@@ -0,0 +1,43 @@
+[agent] 2026-10-17: pnpm bug-hunt run
+
+**Tested:** main `657fce2` (unchanged since run 45), release 5.0.1. Linux only. Node 22.22.0, plus Node 16.20.2 for pnpm 5/6. pnpm 5.18.10, 6.35.1, 7.33.7, 8.15.9, 9.15.9, 10.34.7, 11.28.6, 12.12.1 and 12.14.0. No new pnpm release since run 47. I rebuilt the Python mock: the org patch API for `left-pad@1.3.0` and scoped `@sp/pad@1.0.0`, plus a registry serving those, the unpatched `left-pad@1.2.0`, and `sp-wrap@1.0.0` → `left-pad@1.3.0`.
+
+### Re-triage
+- No commits since run 45, so nothing was re-run for a fix. Nothing was closed.
+- Commented on **#1619** (https://github.com/SocketDev/socket-patch/issues/1619#issuecomment-6234481441): on 12.12.1, `remove pkg:npm/%40sp/pad@1.0.0` and the hosted → vendored takeover followed by `rollback` also drop the scoped `tarball:` URL (2/2 each). A vendored-only rollback stays byte-exact, which points at the hosted upstream restore. 12.14.0 is byte-exact on every path.
+
+### Issues
+- None filed. No new defect cleared the filing bar.
+
+### Cells (all on Linux)
+- After a hosted pin, ran `install --fix-lockfile`, `install --resolution-only`, `install --lockfile-only` and `dedupe --check` on 9 / 10 / 11 / 12.14:
+  - `--fix-lockfile` drops the pin on 11 / 12 (upstream re-resolution; added to Known non-bugs).
+  - `--lockfile-only` keeps it everywhere.
+  - pnpm 12 has no `--resolution-only`.
+- Hosted scoped pin on 12.12.1: `remove` **fail #1619**, takeover → rollback **fail #1619**. 12.14.0: pass.
+- Two-version workspace (member a uses left-pad 1.3.0, member b uses 1.2.0), on 9 / 10 / 11 / 12.14:
+  - Hosted and vendored fresh frozen install patches only a, and `--filter b` works: **pass**.
+  - vex + rollback (hosted / vendored / agent) on 9 / 12.14: **pass**.
+- Concurrent scans on 12.14:
+  - Same cwd (hosted and vendored, ×3 each): **pass**. The loser gets `lock_held`, and the lock stays valid.
+  - Root + member cwd: the member run refuses as documented. The fresh install is patched.
+- `resolution-mode=time-based` lock (`time:` block) on 8 / 9 / 10: hosted pin → dead-registry frozen install → byte-exact rollback **pass**.
+- `npm:` alias + scoped package:
+  - Hosted on 5.18.10 / 6.35.1 / 7.33.7: **pass**.
+  - Agent apply → vex → rollback on 5 / 6 / 7 / 8: **pass**. (These closed legacy-lock cells that were still untested.)
+- Agent with hashed virtual store dirs (`virtual-store-dir-max-length=12`), direct and transitive (`sp-wrap`), on 9 / 10 / 11 / 12.14: **pass**.
+
+### False positives ruled out
+- My first hosted fresh-clone check passed with upstream bytes because my fixture committed `node_modules`. I fixed the fixture (`.gitignore`), and the cell passes.
+- `vex` exit 1 on pnpm 9 after a hosted pin + plain `pnpm install`: pnpm 9 keeps the upstream bytes, so the decline is honest. That's already a Known non-bug.
+- Vendored from a workspace member cwd fails `vendor_lockfile_missing`. That's already a Known non-bug.
+
+### Blocked
+- No probe branches. The stale `bughunt/pnpm/20260930-virtual-store` still needs a maintainer to delete it.
+
+### Next
+1. #1619: a Rush lock with `pnpmVersion` 12.12, then re-verify once fixed.
+2. #1597 follow-ups: a transitive build package (`sp-wrap` is now in the mock fixture recipe) and a supersede.
+3. Agent mode over the member alias fixture.
+4. Re-verify the #1007 fixes: #435 (`-g` on 11/12), #713 / #714 (Rush), #830, #853, #1006.
+5. macOS / Windows global-mode probes, once branch cleanup works.
@@ -1,6 +1,6 @@
 [agent] Progress ledger for the scheduled pnpm bug-hunt routine (label pm:pnpm).
 
-Last updated: 2026-10-17 (run 47), main `657fce2`, latest release 5.0.1. (main was force-pushed before runs 39, 43, 44 and 45, so older SHAs in this ledger may not resolve any more.)
+Last updated: 2026-10-17 (run 48), main `657fce2`, latest release 5.0.1. (main was force-pushed before runs 39, 43, 44 and 45, so older SHAs in this ledger may not resolve any more.)
 
 Method: real pnpm installs. Hosted, vendored and global agent mode run against a local Python mock of the patch API (the batch and by-package routes must answer only for the purls they actually serve, or an upgraded tree looks like a failure; batch, by-package, view with inline blobs, `patches/blob/<hash>`, package grant, hosted tarball, `/registry/<name>/<ver>` mirror; `ajv-keywords@3.5.2` serves as the peer-dependency package). On v5, set `SOCKET_PATCH_SERVER_URL=<mock>` and `SOCKET_NPM_REGISTRY=<mock>/registry` so that hosted pins are recognised and rollback can restore upstream. The oracle is a marker prepended to `index.js`, checked after a fresh `--frozen-lockfile` install against a dead registry, or by running the global tool. The repo's pinned matrix (`.github/workflows/pnpm-compatibility.yml`) already covers plain hosted and vendored installs on pnpm 1–12. This ledger tracks what it doesn't.
 
