@@ -0,0 +1,5 @@
+[agent] 2026-10-02: handover from the vlt bug-hunt routine (ledger #307)
+
+#601 (https://github.com/SocketDev/socket-patch/issues/601) also reproduces on **pnpm 10.28.0** (Linux, main `b1f9818`). Setup: the project depends on `left-pad@1.3.0` and on `bundler@1.0.0`, which bundles `left-pad@1.3.0`. `scan --mode agent` patches `node_modules/.pnpm/left-pad@1.3.0/node_modules/left-pad` but leaves `node_modules/.pnpm/bundler@1.0.0/node_modules/bundler/node_modules/left-pad` pristine. `vex` exits 0 with not_affected.
+
+Suspect: `npm_crawler.rs:1235`. `find_by_purls` runs the unfiltered pass 2 only for targets pass 1 didn't find. Please add pnpm cells, other pnpm majors or OSes, as a comment on #601 rather than a new issue.
@@ -0,0 +1,33 @@
+[agent] 2026-10-02: vlt bug-hunt run
+
+**Tested:** main `b1f9818` (34 commits since run 8, including #472 / #499 / #543 / #442 / #486 / #517). Latest release is still 4.0.0. There's no new vlt release (newest is 1.3.5). Linux sandbox, Node 22.22.0. vlt `ci` in the sandbox needs `--allow-scripts :scripts`; without it the security-data fetch to api.socket.dev returns 403 (a known sandbox artifact, see #448).
+
+### Re-triage
+- #521: still reproduces on vlt 1.2.0 / 1.3.5. A non-conventional `dist.tarball` comes back as `/<name>/-/<name>-<ver>.tgz` after rollback. https://github.com/SocketDev/socket-patch/issues/521#issuecomment-5960224136
+- #372: still reproduces on vlt 1.3.5. The flag-4 `tar.br` node isn't redirected, and the scan exits 0 with the lock untouched. https://github.com/SocketDev/socket-patch/issues/372#issuecomment-5960224940
+- #471 (closed by #472): verified on 1.2.0 / 1.3.5. Hosted and vendored warn `*_bundled_instance_skipped`, and `vex` refuses (hosted rc 2, vendored rc 1). **pass**.
+- #541 (closed by #543): verified on 1.2.0 / 1.3.5, twice each. After the bump, rescan / `--prune` / rescan give rc 0 / 0 / 0 and the vendor dir is empty. **pass**.
+
+### Cells (Linux)
+- Run-2 probe matrix (22 checks) on **1.0.10 / 1.2.0 / 1.3.5**: **pass**, twice for 1.0.10 / 1.2.0.
+- **Named catalogs** (`vlt.json` `catalogs.sec`, two workspace members on `catalog:sec`), hosted / vendored on 1.2.0 / 1.3.5: scan, `--frozen-lockfile` stable, `ci` patched in both members, vex, rollback byte-exact on all 5 files: **pass**. Agent: scan / rollback: pass.
+- **Agent mode with a bundled copy plus a normal install of the same name@version: FAIL #601** on 1.0.10 / 1.2.0 / 1.3.5 (and on pnpm 10.28.0). Only the `~npm~left-pad@1.3.0` copy gets patched. The copy under `~npm~bundler@1.0.0/node_modules/bundler/node_modules/left-pad` stays pristine, apply exits 0 (`already_patched`), and `vex` says not_affected. With a bundled-only install it passes.
+
+### Issues
+- Filed #601: https://github.com/SocketDev/socket-patch/issues/601
+- Commented on #521 and #372.
+- Handed over to pnpm (`entries/pnpm/*-from-vlt.md`): #601 also reproduces on pnpm 10.28.0.
+
+### False positives ruled out
+- `hosted.ci` failing on 1.0.10 / 1.2.0 came from vlt's security-data fetch (403 `host_not_allowed`), not from socket-patch. It passes with `--allow-scripts :scripts`.
+- Agent-mode `require` reading pristine after `rm -rf node_modules && vlt ci` is expected: a reinstall replaces agent patches.
+
+### Infra
+- No probe branches this run, since branch deletion is still denied. The 3 old `bughunt/vlt/*` branches still need a maintainer to delete them.
+
+### Next
+1. #601 on macOS / Windows and with a bundled copy at a different version; re-test once it's fixed.
+2. #521 / #372 re-tests once fixes land; #521 on the 3-tuple (`config.registry`) project.
+3. #498 fix (#499) verification with the npm global prefix plus a vlt project, and #434 (fixed by #442) on Windows.
+4. The vlt 1.3.4 tarball-cache integrity changes: a warm cache holding pristine bytes at a re-used patch URL.
+5. Vendored `vlt update` after a catalog bump.
@@ -1,6 +1,6 @@
 [agent] Progress ledger for the scheduled vlt bug-hunt routine (label pm:vlt).
 
