@@ -194,11 +194,14 @@ into the new version's section — see docs/releasing.md.
   pre-hosted lock. The hosted rewrite now keeps the registry record's
   inactive bytes (padding, semver) in the tarball record it writes, and a
   re-pin to a later grant's URL drops the superseded URL from the string
-  pool, so the rebuild is byte-exact — early writers' uninitialized padding included —
-  except for a binary format 1 lock (kept promoted to format 2) and a
-  workspace lock (dependency behaviors kept normalized). Those exceptions
-  keep `rollback` / `remove` refusing a hosted `bun.lockb` pin with the
-  `git checkout -- bun.lockb` remedy; an `--offline` vendor still refuses.
+  pool, so the rebuild is byte-exact — early writers' uninitialized padding included.
+  Where the hosted rewrite had to normalize the lock it marks it (in the
+  root package's resolution bytes, which no Bun reader reads): a binary
+  format 1 lock (Bun 0.1.1-0.1.6), promoted to format 2, is demoted back to
+  its exact format-1 bytes, and a lock whose workspace dependency behaviors
+  were normalized is refused with the `git checkout -- bun.lockb` remedy
+  instead of taken over non-exactly. `rollback` / `remove` keep refusing a
+  hosted `bun.lockb` pin with that remedy; an `--offline` vendor still refuses.
 - **`vendor_supersedes_redirect` is removed.** The vendored flows no longer
   warn about (or auto-reconcile, or unwind the `.npmrc` for) a stale hosted
   ledger record: once the lock routes a package to `.socket/vendor/`, no
 
@@ -957,7 +957,7 @@ v5.0 replaces v4's per-purl reverts and whole-ledger reverse replay (`revert_rem
 
