WS5: one VendoredBackend for vendored apply/revert/repair; cut repair's ledger rebuild (#283)

* Consolidate vendored apply/revert/repair into one VendoredBackend

vendor, scan/get --mode vendored, vendor --revert, rollback's vendored
leg, remove and repair now go through one VendoredBackend { apply,
revert, repair } over the shared engine (vendor_records_reusing,
dispatch_revert_one_opts). The boxed_* scan shims collapse into one
boxed_vendor_step; the engine future stays boxed inside apply for the
Windows 1 MiB main-thread stack.

repair no longer re-synthesizes vendor ledger entries from lockfiles. A
lockfile reference with no ledger entry fails with vendor_ledger_missing
(artifact-level event: uuid + details.{ecosystem,path}); the remedy is
restoring state.json from version control. Missing or corrupt artifacts
are re-vendored through the same engine as vendor, so the patch
service's prebuilt artifact is downloaded first under --vendor-source
auto, with the local build as the fallback. The fingerprint post-verify,
set-aside of corrupt bytes and carried-inventory refresh are kept.

Removed with the rebuild: repair_vendor.rs, gem Gemfile wiring
reconstruction, and registry_fetch::fetch_npm_unverified. The packing
code (npm_pack, pypi_wheel, berry_zip, registry_fetch, prestage) stays:
depscan does not call it (verified against depscan master 784013d6), but
it is the CLI's own --vendor-source build/auto fallback.

Tests for the reconstruction path are replaced by vendor_ledger_missing
pins per flavor; CLI_CONTRACT, README, CHANGELOG and the v5 plan are
updated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DMhWChtaNX5FJYNDq3NBJa

* Point the vlt coverage map at the renamed repair test

vlt-coverage.json still named vlt_repair_reconstructs_the_ledger_from_the_lock,
and vendor_vlt_lock_out_of_sync lost the only assertion the coverage
check could see when the lock-only reference test switched to
vendor_ledger_missing. vendor_vlt_out_of_sync now asserts the refusal
detail.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DMhWChtaNX5FJYNDq3NBJa

* Drop the ledger-less mirror leg from the bun binary workspace test

native_binary_alias_and_transitive still expected repair to rebuild a
workspace mirror after deleting state.json. Repair now reports that as
vendor_ledger_missing (pinned in native_binary_hosted_vendored_takeover_roundtrip),
so the leg is gone; the missing/corrupt mirror legs keep running and
assert the ledger stays byte-identical.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DMhWChtaNX5FJYNDq3NBJa

* Pass --mode agent to the gated agent-mode get fixtures

get defaults to hosted since 5e5f5ed, which moved the agent-mode
fixtures to --mode agent but missed the #[ignore]d real-toolchain
suites (e2e_vlt, e2e_npm, e2e_pypi, e2e_gem, e2e_safety_pnpm). Their
plain `get <uuid>` now redirects instead of applying in place, so e.g.
vlt_pinned_matrix_agent_get_and_remove saw the copy Absent. This PR
touches the vlt-compatibility path filter, which surfaced it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DMhWChtaNX5FJYNDq3NBJa

* Keep an unpersistable inventory refresh loud, drop reconstruction persist tests

A carried-inventory refresh whose ledger write fails now reports
vendor_inventory_refreshed next to vendor_state_write_failed and keeps
the member-verified rebuild on disk, instead of falling through to
vendor_artifact_rebuild_failed and removing it. The persist-failure
tests for the removed backfill / anchored / soft reconstruction paths
go with them; they only run as non-root, which is why the root sandbox
skipped them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DMhWChtaNX5FJYNDq3NBJa

* Restore the macOS-only PatchedFixture hash fields

The dead-field clippy fix removed before_hash/after_hash, but the macOS
immutable-flag rollback tests read them, so test (macos-latest) no
longer compiled. Keep the fields and allow dead_code off macOS only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DMhWChtaNX5FJYNDq3NBJa

* Keep repair on the recorded artifact identity

Review of #283 found two regressions in the shared-engine repair:

- A corrupt artifact was moved aside before staging, so its
  afterHash-verified members were no longer harvested: an offline repair
  that the previous implementation completed failed with "no local
  source". The members are now harvested first and passed as the seed.
- The post-verify reloaded the ledger the re-vendor had just written, so a
  service archive with different bytes (same members, new gzip mtime) was
  committed as `rebuilt` with a rewired lock and new fingerprint. Repair
  now verifies against the original entry; when the result is not the
  recorded artifact, that candidate's wiring files and ledger entry are
  put back from a pre-run snapshot, and a service copy falls back to a
  build-only rebuild. Legitimate backend migrations of a verified rebuild
  (the cargo version retag) are kept.

