"), false),
+            (format!("{MODULE} v1.4.1 {ZIP_H1}\n"), true),
+            (String::new(), false),
+        ] {
+            let p = Project::new();
+            p.write("go.mod", &go_mod)
+                .write("go.sum", format!("{extra}{pin}"));
+            let out = run(&p).await;
+            if inert {
+                assert_refs(&out, &[]);
+                assert_eq!(out.diagnostics.len(), 1, "{extra}");
+                assert_eq!(out.diagnostics[0].code, DIAG_REF_INVALID);
+                assert!(out.diagnostics[0].detail.contains("is inert"));
+            } else {
+                assert_refs(&out, &[(PURL, UUID_A, WiringMode::Hosted)]);
+                assert!(out.refs[0].lockfile_basis_ok(), "{extra}");
+            }
+        }
+        // With the zip line the socket module is loaded, so it is selected.
+        let p = Project::new();
+        p.write("go.mod", &go_mod).write(
+            "go.sum",
+            format!("{MODULE} v1.5.0 {ZIP_H1}\n{}", go_sum_for(UUID_A, sver)),
+        );
+        assert_refs(&run(&p).await, &[(PURL, UUID_A, WiringMode::Hosted)]);
+    }
+
+    /// go rejects a whole go.sum over one line of the wrong token count, and
+    /// ignores hashes of algorithms it does not know.
+    #[tokio::test]
+    async fn sum_file_parse_rules_follow_go() {
+        let m = gopatch(UUID_A);
+        let sver = "v1.4.2-socketpatch.1";
+        let go_mod = format!("{BASE_GO_MOD}\nreplace {MODULE} {VERSION} => {m} {sver}\n");
+        let pair = go_sum_for(UUID_A, sver);
+        for (go_sum, pinned) in [
+            (format!("a.com/x v1.0.0 h1:x= extra\n{pair}"), false),
+            (format!("a.com/x v1.0.0\n{pair}"), false),
+            (format!("\n  \n{pair}"), true),
+            (format!("{pair}{m} {sver} h2:whatever\n"), true),
+            (format!("{pair}{m} {sver}/go.mod h1:short\n"), false),
+        ] {
+            let p = Project::new();
+            p.write("go.mod", &go_mod).write("go.sum", &go_sum);
+            let out = run(&p).await;
+            assert_refs(&out, &[(PURL, UUID_A, WiringMode::Hosted)]);
+            assert_eq!(out.refs[0].lockfile_basis_ok(), pinned, "{go_sum:?}");
+            assert_eq!(out.refs[0].locked_integrity.is_some(), pinned, "{go_sum:?}");
+        }
+    }
+
     #[tokio::test]
     async fn go_mod_and_go_work_both_wiring_emit_both_refs() {
         // Rule 10: no cross-file precedence — the CLI gates the conflict.
diff --git a/crates/socket-patch-core/src/vex/discover/mod.rs b/crates/socket-patch-core/src/vex/discover/mod.rs
index fd3755207..7f75ab844 100644
--- a/crates/socket-patch-core/src/vex/discover/mod.rs
+++ b/crates/socket-patch-core/src/vex/discover/mod.rs
@@ -103,11 +103,14 @@
 //!    diagnostic) and dedupes. `source_file` is the root-relative name of the
 //!    file the reference was read from.
 //! 8. **Integrity.** Set `locked_integrity` whenever the lock pins the
-//!    artifact bytes. For hosted refs set `integrity_required` iff that
-//!    format's hosted rewriter ALWAYS writes a pin: a pin-less entry is then
-//!    not Socket-written and must not use the not-installed lockfile basis
-//!    (see [`PatchedRef::lockfile_basis_ok`]). Document the per-format
-//!    choice in the extractor. Vendored refs ignore it (the artifact is
+//!    artifact bytes. For hosted refs set `integrity_required` iff a
+//!    pin-less entry in this lock state is not Socket-written: the
+//!    format's hosted rewriter always writes a pin there, and no tool
+//!    legitimately drops it. Such an entry must not use the not-installed
+//!    lockfile basis (see [`PatchedRef::lockfile_basis_ok`]). The choice
+//!    may depend on the lock state (a gem lock without `CHECKSUMS`, a Go
+//!    pin `go mod tidy` pruned to its `/go.mod` line); document it in the
+//!    extractor. Vendored refs ignore it (the artifact is
 //!    hashed).
 //! 9. **Tests** live in the extractor's own file and use the `testing`
 //!    module below (`Project` tempdir builder with fixture copy,
@@ -273,10 +276,11 @@ pub struct PatchedRef {
     /// The content pin the lock records for the wired artifact, if any.
     /// Never `Some(LockIntegrity::None)` (push normalizes it to `None`).
     pub locked_integrity: Option<LockIntegrity>,
-    /// Hosted only: this format's hosted rewriter ALWAYS writes an
-    /// integrity pin, so a missing `locked_integrity` means the entry was
-    /// not Socket-written (hand-edited / degraded) and must not be attested
-    /// from the lockfile alone.
+    /// Hosted only: in this lock state the hosted rewriter always writes an
+    /// integrity pin and no tool legitimately drops it, so a missing
+    /// `locked_integrity` means the entry was not Socket-written
+    /// (hand-edited / degraded) and must not be attested from the lockfile
+    /// alone.
     pub integrity_required: bool,
     /// Hosted only: the Socket URL (artifact, registry index, or source url)
     /// the reference was recovered from, for diagnostics.

From 14057c8a66d540ef381e59e0f315c2511b65af51 Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Tue, 27 Oct 2026 16:56:33 -0400
Subject: [PATCH 3/9] Document tidy Go pin rules in the CLI contract

Assisted-by: Claude Code:claude-opus-5-5
---
 crates/socket-patch-cli/CLI_CONTRACT.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/crates/socket-patch-cli/CLI_CONTRACT.md b/crates/socket-patch-cli/CLI_CONTRACT.md
index 2c4b5d445..ccf08ecb4 100644
--- a/crates/socket-patch-cli/CLI_CONTRACT.md
+++ b/crates/socket-patch-cli/CLI_CONTRACT.md
@@ -323,7 +323,7 @@ For a **9.0 root lock**, the CLI ensures `pnpm-workspace.yaml` carries `trustLoc
 
 **Vendored entries and the rest of the CLI.** Because nothing is in the manifest, vendored patches are invisible to `apply` (nothing to apply in place) but fully visible to `list` (listed from the ledger, labeled `Mode: vendored (recorded in .socket/vendor/state.json)` in human mode, exit 0 on a vendored-only project), `vex` (attested from the embedded records while a lockfile still wires the artifact — see "Manifest-less VEX"), `repair` (health-checked and rebuilt from the ledger), and `scan --prune` (lockfile-driven reconcile). They are exempt from standalone `vendor`'s manifest reconcile (`reconcile_dropped` never touches `detached` entries) and exit via `remove <purl>` (which reverts them), `vendor --revert`, or `rollback`, whose vendored leg reverts every in-scope ledger entry (unscoped and identifier-scoped runs; path-scoped runs reach them only when an installed copy matches).
 