@@ -510,9 +510,21 @@ Run 47 additions (main `657fce2`, release 5.0.1, Linux, Node 22.22.0; mock rebui
 
 #1619 isn't a regression: release 5.0.1 behaves the same. pnpm 12.0.0–12.12.1 record a scoped registry's `tarball:` unconditionally; 7–11 and 12.13+ don't; a non-scoped `registry=` mirror isn't recorded by 12.12.1.
 
+Run 48 additions (main `657fce2`, release 5.0.1, Linux, Node 22.22.0, Node 16.20.2 for pnpm 5/6; mock rebuilt: org patch API for `left-pad@1.3.0` and scoped `@sp/pad@1.0.0`, registry serving those plus unpatched `left-pad@1.2.0` and `sp-wrap@1.0.0` → `left-pad@1.3.0`):
+
+| pnpm | `install --fix-lockfile` / `--resolution-only` / `--lockfile-only` / `dedupe --check` after a hosted pin | Hosted scoped pin: `remove` (scoped / other) / takeover hosted → vendored → `rollback` / vendored-only rollback | Workspace, member a = left-pad 1.3.0, member b = 1.2.0: hosted / vendored fresh frozen + `--filter b` | Same workspace: vex + rollback (hosted / vendored / agent) | Concurrent scans: same cwd (hosted, vendored ×3) / root + member cwd | `resolution-mode=time-based` lock (`time:` block): hosted pin → dead-registry frozen → rollback | `npm:` alias + scoped package: hosted pin → frozen → rollback / agent apply → vex → rollback | Agent with hashed virtual store dirs (`virtual-store-dir-max-length=12`): direct / transitive (`sp-wrap`) |
+| --- | --- | --- | --- | --- | --- | --- | --- | --- |
+| 5.18.10 (5.2) / 6.35.1 (5.3) / 7.33.7 (5.4) | — | — | — | — | — | — | pass / pass | — |
+| 8.15.9 (6.0) | — | — | — | — | — | pass | — / pass | — |
+| 9.15.9 | kept / dropped / kept / clean | — | pass / pass | pass (vex declines after plain install: documented) / pass / pass | — | pass | — | pass / pass |
+| 10.34.7 | kept / kept / kept / clean | — | pass / pass | — | — | pass | — | pass / pass |
+| 11.28.6 | dropped / dropped / kept / clean | — | pass / pass | — | — | n/a | — | pass / — |
+| 12.12.1 | — | **fail #1619** / as expected / **fail #1619** (2/2) / pass (2/2) | — | — | — | n/a | — | — |
+| 12.14.0 | dropped / n/a (flag removed) / kept / exit 1 (would dedupe) | pass / pass / pass / pass | pass / pass | pass / pass / pass | pass (`lock_held` for the loser) / documented refusals (`redirect_pnpm_lockfile_elsewhere`, `vendor_lockfile_missing`) | n/a | — | pass / pass |
+
 ## Backlog
 
-0ac. **#1619** (rollback drops scoped-registry `tarball:` on pnpm 12.0–12.12): re-verify once fixed on 12.0.0 / 12.12.1 and that 12.13+ stays bare; also `remove` and the hosted → vendored takeover restore over the same lock, and a Rush lock with `pnpmVersion` 12.12.
+0ac. **#1619** (rollback drops scoped-registry `tarball:` on pnpm 12.0–12.12): re-verify once fixed on 12.0.0 / 12.12.1 and that 12.13+ stays bare. Run 48 showed `remove` and the hosted → vendored takeover restore drop it too (commented). Still to do: a Rush lock with `pnpmVersion` 12.12.
 0ab. **#1597** (vendored pnpm ≥ 10.34.2 breaks build approvals for the `file:` tarball): re-verify once fixed on 10.34.7 / 11 / 12. Denials done in run 46 (12.11.2 breaks with `allowBuilds: false`, commented; 9/10/11 pass). Run 47 on 12.14.0: `allowBuilds: true` still fails (`ERR_PNPM_IGNORED_BUILDS`), an unscoped `sp-build: false` denial holds, and `false` + `dangerouslyAllowAllBuilds: true` (12.12.0 semantics) holds. Still to do: a transitive build package, a supersede (the uuid in an approval key changes), and the pnpm 10.34.2 changelog to cite the upstream change. Also check whether `vex` should stay honest about an unbuilt native addon.
 
 0w. #1460 is verified fixed (run 40, all 16 env × major cells). Still to do: the `gitBranchLockfile` env variant on 12 after the fix, and the #1437 refusal over a `configDependencies` two-document lock.
@@ -558,6 +570,7 @@ Run 47 additions (main `657fce2`, release 5.0.1, Linux, Node 22.22.0; mock rebui
 10. Vendored on Windows and macOS (autocrlf: expect the `vendor_lockfile_crlf_unsupported` refusal, and the #853 un-hosting when switching from hosted; check that hosted handles the same checkout; hosted CRLF passes on Linux).
 
 ## Known non-bugs
+- `pnpm install --fix-lockfile` re-resolves and drops hosted pins on pnpm 11 / 12 (9 / 10 keep them), like `pnpm dedupe` and `--resolution-only`. `pnpm 12 dedupe --check` then exits 1. That's upstream re-resolution (run 48).
 
 - pnpm 12.0.0–12.12.1 record `tarball:` for every scoped-registry package, and 12.13.0 stopped doing that (pnpm#16866). A lock that differs between those pnpm versions only in that field is pnpm's own behaviour. Only socket-patch's rollback dropping the field is a bug (#1619).