@@ -1540,10 +1540,10 @@ command's integration tests check its output.
 | `vendor_lock_descriptor_unlocked` | revert `warnings[]` | vendor `--revert` / rollback / remove (yarn berry, #759): a descriptor of the vendored package was added while it was vendored, and the restored registry version does not satisfy it (or its range is one socket-patch cannot read, such as a dist-tag), so it has no `yarn.lock` entry after the revert. The revert still succeeds and the artifact is removed. Run `yarn install` and commit `yarn.lock`. |
 | `pypi_{poetry,pdm,pipenv}_no_lockfile` | `failed` | vendor (pypi): a lock-less tool marker with no `requirements.txt` fallback — run `<tool> lock`. |
 | `pypi_poetry_integrity_unverified` | `skipped` (warning) | vendor (pypi / poetry): the lock was written by Poetry < 1.4 (0.12 `[metadata.hashes]`, lock 1.0/1.1, or a 2.0 lock without a `@generated by Poetry X.Y.Z` header — 1.3 wrote those). That installer does not verify local wheel hashes (the committed wheel bytes are the protection) and does not replace an already-installed package at the same version; recreate the virtualenv or `pip uninstall` the package before `poetry install`, or upgrade Poetry. |
-| `pypi_poetry_source_constraint` | `failed` / `skipped` (warning) | vendor (pypi / poetry): the pyproject pins the package to a named source (`source = "pypi"`), which Poetry records nothing for in the lock. Over a lock written by Poetry 1.3 – 2.2 (whose installer refuses that constraint on a file-sourced package, so every `poetry install` would fail) the package is refused before any write, `failed`; an already-wired lock is refused the same way instead of reading as in sync. Over any other lock the wiring stands and this is a warning naming the 1.3 – 2.2 range. The detail names the remedy: drop the `source` key or upgrade to Poetry >= 2.3, re-lock and re-run; when the lock is already wired it first says to run `socket-patch vendor --revert` (which reverts EVERY vendored package), since re-locking discards the wiring. |
+| `pypi_poetry_source_constraint` | `failed` / `skipped` (warning) | vendor (pypi / poetry): the pyproject pins the package to a named source (`source = "pypi"`), which Poetry records nothing for in the lock. Over a lock written by Poetry 1.3 – 2.2 (whose installer refuses that constraint on a file-sourced package, so every `poetry install` would fail), or one with `lock-version` 1.0 / 1.1 (which every Poetry 1.3+ re-solves on install and then refuses the same way, #1503), the package is refused before any write, `failed`, and the detail says which; an already-wired lock is refused the same way instead of reading as in sync. Over a Poetry 2.3+ (or 0.x) lock the wiring stands and this is a warning naming the 1.3 – 2.2 range. The detail names the remedy: drop the `source` key or upgrade to Poetry >= 2.3, re-lock and re-run; when the lock is already wired it first says to run `socket-patch vendor --revert` (which reverts EVERY vendored package), since re-locking discards the wiring. |
 | `redirect_poetry_stale_install_risk` | `warnings[]` (warning) | scan `--mode hosted` (poetry): same writer test as above — a warm virtualenv keeps the upstream package after the redirect on Poetry < 1.4 (1.4+ re-installs from the new source); fresh installs pick up the patched wheel. Emitted once per rewritten lock, only on the run that rewrites it. |
-| `redirect_poetry_source_constraint` | `warnings[]` (warning) | scan `--mode hosted` (poetry): the pyproject pins the redirected package to a named source (`source = "pypi"`) and the lock was not written by Poetry 1.3 – 2.2 (those writers are refused with `redirect_poetry_lock_unsupported`, also when the lock is already redirected and before a vendored → hosted takeover reverts anything). The rewrite stands, and an already-redirected lock is still confirmed; the detail says a Poetry 1.3 – 2.2 installer would refuse the lock and to drop the `source` key if the project is installed with one. Exit code and `status` unchanged. |
-| `redirect_poetry_entry_not_found` / `redirect_poetry_missing_sha256` / `redirect_poetry_lock_unsupported` | `warnings[]` (warning) | scan `--mode hosted` (poetry): the lock has no `[[package]]` at the granted version (uv-parity twin of `redirect_uv_entry_not_found`); the grant carries no SHA-256 (gated once per dep, not per lock); the lock is refused — Poetry 0.12 layout (URL sources ignored), an unsupported `lock-version`, a forked package listed at several versions, a user-authored `[package.source]` on another origin (an earlier Socket URL for the same wheel is superseded in place), a package the pyproject pins to a named source (`source = "pypi"`) over a lock written by Poetry 1.3 – 2.2, whose installer refuses that constraint on a URL-sourced package, a malformed `[metadata.files]`/`[metadata.hashes]`, or a wheel whose filename does not match the locked package. Exit code and `status` unchanged (hosted-refusal posture). A vendored → hosted takeover over a Poetry 0.x lock is retracted with this code (wet and `--dry-run`, see **Staged takeover**): the purl stays vendored and patched and is skipped with this code as `skipped` (hosted event). The detail names the remedy and its reach: run `socket-patch vendor --revert` (it reverts EVERY vendored package in the project, not just this one), upgrade to Poetry >= 1.0 and re-lock, then re-run `scan --mode hosted`. |
