[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Fixes #991

What changes for users

Two branches each vendor a different package. Git merges yarn.lock cleanly, but .socket/vendor/state.json conflicts and the user keeps one side. The lockfile still wires the other side's package into .socket/vendor/npm/<uuid>/, and no ledger entry owns that dir.

• Before: a bare rollback reverted the ledgered package and exited 0 with only a vendor_orphan_still_wired advisory. It then deleted state.json, so the other package stayed patched and committed. Every later rollback / scan --mode vendored failed with "restore state.json from version control". The advisory told users to run repair, which no longer rebuilds ledger entries in v5.
• After: an unscoped rollback (wet, --dry-run and --preserve-state) refuses before writing anything. It exits 1 with vendor_ledger_missing and names each unowned dir. The remedy: restore the missing entries, and after a merge that kept one side, merge both sides' entries; or restore the lockfile. This is the same refusal rollback already gives when the ledger is missing entirely. Once the entries are merged, rollback unwinds both packages byte-exact (checked with real yarn 1.22.22).
• The vendor_orphan_still_wired advisory (vendor --revert, scan --prune, scoped rollback, remove) now names the ledger restore instead of repair. It does not suggest checking out the lockfile, because it follows a revert that already rewrote it (a Bugbot finding).

The vendor --check half of #991 was already fixed on main (re-verified in the issue on 10-14). vendor --check and rollback now share one helper, unledgered_vendor_references, for "which lockfile references does the ledger not own".

Root cause

rollback's ledger guard (rollback.rs, "Ledger-less but still wired?") ran only when state.json was absent. With a partial ledger, the unowned wiring reached the #1610 orphan sweep. That sweep treats a wired orphan as an advisory, so the run reverted every ledgered entry, saved an empty ledger (which deletes the file) and exited 0.

Changes

• commands/rollback.rs: after scope resolution and before the prompt or any write, an unscoped run with project state checks the lockfile references against the loaded ledger. Any in---ecosystems reference whose uuid no entry carries gets a vendor_ledger_missing refusal, recorded in telemetry like the other post-lock errors. An entry whose ecosystem has no backend still owns its uuid, so its own revert reports vendor_revert_failed (the existing vendored_unknown_ecosystem_* tests).
• vendored_backend/repair.rs: a new shared unledgered_vendor_references. vendor --check (vendor.rs) now uses it.
• vendor_orphans.rs: a shared UNLEDGERED_WIRING_REMEDY, and the advisory text no longer points at repair.
• CLI_CONTRACT.md: rollback State discovery, the vendored-leg note and the vendor_ledger_missing row.

Tests (red on main, green here)

Issue	Test	Red on main	Green
#991 (yarn classic, real yarn)	e2e_vendor_yarn_classic_build::yarn_classic_rollback_refuses_a_lock_reference_the_ledger_lost: merge flow from the issue, dry and wet refusal, nothing written, then the merged-entries remedy unwinds both byte-exact	rollback (dry=true) must refuse … left: 0 right: 1	ok
#991 (npm lock)	in_process_rollback_vendored::unscoped_rollback_refuses_a_still_wired_orphan (replaces …_keeps_a_still_wired_orphan, which asserted the exit-0 behavior): dry, wet and --preserve-state all refuse; lock, ledger and manifest are byte-identical afterwards; a scoped rollback still reverts its target	rollback ["--dry-run"] refuses … left: 0 right: 1	ok
#991 (remedy text)	vendor_orphans::tests::orphan_still_wired_names_a_working_remedy and in_process_rollback_vendored::scoped_rollback_keeps_a_still_wired_orphan_of_its_target	FAILED (advisory said socket-patch repair)	ok

Commands run locally (Linux, root container):

• cargo fmt --all -- --check: ok. cargo clippy --workspace --all-features -- -D warnings: ok.
• cargo test --workspace --all-features --no-fail-fast: everything this PR touches passes. That includes the rollback suite (122), in_process_rollback_vendored (23), in_process_vendor, repair, vendor_jvm_cli, e2e_vendor_composer_build, e2e_sbt_vendor and e2e_vendor_yarn_classic_build (41, with SOCKET_PATCH_YARN_E2E_REQUIRED=1). Two kinds of failure are environmental and fail identically with origin/main's src/. (1) Tests that inject write failures with chmod don't fail as root: repair_cleanup_failure…, repair_exits_zero…lock_file_unremovable, 3 in_process_redirect write-failure tests and 4 socket-patch-core unit tests (core is untouched). (2) Two e2e_bun_lockb tests need patches-api.socket.dev, which the sandbox proxy blocks.
• node --test npm/socket-patch/bin/socket-patch.test.mjs: 24 pass. The wrappers only dispatch to the binary, so no wrapper changes are needed.

CI note

Commit 274386a ports #1738's unearth<0.19 pin (test harness only) because unearth 0.19 broke the PDM e2e leg on main. It is a no-op once #1738 merges.

/code-review high outcomes

Fixed: the misplaced emit_rollback_error doc comment, the missing telemetry on the refusal, the duplicated reference-vs-ledger comparison (now shared with vendor --check), singular/plural remedy grammar, a redundant dedup, and the lost rollback coverage of vendor_orphan_still_wired (new scoped test).