-`scan --mode hosted` swaps the in-place apply for the registry-redirect pipeline: discover → resolve hosted-patch references (grant token + integrity + per-dep registry override) → rewrite ONLY the patched dependencies' lockfile / registry-config entries to point at the hosted packages. A dep counts as **redirected** only when its hosted-artifact URL (or per-dep registry index URL) actually landed in a project file — a granted reference whose rewriter found nothing to edit is neither counted nor attested. **No ledger (v5.0)**: hosted mode writes ONLY the lockfile / registry-config edits — `.socket/vendor/redirect-state.json` is never written (on success or failure), and a pre-v5 one on disk is ignored (never read for planning, never quarantined, left byte-identical). The lockfiles are the only record of a hosted patch: `list`, `vex`, `rollback`, `remove`, `vendor` and `repair` all discover the hosted pins from them (a hosted URL counts only on `https://patch.socket.dev` or the `--patch-server-url` / `SOCKET_PATCH_SERVER_URL` origin), and commit-ready output is just the lockfile / config changes. Cargo and golang are confirmed only by their rewriter's own report (`confirmed_cargo_uuids` / `confirmed_golang_uuids`): a golang dep counts only when its go.mod `replace M V => patch.socket.dev/gopatch/<uuid> <sver>` and both go.sum lines are in place, never because the patch-server origin or leftover go.sum lines appear somewhere. Gradle is confirmed the same way (`confirmed_gradle_uuids`): only when the final files hold the owned script, the index row, the live apply line in every build's settings file and the suffixed version in every lock entry of the GA (see [Gradle builds](#gradle-builds-v50)). A golang module that go.mod does not require and go.sum has no zip (`h1:` of the module tree) line for at the patched version is outside the build graph and is refused with `redirect_golang_not_in_module_graph` (nothing written); a `/go.mod`-only line doesn't count, since go writes one for every version MVS reads (#509). In a go < 1.17 graph, where `require` holds only lower bounds, the build selects the highest of the required version and go.sum's zip-line versions, and a patch for a lower version warns `redirect_golang_version_mismatch` (nothing written). Only the exact module `patch.socket.dev/gopatch/<canonical uuid>` is socket-owned; any other module path is refused with `redirect_golang_untrusted_module_path`. A vendored golang module is taken over like cargo and the npm family: its vendor wiring, committed copy and ledger entry are reverted first (`redirect_takeover_reverted_vendored`). A vendored PyPI package (requirements.txt, Poetry, Pipenv, uv, Hatch, PDM, pylock) is taken over the same way: its vendored wiring is restored to the recorded registry entry, its ledger entry and wheel are removed, and it is redirected in the same commit. The Python rewriters treat any non-registry source as user-authored, so without the revert they refused socket-patch's own vendored source and left the project vendored. A vendored Composer package is taken over the same way: its `composer.lock` entry is restored to the recorded pre-vendor entry, its ledger entry and committed copy are removed, and it is redirected in the same commit, so the lock matches a direct hosted scan and `rollback` can restore it from packagist. Without the revert the rewriter edited the vendored entry in place and kept its patch-uuid `dist.reference`, which `rollback` refused. A vendored Composer entry the takeover cannot revert (its vendored ledger entry is missing) is left vendored with `redirect_composer_vendored_entry`, never repointed in place. A takeover revert that leaves vendored wiring in place is refused with `redirect_vendored_revert_failed`. That covers a drift-skipped record (`vendor_lock_entry_drifted`) and a reverted file that still references the artifact (`vendor_revert_residual_reference`). The ledger entry and artifact are kept, and the package stays vendored and skipped. `--dry-run` predicts the same refusal from the same signals instead of previewing `redirect_would_revert_vendored`. The hosted requirements.txt rewriter only rewrites an existing pin in the root `requirements.txt`, so a vendored requirements.txt package whose wiring is a pin in a `-r` include or a `(transitive)` line vendored mode appended is kept vendored, wet and `--dry-run` alike, with `redirect_requirements_takeover_unreachable` (a top-level `warnings[]` entry, and the `errorCode` of the package's `skipped` event). Its wiring, ledger entry and wheel are kept, so it stays vendored and patched (exit 0). The uv and Poetry rewriters are covered the same way: a vendored uv package whose recorded pre-vendor `uv.lock` entry is at another version than the patch (vendored uv pins the entry down to the patch's version; the revert brings the lock's own version back, and hosted mode only pins the version the lock resolves) is kept vendored with `redirect_uv_takeover_version_unreachable`, and a vendored Poetry package on a Poetry 0.x lock (which hosted mode refuses outright) is kept vendored with `redirect_poetry_lock_unsupported`. **Staged takeover (v5.0)**: the takeover is atomic. Each purl's vendored revert is staged in memory (the run's group commit, the same journaled commit vendored mode uses), the hosted rewrite plans against the reverted project, and a staged purl the rewrite does not pin is retracted: every staged revert is undone, that purl keeps its vendored wiring, ledger entry and artifact byte-identical, and the rest are staged and rewritten again. A retracted purl is a `skipped` event whose `errorCode` is the cause: its existing skip reason (unavailable wheel metadata, …), the rewriter warning that names the package (`redirect_yarn_berry_missing_checksum`, `redirect_pypi_platform_wheel`, …), `redirect_requirements_takeover_unreachable`, the rewrite's lock-level refusal (`redirect_yarn_berry_mixed_line_endings`, `redirect_bun_lock_unsupported`, a Gradle planner refusal, …) or `redirect_takeover_not_pinned`; that warning is reported in `warnings[]`, followed by `redirect_takeover_kept_vendored` naming the package. Exit 0: the package stays vendored and patched, never unpatched in both modes. The reverts, the hosted pins and the vendored ledger then reach the disk in one commit, and the reverted artifacts are deleted only after it: a refusal or write failure before the commit writes nothing, a failed commit puts back the files it replaced, and a commit interrupted after its journal was written is finished by the next command that takes the apply lock. `--dry-run` runs the same steps and drops the staged state instead of committing, so its `verified` events and warnings are the wet run's `applied` events and warnings. A hosted run with no takeover stages its writes the same way but commits them without the journal (it writes nothing under `.socket/`): a file that fails to be replaced puts back the ones already replaced, so a failed run leaves no lock half-redirected. Re-runs over already-rewritten output plan from the current lock text and are idempotent (exit 0, lock unchanged). **Lock (v5.0)**: the hosted engine acquires `<.socket>/apply.lock` before its first wet write (the staged takeover reverts) — not on `--dry-run`, and not when the run would write nothing (zero redirects, all skipped) — so previews and no-op runs never create `.socket/`; contention is `lock_held` and a lock-file I/O fault (a read-only project root, a file squatting on `.socket/`) is `lock_io` — both exit 1, refused BEFORE any project file is written, and rendered like every other lock holder: human `Error (<code>): <message>` on stderr (+ the `--lock-timeout` hint for a live holder); JSON prints the envelope with `status: "error"` and `error: {code: "lock_held" | "lock_io", message}` (no `redirect` payload: nothing was rewritten). **Takeover symlink pre-check (v5.0)**: a vendored→hosted takeover whose recorded wiring file is a symlink is refused up front with `redirect_symlinked_file_unsupported` — wet and `--dry-run` alike, before any revert — so "nothing was written" holds. **Human mode (v5.0)**: hosted `scan` prints the results table and update detection like the other modes, then rewrites without a prompt (scan never prompts); `--dry-run` previews through the engine, and a detail fetch that leaves nothing to redirect enters the engine as a no-op (`Redirected 0 packages; rewrote 0 files.`, no lock, no `.socket/`). The detail fetch prints the same progress counter and per-package `Warning: could not fetch details for …` lines as the agent arm. An EMPTY hosted discovery prints `No patches available for installed packages.` and exits 0 without entering the engine; a discovery whose every offer is paid-tier for an org without paid access prints the table's paid nudge, then `No downloadable patches (paid subscription required).`, and exits 0 without entering the engine (parity with the agent/vendored arms). Under `--json` (v5.0, MAJOR) the outcome is recorded into the scan envelope: one event per selected patch, sorted by purl, each with `details.mode: "hosted"` — `applied` for a confirmed pin (`verified` under `--dry-run`), `skipped` with the skip reason as `errorCode` (and its detail as `reason`), or `skipped` / `redirect_unconfirmed` for a patch that was granted but no lockfile entry pinning it could be rewritten (the human output's `Not hosted <purl>: …` line) — plus a `redirect: {mode: "hosted", rewrittenFiles}` payload (the files rewritten, or that would be). A `skipped` event does not change `status` or the exit code (the hosted exit policy is an open decision, #704). Rewriter warnings carry stable `redirect_*` codes (e.g. `redirect_npm_no_lockfile`, `redirect_gradle_manual_snippet`, `redirect_golang_unsupported`); new codes are additive (MINOR). v5.0 additive codes: `redirect_composer_no_lockfile` / `redirect_gem_no_gemfile` (composer / gem: neither manifest nor lock present — once per run, after the intake gates), `redirect_gem_bundle_gemfile_unsupported` (gem: `BUNDLE_GEMFILE` — `BUNDLE_GEMFILE:` in the bundler app config, which outranks the environment variable as in `Bundler::Settings`, else the environment variable — names a manifest other than the project's `Gemfile` / `gems.rb`, so no gem is redirected or attested; a value naming one of those two selects that pair even when the other spelling is present), `redirect_gem_bundle_lockfile_unsupported` (gem: bundler 4's custom lockfile — the `BUNDLE_LOCKFILE` environment variable, else `BUNDLE_LOCKFILE:` in the bundler app config, else in the global config — names a lock other than the loaded pair's own `Gemfile.lock` / `gems.locked`, so no gem is redirected or attested rather than pinning a lock bundler ignores), `redirect_gem_twin_manifest_ambiguous` (gem: a `Gemfile` + `gems.rb` twin under default discovery; bundler 1.x loads the `Gemfile` and bundler ≥ 2 loads `gems.rb`, and a lock's `BUNDLED WITH` records which bundler wrote it, not which one installs it, so neither pair is wired or attested — remove the unused spelling or set `BUNDLE_GEMFILE` to the one in use), `redirect_gem_mirror_overrides_source` (gem: Bundler's all-source, exact patch-source or patch-hostname mirror can route the per-dep `source` block to an unpatched upstream gem. Intake reads the app config (`BUNDLE_APP_CONFIG`, where a set-but-empty value selects `<root>/config`, honoring `BUNDLE_IGNORE_CONFIG`) and all `BUNDLE_MIRROR__...` variables visible to the scan; app config overrides the environment per encoded key, then `mirror.all` takes precedence over exact source, which takes precedence over hostname. URI matching follows Bundler's whole-URI case folding, default-port/trailing-slash normalization and single slash key alias, not URL prefixes. An exact-source fallback-timeout key without a mirror URL shadows the hostname mirror and fetches that source directly; a configured URL is conservatively refused even if a timeout could bypass an unreachable mirror at install time. Like `redirect_gem_bundle_gemfile_unsupported`, the gate leaves the Gemfile pair byte-identical and confirms no gem redirect. On an embedded `scan --vex`, rediscovered older hosted gem pins may attest only from verified installed bytes: a missing tree is not excused by the lockfile, and `--vex-no-verify` omits those hosted gems with `mirror_overrides_source` rather than trusting their intercepted source. Agent/vendored evidence, unrelated ecosystems and standalone VEX behavior are unchanged. Details identify the setting form and its app/environment origin without printing mirror values or source URLs, which may contain credentials. Remove the applicable all/source/hostname setting (including any slash alias) from that origin and reuse its existing mirror URL under `mirror.https://rubygems.org` to clear the refusal; an environment setting must be unset in the scan/install environment. User-global Bundler config and mirrors set only in a later install environment are not inspected; keep those mirrors scoped to the upstream source too), `redirect_maven_no_pom` (no `pom.xml` and no Gradle build), `redirect_nuget_lock_unparseable` (a present-but-corrupt `packages.lock.json` — warned once, nothing mutated; an absent lock still proceeds; a leading UTF-8 BOM, which dotnet reads past, is not corrupt and is kept on rewrite), `redirect_nuget_lock_other_version` (the lock also resolves the patched id at another version in some target framework: the exact-id `packageSourceMapping` would route that framework to a feed that serves only the patched version, so the dep is skipped with nothing written; only lock entries at the patched version are ever re-pinned, and `resolved` is never rewritten), `redirect_nuget_mapping_set_aside` (v5.0 #462: another source's `packageSourceMapping` also named the patched id exactly — Visual Studio's mapping UI writes such lists — which ties with the Socket source so NuGet would take the package from whichever feed answers first; that pattern, or its whole `<packageSource>` when it was the only one, is commented out in a `<!-- socket-patch-<uuid> moved: … -->` comment while the patch is wired, and `remove` / `rollback` put it back byte-exact), `redirect_nuget_mapping_conflict` (such a pattern sits in markup that cannot go in a comment; the dep is skipped, nothing written). v5.0 #354: when the rewriter creates the `packageSourceMapping`, its `*` catch-all also names the sources NuGet merges in from the user config and every parent directory's config (honoring `<clear />`), since NuGet drops every source no pattern names; a fresh config only seeds `nuget.org` when those inherited configs have it (a parent that cleared it for a mirror keeps that choice); when an inherited config already has a `packageSourceMapping` (NuGet merges those too), no catch-all is written at all — only the Socket pattern — so a source the parent restricts is never widened; the exclusivity set-aside exempts only the source the run wires, so a `socket-patch-*` lookalike key or a stale uuid naming the id is set aside too, `redirect_cargo_lock_pkg_ambiguous` (several same-name+version `[[package]]` blocks and none carries the index `source` — transactional skip), `redirect_cargo_dep_overridden` (the crate does not resolve to crates.io because the user overrides it — its one `Cargo.lock` block carries a git / other-registry `source`, as a `[patch]` git or registry override in the root manifest or any cargo config leaves it, or has no `source` while the root `Cargo.toml` / project `.cargo/config*` holds a `[patch]` path entry for it; with no `Cargo.lock`, the same `[patch.crates-io]` / `[patch."https://github.com/rust-lang/crates.io-index"]` entry for the crate, by key or `package = "…"`, in the root `Cargo.toml` or the project `.cargo/config*` — transactional skip, nothing rewritten: a Socket pin would silently replace the user's fork and the then-unused `[patch]` entry breaks `cargo --locked`). Also additive: `redirect_cargo_directory_source` (#455: a cargo config replaces crates.io with an on-disk source through its `[source.crates-io] replace-with` chain — a directory source, as a `cargo vendor` project has, or a `cargo local-registry` — so the project builds every crates.io crate offline from it and a Socket registry pin would break `cargo build --frozen --offline`. The configs read are the ones cargo reads for a build in the scanned directory: the project's own `.cargo/config*`, every parent directory's (a monorepo root) and `$CARGO_HOME`'s. Every cargo dependency is skipped with nothing written, one warning each naming the crate and the config that set the replacement, and the detail points at agent mode, which patches the copy cargo builds in place. A replacement with a registry mirror is not an offline source and is still redirected). Also additive: `redirect_gem_version_not_locked` (gem: no `GEM` section of the lock lists the crawled `name (version)`, for example a version another project installed into the shared gem home; the gem is skipped with nothing written, so the user's declared constraint and the locked version are never overwritten), `redirect_gem_no_lockfile` (gem: the project has a `Gemfile` / `gems.rb` but no `Gemfile.lock` / `gems.locked`, so nothing records which version it resolves and the crawled version may be another project's copy in the shared gem home; the gem is skipped with nothing written, never pinned over the user's constraint or appended as a new dependency, and the detail asks for `bundle lock` (or `bundle install`) and a re-run). Also v5.0: a registry override of the wrong kind (or none at all) warns the arm's missing-override code for nuget/gem/golang. Refusals stay fail-closed with a diagnosis that names the actual cause: a yarn-berry lock entry resolving through a non-`npm:` protocol keeps `redirect_yarn_berry_unsupported_protocol` with the entry's ACTUAL protocol in the detail — except socket-patch's OWN vendored wiring (a `file:` range into `.socket/vendor/`), which gets the distinct `redirect_yarn_berry_vendored_entry` code whose detail names the retirement path (`remove <purl>` per package, or `vendor --revert` which unwinds every vendored package, then re-run `scan --mode hosted`). Both leave the entry byte-identical; neither changes exit code or status. **yarn berry line endings (v5.0)**: yarn writes a NEW `yarn.lock` with the OS line ending (`os.EOL` — CRLF on Windows) and keeps an existing lock's majority ending on every later write, and a `core.autocrlf` checkout turns an LF lock CRLF on any OS — so a uniformly CRLF lock is rewritten in its own ending: every untouched byte (a leading BOM included) round-trips (and `rollback`'s upstream restore keeps the lock's own ending). A lock that MIXES CRLF and LF (or holds a bare CR) has no single ending to keep — yarn's own `--immutable` check rejects it too (YN0028) — so it is refused untouched with `redirect_yarn_berry_mixed_line_endings` (the detail names `yarn install`, which normalizes it). The root `package.json`, which the rewrite re-renders to add `resolutions`, gets the same gate: a mixed one is refused untouched with the same code — the decision vendored mode takes with `vendor_yarn_berry_mixed_line_endings`, from the same shared berry gate set. This replaces v4's `redirect_yarn_berry_crlf_unsupported`, which refused every CRLF lock and is no longer emitted. A vendored→hosted takeover of a yarn-berry entry is checked against these project gates (mixed `yarn.lock` / `package.json` line endings, unsupported `cacheKey`, a non-zero `.yarnrc.yml` `compressionLevel`) on the project as it is before any revert, because the revert re-renders `package.json` in its majority ending — wet and `--dry-run` alike. A refused purl keeps its vendored wiring, ledger entry and artifact byte-identical, is skipped with the gate's code (reported in `warnings[]`, followed by `redirect_takeover_kept_vendored`) and is never announced as `redirect_takeover_reverted_vendored`.
+`scan --mode hosted` swaps the in-place apply for the registry-redirect pipeline: discover → resolve hosted-patch references (grant token + integrity + per-dep registry override) → rewrite ONLY the patched dependencies' lockfile / registry-config entries to point at the hosted packages. A dep counts as **redirected** only when its hosted-artifact URL (or per-dep registry index URL) actually landed in a project file — a granted reference whose rewriter found nothing to edit is neither counted nor attested. **No ledger (v5.0)**: hosted mode writes ONLY the lockfile / registry-config edits — `.socket/vendor/redirect-state.json` is never written (on success or failure), and a pre-v5 one on disk is ignored (never read for planning, never quarantined, left byte-identical). The lockfiles are the only record of a hosted patch: `list`, `vex`, `rollback`, `remove`, `vendor` and `repair` all discover the hosted pins from them (a hosted URL counts only on `https://patch.socket.dev` or the `--patch-server-url` / `SOCKET_PATCH_SERVER_URL` origin), and commit-ready output is just the lockfile / config changes. Cargo and golang are confirmed only by their rewriter's own report (`confirmed_cargo_uuids` / `confirmed_golang_uuids`): a golang dep counts only when its go.mod `replace M V => patch.socket.dev/gopatch/<uuid> <sver>` and both go.sum lines are in place (or, on a re-run, the replace and just the `/go.mod` line `go mod tidy` leaves when no package of the module is loaded, which the rewriter keeps as is), never because the patch-server origin or leftover go.sum lines appear somewhere. Gradle is confirmed the same way (`confirmed_gradle_uuids`): only when the final files hold the owned script, the index row, the live apply line in every build's settings file and the suffixed version in every lock entry of the GA (see [Gradle builds](#gradle-builds-v50)). A golang module that go.mod does not require and go.sum has no zip (`h1:` of the module tree) line for at the patched version is outside the build graph and is refused with `redirect_golang_not_in_module_graph` (nothing written); a `/go.mod`-only line doesn't count, since go writes one for every version MVS reads (#509). In a go < 1.17 graph, where `require` holds only lower bounds, the build selects the highest of the required version and go.sum's zip-line versions, and a patch for a lower version warns `redirect_golang_version_mismatch` (nothing written). Only the exact module `patch.socket.dev/gopatch/<canonical uuid>` is socket-owned; any other module path is refused with `redirect_golang_untrusted_module_path`. A vendored golang module is taken over like cargo and the npm family: its vendor wiring, committed copy and ledger entry are reverted first (`redirect_takeover_reverted_vendored`). A vendored PyPI package (requirements.txt, Poetry, Pipenv, uv, Hatch, PDM, pylock) is taken over the same way: its vendored wiring is restored to the recorded registry entry, its ledger entry and wheel are removed, and it is redirected in the same commit. The Python rewriters treat any non-registry source as user-authored, so without the revert they refused socket-patch's own vendored source and left the project vendored. A vendored Composer package is taken over the same way: its `composer.lock` entry is restored to the recorded pre-vendor entry, its ledger entry and committed copy are removed, and it is redirected in the same commit, so the lock matches a direct hosted scan and `rollback` can restore it from packagist. Without the revert the rewriter edited the vendored entry in place and kept its patch-uuid `dist.reference`, which `rollback` refused. A vendored Composer entry the takeover cannot revert (its vendored ledger entry is missing) is left vendored with `redirect_composer_vendored_entry`, never repointed in place. A takeover revert that leaves vendored wiring in place is refused with `redirect_vendored_revert_failed`. That covers a drift-skipped record (`vendor_lock_entry_drifted`) and a reverted file that still references the artifact (`vendor_revert_residual_reference`). The ledger entry and artifact are kept, and the package stays vendored and skipped. `--dry-run` predicts the same refusal from the same signals instead of previewing `redirect_would_revert_vendored`. The hosted requirements.txt rewriter only rewrites an existing pin in the root `requirements.txt`, so a vendored requirements.txt package whose wiring is a pin in a `-r` include or a `(transitive)` line vendored mode appended is kept vendored, wet and `--dry-run` alike, with `redirect_requirements_takeover_unreachable` (a top-level `warnings[]` entry, and the `errorCode` of the package's `skipped` event). Its wiring, ledger entry and wheel are kept, so it stays vendored and patched (exit 0). The uv and Poetry rewriters are covered the same way: a vendored uv package whose recorded pre-vendor `uv.lock` entry is at another version than the patch (vendored uv pins the entry down to the patch's version; the revert brings the lock's own version back, and hosted mode only pins the version the lock resolves) is kept vendored with `redirect_uv_takeover_version_unreachable`, and a vendored Poetry package on a Poetry 0.x lock (which hosted mode refuses outright) is kept vendored with `redirect_poetry_lock_unsupported`. **Staged takeover (v5.0)**: the takeover is atomic. Each purl's vendored revert is staged in memory (the run's group commit, the same journaled commit vendored mode uses), the hosted rewrite plans against the reverted project, and a staged purl the rewrite does not pin is retracted: every staged revert is undone, that purl keeps its vendored wiring, ledger entry and artifact byte-identical, and the rest are staged and rewritten again. A retracted purl is a `skipped` event whose `errorCode` is the cause: its existing skip reason (unavailable wheel metadata, …), the rewriter warning that names the package (`redirect_yarn_berry_missing_checksum`, `redirect_pypi_platform_wheel`, …), `redirect_requirements_takeover_unreachable`, the rewrite's lock-level refusal (`redirect_yarn_berry_mixed_line_endings`, `redirect_bun_lock_unsupported`, a Gradle planner refusal, …) or `redirect_takeover_not_pinned`; that warning is reported in `warnings[]`, followed by `redirect_takeover_kept_vendored` naming the package. Exit 0: the package stays vendored and patched, never unpatched in both modes. The reverts, the hosted pins and the vendored ledger then reach the disk in one commit, and the reverted artifacts are deleted only after it: a refusal or write failure before the commit writes nothing, a failed commit puts back the files it replaced, and a commit interrupted after its journal was written is finished by the next command that takes the apply lock. `--dry-run` runs the same steps and drops the staged state instead of committing, so its `verified` events and warnings are the wet run's `applied` events and warnings. A hosted run with no takeover stages its writes the same way but commits them without the journal (it writes nothing under `.socket/`): a file that fails to be replaced puts back the ones already replaced, so a failed run leaves no lock half-redirected. Re-runs over already-rewritten output plan from the current lock text and are idempotent (exit 0, lock unchanged). **Lock (v5.0)**: the hosted engine acquires `<.socket>/apply.lock` before its first wet write (the staged takeover reverts) — not on `--dry-run`, and not when the run would write nothing (zero redirects, all skipped) — so previews and no-op runs never create `.socket/`; contention is `lock_held` and a lock-file I/O fault (a read-only project root, a file squatting on `.socket/`) is `lock_io` — both exit 1, refused BEFORE any project file is written, and rendered like every other lock holder: human `Error (<code>): <message>` on stderr (+ the `--lock-timeout` hint for a live holder); JSON prints the envelope with `status: "error"` and `error: {code: "lock_held" | "lock_io", message}` (no `redirect` payload: nothing was rewritten). **Takeover symlink pre-check (v5.0)**: a vendored→hosted takeover whose recorded wiring file is a symlink is refused up front with `redirect_symlinked_file_unsupported` — wet and `--dry-run` alike, before any revert — so "nothing was written" holds. **Human mode (v5.0)**: hosted `scan` prints the results table and update detection like the other modes, then rewrites without a prompt (scan never prompts); `--dry-run` previews through the engine, and a detail fetch that leaves nothing to redirect enters the engine as a no-op (`Redirected 0 packages; rewrote 0 files.`, no lock, no `.socket/`). The detail fetch prints the same progress counter and per-package `Warning: could not fetch details for …` lines as the agent arm. An EMPTY hosted discovery prints `No patches available for installed packages.` and exits 0 without entering the engine; a discovery whose every offer is paid-tier for an org without paid access prints the table's paid nudge, then `No downloadable patches (paid subscription required).`, and exits 0 without entering the engine (parity with the agent/vendored arms). Under `--json` (v5.0, MAJOR) the outcome is recorded into the scan envelope: one event per selected patch, sorted by purl, each with `details.mode: "hosted"` — `applied` for a confirmed pin (`verified` under `--dry-run`), `skipped` with the skip reason as `errorCode` (and its detail as `reason`), or `skipped` / `redirect_unconfirmed` for a patch that was granted but no lockfile entry pinning it could be rewritten (the human output's `Not hosted <purl>: …` line) — plus a `redirect: {mode: "hosted", rewrittenFiles}` payload (the files rewritten, or that would be). A `skipped` event does not change `status` or the exit code (the hosted exit policy is an open decision, #704). Rewriter warnings carry stable `redirect_*` codes (e.g. `redirect_npm_no_lockfile`, `redirect_gradle_manual_snippet`, `redirect_golang_unsupported`); new codes are additive (MINOR). v5.0 additive codes: `redirect_composer_no_lockfile` / `redirect_gem_no_gemfile` (composer / gem: neither manifest nor lock present — once per run, after the intake gates), `redirect_gem_bundle_gemfile_unsupported` (gem: `BUNDLE_GEMFILE` — `BUNDLE_GEMFILE:` in the bundler app config, which outranks the environment variable as in `Bundler::Settings`, else the environment variable — names a manifest other than the project's `Gemfile` / `gems.rb`, so no gem is redirected or attested; a value naming one of those two selects that pair even when the other spelling is present), `redirect_gem_bundle_lockfile_unsupported` (gem: bundler 4's custom lockfile — the `BUNDLE_LOCKFILE` environment variable, else `BUNDLE_LOCKFILE:` in the bundler app config, else in the global config — names a lock other than the loaded pair's own `Gemfile.lock` / `gems.locked`, so no gem is redirected or attested rather than pinning a lock bundler ignores), `redirect_gem_twin_manifest_ambiguous` (gem: a `Gemfile` + `gems.rb` twin under default discovery; bundler 1.x loads the `Gemfile` and bundler ≥ 2 loads `gems.rb`, and a lock's `BUNDLED WITH` records which bundler wrote it, not which one installs it, so neither pair is wired or attested — remove the unused spelling or set `BUNDLE_GEMFILE` to the one in use), `redirect_gem_mirror_overrides_source` (gem: Bundler's all-source, exact patch-source or patch-hostname mirror can route the per-dep `source` block to an unpatched upstream gem. Intake reads the app config (`BUNDLE_APP_CONFIG`, where a set-but-empty value selects `<root>/config`, honoring `BUNDLE_IGNORE_CONFIG`) and all `BUNDLE_MIRROR__...` variables visible to the scan; app config overrides the environment per encoded key, then `mirror.all` takes precedence over exact source, which takes precedence over hostname. URI matching follows Bundler's whole-URI case folding, default-port/trailing-slash normalization and single slash key alias, not URL prefixes. An exact-source fallback-timeout key without a mirror URL shadows the hostname mirror and fetches that source directly; a configured URL is conservatively refused even if a timeout could bypass an unreachable mirror at install time. Like `redirect_gem_bundle_gemfile_unsupported`, the gate leaves the Gemfile pair byte-identical and confirms no gem redirect. On an embedded `scan --vex`, rediscovered older hosted gem pins may attest only from verified installed bytes: a missing tree is not excused by the lockfile, and `--vex-no-verify` omits those hosted gems with `mirror_overrides_source` rather than trusting their intercepted source. Agent/vendored evidence, unrelated ecosystems and standalone VEX behavior are unchanged. Details identify the setting form and its app/environment origin without printing mirror values or source URLs, which may contain credentials. Remove the applicable all/source/hostname setting (including any slash alias) from that origin and reuse its existing mirror URL under `mirror.https://rubygems.org` to clear the refusal; an environment setting must be unset in the scan/install environment. User-global Bundler config and mirrors set only in a later install environment are not inspected; keep those mirrors scoped to the upstream source too), `redirect_maven_no_pom` (no `pom.xml` and no Gradle build), `redirect_nuget_lock_unparseable` (a present-but-corrupt `packages.lock.json` — warned once, nothing mutated; an absent lock still proceeds; a leading UTF-8 BOM, which dotnet reads past, is not corrupt and is kept on rewrite), `redirect_nuget_lock_other_version` (the lock also resolves the patched id at another version in some target framework: the exact-id `packageSourceMapping` would route that framework to a feed that serves only the patched version, so the dep is skipped with nothing written; only lock entries at the patched version are ever re-pinned, and `resolved` is never rewritten), `redirect_nuget_mapping_set_aside` (v5.0 #462: another source's `packageSourceMapping` also named the patched id exactly — Visual Studio's mapping UI writes such lists — which ties with the Socket source so NuGet would take the package from whichever feed answers first; that pattern, or its whole `<packageSource>` when it was the only one, is commented out in a `<!-- socket-patch-<uuid> moved: … -->` comment while the patch is wired, and `remove` / `rollback` put it back byte-exact), `redirect_nuget_mapping_conflict` (such a pattern sits in markup that cannot go in a comment; the dep is skipped, nothing written). v5.0 #354: when the rewriter creates the `packageSourceMapping`, its `*` catch-all also names the sources NuGet merges in from the user config and every parent directory's config (honoring `<clear />`), since NuGet drops every source no pattern names; a fresh config only seeds `nuget.org` when those inherited configs have it (a parent that cleared it for a mirror keeps that choice); when an inherited config already has a `packageSourceMapping` (NuGet merges those too), no catch-all is written at all — only the Socket pattern — so a source the parent restricts is never widened; the exclusivity set-aside exempts only the source the run wires, so a `socket-patch-*` lookalike key or a stale uuid naming the id is set aside too, `redirect_cargo_lock_pkg_ambiguous` (several same-name+version `[[package]]` blocks and none carries the index `source` — transactional skip), `redirect_cargo_dep_overridden` (the crate does not resolve to crates.io because the user overrides it — its one `Cargo.lock` block carries a git / other-registry `source`, as a `[patch]` git or registry override in the root manifest or any cargo config leaves it, or has no `source` while the root `Cargo.toml` / project `.cargo/config*` holds a `[patch]` path entry for it; with no `Cargo.lock`, the same `[patch.crates-io]` / `[patch."https://github.com/rust-lang/crates.io-index"]` entry for the crate, by key or `package = "…"`, in the root `Cargo.toml` or the project `.cargo/config*` — transactional skip, nothing rewritten: a Socket pin would silently replace the user's fork and the then-unused `[patch]` entry breaks `cargo --locked`). Also additive: `redirect_cargo_directory_source` (#455: a cargo config replaces crates.io with an on-disk source through its `[source.crates-io] replace-with` chain — a directory source, as a `cargo vendor` project has, or a `cargo local-registry` — so the project builds every crates.io crate offline from it and a Socket registry pin would break `cargo build --frozen --offline`. The configs read are the ones cargo reads for a build in the scanned directory: the project's own `.cargo/config*`, every parent directory's (a monorepo root) and `$CARGO_HOME`'s. Every cargo dependency is skipped with nothing written, one warning each naming the crate and the config that set the replacement, and the detail points at agent mode, which patches the copy cargo builds in place. A replacement with a registry mirror is not an offline source and is still redirected). Also additive: `redirect_gem_version_not_locked` (gem: no `GEM` section of the lock lists the crawled `name (version)`, for example a version another project installed into the shared gem home; the gem is skipped with nothing written, so the user's declared constraint and the locked version are never overwritten), `redirect_gem_no_lockfile` (gem: the project has a `Gemfile` / `gems.rb` but no `Gemfile.lock` / `gems.locked`, so nothing records which version it resolves and the crawled version may be another project's copy in the shared gem home; the gem is skipped with nothing written, never pinned over the user's constraint or appended as a new dependency, and the detail asks for `bundle lock` (or `bundle install`) and a re-run). Also v5.0: a registry override of the wrong kind (or none at all) warns the arm's missing-override code for nuget/gem/golang. Refusals stay fail-closed with a diagnosis that names the actual cause: a yarn-berry lock entry resolving through a non-`npm:` protocol keeps `redirect_yarn_berry_unsupported_protocol` with the entry's ACTUAL protocol in the detail — except socket-patch's OWN vendored wiring (a `file:` range into `.socket/vendor/`), which gets the distinct `redirect_yarn_berry_vendored_entry` code whose detail names the retirement path (`remove <purl>` per package, or `vendor --revert` which unwinds every vendored package, then re-run `scan --mode hosted`). Both leave the entry byte-identical; neither changes exit code or status. **yarn berry line endings (v5.0)**: yarn writes a NEW `yarn.lock` with the OS line ending (`os.EOL` — CRLF on Windows) and keeps an existing lock's majority ending on every later write, and a `core.autocrlf` checkout turns an LF lock CRLF on any OS — so a uniformly CRLF lock is rewritten in its own ending: every untouched byte (a leading BOM included) round-trips (and `rollback`'s upstream restore keeps the lock's own ending). A lock that MIXES CRLF and LF (or holds a bare CR) has no single ending to keep — yarn's own `--immutable` check rejects it too (YN0028) — so it is refused untouched with `redirect_yarn_berry_mixed_line_endings` (the detail names `yarn install`, which normalizes it). The root `package.json`, which the rewrite re-renders to add `resolutions`, gets the same gate: a mixed one is refused untouched with the same code — the decision vendored mode takes with `vendor_yarn_berry_mixed_line_endings`, from the same shared berry gate set. This replaces v4's `redirect_yarn_berry_crlf_unsupported`, which refused every CRLF lock and is no longer emitted. A vendored→hosted takeover of a yarn-berry entry is checked against these project gates (mixed `yarn.lock` / `package.json` line endings, unsupported `cacheKey`, a non-zero `.yarnrc.yml` `compressionLevel`) on the project as it is before any revert, because the revert re-renders `package.json` in its majority ending — wet and `--dry-run` alike. A refused purl keeps its vendored wiring, ledger entry and artifact byte-identical, is skipped with the gate's code (reported in `warnings[]`, followed by `redirect_takeover_kept_vendored`) and is never announced as `redirect_takeover_reverted_vendored`.
 
 **Attribution gate (v5.0).** A hosted run never leaves wiring that lockfile discovery calls contested: before the rewrite writes any lockfile, the same discovery `vex`, `list`, `rollback`, `remove` and `vendor` read runs over the project as the rewrite would leave it. A candidate whose pin discovery reads but cannot attribute to one package version (a requirements `-r` include resolving the same version from the registry beside a rewired `Pipfile.lock`, #567; a Maven pin in a `<profile>`, #260) is left out of the rewrite and reported as a `skipped` event with `errorCode` `redirect_unattributable` (nothing written for it; exit code unchanged). Unchanged: a pin in a file discovery does not read (a pre-2.6 bundler `Gemfile`, locked by the next `bundle install`) keeps the rewriter's verdict, and so does a deliberate partial redirect the run already reports (a bundled or `bun patch`-ed copy left on the registry, a yarn `npm:` alias entry left on the registry with `redirect_yarn_classic_alias_skipped` / `redirect_yarn_berry_alias_skipped` while the package's direct entry is pinned, a dep withheld from the vlt rewrite while a sibling lock takes it), and so does a vendored→hosted takeover: its vendored wiring is reverted in the run's staged overlay before the rewrite plans, and it is redirected when the rewriters pin it (otherwise it is retracted and stays vendored), in a `--dry-run` preview the same. A pin whose own pnpm or yarn lock also installs an unpatched copy of the same `name@version` (a pnpm `file:` directory or tarball dependency; a yarn `file:` / URL / berry `portal:` / `link:` dependency declared under another name) is written too, with a `redirect_copy_unpatched` warning naming that entry, and is not attested. A lockless NuGet / Cargo pin (an exclusive Socket source mapping without `packages.lock.json`, a Cargo registry pin without `Cargo.lock`) is still written, with a `redirect_pin_lockless` warning: no lockfile records its version, so `vex` cannot attest it and `rollback` / `remove` / `vendor` refuse it until the lockfile exists (whether such pins should be written at all is an open decision). The rollout's recorded view uses the same discovery: a uuid a file merely mentions (a stale `package.json` field, an inactive `pdm.lock`, a comment) is not a pin and does not count as already patched.
 
