@@ -0,0 +1,47 @@
+[agent] 2026-10-14: pip / requirements.txt bug-hunt run
+
+**Tested:** main `313d532`; latest release v5.0.1 (npm `@socketsecurity/socket-patch@5.0.1` installed for the regression check). Main moved 19 commits since `d4af25a`; none touch requirements.txt paths (Poetry #1503, uv script #1501, Pipenv #1507, npm/yarn/bun, and CI hermetic spawns).
+
+**Setup:** real pip 26.2.1 / py3.13, pip 25.0.1 / py3.12, pip 24.0 / py3.11, pip 20.3.4 / py3.8 (uv venvs). A fresh standalone Python mock (batch, by-package, view with git-sha256 + inline blobs, blob route, package grant with sha256 + sha512 SRI, hosted wheel route) served patched copies of the real wheels for `zope.event` 5.0, `ruamel.yaml` 0.18.6, `backports.tarfile` 1.2.0 and `typing_extensions` 4.12.2 (wheel filenames with dots and underscores). It drove hosted, agent, vendored (`--vendor-url` = the mock) and vex.
+
+**Probe branches: still blocked.** `git push origin --delete bughunt/pip/20260930-hash-mode` was denied again by the session's permission layer, so I pushed no probe branch. Everything ran on Linux.
+
+## Re-triage
+
+- #977: **still fails** on `313d532` (append `  (security patch)` to the vendor comment, then `vendor --revert`: `vendor_revert_line_drifted` + `vendor_revert_kept`, exit 0, wheel kept). No new information, so no comment.
+
+## Cells (Linux)
+
+| Cell | Result |
+| --- | --- |
+| Hosted, dotted / underscored names spelled `Zope.Event`, `ruamel-yaml`, `backports_tarfile`, `Typing-Extensions`; install, vex, rollback | pass (pip-equivalent respell on rollback, documented) |
+| Hosted with extras + markers (`ruamel-yaml[jinja2]==X ; marker`, `;marker` without spaces, trailing comment, `--config-settings`) | pass; installs patched on pip 26.2.1, 25.0.1, 24.0, 20.3.4 (20.3.4 without `--config-settings`, which pip 20 lacks) |
+| Hosted pip-compile `--generate-hashes` shape (marker + `\` continuation + `# via`, two hashes, inline hash) for the four names, `--require-hashes` | pass on pip 26.2.1 / 24.0 / 20.3.4; vex attests; rollback restores installable hashed lines |
+| Agent mode, the four names (`.venv` and `VIRTUAL_ENV`), vex, rollback | pass |
+| Project path with spaces + non-ASCII (`My Proj ü 日本`): agent, rollback, hosted, vex | pass |
+| Vendored, the four names, odd spellings; install, vex, `vendor --check`, `vendor --revert` | pass (byte-identical revert) |
+| Backlog 1h: vendored requirements.txt, then `pip lock .` / `pip lock -r <original>` pylock.toml added, re-scan | **fail → #1524** (entry flips to flavor `python-lock` and keeps its `requirements_line` record; revert / remove / hosted takeover all drift-keep, revert exit 0) |
+| Both files present at the first vendored scan | pass (only pylock.toml wired, documented `pypi_multiple_lockfiles`) |
+| `pip lock -r requirements.txt` after vendoring (archive `file://…/.socket/vendor/…whl`) | revert keeps the wheel (`vendor_revert_residual_reference`), fail-safe |
+| #1050 liveness: requirements.txt pin dropped, pylock still pins, `scan --prune` | wheel kept (pass); but the stale `requirements_line` record stays (part of #1524) |
+
+## Issues
+
+- Filed #1524 (https://github.com/SocketDev/socket-patch/issues/1524). Reproduced twice on main and once on v5.0.1.
+
+## False positives ruled out / not filed
+
+- A mock whose `view` record purl (`pkg:pypi/zope.event@5.0`) spells the name differently from its `batch` purl (`pkg:pypi/zope-event@5.0`) makes a later vendored scan open a second state entry per package, and vex lists both spellings. With consistent purls (canonical or wheel-spelled) the entries merge. That's a harness artifact.
+- VEX subcomponent ids echo the server record's purl spelling (`typing_extensions`, `zope.event`) and aren't PEP 503 / purl-spec canonicalised. Whether the live API returns canonical purls isn't known here, so I didn't file it.
+- A requirements.txt still listing `socket-patch[hook]` after v5 gets no stale-hook warning (Bundler gets `gem_bundler_plugin_stale`). docs/migrating-to-v5.md documents this as manual cleanup.
+
+## Next
+
+1. #1524 follow-ups: the same co-wiring with uv `uv export --format pylock.toml` and a `-r` include pin; `vex` / `vendor --check` stay green on the mixed entry (true today).
+2. #1104 / #977 / #668 / #740 / #819 / #638 re-verify as fixes land.
+3. Windows / macOS probe once branch deletion works.
+4. Check whether the live API's PyPI record purls are canonical (VEX id spelling).
+5. pip 25.x spot-checks for vendored rewrites.
+
+---
+_Generated by [Claude Code](https://claude.ai/code)_
@@ -1,6 +1,6 @@
 [agent] Progress ledger for the scheduled pip / requirements.txt bug-hunt routine (label pm:pip).
 
