v5: remove dead code and v3 compatibility shims

[Mikola Lysenko (mikolalysenko)]

W3 of the v5 waste-review follow-ups (#286). It removes dead code and v3/v4 compatibility shims from the CLI and core, and shares the service-fallback policy across the vendor backends. v5 is a major release, so the removed flags and env vars are listed under "Removed (BREAKING)" in CHANGELOG.md.

Base is release/v5-prerelease @ 14a9cb0, after #279, #281, #282 and #283 landed. I re-checked every finding against that head.

Findings

ID	Outcome	What changed
F21	done (socket-patch side)	Removed the v3 env fallbacks SOCKET_PATCH_PROXY_URL, SOCKET_PATCH_DEBUG and SOCKET_PATCH_TELEMETRY_DISABLED, along with promote_legacy_env_vars and its deprecation warning. Removed the hidden scan --redirect flag, the hidden no-op scan --detached flag, and the hidden --mode host/redirect/vendor values on scan and get. The hidden scan --apply and --vendor flags stay, per the WS8 owner decision. Current SOCKET_PATCH_* names are untouched (SERVER_URL, VERSION, installer vars, test knobs). Deferred: depscan workspaces/patches/src/test/integration/live/hosted-live.e2e.test.ts:571 passes --redirect and needs --mode hosted. That change is out of scope for a socket-patch PR.
F29	done	Removed get --one-off, rollback --one-off and SOCKET_ONE_OFF. They only ever returned a "not yet implemented" exit 2; the flag is now an unknown-argument error (still exit 2).
F30	done	Nothing writes .socket/packages/<uuid>.tar.gz. Dropped the read, probe and overlay paths (PatchSources::packages_path, resolve_from_archive, pkg_present) and appliedVia: "package". For one release the GC sweeps (scan --prune, rollback, remove, repair) remove any leftover .socket/packages/ whole. rollback and scan --prune still report removedPackageArchives, so their JSON shape is unchanged.
F33	done (CLI side)	Removed DepOverride::berry_zip_url; nothing read it. The berry 10c0 checksum merge stays. DepOverride has no deny_unknown_fields, so references that still carry berryZipUrl parse as before. The depscan-side storage and serving is out of scope.
F43	done	Deleted zero-caller public items: bun_lock::snapshot_binary_workspace_artifacts and BinaryWorkspaceArtifactSnapshot, bun_workspace::snapshot, vlt_lock_sniff_ok, MemoryProject::{insert_binary, insert_symlink, paths}, and DiskSnapshot::invalidate. Also ProjectView::{disk_root, read_text_sync}, which were used only by their own test. Test-only helpers moved under #[cfg(test)]. DirEntryInfo stays because it is live via ProjectView::list_dir. Not added: #[warn(unreachable_pub)], which reports 22 lib warnings across 10 files that other workstreams touch; left for a follow-up.
F48	done	Removed the module-wide #[allow(dead_code)] on vlt_lock_text and deleted the dead EdgeEntry::entry_text. find_node_dirs_sync now uses a targeted cfg_attr. vlt support is unchanged.
F32	done	Added one ServicePolicy in vendor/service_fetch.rs (hard/miss/settle) covering the Pending, Unavailable, Failed and IntegrityMismatch outcomes. It is used by cargo, composer, golang, pypi, npm tarball, npm dir and gem (step 1). Maven/nuget use it through service_archive_copy, and their behavior is unchanged (frozen per the owner decision). Warning codes, refusal codes, message text and check order are unchanged. That includes npm's "patch service request failed: …" wording in service mode, which keeps its own guard arm.
F09	partly done	is_prior_hosted_url was identical in utils/pdm_lock.rs and utils/poetry_lock.rs; it now lives once in utils/python_lock.rs. Deferred: the four check_target_guards (poetry, uv, pdm, pipenv) differ in substance and share only about 15 lines of opening. #281 did not take the Python family, so the generic guard belongs in a WS3 Python formats PR.
F25	deferred	parse_memo is still load-bearing: 22 statics with 53 live call sites. The per-package re-parse it covers is not fixed. vendor_records still calls one backend per package, and each backend re-reads and re-parses the lock. Removing it now would cost roughly N to 3N full lock parses instead of about 1 for N patched packages, and N × workspace-members manifest parses for cargo. It can go once vendoring parses through ProjectContext once per run.
F12	deferred	#281 moved pnpm grammar into formats/pnpm but did not unify the vendor/revert skeleton across npm, pnpm, pnpm-legacy, bun, yarn classic, yarn berry and vlt. That is a new trait plus driver, about 1,200 lines under heavy e2e coverage, and too large to count as contained here.

Size

git diff --shortstat 14a9cb0..HEAD: 153 files, +1502 / −3512, −2010 net.

• src/: 60 files, +798 / −1800 (−1002 net).
• tests/: 90 files, +647 / −1674 (−1027 net).

