@@ -0,0 +1,30 @@
+[agent] 2026-10-14: Pipenv bug-hunt run
+
+**Tested:** main `4a29912` (5.0.1). The Pipenv-relevant change since the last run is 887a5f7 / #1508 (the #1507 fix); the rest of the range is other ecosystems and CI hermeticity. Linux only. Real Pipenv 2022.12.19, 2023.2.4 and 2026.9.1 (py3.11, Debian `/usr/bin/python3.11` with `python3-six` 1.16.0), plus the published 5.0.1 and 4.0.0 linux-x64 binaries from npm for comparison. The mock is a python http.server again (batch filtered by purl, by-package, package grant with sha256 + sha512, view with inline blob, hosted wheel route). It serves a patched real `six-1.16.0` wheel, and the oracle is `six.SOCKET_PATCHED`.
+
+## Re-triage
+- **#1507** (closed by #1508): verified fixed. The printed export now names comma-joined lock keys. Followed verbatim: 2022.12.19 hosted `[packages]`+`[docs]` (`"default,docs"`, 2 lines), 2022.12.19 vendored `[dev-packages]`+`[docs]` (`"develop,docs"`), 2023.2.4 hosted `[tests]`+`[docs]` (`"docs,tests"`), 2023.2.4 vendored `[packages]`+`[docs]`, 2026.9.1 hosted `[dev-packages]`+`[docs]`: PATCHED, re-scan without the warning, vex `not_affected` in each. Commented: https://github.com/SocketDev/socket-patch/issues/1507#issuecomment-6165094548
+- #981 / #842: no code change touching them, so I didn't re-run them.
+
+## Cells (Linux, `4a29912`, Pipenv 2026.9.1 unless noted)
+- Concurrent runs: 4 parallel `scan --mode hosted` and 4 parallel `--mode vendored`: one success, three `lock_held` errors, valid lock, correct wiring: **pass**.
+- Interrupted runs: SIGKILL at 5, 10, 15, 20, 25, 30, 40, 50, 60, 80, 100 and 130 ms into a vendored and a hosted scan (a full run takes ~25 ms), then a re-run: Pipfile.lock always valid JSON, re-run exit 0, both categories wired, `vendor --check` 0: **pass** (24 cells).
+- #1050 GC, `--json --prune`: six removed from the Pipfile and relocked (plain, and `use_pylock = true` with pylock.toml): reverted, artifact deleted, exit 0, check 0: **pass**. `use_pylock` with Pipfile.lock reset to upstream while pylock.toml stays wired: kept and re-wired, sync PATCHED: **pass**. six left only in `[docs]` after a relock dropped the ref: re-wired and kept, sync PATCHED: **pass**. CRLF Pipfile.lock: kept, check 0, PATCHED: **pass**.
+- The base-interpreter (`--site-packages`) warning in `scan --json`: carried as a skipped event `pypi_pipenv_stale_install` with the full remedy, status success: **pass**.
+- The #1450 remedy from a subdirectory: socket-patch itself finds no packages there (documented CLI scope), so the remedy isn't printed. Not a bug; see Known non-bugs.
+
+## Issues
+- Filed: none. Commented: #1507. Closed: none.
+
+## False positives ruled out
+- After a package left the lock, `scan --mode vendored` (with or without `--prune`) exited 1 with `pypi_pipenv_lock_package_missing` while `--dry-run` said skip, on main and on the published 5.0.1. That came from my mock: its batch route returned six for any request. With the batch filtered by `components[].purl` (the request asked only for idna), the same scan exits 0 with `vendor_ledger_entry_unwired`. Added a harness note.
+
+## Blocked
+- macOS / Windows probes: not attempted (branch deletion is still refused by policy).
+
+## Next
+1. Hosted sdist artifact under 2026.9.x `resolver_backend = "pure-python"` (the mock needs an sdist route).
+2. Standalone `vendor` from an agent manifest on a `use_pylock` project (the mock needs the blob route).
+3. Interrupted `vendor --revert` / `rollback` (SIGKILL sweep, as for scan).
+4. `pylock_name` GC; `-g` on 2018 / 11.
+5. Re-verify #981 and #842 once fixed.
@@ -2,7 +2,7 @@
 
 The routine runs every 6 hours. Each run adds one comment here with the socket-patch commit it tested, the OS × Pipenv-version × mode cells it covered, the issues it filed, updated or closed, and what it plans to probe next. The routine treats this thread as its only memory.
 