Both reproductions are pinned in repair_vendor_e2e.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DMhWChtaNX5FJYNDq3NBJa

* Make repair's wiring undo FIFO-safe, atomic and symlink-preserving

Bugbot on #283: the identity-undo snapshot read lockfiles with bare
tokio::fs::read (a FIFO at a wiring path blocks open(2)) and skipped
symlinked lockfiles, and the put-back wrote them in place (no
stage+fsync+rename, mode bits dropped).

The snapshot now reads through read_regular_to_bytes and records a
symlinked lockfile's link text; the undo re-links a link that the
engine's rename replaced, then writes the target through
atomic_write_bytes_preserving_mode. Pinned by
repair_identity_undo_follows_a_symlinked_lockfile.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DMhWChtaNX5FJYNDq3NBJa

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: mikolalysenko

.github/workflows/bun-compatibility.yml

@@ -43,7 +43,7 @@ on:
       - 'crates/socket-patch-cli/src/commands/scan/**'
       - 'crates/socket-patch-cli/src/commands/rollback.rs'
       - 'crates/socket-patch-cli/src/commands/vendor.rs'
-      - 'crates/socket-patch-cli/src/commands/repair_vendor.rs'
+      - 'crates/socket-patch-cli/src/commands/vendored_backend/**'
       - 'crates/socket-patch-cli/src/commands/remove.rs'
   # Main runs are the only rust-cache writers (save-if below), so a
   # path-filtered push trigger is what seeds the cache the PR builds restore
@@ -75,7 +75,7 @@ on:
       - 'crates/socket-patch-cli/src/commands/scan/**'
       - 'crates/socket-patch-cli/src/commands/rollback.rs'
       - 'crates/socket-patch-cli/src/commands/vendor.rs'
-      - 'crates/socket-patch-cli/src/commands/repair_vendor.rs'
+      - 'crates/socket-patch-cli/src/commands/vendored_backend/**'
       - 'crates/socket-patch-cli/src/commands/remove.rs'
   workflow_dispatch:
     inputs:

.github/workflows/vlt-compatibility.yml

@@ -37,7 +37,7 @@ on:
       - 'crates/socket-patch-cli/src/commands/remove.rs'
       - 'crates/socket-patch-cli/src/commands/setup.rs'
       - 'crates/socket-patch-cli/src/commands/vendor.rs'
-      - 'crates/socket-patch-cli/src/commands/repair_vendor.rs'
+      - 'crates/socket-patch-cli/src/commands/vendored_backend/**'
       - 'crates/socket-patch-cli/src/commands/get.rs'
       - 'crates/socket-patch-cli/src/commands/vlt_preflight.rs'
       - 'crates/socket-patch-cli/src/commands/scan/**'
@@ -74,7 +74,7 @@ on:
       - 'crates/socket-patch-cli/src/commands/remove.rs'
       - 'crates/socket-patch-cli/src/commands/setup.rs'
       - 'crates/socket-patch-cli/src/commands/vendor.rs'
-      - 'crates/socket-patch-cli/src/commands/repair_vendor.rs'
+      - 'crates/socket-patch-cli/src/commands/vendored_backend/**'
       - 'crates/socket-patch-cli/src/commands/get.rs'
       - 'crates/socket-patch-cli/src/commands/vlt_preflight.rs'
       - 'crates/socket-patch-cli/src/commands/scan/**'

CHANGELOG.md

@@ -226,6 +226,30 @@ into the new version's section — see docs/releasing.md.
   (`https://repo.packagist.org`) and `SOCKET_NUGET_URL`
   (`https://api.nuget.org`).
 