 * **Scope.** The hosted pins are what lockfile discovery finds — `(purl, patch uuid, files wiring it)`, recognized only on `https://patch.socket.dev` or the `--patch-server-url` / `SOCKET_PATCH_SERVER_URL` origin. A scoped rollback (paths / identifiers / `--ecosystems`) restores exactly the pins in scope; each pin restores or refuses on its own (there is no whole-ledger replay, and a pre-v5 ledger's edits are never replayed). A pin discovery cannot see is out of reach: a lockless cargo `registry = "socket-patch-<uuid>"` pin, a nuget exact-id mapping with no `packages.lock.json`, a gem wired only in the `Gemfile` (pre-bundler-2.6 mixed state) — restore those files from version control.
 * **What a restore does.** Every file wiring the pin is rewritten back to the DEFAULT UPSTREAM registry entry for `name@version`, re-resolving whatever the entry pins (tarball URL, integrity, checksum, hashes) from the public registry; only the hosted entries change and every other byte stays the file's own. A pin is **all-or-nothing**: refused in one of its files, it is restored in none of them, so no pin is left half hosted. Nothing reaches disk until every pin has resolved, and `--dry-run` resolves exactly like a wet run — registry lookups included — and skips only the write. Per format:
-  * **npm family** — `package-lock.json` / `npm-shrinkwrap.json`, `yarn.lock` (classic and berry), `pnpm-lock.yaml` / `shrinkwrap.yaml`, `bun.lock`: resolution + integrity (+ shasum where recorded) from the npm registry's version document (`SOCKET_NPM_REGISTRY`). Side settings: a project `.npmrc` that is exactly `allow-remote=all\n` is deleted once no root npm lock entry is hosted, otherwise a remaining top-level `allow-remote=all` warns `npm_allow_remote_left`; a `pnpm-workspace.yaml` that is exactly the scaffold hosted mode creates is deleted once `pnpm-lock.yaml` is no longer hosted, otherwise a remaining `trustLockfile: true` warns `pnpm_trust_lockfile_left`. **`bun.lockb` (binary)**: `rollback` and `remove` refuse it (the checkout remedy) — a rebuilt record is not byte-exact for every lock: a binary format 1 lock stays promoted to format 2 and a workspace lock keeps its normalized dependency behaviors. The hosted → vendored takeover and the eject DO restore it, since the vendor ledger then records the rebuilt record as its pre-vendor original: the native codec turns each hosted remote-tarball record back into Bun's npm registry record for `name@version` (the registry's `dist.tarball` + `dist.integrity`, the package metadata hash re-derived, the hosted URL string dropped from the string pool). The hosted rewrite keeps the registry record's inactive bytes (padding, semver) in the tarball record, so a lock it wrote comes back byte for byte — early writers' uninitialized padding included; a record without them (an older socket-patch or a Bun re-save) is rebuilt the way Bun writes one, and refused for a prerelease/build version.
+  * **npm family** — `package-lock.json` / `npm-shrinkwrap.json`, `yarn.lock` (classic and berry), `pnpm-lock.yaml` / `shrinkwrap.yaml`, `bun.lock`: resolution + integrity (+ shasum where recorded) from the npm registry's version document (`SOCKET_NPM_REGISTRY`). Side settings: a project `.npmrc` that is exactly `allow-remote=all\n` is deleted once no root npm lock entry is hosted, otherwise a remaining top-level `allow-remote=all` warns `npm_allow_remote_left`; a `pnpm-workspace.yaml` that is exactly the scaffold hosted mode creates is deleted once `pnpm-lock.yaml` is no longer hosted, otherwise a remaining `trustLockfile: true` warns `pnpm_trust_lockfile_left`. **`bun.lockb` (binary)**: `rollback` and `remove` refuse it (the checkout remedy). The hosted → vendored takeover and the eject DO restore it, since the vendor ledger then records the rebuilt record as its pre-vendor original: the native codec turns each hosted remote-tarball record back into Bun's npm registry record for `name@version` (the registry's `dist.tarball` + `dist.integrity`, the package metadata hash re-derived, the hosted URL string dropped from the string pool). The hosted rewrite keeps the registry record's inactive bytes (padding, semver) in the tarball record, so a lock it wrote comes back byte for byte — early writers' uninitialized padding included; a record without them (an older socket-patch or a Bun re-save) is rebuilt the way Bun writes one, and refused for a prerelease/build version. A lock the hosted rewrite had to normalize is marked in the root package's resolution value bytes (which no Bun reader reads): a binary format 1 lock it promoted to format 2 is demoted back to its exact format-1 bytes (verified by promoting it again, otherwise refused), and a lock whose workspace dependency behaviors it normalized is refused with the `git checkout -- bun.lockb` remedy.
   * **vlt** — `vlt-lock.json`: slot [2] from the registry's `dist.integrity`, slot [3] per the lock's own convention (see the vlt hosted-mode contract); every hosted instance of the pin together.
   * **cargo** — `Cargo.lock` back on crates.io (source + the sparse index's checksum, `SOCKET_CRATES_INDEX`); every `Cargo.toml` declaration loses its `registry = "socket-patch-<uuid>"` pin (the shorthand the rewriter produced collapses back); the unreferenced `[registries.socket-patch-<uuid>]` block leaves the project cargo config. A declaration it cannot unpin refuses.
   * **golang** — the hosted `replace` and the socket module's go.sum lines go; the upstream module's two go.sum lines come back, hashed from the module proxy (`SOCKET_GOPROXY`, else `GOPROXY` / `GONOPROXY` / `GOPRIVATE` as go reads them) and cross-checked against the checksum database (`SOCKET_GOSUMDB_URL`, else `sum.golang.org` unless `GOSUMDB=off` / `GONOSUMDB` / `GOPRIVATE` say go would not ask it). A `replace` the user had before the hosted run is not recorded anywhere, so the restore lands on the plain upstream module.
 
@@ -116,8 +116,8 @@ fn cli_code(project: &Path, args: &[&str]) -> (i32, Value) {
 }
 
 /// v5 keeps no hosted ledger, so undoing a hosted pin means restoring the
-/// entry's upstream registry form. For a binary `bun.lockb` that rebuilt
-/// record is not byte-exact for every lock (format 1, workspace locks), so
+/// entry's upstream registry form. For a binary `bun.lockb` only a vendor
+/// takeover rebuilds that record (it refuses a workspace-normalized lock), so
 /// `rollback` REFUSES the pin, naming the checkout remedy, and leaves the
 /// lock exactly as found; the test then applies that remedy (`git checkout --
 /// bun.lockb`, here: the original bytes written back).
 