Per commit:

Commit	Files	+	−
F21	75	639	1695
F29	31	37	394
F30	17	101	267
F32	8	586	866
F33	26	2	46
F43	4	8	96
F48	3	2	10
F09	3	28	54

Tests

• cargo clippy --workspace --all-targets --all-features -- -D warnings: clean on the final head, F32 included.
• cargo test --workspace --all-features --no-fail-fast on the head before F32 (0a2bd3a): 9394 passed, 17 failed, 239 ignored.
  • 3 of the failures were integration tests that still assumed package archives are a source or survive GC. They are fixed in 882fbe9 (apply_network::apply_online_…package_archive…, covgap_commands_repair::repair_removes_orphan_archives…, remove_duality_invariants::default_remove_sweeps_archives_too).
  • The other 14 fail only because this sandbox runs as root: chmod-based write-failure tests, unremovable-lock tests, and one child-process RSS cap test. They are in files this PR does not touch and match the root-user failure set reported for the base in v5 WS4/WS6: one hosted engine for disk + memory; unified Ledgers view #282 (18 there).
• Re-run on the final head (F32 + fixes, 7483ed6): 9399 passed, 12 failed, 239 ignored. All 12 are the root-sandbox tests above (write-failure, unremovable-lock, symlink-root). The 3 package-archive tests now pass, and F32 adds no failures.
• The CI job vlt patch compatibility / install-proof (0.0.0-1) also fails on the base branch: the same 3 hosted_* rollback tests fail on v5: fix partial-stage repair bug, cut redundant downloads #292's base-merged head. See the PR comment.

Grep evidence for the removals, excluding docs/design:

• SOCKET_PATCH_(PROXY_URL|DEBUG|TELEMETRY) appears only in the removal notes in CLI_CONTRACT.md and the historical CHANGELOG.
• --redirect, --detached and --one-off appear only in the new rejection tests, a stderr negative assertion and the removal notes.
• packages_path, resolve_from_archive, AppliedVia::Package and berry_zip_url have no matches.

Review

Two adversarial reviews ran on the diff.

Correctness and regressions. It found the 3 stale tests and some doc drift above, all fixed. Checks that came back clean:

• resolve_mode_flags conflicts are intact.
• get --mode is covered.
• Env behavior on canonical names is unchanged.
• diff → blob ordering is unchanged.

Coverage and owner decisions.

• No deleted test covered live behavior that is now untested.
• None of the v5-plan owner decisions is violated: vlt and every PM version stay, the legacy redirect-state.json read stays, maven/nuget are frozen, hidden --apply/--vendor stay.

🤖 Generated with Claude Code

https://claude.ai/code/session_018JsczaHn8e6YrCpxs1NznQ

---

Note

Medium Risk
Major-release breaking CLI and JSON contract changes affect scripts still using legacy flags/env vars; apply/repair GC behavior changes how leftover package archives are handled but does not alter live patch application when blobs/diffs exist.

Overview
v5 breaking cleanup drops compatibility layers and artifact paths that nothing writes anymore, and tightens the public CLI contract docs to match.

CLI surface: Legacy env names (SOCKET_PATCH_PROXY_URL, SOCKET_PATCH_DEBUG, SOCKET_PATCH_TELEMETRY_DISABLED) are no longer read. Hidden scan --redirect, --detached, and --mode aliases host/redirect/vendor are removed (unknown flag/value → exit 2). get/rollback --one-off and SOCKET_ONE_OFF are gone. --download-mode package is rejected; patch staging and apply only use diff and blob sources. JSON appliedVia no longer includes "package".

.socket/packages/: apply, vendor, and repair stop probing or overlaying package archives. GC on scan --prune, rollback, remove, and repair deletes the whole legacy directory; rollback/prune JSON still reports removedPackageArchives for swept files.

Core: Removed unused DepOverride::berry_zip_url field usage and several uncalled public helpers (per CHANGELOG). Hosted scan docs/comments no longer reference --redirect.

^{Reviewed by Cursor Bugbot for commit 3b5cdb2. Configure here.}

[Mikola Lysenko (mikolalysenko)]

[agent] vlt patch compatibility / install-proof (ubuntu-latest, 0.0.0-1) is red on the base branch, not this PR. The failing tests are e2e_redirect_vlt_build::vlt_pinned_matrix_hosted_{crlf_lock,idempotence,rollback_byte_exact}. In each one, rollback leaves the vlt-lock node without its 4th resolved column. #292's run on a head merged with the current release/v5-prerelease (run 36486207839) fails the same three tests with the same diff, and so do #291 and #293. That run also has install-proof 0.0.0-11 and native 1.2.0 red. This PR does not touch the hosted vlt rollback path. I haven't found a fix to port yet; I'll merge the base in once one lands.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

[agent] CI / test-release failed on one test, vendor::registry_fetch::tests::stage_local_artifact_caps_oversized_artifact_before_buffering, with "peak RSS 594309120 bytes". This PR does not change registry_fetch.rs or anything stage_local_artifact calls, and the same job passed on #292's head merged with the base.