-Last updated: 2026-10-02 (run 8), main `61cfb9b`, latest release 4.0.0 (no vlt support; previous 3.3.0). Newest vlt: 1.3.5 (2026-10-02; 1.3.4 on 2026-10-01). Locally, run `vlt ci --allow-scripts :scripts` (otherwise vlt ≥ rc.24 POSTs to api.socket.dev; see #448).
+Last updated: 2026-10-02 (run 9), main `b1f9818`, latest release 4.0.0 (no vlt support; previous 3.3.0). Newest vlt: 1.3.5 (2026-10-02; 1.3.4 on 2026-10-01). Locally, run `vlt ci --allow-scripts :scripts` (otherwise vlt POSTs to api.socket.dev and the sandbox's 403 fails `ci` on 1.0.10 / 1.2.0; see #448). Run 9 mock adds `left-pad@1.2.0` (`'old'`) for bump tests.
 
 Method: real vlt installs (`scripts/install-vlt.sh`) against a local Node mock of the npm registry plus the patch API. It's a pure-JS tar writer, so it runs on every OS. The registry is on :18555 and the patch server on :18556 via `SOCKET_PATCH_SERVER_URL`; set `SOCKET_NPM_REGISTRY` to the registry for v5 rollback. The oracle is `require('left-pad')` printing `patched` / `pristine`. The 3-OS probe scripts are in the run-2 workflow (run 36803186961), the run-3 global-mode workflow (run 36834317384) and the run-4 bundled-copy workflow (run 36871535059, whose mock adds a `bundler@1.0.0` that bundles left-pad). Run 6 mock adds `PKG=` (scoped names) and `CDN=1` (non-conventional `dist.tarball`); the patch artifact leaf must be the unscoped basename. The mock's `/patches/batch` must answer only for purls in the request body, or `scan -g` shows false hits. CI already runs the capstones and the native backtest on 57 releases × 3 OS.
 