@@ -531,7 +531,7 @@ Discovery is read-only, never touches the network, and never fails the run: a ma
 | bun | `bun.lock`; `bun.lockb` only when there is no `bun.lock` (bun reads exactly one) | URL tuple / binary remote-tarball resolution; version from the URL leaf. A user URL or `file:` tarball tuple / record whose `<name>-<ver>.tgz` leaf names the same `name@version` is installed from its own spec, so every ref for that `name@version` is dropped | `.socket/vendor/npm/<uuid>/<name>-<ver>.tgz` tuple / local-tarball resolution | `sha512-…`, required. A 2-tuple that Bun < 1.3.10 re-saved without its digest is still a reference, but it attests only from an installed tree. |
 | vlt | `vlt-lock.json` (lockfileVersion absent, `0` or `1`; a BOM-prefixed, unparseable, non-object or other-version lock is not read: diagnosed, no ref). `vlt.json` (read only for its `modifiers`) and `node_modules/.vlt-lock.json` are never wiring. | a registry node (any segment) whose slot [3] is a `/patch/npm/…` URL on the patch host with the leaf `<bare>-<ver>.tgz` of its DepID's `name@version`, whose embedded `<name>/<ver>` path (when present) is that `name@version`, and slot [1] == name; version from the DepID | a `file` node `.socket/vendor/npm/<uuid>/<name>-<ver>/node_modules/<name>` (or a user-installed `<name>-<ver>.tgz`) with slot [1] == name; version from the path. A same-`name@version` registry node, or a diagnosed Socket-shaped one, beside it is diagnosed, no ref. | slot [2] `sha512-…`, required (a hosted node without one is no reference). A same-`name@version` node on another registry, or a diagnosed Socket-shaped one, keeps the reference but withholds the lockfile basis: only an installed tree whose every store copy verifies attests. So does a lock some vlt release discards, the conditions of `redirect_vlt_lockfile_version_missing`, `redirect_vlt_old_lockfile_ignored` and `redirect_vlt_scalar_registry_ignored` (which in-run `--vex` withholds too): every hosted reference in it keeps no pin, and one `patched_ref_unattributable` names them. |
 | cargo | `Cargo.lock`, `Cargo.toml`, `.cargo/config` (else `.cargo/config.toml`) | `Cargo.lock` `source = "sparse+…/<uuid>/index/"`, confirmed by `Cargo.toml`: a crate the root manifest declares must pin `registry = "socket-patch-<uuid>"`. A reverted pin is diagnosed, no ref. Another `[[package]]` of the same `name@version` from a non-Socket source (crates.io, git), which cargo locks beside the pin for a dependent added later and builds unpatched (#679), withholds the ref (`patched_ref_unattributable`, never attested) while `rollback` / `remove` still unwind it. | `[patch.<source>] <key> = { path = ".socket/vendor/cargo/<uuid>/<name>-<ver>" }` — primarily the root `Cargo.toml` (v5 `vendor`; key-agnostic: `<name>` is `package` when renamed, else the key, so `<name>-socket-<uuid8>` keys count), also the project config (pre-v5 wiring), live only while the lock holds a sourceless entry for it that is not in `[[patch.unused]]`; a manifest entry cargo ignores — the project config redefines its key with another path, or a `[patch."https://github.com/rust-lang/crates.io-index"]` table replaces `[patch.crates-io]` — is diagnosed (`patched_ref_invalid`), no ref | `checksum` (v1: `[metadata]`), required |
-| golang | `go.mod`, `go.work`, `go.sum`, `go.work.sum` | `replace M v => patch.socket.dev/gopatch/<uuid> <sver>` | `replace M v => ./.socket/vendor/golang/<uuid>/M@v` | the socket module's `/go.mod` go.sum line, required. The zip line (`h1:` of the module tree) is the locked integrity when present; `go mod tidy` prunes it when no package of the module is loaded and the build stays green, so the `/go.mod` line alone still attests from the lockfile. A conflicting or malformed line for the socket module+version is no pin. A replace that `require` no longer selects (`require M v'`) is inert: diagnosed, no ref. |
+| golang | `go.mod`, `go.work`, `go.sum`, `go.work.sum` | `replace M v => patch.socket.dev/gopatch/<uuid> <sver>` | `replace M v => ./.socket/vendor/golang/<uuid>/M@v` | the socket module's `/go.mod` go.sum line, required. The zip line (`h1:` of the module tree) is the locked integrity when present; `go mod tidy` prunes it when no package of the module is loaded and the build stays green, so the `/go.mod` line alone still attests from the lockfile, unless go.sum shows the build selects another version (MVS keeps the `/go.mod` line of versions it only reads): then the replace is inert. With a `go.work`, `go.work.sum` and each in-root `use` member's `go.sum` are read too. A conflicting hash or a malformed `h1:` for the socket module+version, or a line of other than three tokens anywhere in a sum file, is no pin. A replace that `require` no longer selects (`require M v'`) is inert: diagnosed, no ref. |
 | pypi | `uv.lock` (confirmed by `pyproject.toml` `[tool.uv.sources]` when present), PEP 723 `<script>.py.lock`, `pylock.toml` / `pylock.<name>.toml`, `poetry.lock`, `pdm.lock`, `Pipfile.lock`, `requirements.txt` + its in-root `-r` includes, PEP 508 direct references in `pyproject.toml` / `hatch.toml` | Socket-host artifact url | `.socket/vendor/pypi/<uuid>/<wheel>` naming the entry's own dist | sha256, required |
 | gem | `Gemfile.lock` and `gems.locked` (the `Gemfile` / `gems.rb` only to cross-check a merged multi-remote `GEM` section) | a `GEM` section whose remote ends `patch-registry/gem/<token>/<uuid>` | `PATH` remote `.socket/vendor/gem/<uuid>/<name>-<ver>` | `CHECKSUMS` sha256, required only when the lock has a `CHECKSUMS` section (bundler ≥ 2.6) |
 | composer | `composer.lock` (`packages` + `packages-dev`) | `dist.url` on the patch host | `dist: {type: "path", url: ".socket/vendor/composer/<uuid>/…", reference: "<uuid>"}` | `dist.shasum`, required |

From 14fa6d4bc12c485d482783b2dc8d0dc71784c147 Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Tue, 27 Oct 2026 18:10:51 -0400
Subject: [PATCH 4/9] Don't attest Go pins a workspace never builds

In a go.work workspace, Go builds the highest version any `use` member
requires. A Socket replace whose go.sum held only the `/go.mod` line
was still attested when another member required a newer version, so
VEX could claim a patch that no build links. Such a pin now attests
only when every member's go.mod is inside the project and readable and
together they select the replaced version; otherwise it is flagged as
inert or left unattested.

Pins are also looked up only in the sum files Go actually reads: in a
workspace, go.work.sum and the members' go.sum (the root go.sum only
when `.` is a member); with GOWORK=off, the root go.sum alone, and the
go.work replaces are ignored as Go ignores them.

Assisted-by: Claude Code:claude-opus-5-5
---
 crates/socket-patch-cli/CLI_CONTRACT.md       |   2 +-
 .../tests/e2e_golang_hosted_build.rs          | 109 ++++++
 .../src/vex/discover/golang.rs                | 370 +++++++++++++++---
 3 files changed, 425 insertions(+), 56 deletions(-)

diff --git a/crates/socket-patch-cli/CLI_CONTRACT.md b/crates/socket-patch-cli/CLI_CONTRACT.md
index ccf08ecb4..ad0f9c89b 100644
--- a/crates/socket-patch-cli/CLI_CONTRACT.md
+++ b/crates/socket-patch-cli/CLI_CONTRACT.md
@@ -531,7 +531,7 @@ Discovery is read-only, never touches the network, and never fails the run: a ma
 | bun | `bun.lock`; `bun.lockb` only when there is no `bun.lock` (bun reads exactly one) | URL tuple / binary remote-tarball resolution; version from the URL leaf. A user URL or `file:` tarball tuple / record whose `<name>-<ver>.tgz` leaf names the same `name@version` is installed from its own spec, so every ref for that `name@version` is dropped | `.socket/vendor/npm/<uuid>/<name>-<ver>.tgz` tuple / local-tarball resolution | `sha512-…`, required. A 2-tuple that Bun < 1.3.10 re-saved without its digest is still a reference, but it attests only from an installed tree. |
 | vlt | `vlt-lock.json` (lockfileVersion absent, `0` or `1`; a BOM-prefixed, unparseable, non-object or other-version lock is not read: diagnosed, no ref). `vlt.json` (read only for its `modifiers`) and `node_modules/.vlt-lock.json` are never wiring. | a registry node (any segment) whose slot [3] is a `/patch/npm/…` URL on the patch host with the leaf `<bare>-<ver>.tgz` of its DepID's `name@version`, whose embedded `<name>/<ver>` path (when present) is that `name@version`, and slot [1] == name; version from the DepID | a `file` node `.socket/vendor/npm/<uuid>/<name>-<ver>/node_modules/<name>` (or a user-installed `<name>-<ver>.tgz`) with slot [1] == name; version from the path. A same-`name@version` registry node, or a diagnosed Socket-shaped one, beside it is diagnosed, no ref. | slot [2] `sha512-…`, required (a hosted node without one is no reference). A same-`name@version` node on another registry, or a diagnosed Socket-shaped one, keeps the reference but withholds the lockfile basis: only an installed tree whose every store copy verifies attests. So does a lock some vlt release discards, the conditions of `redirect_vlt_lockfile_version_missing`, `redirect_vlt_old_lockfile_ignored` and `redirect_vlt_scalar_registry_ignored` (which in-run `--vex` withholds too): every hosted reference in it keeps no pin, and one `patched_ref_unattributable` names them. |
 | cargo | `Cargo.lock`, `Cargo.toml`, `.cargo/config` (else `.cargo/config.toml`) | `Cargo.lock` `source = "sparse+…/<uuid>/index/"`, confirmed by `Cargo.toml`: a crate the root manifest declares must pin `registry = "socket-patch-<uuid>"`. A reverted pin is diagnosed, no ref. Another `[[package]]` of the same `name@version` from a non-Socket source (crates.io, git), which cargo locks beside the pin for a dependent added later and builds unpatched (#679), withholds the ref (`patched_ref_unattributable`, never attested) while `rollback` / `remove` still unwind it. | `[patch.<source>] <key> = { path = ".socket/vendor/cargo/<uuid>/<name>-<ver>" }` — primarily the root `Cargo.toml` (v5 `vendor`; key-agnostic: `<name>` is `package` when renamed, else the key, so `<name>-socket-<uuid8>` keys count), also the project config (pre-v5 wiring), live only while the lock holds a sourceless entry for it that is not in `[[patch.unused]]`; a manifest entry cargo ignores — the project config redefines its key with another path, or a `[patch."https://github.com/rust-lang/crates.io-index"]` table replaces `[patch.crates-io]` — is diagnosed (`patched_ref_invalid`), no ref | `checksum` (v1: `[metadata]`), required |
-| golang | `go.mod`, `go.work`, `go.sum`, `go.work.sum` | `replace M v => patch.socket.dev/gopatch/<uuid> <sver>` | `replace M v => ./.socket/vendor/golang/<uuid>/M@v` | the socket module's `/go.mod` go.sum line, required. The zip line (`h1:` of the module tree) is the locked integrity when present; `go mod tidy` prunes it when no package of the module is loaded and the build stays green, so the `/go.mod` line alone still attests from the lockfile, unless go.sum shows the build selects another version (MVS keeps the `/go.mod` line of versions it only reads): then the replace is inert. With a `go.work`, `go.work.sum` and each in-root `use` member's `go.sum` are read too. A conflicting hash or a malformed `h1:` for the socket module+version, or a line of other than three tokens anywhere in a sum file, is no pin. A replace that `require` no longer selects (`require M v'`) is inert: diagnosed, no ref. |
+| golang | `go.mod`, `go.work`, `go.sum`, `go.work.sum` | `replace M v => patch.socket.dev/gopatch/<uuid> <sver>` | `replace M v => ./.socket/vendor/golang/<uuid>/M@v` | the socket module's `/go.mod` go.sum line, required. The zip line (`h1:` of the module tree) is the locked integrity when present; `go mod tidy` prunes it when no package of the module is loaded and the build stays green, so the `/go.mod` line alone still attests from the lockfile, unless the main modules' `require`s or go.sum show the build selects another version (MVS keeps the `/go.mod` line of versions it only reads): then the replace is inert. With a `go.work` the main modules are its `use` members, and a `/go.mod`-only pin attests from the lockfile only when every member's `go.mod` is in the root and readable and they show the replaced version is selected. The sum files are the ones go reads: the root `go.sum`, or with a `go.work`, `go.work.sum` and each in-root `use` member's `go.sum` (the root's only when `.` is a member); under `GOWORK=off`, `go.work` and its replaces are ignored. A conflicting hash or a malformed `h1:` for the socket module+version, or a line of other than three tokens anywhere in a sum file, is no pin. A replace that `require` no longer selects (`require M v'`) is inert: diagnosed, no ref. |
 | pypi | `uv.lock` (confirmed by `pyproject.toml` `[tool.uv.sources]` when present), PEP 723 `<script>.py.lock`, `pylock.toml` / `pylock.<name>.toml`, `poetry.lock`, `pdm.lock`, `Pipfile.lock`, `requirements.txt` + its in-root `-r` includes, PEP 508 direct references in `pyproject.toml` / `hatch.toml` | Socket-host artifact url | `.socket/vendor/pypi/<uuid>/<wheel>` naming the entry's own dist | sha256, required |
 | gem | `Gemfile.lock` and `gems.locked` (the `Gemfile` / `gems.rb` only to cross-check a merged multi-remote `GEM` section) | a `GEM` section whose remote ends `patch-registry/gem/<token>/<uuid>` | `PATH` remote `.socket/vendor/gem/<uuid>/<name>-<ver>` | `CHECKSUMS` sha256, required only when the lock has a `CHECKSUMS` section (bundler ≥ 2.6) |
 | composer | `composer.lock` (`packages` + `packages-dev`) | `dist.url` on the patch host | `dist: {type: "path", url: ".socket/vendor/composer/<uuid>/…", reference: "<uuid>"}` | `dist.shasum`, required |
diff --git a/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs b/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs
index 0e9502e76..1ca070d53 100644
--- a/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs
@@ -889,3 +889,112 @@ async fn tidy_pruned_zip_line_still_pins_the_hosted_replace() {
         discovery.diagnostics
     );
 }
+
+/// A go.work whose other `use` member requires a higher version of the
+/// patched module: go builds that version, so `go.work.sum` keeps only the
+/// socket module's `/go.mod` line and the replace is inert. Discovery must
+/// not attest it, neither when that member is in the project root (its
+/// `require` shows the build selects the higher version) nor when it is
+/// outside it (its `require` cannot be read).
+// #[serial]: see the capstone's note — env mutation vs env iteration.
+#[tokio::test]
+#[serial_test::serial]
+async fn workspace_member_selecting_another_version_never_attests() {
+    if !golang_e2e_matrix::toolchain_ready("e2e_golang_hosted_build") {
+        return;
+    }
+    const NEXT: &str = "v1.1.0";
+    let tmp = tempfile::tempdir().unwrap();
+    let _cleanup = ChmodGuard(tmp.path().to_path_buf());
+    let proxy_url = format!("file://{}", tmp.path().join("proxy").display());
+    let smod = socket_module();
+    let upstream_gomod = format!("module {UMOD}\n\ngo 1.21\n");
+    publish(tmp.path(), UMOD, UVER, &upstream_gomod, PRISTINE_LIB);
+    publish(
+        tmp.path(),
+        UMOD,
+        NEXT,
+        &upstream_gomod,
+        "package upstream\n\nfunc Greeting() string { return \"PRISTINE-NEXT\" }\n",
+    );
+    publish(tmp.path(), &smod, SVER, &upstream_gomod, PATCHED_LIB);
+    let (_, gomod_h1) = harvest_sums(tmp.path(), &proxy_url, &smod, SVER);
+    let (next_zip_h1, next_gomod_h1) = harvest_sums(tmp.path(), &proxy_url, UMOD, NEXT);
+    let next_pair = format!("{UMOD} {NEXT} {next_zip_h1}\n{UMOD} {NEXT}/go.mod {next_gomod_h1}\n");
+    let env = day2_env(&proxy_url);
+    let purl = format!("pkg:golang/{UMOD}@{UVER}");
+
+    for (name, svc_rel) in [("in-root", "svc"), ("out-of-root", "../svc")] {
+        let app = tmp.path().join(name).join("app");
+        let svc = app.join(svc_rel);
+        std::fs::create_dir_all(&svc).unwrap();
+        std::fs::write(
+            app.join("go.mod"),
+            format!("module example.com/app\n\ngo 1.21\n\nrequire {UMOD} {UVER}\n"),
+        )
+        .unwrap();
+        std::fs::write(app.join("go.sum"), &next_pair).unwrap();
+        std::fs::write(
+            app.join("main.go"),
+            format!(
+                "package main\n\nimport \"{UMOD}\"\n\nfunc main() {{ println(upstream.Greeting()) }}\n"
+            ),
+        )
+        .unwrap();
+        std::fs::write(
+            svc.join("go.mod"),
+            format!("module example.com/svc\n\ngo 1.21\n\nrequire {UMOD} {NEXT}\n"),
+        )
+        .unwrap();
+        std::fs::write(svc.join("go.sum"), &next_pair).unwrap();
+        std::fs::write(
+            svc.join("svc.go"),
+            format!("package svc\n\nimport \"{UMOD}\"\n\nvar X = upstream.Greeting()\n"),
+        )
+        .unwrap();
+        std::fs::write(
+            app.join("go.work"),
+            format!(
+                "go 1.21\n\nuse (\n\t.\n\t./{svc_rel}\n)\n\n\
+                 replace {UMOD} {UVER} => {smod} {SVER}\n"
+            ),
+        )
+        .unwrap();
+        std::fs::write(
+            app.join("go.work.sum"),
+            format!("{smod} {SVER}/go.mod {gomod_h1}\n"),
+        )
+        .unwrap();
+
+        let machine = Machine::new(tmp.path(), &format!("{name}-machine"));
+        let run = go(&app, &machine, &["run", "."], &as_pairs(&env));
+        let stderr = String::from_utf8_lossy(&run.stderr);
+        assert!(run.status.success(), "{name}: {stderr}");
+        assert!(stderr.contains("PRISTINE-NEXT"), "{name}: {stderr}");
+        let list = go(&app, &machine, &["list", "-m", UMOD], &as_pairs(&env));
+        assert_eq!(
+            String::from_utf8_lossy(&list.stdout).trim(),
+            format!("{UMOD} {NEXT}"),
+            "{name}: {}",
+            String::from_utf8_lossy(&list.stderr)
+        );
+
+        let discovery = socket_patch_core::vex::discover::discover_patched_refs(&app).await;
+        let attested: Vec<_> = discovery
+            .refs
+            .iter()
+            .filter(|r| r.purl == purl && r.lockfile_basis_ok())
+            .collect();
+        assert!(attested.is_empty(), "{name}: {attested:?}");
+        if name == "in-root" {
+            assert!(
+                discovery
+                    .diagnostics
+                    .iter()
+                    .any(|d| d.detail.contains("is inert")),
+                "{name}: {:?}",
+                discovery.diagnostics
+            );
+        }
+    }
+}
diff --git a/crates/socket-patch-core/src/vex/discover/golang.rs b/crates/socket-patch-core/src/vex/discover/golang.rs
index 7470b96a5..fbb680c1c 100644
--- a/crates/socket-patch-core/src/vex/discover/golang.rs
+++ b/crates/socket-patch-core/src/vex/discover/golang.rs
@@ -43,19 +43,25 @@
 //!   uuid and go compiles none of its packages, so the pinned replace alone
 //!   is the attestation basis — but MVS also keeps the `/go.mod` line of a
 //!   version it reads and does not select, so a `/go.mod`-only pin whose
-//!   version go.sum shows is not selected ([`go_build_list::select`]) is
-//!   inert: diagnosed, no ref. Anything else — no `/go.mod` line, two
+//!   version the main modules' `require`s or go.sum show is not selected
+//!   ([`go_build_list::select`]) is inert: diagnosed, no ref. With a
+//!   `go.work` the build list is the union of every `use` member's
+//!   requirements, so the pin attests only when each member's go.mod is
+//!   in the root and read and they show the replaced version is the one
+//!   selected; otherwise `integrity_required = true`. Anything else — no `/go.mod` line, two
 //!   different hashes for one line, a non-dirhash `h1:` (both a go
 //!   `SECURITY ERROR`), a line of other than three tokens anywhere in a
 //!   sum file (go rejects the whole file) — is not a pin:
 //!   `integrity_required = true`, no `locked_integrity`. Hashes of other
 //!   algorithms are ignored, as go ignores them. The sum files are the
-//!   root `go.sum` and, with a `go.work`, `go.work.sum` and each in-root
-//!   `use` member's `go.sum` (go verifies against all of them, so a
-//!   member's go.sum may hold the zip line).
-//!   NB for the CLI's installed-tree basis: under a hosted replace the module cache's
-//!   `M@v` (if any, e.g. from before the redirect) is pristine BY
-//!   CONSTRUCTION — the build consumes `patch.socket.dev/gopatch/<uuid>@<sver>`.
+//!   ones go verifies against: the root `go.sum`, or with a `go.work`,
+//!   `go.work.sum` and each in-root `use` member's `go.sum` (the root's
+//!   only when `.` is a member). Under `GOWORK=off` go ignores `go.work`,
+//!   so discovery reads neither it nor its sum files.
+//!   NB for the CLI's installed-tree basis: under a hosted replace the
+//!   module cache's `M@v` (if any, e.g. from before the redirect) is
+//!   pristine BY CONSTRUCTION — the build consumes
+//!   `patch.socket.dev/gopatch/<uuid>@<sver>`.
 //! * **Vendored identity** comes from [`vendor_ref`] over the replace PATH
 //!   (root-anchored: a `../…/.socket/vendor/golang/…` or absolute target —
 //!   which `detect_owner` still classifies as `Vendor` — points the build at
@@ -83,9 +89,10 @@
 //!   against the ROOT `go.mod`'s `require` (the only one discovery reads),
 //!   and hosted pins looked up in the sum files above. go.work
 //!   replaces override go.mod replaces in Go, but rule 10 leaves
-//!   cross-file precedence to the CLI's `wiring_conflict` gate. Nested
-//!   workspace members' go.mod files are not read (root-only, rule 1);
-//!   only their go.sum pins are.
+//!   cross-file precedence to the CLI's `wiring_conflict` gate. In-root
+//!   workspace members' go.mod files are read only for their `require`s
+//!   (the `/go.mod`-only pin's selection) and their go.sum for pins; their
+//!   replaces are not (root-only, rule 1).
 //! * **Hand-edit tolerance**: a UTF-8 BOM, CRLF line ends, tab-separated
 //!   tokens, `replace(` without a space, `// comments`, and Go string
 //!   literals (`"github.com/foo/bar"`, `` `…` ``) around escape- and
@@ -104,12 +111,13 @@ use super::{
 };
 use crate::patch::apply::is_safe_relative_subpath;
 use crate::patch::path_safety::is_safe_single_segment;
-use crate::vendor::go_build_list;
+use crate::utils::go_env::go_env;
+use crate::vendor::go_build_list::{self, Selection};
 use crate::vendor::go_mod_edit::{
     self, block_structure_error, hosted_module_uuid, normalize_for_read, ReplaceEntry,
     ReplaceOwner, HOSTED_GO_MODULE_PREFIX,
 };
-use crate::vendor::go_sum_edit::{go_sum_lines, is_h1_dirhash};
+use crate::vendor::go_sum_edit::{go_semver_cmp, go_sum_lines, is_h1_dirhash};
 use crate::vendor::lock_inventory::LockIntegrity;
 
 const GO_MOD: &str = "go.mod";
@@ -118,6 +126,13 @@ const GO_WORK: &str = "go.work";
 const GO_WORK_SUM: &str = "go.work.sum";
 
 pub(crate) async fn extract(ctx: &DiscoverCtx<'_>, out: &mut Discovery) {
+    let workspaces = go_env("GOWORK").as_deref() != Some("off");
+    extract_with(ctx, out, workspaces).await;
+}
+
+/// [`extract`], with `workspaces` false under `GOWORK=off`: go then ignores
+/// `go.work`, its replaces and its sum files.
+async fn extract_with(ctx: &DiscoverCtx<'_>, out: &mut Discovery, workspaces: bool) {
     let go_mod = match ctx.read_text(GO_MOD, out).await {
         Some(text) => parse_go_file(GO_MOD, &text, out),
         None => None,
@@ -127,10 +142,12 @@ pub(crate) async fn extract(ctx: &DiscoverCtx<'_>, out: &mut Discovery) {
         .map(go_mod_edit::parse_required_versions)
         .unwrap_or_default();
 
-    let go_work = match ctx.read_text(GO_WORK, out).await {
-        Some(text) => parse_go_file(GO_WORK, &text, out),
-        None => None,
+    let go_work = if workspaces {
+        ctx.read_text(GO_WORK, out).await
+    } else {
+        None
     };
+    let go_work = go_work.and_then(|text| parse_go_file(GO_WORK, &text, out));
     let files: Vec<(&str, Vec<ReplaceEntry>)> = [(GO_MOD, &go_mod), (GO_WORK, &go_work)]
         .into_iter()
         .filter_map(|(file, text)| {
@@ -141,29 +158,111 @@ pub(crate) async fn extract(ctx: &DiscoverCtx<'_>, out: &mut Discovery) {
         .iter()
         .flat_map(|(_, entries)| entries)
         .any(|e| e.owner == Some(ReplaceOwner::Hosted));
-    let sums = if any_hosted {
-        SumPins::read(ctx, out, go_work.as_deref()).await
-    } else {
-        SumPins::default()
-    };
-    let graph = Graph {
-        pruned: go_mod
-            .as_deref()
-            .is_some_and(go_mod_edit::prunes_module_graph),
+    let mut graph = Graph {
         required,
+        mains: Some(vec![MainModule::new(go_mod.as_deref().unwrap_or_default())]),
+        workspace: go_work.is_some(),
     };
+    let mut sums = SumPins::default();
+    if any_hosted {
+        let sum_files = match go_work.as_deref() {
+            Some(work) => {
+                let (mains, files) = read_workspace(ctx, out, go_mod.as_deref(), work).await;
+                graph.mains = mains;
+                files
+            }
+            None => vec![GO_SUM.to_string()],
+        };
+        sums = SumPins::read(ctx, out, &sum_files).await;
+    }
     for (file, entries) in &files {
         extract_file(out, file, entries, &graph, &sums);
     }
 }
 