-Last run: 2026-10-13 ~21:35Z, main `aa85c6c` (5.0.1). Verified #1450 fixed (install-over remedy: Debian base, user site, shadowing; hosted + vendored; 2022.12.19 / 2023.12.1 / 2026.9.1). Filed #1507 (that remedy's multi-category `pipenv requirements --categories "packages docs"` exports nothing on Pipenv 2022.12.x–2023.2.4). 2026.9.1 update / upgrade and `use_pylock` after #1486: pass. Previous run: 2026-10-13 ~09:25Z.
+Last run: 2026-10-14 ~06:30Z, main `4a29912` (5.0.1). Verified #1507 fixed by #1508 (comma-joined lock keys in the install-over export; 2022.12.19 / 2023.2.4 / 2026.9.1, hosted + vendored). New, all pass: concurrent scans (`lock_held`), SIGKILL-interrupted scans, #1050 GC on `use_pylock` (removed, and pylock-only wiring kept), GC with a named category left, CRLF-lock GC. Previous run: 2026-10-13 ~21:35Z.
 
 ## Coverage matrix
 
@@ -103,11 +103,13 @@ Stale-install remedy followed verbatim, `15:30Z` run, `045d7ec`: `default` patch
 
 `21:35Z` run (2026-10-13), `aa85c6c`: #1450 install-over remedy followed verbatim gives PATCHED + vex `not_affected` for Debian base / `~/.local` user site / shadowing venv copy, hosted + vendored, `[packages]` / `[dev-packages]` / `[docs]`, on 2022.12.19 / 2023.12.1 / 2026.9.1 (pass). A pin in `[packages]` + `[docs]` or `[dev-packages]` + `[docs]` gets `pipenv requirements --categories "packages docs"`, which 2022.12.19 / 2023.2.4 export empty (fail #1507; first good Pipenv 2023.2.18). 2026.9.1 `upgrade <pkg>` / `update <pkg>` keep hosted and vendored refs, full `update` / `upgrade` drop them, and check / vex catch it (pass). `use_pylock` hosted + vendored vex and hosted rollback with a sibling package after #1486: pass.
 
+`06:30Z` run (2026-10-14), `4a29912`: #1507 verified fixed (2022.12.19 hosted `[packages]`+`[docs]`, vendored `[dev-packages]`+`[docs]`; 2023.2.4 hosted `[tests]`+`[docs]`, vendored `[packages]`+`[docs]`; 2026.9.1 hosted `[dev-packages]`+`[docs]`: PATCHED, re-scan clean, vex `not_affected`). 2026.9.1: 4 concurrent hosted / vendored scans give one success + `lock_held` (pass); SIGKILL at 5–130 ms then re-run, hosted + vendored, 12 cells each: lock valid, re-run exit 0, `vendor --check` 0 (pass); `--json --prune` after six left `[packages]` (plain and `use_pylock`): reverted, exit 0, check 0 (pass); `use_pylock` with only pylock.toml still wired: kept and re-wired, sync PATCHED (pass); six left in `[docs]` only after a relock: re-wired, kept (pass); CRLF lock: kept, PATCHED (pass); base-interpreter warning in `scan --json` events as `pypi_pipenv_stale_install` (pass).
+
 macOS/Windows rows are from the 2026-09-30 probes on `f6b7fb9`. No probe ran on v5 because branch deletion through the git proxy still fails (re-checked 2026-10-03 03:30Z); `bughunt/pipenv/20260930-venv-discovery` and `bughunt/pipenv/20260930-virtualenv` still need a maintainer to delete them.
 