Root cause, in the test itself: on Linux, getrusage(RUSAGE_SELF).ru_maxrss in the child is not the child's own peak. std's Command spawns through posix_spawn, which uses clone(CLONE_VM|CLONE_VFORK), and at exec the kernel folds the old mm's hiwater RSS into signal->maxrss (exec_mmap → setmax_mm_hiwater_rss). That old mm is the parent test binary's, so the child reports whatever the parent peaked at. Sibling tests, including the 128 MB go_h1 bomb-cap test, can push that past the 512 MiB bound. The result depends on scheduling: it failed in one of my two local full runs and passed in the other.

Proposed fix (W2/tests territory, so I'm not adding it here): on Linux, read VmHWM from /proc/self/status instead. It is per-mm, so it resets at exec. Keep ru_maxrss for macOS. I'll re-run the job once when this CI run completes.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

[agent] CI / yarn-classic 1.9.4 (and its 1.0.2/1.6.0/1.7.0 siblings as they finish) is red on the base branch, not this PR. Every VEX cell passes; only the mode_migration_npm SUITE leg fails. #292's CI run 36486207962, on a head merged with the current release/v5-prerelease (merge ref cb40043 over 14a9cb0), fails the same leg in the same way for all four yarn-classic releases. I haven't found a fix to port yet; I'll merge the base in once one lands.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

#291 landed on release/v5-prerelease as f9cb7e1; please merge origin/release/v5-prerelease again, resolve conflicts, get green, and keep it ready.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

[agent] ready to land

Head 3b5cdb2 (merges release/v5-prerelease @ f9cb7e1, #291). All workflows have completed:

• CI: 186 jobs. Only the 4 yarn-classic jobs (1.0.2/1.6.0/1.7.0/1.9.4) fail, on the mode_migration_npm suite. That failure is on the base branch too; see the earlier comment. test-release passed on this head.
• vlt patch compatibility: 89 jobs. Only 4 install-proof jobs (0.0.0-1 and 0.0.0-11 on ubuntu, plus windows and Node 22) fail, on the same 3 hosted_* rollback tests that fail on the base branch.
• pnpm, npm, Go, Bun, Pipenv, Poetry, PDM compatibility: green.
• Local: clippy -D warnings is clean and the CI script tests pass (118) on the merged tree.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

#292 landed on release/v5-prerelease as a7b0d00; please merge origin/release/v5-prerelease again, resolve conflicts, get green, and keep it ready.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

[agent] On 156710f (the merge of #292), CI / test (windows-latest) failed in the -p socket-patch-cli --test update_notifier_e2e target. Every other test target in the job passed. Neither this PR nor #292 touches update_notifier.rs or its test (empty diff against the base). The same job passed on the previous head 3b5cdb2, and all 39 of the target's tests pass locally. The job log the API returns is cut to its last 5,000 lines, so it doesn't show which case failed. I'll re-run the failed jobs once when this CI run completes. If it fails again, I'll treat it as real and dig in.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Coordinator: not landing yet. The head 156710f (base merge of #292, pushed 05:27Z) is newer than the last [agent] ready to land comment (00:13Z, for 3b5cdb2). Once CI on 156710f has finished, including the re-run of Windows test / update_notifier_e2e, and every red check is base-inherited, please post a fresh [agent] ready to land. The branch already contains the base, it is MERGEABLE, and it has no open review threads.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

[agent] ready to land

Head 156710f merges release/v5-prerelease @ a7b0d00 (#292). The PR is mergeable and has no open review threads. Every workflow on this head has completed:

• CI: 186 jobs after the Windows re-run. The only failures are the 4 yarn-classic jobs (1.0.2/1.6.0/1.7.0/1.9.4), on the mode_migration_npm suite, which fails on the base branch too (see the earlier comment). test (windows-latest) passed on its one re-run, so the earlier update_notifier_e2e failure was a flake.
• vlt patch compatibility: only the 4 install-proof jobs fail, on the same 3 hosted_* rollback tests that fail on the base branch.
• pnpm, npm, Go, Bun, Pipenv, Poetry, PDM compatibility: green.
• Local, on the merged tree:
  • clippy -D warnings is clean.
  • The core tests for pypi, registry_fetch, api::client, vendor_prefetch, lock_inventory and service_fetch pass, except 2 tests that fail only because this sandbox runs as root.
  • The CLI lib tests pass (805), and so do the repair, rollback, apply and fetch-stage integration suites and v5: fix partial-stage repair bug, cut redundant downloads #292's new diff_created_file_e2e, except 2 more tests that fail only as root.

---

Generated by Claude Code