+| `redirect_poetry_source_constraint` | `warnings[]` (warning) | scan `--mode hosted` (poetry): the pyproject pins the redirected package to a named source (`source = "pypi"`) and the lock is in format 2.1+ and was not written by Poetry 1.3 – 2.2 (those writers, and any `lock-version` 1.0 / 1.1 lock, which every Poetry 1.3+ re-solves and refuses (#1503), are refused with `redirect_poetry_lock_unsupported`, also when the lock is already redirected and before a vendored → hosted takeover reverts anything). The rewrite stands, and an already-redirected lock is still confirmed; the detail says a Poetry 1.3 – 2.2 installer would refuse the lock and to drop the `source` key if the project is installed with one. Exit code and `status` unchanged. |
+| `redirect_poetry_entry_not_found` / `redirect_poetry_missing_sha256` / `redirect_poetry_lock_unsupported` | `warnings[]` (warning) | scan `--mode hosted` (poetry): the lock has no `[[package]]` at the granted version (uv-parity twin of `redirect_uv_entry_not_found`); the grant carries no SHA-256 (gated once per dep, not per lock); the lock is refused — Poetry 0.12 layout (URL sources ignored), an unsupported `lock-version`, a forked package listed at several versions, a user-authored `[package.source]` on another origin (an earlier Socket URL for the same wheel is superseded in place), a package the pyproject pins to a named source (`source = "pypi"`) over a lock written by Poetry 1.3 – 2.2, whose installer refuses that constraint on a URL-sourced package, or over a `lock-version` 1.0 / 1.1 lock, which every Poetry 1.3+ re-solves and refuses the same way (#1503), a malformed `[metadata.files]`/`[metadata.hashes]`, or a wheel whose filename does not match the locked package. Exit code and `status` unchanged (hosted-refusal posture). A vendored → hosted takeover over a Poetry 0.x lock is retracted with this code (wet and `--dry-run`, see **Staged takeover**): the purl stays vendored and patched and is skipped with this code as `skipped` (hosted event). The detail names the remedy and its reach: run `socket-patch vendor --revert` (it reverts EVERY vendored package in the project, not just this one), upgrade to Poetry >= 1.0 and re-lock, then re-run `scan --mode hosted`. |
 | `redirect_pdm_refused` / `redirect_pdm_legacy_sync_required` | `warnings[]` (warning) | scan `--mode hosted` (pdm): the `pdm.lock` rewrite was refused — an unsupported `[metadata] lock_version` (the identity-losing `3.1` / `4.0`–`4.2` formats or an untested future format), an unsupported `strategy`, a package listed at several versions (fork) or absent, a user-authored `url`/`path`/VCS/`editable` source, hash-less or malformed `files`, or a wheel whose filename does not match the locked package (`redirect_pdm_refused`); or the lock was written in format `2` (PDM 0.12–1.4), whose upstream freshness bug lets `pdm install` regenerate the lock — use `pdm sync` (`redirect_pdm_legacy_sync_required`). A refused uuid is withheld from every other PyPI rewriter when `pdm.lock` is the install driver, and its patch is not confirmed. Exit code and `status` unchanged (hosted-refusal posture). |
 | `redirect_bun_lock_unsupported` | `warnings[]` (warning) | scan/get `--mode hosted` (bun): the text lock's `lockfileVersion` is not 0, 1 or 2 (a newer version: update socket-patch, re-locking would reproduce it; no integer: re-lock with Bun ≥ 1.2 — the shared gate's text, identical to vendored's `vendor_lockfile_version_unsupported`), or its `packages` section is not bun's single-line grammar. Nothing rewritten; exit 0 (hosted-refusal posture). |
 | `redirect_bun_workspace_unsupported` | `warnings[]` (warning) | scan/get `--mode hosted` (bun): a lockfileVersion-0 lock (Bun 1.1.39–1.1.45 `--save-text-lockfile`) holds `workspace:` packages; frozen installs of that grammar cannot keep the hosted tuple. Detail: "Bun version-0 workspace locks cannot preserve hosted tarballs on frozen installs; delete bun.lock and re-run `bun install` with Bun >= 1.2 (which writes lockfileVersion 1, accepted by hosted mode) — a plain in-place `bun install` bumps the version only when a workspace depends on another workspace (e.g. root -> member); otherwise it keeps version 0 or fails to resolve" (measured: Bun 1.2.0 keeps 0, 1.2.23–1.4.2 exit 1 "failed to resolve" on a root that does not depend on its members). Version-1/2 workspace locks are rewritten. Exit 0. |
 
