From e4ee6952a46aaa35eb214f2713adb9e17f7e91e9 Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Thu, 24 Sep 2026 13:54:20 -0400
Subject: [PATCH 01/13] feat(vendor): wire cargo patches through Cargo.toml
 [patch]

Vendored cargo patches are now wired through a Socket-owned
[patch.crates-io] key in the workspace-root Cargo.toml instead of
.cargo/config, so the patch uuid is visible from the manifest alone.
Legacy config wiring is migrated on re-run, repair and uuid bumps.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/ci.yml                      |   33 +
 CHANGELOG.md                                  |   46 +-
 README.md                                     |    2 +-
 crates/socket-patch-cli/CLI_CONTRACT.md       |   33 +-
 .../src/commands/repair_vendor.rs             |   49 +
 .../src/commands/scan/hosted.rs               |   29 +-
 .../socket-patch-cli/src/commands/vendor.rs   |    3 +-
 .../tests/covgap_commands_scan_hosted.rs      |  121 +-
 .../tests/e2e_vendor_cargo_build.rs           |  971 +++++++-
 .../tests/e2e_vex_lockfile/cargo.rs           |  158 +-
 .../socket-patch-cli/tests/e2e_vex_vendor.rs  |   38 +-
 .../tests/mode_migration_cargo.rs             |   26 +-
 crates/socket-patch-core/src/vendor/cargo.rs  | 2218 ++++++++++++++---
 .../src/vendor/cargo_config.rs                |  302 ++-
 .../src/vendor/cargo_manifest.rs              | 1220 +++++++++
 .../src/vendor/lock_inventory/mod.rs          |    5 +-
 crates/socket-patch-core/src/vendor/mod.rs    |    3 +-
 crates/socket-patch-core/src/vendor/state.rs  |   63 +
 .../src/vex/discover/cargo.rs                 |  254 +-
 docs/ecosystems.md                            |   65 +-
 20 files changed, 5064 insertions(+), 575 deletions(-)
 create mode 100644 crates/socket-patch-core/src/vendor/cargo_manifest.rs

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3d6155e7..8d2396f2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1458,6 +1458,39 @@ jobs:
           cargo test -p socket-patch-cli --test e2e_redirect_cargo_build --test e2e_vendor_cargo_build --test mode_migration_cargo
           cargo test -p socket-patch-cli --test e2e_safety_cargo_build -- --ignored
 
+  # Manifest `[patch]` (the v5 vendored cargo wiring) on toolchains older
+  # than the 1.56 floor of config-file `[patch]`. The old-toolchain tests
+  # skip when none is installed; this leg installs two and requires them.
+  cargo-old-toolchains:
+    name: cargo old toolchains (manifest [patch])
+    needs: test
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Install Rust
+        run: rustup show
+      - name: Install the old cargos under test
+        run: |
+          rustup toolchain install 1.41.0 --profile minimal
+          rustup toolchain install 1.56.0 --profile minimal
+      - name: Cache cargo
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        with:
+          key: cargo-old-toolchains
+          save-if: ${{ github.ref == 'refs/heads/main' }}
+      - name: Vendored manifest [patch] on old cargo
+        shell: bash
+        env:
+          SOCKET_PATCH_CARGO_E2E_REQUIRED: '1'
+          SOCKET_PATCH_CARGO_OLD_TOOLCHAINS_REQUIRED: '1'
+        run: |
+          set -euo pipefail
+          cargo test -p socket-patch-cli --test e2e_vendor_cargo_build -- old_toolchain --nocapture
+
   # ----------------------------------------------------------------------
   # Experimental `setup`-flow matrix (NON-BLOCKING).
   #
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8540e431..b6c72a76 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,13 +19,57 @@ into the new version's section — see docs/releasing.md.
 
 > **Semver note:** this entry changes `rollback`'s default behavior, narrows
 > the meaning of its existing `vendored: []` JSON key, makes vendored mode
-> manifest-free, turns a plain non-TTY `scan` report-only, and makes `vex`
+> manifest-free, moves vendored cargo wiring from `.cargo/config*` into
+> `Cargo.toml`, turns a plain non-TTY `scan` report-only, and makes `vex`
 > refuse to attest stale ledger records and corrupt vendor ledgers — all
 > MAJOR per CLI_CONTRACT.md's semver policy — so it ships as the next major
 > release (v5.0).
 