-/// The root module's build-list evidence.
+/// The build list's evidence: the main modules' `require`s.
 struct Graph {
-    /// go >= 1.17: `require` lists every module that provides a package.
-    pruned: bool,
     /// `require` of the root module: the version the build selects (as far
     /// as a root-only reader can tell).
     required: HashMap<String, String>,
+    /// The main modules: the root module, or every `go.work` `use` member.
+    /// `None` when a member is outside the root or unreadable.
+    mains: Option<Vec<MainModule>>,
+    /// A `go.work` is in effect.
+    workspace: bool,
+}
+
+struct MainModule {
+    /// go >= 1.17: `require` lists every module that provides a package.
+    pruned: bool,
+    required: HashMap<String, String>,
+}
+
+impl MainModule {
+    fn new(go_mod: &str) -> Self {
+        MainModule {
+            pruned: go_mod_edit::prunes_module_graph(go_mod),
+            required: go_mod_edit::parse_required_versions(go_mod),
+        }
+    }
+}
+
+impl Graph {
+    /// [`go_build_list::select`] over every main module: a workspace builds
+    /// the union of its members' requirements.
+    fn select(&self, module: &str, version: &str, zips: &[&str]) -> Selection {
+        let Some(mains) = &self.mains else {
+            return Selection::Unknown;
+        };
+        let pruned = mains.iter().all(|m| m.pruned);
+        let required = mains
+            .iter()
+            .filter_map(|m| m.required.get(module).map(String::as_str))
+            .max_by(|a, b| go_semver_cmp(a, b));
+        match go_build_list::select(pruned, required, zips, version) {
+            Selection::NotInGraph if self.workspace => Selection::Unknown,
+            selected => selected,
+        }
+    }
+}
+
+/// The `use` members of `go.work` as main modules, and the sum files go
+/// verifies against in workspace mode: `go.work.sum` and each member's
+/// `go.sum` (the root's only when `.` is a member). The main modules are
+/// `None` when a member's go.mod is outside the root or unreadable.
+async fn read_workspace(
+    ctx: &DiscoverCtx<'_>,
+    out: &mut Discovery,
+    go_mod: Option<&str>,
+    go_work: &str,
+) -> (Option<Vec<MainModule>>, Vec<String>) {
+    let mut mains = Some(Vec::new());
+    let mut files = vec![GO_WORK_SUM.to_string()];
+    for dir in go_mod_edit::parse_use_dirs(go_work) {
+        let Some(dir) = member_dir(&dir) else {
+            mains = None;
+            continue;
+        };
+        let text = if dir.is_empty() {
+            go_mod.map(str::to_string)
+        } else {
+            let rel = member_file(&dir, GO_MOD);
+            match ctx.read_text(&rel, out).await {
+                Some(text) => parse_go_file(&rel, &text, out),
+                None => None,
+            }
+        };
+        match (text, mains.as_mut()) {
+            (Some(text), Some(mains)) => mains.push(MainModule::new(&text)),
+            (Some(_), None) => {}
+            (None, _) => mains = None,
+        }
+        let sum = member_file(&dir, GO_SUM);
+        if !files.contains(&sum) {
+            files.push(sum);
+        }
+    }
+    (mains, files)
 }
 
 /// Normalize a go.mod-grammar file (BOM, simple string literals) and check
@@ -243,20 +342,22 @@ fn extract_file(
                         // `replaced_purl` resolved one of the two.
                         let version = entry.version.as_deref().or(req).unwrap_or_default();
                         let zips = sums.zip_versions(&entry.module);
-                        let selected = go_build_list::select(graph.pruned, req, &zips, version);
+                        let selected = graph.select(&entry.module, version, &zips);
                         if let Some(other) = selected.other_version() {
                             out.diag(
                                 DIAG_REF_INVALID,
                                 file,
                                 format!(
-                                    "{file}: replace {} {version} is inert: go.sum shows the \
-                                     build selects {other}, so it uses the unpatched module",
+                                    "{file}: replace {} {version} is inert: the build \
+                                     selects {other}, so it uses the unpatched module",
                                     entry.module
                                 ),
                             );
                             continue;
                         }
-                        (None, false)
+                        // A workspace member out of reach may require
+                        // another version: only a proven selection attests.
+                        (None, graph.workspace && selected != Selection::Selected)
                     }
                     SumPin::Unpinned => (None, true),
                 };
@@ -428,22 +529,9 @@ enum SumPin {
 }
 
 impl SumPins {
-    /// The root `go.sum`; in workspace mode also `go.work.sum` and each
-    /// in-root `use` member's `go.sum`, which go verifies against too.
-    async fn read(ctx: &DiscoverCtx<'_>, out: &mut Discovery, go_work: Option<&str>) -> Self {
-        let mut files = vec![GO_SUM.to_string()];
-        if let Some(work) = go_work {
-            files.push(GO_WORK_SUM.to_string());
-            for dir in go_mod_edit::parse_use_dirs(work) {
-                if let Some(rel) = member_go_sum(&dir) {
-                    if !files.contains(&rel) {
-                        files.push(rel);
-                    }
-                }
-            }
-        }
+    async fn read(ctx: &DiscoverCtx<'_>, out: &mut Discovery, files: &[String]) -> Self {
         let mut pins = SumPins::default();
-        for file in &files {
+        for file in files {
             if let Some(text) = ctx.read_text(file, out).await {
                 pins.add(&text);
             }
@@ -515,9 +603,9 @@ impl SumPins {
     }
 }
 
-/// Root-relative `go.sum` of a `go.work` `use` member; `None` for the root
-/// itself (already read) and for a member outside the root.
-fn member_go_sum(dir: &str) -> Option<String> {
+/// Root-relative directory of a `go.work` `use` member (`""` for the root
+/// itself); `None` for a member outside the root.
+fn member_dir(dir: &str) -> Option<String> {
     let dir = dir.replace('\\', "/");
     if !is_safe_relative_subpath(&dir) {
         return None;
@@ -526,10 +614,14 @@ fn member_go_sum(dir: &str) -> Option<String> {
         .split('/')
         .filter(|s| !s.is_empty() && *s != ".")
         .collect();
-    if segments.is_empty() {
-        return None;
+    Some(segments.join("/"))
+}
+
+fn member_file(dir: &str, file: &str) -> String {
+    match dir {
+        "" => file.to_string(),
+        dir => format!("{dir}/{file}"),
     }
-    Some(format!("{}/{GO_SUM}", segments.join("/")))
 }
 
 #[cfg(test)]
@@ -553,7 +645,13 @@ mod tests {
         "module example.com/app\n\ngo 1.21\n\nrequire github.com/foo/bar v1.4.2\n";
 
     async fn run(p: &Project) -> Discovery {
-        p.run(|c, o| Box::pin(super::extract(c, o))).await
+        p.run(|c, o| Box::pin(super::extract_with(c, o, true)))
+            .await
+    }
+
+    async fn gowork_off(p: &Project) -> Discovery {
+        p.run(|c, o| Box::pin(super::extract_with(c, o, false)))
+            .await
     }
 
     fn gopatch(uuid: &str) -> String {
@@ -874,13 +972,175 @@ mod tests {
                     "{use_dir}"
                 );
                 assert!(r.integrity_required);
+                assert!(r.lockfile_basis_ok(), "{use_dir}");
             } else {
                 assert_eq!(r.locked_integrity, None, "{use_dir}");
+                // Nor can its `require` show the `/go.mod` line's version
+                // is the one the workspace selects.
+                assert!(!r.lockfile_basis_ok(), "{use_dir}");
+            }
+        }
+    }
+
+    /// A workspace builds the union of its members' requirements: a
+    /// `/go.mod`-only pin attests only when every member is read and none
+    /// selects another version.
+    #[tokio::test]
+    async fn workspace_go_mod_only_pin_needs_every_member_to_select_it() {
+        let m = gopatch(UUID_A);
+        let sver = "v1.4.2-socketpatch.1";
+        let svc = |go: &str, require: &str| format!("module example.com/svc\n\ngo {go}\n{require}");
+        let req = |v: &str| format!("\nrequire {MODULE} {v}\n");
+        let zip = |v: &str| format!("{MODULE} {v} {ZIP_H1}\n{MODULE} {v}/go.mod {MOD_H1}\n");
+        enum Want {
+            Attested,
+            Unproven,
+            Inert,
+        }
+        for (name, uses, svc_mod, svc_sum, want) in [
+            (
+                "member requires it too",
+                ". ./svc",
+                Some(svc("1.21", &req(VERSION))),
+                None,
+                Want::Attested,
+            ),
+            (
+                "member does not require it",
+                ". ./svc",
+                Some(svc("1.21", "")),
+                None,
+                Want::Attested,
+            ),
+            (
+                "member requires a higher version",
+                ". ./svc",
+                Some(svc("1.21", &req("v1.5.0"))),
+                Some(zip("v1.5.0")),
+                Want::Inert,
+            ),
+            (
+                "member requires a lower version",
+                ". ./svc",
+                Some(svc("1.21", &req("v1.4.1"))),
+                None,
+                Want::Attested,
+            ),
+            (
+                "go 1.16 member builds a higher zip",
+                ". ./svc",
+                Some(svc("1.16", &req("v1.4.1"))),
+                Some(zip("v1.5.0")),
+                Want::Inert,
+            ),
+            (
+                "member go.mod missing",
+                ". ./svc",
+                None,
+                None,
+                Want::Unproven,
+            ),
+            (
+                "member outside the root",
+                ". ../svc",
+                None,
+                None,
+                Want::Unproven,
+            ),
+            (
+                "root not a member",
+                "./svc",
+                Some(svc("1.21", &req(VERSION))),
+                None,
+                Want::Attested,
+            ),
+            (
+                "root not a member, nothing requires it",
+                "./svc",
+                Some(svc("1.21", "")),
+                None,
+                Want::Unproven,
+            ),
+        ] {
+            let p = Project::new();
+            p.write("go.mod", BASE_GO_MOD)
+                .write(
+                    "go.work",
+                    format!(
+                        "go 1.21\n\nuse (\n{}\n)\n\nreplace {MODULE} {VERSION} => {m} {sver}\n",
+                        uses.replace(' ', "\n")
+                    ),
+                )
+                .write("go.work.sum", format!("{m} {sver}/go.mod {MOD_H1}\n"));
+            if let Some(text) = &svc_mod {
+                p.write("svc/go.mod", text);
+            }
+            if let Some(text) = &svc_sum {
+                p.write("svc/go.sum", text);
+            }
+            let out = run(&p).await;
+            match want {
+                Want::Inert => {
+                    assert_refs(&out, &[]);
+                    assert_eq!(out.diagnostics.len(), 1, "{name}");
+                    assert_eq!(out.diagnostics[0].code, DIAG_REF_INVALID, "{name}");
+                    assert!(out.diagnostics[0].detail.contains("is inert"), "{name}");
+                }
+                Want::Attested | Want::Unproven => {
+                    assert_refs(&out, &[(PURL, UUID_A, WiringMode::Hosted)]);
+                    let ok = matches!(want, Want::Attested);
+                    assert_eq!(out.refs[0].lockfile_basis_ok(), ok, "{name}");
+                    assert_eq!(out.refs[0].locked_integrity, None, "{name}");
+                }
             }
-            assert!(r.lockfile_basis_ok(), "{use_dir}");
         }
     }
 
+    /// go verifies against the sum files of the mode it builds in: in
+    /// workspace mode `go.work.sum` and the members' go.sum (the root's only
+    /// when `.` is a member); under `GOWORK=off` the root go.sum alone, with
+    /// go.work and its replaces ignored.
+    #[tokio::test]
+    async fn sum_files_follow_the_build_mode() {
+        let m = gopatch(UUID_A);
+        let sver = "v1.4.2-socketpatch.1";
+        let pair = go_sum_for(UUID_A, sver);
+        let replace = format!("replace {MODULE} {VERSION} => {m} {sver}\n");
+        let svc = format!("module example.com/svc\n\ngo 1.21\n\nrequire {MODULE} {VERSION}\n");
+        let pinned = |out: &Discovery| {
+            assert_refs(out, &[(PURL, UUID_A, WiringMode::Hosted)]);
+            out.refs[0].locked_integrity.is_some()
+        };
+
+        // Root not a member: its go.sum is not consulted.
+        let p = Project::new();
+        p.write("go.mod", BASE_GO_MOD)
+            .write("go.work", format!("go 1.21\n\nuse ./svc\n\n{replace}"))
+            .write("svc/go.mod", &svc)
+            .write("go.sum", &pair);
+        let out = run(&p).await;
+        assert!(!pinned(&out));
+        assert!(!out.refs[0].lockfile_basis_ok());
+        p.write("svc/go.sum", &pair);
+        assert!(pinned(&run(&p).await));
+
+        // GOWORK=off: the go.work replace does not apply at all.
+        let p = Project::new();
+        p.write("go.mod", BASE_GO_MOD)
+            .write("go.work", format!("go 1.21\n\nuse .\n\n{replace}"))
+            .write("go.work.sum", &pair)
+            .write("go.sum", &pair);
+        assert_refs(&gowork_off(&p).await, &[]);
+        // A go.mod replace is pinned by the root go.sum only.
+        let p = Project::new();
+        p.write("go.mod", format!("{BASE_GO_MOD}\n{replace}"))
+            .write("go.work", "go 1.21\n\nuse .\n")
+            .write("go.work.sum", &pair);
+        assert!(!pinned(&gowork_off(&p).await));
+        p.write("go.sum", &pair);
+        assert!(pinned(&gowork_off(&p).await));
+    }
+
     /// In a go < 1.17 graph MVS keeps the `/go.mod` line of a version it only
     /// reads: a `/go.mod`-only pin whose version go.sum shows is not the one
     /// selected is inert.

From b23666dba02d84f56807a644811e7e2583a51c45 Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Tue, 27 Oct 2026 18:11:47 -0400
Subject: [PATCH 5/9] Let a hosted Go re-run restore a pruned zip line

`go mod tidy` drops the Socket module's zip checksum line while no
package of the patched module is imported. If the project later
imports it, the build fails with "missing go.sum entry", and
re-running `scan --mode hosted` left that state untouched, so the
project had no supported way back. A re-run now always writes both
go.sum lines, so it repairs the project and the build uses the patched
module again. The trade-off is that the next `go mod tidy` may drop
the line again while the module stays unimported.

Assisted-by: Claude Code:claude-opus-5-5
---
 crates/socket-patch-cli/CLI_CONTRACT.md       |  2 +-
 .../tests/e2e_golang_hosted_build.rs          | 74 +++++++++++++++----
 .../src/patch/redirect/mod.rs                 | 31 +++-----
 .../src/vendor/go_sum_edit.rs                 | 30 --------
 docs/ecosystems.md                            |  3 +
 5 files changed, 73 insertions(+), 67 deletions(-)

diff --git a/crates/socket-patch-cli/CLI_CONTRACT.md b/crates/socket-patch-cli/CLI_CONTRACT.md
index ad0f9c89b..c05f3b982 100644
--- a/crates/socket-patch-cli/CLI_CONTRACT.md
+++ b/crates/socket-patch-cli/CLI_CONTRACT.md
@@ -323,7 +323,7 @@ For a **9.0 root lock**, the CLI ensures `pnpm-workspace.yaml` carries `trustLoc
 
 **Vendored entries and the rest of the CLI.** Because nothing is in the manifest, vendored patches are invisible to `apply` (nothing to apply in place) but fully visible to `list` (listed from the ledger, labeled `Mode: vendored (recorded in .socket/vendor/state.json)` in human mode, exit 0 on a vendored-only project), `vex` (attested from the embedded records while a lockfile still wires the artifact — see "Manifest-less VEX"), `repair` (health-checked and rebuilt from the ledger), and `scan --prune` (lockfile-driven reconcile). They are exempt from standalone `vendor`'s manifest reconcile (`reconcile_dropped` never touches `detached` entries) and exit via `remove <purl>` (which reverts them), `vendor --revert`, or `rollback`, whose vendored leg reverts every in-scope ledger entry (unscoped and identifier-scoped runs; path-scoped runs reach them only when an installed copy matches).
 