@@ -20,7 +20,7 @@
 
 #[path = "common/mod.rs"]
 mod common;
-use common::{binary, git_sha256};
+use common::{binary, git_sha256, hermetic};
 
 use std::path::{Path, PathBuf};
 use std::process::{Command, Output};
@@ -60,20 +60,20 @@ fn git_sha256_file(path: &Path) -> String {
     git_sha256(&content)
 }
 
+/// Run the binary with the hermetic `SOCKET_*` environment (no token, so the
+/// scans take the public-proxy path `--proxy-url` pins). The gem crawler
+/// reads `BUNDLE_PATH`, `BUNDLE_APP_CONFIG`, the user's `~/.bundle/config`
+/// and the `gem env` homes (`GEM_HOME`, `GEM_PATH`, `~/.gem`), and the scans
+/// are unscoped, so every `BUNDLE_*` var, both gem-home vars and an
+/// activated venv are scrubbed and `HOME` points at a stand-in
+/// (`jvm_env::isolate_cli`): any of them would add the developer's gems or
+/// packages to the exact purl sets these tests assert.
 fn run(cwd: &Path, args: &[&str]) -> (i32, String, String) {
-    let mut cmd = Command::new(binary());
+    let mut cmd = hermetic::command(&binary());
+    hermetic::scrub_extra(&mut cmd, &[hermetic::Extra::Bundle, hermetic::Extra::Venv]);
+    cmd.env_remove("GEM_HOME").env_remove("GEM_PATH");
+    common::jvm_env::isolate_cli(&mut cmd);
     cmd.args(args).current_dir(cwd);
-    // Hermeticity, mirroring the production e2e suites: scrub every ambient
-    // `SOCKET_*` (token, api/proxy URL, org, legacy aliases — not just the
-    // two token vars) and block the socket-cli config.json, so a developer's
-    // login or configured apiBaseUrl cannot silently repoint or re-tier
-    // these runs.
-    for (k, _) in std::env::vars_os() {
-        if k.to_string_lossy().starts_with("SOCKET_") {
-            cmd.env_remove(&k);
-        }
-    }
-    cmd.env("SOCKET_NO_CONFIG", "true");
     let out: Output = cmd.output().expect("failed to execute socket-patch binary");
 