 ### Changed (BREAKING)
 
+- **Vendored cargo wiring moved to `Cargo.toml`.** `vendor` / `scan` /
+  `get --mode vendored` write the `[patch.crates-io]` path entry into the
+  workspace-root `Cargo.toml` (beside the `Cargo.lock` it detaches) instead
+  of `.cargo/config.toml` / `.cargo/config`, so Socket scanners can recover
+  the patch uuid from the manifest alone and single-version wiring builds
+  on cargo older than 1.56 (the floor of config-file `[patch]`); two
+  vendored versions of one crate additionally need `--offline` (or a
+  reachable registry index) on such old cargo. The edit is
+  format-preserving (comments, ordering, CRLF / mixed line endings, a
+  UTF-8 BOM and the trailing-newline state survive; a revert restores the
+  manifest byte for byte and keeps a user's own `[patch]` /
+  `[patch.crates-io]` headers). The key is always the Socket-owned
+  `<name>-socket-<uuid8>` with `package = "<name>"`, never the bare crate
+  name: cargo lets a config-file `[patch]` item (project, ancestor
+  directory or `$CARGO_HOME`) replace the manifest item with the same key
+  whatever its version, so a crate-named key could be silently shadowed —
+  and two vendored versions of one crate get distinct keys instead of
+  clobbering each other (the config wiring keyed by crate name let the
+  second overwrite the first). The ledger's `cargo_patch_entry` record now
+  names `Cargo.toml` (its `key` is the TOML key). New refusals, each before
+  any write: `cargo_manifest_unreadable`, `cargo_manifest_unparseable`,
+  `cargo_manifest_symlink_unsupported` (vendor and revert),
+  `cargo_manifest_not_workspace_root` (run from a workspace member, whose
+  `[patch]` cargo ignores) and `cargo_manifest_patch_source_alias` (the
+  manifest spells crates.io by URL in `[patch."https://github.com/rust-lang/crates.io-index"]`,
+  which replaces `[patch.crates-io]` wholesale);
+  `user_authored_patch_entry` now covers user entries in `Cargo.toml` and
+  in every cargo config file cargo merges (project, ancestors,
+  `$CARGO_HOME`) and matches by crate (`package` or key), sparing a path
+  patch that is provably another version. **Old wiring migrates
+  automatically**: a re-run or `repair` moves a Socket-owned
+  `.cargo/config*` entry into `Cargo.toml` (`cargo_wiring_migrated` note; a
+  migrating vendor re-run reports the package `applied`) and cleans a
+  config file / `.cargo/` the move emptied — a legacy entry that cannot be
+  removed fails the run and unwinds it (`cargo_legacy_wiring_kept`) — while
+  `rollback` / `remove` / `vendor --revert` / GC / hosted takeover remove
+  both spellings. Projects hit by the pre-v5 multi-version overwrite (a
+  detached lock entry nothing wired) are healed by a re-run or `repair`
+  (`cargo_wiring_restored`). User config entries are never touched. VEX
+  discovery reads the manifest first (key-agnostic), skips a manifest entry
+  that cargo ignores (a same-key project-config item or a URL-spelled
+  crates.io table replaces it), and still honors pre-v5 config wiring. The
+  hosted takeover's missing-ledger guard is now per version.
 - **Binary Bun lockfiles are patched natively in place.** Hosted and vendored
   modes read and rewrite `bun.lockb` formats 1–3 directly, including mode
   changes, repair, and scoped rollback. Binary-to-text conversion, migration
diff --git a/README.md b/README.md
index 063359d0..ea4878b5 100644
--- a/README.md
+++ b/README.md
@@ -1246,7 +1246,7 @@ Behavior worth knowing:
 | pnpm | `pnpm-lock.yaml` (all generations), `shrinkwrap.yaml` (pnpm 1/2), Rush locks | Aliased / nested `resolution` shapes are diagnosed, not attested; `overrides` alone prove nothing |
 | yarn | `yarn.lock` (classic + berry) | Berry vendored entries also need the root `package.json` `resolutions` mapping; member locks are not read |
 | bun | `bun.lock`, else `bun.lockb` | A hosted entry that Bun < 1.3.10 re-saved without its sha512 attests only after install |
-| cargo | `Cargo.lock`, `Cargo.toml`, `.cargo/config[.toml]` | Root manifest + project config only (no `$CARGO_HOME` / parent configs); a lockless hosted pin needs the redirect ledger's record |
+| cargo | `Cargo.lock`, `Cargo.toml`, `.cargo/config[.toml]` | Root manifest + project config only (no `$CARGO_HOME` / parent configs); vendored `[patch.crates-io]` entries are read from `Cargo.toml` first (v5), the project config for pre-v5 projects; a manifest entry cargo ignores (a same-key project-config item, or a URL-spelled crates.io `[patch]` table) is not attested; a lockless hosted pin needs the redirect ledger's record |
 | golang | `go.mod`, `go.work`, `go.sum`, `go.work.sum` | A replace that `require` no longer selects is inert; `vendor/modules.txt` is not read |
 | pypi | `uv.lock`, `*.py.lock`, `pylock*.toml`, `poetry.lock`, `pdm.lock`, `Pipfile.lock`, `requirements.txt` (+ `-r` includes), `pyproject.toml` / `hatch.toml` | A `uv.lock` beside a `pyproject.toml` must agree with its `[tool.uv.sources]`; PDM 3.1 / 4.0–4.2 locks are refused; a Pipenv project needs `--product` (or a git remote) |
 | gem | `Gemfile.lock`, `gems.locked` | Platform gems unsupported; a Gemfile-only (pre-bundler-2.6, not yet locked) wiring needs the redirect ledger |
diff --git a/crates/socket-patch-cli/CLI_CONTRACT.md b/crates/socket-patch-cli/CLI_CONTRACT.md
index e4b72f53..68cb48c1 100644
--- a/crates/socket-patch-cli/CLI_CONTRACT.md
+++ b/crates/socket-patch-cli/CLI_CONTRACT.md
@@ -198,7 +198,7 @@ Discovery is read-only, never touches the network, and never fails the run: a ma
 | pnpm | `pnpm-lock.yaml` (every `lockfileVersion`); `shrinkwrap.yaml` only when there is no `pnpm-lock.yaml`; with `rush.json`, `common/config/rush/pnpm-lock.yaml` + `common/config/subspaces/*/pnpm-lock.yaml` | `packages:` `resolution.tarball` on the patch host | `file:.socket/vendor/npm/…` tarball + key | `integrity`, required |
 | yarn | `yarn.lock` (classic and berry) | classic `resolved`; berry `resolution: …::__archiveUrl=<url>` | classic `resolved "file:./.socket/vendor/npm/…#<sha1>"`; berry `file:` entry **plus** a root `package.json` `resolutions` mapping onto the same artifact (without it the entry is orphaned: diagnosed, no ref) | classic `integrity` / `#sha1`, berry `checksum`, required |
 | bun | `bun.lock`; `bun.lockb` only when there is no `bun.lock` (bun reads exactly one) | URL tuple / binary remote-tarball resolution; version from the URL leaf | `.socket/vendor/npm/<uuid>/<name>-<ver>.tgz` tuple / local-tarball resolution | `sha512-…`, required. A 2-tuple that Bun < 1.3.10 re-saved without its digest is still a reference, but it attests only from an installed tree. |
-| cargo | `Cargo.lock`, `Cargo.toml`, `.cargo/config` (else `.cargo/config.toml`) | `Cargo.lock` `source = "sparse+…/<uuid>/index/"`, confirmed by `Cargo.toml`: a crate the root manifest declares must pin `registry = "socket-patch-<uuid>"`. A reverted pin is diagnosed, no ref. | `[patch.<source>] <name> = { path = ".socket/vendor/cargo/<uuid>/<name>-<ver>" }` (config or `Cargo.toml`), live only while the lock holds a sourceless entry for it that is not in `[[patch.unused]]` | `checksum` (v1: `[metadata]`), required |
+| cargo | `Cargo.lock`, `Cargo.toml`, `.cargo/config` (else `.cargo/config.toml`) | `Cargo.lock` `source = "sparse+…/<uuid>/index/"`, confirmed by `Cargo.toml`: a crate the root manifest declares must pin `registry = "socket-patch-<uuid>"`. A reverted pin is diagnosed, no ref. | `[patch.<source>] <key> = { path = ".socket/vendor/cargo/<uuid>/<name>-<ver>" }` — primarily the root `Cargo.toml` (v5 `vendor`; key-agnostic: `<name>` is `package` when renamed, else the key, so `<name>-socket-<uuid8>` keys count), also the project config (pre-v5 wiring), live only while the lock holds a sourceless entry for it that is not in `[[patch.unused]]`; a manifest entry cargo ignores — the project config redefines its key with another path, or a `[patch."https://github.com/rust-lang/crates.io-index"]` table replaces `[patch.crates-io]` — is diagnosed (`patched_ref_invalid`), no ref | `checksum` (v1: `[metadata]`), required |
 | golang | `go.mod`, `go.work`, `go.sum`, `go.work.sum` | `replace M v => patch.socket.dev/gopatch/<uuid> <sver>` | `replace M v => ./.socket/vendor/golang/<uuid>/M@v` | both go.sum lines, required. A replace that `require` no longer selects (`require M v'`) is inert: diagnosed, no ref. |
 | pypi | `uv.lock` (confirmed by `pyproject.toml` `[tool.uv.sources]` when present), PEP 723 `<script>.py.lock`, `pylock.toml` / `pylock.<name>.toml`, `poetry.lock`, `pdm.lock`, `Pipfile.lock`, `requirements.txt` + its in-root `-r` includes, PEP 508 direct references in `pyproject.toml` / `hatch.toml` | Socket-host artifact url | `.socket/vendor/pypi/<uuid>/<wheel>` naming the entry's own dist | sha256, required |
 | gem | `Gemfile.lock` and `gems.locked` (the `Gemfile` / `gems.rb` only to cross-check a merged multi-remote `GEM` section) | a `GEM` section whose remote ends `patch-registry/gem/<token>/<uuid>` | `PATH` remote `.socket/vendor/gem/<uuid>/<name>-<ver>` | `CHECKSUMS` sha256, required only when the lock has a `CHECKSUMS` section (bundler ≥ 2.6) |
@@ -696,7 +696,7 @@ to **six flavors**.
 | npm / pnpm LEGACY (lockfileVersion 5.4 = pnpm 7, 6.0 = pnpm 8; flavor `pnpm-legacy`) | (same tarball) | root `package.json` `pnpm.overrides` **+** legacy lock surgery (overrides / root dep + specifiers / packages rekey to a bare `file:` key with recomputed integrity / in-package dep refs). **No `pnpm-workspace.yaml` is written** (pnpm ≤ 8 reads overrides only from package.json). The lock's SPECIFIER is machine-ABSOLUTE — pnpm ≤ 8 absolutizes `file:` overrides itself — surfaced as `vendor_pnpm_legacy_absolute_specifier`. Legacy WORKSPACE locks (`importers:`) refused | same-path `pnpm install --frozen-lockfile --offline`, cold store (byte-stable on pnpm 7.33.5 / 8.15.9). A checkout at a DIFFERENT path fails the frozen check (path-bound specifier) and must run `pnpm install --offline --no-frozen-lockfile` once (the flag matters on CI, where pnpm defaults frozen on), which installs the vendored tarball and re-resolves only the specifier line |
 | npm / bun (`bun.lock`, lockfileVersion 0, 1 or 2 — `vendor_lockfile_version_unsupported` otherwise) | (same tarball) | `bun.lock` only: the packages entry's registry 4-tuple → local 3-tuple with recomputed `sha512`; the entry's `{deps}` meta, the lock's version line and its line endings are preserved. A lock holding `workspace:` packages is refused `vendor_bun_workspace_unsupported` unless lockfileVersion is 2 — Bun 1.2–1.3 resolve a workspace member's local-tarball path relative to the MEMBER (ENOENT on our root-relative path), 1.4 relative to the lockfile, and a committed version-2 lock is the only proof every consumer runs Bun ≥ 1.4 (a deliberate over-approximation: a package declared only by the workspace root would install on version 1 too). The gate fires only on a run that would WRITE a new local tuple, so in-sync re-runs, `already_vendored` skips and `repair` rebuilds on such a lock pass. The detail names the version and the remedy: delete `bun.lock` and re-lock with Bun ≥ 1.4 (an in-place `bun install` keeps the existing lockfileVersion), or `--mode hosted`. Native binary support is described in the next row. `scan`/`get --mode vendored` apply all four refusals BEFORE downloading (see the `get --mode vendored` bullet). Bun 1.1.39–1.3.9 re-save the local tuple WITHOUT its `sha512` on any later lock re-save (`bun add`, `bun install` after a manifest change); the digest-less 2-tuple is recognised as the same wiring — an in-sync re-run stays `already_vendored` and re-pins the digest on disk (no new wiring record) when the committed artifact still holds the bytes the lock was written from — otherwise, as for any stale tuple of ours, the line is re-pinned and the fresh entry carries the new fingerprint — `repair` rebuilds through it, and `vendor --revert` / `rollback` restore the registry line over it (a 2-tuple at ANOTHER uuid is still `vendor_lock_entry_drifted`) | `bun install --frozen-lockfile`, cold cache (the local tarball's sha512 is enforced by Bun ≥ 1.3.10; 1.1.39–1.3.9 install it unverified — the committed artifact is the protection there) |
 | npm / bun binary (`bun.lockb`, native binary format 1, 2 or 3) | (same tarball) | Rewrite matching binary package resolutions and integrity in place; preserve topology and unrelated metadata, update binary offsets and the package metadata hash. Text `bun.lock` takes precedence. `bun_lockb_package` wiring snapshots recover pristine registry metadata for repair and support per-package revert and hosted ↔ vendored migration. Binary discovery and rewrites require no installed Bun runtime. Malformed or unsupported content refuses `vendor_bun_lockb_invalid` before download or takeover. | Frozen installs with the original compatible Bun reader; see `docs/testing/bun-compatibility.md` for the release matrix and historical runtime integrity limits. |
-| cargo | crate dir `<name>-<version>/` (no `.cargo-checksum.json`) | `.cargo/config.toml` `[patch.crates-io]` path entry **+** Cargo.lock surgery (the `[[package]]` entry's `source`/`checksum` removed) | `cargo build --locked --offline` on a fresh checkout. Requires cargo ≥ 1.56 (`[patch]` in config files). Note: path deps build **without** `--cap-lints allow` |
+| cargo | crate dir `<name>-<version>/` (no `.cargo-checksum.json`) | (v5.0) `[patch.crates-io]` path entry in the **workspace-root `Cargo.toml`** (the manifest beside the `Cargo.lock` it detaches — never `.cargo/config*`) **+** Cargo.lock surgery (the `[[package]]` entry's `source`/`checksum` removed). Key: always the Socket-owned `<name>-socket-<first 8 hex of the uuid>` with `package = "<name>"` (the full uuid hex when that key is taken), never the bare crate name — cargo lets a config-file `[patch]` item (project, ancestor directory or `$CARGO_HOME`) replace the manifest item with the same key whatever its version, so keys any of those configs use are avoided and a re-run moves an entry off a now-shadowed key; two versions of one crate are wired side by side. Pre-v5 wiring in `.cargo/config.toml` / `.cargo/config` is moved into `Cargo.toml` by a re-run (`vendor`, `scan`/`get --mode vendored`) or `repair` (`cargo_wiring_migrated` note; the ledger's `cargo_patch_entry` record then names `Cargo.toml`); a detached lock entry left unwired by the pre-v5 multi-version overwrite is re-wired the same way (`cargo_wiring_restored`); every revert removes both spellings | `cargo build --locked --offline` on a fresh checkout — single-version manifest `[patch]` also builds with no network on cargo older than 1.56 (the old config-file wiring's floor); two vendored versions of ONE crate need `--offline` (or a reachable registry index) on such old cargo, which loads the index to tell them apart. Note: path deps build **without** `--cap-lints allow` |
 | golang | module dir `<module>@<version>/` | `go.mod` `replace <module> <ver> => ./.socket/vendor/golang/<uuid>/<module>@<ver>` | `go build` with `GOPROXY=off` + empty `GOMODCACHE` (directory replaces bypass go.sum entirely; survives `go mod tidy`) |
 | composer | package dir `<vendor>/<name>@<version>/` | `composer.lock` only: entry's `dist` → `{type: "path", url, reference: null}`, `source` removed, `transport-options: {symlink: false}` added. `content-hash` unaffected; `composer.json` untouched | `composer install` (from the lock alone, real copy not symlink, works under `--network none`). `composer update <pkg>` reverts it |
 | gem | gem dir `<name>-<version>/` + gemspec materialized from `specifications/` | **Gemfile + Gemfile.lock pair**: the `gem` line gains `path:` (or a managed block for transitive deps); the lock's spec block moves GEM→PATH and the DEPENDENCIES entry becomes `<name> (= <ver>)!`, in bundler's exact canonical form | `bundle install` (normal **and** `BUNDLE_FROZEN=true`), byte-stable lock. Lock-only edits are a silent unpatch — hence the mandatory pair |
@@ -856,8 +856,29 @@ worse, lets a warm cache silently serve unpatched bytes):
   recomputation is mandatory and enforced by the implementation.
 * npm redacts uuid-like path segments as `***` in its own error output (its secret heuristic);
   the path on disk and in the lockfile is unaffected.
-* cargo: invoking cargo from **outside** the project root skips `.cargo/config.toml` discovery and
-  an unlocked build will silently re-lock to the registry crate. CI should build with `--locked`.
+* cargo: the vendored `[patch]` lives in the workspace-root `Cargo.toml`, so it applies however
+  cargo is invoked (the pre-v5 `.cargo/config.toml` wiring was skipped when cargo ran from
+  outside the project root). CI should still build with `--locked`.
+* cargo (v5.0): the vendored wiring edits the root manifest format-preservingly (comments,
+  ordering, CRLF / mixed line endings, a UTF-8 BOM and the trailing-newline state survive; a
+  revert with nothing else changed restores `Cargo.toml` byte for byte, keeping a user's
+  explicit `[patch]` header and a `[patch.crates-io]` header that another table follows or
+  that carries a comment). Vendor refuses up front — nothing written — with
+  `cargo_manifest_unreadable` (no root `Cargo.toml`, or not a readable regular file),
+  `cargo_manifest_unparseable` (not valid TOML, or `[patch.crates-io]` is not a table),
+  `cargo_manifest_symlink_unsupported` (a symlinked `Cargo.toml`; a revert that must edit a
+  symlinked manifest fails with the same code, nothing reverted),
+  `cargo_manifest_not_workspace_root` (the project directory is a workspace member — its
+  manifest sets `package.workspace`, or an ancestor `[workspace]` claims it without
+  `exclude` — whose `[patch]` cargo ignores; run from the workspace root),
+  `cargo_manifest_patch_source_alias` (the manifest also has a
+  `[patch."https://github.com/rust-lang/crates.io-index"]` table — cargo keys manifest
+  `[patch]` tables by URL and lets that one replace `[patch.crates-io]` wholesale), and
+  `user_authored_patch_entry` (a user-authored crates.io `[patch]` entry in `Cargo.toml` or in
+  any cargo config file cargo merges — the project's, every ancestor directory's,
+  `$CARGO_HOME`'s — whose crate — `package` or key — is the vendored crate and which is not
+  provably a DIFFERENT version: a git/registry patch, or a path whose `Cargo.toml` version is
+  unreadable or equal). Each is a `failed` event, exit 1 (`partialFailure`).
 * pip/`uv pip`: bare relative requirement paths resolve against the invoking process's CWD; run
   installs from the project root.
 * `vendor` exits like `apply`: 0 on success (benign skips included), 1 on any refusal/failure
@@ -1217,6 +1238,10 @@ Every `--json` invocation emits a single JSON object that follows the **unified
 | `vendor_lockfile_missing` / `vendor_lockfile_version_unsupported` (bun preflight placement) | `failed` | scan / get `--mode vendored` (bun): the pre-download preflight found `bun.lock` unreadable / at a `lockfileVersion` other than 0, 1 or 2 (a newer version: update socket-patch; no integer: re-lock with Bun ≥ 1.2 — the same text as hosted's `redirect_bun_lock_unsupported`) or outside bun's single-line `packages` grammar. Same placements as `vendor_bun_lockb_invalid`; nothing fetched, no patch record. An unreadable `.socket/vendor/state.json` met by the same preflight is `vendor_state_unreadable` (see that row), never one of these. |
 | `bun_lockb_invalid` | scan `warnings[]` (run-level) | scan (every mode): the native binary inventory could not parse or read `bun.lockb`; detail names the format or filesystem error. Also printed as `Warning (bun_lockb_invalid): …` on stderr. Exit and status remain unchanged. The warning is retained on empty and non-empty scans; valid binary locks are inventoried normally without a runtime or install. |
 | `would_refuse` | dry-run preview action (`vendor.patches[]`) | scan `--mode vendored --dry-run` / get `--mode vendored --dry-run`: the wet run's Bun preflight would refuse this npm purl; the record carries `errorCode` (one of the four Bun lock codes above, or `vendor_state_unreadable` for an unreadable vendor ledger) + `error`. Exit 0 / `status: "success"`, nothing written. |
+| `cargo_wiring_migrated` | `skipped` (advisory note) | vendor / scan / get `--mode vendored` / repair (v5.0): a pre-v5 `.cargo/config.toml` / `.cargo/config` vendored `[patch.crates-io]` entry was moved into the workspace-root `Cargo.toml` (dry run: "would move"); the ledger entry is rewritten to name `Cargo.toml` (lock originals kept). A vendor re-run that migrates reports the package `applied`, not `already_vendored`. |
+| `cargo_legacy_wiring_kept` | vendor: `failed`; repair: `skipped` (warning) | vendor / scan / get `--mode vendored` (v5.0): the pre-v5 config entry could not be removed after the manifest took the wiring — the run is unwound (manifest, lock and copy as before) and the package fails, since a kept entry would double-wire the crate and, on a uuid bump, point at a copy the stale sweep deletes; the code prefixes the error detail. repair: the move was refused (e.g. an unparseable `Cargo.toml`, a user entry for the crate, or an unremovable legacy entry — the manifest edit is unwound); left in place. |
+| `cargo_wiring_restored` | `skipped` (advisory note) | repair (v5.0): a vendored crate's Cargo.lock entry was detached with no Socket-owned `[patch]` pointing at its committed copy (a pre-v5 release overwrote its crate-named config key when a second version was vendored); the manifest entry is written back and the ledger updated (dry run: "would restore"). A `vendor` re-run heals the same state as a plain re-vendor. |
+| `cargo_manifest_unreadable` / `cargo_manifest_unparseable` / `cargo_manifest_symlink_unsupported` / `cargo_manifest_not_workspace_root` / `cargo_manifest_patch_source_alias` | `failed` | vendor / scan / get `--mode vendored` (cargo, v5.0): the workspace-root `Cargo.toml` cannot carry the vendored `[patch.crates-io]` entry (or cargo would ignore it there) — see the cargo caveat under "Vendored mode". Refused before any write. |
 | `vendor_would_revert_redirect` / `vendor_takeover_reverted_redirect` | `skipped` (advisory event) | vendor / scan / get `--mode vendored` over a hosted-redirected purl (cargo and the npm family, bun included): dry run — the per-purl hosted revert was PROBED and would succeed (for bun, only after the Bun vendored preflight accepted the lock; a refused lock is previewed as the wet run's `failed <code>` instead) / wet run — the hosted lockfile edits were reverted to their pre-redirect registry values and the redirect-ledger record dropped before vendoring (mode takeover). Fires on the run that takes over, not on re-runs. |
 | `redirect_revert_failed` | `failed` | vendor / scan / get `--mode vendored` (dry and wet): the per-purl hosted revert refused (drifted lock, missing original fragment, an undecidable ledger edit) — nothing vendored for the purl, hosted wiring left in place, exit 1 `partial_failure`; the detail names the remedy (for bun: an unscoped `socket-patch rollback`). |
 | `vendor_yarn_berry_cache_unsupported` | `failed` | vendor (yarn berry): lock `cacheKey ≠ 10c0` or non-default `.yarnrc.yml` `compressionLevel` — the cache-zip checksum is not reproducible. |
diff --git a/crates/socket-patch-cli/src/commands/repair_vendor.rs b/crates/socket-patch-cli/src/commands/repair_vendor.rs
index c880ff65..e495cf66 100644
--- a/crates/socket-patch-cli/src/commands/repair_vendor.rs
+++ b/crates/socket-patch-cli/src/commands/repair_vendor.rs
@@ -112,7 +112,9 @@ const WIRING_FILES: &[&str] = &[
     "package.json",
     "Cargo.toml",
     "Cargo.lock",
+    // Pre-v5 vendored cargo wiring (migrated into Cargo.toml on re-run).
     ".cargo/config.toml",
+    ".cargo/config",
     "go.mod",
     "composer.json",
     "composer.lock",
@@ -667,6 +669,53 @@ pub(crate) async fn repair_vendored_artifacts_with_references(
             );
             continue;
         }
+        // Pre-v5 cargo wiring in `.cargo/config*`: move it into the root
+        // Cargo.toml (the v5 location) and record the move in the ledger —
+        // or restore the manifest entry a pre-v5 multi-version vendor lost.
+        let entry = if entry.ecosystem == "cargo" {
+            match vendor::cargo::migrate_legacy_wiring(&entry, &common.cwd, common.dry_run).await {
+                Ok(Some((migrated, warning))) => {
+                    record_warning(env, purl, &warning, common);
+                    if common.dry_run {
+                        entry
+                    } else if persist_vendor_entry(
+                        common,
+                        env,
+                        &mut state,
+                        purl,
+                        migrated.clone(),
+                        entry.detached,
+                        &record,
+                    )
+                    .await
+                    {
+                        continue;
+                    } else {
+                        migrated
+                    }
+                }
+                Ok(None) => entry,
+                Err(detail) => {
+                    record_warning(
+                        env,
+                        purl,
+                        &VendorWarning::new(
+                            "cargo_legacy_wiring_kept",
+                            format!(
+                                "the vendored wiring for {} could not be written into \
+                                 Cargo.toml ({detail}); any pre-v5 .cargo/config wiring was \
+                                 left in place",
+                                normalize_purl(purl)
+                            ),
+                        ),
+                        common,
+                    );
+                    entry
+                }
+            }
+        } else {
+            entry
+        };
         let health = check_vendored_artifact(&common.cwd, &entry, &record).await;
         if health == ArtifactHealth::Healthy || workspace_copy_issue(&health) {
             let mut healed = entry.clone();
diff --git a/crates/socket-patch-cli/src/commands/scan/hosted.rs b/crates/socket-patch-cli/src/commands/scan/hosted.rs
index f9f76674..d0e3a1df 100644
--- a/crates/socket-patch-cli/src/commands/scan/hosted.rs
+++ b/crates/socket-patch-cli/src/commands/scan/hosted.rs
@@ -1491,8 +1491,6 @@ pub(crate) async fn run_redirect_selected(
         {
             return refuse_symlinked_file(common, scan_result.take(), linked);
         }
-        let patch_entries =
-            socket_patch_core::vendor::cargo_config::read_patch_entries(&common.cwd).await;
         let mut refused: Vec<String> = Vec::new();
         for (candidate, ledger_entry) in &takeover {
             let purl = &candidate.purl;
@@ -1608,23 +1606,30 @@ pub(crate) async fn run_redirect_selected(
                 // this crate is nevertheless present, the ledger is missing or
                 // corrupt — the originals needed to revert are unrecoverable,
                 // so redirecting on top would wedge the project. Refuse.
-                // (Cargo-only probe: `.cargo/config.toml` `[patch]` entries.
-                // An npm purl in this state falls through to the rewriters'
-                // own per-flavor diagnostics.)
-                let name = purl
+                // (Cargo-only probe: Socket-owned `[patch.crates-io]` entries
+                // for exactly this name@version in the root Cargo.toml or a
+                // legacy `.cargo/config*` — another vendored version of the
+                // crate has its own ledger entry. An npm purl in this state
+                // falls through to the rewriters' own per-flavor
+                // diagnostics.)
+                let coords = purl
                     .starts_with("pkg:cargo/")
-                    .then(|| purl_parts(purl).map(|(_, name, _)| name))
+                    .then(|| purl_parts(purl).map(|(_, name, version)| (name, version)))
                     .flatten();
-                let wired = name
-                    .as_deref()
-                    .is_some_and(|n| patch_entries.get(n).is_some_and(|i| i.socket_owned));
+                let wired = match &coords {
+                    Some((n, v)) => {
+                        socket_patch_core::vendor::cargo::socket_wiring_present(&common.cwd, n, v)
+                            .await
+                    }
+                    None => false,
+                };
                 if wired {
                     refused.push(purl.clone());
                     takeover_pre_warnings.push(serde_json::json!({
                         "code": "redirect_vendored_revert_failed",
                         "detail": format!(
-                            "{purl} has socket-owned vendored wiring in \
-                             .cargo/config.toml but no usable vendored ledger entry \
+                            "{purl} has socket-owned vendored `[patch.crates-io]` \
+                             wiring but no usable vendored ledger entry \
                              (.socket/vendor/state.json is missing or corrupt); NOT \
                              redirected — restore the ledger or remove the vendored \
                              wiring manually, then re-run"
diff --git a/crates/socket-patch-cli/src/commands/vendor.rs b/crates/socket-patch-cli/src/commands/vendor.rs
index 76f43262..89a1b889 100644
--- a/crates/socket-patch-cli/src/commands/vendor.rs
+++ b/crates/socket-patch-cli/src/commands/vendor.rs
@@ -378,7 +378,8 @@ fn advisory_tier(code: &str) -> AdvisoryTier {
         // The run did what was asked; these explain how.
         "vendor_fetched_missing"
         | "vendor_would_revert_redirect"
-        | "vendor_takeover_reverted_redirect" => AdvisoryTier::Note,
+        | "vendor_takeover_reverted_redirect"
+        | "cargo_wiring_migrated" => AdvisoryTier::Note,
         _ => AdvisoryTier::Warning,
     }
 }
diff --git a/crates/socket-patch-cli/tests/covgap_commands_scan_hosted.rs b/crates/socket-patch-cli/tests/covgap_commands_scan_hosted.rs
index 69d4b4a8..a90a6113 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_scan_hosted.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_scan_hosted.rs
@@ -1127,13 +1127,26 @@ async fn hosted_human_paid_only_discovery_stops_with_the_paid_hint() {
 