-`scan --mode hosted` swaps the in-place apply for the registry-redirect pipeline: discover → resolve hosted-patch references (grant token + integrity + per-dep registry override) → rewrite ONLY the patched dependencies' lockfile / registry-config entries to point at the hosted packages. A dep counts as **redirected** only when its hosted-artifact URL (or per-dep registry index URL) actually landed in a project file — a granted reference whose rewriter found nothing to edit is neither counted nor attested. **No ledger (v5.0)**: hosted mode writes ONLY the lockfile / registry-config edits — `.socket/vendor/redirect-state.json` is never written (on success or failure), and a pre-v5 one on disk is ignored (never read for planning, never quarantined, left byte-identical). The lockfiles are the only record of a hosted patch: `list`, `vex`, `rollback`, `remove`, `vendor` and `repair` all discover the hosted pins from them (a hosted URL counts only on `https://patch.socket.dev` or the `--patch-server-url` / `SOCKET_PATCH_SERVER_URL` origin), and commit-ready output is just the lockfile / config changes. Cargo and golang are confirmed only by their rewriter's own report (`confirmed_cargo_uuids` / `confirmed_golang_uuids`): a golang dep counts only when its go.mod `replace M V => patch.socket.dev/gopatch/<uuid> <sver>` and both go.sum lines are in place (or, on a re-run, the replace and just the `/go.mod` line `go mod tidy` leaves when no package of the module is loaded, which the rewriter keeps as is), never because the patch-server origin or leftover go.sum lines appear somewhere. Gradle is confirmed the same way (`confirmed_gradle_uuids`): only when the final files hold the owned script, the index row, the live apply line in every build's settings file and the suffixed version in every lock entry of the GA (see [Gradle builds](#gradle-builds-v50)). A golang module that go.mod does not require and go.sum has no zip (`h1:` of the module tree) line for at the patched version is outside the build graph and is refused with `redirect_golang_not_in_module_graph` (nothing written); a `/go.mod`-only line doesn't count, since go writes one for every version MVS reads (#509). In a go < 1.17 graph, where `require` holds only lower bounds, the build selects the highest of the required version and go.sum's zip-line versions, and a patch for a lower version warns `redirect_golang_version_mismatch` (nothing written). Only the exact module `patch.socket.dev/gopatch/<canonical uuid>` is socket-owned; any other module path is refused with `redirect_golang_untrusted_module_path`. A vendored golang module is taken over like cargo and the npm family: its vendor wiring, committed copy and ledger entry are reverted first (`redirect_takeover_reverted_vendored`). A vendored PyPI package (requirements.txt, Poetry, Pipenv, uv, Hatch, PDM, pylock) is taken over the same way: its vendored wiring is restored to the recorded registry entry, its ledger entry and wheel are removed, and it is redirected in the same commit. The Python rewriters treat any non-registry source as user-authored, so without the revert they refused socket-patch's own vendored source and left the project vendored. A vendored Composer package is taken over the same way: its `composer.lock` entry is restored to the recorded pre-vendor entry, its ledger entry and committed copy are removed, and it is redirected in the same commit, so the lock matches a direct hosted scan and `rollback` can restore it from packagist. Without the revert the rewriter edited the vendored entry in place and kept its patch-uuid `dist.reference`, which `rollback` refused. A vendored Composer entry the takeover cannot revert (its vendored ledger entry is missing) is left vendored with `redirect_composer_vendored_entry`, never repointed in place. A takeover revert that leaves vendored wiring in place is refused with `redirect_vendored_revert_failed`. That covers a drift-skipped record (`vendor_lock_entry_drifted`) and a reverted file that still references the artifact (`vendor_revert_residual_reference`). The ledger entry and artifact are kept, and the package stays vendored and skipped. `--dry-run` predicts the same refusal from the same signals instead of previewing `redirect_would_revert_vendored`. The hosted requirements.txt rewriter only rewrites an existing pin in the root `requirements.txt`, so a vendored requirements.txt package whose wiring is a pin in a `-r` include or a `(transitive)` line vendored mode appended is kept vendored, wet and `--dry-run` alike, with `redirect_requirements_takeover_unreachable` (a top-level `warnings[]` entry, and the `errorCode` of the package's `skipped` event). Its wiring, ledger entry and wheel are kept, so it stays vendored and patched (exit 0). The uv and Poetry rewriters are covered the same way: a vendored uv package whose recorded pre-vendor `uv.lock` entry is at another version than the patch (vendored uv pins the entry down to the patch's version; the revert brings the lock's own version back, and hosted mode only pins the version the lock resolves) is kept vendored with `redirect_uv_takeover_version_unreachable`, and a vendored Poetry package on a Poetry 0.x lock (which hosted mode refuses outright) is kept vendored with `redirect_poetry_lock_unsupported`. **Staged takeover (v5.0)**: the takeover is atomic. Each purl's vendored revert is staged in memory (the run's group commit, the same journaled commit vendored mode uses), the hosted rewrite plans against the reverted project, and a staged purl the rewrite does not pin is retracted: every staged revert is undone, that purl keeps its vendored wiring, ledger entry and artifact byte-identical, and the rest are staged and rewritten again. A retracted purl is a `skipped` event whose `errorCode` is the cause: its existing skip reason (unavailable wheel metadata, …), the rewriter warning that names the package (`redirect_yarn_berry_missing_checksum`, `redirect_pypi_platform_wheel`, …), `redirect_requirements_takeover_unreachable`, the rewrite's lock-level refusal (`redirect_yarn_berry_mixed_line_endings`, `redirect_bun_lock_unsupported`, a Gradle planner refusal, …) or `redirect_takeover_not_pinned`; that warning is reported in `warnings[]`, followed by `redirect_takeover_kept_vendored` naming the package. Exit 0: the package stays vendored and patched, never unpatched in both modes. The reverts, the hosted pins and the vendored ledger then reach the disk in one commit, and the reverted artifacts are deleted only after it: a refusal or write failure before the commit writes nothing, a failed commit puts back the files it replaced, and a commit interrupted after its journal was written is finished by the next command that takes the apply lock. `--dry-run` runs the same steps and drops the staged state instead of committing, so its `verified` events and warnings are the wet run's `applied` events and warnings. A hosted run with no takeover stages its writes the same way but commits them without the journal (it writes nothing under `.socket/`): a file that fails to be replaced puts back the ones already replaced, so a failed run leaves no lock half-redirected. Re-runs over already-rewritten output plan from the current lock text and are idempotent (exit 0, lock unchanged). **Lock (v5.0)**: the hosted engine acquires `<.socket>/apply.lock` before its first wet write (the staged takeover reverts) — not on `--dry-run`, and not when the run would write nothing (zero redirects, all skipped) — so previews and no-op runs never create `.socket/`; contention is `lock_held` and a lock-file I/O fault (a read-only project root, a file squatting on `.socket/`) is `lock_io` — both exit 1, refused BEFORE any project file is written, and rendered like every other lock holder: human `Error (<code>): <message>` on stderr (+ the `--lock-timeout` hint for a live holder); JSON prints the envelope with `status: "error"` and `error: {code: "lock_held" | "lock_io", message}` (no `redirect` payload: nothing was rewritten). **Takeover symlink pre-check (v5.0)**: a vendored→hosted takeover whose recorded wiring file is a symlink is refused up front with `redirect_symlinked_file_unsupported` — wet and `--dry-run` alike, before any revert — so "nothing was written" holds. **Human mode (v5.0)**: hosted `scan` prints the results table and update detection like the other modes, then rewrites without a prompt (scan never prompts); `--dry-run` previews through the engine, and a detail fetch that leaves nothing to redirect enters the engine as a no-op (`Redirected 0 packages; rewrote 0 files.`, no lock, no `.socket/`). The detail fetch prints the same progress counter and per-package `Warning: could not fetch details for …` lines as the agent arm. An EMPTY hosted discovery prints `No patches available for installed packages.` and exits 0 without entering the engine; a discovery whose every offer is paid-tier for an org without paid access prints the table's paid nudge, then `No downloadable patches (paid subscription required).`, and exits 0 without entering the engine (parity with the agent/vendored arms). Under `--json` (v5.0, MAJOR) the outcome is recorded into the scan envelope: one event per selected patch, sorted by purl, each with `details.mode: "hosted"` — `applied` for a confirmed pin (`verified` under `--dry-run`), `skipped` with the skip reason as `errorCode` (and its detail as `reason`), or `skipped` / `redirect_unconfirmed` for a patch that was granted but no lockfile entry pinning it could be rewritten (the human output's `Not hosted <purl>: …` line) — plus a `redirect: {mode: "hosted", rewrittenFiles}` payload (the files rewritten, or that would be). A `skipped` event does not change `status` or the exit code (the hosted exit policy is an open decision, #704). Rewriter warnings carry stable `redirect_*` codes (e.g. `redirect_npm_no_lockfile`, `redirect_gradle_manual_snippet`, `redirect_golang_unsupported`); new codes are additive (MINOR). v5.0 additive codes: `redirect_composer_no_lockfile` / `redirect_gem_no_gemfile` (composer / gem: neither manifest nor lock present — once per run, after the intake gates), `redirect_gem_bundle_gemfile_unsupported` (gem: `BUNDLE_GEMFILE` — `BUNDLE_GEMFILE:` in the bundler app config, which outranks the environment variable as in `Bundler::Settings`, else the environment variable — names a manifest other than the project's `Gemfile` / `gems.rb`, so no gem is redirected or attested; a value naming one of those two selects that pair even when the other spelling is present), `redirect_gem_bundle_lockfile_unsupported` (gem: bundler 4's custom lockfile — the `BUNDLE_LOCKFILE` environment variable, else `BUNDLE_LOCKFILE:` in the bundler app config, else in the global config — names a lock other than the loaded pair's own `Gemfile.lock` / `gems.locked`, so no gem is redirected or attested rather than pinning a lock bundler ignores), `redirect_gem_twin_manifest_ambiguous` (gem: a `Gemfile` + `gems.rb` twin under default discovery; bundler 1.x loads the `Gemfile` and bundler ≥ 2 loads `gems.rb`, and a lock's `BUNDLED WITH` records which bundler wrote it, not which one installs it, so neither pair is wired or attested — remove the unused spelling or set `BUNDLE_GEMFILE` to the one in use), `redirect_gem_mirror_overrides_source` (gem: Bundler's all-source, exact patch-source or patch-hostname mirror can route the per-dep `source` block to an unpatched upstream gem. Intake reads the app config (`BUNDLE_APP_CONFIG`, where a set-but-empty value selects `<root>/config`, honoring `BUNDLE_IGNORE_CONFIG`) and all `BUNDLE_MIRROR__...` variables visible to the scan; app config overrides the environment per encoded key, then `mirror.all` takes precedence over exact source, which takes precedence over hostname. URI matching follows Bundler's whole-URI case folding, default-port/trailing-slash normalization and single slash key alias, not URL prefixes. An exact-source fallback-timeout key without a mirror URL shadows the hostname mirror and fetches that source directly; a configured URL is conservatively refused even if a timeout could bypass an unreachable mirror at install time. Like `redirect_gem_bundle_gemfile_unsupported`, the gate leaves the Gemfile pair byte-identical and confirms no gem redirect. On an embedded `scan --vex`, rediscovered older hosted gem pins may attest only from verified installed bytes: a missing tree is not excused by the lockfile, and `--vex-no-verify` omits those hosted gems with `mirror_overrides_source` rather than trusting their intercepted source. Agent/vendored evidence, unrelated ecosystems and standalone VEX behavior are unchanged. Details identify the setting form and its app/environment origin without printing mirror values or source URLs, which may contain credentials. Remove the applicable all/source/hostname setting (including any slash alias) from that origin and reuse its existing mirror URL under `mirror.https://rubygems.org` to clear the refusal; an environment setting must be unset in the scan/install environment. User-global Bundler config and mirrors set only in a later install environment are not inspected; keep those mirrors scoped to the upstream source too), `redirect_maven_no_pom` (no `pom.xml` and no Gradle build), `redirect_nuget_lock_unparseable` (a present-but-corrupt `packages.lock.json` — warned once, nothing mutated; an absent lock still proceeds; a leading UTF-8 BOM, which dotnet reads past, is not corrupt and is kept on rewrite), `redirect_nuget_lock_other_version` (the lock also resolves the patched id at another version in some target framework: the exact-id `packageSourceMapping` would route that framework to a feed that serves only the patched version, so the dep is skipped with nothing written; only lock entries at the patched version are ever re-pinned, and `resolved` is never rewritten), `redirect_nuget_mapping_set_aside` (v5.0 #462: another source's `packageSourceMapping` also named the patched id exactly — Visual Studio's mapping UI writes such lists — which ties with the Socket source so NuGet would take the package from whichever feed answers first; that pattern, or its whole `<packageSource>` when it was the only one, is commented out in a `<!-- socket-patch-<uuid> moved: … -->` comment while the patch is wired, and `remove` / `rollback` put it back byte-exact), `redirect_nuget_mapping_conflict` (such a pattern sits in markup that cannot go in a comment; the dep is skipped, nothing written). v5.0 #354: when the rewriter creates the `packageSourceMapping`, its `*` catch-all also names the sources NuGet merges in from the user config and every parent directory's config (honoring `<clear />`), since NuGet drops every source no pattern names; a fresh config only seeds `nuget.org` when those inherited configs have it (a parent that cleared it for a mirror keeps that choice); when an inherited config already has a `packageSourceMapping` (NuGet merges those too), no catch-all is written at all — only the Socket pattern — so a source the parent restricts is never widened; the exclusivity set-aside exempts only the source the run wires, so a `socket-patch-*` lookalike key or a stale uuid naming the id is set aside too, `redirect_cargo_lock_pkg_ambiguous` (several same-name+version `[[package]]` blocks and none carries the index `source` — transactional skip), `redirect_cargo_dep_overridden` (the crate does not resolve to crates.io because the user overrides it — its one `Cargo.lock` block carries a git / other-registry `source`, as a `[patch]` git or registry override in the root manifest or any cargo config leaves it, or has no `source` while the root `Cargo.toml` / project `.cargo/config*` holds a `[patch]` path entry for it; with no `Cargo.lock`, the same `[patch.crates-io]` / `[patch."https://github.com/rust-lang/crates.io-index"]` entry for the crate, by key or `package = "…"`, in the root `Cargo.toml` or the project `.cargo/config*` — transactional skip, nothing rewritten: a Socket pin would silently replace the user's fork and the then-unused `[patch]` entry breaks `cargo --locked`). Also additive: `redirect_cargo_directory_source` (#455: a cargo config replaces crates.io with an on-disk source through its `[source.crates-io] replace-with` chain — a directory source, as a `cargo vendor` project has, or a `cargo local-registry` — so the project builds every crates.io crate offline from it and a Socket registry pin would break `cargo build --frozen --offline`. The configs read are the ones cargo reads for a build in the scanned directory: the project's own `.cargo/config*`, every parent directory's (a monorepo root) and `$CARGO_HOME`'s. Every cargo dependency is skipped with nothing written, one warning each naming the crate and the config that set the replacement, and the detail points at agent mode, which patches the copy cargo builds in place. A replacement with a registry mirror is not an offline source and is still redirected). Also additive: `redirect_gem_version_not_locked` (gem: no `GEM` section of the lock lists the crawled `name (version)`, for example a version another project installed into the shared gem home; the gem is skipped with nothing written, so the user's declared constraint and the locked version are never overwritten), `redirect_gem_no_lockfile` (gem: the project has a `Gemfile` / `gems.rb` but no `Gemfile.lock` / `gems.locked`, so nothing records which version it resolves and the crawled version may be another project's copy in the shared gem home; the gem is skipped with nothing written, never pinned over the user's constraint or appended as a new dependency, and the detail asks for `bundle lock` (or `bundle install`) and a re-run). Also v5.0: a registry override of the wrong kind (or none at all) warns the arm's missing-override code for nuget/gem/golang. Refusals stay fail-closed with a diagnosis that names the actual cause: a yarn-berry lock entry resolving through a non-`npm:` protocol keeps `redirect_yarn_berry_unsupported_protocol` with the entry's ACTUAL protocol in the detail — except socket-patch's OWN vendored wiring (a `file:` range into `.socket/vendor/`), which gets the distinct `redirect_yarn_berry_vendored_entry` code whose detail names the retirement path (`remove <purl>` per package, or `vendor --revert` which unwinds every vendored package, then re-run `scan --mode hosted`). Both leave the entry byte-identical; neither changes exit code or status. **yarn berry line endings (v5.0)**: yarn writes a NEW `yarn.lock` with the OS line ending (`os.EOL` — CRLF on Windows) and keeps an existing lock's majority ending on every later write, and a `core.autocrlf` checkout turns an LF lock CRLF on any OS — so a uniformly CRLF lock is rewritten in its own ending: every untouched byte (a leading BOM included) round-trips (and `rollback`'s upstream restore keeps the lock's own ending). A lock that MIXES CRLF and LF (or holds a bare CR) has no single ending to keep — yarn's own `--immutable` check rejects it too (YN0028) — so it is refused untouched with `redirect_yarn_berry_mixed_line_endings` (the detail names `yarn install`, which normalizes it). The root `package.json`, which the rewrite re-renders to add `resolutions`, gets the same gate: a mixed one is refused untouched with the same code — the decision vendored mode takes with `vendor_yarn_berry_mixed_line_endings`, from the same shared berry gate set. This replaces v4's `redirect_yarn_berry_crlf_unsupported`, which refused every CRLF lock and is no longer emitted. A vendored→hosted takeover of a yarn-berry entry is checked against these project gates (mixed `yarn.lock` / `package.json` line endings, unsupported `cacheKey`, a non-zero `.yarnrc.yml` `compressionLevel`) on the project as it is before any revert, because the revert re-renders `package.json` in its majority ending — wet and `--dry-run` alike. A refused purl keeps its vendored wiring, ledger entry and artifact byte-identical, is skipped with the gate's code (reported in `warnings[]`, followed by `redirect_takeover_kept_vendored`) and is never announced as `redirect_takeover_reverted_vendored`.
+`scan --mode hosted` swaps the in-place apply for the registry-redirect pipeline: discover → resolve hosted-patch references (grant token + integrity + per-dep registry override) → rewrite ONLY the patched dependencies' lockfile / registry-config entries to point at the hosted packages. A dep counts as **redirected** only when its hosted-artifact URL (or per-dep registry index URL) actually landed in a project file — a granted reference whose rewriter found nothing to edit is neither counted nor attested. **No ledger (v5.0)**: hosted mode writes ONLY the lockfile / registry-config edits — `.socket/vendor/redirect-state.json` is never written (on success or failure), and a pre-v5 one on disk is ignored (never read for planning, never quarantined, left byte-identical). The lockfiles are the only record of a hosted patch: `list`, `vex`, `rollback`, `remove`, `vendor` and `repair` all discover the hosted pins from them (a hosted URL counts only on `https://patch.socket.dev` or the `--patch-server-url` / `SOCKET_PATCH_SERVER_URL` origin), and commit-ready output is just the lockfile / config changes. Cargo and golang are confirmed only by their rewriter's own report (`confirmed_cargo_uuids` / `confirmed_golang_uuids`): a golang dep counts only when its go.mod `replace M V => patch.socket.dev/gopatch/<uuid> <sver>` and both go.sum lines are in place (a re-run restores the zip line `go mod tidy` drops while no package of the module is loaded, so a later import still builds), never because the patch-server origin or leftover go.sum lines appear somewhere. Gradle is confirmed the same way (`confirmed_gradle_uuids`): only when the final files hold the owned script, the index row, the live apply line in every build's settings file and the suffixed version in every lock entry of the GA (see [Gradle builds](#gradle-builds-v50)). A golang module that go.mod does not require and go.sum has no zip (`h1:` of the module tree) line for at the patched version is outside the build graph and is refused with `redirect_golang_not_in_module_graph` (nothing written); a `/go.mod`-only line doesn't count, since go writes one for every version MVS reads (#509). In a go < 1.17 graph, where `require` holds only lower bounds, the build selects the highest of the required version and go.sum's zip-line versions, and a patch for a lower version warns `redirect_golang_version_mismatch` (nothing written). Only the exact module `patch.socket.dev/gopatch/<canonical uuid>` is socket-owned; any other module path is refused with `redirect_golang_untrusted_module_path`. A vendored golang module is taken over like cargo and the npm family: its vendor wiring, committed copy and ledger entry are reverted first (`redirect_takeover_reverted_vendored`). A vendored PyPI package (requirements.txt, Poetry, Pipenv, uv, Hatch, PDM, pylock) is taken over the same way: its vendored wiring is restored to the recorded registry entry, its ledger entry and wheel are removed, and it is redirected in the same commit. The Python rewriters treat any non-registry source as user-authored, so without the revert they refused socket-patch's own vendored source and left the project vendored. A vendored Composer package is taken over the same way: its `composer.lock` entry is restored to the recorded pre-vendor entry, its ledger entry and committed copy are removed, and it is redirected in the same commit, so the lock matches a direct hosted scan and `rollback` can restore it from packagist. Without the revert the rewriter edited the vendored entry in place and kept its patch-uuid `dist.reference`, which `rollback` refused. A vendored Composer entry the takeover cannot revert (its vendored ledger entry is missing) is left vendored with `redirect_composer_vendored_entry`, never repointed in place. A takeover revert that leaves vendored wiring in place is refused with `redirect_vendored_revert_failed`. That covers a drift-skipped record (`vendor_lock_entry_drifted`) and a reverted file that still references the artifact (`vendor_revert_residual_reference`). The ledger entry and artifact are kept, and the package stays vendored and skipped. `--dry-run` predicts the same refusal from the same signals instead of previewing `redirect_would_revert_vendored`. The hosted requirements.txt rewriter only rewrites an existing pin in the root `requirements.txt`, so a vendored requirements.txt package whose wiring is a pin in a `-r` include or a `(transitive)` line vendored mode appended is kept vendored, wet and `--dry-run` alike, with `redirect_requirements_takeover_unreachable` (a top-level `warnings[]` entry, and the `errorCode` of the package's `skipped` event). Its wiring, ledger entry and wheel are kept, so it stays vendored and patched (exit 0). The uv and Poetry rewriters are covered the same way: a vendored uv package whose recorded pre-vendor `uv.lock` entry is at another version than the patch (vendored uv pins the entry down to the patch's version; the revert brings the lock's own version back, and hosted mode only pins the version the lock resolves) is kept vendored with `redirect_uv_takeover_version_unreachable`, and a vendored Poetry package on a Poetry 0.x lock (which hosted mode refuses outright) is kept vendored with `redirect_poetry_lock_unsupported`. **Staged takeover (v5.0)**: the takeover is atomic. Each purl's vendored revert is staged in memory (the run's group commit, the same journaled commit vendored mode uses), the hosted rewrite plans against the reverted project, and a staged purl the rewrite does not pin is retracted: every staged revert is undone, that purl keeps its vendored wiring, ledger entry and artifact byte-identical, and the rest are staged and rewritten again. A retracted purl is a `skipped` event whose `errorCode` is the cause: its existing skip reason (unavailable wheel metadata, …), the rewriter warning that names the package (`redirect_yarn_berry_missing_checksum`, `redirect_pypi_platform_wheel`, …), `redirect_requirements_takeover_unreachable`, the rewrite's lock-level refusal (`redirect_yarn_berry_mixed_line_endings`, `redirect_bun_lock_unsupported`, a Gradle planner refusal, …) or `redirect_takeover_not_pinned`; that warning is reported in `warnings[]`, followed by `redirect_takeover_kept_vendored` naming the package. Exit 0: the package stays vendored and patched, never unpatched in both modes. The reverts, the hosted pins and the vendored ledger then reach the disk in one commit, and the reverted artifacts are deleted only after it: a refusal or write failure before the commit writes nothing, a failed commit puts back the files it replaced, and a commit interrupted after its journal was written is finished by the next command that takes the apply lock. `--dry-run` runs the same steps and drops the staged state instead of committing, so its `verified` events and warnings are the wet run's `applied` events and warnings. A hosted run with no takeover stages its writes the same way but commits them without the journal (it writes nothing under `.socket/`): a file that fails to be replaced puts back the ones already replaced, so a failed run leaves no lock half-redirected. Re-runs over already-rewritten output plan from the current lock text and are idempotent (exit 0, lock unchanged). **Lock (v5.0)**: the hosted engine acquires `<.socket>/apply.lock` before its first wet write (the staged takeover reverts) — not on `--dry-run`, and not when the run would write nothing (zero redirects, all skipped) — so previews and no-op runs never create `.socket/`; contention is `lock_held` and a lock-file I/O fault (a read-only project root, a file squatting on `.socket/`) is `lock_io` — both exit 1, refused BEFORE any project file is written, and rendered like every other lock holder: human `Error (<code>): <message>` on stderr (+ the `--lock-timeout` hint for a live holder); JSON prints the envelope with `status: "error"` and `error: {code: "lock_held" | "lock_io", message}` (no `redirect` payload: nothing was rewritten). **Takeover symlink pre-check (v5.0)**: a vendored→hosted takeover whose recorded wiring file is a symlink is refused up front with `redirect_symlinked_file_unsupported` — wet and `--dry-run` alike, before any revert — so "nothing was written" holds. **Human mode (v5.0)**: hosted `scan` prints the results table and update detection like the other modes, then rewrites without a prompt (scan never prompts); `--dry-run` previews through the engine, and a detail fetch that leaves nothing to redirect enters the engine as a no-op (`Redirected 0 packages; rewrote 0 files.`, no lock, no `.socket/`). The detail fetch prints the same progress counter and per-package `Warning: could not fetch details for …` lines as the agent arm. An EMPTY hosted discovery prints `No patches available for installed packages.` and exits 0 without entering the engine; a discovery whose every offer is paid-tier for an org without paid access prints the table's paid nudge, then `No downloadable patches (paid subscription required).`, and exits 0 without entering the engine (parity with the agent/vendored arms). Under `--json` (v5.0, MAJOR) the outcome is recorded into the scan envelope: one event per selected patch, sorted by purl, each with `details.mode: "hosted"` — `applied` for a confirmed pin (`verified` under `--dry-run`), `skipped` with the skip reason as `errorCode` (and its detail as `reason`), or `skipped` / `redirect_unconfirmed` for a patch that was granted but no lockfile entry pinning it could be rewritten (the human output's `Not hosted <purl>: …` line) — plus a `redirect: {mode: "hosted", rewrittenFiles}` payload (the files rewritten, or that would be). A `skipped` event does not change `status` or the exit code (the hosted exit policy is an open decision, #704). Rewriter warnings carry stable `redirect_*` codes (e.g. `redirect_npm_no_lockfile`, `redirect_gradle_manual_snippet`, `redirect_golang_unsupported`); new codes are additive (MINOR). v5.0 additive codes: `redirect_composer_no_lockfile` / `redirect_gem_no_gemfile` (composer / gem: neither manifest nor lock present — once per run, after the intake gates), `redirect_gem_bundle_gemfile_unsupported` (gem: `BUNDLE_GEMFILE` — `BUNDLE_GEMFILE:` in the bundler app config, which outranks the environment variable as in `Bundler::Settings`, else the environment variable — names a manifest other than the project's `Gemfile` / `gems.rb`, so no gem is redirected or attested; a value naming one of those two selects that pair even when the other spelling is present), `redirect_gem_bundle_lockfile_unsupported` (gem: bundler 4's custom lockfile — the `BUNDLE_LOCKFILE` environment variable, else `BUNDLE_LOCKFILE:` in the bundler app config, else in the global config — names a lock other than the loaded pair's own `Gemfile.lock` / `gems.locked`, so no gem is redirected or attested rather than pinning a lock bundler ignores), `redirect_gem_twin_manifest_ambiguous` (gem: a `Gemfile` + `gems.rb` twin under default discovery; bundler 1.x loads the `Gemfile` and bundler ≥ 2 loads `gems.rb`, and a lock's `BUNDLED WITH` records which bundler wrote it, not which one installs it, so neither pair is wired or attested — remove the unused spelling or set `BUNDLE_GEMFILE` to the one in use), `redirect_gem_mirror_overrides_source` (gem: Bundler's all-source, exact patch-source or patch-hostname mirror can route the per-dep `source` block to an unpatched upstream gem. Intake reads the app config (`BUNDLE_APP_CONFIG`, where a set-but-empty value selects `<root>/config`, honoring `BUNDLE_IGNORE_CONFIG`) and all `BUNDLE_MIRROR__...` variables visible to the scan; app config overrides the environment per encoded key, then `mirror.all` takes precedence over exact source, which takes precedence over hostname. URI matching follows Bundler's whole-URI case folding, default-port/trailing-slash normalization and single slash key alias, not URL prefixes. An exact-source fallback-timeout key without a mirror URL shadows the hostname mirror and fetches that source directly; a configured URL is conservatively refused even if a timeout could bypass an unreachable mirror at install time. Like `redirect_gem_bundle_gemfile_unsupported`, the gate leaves the Gemfile pair byte-identical and confirms no gem redirect. On an embedded `scan --vex`, rediscovered older hosted gem pins may attest only from verified installed bytes: a missing tree is not excused by the lockfile, and `--vex-no-verify` omits those hosted gems with `mirror_overrides_source` rather than trusting their intercepted source. Agent/vendored evidence, unrelated ecosystems and standalone VEX behavior are unchanged. Details identify the setting form and its app/environment origin without printing mirror values or source URLs, which may contain credentials. Remove the applicable all/source/hostname setting (including any slash alias) from that origin and reuse its existing mirror URL under `mirror.https://rubygems.org` to clear the refusal; an environment setting must be unset in the scan/install environment. User-global Bundler config and mirrors set only in a later install environment are not inspected; keep those mirrors scoped to the upstream source too), `redirect_maven_no_pom` (no `pom.xml` and no Gradle build), `redirect_nuget_lock_unparseable` (a present-but-corrupt `packages.lock.json` — warned once, nothing mutated; an absent lock still proceeds; a leading UTF-8 BOM, which dotnet reads past, is not corrupt and is kept on rewrite), `redirect_nuget_lock_other_version` (the lock also resolves the patched id at another version in some target framework: the exact-id `packageSourceMapping` would route that framework to a feed that serves only the patched version, so the dep is skipped with nothing written; only lock entries at the patched version are ever re-pinned, and `resolved` is never rewritten), `redirect_nuget_mapping_set_aside` (v5.0 #462: another source's `packageSourceMapping` also named the patched id exactly — Visual Studio's mapping UI writes such lists — which ties with the Socket source so NuGet would take the package from whichever feed answers first; that pattern, or its whole `<packageSource>` when it was the only one, is commented out in a `<!-- socket-patch-<uuid> moved: … -->` comment while the patch is wired, and `remove` / `rollback` put it back byte-exact), `redirect_nuget_mapping_conflict` (such a pattern sits in markup that cannot go in a comment; the dep is skipped, nothing written). v5.0 #354: when the rewriter creates the `packageSourceMapping`, its `*` catch-all also names the sources NuGet merges in from the user config and every parent directory's config (honoring `<clear />`), since NuGet drops every source no pattern names; a fresh config only seeds `nuget.org` when those inherited configs have it (a parent that cleared it for a mirror keeps that choice); when an inherited config already has a `packageSourceMapping` (NuGet merges those too), no catch-all is written at all — only the Socket pattern — so a source the parent restricts is never widened; the exclusivity set-aside exempts only the source the run wires, so a `socket-patch-*` lookalike key or a stale uuid naming the id is set aside too, `redirect_cargo_lock_pkg_ambiguous` (several same-name+version `[[package]]` blocks and none carries the index `source` — transactional skip), `redirect_cargo_dep_overridden` (the crate does not resolve to crates.io because the user overrides it — its one `Cargo.lock` block carries a git / other-registry `source`, as a `[patch]` git or registry override in the root manifest or any cargo config leaves it, or has no `source` while the root `Cargo.toml` / project `.cargo/config*` holds a `[patch]` path entry for it; with no `Cargo.lock`, the same `[patch.crates-io]` / `[patch."https://github.com/rust-lang/crates.io-index"]` entry for the crate, by key or `package = "…"`, in the root `Cargo.toml` or the project `.cargo/config*` — transactional skip, nothing rewritten: a Socket pin would silently replace the user's fork and the then-unused `[patch]` entry breaks `cargo --locked`). Also additive: `redirect_cargo_directory_source` (#455: a cargo config replaces crates.io with an on-disk source through its `[source.crates-io] replace-with` chain — a directory source, as a `cargo vendor` project has, or a `cargo local-registry` — so the project builds every crates.io crate offline from it and a Socket registry pin would break `cargo build --frozen --offline`. The configs read are the ones cargo reads for a build in the scanned directory: the project's own `.cargo/config*`, every parent directory's (a monorepo root) and `$CARGO_HOME`'s. Every cargo dependency is skipped with nothing written, one warning each naming the crate and the config that set the replacement, and the detail points at agent mode, which patches the copy cargo builds in place. A replacement with a registry mirror is not an offline source and is still redirected). Also additive: `redirect_gem_version_not_locked` (gem: no `GEM` section of the lock lists the crawled `name (version)`, for example a version another project installed into the shared gem home; the gem is skipped with nothing written, so the user's declared constraint and the locked version are never overwritten), `redirect_gem_no_lockfile` (gem: the project has a `Gemfile` / `gems.rb` but no `Gemfile.lock` / `gems.locked`, so nothing records which version it resolves and the crawled version may be another project's copy in the shared gem home; the gem is skipped with nothing written, never pinned over the user's constraint or appended as a new dependency, and the detail asks for `bundle lock` (or `bundle install`) and a re-run). Also v5.0: a registry override of the wrong kind (or none at all) warns the arm's missing-override code for nuget/gem/golang. Refusals stay fail-closed with a diagnosis that names the actual cause: a yarn-berry lock entry resolving through a non-`npm:` protocol keeps `redirect_yarn_berry_unsupported_protocol` with the entry's ACTUAL protocol in the detail — except socket-patch's OWN vendored wiring (a `file:` range into `.socket/vendor/`), which gets the distinct `redirect_yarn_berry_vendored_entry` code whose detail names the retirement path (`remove <purl>` per package, or `vendor --revert` which unwinds every vendored package, then re-run `scan --mode hosted`). Both leave the entry byte-identical; neither changes exit code or status. **yarn berry line endings (v5.0)**: yarn writes a NEW `yarn.lock` with the OS line ending (`os.EOL` — CRLF on Windows) and keeps an existing lock's majority ending on every later write, and a `core.autocrlf` checkout turns an LF lock CRLF on any OS — so a uniformly CRLF lock is rewritten in its own ending: every untouched byte (a leading BOM included) round-trips (and `rollback`'s upstream restore keeps the lock's own ending). A lock that MIXES CRLF and LF (or holds a bare CR) has no single ending to keep — yarn's own `--immutable` check rejects it too (YN0028) — so it is refused untouched with `redirect_yarn_berry_mixed_line_endings` (the detail names `yarn install`, which normalizes it). The root `package.json`, which the rewrite re-renders to add `resolutions`, gets the same gate: a mixed one is refused untouched with the same code — the decision vendored mode takes with `vendor_yarn_berry_mixed_line_endings`, from the same shared berry gate set. This replaces v4's `redirect_yarn_berry_crlf_unsupported`, which refused every CRLF lock and is no longer emitted. A vendored→hosted takeover of a yarn-berry entry is checked against these project gates (mixed `yarn.lock` / `package.json` line endings, unsupported `cacheKey`, a non-zero `.yarnrc.yml` `compressionLevel`) on the project as it is before any revert, because the revert re-renders `package.json` in its majority ending — wet and `--dry-run` alike. A refused purl keeps its vendored wiring, ledger entry and artifact byte-identical, is skipped with the gate's code (reported in `warnings[]`, followed by `redirect_takeover_kept_vendored`) and is never announced as `redirect_takeover_reverted_vendored`.
 