@@ -8,7 +8,9 @@
 //! per-purl takeover (`vendor` with the patch record staged) and the eject
 //! (`vendor` in a manifest-less hosted project). Each vendors, records the
 //! REGISTRY record as the vendor ledger's pre-vendor original, and
-//! `vendor --revert` returns the exact pre-hosted bytes. `rollback` of the
+//! `vendor --revert` returns the exact pre-hosted bytes (a format-1 lock the
+//! hosted rewrite promoted is demoted back; a lock whose workspace behaviors
+//! it normalized is refused with the checkout remedy). `rollback` of the
 //! hosted pin still refuses with the `git checkout -- bun.lockb` remedy, as
 //! does an offline vendor (the registry cannot be asked).
 //!
@@ -251,12 +253,14 @@ fn assert_vendored(p: &Project, env: &Value) {
     assert_eq!(original["integrity"], UPSTREAM_INTEGRITY, "{original}");
 }
 
-/// Bun 0.8.1 (uninitialized record padding), 1.1.38 (the last binary-only
-/// writer) and 1.2.0 (the legacy lock Bun 1.2 keeps): the takeover vendors
-/// over the hosted pin, and the revert gives back the pre-hosted bytes.
+/// Bun 0.1.1 / 0.1.6 (binary format 1, which the hosted rewrite promotes to
+/// format 2 and the takeover's restore demotes again), 0.8.1 (uninitialized
+/// record padding), 1.1.38 (the last binary-only writer) and 1.2.0 (the
+/// legacy lock Bun 1.2 keeps): the takeover vendors over the hosted pin, and
+/// the revert gives back the pre-hosted bytes.
 #[tokio::test]
 async fn takeover_vendors_over_a_hosted_bun_lockb_and_reverts_exactly() {
-    for writer in ["0.8.1", "1.1.38", "1.2.0"] {
+    for writer in ["0.1.1", "0.1.6", "0.8.1", "1.1.38", "1.2.0"] {
         let p = hosted_project(writer).await;
         stage_record(p.root());
         let hosted = p.lock();
@@ -311,6 +315,38 @@ async fn eject_vendors_a_hosted_bun_lockb_and_reverts_exactly() {
     assert!(p.lock() == p.pristine, "exact pre-hosted bytes");
 }
 
+/// A hosted lock whose workspace dependency behaviors the rewrite had to
+/// normalize cannot be given back byte for byte: the takeover refuses with
+/// the checkout remedy (dry and wet alike) and writes nothing.
+#[tokio::test]
+async fn takeover_refuses_a_workspace_normalized_hosted_bun_lockb() {
+    let p = hosted_project("1.1.45-extensions").await;
+    stage_record(p.root());
+    let hosted = p.lock();
+    for extra in [&["--dry-run"][..], &[][..]] {
+        let mut args = vec!["vendor"];
+        args.extend_from_slice(extra);
+        let (code, env) = p.run_json(&args);
+        assert_eq!(code, 1, "{extra:?}: {env:#}");
+        let refused = env["events"]
+            .as_array()
+            .and_then(|events| {
+                events
+                    .iter()
+                    .find(|e| e["errorCode"] == "redirect_revert_failed")
+            })
+            .unwrap_or_else(|| panic!("expected redirect_revert_failed: {env:#}"));
+        assert!(
+            refused["error"].as_str().is_some_and(|e| e
+                .contains("workspace dependency behaviors")
+                && e.contains("git checkout -- bun.lockb")),
+            "{env:#}"
+        );
+        assert_eq!(p.lock(), hosted, "{extra:?}: a refused vendor writes nothing");
+        assert!(!p.root().join(".socket/vendor").exists());
+    }
+}
+
 /// `rollback` of the hosted pin, and a vendor that cannot reach the
 /// registry, refuse with the checkout remedy and write nothing.
 #[tokio::test]
 