 // ───────────── cargo wiring-without-ledger refusal (1104-1114) ─────────────
 
-/// A cargo purl with SOCKET-OWNED `[patch.crates-io]` wiring in
-/// .cargo/config.toml but NO vendored ledger must be refused: the originals
-/// needed to revert are unrecoverable, so redirecting on top would wedge the
-/// project. The refusal happens before any rewrite — config and lock stay
-/// byte-identical.
+/// A cargo purl with SOCKET-OWNED `[patch.crates-io]` wiring — pre-v5 in
+/// .cargo/config.toml, or v5 in the root Cargo.toml — but NO vendored ledger
+/// must be refused: the originals needed to revert are unrecoverable, so
+/// redirecting on top would wedge the project. The refusal happens before
+/// any rewrite — manifest, config and lock stay byte-identical.
 #[tokio::test]
 async fn cargo_socket_owned_wiring_without_ledger_refuses_the_redirect() {
+    ledgerless_cargo_wiring_refuses(false).await;
+}
+
+#[tokio::test]
+async fn cargo_socket_owned_manifest_wiring_without_ledger_refuses_the_redirect() {
+    ledgerless_cargo_wiring_refuses(true).await;
+}
+
+/// The missing-ledger probe is version-scoped: Socket-owned wiring for
+/// ANOTHER version of the crate (vendored alongside, with its own ledger
+/// entry) must not refuse redirecting this one.
+#[tokio::test]
+async fn cargo_other_version_vendored_wiring_does_not_refuse_the_redirect() {
     const CNAME: &str = "covgap-cargo-dep";
     const CPURL: &str = "pkg:cargo/covgap-cargo-dep@1.0.0";
     const CUUID: &str = "44444444-4444-4444-8444-444444444444";
@@ -1169,13 +1182,15 @@ async fn cargo_socket_owned_wiring_without_ledger_refuses_the_redirect() {
         }),
     )
     .await;
-
     let tmp = tempfile::tempdir().unwrap();
     let root = tmp.path();
     std::fs::write(
         root.join("Cargo.toml"),
         format!(
-            "[package]\nname = \"consumer\"\nversion = \"0.1.0\"\nedition = \"2021\"\n\n[dependencies]\n{CNAME} = \"1.0.0\"\n"
+            "[package]\nname = \"consumer\"\nversion = \"0.1.0\"\nedition = \"2021\"\n\n\
+             [dependencies]\n{CNAME} = \"1.0.0\"\n\n[patch.crates-io]\n\
+             {CNAME}-socket-66666666 = {{ package = \"{CNAME}\", path = \
+             \".socket/vendor/cargo/66666666-6666-4666-8666-666666666666/{CNAME}-0.9.0\" }}\n"
         ),
     )
     .unwrap();
@@ -1186,16 +1201,96 @@ async fn cargo_socket_owned_wiring_without_ledger_refuses_the_redirect() {
         ),
     )
     .unwrap();
-    // Socket-owned [patch.crates-io] wiring — but NO .socket/vendor/state.json.
-    std::fs::create_dir_all(root.join(".cargo")).unwrap();
+    let cargo_home = root.join("cargo-home");
+    std::fs::create_dir_all(&cargo_home).unwrap();
+    let cargo_home_s = cargo_home.to_str().unwrap().to_string();
+    let (_, doc) = scan_hosted_json(
+        root,
+        &server.uri(),
+        &[],
+        &[("CARGO_HOME", cargo_home_s.as_str())],
+    );
+    let codes: Vec<&str> = doc["redirect"]["warnings"]
+        .as_array()
+        .into_iter()
+        .flatten()
+        .filter_map(|w| w["code"].as_str())
+        .collect();
+    assert!(
+        !codes.contains(&"redirect_vendored_revert_failed"),
+        "another version's wiring is not this version's lost ledger: {doc:#}"
+    );
+    assert!(
+        !doc["redirect"]["skipped"]
+            .as_array()
+            .is_some_and(|s| s.iter().any(|e| e["reason"] == "vendored_revert_failed")),
+        "{doc:#}"
+    );
+}
+
+async fn ledgerless_cargo_wiring_refuses(manifest_wiring: bool) {
+    const CNAME: &str = "covgap-cargo-dep";
+    const CPURL: &str = "pkg:cargo/covgap-cargo-dep@1.0.0";
+    const CUUID: &str = "44444444-4444-4444-8444-444444444444";
+    let server = MockServer::start().await;
+    mock_discovery(&server, CPURL, CUUID).await;
+    let hosted_url = format!(
+        "{}/patch/cargo/{CNAME}/1.0.0/55555555-5555-4555-8555-555555555555/{CUUID}/{CNAME}-1.0.0.crate",
+        server.uri()
+    );
+    let cksum = "a".repeat(64);
+    mock_reference_results(
+        &server,
+        json!({
+            CUUID: {
+                "status": "granted",
+                "url": hosted_url,
+                "purl": CPURL,
+                "artifacts": [{
+                    "kind": "tarball",
+                    "url": hosted_url,
+                    "integrity": { "sha256": cksum }
+                }],
+                "registryOverride": {
+                    "kind": "cargo-sparse",
+                    "indexUrl": format!("sparse+{}/index/", server.uri()),
+                    "identifiers": {
+                        "name": CNAME,
+                        "version": "1.0.0",
+                        "cargoCksumSha256": cksum,
+                    }
+                }
+            }
+        }),
+    )
+    .await;
+
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path();
+    let patch = format!(
+        "[patch.crates-io]\n{CNAME} = {{ path = \".socket/vendor/cargo/{CUUID}/{CNAME}-1.0.0\" }}\n"
+    );
     std::fs::write(
-        root.join(".cargo/config.toml"),
+        root.join("Cargo.toml"),
         format!(
-            "[patch.crates-io]\n{CNAME} = {{ path = \".socket/vendor/cargo/{CUUID}/{CNAME}-1.0.0\" }}\n"
+            "[package]\nname = \"consumer\"\nversion = \"0.1.0\"\nedition = \"2021\"\n\n[dependencies]\n{CNAME} = \"1.0.0\"\n{}",
+            if manifest_wiring { format!("\n{patch}") } else { String::new() }
         ),
     )
     .unwrap();
-    let config_before = std::fs::read(root.join(".cargo/config.toml")).unwrap();
+    std::fs::write(
+        root.join("Cargo.lock"),
+        format!(
+            "version = 3\n\n[[package]]\nname = \"consumer\"\nversion = \"0.1.0\"\ndependencies = [\n \"{CNAME}\",\n]\n\n[[package]]\nname = \"{CNAME}\"\nversion = \"1.0.0\"\nsource = \"registry+https://github.com/rust-lang/crates.io-index\"\nchecksum = \"{cksum}\"\n"
+        ),
+    )
+    .unwrap();
+    // Socket-owned [patch.crates-io] wiring — but NO .socket/vendor/state.json.
+    if !manifest_wiring {
+        std::fs::create_dir_all(root.join(".cargo")).unwrap();
+        std::fs::write(root.join(".cargo/config.toml"), &patch).unwrap();
+    }
+    let config_before = std::fs::read(root.join(".cargo/config.toml")).ok();
     let lock_before = std::fs::read(root.join("Cargo.lock")).unwrap();
     let manifest_before = std::fs::read(root.join("Cargo.toml")).unwrap();
 
@@ -1225,7 +1320,7 @@ async fn cargo_socket_owned_wiring_without_ledger_refuses_the_redirect() {
     );
     assert_eq!(doc["redirect"]["redirected"], 0, "envelope: {doc:#}");
     assert_eq!(
-        std::fs::read(root.join(".cargo/config.toml")).unwrap(),
+        std::fs::read(root.join(".cargo/config.toml")).ok(),
         config_before,
         "the socket-owned wiring must be left for manual recovery"
     );
diff --git a/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs b/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs
index d298ee66..7fd4259b 100644
--- a/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs
@@ -12,17 +12,31 @@
 //!      (spike-verified).
 //!   3. `socket-patch vendor --json --offline` — asserts the patched copy at
 //!      `.socket/vendor/cargo/<uuid>/cfg-if-<ver>/`, the `[patch.crates-io]`
-//!      entry in `.cargo/config.toml`, and the surgical lock detach (the
-//!      `[[package]]` entry keeps name+version but loses source+checksum).
+//!      entry in the root `Cargo.toml` (no `.cargo/` is created), and the
+//!      surgical lock detach (the `[[package]]` entry keeps name+version but
+//!      loses source+checksum).
 //!   4. COMPILE ORACLE: the consumer's `main.rs` is rewritten to call
 //!      `cfg_if::socket_patched()` — it only compiles if the patched bytes
 //!      are what cargo links — and `cargo run --locked --offline` prints it.
 //!   5. **Fresh-checkout proof**: copy ONLY the committable files
-//!      (Cargo.toml + Cargo.lock + .cargo/ + src/ + .socket/) to a new dir
+//!      (Cargo.toml + Cargo.lock + src/ + .socket/) to a new dir
 //!      and `cargo build --locked --offline` with an EMPTY CARGO_HOME — and
 //!      assert that CARGO_HOME gained no `registry/` (zero crate downloads).
-//!   6. **Revert proof**: `vendor --revert` restores Cargo.lock byte-for-byte
-//!      and removes `.socket/vendor/` + the managed `[patch]` entry.
+//!   6. **Revert proof**: `vendor --revert` restores Cargo.lock AND
+//!      Cargo.toml byte-for-byte and removes `.socket/vendor/`.
+//!
+//! Also here: MULTI-VERSION (two vendored versions of one crate get
+//! distinct `[patch.crates-io]` keys and both compile under `--locked`),
+//! LEGACY MIGRATION (a pre-v5 `.cargo/config.toml` wiring is moved into
+//! `Cargo.toml` by `repair` and by a `vendor` re-run, and the result still
+//! builds), and an OLD-TOOLCHAIN proof (manifest `[patch]` + the detached
+//! lock type-check the patched copy with no network on every installed
+//! rustup toolchain 1.36..=1.56 — config-file `[patch]` needs 1.56+; two
+//! versions of one crate there need `--offline`; skipped when none is
+//! installed, required by the `cargo-old-toolchains` CI leg). Also: a
+//! URL-spelled crates.io `[patch]` table is refused, an ancestor-directory
+//! config entry cannot silently shadow the vendored copy, and the pre-v5
+//! multi-version overwrite is healed by a re-run and by `repair`.
 //!
 //! A get-driven twin (`cargo_get_uuid_vendored_fresh_checkout_locked_build`,
 //! v3.6) reaches the same committed state through `get <uuid> --mode
@@ -73,6 +87,19 @@ use vex_e2e_common::{
 const ORG: &str = "test-org";
 const UUID: &str = "2b3c4d5e-6f70-4a1b-8c2d-0123456789ab";
 const DEP: &str = "cfg-if";
+
+/// The Socket-owned `[patch.crates-io]` key vendoring writes for `uuid`.
+fn socket_key(uuid: &str) -> String {
+    format!("{DEP}-socket-{}", &uuid.replace('-', "")[..8])
+}
+
+/// The manifest entry line vendoring writes for `copy_rel` under `uuid`.
+fn socket_entry(uuid: &str, copy_rel: &str) -> String {
+    format!(
+        "{} = {{ package = \"{DEP}\", path = \"{copy_rel}\" }}",
+        socket_key(uuid)
+    )
+}
 /// Appended to the dep's `src/lib.rs`. Doc comment required: cfg-if denies
 /// `missing_docs` and path deps get no `--cap-lints allow`.
 const PATCH_SUFFIX: &str =
@@ -175,6 +202,33 @@ fn copy_dir_recursive(src: &Path, dst: &Path) {
     }
 }
 
+/// `manifest` without its `[patch.crates-io]` table (the header through the
+/// next table header or EOF, plus the blank line before it) — a hand revert
+/// of the vendored wiring.
+fn strip_patch_table(manifest: &str) -> String {
+    let mut out: Vec<&str> = Vec::new();
+    let mut skipping = false;
+    for line in manifest.lines() {
+        let t = line.trim();
+        if t == "[patch.crates-io]" {
+            skipping = true;
+            while out.last().is_some_and(|l| l.trim().is_empty()) {
+                out.pop();
+            }
+            continue;
+        }
+        if skipping && t.starts_with('[') {
+            skipping = false;
+        }
+        if !skipping {
+            out.push(line);
+        }
+    }
+    let mut s = out.join("\n");
+    s.push('\n');
+    s
+}
+
 /// The locked version of `name` in Cargo.lock (first `[[package]]` match).
 fn locked_version(lock_text: &str, name: &str) -> Option<String> {
     let needle = format!("name = \"{name}\"");
@@ -399,9 +453,12 @@ impl ManifestlessVendored {
         //      kept, rebuilt for real from crates.io's copy.
         let revert = self.scratch.join("reverted");
         std::fs::create_dir_all(&revert).unwrap();
-        for file in ["Cargo.toml", "Cargo.lock"] {
-            std::fs::copy(fresh.join(file), revert.join(file)).unwrap();
-        }
+        std::fs::copy(fresh.join("Cargo.lock"), revert.join("Cargo.lock")).unwrap();
+        std::fs::write(
+            revert.join("Cargo.toml"),
+            strip_patch_table(&std::fs::read_to_string(fresh.join("Cargo.toml")).unwrap()),
+        )
+        .unwrap();
         copy_dir_recursive(&fresh.join("src"), &revert.join("src"));
         copy_dir_recursive(&fresh.join(".socket"), &revert.join(".socket"));
         std::fs::write(
@@ -461,6 +518,7 @@ fn cargo_vendor_fresh_checkout_locked_offline_build_and_revert() {
 
     let lock_path = proj.join("Cargo.lock");
     let lock_before = std::fs::read(&lock_path).unwrap();
+    let manifest_before = std::fs::read(proj.join("Cargo.toml")).unwrap();
 
     // Vendor (offline; blob staged locally).
     let (code, stdout, stderr) = run_socket(
@@ -551,16 +609,31 @@ fn cargo_vendor_fresh_checkout_locked_offline_build_and_revert() {
         "vendored attestation must carry the (vendored) marker: {vex_doc}"
     );
 
-    // `[patch.crates-io]` entry in .cargo/config.toml points at the copy.
-    let config = std::fs::read_to_string(proj.join(".cargo/config.toml"))
-        .expect("vendor must create .cargo/config.toml");
-    assert!(
-        config.contains("[patch.crates-io]"),
-        "config must carry [patch.crates-io]:\n{config}"
+    // The `[patch.crates-io]` entry lives in the ROOT MANIFEST (appended
+    // after the user's content, which is otherwise byte-identical); no
+    // project config is created.
+    let manifest = std::fs::read_to_string(proj.join("Cargo.toml")).unwrap();
+    assert_eq!(
+        manifest,
+        format!(
+            "{}\n[patch.crates-io]\n{}\n",
+            String::from_utf8_lossy(&manifest_before),
+            socket_entry(UUID, &copy_rel)
+        ),
+        "the manifest gains exactly the Socket-owned [patch] entry"
     );
     assert!(
-        config.contains(&copy_rel),
-        "patch entry must point at the uuid copy path:\n{config}"
+        !proj.join(".cargo").exists(),
+        "vendored mode writes no .cargo/config.toml"
+    );
+    let state: serde_json::Value = serde_json::from_str(
+        &std::fs::read_to_string(proj.join(".socket/vendor/state.json")).unwrap(),
+    )
+    .unwrap();
+    assert_eq!(
+        state["entries"][purl.as_str()]["wiring"][0]["file"],
+        "Cargo.toml",
+        "the ledger records the manifest wiring: {state}"
     );
 
     // Lock surgery: the entry keeps name+version but loses source+checksum
@@ -606,7 +679,6 @@ fn cargo_vendor_fresh_checkout_locked_offline_build_and_revert() {
     std::fs::create_dir_all(&fresh).unwrap();
     std::fs::copy(proj.join("Cargo.toml"), fresh.join("Cargo.toml")).unwrap();
     std::fs::copy(&lock_path, fresh.join("Cargo.lock")).unwrap();
-    copy_dir_recursive(&proj.join(".cargo"), &fresh.join(".cargo"));
     copy_dir_recursive(&proj.join("src"), &fresh.join("src"));
     copy_dir_recursive(&proj.join(".socket"), &fresh.join(".socket"));
 
@@ -702,13 +774,14 @@ fn cargo_vendor_fresh_checkout_locked_offline_build_and_revert() {
         !proj.join(".socket/vendor").exists(),
         ".socket/vendor must be fully removed after revert"
     );
-    // The managed [patch] entry is gone (vendor created the config, so the
-    // whole file is removed; tolerate an empty leftover that lost the entry).
-    let config_after = std::fs::read_to_string(proj.join(".cargo/config.toml")).unwrap_or_default();
-    assert!(
-        !config_after.contains(DEP),
-        "revert must drop the managed [patch.crates-io] entry:\n{config_after}"
+    // The managed [patch] entry is gone: the manifest is byte-identical to
+    // the pre-vendor snapshot.
+    assert_eq!(
+        std::fs::read(proj.join("Cargo.toml")).unwrap(),
+        manifest_before,
+        "revert must restore Cargo.toml byte-identical to the pre-vendor snapshot"
     );
+    assert!(!proj.join(".cargo").exists());
 }
 
 /// Correct-behavior pin for the vendor envelope: a successful first-time
@@ -924,13 +997,13 @@ async fn cargo_get_uuid_vendored_fresh_checkout_locked_build() {
         "the vendor ledger must be written"
     );
 