     let code = out.status.code().unwrap_or(-1);
@@ -94,6 +94,11 @@ fn assert_run_ok(cwd: &Path, args: &[&str], context: &str) -> (String, String) {
 fn bundle_run(cwd: &Path, args: &[&str]) {
     let mut cmd = Command::new("bundle");
     cmd.args(args).current_dir(cwd);
+    // Scrub first: the sweeps would otherwise remove the BUNDLE_PATH below,
+    // and an ambient `BUNDLE_*` (frozen, deployment, without, ...) would
+    // change what this install does.
+    hermetic::scrub_socket_vars(&mut cmd);
+    hermetic::scrub_extra(&mut cmd, &[hermetic::Extra::Bundle]);
     // Bundler 4 removed `bundle install --path`; BUNDLE_PATH is honored by
     // bundler 2 through 4 and keeps the vendor/bundle/ruby/*/gems layout
     // `find_gem_dir` expects. It also upholds cache_env's hermeticity
 
@@ -1179,9 +1179,10 @@ fn poetry_vendored_revendors_to_a_superseding_patch() {
 /// `six = {version = "1.16.0", source = "pypi"}` leaves no trace in the
 /// lock, and Poetry 1.3 – 2.2 refuse to install a lock that then sources six
 /// from a URL or file ("Repository \"pypi\" does not exist."; 1.3 and 1.4
-/// report a solver failure). Over a lock one of them wrote, both modes
-/// refuse and leave the lock installable; other releases install the
-/// rewired lock, with a warning (#1282, #1447).
+/// report a solver failure), and every Poetry 1.3+ re-solves, then refuses,
+/// a lock-version 1.0 / 1.1 lock (Poetry 1.0 – 1.2 write those). Over such a lock
+/// both modes refuse and leave the lock installable; 2.3+ install the
+/// rewired lock, with a warning (#1282, #1447, #1503).
 #[test]
 #[ignore = "real Poetry + PyPI; run by the CI e2e matrix per Poetry release"]
 fn poetry_source_pypi_constraint_never_breaks_install() {
@@ -1206,7 +1207,10 @@ fn poetry_source_pypi_constraint_never_breaks_install() {
         return;
     };
     // The lock was written by this Poetry, so it is also the installer.
-    let refused = ((1, 3)..(2, 3)).contains(&poetry.major_minor());
+    // 1.1 and 1.2 install their own lock, but they write lock format 1.1,
+    // which every Poetry 1.3+ re-solves and then refuses (#1503): refused
+    // too, since the installer usually outlives the lock.
+    let refused = poetry.major_minor() < (2, 3);
     let mut patched = pristine.clone();
     patched.extend_from_slice(MARKER);
     let wheel = build_wheel(&patched);
 
@@ -864,6 +864,105 @@ async fn uv_no_sources_is_refused_in_both_modes() {
     }
 }
 