Not fixed, with reasons (follow-ups, not claimed by this PR):

• Scoped / --ecosystems-narrowed rollback can still revert the last ledger entry and delete state.json while another package's wiring is unowned. A scoped run doesn't promise to unwind that package, and the ledger it deletes held nothing for it. The next unscoped rollback, or vendor --check (the CI gate), names the wiring. Refusing a targeted rollback over an unrelated package would block a legitimate request.
• Unscoped vendor --revert keeps the still-wired orphan with an advisory and exits 0. e2e_vendor_composer_build asserts that on purpose ("sweeping is not a failure"), so changing it is a separate decision for that command.
• JVM vendor trees (maven2 / gradle / coursier) are not uuid-keyed, so scan_vendor_references can't see them. A merge that loses a jvm entry is not covered here. vendor --check handles JVM through its own LEDGER_OWNED_PATHS path.

https://claude.ai/code/session_011f9aePVxAgoVYdQqvzxbPm

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

[agent] CI on 2120d22: the only failure was e2e (ubuntu-latest, e2e_vex_build, pdm:: --ignored, 2.29.2). pdm lock crashed with "PDMPyPIClient is not an instance or subtype of type (Client)" because unearth 0.19 moved to httpx2. This PR doesn't cause it: it breaks the PDM leg on main and every PR. I ported the existing fix from #1738 (pin unearth<0.19, 2 files, test harness only) as a separate commit. It becomes a no-op once #1738 merges.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit dcd5127. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Burn-down agent: labeled Ready for review at head dcd5127.

• CI: 56/56 check runs on dcd5127 passed or skipped (37 success, 19 skipped); mergeable with main.
• Bugbot: reviewed dcd5127, no new issues. The one earlier thread (orphan advice suggesting a lockfile checkout) was fixed in dcd5127 and is resolved.
• Reviewer note: commit 274386a ports Pin unearth<0.19 in the PDM e2e bootstrap #1738's unearth<0.19 PDM pin (test harness only); it no-ops once Pin unearth<0.19 in the PDM e2e bootstrap #1738 merges.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Burn-down agent: labeled Ready for review at head dcd5127.

• CI: 56/56 check runs on dcd5127 green (37 success, 19 skipped); no main-wide failures.
• Bugbot: reviewed dcd5127, no new issues; the one earlier thread (vendor_orphans.rs:128) is resolved.
• Reviewer note: the PDM unearth<0.19 pin is ported from Pin unearth<0.19 in the PDM e2e bootstrap #1738 and becomes a no-op once Pin unearth<0.19 in the PDM e2e bootstrap #1738 lands.
• Slack announcement not sent this run (the Slack send tool was unavailable); the next run retries.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Final review brief

What it does: An unscoped rollback now refuses up front (vendor_ledger_missing, exit 1, nothing written, also on --dry-run/--preserve-state) when a lockfile is still wired into a .socket/vendor/<eco>/<uuid>/ dir that the vendor ledger has no entry for, which is what a git merge that kept one side of state.json leaves behind. Before, it reverted everything else, exited 0 and deleted the ledger, leaving that package patched with no way to unwind it (#991). A scoped rollback still proceeds, and the vendor_orphan_still_wired advisory stops pointing at repair, which can't rebuild ledger entries in v5.

Risk: low–medium. The change is small and fails closed, but it's a new hard stop on the unscoped path: one unledgered reference now blocks the agent and hosted legs too, the same way the existing "ledger missing" refusal does.

Look here:

• rollback.rs:1632: the refusal gate (unscoped + project state + readable ledger only)
• rollback.rs:908: --ecosystems filter, and a uuid owned under another ecosystem still counts as owned
• repair.rs:192:`` shared helper; vendor.rs:1334 vendor --check now uses it (same behaviour)
• vendor_orphans.rs:116: new remedy text
• CLI_CONTRACT.md: the contract change

Verified:

• Read the full diff.
• cargo test -p socket-patch-cli --test in_process_rollback_vendored: 23/23 pass.
• With rollback.rs reverted to main, unscoped_rollback_refuses_a_still_wired_orphan fails, so the test covers the fix.
• The tests check that the lockfile, ledger and manifest are byte-identical after the refusal, on all three flag variants, and that a scoped run still reverts its target.
• CI 37/37 non-skipped green (ci-ok and clippy included), Bugbot success, 0 unresolved threads, CHANGELOG untouched.
• Also carries Pin unearth<0.19 in the PDM e2e bootstrap #1738's unearth<0.19 PDM pin. It's identical to Pin unearth<0.19 in the PDM e2e bootstrap #1738, so it merges cleanly either way.

Changes I made: none.

Open questions (non-blocking):

• Is blocking the agent and hosted legs on an unscoped run the intended trade-off? It mirrors the existing missing-ledger refusal, and a scoped rollback is the escape hatch.
• Nit: the doc comment on orphan_still_wired_names_a_working_remedy says the advisory names "or the lockfile restore", but the text (correctly) doesn't.

Auto-merge is armed: approving sends it straight to the merge queue.

---

Generated by Claude Code