 **Attribution gate (v5.0).** A hosted run never leaves wiring that lockfile discovery calls contested: before the rewrite writes any lockfile, the same discovery `vex`, `list`, `rollback`, `remove` and `vendor` read runs over the project as the rewrite would leave it. A candidate whose pin discovery reads but cannot attribute to one package version (a requirements `-r` include resolving the same version from the registry beside a rewired `Pipfile.lock`, #567; a Maven pin in a `<profile>`, #260) is left out of the rewrite and reported as a `skipped` event with `errorCode` `redirect_unattributable` (nothing written for it; exit code unchanged). Unchanged: a pin in a file discovery does not read (a pre-2.6 bundler `Gemfile`, locked by the next `bundle install`) keeps the rewriter's verdict, and so does a deliberate partial redirect the run already reports (a bundled or `bun patch`-ed copy left on the registry, a yarn `npm:` alias entry left on the registry with `redirect_yarn_classic_alias_skipped` / `redirect_yarn_berry_alias_skipped` while the package's direct entry is pinned, a dep withheld from the vlt rewrite while a sibling lock takes it), and so does a vendored→hosted takeover: its vendored wiring is reverted in the run's staged overlay before the rewrite plans, and it is redirected when the rewriters pin it (otherwise it is retracted and stays vendored), in a `--dry-run` preview the same. A pin whose own pnpm or yarn lock also installs an unpatched copy of the same `name@version` (a pnpm `file:` directory or tarball dependency; a yarn `file:` / URL / berry `portal:` / `link:` dependency declared under another name) is written too, with a `redirect_copy_unpatched` warning naming that entry, and is not attested. A lockless NuGet / Cargo pin (an exclusive Socket source mapping without `packages.lock.json`, a Cargo registry pin without `Cargo.lock`) is still written, with a `redirect_pin_lockless` warning: no lockfile records its version, so `vex` cannot attest it and `rollback` / `remove` / `vendor` refuse it until the lockfile exists (whether such pins should be written at all is an open decision). The rollout's recorded view uses the same discovery: a uuid a file merely mentions (a stale `package.json` field, an inactive `pdm.lock`, a comment) is not a pin and does not count as already patched.
 
diff --git a/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs b/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs
index 1ca070d53..80ae93a30 100644
--- a/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs
@@ -762,11 +762,13 @@ async fn golang_get_uuid_hosted_day2_machine_builds() {
 /// requirement and nothing imports its packages: `go mod tidy` prunes the
 /// socket module's zip line from the committed pair, the build stays green
 /// on a fresh machine (the zip is never fetched), and discovery still reads
-/// the `/go.mod` line as the hosted pin.
+/// the `/go.mod` line as the hosted pin. Once the project imports the
+/// module that state no longer builds, and re-running the hosted rewrite
+/// restores the zip line so it builds the patched module again.
 // #[serial]: see the capstone's note — env mutation vs env iteration.
 #[tokio::test]
 #[serial_test::serial]
-async fn tidy_pruned_zip_line_still_pins_the_hosted_replace() {
+async fn tidy_pruned_zip_line_pins_and_a_rerun_restores_it() {
     if !golang_e2e_matrix::toolchain_ready("e2e_golang_hosted_build") {
         return;
     }
@@ -839,7 +841,41 @@ async fn tidy_pruned_zip_line_still_pins_the_hosted_replace() {
         String::from_utf8_lossy(&build.stderr)
     );
 
-    // Re-running the hosted rewrite leaves the tidy pair alone.
+    let discovery = socket_patch_core::vex::discover::discover_patched_refs(&consumer).await;
+    let purl = format!("pkg:golang/{UMOD}@{UVER}");
+    let refs: Vec<_> = discovery.refs.iter().filter(|r| r.purl == purl).collect();
+    assert_eq!(refs.len(), 1, "{:?}", discovery.refs);
+    assert_eq!(refs[0].uuid, UUID);
+    assert!(refs[0].lockfile_basis_ok(), "{:?}", refs[0]);
+    assert!(
+        discovery.diagnostics.is_empty(),
+        "{:?}",
+        discovery.diagnostics
+    );
+
+    // The project starts importing the patched module (and requires it, as
+    // go 1.16 wants for a directly imported module): the tidy state no
+    // longer builds.
+    let go_mod = std::fs::read_to_string(consumer.join("go.mod")).unwrap();
+    std::fs::write(
+        consumer.join("go.mod"),
+        format!("{go_mod}\nrequire {UMOD} {UVER}\n"),
+    )
+    .unwrap();
+    std::fs::write(
+        consumer.join("main.go"),
+        format!(
+            "package main\n\nimport (\n\t\"{MID}\"\n\t\"{UMOD}\"\n)\n\n\
+             func main() {{ println(mid.Hello(), upstream.Greeting()) }}\n"
+        ),
+    )
+    .unwrap();
+    let m3 = Machine::new(tmp.path(), "machine3");
+    let broken = go(&consumer, &m3, &["build", "./..."], &as_pairs(&env));
+    let stderr = String::from_utf8_lossy(&broken.stderr);
+    assert!(!broken.status.success(), "{stderr}");
+    assert!(stderr.contains("missing go.sum entry"), "{stderr}");
+
     let ovr = DepOverride {
         ecosystem: "golang".into(),
         name: UMOD.into(),
@@ -860,8 +896,8 @@ async fn tidy_pruned_zip_line_still_pins_the_hosted_replace() {
             },
         }),
         integrity: Integrity {
-            dirhash_h1: Some(zip_h1),
-            go_mod_h1: Some(gomod_h1),
+            dirhash_h1: Some(zip_h1.clone()),
+            go_mod_h1: Some(gomod_h1.clone()),
             ..Default::default()
         },
     };
@@ -874,20 +910,28 @@ async fn tidy_pruned_zip_line_still_pins_the_hosted_replace() {
         .collect();
     let rerun = rewrite_registry_redirect(&files, std::slice::from_ref(&ovr));
     assert!(rerun.warnings.is_empty(), "{:?}", rerun.warnings);
-    assert!(rerun.files.is_empty(), "{:?}", rerun.files);
     assert!(rerun.confirmed_golang_uuids.contains(UUID));
+    assert_eq!(
+        rerun.files.keys().collect::<Vec<_>>(),
+        ["go.sum"],
+        "{:?}",
+        rerun.files
+    );
+    let restored = &rerun.files["go.sum"];
+    assert!(
+        restored.contains(&format!("{smod} {SVER} {zip_h1}\n")),
+        "{restored}"
+    );
+    std::fs::write(consumer.join("go.sum"), restored).unwrap();
 
-    let discovery = socket_patch_core::vex::discover::discover_patched_refs(&consumer).await;
-    let purl = format!("pkg:golang/{UMOD}@{UVER}");
-    let refs: Vec<_> = discovery.refs.iter().filter(|r| r.purl == purl).collect();
-    assert_eq!(refs.len(), 1, "{:?}", discovery.refs);
-    assert_eq!(refs[0].uuid, UUID);
-    assert!(refs[0].lockfile_basis_ok(), "{:?}", refs[0]);
+    let m4 = Machine::new(tmp.path(), "machine4");
+    let run = go(&consumer, &m4, &["run", "."], &as_pairs(&env));
+    let stderr = String::from_utf8_lossy(&run.stderr);
     assert!(
-        discovery.diagnostics.is_empty(),
-        "{:?}",
-        discovery.diagnostics
+        run.status.success(),
+        "fresh-machine run after re-run failed: {stderr}"
     );
+    assert!(stderr.contains("hi PATCHED"), "{stderr}");
 }
 
 /// A go.work whose other `use` member requires a higher version of the
diff --git a/crates/socket-patch-core/src/patch/redirect/mod.rs b/crates/socket-patch-core/src/patch/redirect/mod.rs
index 246a705b2..bb3acdd33 100644
--- a/crates/socket-patch-core/src/patch/redirect/mod.rs
+++ b/crates/socket-patch-core/src/patch/redirect/mod.rs
@@ -9410,16 +9410,11 @@ fn rewrite_golang(
                 }
             }
         }
-        // A re-run over a project `go mod tidy` left with only the `/go.mod`
-        // line (no package of the module is loaded) is already pinned:
-        // re-adding the zip line would only churn the next tidy.
-        let tidied = prior.is_some_and(|e| {
-            e.owner == Some(go_mod_edit::ReplaceOwner::Hosted)
-                && e.version.as_deref() == Some(dep.version.as_str())
-                && e.rhs_module.as_deref() == Some(rhs_module.as_str())
-                && e.rhs_version.as_deref() == Some(rhs_version.as_str())
-        }) && go_sum.holds_only_go_mod_line(rhs_module, rhs_version, gomod_h1);
-        if !tidied && go_sum.upsert_module_lines(rhs_module, rhs_version, zip_h1, gomod_h1) {
+        // Always both lines, even over the `/go.mod` line alone that `go mod
+        // tidy` leaves while no package of the module is loaded: the
+        // rewriter cannot see imports, and without the zip line a later
+        // import fails `missing go.sum entry` with nothing else to restore it.
+        if go_sum.upsert_module_lines(rhs_module, rhs_version, zip_h1, gomod_h1) {
             sum_changed = true;
             result.edits.push(FileEdit {
                 path: "go.sum".into(),
@@ -23121,9 +23116,9 @@ packages:
     }
 
     /// `go mod tidy` drops the socket module's zip line when no package of it
-    /// is loaded; a re-run leaves that pair alone and still confirms.
+    /// is loaded; a re-run restores it, so a later import still builds.
     #[test]
-    fn golang_rerun_keeps_a_tidy_pruned_pair() {
+    fn golang_rerun_restores_a_tidy_pruned_zip_line() {
         let files = golang_files();
         let ovr = golang_override();
         let first = rewrite_registry_redirect(&files, std::slice::from_ref(&ovr));
@@ -23136,17 +23131,11 @@ packages:
         assert_ne!(tidied, first.files["go.sum"]);
         let mut again = files.clone();
         again.extend(first.files.clone());
-        again.insert("go.sum".to_string(), tidied.clone());
+        again.insert("go.sum".to_string(), tidied);
         let second = rewrite_registry_redirect(&again, std::slice::from_ref(&ovr));
-        assert!(second.files.is_empty(), "{:?}", second.files);
+        assert_eq!(second.files.keys().collect::<Vec<_>>(), ["go.sum"]);
+        assert_eq!(second.files["go.sum"], first.files["go.sum"]);
         assert!(second.confirmed_golang_uuids.contains(GO_UUID));
-
-        // A `/go.mod` line with another hash is not the pin: rewritten.
-        let mod_h1 = ovr.integrity.go_mod_h1.clone().unwrap();
-        let wrong = tidied.replace(&mod_h1, "h1:CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC=");
-        again.insert("go.sum".to_string(), wrong);
-        let third = rewrite_registry_redirect(&again, std::slice::from_ref(&ovr));
-        assert_eq!(third.files["go.sum"], first.files["go.sum"]);
     }
 
     /// Only `patch.socket.dev/gopatch/<canonical uuid>` is a hosted module;
diff --git a/crates/socket-patch-core/src/vendor/go_sum_edit.rs b/crates/socket-patch-core/src/vendor/go_sum_edit.rs
index c0c2b9a8e..6c5fcceb4 100644
--- a/crates/socket-patch-core/src/vendor/go_sum_edit.rs
+++ b/crates/socket-patch-core/src/vendor/go_sum_edit.rs
@@ -223,22 +223,6 @@ impl GoSumEditor {
             .chain(lines.into_iter().flatten())
     }
 
-    /// True when the only line for `module@version` is exactly its wanted
-    /// `/go.mod` line: what `go mod tidy` leaves of the pair when no package
-    /// of the module is loaded.
-    pub(crate) fn holds_only_go_mod_line(
-        &self,
-        module: &str,
-        version: &str,
-        gomod_h1: &str,
-    ) -> bool {
-        let want = format!("{module} {version}/go.mod {gomod_h1}");
-        let mut key_lines = self
-            .current_lines()
-            .filter(|l| is_version_line(l, module, version));
-        key_lines.next() == Some(want.as_str()) && key_lines.next().is_none()
-    }
-
     /// Upsert the two `go.sum` lines for `module@version`. Any existing lines
     /// for exactly that module+version (either suffix form) are replaced;
     /// everything else — including stale lines for the *replaced* original
@@ -468,20 +452,6 @@ mod tests {
         Some((editor.into_string(), removed))
     }
 
-    #[test]
-    fn only_the_exact_go_mod_line_is_the_tidy_pair() {
-        let gomod = format!("{MOD} {VER}/go.mod {GOMOD_H1}\n");
-        let holds = |text: &str| {
-            GoSumEditor::new(text.to_string()).holds_only_go_mod_line(MOD, VER, GOMOD_H1)
-        };
-        assert!(holds(&gomod));
-        assert!(holds(&format!("a.com/x v1.0.0 h1:x=\n{gomod}")));
-        assert!(!holds(""));
-        assert!(!holds(&format!("{MOD} {VER} {ZIP_H1}\n{gomod}")));
-        assert!(!holds(&format!("{MOD} {VER}/go.mod {ZIP_H1}\n")));
-        assert!(!holds(&format!("{gomod}{gomod}")));
-    }
-
     #[test]
     fn creates_from_empty_and_is_idempotent() {
         let out = upsert_module_lines("", MOD, VER, ZIP_H1, GOMOD_H1).unwrap();
diff --git a/docs/ecosystems.md b/docs/ecosystems.md
index 62b0b8556..052d94451 100644
--- a/docs/ecosystems.md
+++ b/docs/ecosystems.md
@@ -1443,6 +1443,9 @@ replacement. Go uses committed `go.sum` entries without consulting the checksum
 database for those entries, so a fresh checkout needs no per-machine checksum
 exemption. A mismatched checksum still fails the build. The rewriter removes the
 replaced version's original sum lines to keep the result stable under `go mod tidy`.
+When no package of the patched module is imported, `go mod tidy` drops the zip-hash
+line and the build still works; re-running `scan --mode hosted` writes it back, so a
+later import of the module builds without a `missing go.sum entry` error.
 A re-pin to a newer patch (a superseding patch uuid, or the same patch republished
 at a new `-socketpatch.<n>` version) also removes the previous Socket module's sum
 lines, so `go mod tidy -diff` stays clean after a patch update.

From 46b40a1dd4e68466607193f193ad6e9c425d5d2c Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Tue, 27 Oct 2026 19:02:13 -0400
Subject: [PATCH 6/9] Don't attest Go /go.mod-only pins in a workspace

A go.work build never makes a member's go.mod list the versions it
builds, and it adds missing checksums to go.work.sum on its own. So a
member's dependency can pull in a newer version of a patched module
than any committed file names, and the build links the unpatched
module. vex used to attest such a pin from the lockfile whenever the
members' go.mod files named the patched version.

In a workspace a pin with only the /go.mod line now needs a verifying
installed copy, and a newer version in a member's require or in any
recorded zip line marks the replace as inert. Docs and the CLI contract
say so, and a real-go test covers the member dependency case.

Assisted-by: Claude Code:claude-opus-5-5
---
 crates/socket-patch-cli/CLI_CONTRACT.md       |   2 +-
 .../tests/e2e_golang_hosted_build.rs          | 122 ++++++++++++
 .../src/vex/discover/golang.rs                | 184 ++++++++++++------
 docs/ecosystems.md                            |   4 +
 4 files changed, 248 insertions(+), 64 deletions(-)

