docs: v5 waste review and repacking design (reference)

[Mikola Lysenko (mikolalysenko)]

This PR adds the two design docs from #286 to docs/design/ as reference material. #286 is being closed without merging because its findings are now split into follow-up PRs, and this PR keeps its docs.

• docs/design/v5-waste-review.md: the 69 ranked findings, the measurements, and the dropped findings.
• docs/design/repacking-to-depscan.md: what each repo builds, and what moving the rest of repacking to depscan would take.

Both files match v5/waste-review (4e989ca) except for one added blockquote under the title. It links the triage map on #286, which names the workstream, in-flight PR or owner decision for each finding. git diff origin/v5/waste-review -- docs/design shows 8 insertions and nothing else.

The PR changes docs only: no code, tests or workflows.

🤖 Generated with Claude Code

---

Generated by Claude Code

---

Note

Low Risk
Documentation-only addition with no runtime or CI behavior changes.

Overview
Adds reference design docs under docs/design/ so material from closed PR #286 stays in-repo while follow-up work lands elsewhere.

v5-waste-review.md inventories socket-patch + depscan patch-system waste: 69 ranked findings (F01–F80), measurements, top-10 cuts, totals, and dropped findings. It points owners at the #286 triage map for workstream/PR assignment.

repacking-to-depscan.md records the chosen server-primary vendoring model (depscan produces patched bytes; CLI keeps a single local builder for PyPI wheels), contract v2 on POST …/patches/package, migration phases 0–5, and open owner questions. It cross-links the waste review for CI levers and finding IDs.

Both files are largely a copy of the v5/waste-review branch content; the only intentional delta vs that branch is the triage-map blockquote under each title. No code, tests, or workflows change.

^{Reviewed by Cursor Bugbot for commit d77c5e6. Configure here.}

[Mikola Lysenko (mikolalysenko)]

[agent] ready to land

This PR changes docs only: it adds 2 files under docs/design/, which are #286's docs plus one header line each. If coverage or test* go red, the cause is the base, not this PR. The base release/v5-prerelease has the known F77 failure (e2e_redirect_cargo_build.rs case (3)), which W0 / #288 fixes.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

[agent] CI note: test (windows-latest) is red, and the cause is the base, not this PR.

• One target fails, -p socket-patch-cli --test covgap_commands_scan_mod (job). The failing test's own output is earlier in the log than the API returns, so I could not name the exact assertion.
• Add the NuGet vendoring design (docs only) #285 also fails it. That PR is docs-only too and sits on the same base release/v5-prerelease @ 686e5fb. It fails in exactly this job and target, with ubuntu, macos, test-release and coverage green (job).
• This PR adds only two markdown files under docs/design/, so it cannot affect any Rust test. The failure is new on 686e5fb (after v5 WS1+WS2: ledger-free hosted mode, upstream-restore rollback, vendor ejects hosted projects #280) and is not the F77 case.
• No fix exists that I can port. I have flagged it on v5 fix: unblock the e2e tier on the v5 base #288 (W0, which owns unblocking the v5 base).
• I am not re-running it: two independent docs-only PRs fail identically, which makes it a deterministic failure on the base, not a flake.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

#283 landed on release/v5-prerelease as 06437d2; please merge origin/release/v5-prerelease again, resolve conflicts, get green, and keep it ready.

---

Generated by Claude Code