+- **`repair` no longer rebuilds the vendor ledger from lockfiles.** A
+  lockfile that references `.socket/vendor/<eco>/<uuid>/` with no entry in
+  `.socket/vendor/state.json` now fails with `vendor_ledger_missing` (an
+  artifact-level `failed` event with `uuid` and `details.{ecosystem,path}`;
+  exit 1) instead of re-synthesizing the entry (`details.ledgerRestored` is
+  gone). The rewired lockfile cannot supply the pre-vendor originals a
+  revert needs, so the remedy is restoring `state.json` from version
+  control (or `git checkout -- <lockfile>` and re-vendoring). The unverified
+  npm "rebuild from the wired integrity" rung and the gem Gemfile wiring
+  reconstruction went with it; `rollback`'s missing-ledger error now asks
+  for `state.json` to be restored instead of naming `repair`.
+- **`repair` re-vendors broken artifacts the way `vendor` does.** Missing
+  or corrupt vendored artifacts go through the same vendored backend as
+  `vendor` / `scan --mode vendored` / `get --mode vendored`, so under the
+  default `--vendor-source auto` the patch service's prebuilt artifact is
+  downloaded again, with a local build as the fallback (and the only
+  source under `--offline` / `--vendor-source build`). The result is still
+  verified against the ledger fingerprint before it counts as `rebuilt`.
+  Failure details are now `vendor`'s own (for example "no installed
+  package found on disk"), and a drifted installed copy of a gem or pypi
+  release variant is no longer force-overwritten by repair — it fails the
+  same installed-variant check `vendor` applies. Internally, `vendor`, `scan`/`get --mode vendored`, `vendor --revert`,
+  `rollback`'s vendored leg, `remove` and `repair` now share one
+  `VendoredBackend { apply, revert, repair }`.
 - **Vendored runs refuse lock-text failures before downloading them.**
   `scan --mode vendored` and `get --mode vendored` evaluate the vendor
   backends' pure lock-text gates — pnpm, yarn classic and yarn berry

README.md

@@ -476,7 +476,7 @@ need the network and refuse to run with `--offline`.
 | [`remove`](#remove) | The single-patch form of `rollback`: restore, unwind, drop the record and GC for one PURL/UUID (a hosted patch is restored to upstream) |
 | [`vendor --revert`](#vendor) | **Un-vendors wholesale**: restores the recorded original lockfile fragments byte-for-byte and removes the `.socket/vendor/` artifacts (a package vendored over a hosted pin returns to upstream, not to hosted) |
 | [`scan --prune`](#scan) | Agent mode: **reconciles, doesn't reverse** — drops manifest entries for packages that have left the project and garbage-collects orphan blob/diff/archive files |
-| [`repair`](#repair) (alias `gc`) | **Restores health, not originals**: re-downloads missing blobs, rebuilds missing/corrupt vendored artifacts, and cleans up unused ones |
+| [`repair`](#repair) (alias `gc`) | **Restores health, not originals**: re-downloads missing blobs, re-vendors missing/corrupt vendored artifacts, and cleans up unused ones |
 
 And `setup --remove` reverts the install hooks that `setup` added.
 
@@ -497,7 +497,7 @@ And `setup --remove` reverts the install hooks that `setup` added.
 | [`setup`](#setup) | Wire install hooks (npm, Python, Bundler, Composer) that re-apply patches after install |
 | [`rollback`](#rollback) | Undo patches in every mode: restore original files, unwind vendored lockfile wiring, and restore hosted lockfile entries to upstream |
 | [`remove`](#remove) | Remove one patch by PURL or UUID (rolls back first) |
-| [`repair`](#repair) | Download missing patch artifacts, rebuild vendored artifacts, clean up unused ones (alias: `gc`) |
+| [`repair`](#repair) | Download missing patch artifacts, re-vendor broken vendored artifacts, clean up unused ones (alias: `gc`) |
 
 `socket-patch --update` updates the CLI itself (see [Updating](#updating)).
 
@@ -1215,14 +1215,18 @@ socket-patch remove "pkg:npm/lodash@4.17.20" --json
 
 ### `repair`
 
-Download missing blobs, rebuild missing or corrupt vendored artifacts, and clean up unused
+Download missing blobs, re-vendor missing or corrupt vendored artifacts, and clean up unused
 blobs.
 
 Alias: `gc`
 
 `repair` cleans up the `.socket/` directory without running a scan — useful when you've
 manually adjusted the manifest, recovered from a partial-failure state, or just want to
-free space. It also rebuilds missing or corrupt vendored artifacts. For the combined
+free space. It also re-vendors missing or corrupt vendored artifacts the same way `vendor`
+does (the patch service's prebuilt artifact first, a local build as the fallback), checked
+against `.socket/vendor/state.json`. `repair` does not recreate a lost `state.json`: if a
+lockfile points into `.socket/vendor/` and the ledger has no entry for it, `repair` fails with
+`vendor_ledger_missing` — restore `state.json` from version control. For the combined
 agent-mode workflow (discover + apply + GC in one pass), use `scan --sync` instead.
 
 Like every other mutating command, `repair` takes the `.socket/apply.lock` advisory lock