+/// #1501: a PEP 723 script takes uv's settings from the nearest directory
+/// at or above it that holds a `uv.toml` or a `pyproject.toml` with
+/// `[tool.uv]`. A parent project's `no-sources = true` therefore drops the
+/// script's source too, so both modes must refuse a script scanned from a
+/// subdirectory just as they do beside the setting. A parent pyproject
+/// without `[tool.uv]` sets nothing, and the script is still wired.
+#[tokio::test]
+async fn uv_script_no_sources_in_a_parent_is_refused_in_both_modes() {
+    let parent_pyproject = "[project]\nname = \"root\"\nversion = \"0.1.0\"\n";
+    for (file, setting, refused) in [
+        ("uv.toml", "no-sources = true\n".to_string(), true),
+        (
+            "pyproject.toml",
+            format!("{parent_pyproject}\n[tool.uv]\nno-sources = true\n"),
+            true,
+        ),
+        (
+            "pyproject.toml",
+            format!("{parent_pyproject}\n[tool.uv]\nno-sources-package = [\"Six\"]\n"),
+            true,
+        ),
+        ("pyproject.toml", parent_pyproject.to_string(), false),
+    ] {
+        let (_tmp, root) = project();
+        stage_script_lock(&root);
+        std::fs::write(root.parent().unwrap().join(file), &setting).unwrap();
+        let before = tree(&root);
+
+        let server = MockServer::start().await;
+        mount_hosted_api(&server, true).await;
+        let (code, env) = hosted_scan(&root, &server);
+        assert_eq!(code, 0, "hosted {file}: {env:#}");
+        if refused {
+            assert_eq!(hosted_pinned(&env), 0, "hosted {file}: {env:#}");
+            assert!(
+                env.to_string().contains("redirect_uv_script_unsupported")
+                    && env.to_string().contains(&format!("../{file}")),
+                "hosted {file}: {env:#}"
+            );
+            assert_eq!(tree(&root), before, "hosted {file} wrote nothing");
+        } else {
+            assert_eq!(hosted_pinned(&env), 1, "hosted {file}: {env:#}");
+            continue;
+        }
+
+        stage_manifest(&root);
+        let before = tree(&root);
+        let (code, env) = run_cli(&root, &["vendor"], &[]);
+        assert_ne!(code, 0, "vendored {file}: {env:#}");
+        assert!(
+            env.to_string().contains("pypi_uv_no_sources")
+                && env.to_string().contains(&format!("../{file}")),
+            "vendored {file}: {env:#}"
+        );
+        assert_eq!(tree(&root), before, "vendored {file} wrote nothing");
+    }
+}
+
+/// In a uv workspace, uv takes a member's script settings from the
+/// workspace root, so a member's own `[tool.uv]` does not shield the script
+/// from the root's `no-sources`. The #1138 workspace-member guard refuses
+/// the run before the script lane's own lookup, in both modes.
+#[tokio::test]
+async fn uv_script_in_a_workspace_member_is_not_wired() {
+    let (_tmp, root) = project();
+    stage_script_lock(&root);
+    std::fs::write(
+        root.join("pyproject.toml"),
+        "[project]\nname = \"s\"\nversion = \"0.1.0\"\n\n[tool.uv]\npackage = false\n",
+    )
+    .unwrap();
+    std::fs::write(
+        root.parent().unwrap().join("pyproject.toml"),
+        "[project]\nname = \"b\"\nversion = \"0.1.0\"\n\n[tool.uv.workspace]\nmembers = [\"proj\"]\n\n[tool.uv]\nno-sources = true\n",
+    )
+    .unwrap();
+    let before = tree(&root);
+
+    let server = MockServer::start().await;
+    mount_hosted_api(&server, true).await;
+    let (code, env) = hosted_scan(&root, &server);
+    assert_eq!(code, 1, "hosted: {env:#}");
+    assert_eq!(
+        env["error"]["code"], "redirect_workspace_lockfile_elsewhere",
+        "hosted: {env:#}"
+    );
+    assert_eq!(tree(&root), before, "hosted wrote nothing");
+
+    stage_manifest(&root);
+    let before = tree(&root);
+    let (code, env) = run_cli(&root, &["vendor"], &[]);
+    assert_ne!(code, 0, "vendored: {env:#}");
+    assert!(
+        env.to_string().contains("pypi_uv_workspace_unsupported"),
+        "vendored: {env:#}"
+    );
+    assert_eq!(tree(&root), before, "vendored wrote nothing");
+}
+
 /// A Hatch project; returns its wiring files.
 fn stage_hatch(root: &Path) -> &'static [&'static str] {
     std::fs::write(
 
@@ -30,7 +30,6 @@ use serial_test::serial;
 /// scrubs by hand.
 const PENDING_RAW_SPAWNS: &[&str] = &[
     "apply/apply_network.rs",
-    "e2e_gem.rs",
     "e2e_hosted_production.rs",
     "e2e_maven.rs",
     "e2e_redirect_cargo_shapes.rs",
@@ -39,8 +38,6 @@ const PENDING_RAW_SPAWNS: &[&str] = &[
     "e2e_vendored_production.rs",
     "e2e_vex_vendor.rs",
     "rollback/rollback_multicopy_blob_gate.rs",
-    "vendor/vendor_gem_lockfile_only_e2e.rs",
-    "vendor/vendor_rerun_no_network_e2e.rs",
 ];
 
 /// The environment `cmd`'s child would see: the parent environment with