diff --git a/crates/socket-patch-cli/CLI_CONTRACT.md b/crates/socket-patch-cli/CLI_CONTRACT.md
index c05f3b982..fe119b163 100644
--- a/crates/socket-patch-cli/CLI_CONTRACT.md
+++ b/crates/socket-patch-cli/CLI_CONTRACT.md
@@ -531,7 +531,7 @@ Discovery is read-only, never touches the network, and never fails the run: a ma
 | bun | `bun.lock`; `bun.lockb` only when there is no `bun.lock` (bun reads exactly one) | URL tuple / binary remote-tarball resolution; version from the URL leaf. A user URL or `file:` tarball tuple / record whose `<name>-<ver>.tgz` leaf names the same `name@version` is installed from its own spec, so every ref for that `name@version` is dropped | `.socket/vendor/npm/<uuid>/<name>-<ver>.tgz` tuple / local-tarball resolution | `sha512-…`, required. A 2-tuple that Bun < 1.3.10 re-saved without its digest is still a reference, but it attests only from an installed tree. |
 | vlt | `vlt-lock.json` (lockfileVersion absent, `0` or `1`; a BOM-prefixed, unparseable, non-object or other-version lock is not read: diagnosed, no ref). `vlt.json` (read only for its `modifiers`) and `node_modules/.vlt-lock.json` are never wiring. | a registry node (any segment) whose slot [3] is a `/patch/npm/…` URL on the patch host with the leaf `<bare>-<ver>.tgz` of its DepID's `name@version`, whose embedded `<name>/<ver>` path (when present) is that `name@version`, and slot [1] == name; version from the DepID | a `file` node `.socket/vendor/npm/<uuid>/<name>-<ver>/node_modules/<name>` (or a user-installed `<name>-<ver>.tgz`) with slot [1] == name; version from the path. A same-`name@version` registry node, or a diagnosed Socket-shaped one, beside it is diagnosed, no ref. | slot [2] `sha512-…`, required (a hosted node without one is no reference). A same-`name@version` node on another registry, or a diagnosed Socket-shaped one, keeps the reference but withholds the lockfile basis: only an installed tree whose every store copy verifies attests. So does a lock some vlt release discards, the conditions of `redirect_vlt_lockfile_version_missing`, `redirect_vlt_old_lockfile_ignored` and `redirect_vlt_scalar_registry_ignored` (which in-run `--vex` withholds too): every hosted reference in it keeps no pin, and one `patched_ref_unattributable` names them. |
 | cargo | `Cargo.lock`, `Cargo.toml`, `.cargo/config` (else `.cargo/config.toml`) | `Cargo.lock` `source = "sparse+…/<uuid>/index/"`, confirmed by `Cargo.toml`: a crate the root manifest declares must pin `registry = "socket-patch-<uuid>"`. A reverted pin is diagnosed, no ref. Another `[[package]]` of the same `name@version` from a non-Socket source (crates.io, git), which cargo locks beside the pin for a dependent added later and builds unpatched (#679), withholds the ref (`patched_ref_unattributable`, never attested) while `rollback` / `remove` still unwind it. | `[patch.<source>] <key> = { path = ".socket/vendor/cargo/<uuid>/<name>-<ver>" }` — primarily the root `Cargo.toml` (v5 `vendor`; key-agnostic: `<name>` is `package` when renamed, else the key, so `<name>-socket-<uuid8>` keys count), also the project config (pre-v5 wiring), live only while the lock holds a sourceless entry for it that is not in `[[patch.unused]]`; a manifest entry cargo ignores — the project config redefines its key with another path, or a `[patch."https://github.com/rust-lang/crates.io-index"]` table replaces `[patch.crates-io]` — is diagnosed (`patched_ref_invalid`), no ref | `checksum` (v1: `[metadata]`), required |
-| golang | `go.mod`, `go.work`, `go.sum`, `go.work.sum` | `replace M v => patch.socket.dev/gopatch/<uuid> <sver>` | `replace M v => ./.socket/vendor/golang/<uuid>/M@v` | the socket module's `/go.mod` go.sum line, required. The zip line (`h1:` of the module tree) is the locked integrity when present; `go mod tidy` prunes it when no package of the module is loaded and the build stays green, so the `/go.mod` line alone still attests from the lockfile, unless the main modules' `require`s or go.sum show the build selects another version (MVS keeps the `/go.mod` line of versions it only reads): then the replace is inert. With a `go.work` the main modules are its `use` members, and a `/go.mod`-only pin attests from the lockfile only when every member's `go.mod` is in the root and readable and they show the replaced version is selected. The sum files are the ones go reads: the root `go.sum`, or with a `go.work`, `go.work.sum` and each in-root `use` member's `go.sum` (the root's only when `.` is a member); under `GOWORK=off`, `go.work` and its replaces are ignored. A conflicting hash or a malformed `h1:` for the socket module+version, or a line of other than three tokens anywhere in a sum file, is no pin. A replace that `require` no longer selects (`require M v'`) is inert: diagnosed, no ref. |
+| golang | `go.mod`, `go.work`, `go.sum`, `go.work.sum` | `replace M v => patch.socket.dev/gopatch/<uuid> <sver>` | `replace M v => ./.socket/vendor/golang/<uuid>/M@v` | the socket module's `/go.mod` go.sum line, required. The zip line (`h1:` of the module tree) is the locked integrity when present; `go mod tidy` prunes it when no package of the module is loaded and the build stays green, so the `/go.mod` line alone still attests from the lockfile, unless the main modules' `require`s or go.sum show the build selects another version (MVS keeps the `/go.mod` line of versions it only reads): then the replace is inert. With a `go.work` a `/go.mod`-only pin never attests from the lockfile: go builds a workspace without keeping any member's `go.mod` tidy and writes missing sums to `go.work.sum` itself, so a member's dependency can select a higher version that no file shows (the replace then needs a verifying installed copy). A higher version in an in-root `use` member's `require` or in a zip line of a sum file go reads makes such a replace inert. The sum files are the ones go reads: the root `go.sum`, or with a `go.work`, `go.work.sum` and each in-root `use` member's `go.sum` (the root's only when `.` is a member); under `GOWORK=off`, `go.work` and its replaces are ignored. A conflicting hash or a malformed `h1:` for the socket module+version, or a line of other than three tokens anywhere in a sum file, is no pin. A replace that `require` no longer selects (`require M v'`) is inert: diagnosed, no ref. |
 | pypi | `uv.lock` (confirmed by `pyproject.toml` `[tool.uv.sources]` when present), PEP 723 `<script>.py.lock`, `pylock.toml` / `pylock.<name>.toml`, `poetry.lock`, `pdm.lock`, `Pipfile.lock`, `requirements.txt` + its in-root `-r` includes, PEP 508 direct references in `pyproject.toml` / `hatch.toml` | Socket-host artifact url | `.socket/vendor/pypi/<uuid>/<wheel>` naming the entry's own dist | sha256, required |
 | gem | `Gemfile.lock` and `gems.locked` (the `Gemfile` / `gems.rb` only to cross-check a merged multi-remote `GEM` section) | a `GEM` section whose remote ends `patch-registry/gem/<token>/<uuid>` | `PATH` remote `.socket/vendor/gem/<uuid>/<name>-<ver>` | `CHECKSUMS` sha256, required only when the lock has a `CHECKSUMS` section (bundler ≥ 2.6) |
 | composer | `composer.lock` (`packages` + `packages-dev`) | `dist.url` on the patch host | `dist: {type: "path", url: ".socket/vendor/composer/<uuid>/…", reference: "<uuid>"}` | `dist.shasum`, required |
diff --git a/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs b/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs
index 80ae93a30..86ca7e0aa 100644
--- a/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs
@@ -1042,3 +1042,125 @@ async fn workspace_member_selecting_another_version_never_attests() {
         }
     }
 }
+
+/// A go.work member's dependency requires a higher version of the patched
+/// module than any member's go.mod names. go builds that version without
+/// asking for a go.mod update and writes its sums to `go.work.sum` itself,
+/// so the `/go.mod`-only pin is never the attestation basis, and once the
+/// higher zip line is recorded the replace is diagnosed inert.
+// #[serial]: see the capstone's note — env mutation vs env iteration.
+#[tokio::test]
+#[serial_test::serial]
+async fn workspace_transitive_raise_never_attests() {
+    if !golang_e2e_matrix::toolchain_ready("e2e_golang_hosted_build") {
+        return;
+    }
+    const NEXT: &str = "v1.1.0";
+    const MID: &str = "example.com/mid";
+    let tmp = tempfile::tempdir().unwrap();
+    let _cleanup = ChmodGuard(tmp.path().to_path_buf());
+    let proxy_url = format!("file://{}", tmp.path().join("proxy").display());
+    let smod = socket_module();
+    let upstream_gomod = format!("module {UMOD}\n\ngo 1.21\n");
+    publish(tmp.path(), UMOD, UVER, &upstream_gomod, PRISTINE_LIB);
+    publish(
+        tmp.path(),
+        UMOD,
+        NEXT,
+        &upstream_gomod,
+        "package upstream\n\nfunc Greeting() string { return \"PRISTINE-NEXT\" }\n",
+    );
+    publish(tmp.path(), &smod, SVER, &upstream_gomod, PATCHED_LIB);
+    publish(
+        tmp.path(),
+        MID,
+        "v1.0.0",
+        &format!("module {MID}\n\ngo 1.21\n\nrequire {UMOD} {NEXT}\n"),
+        "package mid\n\nfunc Hello() string { return \"hi\" }\n",
+    );
+    let (_, gomod_h1) = harvest_sums(tmp.path(), &proxy_url, &smod, SVER);
+
+    let app = tmp.path().join("app");
+    let svc = app.join("svc");
+    std::fs::create_dir_all(&svc).unwrap();
+    std::fs::write(
+        app.join("go.mod"),
+        format!("module example.com/app\n\ngo 1.21\n\nrequire {UMOD} {UVER}\n"),
+    )
+    .unwrap();
+    std::fs::write(
+        app.join("main.go"),
+        format!(
+            "package main\n\nimport \"{UMOD}\"\n\nfunc main() {{ println(upstream.Greeting()) }}\n"
+        ),
+    )
+    .unwrap();
+    std::fs::write(
+        svc.join("go.mod"),
+        format!("module example.com/svc\n\ngo 1.21\n\nrequire {MID} v1.0.0\n"),
+    )
+    .unwrap();
+    std::fs::write(
+        svc.join("svc.go"),
+        format!("package svc\n\nimport \"{MID}\"\n\nvar X = mid.Hello()\n"),
+    )
+    .unwrap();
+    std::fs::write(
+        app.join("go.work"),
+        format!("go 1.21\n\nuse (\n\t.\n\t./svc\n)\n\nreplace {UMOD} {UVER} => {smod} {SVER}\n"),
+    )
+    .unwrap();
+    std::fs::write(
+        app.join("go.work.sum"),
+        format!("{smod} {SVER}/go.mod {gomod_h1}\n"),
+    )
+    .unwrap();
+
+    let purl = format!("pkg:golang/{UMOD}@{UVER}");
+    let discovery = socket_patch_core::vex::discover::discover_patched_refs(&app).await;
+    let refs: Vec<_> = discovery.refs.iter().filter(|r| r.purl == purl).collect();
+    assert_eq!(refs.len(), 1, "{:?}", discovery.refs);
+    assert!(!refs[0].lockfile_basis_ok(), "{:?}", refs[0]);
+    assert!(
+        discovery.diagnostics.is_empty(),
+        "{:?}",
+        discovery.diagnostics
+    );
+
+    // A fresh checkout has no sums for the dependencies; skip the checksum
+    // database for this file:// proxy so go records them as it would.
+    let mut env = day2_env(&proxy_url);
+    env.retain(|(k, _)| *k != "GONOSUMDB");
+    env.push(("GONOSUMDB", "example.com".to_string()));
+    let machine = Machine::new(tmp.path(), "machine");
+    let run = go(&app, &machine, &["run", "."], &as_pairs(&env));
+    let stderr = String::from_utf8_lossy(&run.stderr);
+    assert!(run.status.success(), "{stderr}");
+    assert!(stderr.contains("PRISTINE-NEXT"), "{stderr}");
+    let list = go(&app, &machine, &["list", "-m", UMOD], &as_pairs(&env));
+    assert_eq!(
+        String::from_utf8_lossy(&list.stdout).trim(),
+        format!("{UMOD} {NEXT}"),
+        "{}",
+        String::from_utf8_lossy(&list.stderr)
+    );
+    let work_sum = std::fs::read_to_string(app.join("go.work.sum")).unwrap();
+    assert!(
+        work_sum.contains(&format!("{UMOD} {NEXT} h1:")),
+        "{work_sum}"
+    );
+
+    let discovery = socket_patch_core::vex::discover::discover_patched_refs(&app).await;
+    assert!(
+        !discovery.refs.iter().any(|r| r.purl == purl),
+        "{:?}",
+        discovery.refs
+    );
+    assert!(
+        discovery.diagnostics.iter().any(|d| d
+            .detail
+            .contains(&format!("is inert: the build selects {NEXT}"))),
+        "{:?}",
+        discovery.diagnostics
+    );
+}
diff --git a/crates/socket-patch-core/src/vex/discover/golang.rs b/crates/socket-patch-core/src/vex/discover/golang.rs
index fbb680c1c..430286379 100644
--- a/crates/socket-patch-core/src/vex/discover/golang.rs
+++ b/crates/socket-patch-core/src/vex/discover/golang.rs
@@ -43,12 +43,14 @@
 //!   uuid and go compiles none of its packages, so the pinned replace alone
 //!   is the attestation basis — but MVS also keeps the `/go.mod` line of a
 //!   version it reads and does not select, so a `/go.mod`-only pin whose
-//!   version the main modules' `require`s or go.sum show is not selected
-//!   ([`go_build_list::select`]) is inert: diagnosed, no ref. With a
-//!   `go.work` the build list is the union of every `use` member's
-//!   requirements, so the pin attests only when each member's go.mod is
-//!   in the root and read and they show the replaced version is the one
-//!   selected; otherwise `integrity_required = true`. Anything else — no `/go.mod` line, two
+//!   version go.mod's `require` or go.sum show is not selected
+//!   ([`go_build_list::select`]) is inert: diagnosed, no ref. A `go.work`
+//!   build keeps no member's go.mod tidy and adds missing sums to
+//!   `go.work.sum` itself, so a dependency's requirement can raise the
+//!   version past everything discovery reads: there a `/go.mod`-only pin
+//!   is never the basis (`integrity_required = true`), and a higher
+//!   version in a member's `require` or a sum file's zip line makes it
+//!   inert. Anything else — no `/go.mod` line, two
 //!   different hashes for one line, a non-dirhash `h1:` (both a go
 //!   `SECURITY ERROR`), a line of other than three tokens anywhere in a
 //!   sum file (go rejects the whole file) — is not a pin:
@@ -91,7 +93,7 @@
 //!   replaces override go.mod replaces in Go, but rule 10 leaves
 //!   cross-file precedence to the CLI's `wiring_conflict` gate. In-root
 //!   workspace members' go.mod files are read only for their `require`s
-//!   (the `/go.mod`-only pin's selection) and their go.sum for pins; their
+//!   (a `/go.mod`-only pin's inert check) and their go.sum for pins; their
 //!   replaces are not (root-only, rule 1).
 //! * **Hand-edit tolerance**: a UTF-8 BOM, CRLF line ends, tab-separated
 //!   tokens, `replace(` without a space, `// comments`, and Go string
@@ -103,6 +105,7 @@
 //! * `vendor/modules.txt` (`go mod vendor`) only mirrors go.mod's replaces
 //!   and is not read.
 
+use std::cmp::Ordering;
 use std::collections::{BTreeSet, HashMap, HashSet};
 
 use super::{
@@ -185,8 +188,9 @@ struct Graph {
     /// `require` of the root module: the version the build selects (as far
     /// as a root-only reader can tell).
     required: HashMap<String, String>,
-    /// The main modules: the root module, or every `go.work` `use` member.
-    /// `None` when a member is outside the root or unreadable.
+    /// The main modules: the root module, or every readable in-root
+    /// `go.work` `use` member. `None` when a member is outside the root or
+    /// unreadable.
     mains: Option<Vec<MainModule>>,
     /// A `go.work` is in effect.
     workspace: bool,
@@ -208,21 +212,28 @@ impl MainModule {
 }
 
 impl Graph {
-    /// [`go_build_list::select`] over every main module: a workspace builds
-    /// the union of its members' requirements.
+    /// [`go_build_list::select`] over the main modules. A workspace never
+    /// proves [`Selection::Selected`]: go builds it from the full module
+    /// graph without requiring any member's go.mod to be tidy, and fills in
+    /// `go.work.sum` itself, so a dependency's own requirement can raise the
+    /// module past every `require` and sum line discovery reads. Only a
+    /// higher version in that evidence proves the replace inert.
     fn select(&self, module: &str, version: &str, zips: &[&str]) -> Selection {
-        let Some(mains) = &self.mains else {
-            return Selection::Unknown;
-        };
-        let pruned = mains.iter().all(|m| m.pruned);
+        let mains = self.mains.as_deref().unwrap_or_default();
         let required = mains
             .iter()
             .filter_map(|m| m.required.get(module).map(String::as_str))
             .max_by(|a, b| go_semver_cmp(a, b));
-        match go_build_list::select(pruned, required, zips, version) {
-            Selection::NotInGraph if self.workspace => Selection::Unknown,
-            selected => selected,
+        if !self.workspace {
+            let pruned = mains.iter().all(|m| m.pruned);
+            return go_build_list::select(pruned, required, zips, version);
         }
+        required
+            .into_iter()
+            .chain(zips.iter().copied())
+            .filter(|v| go_semver_cmp(v, version) == Ordering::Greater)
+            .max_by(|a, b| go_semver_cmp(a, b))
+            .map_or(Selection::Unknown, |v| Selection::Other(v.to_string()))
     }
 }
 
@@ -355,9 +366,7 @@ fn extract_file(
                             );
                             continue;
                         }
-                        // A workspace member out of reach may require
-                        // another version: only a proven selection attests.
-                        (None, graph.workspace && selected != Selection::Selected)
+                        (None, graph.workspace)
                     }
                     SumPin::Unpinned => (None, true),
                 };
@@ -769,7 +778,8 @@ mod tests {
 
     /// `go mod tidy` keeps only the `/go.mod` line of a replaced module whose
     /// packages nothing imports, and the build stays green: that line alone
-    /// is the pin, with nothing to lock the (never fetched) zip to.
+    /// is the pin, with nothing to lock the (never fetched) zip to. Not in a
+    /// workspace, whose selection go.mod cannot show.
     #[tokio::test]
     async fn tidy_pruned_zip_line_leaves_a_go_mod_line_pin() {
         let m = gopatch(UUID_A);
@@ -789,9 +799,10 @@ mod tests {
             let out = run(&p).await;
             assert_refs(&out, &[(PURL, UUID_A, WiringMode::Hosted)]);
             let r = &out.refs[0];
+            let attests = file == "go.mod";
             assert_eq!(r.locked_integrity, None, "{file}");
-            assert!(!r.integrity_required, "{file}");
-            assert!(r.lockfile_basis_ok(), "{file}");
+            assert_eq!(r.integrity_required, !attests, "{file}");
+            assert_eq!(r.lockfile_basis_ok(), attests, "{file}");
             assert!(out.diagnostics.is_empty(), "{:?}", out.diagnostics);
         }
     }
@@ -982,84 +993,124 @@ mod tests {
         }
     }
 
-    /// A workspace builds the union of its members' requirements: a
-    /// `/go.mod`-only pin attests only when every member is read and none
-    /// selects another version.
+    /// A workspace builds the union of its members' requirements, and a
+    /// member's dependency can raise the module past every `require` while
+    /// go writes the missing sums to `go.work.sum` itself: a `/go.mod`-only
+    /// pin there is never the basis, and a higher `require` or zip line
+    /// makes it inert.
     #[tokio::test]
-    async fn workspace_go_mod_only_pin_needs_every_member_to_select_it() {
+    async fn workspace_go_mod_only_pin_is_never_the_basis() {
         let m = gopatch(UUID_A);
         let sver = "v1.4.2-socketpatch.1";
         let svc = |go: &str, require: &str| format!("module example.com/svc\n\ngo {go}\n{require}");
         let req = |v: &str| format!("\nrequire {MODULE} {v}\n");
         let zip = |v: &str| format!("{MODULE} {v} {ZIP_H1}\n{MODULE} {v}/go.mod {MOD_H1}\n");
-        enum Want {
-            Attested,
-            Unproven,
-            Inert,
-        }
-        for (name, uses, svc_mod, svc_sum, want) in [
+        let mid = "\nrequire example.com/mid v1.0.0\n";
+        for (name, uses, svc_mod, svc_sum, work_sum, inert) in [
             (
                 "member requires it too",
                 ". ./svc",
                 Some(svc("1.21", &req(VERSION))),
                 None,
-                Want::Attested,
+                None,
+                false,
             ),
             (
                 "member does not require it",
                 ". ./svc",
                 Some(svc("1.21", "")),
                 None,
-                Want::Attested,
+                None,
+                false,
             ),
             (
-                "member requires a higher version",
+                "member requires a lower version",
                 ". ./svc",
-                Some(svc("1.21", &req("v1.5.0"))),
+                Some(svc("1.21", &req("v1.4.1"))),
+                None,
+                None,
+                false,
+            ),
+            (
+                "member's dependency, sums not yet written",
+                ". ./svc",
+                Some(svc("1.21", mid)),
+                None,
+                None,
+                false,
+            ),
+            (
+                "member's dependency, go.work.sum written",
+                ". ./svc",
+                Some(svc("1.21", mid)),
+                None,
                 Some(zip("v1.5.0")),
-                Want::Inert,
+                true,
             ),
             (
-                "member requires a lower version",
+                "member's dependency, member go.sum",
                 ". ./svc",
-                Some(svc("1.21", &req("v1.4.1"))),
+                Some(svc("1.21", mid)),
+                Some(zip("v1.5.0")),
+                None,
+                true,
+            ),
+            (
+                "member requires a higher version",
+                ". ./svc",
+                Some(svc("1.21", &req("v1.5.0"))),
+                Some(zip("v1.5.0")),
                 None,
-                Want::Attested,
+                true,
             ),
             (
                 "go 1.16 member builds a higher zip",
                 ". ./svc",
                 Some(svc("1.16", &req("v1.4.1"))),
                 Some(zip("v1.5.0")),
-                Want::Inert,
+                None,
+                true,
             ),
             (
-                "member go.mod missing",
+                "only a higher /go.mod line",
                 ". ./svc",
+                Some(svc("1.21", mid)),
                 None,
-                None,
-                Want::Unproven,
+                Some(format!("{MODULE} v1.5.0/go.mod {MOD_H1}\n")),
+                false,
             ),
+            ("member go.mod missing", ". ./svc", None, None, None, false),
             (
                 "member outside the root",
                 ". ../svc",
                 None,
                 None,
-                Want::Unproven,
+                None,
+                false,
+            ),
+            (
+                "member outside the root, higher zip",
+                ". ../svc",
+                None,
+                None,
+                Some(zip("v1.5.0")),
+                true,
             ),
             (
                 "root not a member",
                 "./svc",
                 Some(svc("1.21", &req(VERSION))),
                 None,
-                Want::Attested,
+                None,
+                false,
             ),
             (
                 "root not a member, nothing requires it",
                 "./svc",
                 Some(svc("1.21", "")),
                 None,
-                Want::Unproven,
+                None,
+                false,
             ),
         ] {
             let p = Project::new();
@@ -1071,7 +1122,13 @@ mod tests {
                         uses.replace(' ', "\n")
                     ),
                 )
-                .write("go.work.sum", format!("{m} {sver}/go.mod {MOD_H1}\n"));
+                .write(
+                    "go.work.sum",
+                    format!(
+                        "{m} {sver}/go.mod {MOD_H1}\n{}",
+                        work_sum.unwrap_or_default()
+                    ),
+                );
             if let Some(text) = &svc_mod {
                 p.write("svc/go.mod", text);
             }
@@ -1079,19 +1136,20 @@ mod tests {
                 p.write("svc/go.sum", text);
             }
             let out = run(&p).await;
-            match want {
-                Want::Inert => {
-                    assert_refs(&out, &[]);
-                    assert_eq!(out.diagnostics.len(), 1, "{name}");
-                    assert_eq!(out.diagnostics[0].code, DIAG_REF_INVALID, "{name}");
-                    assert!(out.diagnostics[0].detail.contains("is inert"), "{name}");
-                }
-                Want::Attested | Want::Unproven => {
-                    assert_refs(&out, &[(PURL, UUID_A, WiringMode::Hosted)]);
-                    let ok = matches!(want, Want::Attested);
-                    assert_eq!(out.refs[0].lockfile_basis_ok(), ok, "{name}");
-                    assert_eq!(out.refs[0].locked_integrity, None, "{name}");
-                }
+            if inert {
+                assert_refs(&out, &[]);
+                assert_eq!(out.diagnostics.len(), 1, "{name}");
+                assert_eq!(out.diagnostics[0].code, DIAG_REF_INVALID, "{name}");
+                assert!(
+                    out.diagnostics[0].detail.contains("selects v1.5.0"),
+                    "{name}"
+                );
+            } else {
+                assert_refs(&out, &[(PURL, UUID_A, WiringMode::Hosted)]);
+                assert!(out.refs[0].integrity_required, "{name}");
+                assert!(!out.refs[0].lockfile_basis_ok(), "{name}");
+                assert_eq!(out.refs[0].locked_integrity, None, "{name}");
+                assert!(out.diagnostics.is_empty(), "{name}: {:?}", out.diagnostics);
             }
         }
     }
diff --git a/docs/ecosystems.md b/docs/ecosystems.md
index 052d94451..90ef261f5 100644
--- a/docs/ecosystems.md
+++ b/docs/ecosystems.md
@@ -1446,6 +1446,10 @@ replaced version's original sum lines to keep the result stable under `go mod ti
 When no package of the patched module is imported, `go mod tidy` drops the zip-hash
 line and the build still works; re-running `scan --mode hosted` writes it back, so a
 later import of the module builds without a `missing go.sum entry` error.
+In a `go.work` workspace `vex` does not attest a pin with only the `/go.mod` line:
+go builds a workspace without keeping each member's `go.mod` complete, so a member's
+dependency can select a newer version of the module that no committed file shows.
+`vex` then needs the patched module in the module cache to attest it.
 A re-pin to a newer patch (a superseding patch uuid, or the same patch republished
 at a new `-socketpatch.<n>` version) also removes the previous Socket module's sum
 lines, so `go mod tidy -diff` stays clean after a patch update.

From bc5f8c46dba6c9904959915f0d6a3947ba5f68b9 Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Tue, 27 Oct 2026 22:29:28 -0400
Subject: [PATCH 7/9] Ignore go.work.sum zip lines as selection proof

go only ever appends to go.work.sum: once a member stops depending on
whatever raised a module, the zip line of the higher version stays
behind. vex treated such a line as proof the workspace builds that
version, so it dropped a Go /go.mod-only pin as inert even when go
builds the patched version.

Only a member's require or the zip lines of a member's go.sum now mark
a workspace pin inert. The pin still needs a verifying installed copy
to attest.