-    // `[patch.crates-io]` wiring + the surgical lock detach.
-    let config = std::fs::read_to_string(proj.join(".cargo/config.toml"))
-        .expect("get --mode vendored must create .cargo/config.toml");
+    // `[patch.crates-io]` wiring (root manifest) + the surgical lock detach.
+    let manifest = std::fs::read_to_string(proj.join("Cargo.toml")).unwrap();
     assert!(
-        config.contains("[patch.crates-io]") && config.contains(&copy_rel),
-        "config must patch crates-io to the uuid copy path:\n{config}"
+        manifest.contains("[patch.crates-io]") && manifest.contains(&copy_rel),
+        "Cargo.toml must patch crates-io to the uuid copy path:\n{manifest}"
     );
+    assert!(!proj.join(".cargo").exists(), "no .cargo/config.toml");
     let lock_text = std::fs::read_to_string(proj.join("Cargo.lock")).unwrap();
     let block = package_block(&lock_text, DEP).expect("cfg-if lock entry must survive");
     assert!(
@@ -954,7 +1027,6 @@ async fn cargo_get_uuid_vendored_fresh_checkout_locked_build() {
     std::fs::create_dir_all(&fresh).unwrap();
     std::fs::copy(proj.join("Cargo.toml"), fresh.join("Cargo.toml")).unwrap();
     std::fs::copy(proj.join("Cargo.lock"), fresh.join("Cargo.lock")).unwrap();
-    copy_dir_recursive(&proj.join(".cargo"), &fresh.join(".cargo"));
     copy_dir_recursive(&proj.join("src"), &fresh.join("src"));
     copy_dir_recursive(&proj.join(".socket"), &fresh.join(".socket"));
 
