GeezerVison

LLM Description written by Claude Code:claude-opus-5-5

Sweep of crates/socket-patch-cli/src/commands/scan/hosted.rs, from its coverage row in the architecture ledger (discussion #1830). It covers everything except the 1,233-line run_redirect_selected_untracked, which is T24's structural work (part of #894), so the row is recorded as partial.

Changes

• Tests moved to the module they test. 13 tests of core hosted::guidance sat in the CLI behind a #[cfg(test)] pub(crate) use re-export of 17 core items. They now live in hosted/guidance.rs, and the re-export is deleted. The two pnpm lock-sniff tests went beside their functions in formats/pnpm/mod.rs and were renamed for those functions.
• Inlined emit_json_error into run_redirect, its only caller. scan calls run_redirect only inside if args.common.json, so run_redirect now takes the Envelope itself. The unreachable human "No changes made." arm is deleted.
• Deleted the test-only wrapper installed_stale_positive_evidence. Its test calls core judge_installed_record(..).stale_evidence through a local helper. Renamed to stale_evidence_requires_readable_mismatched_bytes.
• Flattened the gem probe's vendor/cache fold (pass 2): one if … else None, and cache_covered is keyed on the judged purl instead of looked up again in candidates.
  • Red→green: dropping the insert fails gem_stale_probe_folds_committed_vendor_cache_into_the_remedy and gem_stale_probe_follows_the_configured_bundle_cache_path.
• Deleted the duplicate test gem_stale_probe_record_lookup_is_uuid_keyed. It had the same fixture and assertion as gem_stale_probe_matches_records_by_uuid_not_purl_key.
• Fixed one test that claimed more than it checked. pnpm_lock_carries_hosted_redirect_detects_prior_run_splices now asserts the \/-escaped spelling its doc names.
  • Red→green: making artifact_url_spellings return the raw URL twice fails it.
• About 120 comment lines removed: the human-output banner, 2 test banners, oversized private docs (run_redirect_selected, gem_stale_install_warnings, acquire_hosted_lock, run_redirect's parameters) and bare issue references. The why comments stay.
• Moved the SBT_OWNED_FILE_UNREADABLE import to the top of the file.

Size

git diff --stat: 4 files, +696 / −847.

• Production: scan/hosted.rs +84 / −231, scan/mod.rs ±1.
• Tests: scan/hosted.rs +20 / −615, core guidance.rs +543, core formats/pnpm/mod.rs +48. Most of that is the move.

Behavior change

None. The deleted arm could not run.

Risk

Low. The production edits are an inline, a dead branch and a loop flattening covered by the gem probe tests. No cfg(windows) or cfg(unix) code changed.

Verification

• cargo clippy --workspace --all-features -- -D warnings: clean.
• cargo test -p socket-patch-core --lib (guidance, formats::pnpm): pass. cargo test -p socket-patch-cli --lib scan::hosted: 48 pass.
• cargo test -p socket-patch-cli --test scan --test in_process_redirect: 149 pass, 3 fail. The 3 failures are chmod-based and fail only because the sandbox runs as root; they pass in CI: partial_lockfile_write_failure_exits_1_and_writes_no_ledger, redirect_json_mode_write_failures_emit_error_envelope, vlt::scan_redirect_vlt_heal_invalidation_failure_warns.
• /code-review high found no bugs in the diff.

Review findings not fixed here

All of these predate this PR or are outside a sweep.

• Gem probe pass 3 matches by purl string. Two spellings of one gem sharing an installed dir can warn about the same vendor/cache archive twice.
• Pass 3 builds the cache name without the platform suffix. It uses {name}-{version}.gem, so a committed stale platform-gem archive with no installed dir is missed. Both gem probe findings change behavior, so they want an issue.
• Path::is_file is a blocking stat inside the async probe. It predates this PR.
• The npm_override test fixture now has three copies (the CLI, guidance.rs, redirect/mod.rs). A shared core test builder belongs with A37/Share one scoped env-var test guard: EnvGuard is copy-pasted 11 times across core unit and integration tests #1889-style test-support work.
• run_redirect_selected still takes Option<Envelope> keyed on common.json. Changing it touches get.rs (held by Fix Go patch delivery, audits, and reinstalls #1698) and the T24 body.

🤖 Generated with Claude Code

https://claude.ai/code/session_011f9aeR2NHGsMnustoUpVWS

Generated by Claude Code