-Last run: 2026-10-13 ~19:00 UTC (fortieth run), main `d4af25a`, latest release v5.0.1. No new issues. #1104 and #977 still fail; #1486 (read-only TOML lock reads) regression cells pass for hosted / vex over requirements.txt and pylock.toml. Probe branches still blocked (deletion denied again), so all cells ran on Linux. Open: #1104, #977, #819, #740, #668, #638.
+Last run: 2026-10-14 ~06:30 UTC (forty-first run), main `313d532`, latest release v5.0.1. Filed #1524 (vendored requirements.txt + a later pylock.toml co-wiring can't be reverted / removed). #977 still fails. Dotted / underscored names (`zope.event`, `ruamel.yaml`, `backports.tarfile`, `typing_extensions`) pass in hosted, agent and vendored, and so do unicode / space paths. Probe branches are still blocked (deletion denied). Open: #1524, #1104, #977, #819, #740, #668, #638.
 ## Coverage matrix
 
 | OS | pip / Python | agent (.venv) | agent egg-info | hosted (unhashed → fragment pin) | vendored | rollback / remove | vendored → hosted takeover | system-site venv | `-r` include, lock-only | PEP 440-equivalent pin (`==1.16`) | global `-g` (`--user`) | lock-only spaced pin (`six == X`) | hosted foreign direct ref (`six @ mirror`) | lock-only PEP 440-equivalent pin (`==1.16`) | no root requirements.txt (`--json`) | hosted → vendored takeover (`vendor`) | `vendor --dry-run` over hosted | `get --mode vendored` over hosted | vendored → hosted, include / transitive pin | UTF-16 requirements.txt (hosted / lock-only) | root file used as `-c` by a sibling | vendored re-vendor to a new uuid | vendored pin removed / bumped (`--prune`) | `pip lock` pylock.toml (hosted / vendored) | agent same-size patch vs `__pycache__` | agent rollback of a patch-added file in a new dir | socket.yml package specs (PyPI spelling) | hosted superseding re-pin (A → B) | `--max-new-patches` (hosted) | `get <name>` PyPI spelling | `--max-new-patches` (vendored) | vendored supersede under cap 0 (hashed include / CRLF marker) | vendored line comment edited, then revert | quoted / `${VAR}` `-r` include (lock-only) | option before `-r` on one line (lock-only) | hosted root pin + duplicate pin in `-r` include (vex / rollback) | PEP 263 coding-line (latin-1) requirements.txt, lock-only | `apply --check` (agent, #1029) | vendored `scan --prune` liveness (#1050) | hosted / vendored file regenerated by `pip freeze` | hashed hosted root + hashed `-r` include (`--require-hashes`) | dangling `\` continuation at EOF (lock-only) | lock-only bare-CR / FF / NEL / U+2028 line breaks |
@@ -13,6 +13,8 @@ Last run: 2026-10-13 ~19:00 UTC (fortieth run), main `d4af25a`, latest release v
 
 pip 20.3.4 on py3.13 is blocked (no `distutils`). `setup` was removed in v5, so the old setup column (#377, #378) is retired; both issues are closed.
 
+Run forty-one (2026-10-14, pip 26.2.1 / py3.13, 25.0.1 / py3.12, 24.0 / py3.11, 20.3.4 / py3.8, main `313d532`): dotted / underscored PyPI names with odd spellings pass hosted (plain, extras + markers, pip-compile hashed shapes under `--require-hashes`), agent and vendored (byte-identical revert), with vex and rollback; a unicode + space project path passes agent / hosted. Backlog 1h found #1524: a vendored requirements.txt plus a later `pip lock .` pylock.toml leaves a mixed `python-lock` entry that revert / remove / hosted takeover can't unwind.
+
 Run forty (2026-10-13 evening, pip 26.2.1 / py3.13, 24.0 / py3.11, 20.3.4 / py3.8, virtualenv 21.4.3 over Debian py3.11, main `d4af25a`): #1486 regression pass (hosted hashed continuation and `pip lock` pylock.toml, install patched, vex attests); pyproject + `uv.lock` + `uv export` requirements.txt vendored pass (all three wired once, `uv sync --locked` and `pip install --require-hashes` patched, byte-identical revert; backlog 3k done); virtualenv-made system-site venv hosted pass (stale warning names the Debian dir, vex omits); `--group` hosted = #638 class; sha512-hashed continuation hosted pass, rollback restores the PyPI sha256 form (installs). #1104 / #977 still fail.
 