@@ -1006,3 +1078,844 @@ async fn cargo_get_uuid_vendored_fresh_checkout_locked_build() {
     .run_async()
     .await;
 }
+
+// ── v5 manifest wiring: multi-version, legacy migration, old toolchains ─
+
+const UUID_OLD: &str = "3c4d5e6f-7081-4b2c-9d3e-123456789abc";
+const PATCH_SUFFIX_OLD: &str =
+    "\n/// Socket-patch marker for the OLD major (added by the vendored patch).\npub fn socket_patched_old() -> u32 { 2 }\n";
+
+fn vendor_ok(proj: &Path, cargo_home: &Path, tag: &str) -> serde_json::Value {
+    let (code, stdout, stderr) = run_socket(
+        proj,
+        &[
+            "vendor",
+            "--json",
+            "--offline",
+            "--cwd",
+            proj.to_str().unwrap(),
+        ],
+        cargo_home,
+    );
+    assert_eq!(
+        code, 0,
+        "{tag}: vendor failed.\nstdout:\n{stdout}\nstderr:\n{stderr}"
+    );
+    parse_envelope(&stdout)
+}
+
+fn revert_ok(proj: &Path, cargo_home: &Path, tag: &str) {
+    let (code, stdout, stderr) = run_socket(
+        proj,
+        &[
+            "vendor",
+            "--revert",
+            "--json",
+            "--cwd",
+            proj.to_str().unwrap(),
+        ],
+        cargo_home,
+    );
+    assert_eq!(
+        code, 0,
+        "{tag}: revert failed.\nstdout:\n{stdout}\nstderr:\n{stderr}"
+    );
+}
+
+/// Copy the committable files (`.cargo/` only when present) to a fresh dir
+/// with an empty CARGO_HOME.
+fn fresh_checkout(proj: &Path, tmp: &Path, tag: &str) -> (PathBuf, PathBuf) {
+    let fresh = tmp.join(format!("fresh-{tag}"));
+    std::fs::create_dir_all(&fresh).unwrap();
+    for file in ["Cargo.toml", "Cargo.lock"] {
+        std::fs::copy(proj.join(file), fresh.join(file)).unwrap();
+    }
+    for dir in ["src", ".socket", ".cargo"] {
+        if proj.join(dir).exists() {
+            copy_dir_recursive(&proj.join(dir), &fresh.join(dir));
+        }
+    }
+    let home = tmp.join(format!("fresh-home-{tag}"));
+    std::fs::create_dir_all(&home).unwrap();
+    (fresh, home)
+}
+
+/// The MULTI-VERSION fixture: a consumer locking cfg-if 1.x AND 0.1.x (a
+/// renamed dependency), its baseline build, and one staged manifest with a
+/// marker patch per version (`UUID` for 1.x, `UUID_OLD` for 0.1.x). `None`
+/// when the fixture build is impossible (skip already printed).
+struct TwoVersions {
+    proj: PathBuf,
+    cargo_home: PathBuf,
+    new_v: String,
+    old_v: String,
+    lock_before: Vec<u8>,
+    manifest_before: Vec<u8>,
+}
+
+fn stage_two_versions(tmp: &Path, tag: &str) -> Option<TwoVersions> {
+    let proj = tmp.join("proj");
+    let cargo_home = tmp.join("cargo-home");
+    std::fs::create_dir_all(proj.join("src")).unwrap();
+    std::fs::create_dir_all(&cargo_home).unwrap();
+    std::fs::write(
+        proj.join("Cargo.toml"),
+        "[package]\nname = \"consumer\"\nversion = \"0.1.0\"\nedition = \"2018\"\n\n\
+         [dependencies]\ncfg-if = \"1.0\"\ncfg_if_old = { package = \"cfg-if\", version = \"0.1\" }\n",
+    )
+    .unwrap();
+    std::fs::write(proj.join("src/main.rs"), "fn main() {}\n").unwrap();
+    let build = cargo(&proj, &["build", "-q"], &cargo_home);
+    if !build.status.success() {
+        let _ = cargo_e2e_matrix::skip(
+            &format!("e2e_vendor_cargo_build ({tag})"),
+            &format!(
+                "baseline `cargo build` failed (crates.io unreachable?):\n{}",
+                String::from_utf8_lossy(&build.stderr)
+            ),
+        );
+        return None;
+    }
+    // The toolchain's own lock format: the matrix re-encoder models one
+    // version per crate (`LockPackage::dependencies` holds names), which a
+    // two-version lock is not.
+    let lock_before = std::fs::read(proj.join("Cargo.lock")).unwrap();
+    let manifest_before = std::fs::read(proj.join("Cargo.toml")).unwrap();
+    let locked: Vec<String> = cargo_e2e_matrix::parse_lock(&String::from_utf8_lossy(&lock_before))
+        .into_iter()
+        .filter(|p| p.name == DEP)
+        .map(|p| p.version)
+        .collect();
+    let new_v = locked
+        .iter()
+        .find(|v| v.starts_with("1."))
+        .expect("cfg-if 1.x locked")
+        .clone();
+    let old_v = locked
+        .iter()
+        .find(|v| v.starts_with("0.1."))
+        .expect("cfg-if 0.1 locked")
+        .clone();
+
+    // One manifest, two patches (one per version), blobs from the real bytes.
+    let mut patches = serde_json::Map::new();
+    std::fs::create_dir_all(proj.join(".socket/blobs")).unwrap();
+    for (version, uuid, suffix) in [
+        (&new_v, UUID, PATCH_SUFFIX),
+        (&old_v, UUID_OLD, PATCH_SUFFIX_OLD),
+    ] {
+        let dir = find_registry_crate(&cargo_home, &format!("{DEP}-{version}"))
+            .unwrap_or_else(|| panic!("{DEP}-{version} extracted"));
+        let orig = std::fs::read(dir.join("src/lib.rs")).unwrap();
+        let patched: Vec<u8> = [orig.as_slice(), suffix.as_bytes()].concat();
+        std::fs::write(
+            proj.join(".socket/blobs").join(git_sha256(&patched)),
+            &patched,
+        )
+        .unwrap();
+        patches.insert(
+            format!("pkg:cargo/{DEP}@{version}"),
+            serde_json::json!({
+                "uuid": uuid,
+                "exportedAt": "2026-01-01T00:00:00Z",
+                "files": { "src/lib.rs": {
+                    "beforeHash": git_sha256(&orig),
+                    "afterHash": git_sha256(&patched),
+                }},
+                "vulnerabilities": {},
+                "description": "multi-version marker patch",
+                "license": "MIT",
+                "tier": "free",
+            }),
+        );
+    }
+    std::fs::write(
+        proj.join(".socket/manifest.json"),
+        serde_json::to_string_pretty(&serde_json::json!({ "patches": patches })).unwrap(),
+    )
+    .unwrap();
+
+    Some(TwoVersions {
+        proj,
+        cargo_home,
+        new_v,
+        old_v,
+        lock_before,
+        manifest_before,
+    })
+}
+
+/// The compile oracle for [`TwoVersions`]: a patched-only symbol from EACH
+/// version.
+const TWO_VERSION_MAIN: &str = "fn main() { println!(\"MARKER:{}:{}\", cfg_if::socket_patched(), cfg_if_old::socket_patched_old()); }\n";
+
+/// MULTI-VERSION: the consumer locks cfg-if 1.x AND 0.1.x (a renamed
+/// dependency). Both are vendored: the second version's `[patch.crates-io]`
+/// entry takes the Socket-owned `cfg-if-socket-<uuid8>` key with
+/// `package = "cfg-if"` (the pre-v5 config wiring keyed by crate name made
+/// the second version clobber the first). The compile oracle calls a
+/// patched-only symbol from EACH version, in place and on a fresh checkout
+/// with an empty CARGO_HOME under `--locked --offline`; the revert restores
+/// Cargo.toml and Cargo.lock byte for byte.
+#[test]
+fn cargo_vendor_two_versions_of_one_crate_locked_build() {
+    if !cargo_e2e_matrix::cargo_available("e2e_vendor_cargo_build (multi-version)") {
+        return;
+    }
+    let tmp = tempfile::tempdir().unwrap();
+    let Some(TwoVersions {
+        proj,
+        cargo_home,
+        new_v,
+        old_v,
+        lock_before,
+        manifest_before,
+    }) = stage_two_versions(tmp.path(), "multi-version")
+    else {
+        return;
+    };
+    let env = vendor_ok(&proj, &cargo_home, "multi-version");
+    assert_eq!(env["summary"]["failed"], 0, "{env}");
+    let manifest = std::fs::read_to_string(proj.join("Cargo.toml")).unwrap();
+    let new_rel = format!(".socket/vendor/cargo/{UUID}/{DEP}-{new_v}");
+    let old_rel = format!(".socket/vendor/cargo/{UUID_OLD}/{DEP}-{old_v}");
+    let entries: Vec<&str> = manifest
+        .lines()
+        .skip_while(|l| l.trim() != "[patch.crates-io]")
+        .skip(1)
+        .collect();
+    assert_eq!(entries.len(), 2, "two entries, distinct keys:\n{manifest}");
+    for (rel, uuid) in [(&new_rel, UUID), (&old_rel, UUID_OLD)] {
+        let line = entries
+            .iter()
+            .find(|l| l.contains(rel.as_str()))
+            .unwrap_or_else(|| panic!("an entry for {rel}:\n{manifest}"));
+        assert_eq!(
+            *line,
+            socket_entry(uuid, rel),
+            "each version takes its own Socket-owned key"
+        );
+    }
+    assert!(!proj.join(".cargo").exists());
+
+    // COMPILE ORACLE: a patched-only symbol from each version.
+    std::fs::write(proj.join("src/main.rs"), TWO_VERSION_MAIN).unwrap();
+    let run = cargo(&proj, &["run", "-q", "--locked", "--offline"], &cargo_home);
+    assert!(
+        run.status.success() && String::from_utf8_lossy(&run.stdout).contains("MARKER:1:2"),
+        "both vendored versions must be linked.\nstdout:\n{}\nstderr:\n{}",
+        String::from_utf8_lossy(&run.stdout),
+        String::from_utf8_lossy(&run.stderr)
+    );
+    let (fresh, home) = fresh_checkout(&proj, tmp.path(), "multi");
+    let build = cargo(&fresh, &["build", "-q", "--locked", "--offline"], &home);
+    assert!(
+        build.status.success(),
+        "fresh multi-version checkout must build:\n{}",
+        String::from_utf8_lossy(&build.stderr)
+    );
+    assert!(!home.join("registry").exists(), "zero crate downloads");
+    let out = Command::new(fresh.join("target/debug/consumer"))
+        .output()
+        .unwrap();
+    assert!(String::from_utf8_lossy(&out.stdout).contains("MARKER:1:2"));
+
+    // Re-vendor is a no-op; revert is byte-identical.
+    let lock_wired = std::fs::read(proj.join("Cargo.lock")).unwrap();
+    vendor_ok(&proj, &cargo_home, "multi-version rerun");
+    assert_eq!(
+        std::fs::read_to_string(proj.join("Cargo.toml")).unwrap(),
+        manifest
+    );
+    assert_eq!(std::fs::read(proj.join("Cargo.lock")).unwrap(), lock_wired);
+    std::fs::write(proj.join("src/main.rs"), "fn main() {}\n").unwrap();
+    revert_ok(&proj, &cargo_home, "multi-version");
+    assert_eq!(
+        std::fs::read(proj.join("Cargo.toml")).unwrap(),
+        manifest_before
+    );
+    assert_eq!(std::fs::read(proj.join("Cargo.lock")).unwrap(), lock_before);
+    assert!(!proj.join(".socket/vendor").exists());
+}
+
+/// Turn the v5 wiring of `proj` into what a pre-v5 release wrote: the
+/// `[patch.crates-io]` entry in `.cargo/config.toml` (Cargo.toml without
+/// it), and the ledger's patch-entry record naming the config.
+fn downgrade_to_legacy_wiring(proj: &Path, purl: &str, copy_rel: &str) {
+    let manifest = std::fs::read_to_string(proj.join("Cargo.toml")).unwrap();
+    std::fs::write(proj.join("Cargo.toml"), strip_patch_table(&manifest)).unwrap();
+    std::fs::create_dir_all(proj.join(".cargo")).unwrap();
+    std::fs::write(
+        proj.join(".cargo/config.toml"),
+        format!("[patch.crates-io]\n{DEP} = {{ path = \"{copy_rel}\" }}\n"),
+    )
+    .unwrap();
+    let state_path = proj.join(".socket/vendor/state.json");
+    let mut state: serde_json::Value =
+        serde_json::from_str(&std::fs::read_to_string(&state_path).unwrap()).unwrap();
+    let wiring = state["entries"][purl]["wiring"].as_array_mut().unwrap();
+    for w in wiring.iter_mut() {
+        if w["kind"] == "cargo_patch_entry" {
+            w["file"] = ".cargo/config.toml".into();
+        }
+    }
+    std::fs::write(&state_path, serde_json::to_string_pretty(&state).unwrap()).unwrap();
+}
+
+fn assert_migrated(proj: &Path, purl: &str, copy_rel: &str, tag: &str) {
+    let manifest = std::fs::read_to_string(proj.join("Cargo.toml")).unwrap();
+    assert!(
+        manifest.contains(&format!(
+            "[patch.crates-io]\n{}",
+            socket_entry(UUID, copy_rel)
+        )),
+        "{tag}: the entry moved into Cargo.toml:\n{manifest}"
+    );
+    assert!(
+        !proj.join(".cargo").exists(),
+        "{tag}: the socket-created legacy config (and .cargo/) are cleaned"
+    );
+    let state: serde_json::Value = serde_json::from_str(
+        &std::fs::read_to_string(proj.join(".socket/vendor/state.json")).unwrap(),
+    )
+    .unwrap();
+    let entry = &state["entries"][purl];
+    let files: Vec<&str> = entry["wiring"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .map(|w| w["file"].as_str().unwrap())
+        .collect();
+    assert_eq!(files, vec!["Cargo.toml", "Cargo.lock"], "{tag}: {entry}");
+    assert_eq!(
+        entry["lock"]["source"], "registry+https://github.com/rust-lang/crates.io-index",
+        "{tag}: the unrecoverable lock originals survive the migration: {entry}"
+    );
+}
+
+/// LEGACY MIGRATION: a project vendored by a pre-v5 release (the
+/// `[patch.crates-io]` entry in `.cargo/config.toml`) still builds, and
+/// both `repair` and a plain `vendor` re-run move the wiring into
+/// Cargo.toml — ledger updated, lock originals kept — after which the
+/// project still builds `--locked --offline` on a fresh checkout and the
+/// revert restores the pristine files.
+#[test]
+fn cargo_legacy_config_wiring_migrates_to_the_manifest() {
+    if !cargo_e2e_matrix::cargo_available("e2e_vendor_cargo_build (legacy-migration)") {
+        return;
+    }
+    let tmp = tempfile::tempdir().unwrap();
+    let Some((proj, cargo_home, version, crate_dir)) =
+        stage_fixture(tmp.path(), "legacy-migration")
+    else {
+        return;
+    };
+    let purl = format!("pkg:cargo/{DEP}@{version}");
+    let copy_rel = format!(".socket/vendor/cargo/{UUID}/{DEP}-{version}");
+    let orig = std::fs::read(crate_dir.join("src/lib.rs")).unwrap();
+    let patched: Vec<u8> = [orig.as_slice(), PATCH_SUFFIX.as_bytes()].concat();
+    stage_patch(&proj, &purl, "src/lib.rs", &orig, &patched);
+    let lock_before = std::fs::read(proj.join("Cargo.lock")).unwrap();
+    let manifest_before = std::fs::read(proj.join("Cargo.toml")).unwrap();
+    vendor_ok(&proj, &cargo_home, "legacy-migration");
+    std::fs::write(
+        proj.join("src/main.rs"),
+        "fn main() { println!(\"MARKER:{}\", cfg_if::socket_patched()); }\n",
+    )
+    .unwrap();
+
+    // The pre-v5 shape builds (config `[patch]`, cargo 1.56+).
+    downgrade_to_legacy_wiring(&proj, &purl, &copy_rel);
+    assert_eq!(
+        std::fs::read(proj.join("Cargo.toml")).unwrap(),
+        manifest_before
+    );
+    let run = cargo(&proj, &["run", "-q", "--locked", "--offline"], &cargo_home);
+    assert!(
+        String::from_utf8_lossy(&run.stdout).contains("MARKER:1"),
+        "the legacy wiring builds: {}",
+        String::from_utf8_lossy(&run.stderr)
+    );
+
+    // (1) `repair` migrates.
+    let (code, stdout, stderr) = run_socket(
+        &proj,
+        &[
+            "repair",
+            "--json",
+            "--offline",
+            "--cwd",
+            proj.to_str().unwrap(),
+        ],
+        &cargo_home,
+    );
+    assert_eq!(
+        code, 0,
+        "repair failed.\nstdout:\n{stdout}\nstderr:\n{stderr}"
+    );
+    assert!(stdout.contains("cargo_wiring_migrated"), "{stdout}");
+    assert_migrated(&proj, &purl, &copy_rel, "repair");
+
+    // (2) A plain `vendor` re-run migrates.
+    downgrade_to_legacy_wiring(&proj, &purl, &copy_rel);
+    let env = vendor_ok(&proj, &cargo_home, "legacy re-run");
+    assert!(env.to_string().contains("cargo_wiring_migrated"), "{env}");
+    assert_migrated(&proj, &purl, &copy_rel, "vendor re-run");
+
+    let run = cargo(&proj, &["run", "-q", "--locked", "--offline"], &cargo_home);
+    assert!(
+        String::from_utf8_lossy(&run.stdout).contains("MARKER:1"),
+        "the migrated wiring builds: {}",
+        String::from_utf8_lossy(&run.stderr)
+    );
+    let (fresh, home) = fresh_checkout(&proj, tmp.path(), "migrated");
+    let build = cargo(&fresh, &["build", "-q", "--locked", "--offline"], &home);
+    assert!(
+        build.status.success(),
+        "fresh migrated checkout must build:\n{}",
+        String::from_utf8_lossy(&build.stderr)
+    );
+    assert!(!home.join("registry").exists());
+
+    // A legacy ledger reverts cleanly too (config + manifest both cleaned).
+    downgrade_to_legacy_wiring(&proj, &purl, &copy_rel);
+    std::fs::write(
+        proj.join("src/main.rs"),
+        "fn main() { println!(\"baseline\"); }\n",
+    )
+    .unwrap();
+    revert_ok(&proj, &cargo_home, "legacy revert");
+    assert_eq!(
+        std::fs::read(proj.join("Cargo.toml")).unwrap(),
+        manifest_before
+    );
+    assert_eq!(std::fs::read(proj.join("Cargo.lock")).unwrap(), lock_before);
+    assert!(!proj.join(".cargo").exists());
+    assert!(!proj.join(".socket/vendor").exists());
+}
+
+/// Set to `1` by the CI leg that installs old toolchains: then finding none
+/// is a failure, not a skip (the regular matrix legs set
+/// `SOCKET_PATCH_CARGO_E2E_REQUIRED` but install no old toolchain).
+const OLD_TOOLCHAINS_REQUIRED_ENV: &str = "SOCKET_PATCH_CARGO_OLD_TOOLCHAINS_REQUIRED";
+
+/// Installed rustup toolchains 1.36 (`--offline`) through 1.56 (the floor of
+/// config-file `[patch]`): `(full toolchain name, minor)`.
+fn old_toolchains() -> Vec<(String, u32)> {
+    let Ok(out) = Command::new("rustup").args(["toolchain", "list"]).output() else {
+        return Vec::new();
+    };
+    String::from_utf8_lossy(&out.stdout)
+        .lines()
+        .filter_map(|line| {
+            let name = line.split_whitespace().next()?.to_string();
+            let minor: u32 = name
+                .strip_prefix("1.")?
+                .split(['.', '-'])
+                .next()?
+                .parse()
+                .ok()?;
+            (36..=56).contains(&minor).then_some((name, minor))
+        })
+        .collect()
+}
+
+/// The old toolchains, or `None` (skip printed) when none is installed —
+/// a failure under [`OLD_TOOLCHAINS_REQUIRED_ENV`].
+fn old_toolchains_or_skip(suite: &str) -> Option<Vec<(String, u32)>> {
+    let toolchains = old_toolchains();
+    if toolchains.is_empty() {
+        assert!(
+            std::env::var(OLD_TOOLCHAINS_REQUIRED_ENV).as_deref() != Ok("1"),
+            "{suite}: no rustup toolchain 1.36..=1.56 installed, and \
+             {OLD_TOOLCHAINS_REQUIRED_ENV}=1 is set"
+        );
+        println!("SKIP {suite}: no rustup toolchain 1.36..=1.56 installed");
+        return None;
+    }
+    Some(toolchains)
+}
+
+/// `cargo check -q --locked` (plus `extra`) on `tc` with a private
+/// CARGO_HOME. `check`, not `build`: old rustc cannot link against a
+/// current Xcode on Apple Silicon, and type-checking the consumer against
+/// the patched-only symbol is already the compile oracle. The network is
+/// made unreachable (a dead proxy), so anything cargo tries to fetch fails.
+fn old_cargo_check(dir: &Path, home: &Path, tc: &str, extra: &[&str]) -> Output {
+    Command::new("cargo")
+        .args(["check", "-q", "--locked"])
+        .args(extra)
+        .current_dir(dir)
+        .env("CARGO_HOME", home)
+        .env("RUSTUP_TOOLCHAIN", tc)
+        .env("CARGO_HTTP_PROXY", "http://127.0.0.1:9")
+        .env("CARGO_NET_RETRY", "0")
+        .env_remove("CARGO_TARGET_DIR")
+        .output()
+        .expect("run old cargo")
+}
+
+/// A current-cargo (v4) registry-only lock rewritten in the format `minor`
+/// reads: for registry sources v3 differs from v4 only in the version
+/// marker, and v2 is v3 without it.
+fn lock_for_minor(lock: &str, minor: u32) -> String {
+    let marker = if minor >= 53 { "version = 3\n" } else { "" };
+    lock.replacen("version = 4\n", marker, 1)
+}
+
+/// OLD TOOLCHAIN: the committed v5 wiring (manifest `[patch]` under the
+/// Socket-owned renamed key + detached lock, in the lock format that
+/// toolchain reads) type-checks the patched copy on every installed
+/// toolchain 1.36..=1.56 — below the 1.56 floor of config-file `[patch]` —
+/// with an empty CARGO_HOME and NO network and NO `--offline`, fetching
+/// nothing. Skips when no such toolchain is installed (never installs one);
+/// the `cargo-old-toolchains` CI leg installs 1.41 and 1.56 and requires it.
+#[test]
+fn cargo_vendored_manifest_patch_builds_on_old_toolchains() {
+    const SUITE: &str = "e2e_vendor_cargo_build (old-toolchain)";
+    let Some(toolchains) = old_toolchains_or_skip(SUITE) else {
+        return;
+    };
+    if !cargo_e2e_matrix::cargo_available(SUITE) {
+        return;
+    }
+    let tmp = tempfile::tempdir().unwrap();
+    let Some((proj, cargo_home, version, crate_dir)) = stage_fixture(tmp.path(), "old-toolchain")
+    else {
+        return;
+    };
+    // Edition 2021 needs cargo 1.56.
+    let manifest = std::fs::read_to_string(proj.join("Cargo.toml")).unwrap();
+    std::fs::write(
+        proj.join("Cargo.toml"),
+        manifest.replace("edition = \"2021\"", "edition = \"2018\""),
+    )
+    .unwrap();
+    let purl = format!("pkg:cargo/{DEP}@{version}");
+    let orig = std::fs::read(crate_dir.join("src/lib.rs")).unwrap();
+    let patched: Vec<u8> = [orig.as_slice(), PATCH_SUFFIX.as_bytes()].concat();
+    stage_patch(&proj, &purl, "src/lib.rs", &orig, &patched);
+    vendor_ok(&proj, &cargo_home, "old-toolchain");
+    assert!(
+        std::fs::read_to_string(proj.join("Cargo.toml"))
+            .unwrap()
+            .contains(&format!("{} = {{ package = ", socket_key(UUID))),
+        "the renamed Socket-owned key is what old cargo must accept"
+    );
+    std::fs::write(
+        proj.join("src/main.rs"),
+        "fn main() { println!(\"MARKER:{}\", cfg_if::socket_patched()); }\n",
+    )
+    .unwrap();
+    let pkgs =
+        cargo_e2e_matrix::parse_lock(&std::fs::read_to_string(proj.join("Cargo.lock")).unwrap());
+    for (tc, minor) in toolchains {
+        let (fresh, home) = fresh_checkout(&proj, tmp.path(), &tc);
+        // The lock format that toolchain writes (v3 from 1.53, v2 from 1.41).
+        let lock_version = if minor >= 53 {
+            3
+        } else if minor >= 41 {
+            2
+        } else {
+            1
+        };
+        std::fs::write(
+            fresh.join("Cargo.lock"),
+            cargo_e2e_matrix::write_lock(&pkgs, lock_version),
+        )
+        .unwrap();
+        let out = old_cargo_check(&fresh, &home, &tc, &[]);
+        assert!(
+            out.status.success(),
+            "{tc}: manifest [patch] + detached lock v{lock_version} must type-check the \
+             patched copy with no network:\n{}",
+            String::from_utf8_lossy(&out.stderr)
+        );
+        assert!(
+            !home.join("registry").exists(),
+            "{tc}: nothing is fetched (not even the registry index)"
+        );
+        println!("old-toolchain {tc}: OK (lock v{lock_version})");
+        let _ = std::fs::remove_dir_all(&fresh);
+    }
+}
+
+/// OLD TOOLCHAIN, TWO VERSIONS of one crate: older cargo loads the
+/// crates.io index to tell two same-named `[patch]` entries apart, so the
+/// committed two-version wiring type-checks on 1.36..=1.56 under
+/// `--offline` (what the docs require there); without `--offline` and with
+/// no network the outcome is only reported (current stable needs neither —
+/// see `cargo_vendor_two_versions_of_one_crate_locked_build`).
+#[test]
+fn cargo_vendored_two_versions_on_old_toolchains_need_offline() {
+    const SUITE: &str = "e2e_vendor_cargo_build (old-toolchain multi-version)";
+    let Some(toolchains) = old_toolchains_or_skip(SUITE) else {
+        return;
+    };
+    if !cargo_e2e_matrix::cargo_available(SUITE) {
+        return;
+    }
+    let tmp = tempfile::tempdir().unwrap();
+    let Some(fx) = stage_two_versions(tmp.path(), "old-toolchain multi-version") else {
+        return;
+    };
+    let env = vendor_ok(&fx.proj, &fx.cargo_home, "old-toolchain multi-version");
+    assert_eq!(env["summary"]["failed"], 0, "{env}");
+    std::fs::write(fx.proj.join("src/main.rs"), TWO_VERSION_MAIN).unwrap();
+    let lock = std::fs::read_to_string(fx.proj.join("Cargo.lock")).unwrap();
+    if !lock.contains("version = 4\n") {
+        let _ = cargo_e2e_matrix::skip(SUITE, "the baseline lock is not v4 (pinned toolchain)");
+        return;
+    }
+    for (tc, minor) in toolchains {
+        let (fresh, home) = fresh_checkout(&fx.proj, tmp.path(), &format!("mv-{tc}"));
+        std::fs::write(fresh.join("Cargo.lock"), lock_for_minor(&lock, minor)).unwrap();
+        let online = old_cargo_check(&fresh, &home, &tc, &[]);
+        println!(
+            "old-toolchain multi-version {tc} without --offline: {}",
+            if online.status.success() {
+                "ok"
+            } else {
+                "needs --offline (registry index unreachable)"
+            }
+        );
+        let out = old_cargo_check(&fresh, &home, &tc, &["--offline"]);
+        assert!(
+            out.status.success(),
+            "{tc}: two vendored versions must type-check under --offline:\n{}",
+            String::from_utf8_lossy(&out.stderr)
+        );
+        let _ = std::fs::remove_dir_all(&fresh);
+    }
+}
+
+/// A root manifest that spells crates.io by URL in `[patch]` (cargo lets
+/// that table replace `[patch.crates-io]` wholesale) is refused with no
+/// write, so the project keeps building `--locked --offline` exactly as
+/// before — never a "success" whose wiring cargo silently ignores.
+#[test]
+fn cargo_url_spelled_crates_io_patch_table_is_refused() {
+    const SUITE: &str = "e2e_vendor_cargo_build (url-patch-table)";
+    if !cargo_e2e_matrix::cargo_available(SUITE) {
+        return;
+    }
+    let tmp = tempfile::tempdir().unwrap();
+    let Some((proj, cargo_home, version, crate_dir)) = stage_fixture(tmp.path(), "url-patch-table")
+    else {
+        return;
+    };
+    // A user's same-version fork of cfg-if under the URL spelling.
+    copy_dir_recursive(&crate_dir, &proj.join("fork-cfg-if"));
+    let manifest = format!(
+        "{}\n[patch.\"https://github.com/rust-lang/crates.io-index\"]\n{DEP} = {{ path = \"fork-cfg-if\" }}\n",
+        std::fs::read_to_string(proj.join("Cargo.toml")).unwrap()
+    );
+    std::fs::write(proj.join("Cargo.toml"), &manifest).unwrap();
+    let relock = cargo(&proj, &["build", "-q", "--offline"], &cargo_home);
+    assert!(
+        relock.status.success(),
+        "{}",
+        String::from_utf8_lossy(&relock.stderr)
+    );
+    let manifest = std::fs::read_to_string(proj.join("Cargo.toml")).unwrap();
+    let lock = std::fs::read(proj.join("Cargo.lock")).unwrap();
+    let purl = format!("pkg:cargo/{DEP}@{version}");
+    let orig = std::fs::read(crate_dir.join("src/lib.rs")).unwrap();
+    let patched: Vec<u8> = [orig.as_slice(), PATCH_SUFFIX.as_bytes()].concat();
+    stage_patch(&proj, &purl, "src/lib.rs", &orig, &patched);
+    let (code, stdout, stderr) = run_socket(
+        &proj,
+        &[
+            "vendor",
+            "--json",
+            "--offline",
+            "--cwd",
+            proj.to_str().unwrap(),
+        ],
+        &cargo_home,
+    );
+    assert!(
+        stdout.contains("cargo_manifest_patch_source_alias"),
+        "exit {code}\nstdout:\n{stdout}\nstderr:\n{stderr}"
+    );
+    assert_eq!(
+        std::fs::read_to_string(proj.join("Cargo.toml")).unwrap(),
+        manifest
+    );
+    assert_eq!(std::fs::read(proj.join("Cargo.lock")).unwrap(), lock);
+    assert!(!proj.join(format!(".socket/vendor/cargo/{UUID}")).exists());
+    let build = cargo(
+        &proj,
+        &["build", "-q", "--locked", "--offline"],
+        &cargo_home,
+    );
+    assert!(
+        build.status.success(),
+        "{}",
+        String::from_utf8_lossy(&build.stderr)
+    );
+}
+
+/// Cargo lets a config-file `[patch]` item — from ANY config it merges,
+/// including an ancestor directory's — replace the manifest item with the
+/// same key regardless of version. The Socket-owned key keeps a user's
+/// crate-named entry added after vendoring from silently building their
+/// unpatched copy: cargo fails loudly on the duplicate patch instead.
+#[test]
+fn cargo_ancestor_config_patch_cannot_silently_shadow_the_vendored_copy() {
+    const SUITE: &str = "e2e_vendor_cargo_build (ancestor-config)";
+    if !cargo_e2e_matrix::cargo_available(SUITE) {
+        return;
+    }
+    let tmp = tempfile::tempdir().unwrap();
+    let Some((proj, cargo_home, version, crate_dir)) = stage_fixture(tmp.path(), "ancestor-config")
+    else {
+        return;
+    };
+    let purl = format!("pkg:cargo/{DEP}@{version}");
+    let orig = std::fs::read(crate_dir.join("src/lib.rs")).unwrap();
+    let patched: Vec<u8> = [orig.as_slice(), PATCH_SUFFIX.as_bytes()].concat();
+    stage_patch(&proj, &purl, "src/lib.rs", &orig, &patched);
+    vendor_ok(&proj, &cargo_home, "ancestor-config");
+    std::fs::write(
+        proj.join("src/main.rs"),
+        "fn main() { println!(\"MARKER:{}\", cfg_if::socket_patched()); }\n",
+    )
+    .unwrap();
+    let run = cargo(&proj, &["run", "-q", "--locked", "--offline"], &cargo_home);
+    assert!(String::from_utf8_lossy(&run.stdout).contains("MARKER:1"));
+
+    // A monorepo-level config adds the user's same-version, unpatched fork
+    // under the bare crate name.
+    let fork = tmp.path().join(format!("forks/{DEP}-{version}"));
+    copy_dir_recursive(&crate_dir, &fork);
+    std::fs::create_dir_all(tmp.path().join(".cargo")).unwrap();
+    std::fs::write(
+        tmp.path().join(".cargo/config.toml"),
+        format!("[patch.crates-io]\n{DEP} = {{ path = \"forks/{DEP}-{version}\" }}\n"),
+    )
+    .unwrap();
+    let run = cargo(&proj, &["run", "-q", "--locked", "--offline"], &cargo_home);
+    let stdout = String::from_utf8_lossy(&run.stdout);
+    let stderr = String::from_utf8_lossy(&run.stderr);
+    assert!(
+        !run.status.success() && !stderr.contains("socket_patched"),
+        "the user's fork must never silently replace the vendored copy \
+         (a loud duplicate-patch error is expected).\nstdout:\n{stdout}\nstderr:\n{stderr}"
+    );
+    // A re-run refuses rather than wiring over the conflict.
+    let (_, out, _) = run_socket(
+        &proj,
+        &[
+            "vendor",
+            "--json",
+            "--offline",
+            "--cwd",
+            proj.to_str().unwrap(),
+        ],
+        &cargo_home,
+    );
+    assert!(out.contains("user_authored_patch_entry"), "{out}");
+}
+
+/// PRE-V5 OVERWRITE: a pre-v5 release keyed the config `[patch]` by crate
+/// name, so vendoring a second version repointed the first version's entry
+/// and left its lock entry detached with no wiring (every `--locked` build
+/// broken). Both a v5 `vendor` re-run and `repair` heal that layout into
+/// two manifest entries that build `--locked --offline`.
+#[test]
+fn cargo_pre_v5_multi_version_overwrite_is_healed() {
+    const SUITE: &str = "e2e_vendor_cargo_build (pre-v5 overwrite)";
+    if !cargo_e2e_matrix::cargo_available(SUITE) {
+        return;
+    }
+    let tmp = tempfile::tempdir().unwrap();
+    let Some(fx) = stage_two_versions(tmp.path(), "pre-v5 overwrite") else {
+        return;
+    };
+    let proj = &fx.proj;
+    let env = vendor_ok(proj, &fx.cargo_home, "pre-v5 overwrite");
+    assert_eq!(env["summary"]["failed"], 0, "{env}");
+    std::fs::write(proj.join("src/main.rs"), TWO_VERSION_MAIN).unwrap();
+    let old_rel = format!(".socket/vendor/cargo/{UUID_OLD}/{DEP}-{}", fx.old_v);
+    let clobber = || {
+        let manifest = std::fs::read_to_string(proj.join("Cargo.toml")).unwrap();
+        std::fs::write(proj.join("Cargo.toml"), strip_patch_table(&manifest)).unwrap();
+        std::fs::create_dir_all(proj.join(".cargo")).unwrap();
+        std::fs::write(
+            proj.join(".cargo/config.toml"),
+            format!("[patch.crates-io]\n{DEP} = {{ path = \"{old_rel}\" }}\n"),
+        )
+        .unwrap();
+        let state_path = proj.join(".socket/vendor/state.json");
+        let mut state: serde_json::Value =
+            serde_json::from_str(&std::fs::read_to_string(&state_path).unwrap()).unwrap();
+        for (_, entry) in state["entries"].as_object_mut().unwrap() {
+            for w in entry["wiring"].as_array_mut().unwrap() {
+                if w["kind"] == "cargo_patch_entry" {
+                    w["file"] = ".cargo/config.toml".into();
+                    w["key"] = DEP.into();
+                }
+            }
+        }
+        std::fs::write(&state_path, serde_json::to_string_pretty(&state).unwrap()).unwrap();
+        let broken = cargo(
+            proj,
+            &["build", "-q", "--locked", "--offline"],
+            &fx.cargo_home,
+        );
+        assert!(!broken.status.success(), "the clobbered layout is broken");
+    };
+    let healed = |tag: &str| {
+        let manifest = std::fs::read_to_string(proj.join("Cargo.toml")).unwrap();
+        assert_eq!(
+            manifest.matches(&format!("{DEP}-socket-")).count(),
+            2,
+            "{tag}: both versions wired:\n{manifest}"
+        );
+        assert!(!proj.join(".cargo").exists(), "{tag}");
+        let run = cargo(
+            proj,
+            &["run", "-q", "--locked", "--offline"],
+            &fx.cargo_home,
+        );
+        assert!(
+            String::from_utf8_lossy(&run.stdout).contains("MARKER:1:2"),
+            "{tag}: both patched versions build:\n{}",
+            String::from_utf8_lossy(&run.stderr)
+        );
+    };
+
+    clobber();
+    vendor_ok(proj, &fx.cargo_home, "pre-v5 overwrite re-run");
+    healed("vendor re-run");
+
+    clobber();
+    let (code, stdout, stderr) = run_socket(
+        proj,
+        &[
+            "repair",
+            "--json",
+            "--offline",
+            "--cwd",
+            proj.to_str().unwrap(),
+        ],
+        &fx.cargo_home,
+    );
+    assert_eq!(
+        code, 0,
+        "repair failed.\nstdout:\n{stdout}\nstderr:\n{stderr}"
+    );
+    healed("repair");
+
+    std::fs::write(proj.join("src/main.rs"), "fn main() {}\n").unwrap();
+    revert_ok(proj, &fx.cargo_home, "pre-v5 overwrite");
+    assert_eq!(
+        std::fs::read(proj.join("Cargo.toml")).unwrap(),
+        fx.manifest_before
+    );
+    assert_eq!(
+        std::fs::read(proj.join("Cargo.lock")).unwrap(),
+        fx.lock_before
+    );
+}
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/cargo.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/cargo.rs
index 1b37e6ff..a3e6c4e6 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/cargo.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/cargo.rs
@@ -41,11 +41,12 @@
 //! `Cargo.toml` `registry = "socket-patch-<uuid>"` (inline / table form),
 //! `.cargo/config.toml` / legacy `.cargo/config` / no project config; lock
 //! v1 (`[metadata]` checksums) / v2 (no `version` key) / v3 / v4;
-//! `registry+` source kind; the committed rewriter golden. Vendored —
-//! `[patch.crates-io]` in `.cargo/config.toml` (inline / sub-table /
-//! `./`-prefixed), legacy `.cargo/config`, the root `Cargo.toml`'s own
-//! `[patch.crates-io]`; the lock entry sourceless (v2 / v3 / v4, and no lock
-//! yet). Embedded: `scan --vex`, `apply --vex` and `vendor --vex` on a
+//! `registry+` source kind; the committed rewriter golden. Vendored — the
+//! root `Cargo.toml`'s `[patch.crates-io]` (what v5 `vendor` writes: inline,
+//! the Socket-owned `<name>-socket-<uuid8>` key with `package =`, sub-table,
+//! `./`-prefixed), and the pre-v5 wiring in `.cargo/config.toml` / legacy
+//! `.cargo/config`; the lock entry sourceless (v1 / v2 / v3 / v4, and no
+//! lock yet). Embedded: `scan --vex`, `apply --vex` and `vendor --vex` on a
 //! manifest-less lockfile-wired project.
 