@@ -18,37 +18,37 @@ Method: real vlt installs (`scripts/install-vlt.sh`) against a local Node mock o
 | macOS | 1.2.0 / 1.3.2 | pass (probe run 2) | pass (probe run 2) | pass (probe run 2) | brotli untested |
 | Windows | 1.2.0 / 1.3.2 | pass (probe run 2) | pass (probe run 2) | pass (probe run 2) | brotli untested |
 | Linux / macOS / Windows | 1.3.3 | scan → `vlt ci` patched (probe run 3); peer-extra DepID across workspaces, alias / remote / file mix: pass (Linux, run 5); fail #372 with `tar.br` (Linux) | scan → `vlt ci` patched (probe run 3); frozen / vex / workspaces untested | pass (Linux, run 5: peer-extra store, workspaces, rollback, re-run) | new release, 2026-10-01 |
-| Linux | 1.3.4 / 1.3.5 | pass (run-2 matrix; dev / optional flags; multi-instance `~peer.<hex>` ×2; lock mutation between scan and rollback); fail #372 with `tar.br` | pass (run-2 matrix, frozen, vex, dev / optional); **fail #541** after the target is bumped or uninstalled (also 1.0.10 / 1.2.0 / 1.3.3) | pass (incl. multi-instance peer store) | new releases |
+| Linux | 1.3.4 / 1.3.5 | pass (run-2 matrix; dev / optional flags; multi-instance `~peer.<hex>` ×2; lock mutation between scan and rollback); fail #372 with `tar.br` | pass (run-2 matrix, frozen, vex, dev / optional); bump / uninstall after scan: pass on main `b1f9818` (#541 fixed by #543, verified 1.2.0 / 1.3.5) | pass (incl. multi-instance peer store) | new releases |
 | Linux | 1.0.10 / 1.2.0 / 1.3.3 | non-conventional `dist.tarball` rollback / remove: **fail #521** (run 6); scoped target scan / vex: pass (1.3.3) | scoped target: pass (1.3.3) | scoped target via store symlink: pass (1.3.3) | concurrent scans / SIGKILL mid-run: pass (1.3.3) |
 | Linux | 1.0.0-rc.34 / 1.0.5 / 1.1.1 / 1.3.0 | pass (run-8 probe matrix; 1.3.0 without `tar.br`) | pass (run-8 probe matrix) | pass (run-8) | first local runs of these versions |
-| Linux | 1.3.5 | prerelease target, object-form workspace groups, `catalog:` specs, peer-shape `list` / `remove`: pass (run 8) | prerelease, object workspaces, `catalog:`, peer-shape takeover refusal: pass; #541 is fixed by PR #543 (verified on 1.2.0 / 1.3.5) | prerelease, object workspaces, `catalog:`: pass | |
+| Linux | 1.3.5 | prerelease target, object-form workspace groups, `catalog:` specs, peer-shape `list` / `remove`: pass (run 8) | prerelease, object workspaces, `catalog:`, peer-shape takeover refusal: pass; named catalogs `catalog:<name>` in workspaces: pass (run 9, also 1.2.0) | prerelease, object workspaces, `catalog:`: pass | |
 
 ### Bundled copies (a package bundling the patched name@version; vlt-lock.json never records the bundled copy)
 
 | OS | vlt 1.0.10 | vlt 1.2.0 | vlt 1.3.3 |
 | --- | --- | --- | --- |
-| Linux / macOS / Windows | **fail #471** (hosted + vendored: vex attests, bundled copy pristine) | **fail #471** | **fail #471** |
+| Linux / macOS / Windows | hosted + vendored: **fail #471** before #472. Linux on main `b1f9818`: pass (skip warning, vex refuses) | same as 1.0.10 | same as 1.0.10 (1.3.5 also passes on Linux) |
+| Linux (agent: bundled copy plus a normal install of the same name@version) | **fail #601** | **fail #601** | **fail #601** (1.3.5 too; pnpm 10.28 too). Bundled-only: pass |
 
 ### Global mode (`-g`; vlt has no global install, so this is an npm global prefix with a vlt project in the cwd)
 
 | OS | vlt | `scan -g` report | `-g` / `SOCKET_GLOBAL` / `--global-prefix` × `--mode hosted` refusal | agent apply / vex / rollback (`-g`, `get -g`, env) | `--global-prefix` with space + unicode | unwritable prefix | `rollback -g` / `remove -g` leave the project alone | `vendor -g` / `vendor --revert -g` leave the project alone |
 | --- | --- | --- | --- | --- | --- | --- | --- | --- |
-| Linux | 1.0.10 / 1.2.0 / 1.3.3 | pass | pass | pass | pass | pass (scan); `get` re-run → npm handover | pass (#446; with a hosted project too, run 5) | **fail #498** |
+| Linux | 1.0.10 / 1.2.0 / 1.3.3 | pass | pass | pass | pass | pass (scan); `get` re-run → npm handover | pass (#446; with a hosted project too, run 5) | **fail #498** (closed by #499, re-test pending) |
 | macOS | 1.0.10 / 1.2.0 / 1.3.3 | pass | pass | pass | pass | pass (scan) | untested since #446 | untested |
 | Windows | 1.0.10 / 1.2.0 / 1.3.3 | fail #434 (default prefix) | pass | fail #434 (default prefix) | pass | untested | untested since #446 | untested |
 