 Run thirty-nine (2026-10-13, pip 26.2.1 / py3.13, 24.0 / py3.11 (Debian), 20.3.4 / py3.8 (uv-managed base), pip-tools on 26.2.1, main `15c2c83`): #409 verified fixed: hosted over a system-site venv now warns `redirect_pypi_stale_install` and `vex` omits (`not_applied`) for a base copy in Debian `/usr/lib/python3/dist-packages`, in `PYTHONUSERBASE`, and in a uv-managed base `site-packages` (stdlib venv and `uv venv --system-site-packages`); after `pip install --force-reinstall` the venv copy shadows and `vex` attests. Agent mode over a system-site venv now patches the base copy (root: apply + rollback byte-identical; non-root: `apply_failed` Permission denied, exit 1, vex omits). #1437 verified for pip: a vendor ledger beside a hosted pin is `mode_ambiguous` (exit 2, nothing written) for plain, CRLF, BOM, hashed continuation, marker, comment, `Six`, extras, a `-r` include, `pylock.toml` and `pylock.dev.toml`, on `scan` and bare `get` (name, purl, uuid). Hosted supersede A → B over a pip-compile `--generate-hashes` file passes (`--require-hashes` install, vex names B), and rollback restores the original two-hash block byte for byte.
@@ -48,7 +50,7 @@ Commands covered on Linux: scan (all modes), get (hosted, agent `-g`), rollback,
 1. Re-verify #1104, #977, #819, #740, #668 and #638 as fixes land (#409 verified fixed on Linux 2026-10-13; macOS / Windows re-verify needs a probe). #1104 / #668 weren't re-checked on run 39 (no vendoring-service mock this run). Verify the merged fixes for #410, #926, #910 and #928 with real pip. #328 / #475 re-verify on pip 20.3.4 / 26.x is still open; #765 on pip 20.3.4. #328 / #475 re-verify on pip 20.3.4 / 26.x is still open.
 1b. #819 on `-g` / `--user` site-packages. (The rollback variant is in the #819 body; the pip-lock variants were done 2026-10-05; the new-file case became #838.)
 1g. done 2026-10-08: a hashed include beside a hashed hosted root under `--require-hashes` passes on pip 26.2.1 and 20.3.4.
-1h. #1050 liveness: a pylock.toml / uv.lock beside a vendored requirements.txt (contest vs keep), and a vendored line moved into a `-c` constraints file.
+1h. done 2026-10-14: a pylock.toml added beside a vendored requirements.txt is #1524 (mixed-flavor entry can't be reverted). Still open: a uv.lock / `uv export --format pylock.toml` in the same role, and a vendored line moved into a `-c` constraints file.
 1i. #1039 crash cells done on 2026-10-12 (they recover, with an orphan unit left). Still open: a Windows backslash vendored path vs the residual probe's forward-slash needle.
 1f. #984 follow-up: `cp311-none-any` grants stay redirectable by design. Check pip 3.12 against such a hosted pin, and a build-tag wheel name in `wheel_platform_from_filename`.
 1e. #994 follow-ups: done 2026-10-08. A quoted include's pin is vendored in place (no root `(transitive)` line), and `vex` and prune see it.
@@ -64,6 +66,10 @@ Commands covered on Linux: scan (all modes), get (hosted, agent `-g`), rollback,
 
 ## Known non-bugs
 
+- A mock whose `view` record purl spells a PyPI name differently from its `batch` purl (`zope.event` vs `zope-event`) splits the vendored ledger into two entries per package on a later scan; consistent purls merge. Harness artifact (2026-10-14).
+- VEX subcomponent ids echo the patch record's purl spelling (not PEP 503-canonicalised); unverified against the live API, so not filed (2026-10-14).
+- A requirements.txt still listing `socket-patch[hook]` after v5 gets no stale-hook warning; docs/migrating-to-v5.md documents manual cleanup (2026-10-14).
+
 - A vendored plain-pip project over a base-interpreter copy (system-site venv) gets no scan-time stale warning, and `pip install -r` keeps the base copy ("already installed with the same version"); vex warns `vendored_tree_out_of_sync`. Same class as the documented plain-venv case (2026-10-13).
 - Hosted rollback of a `pip hash -a sha512` continuation restores `six==1.16.0` with PyPI's sha256 hashes on one line; `--require-hashes` installs it. That's the documented pip-equivalent restore (2026-10-13).