 //! manifest-less lockfile-wired project.
@@ -617,16 +618,20 @@ fn cargo_artifact(uuid: &str) -> String {
 
 #[derive(Clone, Copy, Debug)]
 enum CargoVendored {
-    /// `.cargo/config.toml` `[patch.crates-io] serde = { path = "…" }`.
+    /// What v5 `vendor` writes: the root `Cargo.toml`'s
+    /// `[patch.crates-io] serde = { path = "…" }`.
     Inline,
-    /// `[patch.crates-io.serde] path = "…"`.
+    /// The Socket-owned fallback key (a second vendored version of the
+    /// crate): `serde-socket-<uuid8> = { package = "serde", path = "…" }`.
+    SocketKey,
+    /// `[patch.crates-io.serde] path = "…"` in the manifest.
     SubTable,
-    /// `./`-prefixed path spelling.
+    /// `./`-prefixed path spelling in the manifest.
     DotSlash,
-    /// Legacy `.cargo/config`.
-    Legacy,
-    /// The root `Cargo.toml`'s own `[patch.crates-io]` (hand-wired).
-    Manifest,
+    /// Pre-v5 wiring: `.cargo/config.toml` `[patch.crates-io]`.
+    LegacyConfigToml,
+    /// Pre-v5 wiring in the legacy extensionless `.cargo/config`.
+    LegacyConfig,
 }
 
 /// The `vendor` cargo backend's committed state: the patched copy dir, the
@@ -641,42 +646,43 @@ fn write_cargo_vendored(fx: &Fx, uuid: &str, flavor: CargoVendored, lib: &[u8])
     fx.put(&format!("{rel}/src/lib.rs"), lib);
     let dep = format!("[dependencies]\n{CRATE} = \"{CRATE_VERSION}\"\n");
     let inline = format!("[patch.crates-io]\n{CRATE} = {{ path = \"{rel}\" }}\n");
+    let manifest = |patch: String| fx.put("Cargo.toml", cargo_toml(&format!("{dep}\n{patch}")));
     match flavor {
-        CargoVendored::Inline => {
-            fx.put("Cargo.toml", cargo_toml(&dep));
-            fx.put(".cargo/config.toml", inline);
-        }
+        CargoVendored::Inline => manifest(inline),
+        CargoVendored::SocketKey => manifest(format!(
+            "[patch.crates-io]\n{CRATE}-socket-{} = {{ package = \"{CRATE}\", path = \"{rel}\" }}\n",
+            &uuid[..8]
+        )),
         CargoVendored::SubTable => {
-            fx.put("Cargo.toml", cargo_toml(&dep));
-            fx.put(
-                ".cargo/config.toml",
-                format!("[patch.crates-io.{CRATE}]\npath = \"{rel}\"\n"),
-            );
+            manifest(format!("[patch.crates-io.{CRATE}]\npath = \"{rel}\"\n"))
         }
-        CargoVendored::DotSlash => {
+        CargoVendored::DotSlash => manifest(format!(
+            "[patch.crates-io]\n{CRATE} = {{ path = \"./{rel}\" }}\n"
+        )),
+        CargoVendored::LegacyConfigToml => {
             fx.put("Cargo.toml", cargo_toml(&dep));
-            fx.put(
-                ".cargo/config.toml",
-                format!("[patch.crates-io]\n{CRATE} = {{ path = \"./{rel}\" }}\n"),
-            );
+            fx.put(".cargo/config.toml", inline);
         }
-        CargoVendored::Legacy => {
+        CargoVendored::LegacyConfig => {
             fx.put("Cargo.toml", cargo_toml(&dep));
             fx.put(".cargo/config", inline);
         }
-        CargoVendored::Manifest => {
-            fx.put("Cargo.toml", cargo_toml(&format!("{dep}\n{inline}")));
-        }
     }
     fx.put("Cargo.lock", cargo_lock(4, ""));
 }
 
-const CARGO_VENDORED_FLAVORS: [CargoVendored; 5] = [
+/// The manifest `write_cargo_vendored` writes, minus the `[patch]` wiring.
+fn cargo_toml_unwired() -> String {
+    cargo_toml(&format!("[dependencies]\n{CRATE} = \"{CRATE_VERSION}\"\n"))
+}
+
+const CARGO_VENDORED_FLAVORS: [CargoVendored; 6] = [
     CargoVendored::Inline,
+    CargoVendored::SocketKey,
     CargoVendored::SubTable,
     CargoVendored::DotSlash,
-    CargoVendored::Legacy,
-    CargoVendored::Manifest,
+    CargoVendored::LegacyConfigToml,
+    CargoVendored::LegacyConfig,
 ];
 
 fn redirect_fixture(rel: &str) -> String {
@@ -1204,7 +1210,7 @@ fn cargo_vendored_c_ledger_record_attests_offline() {
     let fx = Fx::new();
     write_cargo_vendored(&fx, U, CargoVendored::Inline, PATCHED_RS);
     let wiring = [
-        (".cargo/config.toml", "cargo_patch_entry"),
+        ("Cargo.toml", "cargo_patch_entry"),
         ("Cargo.lock", "cargo_lock_entry"),
     ];
     write_vendor_ledger(
@@ -1248,32 +1254,45 @@ fn cargo_vendored_c_ledger_record_attests_offline() {
     );
 }
 
-/// d: the `[patch]` entry removed, the whole config deleted, or the lock
-/// re-resolved from crates.io (an unused patch) — artifact + ledger left
-/// behind → `vendor_unwired`, `--no-verify` or not.
+/// d: the manifest `[patch]` entry removed, a pre-v5 project's whole
+/// config deleted, or the lock re-resolved from crates.io (an unused patch)
+/// — artifact + ledger left behind → `vendor_unwired`, `--no-verify` or not.
 #[test]
 fn cargo_vendored_d_reverted_wiring_never_keeps_the_ledger_alive() {
-    let shapes: [(&str, &Shape); 3] = [
-        ("[patch] entry removed", &|fx: &Fx| {
-            fx.put(".cargo/config.toml", "[net]\nretry = 2\n")
-        }),
-        ("config deleted", &|fx: &Fx| fx.rm(".cargo/config.toml")),
-        ("lock re-resolved from crates.io", &|fx: &Fx| {
-            fx.put(
-                "Cargo.lock",
-                cargo_lock(
-                    4,
-                    &format!(
-                        "source = \"{CRATES_IO}\"\nchecksum = \"{}\"\n",
-                        "c".repeat(64)
+    let shapes: [(&str, CargoVendored, &str, &Shape); 3] = [
+        (
+            "[patch] entry removed",
+            CargoVendored::Inline,
+            "Cargo.toml",
+            &|fx: &Fx| fx.put("Cargo.toml", cargo_toml_unwired()),
+        ),
+        (
+            "legacy config deleted",
+            CargoVendored::LegacyConfigToml,
+            ".cargo/config.toml",
+            &|fx: &Fx| fx.rm(".cargo/config.toml"),
+        ),
+        (
+            "lock re-resolved from crates.io",
+            CargoVendored::Inline,
+            "Cargo.toml",
+            &|fx: &Fx| {
+                fx.put(
+                    "Cargo.lock",
+                    cargo_lock(
+                        4,
+                        &format!(
+                            "source = \"{CRATES_IO}\"\nchecksum = \"{}\"\n",
+                            "c".repeat(64)
+                        ),
                     ),
-                ),
-            )
-        }),
+                )
+            },
+        ),
     ];
-    for (name, revert) in shapes {
+    for (name, flavor, wiring_file, revert) in shapes {
         let fx = Fx::new();
-        write_cargo_vendored(&fx, U, CargoVendored::Inline, PATCHED_RS);
+        write_cargo_vendored(&fx, U, flavor, PATCHED_RS);
         write_vendor_ledger(
             &fx,
             "cargo",
@@ -1282,7 +1301,7 @@ fn cargo_vendored_d_reverted_wiring_never_keeps_the_ledger_alive() {
             &cargo_artifact(U),
             Some(cargo_record(U)),
             &[
-                (".cargo/config.toml", "cargo_patch_entry"),
+                (wiring_file, "cargo_patch_entry"),
                 ("Cargo.lock", "cargo_lock_entry"),
             ],
         );
@@ -1324,7 +1343,9 @@ fn cargo_vendored_d_patch_shadowed_by_a_path_dependency_is_unwired() {
     fx.put(
         "Cargo.toml",
         cargo_toml(&format!(
-            "[dependencies]\n{CRATE} = {{ path = \"my-serde\" }}\n"
+            "[dependencies]\n{CRATE} = {{ path = \"my-serde\" }}\n\n\
+             [patch.crates-io]\n{CRATE} = {{ path = \"{}\" }}\n",
+            cargo_artifact(U)
         )),
     );
     fx.put(
@@ -1352,7 +1373,7 @@ fn cargo_vendored_d_patch_shadowed_by_a_path_dependency_is_unwired() {
         &cargo_artifact(U),
         Some(cargo_record(U)),
         &[
-            (".cargo/config.toml", "cargo_patch_entry"),
+            ("Cargo.toml", "cargo_patch_entry"),
             ("Cargo.lock", "cargo_lock_entry"),
         ],
     );
@@ -1383,7 +1404,7 @@ fn cargo_vendored_e_tampered_artifact_member_is_omitted() {
         U,
         &cargo_artifact(U),
         Some(cargo_record(U)),
-        &[(".cargo/config.toml", "cargo_patch_entry")],
+        &[("Cargo.toml", "cargo_patch_entry")],
     );
     let run = fx.vex(&["--offline"]);
     assert_omitted(&run, CARGO_PURL, "vendor_hash_mismatch", "ledger");
@@ -1405,8 +1426,11 @@ fn cargo_vendored_f_spoofed_references_never_attest() {
         let fx = Fx::new();
         write_cargo_vendored(&fx, U, CargoVendored::Inline, PATCHED_RS);
         fx.put(
-            ".cargo/config.toml",
-            format!("[patch.crates-io]\n{CRATE} = {{ path = \"{path}\" }}\n"),
+            "Cargo.toml",
+            format!(
+                "{}\n[patch.crates-io]\n{CRATE} = {{ path = \"{path}\" }}\n",
+                cargo_toml_unwired()
+            ),
         );
         let run = fx.vex(&["--proxy-url", &api.uri()]);
         assert_ne!(run.code, Some(0), "{name}: {}", run.env);
@@ -1478,7 +1502,7 @@ fn cargo_vendored_injected_file_needs_the_ledger_inventory() {
         U,
         &rel,
         Some(cargo_record(U)),
-        &[(".cargo/config.toml", "cargo_patch_entry")],
+        &[("Cargo.toml", "cargo_patch_entry")],
     );
     let state_path = ".socket/vendor/state.json";
     let mut state: Value = serde_json::from_str(&fx.read(state_path)).unwrap();
@@ -1520,12 +1544,10 @@ fn write_cargo_mixed(fx: &Fx) {
     let toml = fx.read("Cargo.toml");
     fx.put(
         "Cargo.toml",
-        format!("{toml}{CRATE2} = \"{CRATE2_VERSION}\"\n"),
-    );
-    let config = fx.read(".cargo/config.toml");
-    fx.put(
-        ".cargo/config.toml",
-        format!("{config}\n[patch.crates-io]\n{CRATE2} = {{ path = \"{rel}\" }}\n"),
+        format!(
+            "{toml}{CRATE2} = \"{CRATE2_VERSION}\"\n\n[patch.crates-io]\n\
+             {CRATE2} = {{ path = \"{rel}\" }}\n"
+        ),
     );
     let lock = fx.read("Cargo.lock").replace(
         "dependencies = [\n \"serde\",\n]",
diff --git a/crates/socket-patch-cli/tests/e2e_vex_vendor.rs b/crates/socket-patch-cli/tests/e2e_vex_vendor.rs
index 3d13f2e8..f5550a65 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_vendor.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_vendor.rs
@@ -116,13 +116,17 @@ fn make_record(
     }
 }
 
