GeezerVison

LLM Description written by Claude Code:claude-opus-5-5

Fixes #998
Fixes #1063
Fixes #1123

Summary

A manifest that exists but can't be read is now refused as manifest_unreadable (exit 1, with the --json envelope) on every command and under every spelling of its path. Before, several commands decided "no manifest" with their own looser probes:

• apply, apply --check and vendor report noManifest (exit 0) when .socket/manifest.json exists but can't be stat'd #998 (fail-open): apply, apply --check and vendor reported noManifest and exited 0 when stating .socket/manifest.json failed for any reason (.socket checked in as a file, a symlink loop, an unsearchable .socket/), so install hooks and CI read "every patch skipped" as success. repair, remove and rollback said manifest_not_found.
• scan reads a corrupt manifest as empty, so --prune skips GC and reports success #1063: scan's GC passes (wet and --dry-run preview) read an unloadable manifest as missing and returned a clean summary.
• A directory at .socket/manifest.json exits 2 with no --json output when --manifest-path spells the path, but exits 1 with manifest_unreadable under the default path #1123: a --manifest-path naming a directory exited 2 with no --json document when the path was spelled out (./.socket/manifest.json, an absolute path, SOCKET_MANIFEST_PATH), but 1 with manifest_unreadable under the default spelling.

Root cause (shared)

Core's read_manifest has one rule: only NotFound means absent. The callers above each decided presence another way: metadata().is_err() (#998), _ => no manifest after read_manifest (#1063), and a directory check keyed on the flag's text (#1123).

Fix

• socket_patch_core::manifest::operations::manifest_exists keeps read_manifest's rule (a thin wrapper over tokio::fs::try_exists).
• apply (incl. --check), vendor, repair, remove and rollback use it and refuse a stat error with manifest_unreadable before building a client or taking a lock. A real NotFound keeps every existing no-manifest path (noManifest, hosted/vendored fallbacks).
• scan GC: an unloadable manifest under the lock now yields a manifest_invalid/manifest_unreadable warning next to the vendored half, and the pre-lock gate no longer treats an unstatable manifest as absent. (Agent-mode scan already failed closed at its top-level load since An unparseable .socket/manifest.json is reported under five different --json error codes depending on the command #931; this closes the GC passes themselves.)
• GlobalArgs::validate_paths no longer refuses a directory manifest (the issue's option A). read_manifest refuses it the same way for every spelling. The remaining "project directory does not exist" message prints a .-free path (no more ././.socket/…).
• CLI_CONTRACT.md: the manifest_unreadable row and the exit-2 row describe the new rule.
• On Windows a path under a plain file reports as not found, so there .socket as a file still reads as "no manifest" for both read_manifest and manifest_exists (consistent). Those test cases are #[cfg(unix)].

Per-issue tests (red on main → green here)

The matrix now covers rollback too. cli_parse_list and cli_path_flags_validated pinned the old exit-2 directory verdict and are updated to the new one.

Local verification

• cargo fmt --all -- --check: clean
• cargo clippy --workspace --all-features -- -D warnings: clean
• cargo test --workspace --all-features --no-fail-fast: everything this PR touches passes (core lib, CLI lib 936, apply, repair, rollback, remove, matrix, cli_parse_list, cli_path_flags_validated). Remaining local failures are environmental and also fail on unmodified main in this container: chmod-based write/delete-failure tests that can't fail as root (repair_cleanup_failure_*, repair_*_lock_file_unremovable, three in_process_redirect write-failure tests, four core lib permission tests) and e2e_bun_lockb (Nightly e2e_bun_lockb red: offline takeover test predates #1648 #1770, fix in CI: update bun.lockb offline takeover test (#1770) #1771).
• No wrapper changes needed: npm/, pypi/, gem/ only dispatch the binary.

/code-review high

Fixed: Windows ENOTDIR→NotFound (tests now Unix-only), stale exit-2 contract row, GC comment accuracy, try_exists reuse, apply --check message parity, repair telemetry, GC message cleanup.
Not fixed, by choice:

• Share one "probe and emit" helper across the five commands. Each command already has its own error emitter (emit_error_envelope, emit_rollback_error, emit_eject_refusal, error_envelope, apply's refusal), and each call is the existing load-failure mapping, manifest_load_error, plus that emitter. A helper would save a line per site.
• scan GC's has_ledger probes --cwd instead of the manifest's project, and vendor-ledger presence probes use the same metadata().is_ok() pattern. Both predate this change and are about the vendor ledger, not the manifest. Left as follow-ups so this PR stays one root cause.

https://claude.ai/code/session_011f9aeR3v4Q36DgE4agLMEK

Generated by Claude Code