Assisted-by: Claude Code:claude-opus-5-5
---
 crates/socket-patch-cli/CLI_CONTRACT.md       |  2 +-
 .../tests/e2e_golang_hosted_build.rs          | 20 ++++--------
 .../src/vex/discover/golang.rs                | 32 +++++++++++++------
 3 files changed, 30 insertions(+), 24 deletions(-)

diff --git a/crates/socket-patch-cli/CLI_CONTRACT.md b/crates/socket-patch-cli/CLI_CONTRACT.md
index fe119b163..8f44cc567 100644
--- a/crates/socket-patch-cli/CLI_CONTRACT.md
+++ b/crates/socket-patch-cli/CLI_CONTRACT.md
@@ -531,7 +531,7 @@ Discovery is read-only, never touches the network, and never fails the run: a ma
 | bun | `bun.lock`; `bun.lockb` only when there is no `bun.lock` (bun reads exactly one) | URL tuple / binary remote-tarball resolution; version from the URL leaf. A user URL or `file:` tarball tuple / record whose `<name>-<ver>.tgz` leaf names the same `name@version` is installed from its own spec, so every ref for that `name@version` is dropped | `.socket/vendor/npm/<uuid>/<name>-<ver>.tgz` tuple / local-tarball resolution | `sha512-…`, required. A 2-tuple that Bun < 1.3.10 re-saved without its digest is still a reference, but it attests only from an installed tree. |
 | vlt | `vlt-lock.json` (lockfileVersion absent, `0` or `1`; a BOM-prefixed, unparseable, non-object or other-version lock is not read: diagnosed, no ref). `vlt.json` (read only for its `modifiers`) and `node_modules/.vlt-lock.json` are never wiring. | a registry node (any segment) whose slot [3] is a `/patch/npm/…` URL on the patch host with the leaf `<bare>-<ver>.tgz` of its DepID's `name@version`, whose embedded `<name>/<ver>` path (when present) is that `name@version`, and slot [1] == name; version from the DepID | a `file` node `.socket/vendor/npm/<uuid>/<name>-<ver>/node_modules/<name>` (or a user-installed `<name>-<ver>.tgz`) with slot [1] == name; version from the path. A same-`name@version` registry node, or a diagnosed Socket-shaped one, beside it is diagnosed, no ref. | slot [2] `sha512-…`, required (a hosted node without one is no reference). A same-`name@version` node on another registry, or a diagnosed Socket-shaped one, keeps the reference but withholds the lockfile basis: only an installed tree whose every store copy verifies attests. So does a lock some vlt release discards, the conditions of `redirect_vlt_lockfile_version_missing`, `redirect_vlt_old_lockfile_ignored` and `redirect_vlt_scalar_registry_ignored` (which in-run `--vex` withholds too): every hosted reference in it keeps no pin, and one `patched_ref_unattributable` names them. |
 | cargo | `Cargo.lock`, `Cargo.toml`, `.cargo/config` (else `.cargo/config.toml`) | `Cargo.lock` `source = "sparse+…/<uuid>/index/"`, confirmed by `Cargo.toml`: a crate the root manifest declares must pin `registry = "socket-patch-<uuid>"`. A reverted pin is diagnosed, no ref. Another `[[package]]` of the same `name@version` from a non-Socket source (crates.io, git), which cargo locks beside the pin for a dependent added later and builds unpatched (#679), withholds the ref (`patched_ref_unattributable`, never attested) while `rollback` / `remove` still unwind it. | `[patch.<source>] <key> = { path = ".socket/vendor/cargo/<uuid>/<name>-<ver>" }` — primarily the root `Cargo.toml` (v5 `vendor`; key-agnostic: `<name>` is `package` when renamed, else the key, so `<name>-socket-<uuid8>` keys count), also the project config (pre-v5 wiring), live only while the lock holds a sourceless entry for it that is not in `[[patch.unused]]`; a manifest entry cargo ignores — the project config redefines its key with another path, or a `[patch."https://github.com/rust-lang/crates.io-index"]` table replaces `[patch.crates-io]` — is diagnosed (`patched_ref_invalid`), no ref | `checksum` (v1: `[metadata]`), required |
-| golang | `go.mod`, `go.work`, `go.sum`, `go.work.sum` | `replace M v => patch.socket.dev/gopatch/<uuid> <sver>` | `replace M v => ./.socket/vendor/golang/<uuid>/M@v` | the socket module's `/go.mod` go.sum line, required. The zip line (`h1:` of the module tree) is the locked integrity when present; `go mod tidy` prunes it when no package of the module is loaded and the build stays green, so the `/go.mod` line alone still attests from the lockfile, unless the main modules' `require`s or go.sum show the build selects another version (MVS keeps the `/go.mod` line of versions it only reads): then the replace is inert. With a `go.work` a `/go.mod`-only pin never attests from the lockfile: go builds a workspace without keeping any member's `go.mod` tidy and writes missing sums to `go.work.sum` itself, so a member's dependency can select a higher version that no file shows (the replace then needs a verifying installed copy). A higher version in an in-root `use` member's `require` or in a zip line of a sum file go reads makes such a replace inert. The sum files are the ones go reads: the root `go.sum`, or with a `go.work`, `go.work.sum` and each in-root `use` member's `go.sum` (the root's only when `.` is a member); under `GOWORK=off`, `go.work` and its replaces are ignored. A conflicting hash or a malformed `h1:` for the socket module+version, or a line of other than three tokens anywhere in a sum file, is no pin. A replace that `require` no longer selects (`require M v'`) is inert: diagnosed, no ref. |
+| golang | `go.mod`, `go.work`, `go.sum`, `go.work.sum` | `replace M v => patch.socket.dev/gopatch/<uuid> <sver>` | `replace M v => ./.socket/vendor/golang/<uuid>/M@v` | the socket module's `/go.mod` go.sum line, required. The zip line (`h1:` of the module tree) is the locked integrity when present; `go mod tidy` prunes it when no package of the module is loaded and the build stays green, so the `/go.mod` line alone still attests from the lockfile, unless the main modules' `require`s or go.sum show the build selects another version (MVS keeps the `/go.mod` line of versions it only reads): then the replace is inert. With a `go.work` a `/go.mod`-only pin never attests from the lockfile: go builds a workspace without keeping any member's `go.mod` tidy and writes missing sums to `go.work.sum` itself, so a member's dependency can select a higher version that no file shows (the replace then needs a verifying installed copy). A higher version in an in-root `use` member's `require` or in a zip line of a member's `go.sum` makes such a replace inert; `go.work.sum` zip lines do not, since go never drops a line from it once the requirement that raised the module is gone. The sum files are the ones go reads: the root `go.sum`, or with a `go.work`, `go.work.sum` and each in-root `use` member's `go.sum` (the root's only when `.` is a member); under `GOWORK=off`, `go.work` and its replaces are ignored. A conflicting hash or a malformed `h1:` for the socket module+version, or a line of other than three tokens anywhere in a sum file, is no pin. A replace that `require` no longer selects (`require M v'`) is inert: diagnosed, no ref. |
 | pypi | `uv.lock` (confirmed by `pyproject.toml` `[tool.uv.sources]` when present), PEP 723 `<script>.py.lock`, `pylock.toml` / `pylock.<name>.toml`, `poetry.lock`, `pdm.lock`, `Pipfile.lock`, `requirements.txt` + its in-root `-r` includes, PEP 508 direct references in `pyproject.toml` / `hatch.toml` | Socket-host artifact url | `.socket/vendor/pypi/<uuid>/<wheel>` naming the entry's own dist | sha256, required |
 | gem | `Gemfile.lock` and `gems.locked` (the `Gemfile` / `gems.rb` only to cross-check a merged multi-remote `GEM` section) | a `GEM` section whose remote ends `patch-registry/gem/<token>/<uuid>` | `PATH` remote `.socket/vendor/gem/<uuid>/<name>-<ver>` | `CHECKSUMS` sha256, required only when the lock has a `CHECKSUMS` section (bundler ≥ 2.6) |
 | composer | `composer.lock` (`packages` + `packages-dev`) | `dist.url` on the patch host | `dist: {type: "path", url: ".socket/vendor/composer/<uuid>/…", reference: "<uuid>"}` | `dist.shasum`, required |
diff --git a/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs b/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs
index 86ca7e0aa..15df680c8 100644
--- a/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs
@@ -1046,8 +1046,9 @@ async fn workspace_member_selecting_another_version_never_attests() {
 /// A go.work member's dependency requires a higher version of the patched
 /// module than any member's go.mod names. go builds that version without
 /// asking for a go.mod update and writes its sums to `go.work.sum` itself,
-/// so the `/go.mod`-only pin is never the attestation basis, and once the
-/// higher zip line is recorded the replace is diagnosed inert.
+/// so the `/go.mod`-only pin is never the attestation basis, before or
+/// after the build. The higher zip line go then records proves nothing on
+/// its own: go never drops it once the requirement is gone.
 // #[serial]: see the capstone's note — env mutation vs env iteration.
 #[tokio::test]
 #[serial_test::serial]
@@ -1151,16 +1152,7 @@ async fn workspace_transitive_raise_never_attests() {
     );
 
     let discovery = socket_patch_core::vex::discover::discover_patched_refs(&app).await;
-    assert!(
-        !discovery.refs.iter().any(|r| r.purl == purl),
-        "{:?}",
-        discovery.refs
-    );
-    assert!(
-        discovery.diagnostics.iter().any(|d| d
-            .detail
-            .contains(&format!("is inert: the build selects {NEXT}"))),
-        "{:?}",
-        discovery.diagnostics
-    );
+    let refs: Vec<_> = discovery.refs.iter().filter(|r| r.purl == purl).collect();
+    assert_eq!(refs.len(), 1, "{:?}", discovery.refs);
+    assert!(!refs[0].lockfile_basis_ok(), "{:?}", refs[0]);
 }
diff --git a/crates/socket-patch-core/src/vex/discover/golang.rs b/crates/socket-patch-core/src/vex/discover/golang.rs
index 430286379..83c062481 100644
--- a/crates/socket-patch-core/src/vex/discover/golang.rs
+++ b/crates/socket-patch-core/src/vex/discover/golang.rs
@@ -49,8 +49,10 @@
 //!   `go.work.sum` itself, so a dependency's requirement can raise the
 //!   version past everything discovery reads: there a `/go.mod`-only pin
 //!   is never the basis (`integrity_required = true`), and a higher
-//!   version in a member's `require` or a sum file's zip line makes it
-//!   inert. Anything else — no `/go.mod` line, two
+//!   version in a member's `require` or a member go.sum's zip line makes
+//!   it inert. go only ever appends to `go.work.sum`, so its zip lines
+//!   outlive the requirement that raised a module and prove nothing.
+//!   Anything else — no `/go.mod` line, two
 //!   different hashes for one line, a non-dirhash `h1:` (both a go
 //!   `SECURITY ERROR`), a line of other than three tokens anywhere in a
 //!   sum file (go rejects the whole file) — is not a pin:
@@ -542,13 +544,16 @@ impl SumPins {
         let mut pins = SumPins::default();
         for file in files {
             if let Some(text) = ctx.read_text(file, out).await {
-                pins.add(&text);
+                pins.add(&text, file != GO_WORK_SUM);
             }
         }
         pins
     }
 
-    fn add(&mut self, text: &str) {
+    /// `selects`: whether the file's zip lines show what the build selects.
+    /// go only ever appends to `go.work.sum`, so its lines outlive the
+    /// requirement that raised a module.
+    fn add(&mut self, text: &str, selects: bool) {
         // go rejects a whole go.sum with any non-blank line of other than
         // three tokens (only `go mod tidy` skips it).
         if text
@@ -559,7 +564,7 @@ impl SumPins {
             return;
         }
         for line in go_sum_lines(text) {
-            if !line.go_mod {
+            if !line.go_mod && selects {
                 self.zip_versions
                     .entry(line.module.to_string())
                     .or_default()
@@ -996,8 +1001,9 @@ mod tests {
     /// A workspace builds the union of its members' requirements, and a
     /// member's dependency can raise the module past every `require` while
     /// go writes the missing sums to `go.work.sum` itself: a `/go.mod`-only
-    /// pin there is never the basis, and a higher `require` or zip line
-    /// makes it inert.
+    /// pin there is never the basis, and a higher `require` or member
+    /// go.sum zip line makes it inert. A `go.work.sum` zip line does not:
+    /// go never drops one once nothing raises the module any more.
     #[tokio::test]
     async fn workspace_go_mod_only_pin_is_never_the_basis() {
         let m = gopatch(UUID_A);
@@ -1045,7 +1051,15 @@ mod tests {
                 Some(svc("1.21", mid)),
                 None,
                 Some(zip("v1.5.0")),
-                true,
+                false,
+            ),
+            (
+                "stale go.work.sum zip line, member requires it",
+                ". ./svc",
+                Some(svc("1.21", &req(VERSION))),
+                None,
+                Some(zip("v1.5.0")),
+                false,
             ),
             (
                 "member's dependency, member go.sum",
@@ -1094,7 +1108,7 @@ mod tests {
                 None,
                 None,
                 Some(zip("v1.5.0")),
-                true,
+                false,
             ),
             (
                 "root not a member",

From 2beda00f2f0bebf32fdf569952fabaa46450e9be Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 28 Oct 2026 04:09:41 +0000
Subject: [PATCH 8/9] Check workspace Zip pins for a higher selected version

A workspace's sum files are only appended to, so the socket zip line a
past build wrote to go.work.sum (or a member go.sum) stays after a member
starts requiring a higher version of the replaced module. Go then builds
that higher version and the replace is inert, but discovery attested the
zip-pinned ref from the lockfile anyway, and the CLI's post-gate reads
only the root go.mod and go.sum, so vex claimed a patch the build never
links. Run the same inert check GoModOnly pins already get on Zip pins
in workspace mode.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .../src/vex/discover/golang.rs                | 99 ++++++++++++++-----
 1 file changed, 75 insertions(+), 24 deletions(-)

diff --git a/crates/socket-patch-core/src/vex/discover/golang.rs b/crates/socket-patch-core/src/vex/discover/golang.rs
index 83c062481..c3df3205f 100644
--- a/crates/socket-patch-core/src/vex/discover/golang.rs
+++ b/crates/socket-patch-core/src/vex/discover/golang.rs
@@ -345,31 +345,40 @@ fn extract_file(
                 let Some(purl) = replaced_purl(entry, required, &versioned, file, out) else {
                     continue;
                 };
-                let (integrity, integrity_required) = match sums.pin(rhs, rhs_version) {
-                    SumPin::Zip(h1) => (Some(LockIntegrity::GoH1(h1)), true),
-                    SumPin::GoModOnly => {
-                        // MVS reads (and go.sum keeps the `/go.mod` line of)
-                        // versions it does not select; only a zip line shows
-                        // the replaced version is the one built.
-                        let req = required.get(&entry.module).map(String::as_str);
-                        // `replaced_purl` resolved one of the two.
-                        let version = entry.version.as_deref().or(req).unwrap_or_default();
-                        let zips = sums.zip_versions(&entry.module);
-                        let selected = graph.select(&entry.module, version, &zips);
-                        if let Some(other) = selected.other_version() {
-                            out.diag(
-                                DIAG_REF_INVALID,
-                                file,
-                                format!(
-                                    "{file}: replace {} {version} is inert: the build \
-                                     selects {other}, so it uses the unpatched module",
-                                    entry.module
-                                ),
-                            );
-                            continue;
-                        }
-                        (None, graph.workspace)
+                let pin = sums.pin(rhs, rhs_version);
+                // MVS reads (and go.sum keeps the `/go.mod` line of) versions
+                // it does not select, so a `/go.mod`-only pin needs proof the
+                // replaced version is the one built. In a workspace a zip
+                // line is no proof either: a sum file is only appended to, so
+                // a member that later raises the module leaves the socket zip
+                // line in place while go builds the higher version.
+                let check = match pin {
+                    SumPin::GoModOnly => true,
+                    SumPin::Zip(_) => graph.workspace,
+                    SumPin::Unpinned => false,
+                };
+                if check {
+                    let req = required.get(&entry.module).map(String::as_str);
+                    // `replaced_purl` resolved one of the two.
+                    let version = entry.version.as_deref().or(req).unwrap_or_default();
+                    let zips = sums.zip_versions(&entry.module);
+                    let selected = graph.select(&entry.module, version, &zips);
+                    if let Some(other) = selected.other_version() {
+                        out.diag(
+                            DIAG_REF_INVALID,
+                            file,
+                            format!(
+                                "{file}: replace {} {version} is inert: the build \
+                                 selects {other}, so it uses the unpatched module",
+                                entry.module
+                            ),
+                        );
+                        continue;
                     }
+                }
+                let (integrity, integrity_required) = match pin {
+                    SumPin::Zip(h1) => (Some(LockIntegrity::GoH1(h1)), true),
+                    SumPin::GoModOnly => (None, graph.workspace),
                     SumPin::Unpinned => (None, true),
                 };
                 let url = format!("{rhs}@{rhs_version}");
@@ -1168,6 +1177,48 @@ mod tests {
         }
     }
 
+    /// A workspace's sum files are only appended to, so the socket zip line
+    /// can outlive the build that wrote it: a member that requires a higher
+    /// version makes even a zip-pinned replace inert.
+    #[tokio::test]
+    async fn workspace_zip_pin_is_inert_under_a_higher_member_require() {
+        let m = gopatch(UUID_A);
+        let sver = "v1.4.2-socketpatch.1";
+        for (member_version, inert) in [(VERSION, false), ("v1.4.1", false), ("v1.5.0", true)] {
+            let p = Project::new();
+            p.write("go.mod", BASE_GO_MOD)
+                .write(
+                    "go.work",
+                    format!(
+                        "go 1.21\n\nuse (\n\t.\n\t./svc\n)\n\nreplace {MODULE} {VERSION} => {m} {sver}\n"
+                    ),
+                )
+                .write(
+                    "go.work.sum",
+                    format!("{m} {sver} {ZIP_H1}\n{m} {sver}/go.mod {MOD_H1}\n"),
+                )
+                .write(
+                    "svc/go.mod",
+                    format!("module example.com/svc\n\ngo 1.21\n\nrequire {MODULE} {member_version}\n"),
+                );
+            let out = run(&p).await;
+            if inert {
+                assert_refs(&out, &[]);
+                assert_eq!(out.diagnostics.len(), 1, "{member_version}");
+                assert_eq!(out.diagnostics[0].code, DIAG_REF_INVALID);
+                assert!(out.diagnostics[0].detail.contains("selects v1.5.0"));
+            } else {
+                assert_refs(&out, &[(PURL, UUID_A, WiringMode::Hosted)]);
+                assert_eq!(
+                    out.refs[0].locked_integrity,
+                    Some(LockIntegrity::GoH1(ZIP_H1.to_string())),
+                    "{member_version}"
+                );
+                assert!(out.diagnostics.is_empty(), "{:?}", out.diagnostics);
+            }
+        }
+    }
+
     /// go verifies against the sum files of the mode it builds in: in
     /// workspace mode `go.work.sum` and the members' go.sum (the root's only
     /// when `.` is a member); under `GOWORK=off` the root go.sum alone, with

From f534ec7cb03428b377b16df71aff8bf26dcf7cf7 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 28 Oct 2026 05:36:56 +0000
Subject: [PATCH 9/9] Keep readable workspace members' requires in Go selection

read_workspace dropped every main module when any `use` member was
outside the root or unreadable, so a readable member requiring a higher
version no longer marked a workspace zip pin inert and vex attested a
replace go does not build (Bugbot, golang.rs:271). In a workspace the
members' requires only ever prove a replace inert, so the readable ones
still count when another member cannot be read.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .../src/vex/discover/golang.rs                | 61 ++++++++++++++-----
 1 file changed, 47 insertions(+), 14 deletions(-)

diff --git a/crates/socket-patch-core/src/vex/discover/golang.rs b/crates/socket-patch-core/src/vex/discover/golang.rs
index c3df3205f..6375452b9 100644
--- a/crates/socket-patch-core/src/vex/discover/golang.rs
+++ b/crates/socket-patch-core/src/vex/discover/golang.rs
@@ -165,7 +165,7 @@ async fn extract_with(ctx: &DiscoverCtx<'_>, out: &mut Discovery, workspaces: bo
         .any(|e| e.owner == Some(ReplaceOwner::Hosted));
     let mut graph = Graph {
         required,
-        mains: Some(vec![MainModule::new(go_mod.as_deref().unwrap_or_default())]),
+        mains: vec![MainModule::new(go_mod.as_deref().unwrap_or_default())],
         workspace: go_work.is_some(),
     };
     let mut sums = SumPins::default();
@@ -191,9 +191,8 @@ struct Graph {
     /// as a root-only reader can tell).
     required: HashMap<String, String>,
     /// The main modules: the root module, or every readable in-root
-    /// `go.work` `use` member. `None` when a member is outside the root or
-    /// unreadable.
-    mains: Option<Vec<MainModule>>,
+    /// `go.work` `use` member.
+    mains: Vec<MainModule>,
     /// A `go.work` is in effect.
     workspace: bool,
 }
@@ -221,7 +220,7 @@ impl Graph {
     /// module past every `require` and sum line discovery reads. Only a
     /// higher version in that evidence proves the replace inert.
     fn select(&self, module: &str, version: &str, zips: &[&str]) -> Selection {
-        let mains = self.mains.as_deref().unwrap_or_default();
+        let mains = &self.mains;
         let required = mains
             .iter()
             .filter_map(|m| m.required.get(module).map(String::as_str))
@@ -241,19 +240,20 @@ impl Graph {
 
 /// The `use` members of `go.work` as main modules, and the sum files go
 /// verifies against in workspace mode: `go.work.sum` and each member's
-/// `go.sum` (the root's only when `.` is a member). The main modules are
-/// `None` when a member's go.mod is outside the root or unreadable.
+/// `go.sum` (the root's only when `.` is a member). A member whose go.mod
+/// is outside the root or unreadable adds no main module; the others still
+/// count, since in a workspace their `require`s only ever prove a replace
+/// inert, never selected.
 async fn read_workspace(
     ctx: &DiscoverCtx<'_>,
     out: &mut Discovery,
     go_mod: Option<&str>,
     go_work: &str,
-) -> (Option<Vec<MainModule>>, Vec<String>) {
-    let mut mains = Some(Vec::new());
+) -> (Vec<MainModule>, Vec<String>) {
+    let mut mains = Vec::new();
     let mut files = vec![GO_WORK_SUM.to_string()];
     for dir in go_mod_edit::parse_use_dirs(go_work) {
         let Some(dir) = member_dir(&dir) else {
-            mains = None;
             continue;
         };
         let text = if dir.is_empty() {
@@ -265,10 +265,8 @@ async fn read_workspace(
                 None => None,
             }
         };
-        match (text, mains.as_mut()) {
-            (Some(text), Some(mains)) => mains.push(MainModule::new(&text)),
-            (Some(_), None) => {}
-            (None, _) => mains = None,
+        if let Some(text) = text {
+            mains.push(MainModule::new(&text));
         }
         let sum = member_file(&dir, GO_SUM);
         if !files.contains(&sum) {
@@ -1219,6 +1217,41 @@ mod tests {
         }
     }
 
+    /// A member that cannot be read (outside the root, or missing its
+    /// go.mod) does not hide another member's higher require.
+    #[tokio::test]
+    async fn workspace_unreadable_member_keeps_other_members_requires() {
+        let m = gopatch(UUID_A);
+        let sver = "v1.4.2-socketpatch.1";
+        for extra in ["../outside", "./missing"] {
+            let p = Project::new();
+            p.write("go.mod", BASE_GO_MOD)
+                .write(
+                    "go.work",
+                    format!(
+                        "go 1.21\n\nuse (\n\t.\n\t{extra}\n\t./svc\n)\n\nreplace {MODULE} {VERSION} => {m} {sver}\n"
+                    ),
+                )
+                .write(
+                    "go.work.sum",
+                    format!("{m} {sver} {ZIP_H1}\n{m} {sver}/go.mod {MOD_H1}\n"),
+                )
+                .write(
+                    "svc/go.mod",
+                    format!("module example.com/svc\n\ngo 1.21\n\nrequire {MODULE} v1.5.0\n"),
+                );
+            let out = run(&p).await;
+            assert_refs(&out, &[]);
+            assert!(
+                out.diagnostics
+                    .iter()
+                    .any(|d| d.code == DIAG_REF_INVALID && d.detail.contains("selects v1.5.0")),
+                "{extra}: {:?}",
+                out.diagnostics
+            );
+        }
+    }
+
     /// go verifies against the sum files of the mode it builds in: in
     /// workspace mode `go.work.sum` and the members' go.sum (the root's only
     /// when `.` is a member); under `GOWORK=off` the root go.sum alone, with