 ## Backlog
 
-000000000000000. **New (2026-10-13 21:35Z):** re-verify #1507 once fixed (2022.12.19 / 2023.2.4: `[packages]` + `[docs]`, `[dev-packages]` + `[docs]`, `[docs]` + `[tests]`; hosted + vendored). The #1450 remedy from a project subdirectory / `PIPENV_PIPFILE` (relative `./.socket/vendor` export paths). Hosted sdist artifact under 2026.9.x `resolver_backend = "pure-python"` (mock needs an sdist route). (#1450 verified fixed 2026-10-13 21:35Z; `pipenv update` / `upgrade` on vendored 2026.9.1: done, pass.)
+000000000000000. (#1507 verified fixed on `4a29912`, 2026-10-14.) (Concurrent / interrupted scans and #1050 GC on `use_pylock`: done 2026-10-14, pass.) Still to do: hosted sdist artifact under 2026.9.x `resolver_backend = "pure-python"` (mock needs an sdist route); standalone `vendor` from an agent manifest on a `use_pylock` project (mock needs the blob route); interrupted `vendor --revert` / `rollback`; `pylock_name` GC.
 00000000000000. (#1450 re-verified fixed on `aa85c6c`, 2026-10-13 21:35Z.) (#1437 / #1440 on Pipenv and the #409 diff-version / shadowed / uv-base lanes: done 2026-10-13, pass. 2024.4.1 stray venv/ + VIRTUAL_ENV: done 2026-10-13, pass.)
 0000000000000. #1127 (human `scan --mode vendored --prune` skips the vendored GC when no remaining package has a patch; Pipenv evidence added 2026-10-09 15:40Z): re-verify once fixed, for `[packages]`, named categories and `use_pylock`. Until then, test #1050 GC lanes with `--json --prune`. Still to do: #1050 GC on `use_pylock` / `pylock_name`; vendored undo on 2022 / 2025 after #1245; hosted rollback of a valid hand-written pylock entry.
 000000000000. #1219: re-verify once fixed (`apply --check` remedy with `-g`, `--global-prefix`, `--cwd`, `--manifest-path`).
@@ -137,6 +139,8 @@ macOS/Windows rows are from the 2026-09-30 probes on `f6b7fb9`. No probe ran on
 
 ## Known non-bugs
 
+- Harness note (2026-10-14): a batch mock that ignores the requested purls makes a removed-and-pruned package look like a `pypi_pipenv_lock_package_missing` failure (exit 1, partialFailure) that `--dry-run` doesn't show. It's the mock: with purl filtering the same scan exits 0 with `vendor_ledger_entry_unwired`. Filter the batch by `components[].purl`.
+- socket-patch run from a project subdirectory finds nothing ("No packages found"), so it never prints the #1450 remedy there; documented CLI scope (`<cwd>/Pipfile.lock`, use `--cwd`). Pipenv 2026.9.1 exports a vendored wheel as relative `./.socket/vendor/...`, 2022.12 / 2023.2 as an absolute `file://` URL; both work from the project root.
 - Pipenv 2026.9.1 can't install from a UTF-8 BOM-prefixed Pipfile.lock (`No matching distribution found for six====1.16.0`) and renames it to `Pipfile.lock.bak`, even with no socket-patch involved. BOM-lock cells only check that socket-patch preserves the bytes (it does); a failed install afterwards is Pipenv's.
 - A `--site-packages` venv whose own patched copy shadows an unpatched same-version base copy gets no stale warning and vex `not_affected`. That is correct, because the venv copy is the one imported (2026-10-13).
 - Hosted `rollback` of a `pipenv requirements` sibling restores `six==1.16.0 ; <markers>` (a space before `;`) where Pipenv wrote `six==1.16.0; <markers>`. The v5 upstream restore re-derives the line (CLI_CONTRACT rollback, pypi row), so it's semantically identical; Pipfile.lock itself is byte-exact. Cosmetic, not filed.