@@ -6,14 +6,20 @@
 //! ([`BunLockb::set_registry_package`], which also re-derives the metadata
 //! hash Bun's frozen install checks). Every other byte is the file's own.
 //!
+//! Where the hosted rewrite had to normalize the lock, the codec marked it
+//! (see `vendor::bun_lockb`): a lock promoted from binary format 1 is
+//! demoted back to its exact format-1 bytes once every hosted record is
+//! rebuilt, and a lock whose workspace dependency behaviors were normalized
+//! (not invertible) is refused — the checkout remedy, never a non-exact lock.
+//!
 //! Only reached under [`super::RestoreOptions::bun_lockb`]: see there for
 //! why `rollback` keeps refusing a binary lock.
 
 use std::collections::BTreeSet;
 
 use super::npm::{by_uuid, fetch_dists, refuse_all_in};
 use super::{Ctx, FormatResult, HostedPin, View};
-use crate::vendor::bun_lockb::BunLockb;
+use crate::vendor::bun_lockb::{BunLockb, NORMALIZED_FORMAT_1, NORMALIZED_WORKSPACE};
 
 pub(super) async fn restore(
     view: &mut View<'_>,
@@ -45,6 +51,19 @@ pub(super) async fn restore(
                 continue;
             }
         };
+        let flags = lock.normalized_flags();
+        if flags & NORMALIZED_WORKSPACE != 0 {
+            refuse_all_in(
+                &pins,
+                rel,
+                &mut result,
+                format!(
+                    "the hosted rewrite normalized {rel}'s workspace dependency behaviors, \
+                     so its original bytes cannot be rebuilt"
+                ),
+            );
+            continue;
+        }
         let packages = match lock.packages() {
             Ok(packages) => packages,
             Err(e) => {
@@ -85,6 +104,7 @@ pub(super) async fn restore(
             .collect();
         let dists = fetch_dists(&wanted, ctx, &mut result).await;
         let mut changed = false;
+        let mut restored = Vec::new();
         for (id, uuid, name, version) in hits {
             if result.refused.contains_key(&uuid) {
                 continue;
@@ -102,12 +122,27 @@ pub(super) async fn restore(
             // Transactional per record: a failed rebuild leaves `lock` as is.
             match lock.set_registry_package(id, &version, &dist.tarball, integrity) {
                 Ok(()) => {
-                    result.handled.insert(uuid);
+                    restored.push(uuid);
                     changed = true;
                 }
                 Err(e) => result.refuse(&uuid, format!("{rel} package #{id}: {e}")),
             }
         }
+        if changed && flags & NORMALIZED_FORMAT_1 != 0 {
+            // The hosted rewrite promoted a format-1 lock: give back its
+            // exact original bytes, or nothing.
+            match lock.demote_legacy_format() {
+                Ok(Some(original)) => lock = original,
+                Ok(None) => {}
+                Err(e) => {
+                    for uuid in restored.drain(..) {
+                        result.refuse(&uuid, format!("{rel}: {e}"));
+                    }
+                    changed = false;
+                }
+            }
+        }
+        result.handled.extend(restored);
         if changed {
             view.write_bytes(rel, lock.bytes());
         }
@@ -212,13 +247,16 @@ mod tests {
         }
     }
 
-    /// Every binary writer whose lock the hosted rewrite leaves in the
-    /// format it found gets its exact pre-hosted bytes back — including the
-    /// uninitialized padding early writers leave in registry records.
+    /// Every binary writer gets its exact pre-hosted bytes back — including
+    /// the uninitialized padding early writers leave in registry records,
+    /// and a format-1 lock (0.1.1 / 0.1.6), which the hosted rewrite
+    /// promoted to format 2 and the restore demotes again.
     #[tokio::test]
     #[serial_test::serial]
     async fn hosted_record_restores_byte_exact_on_every_writer() {
         for dir in [
+            "0.1.1",
+            "0.1.6",
             "0.1.7",
             "0.5.9",
             "0.6.7",
@@ -253,40 +291,60 @@ mod tests {
         }
     }
 