+/// The consumer manifest the cargo fixtures wire their `[patch]` into.
+const CARGO_MANIFEST_HEAD: &str =
+    "[package]\nname = \"app\"\nversion = \"1.0.0\"\n\n[dependencies]\nserde = \"1\"\n\n";
+
 /// The serde artifact every cargo-shaped fixture below vendors.
 fn serde_artifact_rel() -> String {
     format!(".socket/vendor/cargo/{UUID}/serde-1.0.0")
 }
 
 /// Wire the vendored serde crate the way `vendor`'s cargo backend does
-/// (`.cargo/config.toml` `[patch.crates-io]`) and return the ledger's
+/// (the root `Cargo.toml`'s `[patch.crates-io]`) and return the ledger's
 /// record of that edit.
 ///
 /// Every vendor-ledger fixture carries live wiring because `vex` now only
@@ -131,18 +135,16 @@ fn serde_artifact_rel() -> String {
 /// with the artifact and ledger left behind) is omitted as
 /// `vendor_unwired` — see `unwired_vendor_ledger_entry_is_not_attested`.
 fn write_cargo_wiring(cwd: &Path) -> WiringRecord {
-    let dir = cwd.join(".cargo");
-    std::fs::create_dir_all(&dir).unwrap();
     std::fs::write(
-        dir.join("config.toml"),
+        cwd.join("Cargo.toml"),
         format!(
-            "[patch.crates-io]\nserde = {{ path = \"{}\" }}\n",
+            "{CARGO_MANIFEST_HEAD}[patch.crates-io]\nserde = {{ path = \"{}\" }}\n",
             serde_artifact_rel()
         ),
     )
     .unwrap();
     WiringRecord {
-        file: ".cargo/config.toml".to_string(),
+        file: "Cargo.toml".to_string(),
         kind: "cargo_patch_entry".to_string(),
         action: WiringAction::Added,
         key: Some("serde".to_string()),
@@ -153,7 +155,7 @@ fn write_cargo_wiring(cwd: &Path) -> WiringRecord {
 
 /// Write a `.socket/vendor/state.json` ledger with one cargo-style
 /// (dir-shaped) entry for `purl` whose artifact lives at `rel_path`, plus
-/// the entry's live `.cargo/config.toml` wiring.
+/// the entry's live root `Cargo.toml` wiring.
 fn write_vendor_state(cwd: &Path, purl: &str, rel_path: &str) {
     let wiring = write_cargo_wiring(cwd);
     let mut state = VendorState::new();
@@ -606,7 +608,7 @@ fn golang_go_patches_redirect_attested_without_module_cache() {
 
 /// Ledger writer for the detached shape: `detached: true` plus the
 /// embedded record that replaces the manifest as verification source, and
-/// the entry's live `.cargo/config.toml` wiring.
+/// the entry's live root `Cargo.toml` wiring.
 fn write_detached_vendor_state(cwd: &Path, purl: &str, rel_path: &str, record: PatchRecord) {
     let wiring = write_cargo_wiring(cwd);
     let mut state = VendorState::new();
@@ -890,9 +892,9 @@ fn write_matrix_wiring(cwd: &Path, eco: &str, uuid: &str, rel: &str) -> WiringRe
             .to_string(),
         ),
         "cargo" => (
-            ".cargo/config.toml",
+            "Cargo.toml",
             "cargo_patch_entry",
-            format!("[patch.crates-io]\nserde = {{ path = \"{rel}\" }}\n"),
+            format!("{CARGO_MANIFEST_HEAD}[patch.crates-io]\nserde = {{ path = \"{rel}\" }}\n"),
         ),
         "golang" => (
             "go.mod",
@@ -1770,7 +1772,7 @@ fn unwired_vendor_ledger_entry_is_not_attested() {
     write_manifest(cwd, &manifest, true);
     // The lockfile/config wiring is reverted by hand; the artifact and the
     // ledger entry stay behind.
-    std::fs::remove_file(cwd.join(".cargo/config.toml")).unwrap();
+    std::fs::write(cwd.join("Cargo.toml"), CARGO_MANIFEST_HEAD).unwrap();
 
     for extra in [&[][..], &["--no-verify"][..]] {
         let (code, env) = vex_json(cwd, extra);
@@ -2232,18 +2234,22 @@ fn rejected_vendored_wiring_never_keeps_a_vendor_ledger_alive() {
             uuid: cargo_uuid,
             rel: cargo_rel.clone(),
             member: "src/lib.rs",
-            wiring: vec![".cargo/config.toml", "Cargo.lock"],
+            wiring: vec!["Cargo.toml", "Cargo.lock"],
             stale: vec![
                 (
-                    ".cargo/config.toml",
-                    format!("[patch.crates-io]\nserde = {{ path = \"{cargo_rel}\" }}\n"),
+                    "Cargo.toml",
+                    format!(
+                        "{CARGO_MANIFEST_HEAD}[patch.crates-io]\nserde = {{ path = \"{cargo_rel}\" }}\n"
+                    ),
                 ),
                 ("Cargo.lock", cargo_lock(&crates_io)),
             ],
             live: vec![
                 (
-                    ".cargo/config.toml",
-                    format!("[patch.crates-io]\nserde = {{ path = \"{cargo_rel}\" }}\n"),
+                    "Cargo.toml",
+                    format!(
+                        "{CARGO_MANIFEST_HEAD}[patch.crates-io]\nserde = {{ path = \"{cargo_rel}\" }}\n"
+                    ),
                 ),
                 ("Cargo.lock", cargo_lock("")),
             ],
diff --git a/crates/socket-patch-cli/tests/mode_migration_cargo.rs b/crates/socket-patch-cli/tests/mode_migration_cargo.rs
index a159d83b..44ef3ef1 100644
--- a/crates/socket-patch-cli/tests/mode_migration_cargo.rs
+++ b/crates/socket-patch-cli/tests/mode_migration_cargo.rs
@@ -1,5 +1,9 @@
 //! Real-cargo mode-migration e2e: vendored ⇄ hosted takeovers must leave the
-//! project FULLY in the new mode — or refuse.
+//! project FULLY in the new mode — or refuse. The vendored wiring is the
+//! root `Cargo.toml`'s `[patch.crates-io]` (v5); the hosted wiring is the
+//! `registry = "socket-patch-<uuid>"` pin in the same manifest plus the
+//! `.cargo/config.toml` registry block — so both directions edit Cargo.toml
+//! and each must leave none of the other mode's lines behind.
 //!
 //! Adapted from the audit probes that empirically proved findings C1–C7 (the
 //! cargo mode-takeover bug class): both directions used to exit 0 while
@@ -583,9 +587,10 @@ async fn vendored_then_hosted_takeover_leaves_pure_hosted() {
     // The project is FULLY hosted: no leftover [patch.crates-io], no vendored
     // ledger claim, no committed vendor tree; the hosted wiring is present.
     let config = read(&proj, ".cargo/config.toml");
+    let toml = read(&proj, "Cargo.toml");
     assert!(
-        !config.contains("[patch.crates-io]"),
-        "leftover [patch.crates-io] breaks every --locked build (C1): {config}"
+        !config.contains("[patch.crates-io]") && !toml.contains("[patch.crates-io]"),
+        "leftover [patch.crates-io] breaks every --locked build (C1): {toml}\n{config}"
     );
     assert!(
         config.contains(&format!("[registries.socket-patch-{UUID_H}]")),
@@ -751,8 +756,13 @@ async fn hosted_then_vendored_takeover_leaves_pure_vendored() {
         "the hosted registry pin must be reverted (C2 — [patch.crates-io] \
          cannot apply over it and the project is unbuildable): {toml}"
     );
+    assert!(
+        toml.contains("[patch.crates-io]")
+            && toml.contains(&format!(".socket/vendor/cargo/{UUID_V}/")),
+        "the vendored wiring lives in Cargo.toml: {toml}"
+    );
     let config = read(&proj, ".cargo/config.toml");
-    assert!(config.contains("[patch.crates-io]"), "{config}");
+    assert!(!config.contains("[patch.crates-io]"), "{config}");
     assert!(
         !config.contains("[registries.socket-patch-"),
         "the now-unused registries block must be dropped: {config}"
@@ -809,7 +819,8 @@ async fn hosted_then_vendored_takeover_leaves_pure_vendored() {
     );
     assert_eq!(read(&proj, "Cargo.toml"), toml_pristine);
     assert!(
-        !read(&proj, ".cargo/config.toml").contains("[patch.crates-io]"),
+        !read(&proj, ".cargo/config.toml").contains("[patch.crates-io]")
+            && !read(&proj, "Cargo.toml").contains("[patch.crates-io]"),
         "vendored wiring gone after revert"
     );
 }
@@ -947,6 +958,10 @@ async fn double_takeover_a_b_a_preserves_lock_originals() {
     assert_eq!(read(&proj, "Cargo.toml"), toml_pristine);
     let config = read(&proj, ".cargo/config.toml");
     assert!(!config.contains("[patch.crates-io]"), "{config}");
+    assert!(
+        !proj.join(".cargo").exists(),
+        "no .cargo/ residue: {config}"
+    );
 }
 
 // ── FAIL CLOSED: vendoring over a hosted redirect with no ledger refuses ────
@@ -1015,5 +1030,6 @@ async fn vendor_over_hosted_without_ledger_is_refused() {
     assert_eq!(read(&proj, "Cargo.toml"), toml_before);
     assert_eq!(read(&proj, "Cargo.lock"), lock_before);
     assert!(!read(&proj, ".cargo/config.toml").contains("[patch.crates-io]"));
+    assert!(!read(&proj, "Cargo.toml").contains("[patch.crates-io]"));
     assert!(!vendor_ledger_claims(&proj, &purl));
 }
diff --git a/crates/socket-patch-core/src/vendor/cargo.rs b/crates/socket-patch-core/src/vendor/cargo.rs
index 57640c3d..875eb772 100644
--- a/crates/socket-patch-core/src/vendor/cargo.rs
+++ b/crates/socket-patch-core/src/vendor/cargo.rs
@@ -2,31 +2,38 @@
 //!
 //! Materialises a patched copy of the crate under
 //! `.socket/vendor/cargo/<patch-uuid>/<name>-<version>/`, points cargo at it
-//! with a `[patch.crates-io]` path entry in `.cargo/config.toml`
-//! ([`super::cargo_config`]), and surgically detaches the crate's
+//! with a `[patch.crates-io]` path entry in the workspace-root `Cargo.toml`
+//! ([`super::cargo_manifest`]), and surgically detaches the crate's
 //! `Cargo.lock` entry from the registry ([`super::cargo_lock`]) — without the
 //! lock edit, `cargo build --locked` fails closed on the un-relocked `[patch]`
 //! (spike-verified; the whole wiring is proven offline-from-Socket on a fresh
 //! checkout with an empty `CARGO_HOME` — `spikes/PHASE0-FINDINGS.txt`).
 //!
+//! Pre-v5 releases wrote the same entry to `.cargo/config.toml` (or the
+//! legacy `.cargo/config`); a re-run over that wiring moves it into the
+//! manifest (`cargo_wiring_migrated`), and every revert removes both
+//! spellings ([`super::cargo_config`] owns the legacy reader and cleanup).
+//!
 //! The copy is produced by **delegating to the hardened
 //! [`apply_package_patch`] pipeline** pointed at the fresh copy, so all the
 //! verify → package/diff/blob → atomic-write machinery is reused unchanged.
 
-use std::path::Path;
+use std::path::{Path, PathBuf};
 
 use crate::manifest::schema::PatchRecord;
 use crate::patch::apply::{ApplyResult, PatchSources};
 use crate::patch::copy_tree::{fresh_copy, remove_tree};
 use crate::patch::path_safety::is_safe_single_segment;
-use crate::utils::fs::read_regular_to_string;
+use crate::utils::fs::{is_symlink, read_regular_to_string};
 use crate::utils::purl::{parse_cargo_purl, strip_purl_qualifiers};
 
 use super::cargo_config;
 use super::cargo_lock::{self, LockEditError};
+use super::cargo_manifest;
 use super::common::{
-    already_patched_result, copy_matches_after_hashes, done, prune_empty_vendor_levels, refused,
-    service_offline_conflict, stage_dir_for, swap_stage_into_place, synthesized_result,
+    already_patched_result, copy_matches_after_hashes, done, prune_empty_vendor_levels,
+    refuse_symlinked, refused, service_offline_conflict, stage_dir_for, swap_stage_into_place,
+    synthesized_result,
 };
 use super::path::vendor_uuid_dir_rel;
 use super::registry_fetch::extract_tgz;
@@ -65,7 +72,8 @@ async fn is_vendored(project_root: &Path, name: &str, version: &str) -> bool {
 ///   socket-patch takeover) → `Some(false)` — the committed copy is NOT what
 ///   the lock consumes, so GC may reclaim the entry (its revert restores /
 ///   keeps the registry resolution and drops the dead `[patch]` wiring);
-/// * entry detached AND the `[patch.crates-io]` entry points at THIS entry's
+/// * entry detached AND a Socket-owned `[patch.crates-io]` entry (root
+///   manifest, or a legacy project-config one) points at THIS entry's
 ///   committed copy → `Some(true)` (the wired vendored shape);
 /// * detached but the `[patch]` points elsewhere / is gone → `Some(false)`
 ///   (nothing consumes the copy; the revert re-attaches the recorded
@@ -79,11 +87,13 @@ pub async fn vendored_entry_in_use(entry: &VendorEntry, project_root: &Path) ->
         cargo_lock::LockEntryProbe::Source(_) => Some(false),
         cargo_lock::LockEntryProbe::Detached => {
             let marker = vendor_uuid_dir_rel("cargo", &entry.uuid)?;
-            let entries = cargo_config::read_patch_entries(project_root).await;
-            let wired = entries
-                .get(name)
-                .and_then(|i| i.path.as_deref())
-                .is_some_and(|p| p.replace('\\', "/").starts_with(&format!("{marker}/")));
+            let wired = socket_patch_paths(project_root, name)
+                .await
+                .iter()
+                .any(|p| {
+                    cargo_manifest::normalize_socket_path(p)
+                        .is_some_and(|n| n.starts_with(&format!("{marker}/")))
+                });
             Some(wired)
         }
     }
@@ -127,22 +137,6 @@ async fn hosted_redirect_residue(project_root: &Path, name: &str, version: &str)
     None
 }
 