 ## Backlog
 
-1. #541: re-test once PR #543 merges (it's verified on Linux vlt 1.2.0 / 1.3.5), and run it on macOS / Windows (also standalone `vendor` and `repair` after a bump).
-2. #521 follow-ups: macOS / Windows, the 3-tuple (`config.registry`) project, and the hosted→vendored takeover with a non-conventional tarball.
-3. **Maintainer `-g` request** (20261001T040000Z): covered except Windows with the default prefix (#434 / PR #442), the Windows unwritable prefix, and the macOS / Windows re-check of `rollback -g` after #446.
-4. #498 on macOS / Windows, and a re-test once PR #499 lands.
-5. #471 follow-ups once PR #472 lands: a bundled copy at a different version, a nested bundle, and agent mode on the bundled store copy.
-6. #372 follow-ups once fixed: a mixed brotli / non-brotli lock, a brotli dev node (flag 6) heal, the restore putting bit 4 back, and VEX on brotli nodes.
-7. Named catalogs (`catalog:<name>`) in workspaces, and vendored + `vlt update` after a catalog bump.
-8. The vlt 1.3.4 tarball-cache integrity changes: a warm cache with pristine bytes at a re-used patch URL.
-9. vlt 1.3.5 frozen / workspaces / catalog cells on macOS and Windows.
-10. Probe branches are blocked: branch deletion is denied, and 3 old `bughunt/vlt/*` branches still need a maintainer to delete them.
+1. #601 on macOS / Windows, with a bundled copy at a different version and a nested bundle; re-test once it's fixed.
+2. #521 follow-ups: re-test once fixed, macOS / Windows, the 3-tuple (`config.registry`) project, and the hosted→vendored takeover with a non-conventional tarball.
+3. #498 (closed by #499) and #434 (closed by #442): re-test `vendor -g` / `vendor --revert -g`, and Windows with the default prefix. The rest of the **maintainer `-g` request** (20261001T040000Z): the Windows unwritable prefix, and the macOS / Windows re-check of `rollback -g` after #446.
+4. #372 follow-ups once fixed: a mixed brotli / non-brotli lock, a brotli dev node (flag 6) heal, the restore putting bit 4 back, and VEX on brotli nodes.
+5. Vendored + `vlt update` after a catalog bump.
+6. The vlt 1.3.4 tarball-cache integrity changes: a warm cache with pristine bytes at a re-used patch URL.
+7. vlt 1.3.5 frozen / workspaces / catalog cells on macOS and Windows.
+8. Perf: #579 (vlt/hosted wall +127% after #472) isn't a bughunt issue; just watch it.
+9. Probe branches are blocked: branch deletion is denied, and 3 old `bughunt/vlt/*` branches still need a maintainer to delete them.
 
 ## Known non-bugs
 
@@ -75,3 +75,5 @@ Method: real vlt installs (`scripts/install-vlt.sh`) against a local Node mock o
 - `vex` exits 1 after the vendored target was bumped away: nothing patched is installed, so that's correct.
 - A hosted scan deletes the stale installed store copies, including every `~peer.<hex>` instance, so `require` fails until `vlt install` / `vlt ci`. That's documented, and the scan prints a warning.
 - vlt 1.0.0-rc.14 full-probe rollback mismatches against the mock because rc.14 resolves left-pad from public npmjs. That's a mock artifact.
+- vlt `ci` / `install` with a cold machine cache fails "Failed to fetch security data" (403 `host_not_allowed` to api.socket.dev) in the sandbox. That's a sandbox artifact; use `--allow-scripts :scripts`.
+- Agent-mode patches disappear after `rm -rf node_modules && vlt ci`. That's expected: a reinstall replaces agent edits.