-    /// Where the hosted rewrite had to normalize the lock (format 1 promoted
-    /// to format 2; workspace dependency behaviors), the restore is the
-    /// registry record, not the original bytes.
+    /// Where the hosted rewrite had to normalize workspace dependency
+    /// behaviors (not invertible), the restore refuses with the checkout
+    /// remedy and writes nothing, instead of returning a non-exact lock.
     #[tokio::test]
     #[serial_test::serial]
-    async fn normalized_locks_restore_the_registry_record() {
-        for dir in [
-            "0.1.1",
-            "0.1.6",
-            "1.1.45-extensions",
-            "1.2.23-extensions",
-            "1.4.2-extensions",
-        ] {
+    async fn workspace_normalized_locks_refuse() {
+        for dir in ["1.1.45-extensions", "1.2.23-extensions", "1.4.2-extensions"] {
             let original = fixture(dir);
             let upstream = minimist(&original);
             let server = registry(upstream.integrity.as_deref().unwrap()).await;
             std::env::set_var("SOCKET_NPM_REGISTRY", server.uri());
-            let (outcome, after) = run(&hosted(&original), &vendor_opts()).await;
-            std::env::remove_var("SOCKET_NPM_REGISTRY");
-            assert_eq!(outcome.pins[0].status, PinStatus::Restored, "{dir}");
-            let restored = minimist(&after);
-            assert_eq!(restored.resolution, UPSTREAM_URL, "{dir}");
-            assert_eq!(restored.integrity, upstream.integrity, "{dir}");
-            BunLockb::parse(&after)
-                .unwrap()
-                .validate_mutation()
-                .unwrap();
-            assert!(
-                !after.windows(16).any(|w| w == b"patch.socket.dev"),
+            let lock = hosted(&original);
+            assert_eq!(
+                BunLockb::parse(&lock).unwrap().normalized_flags(),
+                crate::vendor::bun_lockb::NORMALIZED_WORKSPACE,
                 "{dir}"
             );
+            let (outcome, after) = run(&lock, &vendor_opts()).await;
+            std::env::remove_var("SOCKET_NPM_REGISTRY");
+            let why: Vec<&str> = outcome.refused().map(|(_, why)| why).collect();
+            assert_eq!(why.len(), 1, "{dir}: {why:?}");
+            assert!(why[0].contains("workspace dependency behaviors"), "{why:?}");
+            assert!(why[0].contains("git checkout -- bun.lockb"), "{why:?}");
+            assert!(outcome.reverted_files.is_empty(), "{dir}");
+            assert!(after == lock, "{dir}");
         }
     }
 
+    /// A promoted format-1 lock whose mark this codec did not write exactly
+    /// (here: an unknown flag bit) is refused, never demoted to a guess.
+    #[tokio::test]
+    #[serial_test::serial]
+    async fn promoted_format_1_lock_that_does_not_invert_refuses() {
+        let original = fixture("0.1.6");
+        let upstream = minimist(&original);
+        let server = registry(upstream.integrity.as_deref().unwrap()).await;
+        std::env::set_var("SOCKET_NPM_REGISTRY", server.uri());
+        let mut lock = hosted(&original);
+        let count = u64::from_le_bytes(lock[86..94].try_into().unwrap()) as usize;
+        let package_start = u64::from_le_bytes(lock[110..118].try_into().unwrap()) as usize;
+        // The root resolution's flag byte (its last).
+        let flags_at = package_start + count * 16 + 63;
+        assert_eq!(lock[flags_at], crate::vendor::bun_lockb::NORMALIZED_FORMAT_1);
+        lock[flags_at] |= 0x40;
+        BunLockb::parse(&lock).unwrap().validate_mutation().unwrap();
+        let (outcome, after) = run(&lock, &vendor_opts()).await;
+        std::env::remove_var("SOCKET_NPM_REGISTRY");
+        let why: Vec<&str> = outcome.refused().map(|(_, why)| why).collect();
+        assert_eq!(why.len(), 1, "{why:?}");
+        assert!(why[0].contains("format-1"), "{why:?}");
+        assert!(why[0].contains("git checkout -- bun.lockb"), "{why:?}");
+        assert!(after == lock);
+    }
+
     /// Without the vendor opt-in (the `rollback` posture), or offline,
     /// nothing is written and the refusal names the checkout remedy; a dry
     /// run resolves the restore and writes nothing.