@@ -0,0 +1,34 @@
+[agent] 2026-10-14: uv bug-hunt run
+
+**Tested:** main `306ec81`. The latest release is **v5.0.1**. Since run 40, main gained #1504 (fixes #1501), #1525 (retires the bare `==` manifest overrides of uv < 0.5.6), #1526 (fixes #1524: mixed-flavor PyPI vendor revert), #1529 (pyproject product detection) and non-uv fixes. I used uv 0.5.31, 0.8.17 and 0.13.0 on Linux against the probe-branch mock (six 1.16.0 patch), plus the v5.0.1 and v4.0.0 release binaries.
+
+## Re-triage
+- **#1501** (closed by #1504, janitor drift fixed): verified. A script in `a/sub/` under `no-sources = true` in the parent `uv.toml`, in the grandparent `uv.toml`, or in a grandparent `uv.toml` with a `[tool.uv]`-less `a/pyproject.toml` in between is refused in both modes with nothing written (hosted `redirect_uv_script_unsupported`, vendored `pypi_uv_no_sources`; uv 0.13.0 and 0.5.31). The control without a config wires it and `uv run` prints patched.
+- **#1445** (closed by #1453): ledger drift fixed (verified in run 39).
+- **#1105 / #639**: no fix PR yet (#1130 is the open design question), so I didn't re-run them.
+
+## Cells
+| Cell | Result |
+| --- | --- |
+| Project with no `[tool.uv]` under a parent `uv.toml` (`exclude-newer`) × hosted / vendored × 0.5.31 / 0.8.17 / 0.13.0 | **fail → #1545** |
+| Same, with the parent `pyproject [tool.uv]` | **fail → #1545** |
+| Same, with the parent `uv.toml` `resolution = "lowest-direct"` (no `exclude-newer`) | **fail → #1545** |
+| Control: no parent config | pass (`--locked` green, patched) |
+| #1545 on the v5.0.1 release binary | fail (v4.0.0 didn't wire this fixture against the mock, so no comparison) |
+| Vendored rollback after #1545 | pass (both files restored, `--locked` green) |
+| #1501 neighbours: parent / grandparent / pyproject without `[tool.uv]` in between × hosted / vendored | pass |
+| macOS / Windows probe | **blocked**: branch deletion is still denied (run 40), so I pushed no probe |
+
+## Issues
+- New: **#1545**: https://github.com/SocketDev/socket-patch/issues/1545 (a project's new `[tool.uv]` table hides the parent `uv.toml` / `[tool.uv]` from uv).
+- Commented: none. Closed: none.
+
+## False positives ruled out
+- Hosted rollback refuses `hosted_restore_refused` in the one-package fixture (`exclude-newer` in `[options]`, or no sibling registry package). Both are documented restore limits (uv.rs module docs), with or without the parent config. Added to Known non-bugs.
+- The rollback `--json` file failed to parse at first because I'd redirected stderr into it (the token warning). Not a CLI bug.
+
+## Next
+1. Re-triage #1545 once a fix lands. Neighbours: a parent `[[index]]` / `index-url`, parent constraints / overrides, a project with an unrelated `[tool.uv]` already (must pass), a workspace root under a parent config.
+2. #1529: a BOM'd pyproject on a uv project now yields no VEX product. Check the error is clear.
+3. #1525: the #1445 orphan unwind on uv 0.4.30 / 0.5.3, and that a user's own unmarked override is kept.
+4. Re-triage #1105 / #639 / #891 when fix PRs appear; macOS / Windows probes once branch cleanup works.