Vendored Maven and Gradle: design and prototype

.gitattributes

@@ -22,3 +22,7 @@ crates/socket-patch-core/tests/fixtures/vendor/** -text
 # compares the result byte for byte, so a CRLF checkout would change both
 # the replayed wiring files and the expected revert.
 crates/socket-patch-cli/tests/fixtures/legacy-ledgers/** -text
+
+# The owned Gradle settings script is embedded with include_str! and
+# written into user repos byte for byte; a CRLF checkout would change it.
+crates/socket-patch-core/src/vendor/jvm/socket-patch.settings.gradle -text

crates/socket-patch-cli/src/commands/vendor.rs

@@ -167,11 +167,13 @@ pub(crate) async fn dispatch_vendor_one(
     }
     // Maven and NuGet have no registry-fetch rung — `fetch_and_stage` serves
     // no fetcher for either and `stage_local_artifact` is npm-only — so their
-    // source is always the crawler's own directory.
+    // source is the crawler's own directory. A ledger-driven maven re-run on
+    // a cold cache gets a deferred hint instead: the committed tree answers
+    // an in-sync re-run, and anything else refuses for the missing jar.
     macro_rules! vend_installed {
         ($backend:path) => {{
             debug_assert!(
-                matches!(pkg_path, PackageSource::Installed(_)),
+                eco == "maven" || matches!(pkg_path, PackageSource::Installed(_)),
                 "{eco} has no fetch rung; a pending source would need materialising"
             );
             $backend(
@@ -1077,6 +1079,32 @@ async fn sweep_stale_artifact(
     stale: StaleArtifact,
 ) {
     let StaleArtifact { candidate, prev } = stale;
+    // A JVM tree is not a uuid dir: the replaced entry's own tree files go,
+    // minus any path a live entry records (a Gradle update rewrites them).
+    if vendor::jvm::apply::is_jvm_entry(&prev) {
+        let removed = if common.dry_run {
+            Ok(false)
+        } else {
+            vendor::jvm::apply::sweep_replaced_tree(&common.cwd, &prev, state.entries.values())
+                .await
+        };
+        match removed {
+            Ok(true) => env.record(
+                PatchEvent::new(PatchAction::Removed, candidate).with_reason(
+                    "vendor_stale_artifact_removed",
+                    "previous patch uuid's vendored artifact removed",
+                ),
+            ),
+            Ok(false) => {}
+            Err(detail) => record_warning(
+                env,
+                &candidate,
+                &VendorWarning::new("vendor_stale_artifact_kept", detail),
+                common,
+            ),
+        }
+        return;
+    }
     let still_referenced = state
         .entries
         .values()

crates/socket-patch-cli/tests/covgap_commands_rollback.rs

@@ -149,7 +149,10 @@ struct PatchedFixture {
     purl: &'static str,
     before: &'static [u8],
     after: &'static [u8],
+    // Read only by the macOS-gated manifest-write-failure test.
+    #[cfg_attr(not(target_os = "macos"), allow(dead_code))]
     before_hash: String,
+    #[cfg_attr(not(target_os = "macos"), allow(dead_code))]
     after_hash: String,
 }