-/// The config `[patch]` entry points at THIS copy and the lock entry no
-/// longer needs detaching: either there is no lockfile (nothing to edit — the
-/// first build generates a path-form lock), or the entry exists with no
-/// `source` (already detached). The lock half is probed via a dry-run detach:
-/// `NotRegistry` *is* the detached shape.
-async fn wiring_in_sync(project_root: &Path, name: &str, version: &str, copy_rel: &str) -> bool {
-    let entries = cargo_config::read_patch_entries(project_root).await;
-    if entries.get(name).and_then(|i| i.path.as_deref()) != Some(copy_rel) {
-        return false;
-    }
-    matches!(
-        cargo_lock::detach_lock_entry(project_root, name, version, true).await,
-        Err(LockEditError::NotRegistry) | Err(LockEditError::NoLockfile)
-    )
-}
-
 /// Failure cleanup for a staged (re)build: always remove the stage, then
 /// either unwind the whole `<uuid>/` dir (`unwind_uuid_dir` — a fresh vendor
 /// with no pre-existing state worth keeping) or leave existing state
@@ -457,29 +451,87 @@ pub async fn vendor_cargo_crate(
             ),
         );
     }
-    // (c) A user-authored same-name `[patch.crates-io]` entry is never
-    // overwritten. (`ensure_patch_entry` would also refuse, but pre-flighting
-    // it keeps the refusal ahead of any write.)
-    let prior_entry = cargo_config::read_patch_entries(project_root)
-        .await
-        .remove(name);
-    if let Some(info) = &prior_entry {
-        if !info.socket_owned {
+    // (c) The wiring lives in the workspace-root Cargo.toml: it must be a
+    // readable, parseable regular file — and not a symlink, which the
+    // atomic rewrite would replace with a detached copy (leaving the
+    // link's target unwired and the revert unable to restore the link).
+    if let Err((code, detail)) = refuse_symlinked(
+        project_root,
+        &[cargo_manifest::CARGO_TOML],
+        "cargo_manifest_symlink_unsupported",
+    )
+    .await
+    {
+        return refused(code, detail);
+    }
+    let manifest_doc = match cargo_manifest::read_manifest(project_root).await {
+        Ok(text) => match cargo_manifest::parse_manifest(&text) {
+            Ok(doc) => doc,
+            Err(e) => return refused(e.code(), e.detail().to_string()),
+        },
+        Err(e) => {
             return refused(
-                "user_authored_patch_entry",
+                e.code(),
                 format!(
-                    "`patch.crates-io.{name}` in .cargo/config.toml is user-authored \
-                     ({}); refusing to overwrite",
-                    info.path.as_deref().unwrap_or("non-path source")
+                    "{}; the vendored `[patch.crates-io]` entry is written to the \
+                     workspace-root Cargo.toml",
+                    e.detail()
                 ),
-            );
+            )
         }
+    };
+    // (c2) Cargo only honours `[patch]` in the workspace-root manifest, and
+    // a `[patch."<crates.io URL>"]` table there replaces `[patch.crates-io]`
+    // wholesale: either way the entry would be silently ignored.
+    if let Err(e) = cargo_manifest::check_source_alias(&manifest_doc) {
+        return refused(e.code(), e.detail().to_string());
+    }
+    if let Some(detail) = workspace_root_refusal(project_root, &manifest_doc).await {
+        return refused(NOT_WORKSPACE_ROOT, detail);
+    }
+    let manifest_entries = cargo_manifest::crates_io_patch_entries(&manifest_doc);
+    // (d) A user-authored crates.io `[patch]` entry — in the manifest or any
+    // config file cargo merges (project, ancestor directories,
+    // `$CARGO_HOME`) — that overrides, or may override, this crate@version
+    // is never shadowed or overwritten.
+    let chain = cargo_config::read_config_chain(project_root).await;
+    if let Some(detail) =
+        user_patch_conflict(project_root, &manifest_entries, &chain, name, version).await
+    {
+        return refused("user_authored_patch_entry", detail);
     }
 
     let copy_rel = format!("{base_rel}/{name}-{version}");
     let uuid_dir = project_root.join(&base_rel);
     let copy_dir = project_root.join(&copy_rel);
 
+    // The Socket-owned wiring already in place for THIS crate@version: the
+    // manifest entry (v5) and any legacy project-config entries (pre-v5),
+    // which this run migrates into the manifest.
+    let prior_manifest_entry = manifest_entries
+        .iter()
+        .find(|e| e.source == "crates-io" && cargo_manifest::entry_wires(e, name, version));
+    let prior_manifest_path: Option<String> = prior_manifest_entry
+        .and_then(|e| e.path.as_deref())
+        .and_then(cargo_manifest::normalize_socket_path);
+    let legacy_paths: Vec<String> = cargo_config::legacy_socket_entries(project_root, name)
+        .await
+        .into_iter()
+        .filter(|(_, p)| cargo_manifest::is_socket_copy_of(p, name, version))
+        .filter_map(|(_, p)| cargo_manifest::normalize_socket_path(&p))
+        .collect();
+    let reserved = reserved_config_keys(&chain, name, version);
+    // The existing entry's key must still be Socket-owned and unused by any
+    // config file (cargo lets a config item with the same key replace it);
+    // otherwise even an in-sync re-run moves it to a fresh key.
+    let prior_key_ok = prior_manifest_entry
+        .is_some_and(|e| cargo_manifest::is_socket_key(&e.key, name) && !reserved.contains(&e.key));
+    // A copy of THIS crate@version committed by an earlier Socket run (any
+    // uuid) while no wiring points at it: a pre-v5 project whose config
+    // `[patch]` key a second vendored version overwrote. Its lock entry is
+    // already detached — exactly the shape this run produces.
+    let prior_socket_copy = socket_copy_present(project_root, name, version).await;
+
     // A patch with no files is meaningless: no-op success, nothing wired.
     if record.files.is_empty() {
         return done(
@@ -494,7 +546,7 @@ pub async fn vendor_cargo_crate(
         // pipeline never writes when dry_run — for an accurate "would
         // patch" report (including the auto-force overwrite warnings the
         // real run would emit), without creating the copy or editing
-        // config/lock.
+        // manifest/config/lock.
         let mut dry_warnings: Vec<VendorWarning> = Vec::new();
         let mut result = super::force_apply_staged(
             purl,
@@ -510,6 +562,9 @@ pub async fn vendor_cargo_crate(
         .await;
         result.package_path = copy_dir.display().to_string();
         result.sidecar = None;
+        if !legacy_paths.is_empty() {
+            dry_warnings.push(migration_warning(project_root, name, version, true).await);
+        }
         return done(result, None, dry_warnings);
     }
 
@@ -537,31 +592,45 @@ pub async fn vendor_cargo_crate(
         );
     }
 
-    // Hot path: already in sync → touch nothing (entry stays with the caller's
-    // existing ledger record, which holds the unrecoverable lock originals).
-    if wiring_in_sync(project_root, name, version, &copy_rel).await {
-        if copy_matches_after_hashes(&copy_dir, &record.files).await {
-            return done(
-                already_patched_result(purl, &copy_dir, &record.files),
-                None,
-                Vec::new(),
-            );
-        }
-        // Wired but the committed copy is missing/stale: rebuild the
-        // ARTIFACT only — config + lock are already correct, and the full
-        // path's surgery would re-record live vendored state over the
-        // first run's unrecoverable lock originals. The rebuild is staged: a
-        // failure must leave the previous (drifted-but-buildable) copy and
-        // the live wiring exactly as they were, never a deleted copy under a
-        // still-pointing `[patch]` entry. Service-preferred like the full
-        // path, so `--vendor-source=service` never quietly builds locally.
-        if let Some(refusal) = service_offline_conflict(service) {
-            return refusal;
-        }
+    // Wiring (manifest or legacy config) already points at THIS copy.
+    let points_here = prior_manifest_path.as_deref() == Some(copy_rel.as_str())
+        || legacy_paths.contains(&copy_rel);
+
+    // Hot path: the wiring points here and the lock entry needs no detach
+    // (no lockfile — the first build writes a path-form lock — or already
+    // sourceless; a dry-run detach's `NotRegistry` IS the detached shape).
+    // Touch nothing but the artifact; a legacy-only wiring is migrated.
+    if points_here
+        && matches!(
+            cargo_lock::detach_lock_entry(project_root, name, version, true).await,
+            Err(LockEditError::NotRegistry) | Err(LockEditError::NoLockfile)
+        )
+    {
         let mut warnings: Vec<VendorWarning> = Vec::new();
-        let result =
-            match cargo_service_copy(service, record, name, &copy_dir, &uuid_dir, &mut warnings)
-                .await
+        let result = if copy_matches_after_hashes(&copy_dir, &record.files).await {
+            already_patched_result(purl, &copy_dir, &record.files)
+        } else {
+            // Wired but the committed copy is missing/stale: rebuild the
+            // ARTIFACT only — the wiring + lock are already correct, and the
+            // full path's surgery would re-record live vendored state over
+            // the first run's unrecoverable lock originals. The rebuild is
+            // staged: a failure must leave the previous (drifted-but-
+            // buildable) copy and the live wiring exactly as they were,
+            // never a deleted copy under a still-pointing `[patch]` entry.
+            // Service-preferred like the full path, so
+            // `--vendor-source=service` never quietly builds locally.
+            if let Some(refusal) = service_offline_conflict(service) {
+                return refusal;
+            }
+            let result = match cargo_service_copy(
+                service,
+                record,
+                name,
+                &copy_dir,
+                &uuid_dir,
+                &mut warnings,
+            )
+            .await
             {
                 CargoServiceCopy::Used => already_patched_result(purl, &copy_dir, &record.files),
                 CargoServiceCopy::HardFail(outcome) => return *outcome,
@@ -586,27 +655,73 @@ pub async fn vendor_cargo_crate(
                     }
                 }
             };
-        warnings.push(VendorWarning::new(
-            "vendor_artifact_rebuilt",
-            format!(
-                "the committed vendored copy for {name}@{version} was missing or stale; \
-                 rebuilt at {copy_rel} (config and lock untouched)"
-            ),
-        ));
-        // The rebuild may have recreated the whole uuid dir (deleted
-        // wholesale, marker included): restore the committed marker
-        // alongside the copy so the re-committed vendor unit is complete.
-        // Only when missing — a copy-only rebuild keeps the original marker
-        // (and its vendoredAt).
-        if tokio::fs::metadata(uuid_dir.join(VENDOR_MARKER_FILE))
-            .await
-            .is_err()
+            warnings.push(VendorWarning::new(
+                "vendor_artifact_rebuilt",
+                format!(
+                    "the committed vendored copy for {name}@{version} was missing or stale; \
+                     rebuilt at {copy_rel} (wiring and lock untouched)"
+                ),
+            ));
+            // The rebuild may have recreated the whole uuid dir (deleted
+            // wholesale, marker included): restore the committed marker
+            // alongside the copy so the re-committed vendor unit is
+            // complete. Only when missing — a copy-only rebuild keeps the
+            // original marker (and its vendoredAt).
+            if tokio::fs::metadata(uuid_dir.join(VENDOR_MARKER_FILE))
+                .await
+                .is_err()
+            {
+                let marker =
+                    VendorMarker::new("cargo", strip_purl_qualifiers(purl), record, vendored_at);
+                write_marker_or_warn(&uuid_dir, &marker, &mut warnings).await;
+            }
+            result
+        };
+        if prior_manifest_path.as_deref() == Some(copy_rel.as_str())
+            && legacy_paths.is_empty()
+            && prior_key_ok
         {
-            let marker =
-                VendorMarker::new("cargo", strip_purl_qualifiers(purl), record, vendored_at);
-            write_marker_or_warn(&uuid_dir, &marker, &mut warnings).await;
+            // In sync: the entry stays with the caller's existing ledger
+            // record, which holds the unrecoverable lock originals.
+            return done(result, None, warnings);
         }
-        return done(result, None, warnings);
+        // Migration (legacy config → manifest), or a manifest entry moving
+        // off a key a config file now shadows: a fresh entry naming the
+        // manifest wiring; the caller carries the lock originals forward
+        // from the entry it replaces (`carry_forward_wiring`).
+        let mut result = result;
+        let ensured = match cargo_manifest::ensure_patch_entry(
+            project_root,
+            name,
+            version,
+            &record.uuid,
+            &copy_rel,
+            &reserved,
+            false,
+        )
+        .await
+        {
+            Ok(ensured) => ensured,
+            Err(e) => {
+                result.success = false;
+                result.error = Some(format!(
+                    "failed to move the vendored wiring into Cargo.toml: {e} (the legacy \
+                     .cargo/config wiring was left in place)"
+                ));
+                return done(result, None, warnings);
+            }
+        };
+        if let Err(e) =
+            retire_legacy_wiring(project_root, name, version, &legacy_paths, &mut warnings).await
+        {
+            let prior = ensured.prior_path.as_deref();
+            unwind_manifest(project_root, name, version, &record.uuid, prior, &reserved).await;
+            result.success = false;
+            result.error = Some(legacy_kept_error(name, version, &e));
+            return done(result, None, warnings);
+        }
+        let entry = cargo_entry(purl, record, &copy_rel, &ensured, None);
+        return done(result, Some(entry), warnings);
     }
 
     // ── materialise the patched copy ──────────────────────────────────────
@@ -619,13 +734,17 @@ pub async fn vendor_cargo_crate(
     if let Some(refusal) = service_offline_conflict(service) {
         return refusal;
     }
-    // When the pre-existing config entry already points at THIS copy (wiring
-    // out of sync only because of the lock — e.g. it was re-resolved or went
-    // corrupt post-vendor), a failure must not delete the copy that entry
-    // points at: the unwind restores the entry, and removing the uuid dir
-    // would dangle it and break every build.
-    let prior_points_here =
-        prior_entry.as_ref().and_then(|i| i.path.as_deref()) == Some(copy_rel.as_str());
+    // When pre-existing wiring already points at THIS copy (out of sync
+    // only because of the lock — e.g. it was re-resolved or went corrupt
+    // post-vendor), a failure must not delete the copy that wiring points
+    // at: the unwind restores the entry, and removing the uuid dir would
+    // dangle it and break every build.
+    // Likewise a copy an earlier Socket run committed at this very path (the
+    // pre-v5 overwrite shape): the ledger still references it.
+    let prior_points_here = points_here
+        || tokio::fs::metadata(&copy_dir)
+            .await
+            .is_ok_and(|m| m.is_dir());
     let mut result = match cargo_service_copy(
         service,
         record,
@@ -664,22 +783,34 @@ pub async fn vendor_cargo_crate(
         }
     };
 
-    // ── wire the config entry ─────────────────────────────────────────────
-    if let Err(e) = cargo_config::ensure_patch_entry(project_root, name, &copy_rel, false).await {
-        // The config was left untouched on refusal; unwind the copy so no
-        // unwired artifact lingers under .socket/vendor/ — unless the
-        // existing config entry points at this very copy, which deleting
-        // would dangle.
-        if !prior_points_here {
-            let _ = remove_tree(&uuid_dir).await;
+    // ── wire the manifest entry ───────────────────────────────────────────
+    let ensured = match cargo_manifest::ensure_patch_entry(
+        project_root,
+        name,
+        version,
+        &record.uuid,
+        &copy_rel,
+        &reserved,
+        false,
+    )
+    .await
+    {
+        Ok(ensured) => ensured,
+        Err(e) => {
+            // The manifest was left untouched; unwind the copy so no unwired
+            // artifact lingers under .socket/vendor/ — unless existing wiring
+            // points at this very copy, which deleting would dangle.
+            if !prior_points_here {
+                let _ = remove_tree(&uuid_dir).await;
+            }
+            prune_empty_vendor_levels(&uuid_dir).await;
+            result.success = false;
+            result.error = Some(format!("failed to update Cargo.toml: {e}"));
+            return done(result, None, warnings);
         }
-        prune_empty_vendor_levels(&uuid_dir).await;
-        result.success = false;
-        result.error = Some(format!("failed to update .cargo/config.toml: {e}"));
-        return done(result, None, warnings);
-    }
-
-    let prior_path = prior_entry.as_ref().and_then(|i| i.path.clone());
+    };
+    let had_prior_wiring =
+        ensured.prior_path.is_some() || !legacy_paths.is_empty() || prior_socket_copy;
 
     // ── detach the lock entry ─────────────────────────────────────────────
     let lock_original: Option<CargoLockOriginal> =
@@ -694,34 +825,27 @@ pub async fn vendor_cargo_crate(
                 ));
                 None
             }
-            Err(LockEditError::NotRegistry) if prior_path.is_some() => {
+            Err(LockEditError::NotRegistry) if had_prior_wiring => {
                 // Re-vendor over live wiring (a patch update moved the
-                // manifest to a new uuid): the prior socket-owned run already
-                // detached this entry — source-less is exactly the shape we
-                // produce. The lock is in the desired state; the true
-                // pre-vendor originals live only in the ledger entry being
-                // replaced, which the caller carries forward. Record nothing.
+                // manifest to a new uuid, or a legacy config wiring is being
+                // migrated), or over a committed Socket copy whose wiring a
+                // pre-v5 second-version vendor overwrote: the prior
+                // socket-owned run already detached this entry — source-less
+                // is exactly the shape we produce. The true pre-vendor
+                // originals live only in the ledger entry being replaced,
+                // which the caller carries forward.
                 None
             }
             Err(e) => {
                 // Without the lock edit, `--locked` builds fail closed on the
                 // [patch] we just wired — a half-vendored state. UNWIND the
-                // config edit so the project is back where it started:
-                // restore the prior socket-owned entry when this was a
-                // re-vendor (dropping it would destroy the first run's live
-                // wiring), else drop the entry we just added. Remove this
-                // run's copy — unless the restored entry points at it, in
-                // which case deleting it would dangle that entry and break
-                // every build.
-                match prior_path.as_deref() {
-                    Some(p) => {
-                        let _ =
-                            cargo_config::ensure_patch_entry(project_root, name, p, false).await;
-                    }
-                    None => {
-                        let _ = cargo_config::drop_patch_entry(project_root, name, false).await;
-                    }
-                }
+                // manifest edit: restore the prior socket-owned entry when
+                // this was a re-vendor (dropping it would destroy the first
+                // run's live wiring), else drop the entry we just added.
+                // Remove this run's copy — unless restored wiring points at
+                // it, in which case deleting it would dangle that entry.
+                let prior = ensured.prior_path.as_deref();
+                unwind_manifest(project_root, name, version, &record.uuid, prior, &reserved).await;
                 if !prior_points_here {
                     let _ = remove_tree(&uuid_dir).await;
                 }
@@ -729,30 +853,53 @@ pub async fn vendor_cargo_crate(
                 result.success = false;
                 result.error = Some(format!(
                     "failed to detach the Cargo.lock entry for {name}@{version}: {e} \
-                     (the config edit was unwound and nothing new was vendored)"
+                     (the Cargo.toml edit was unwound and nothing new was vendored)"
                 ));
                 return done(result, None, warnings);
             }
         };
 
+    // ── retire the legacy config wiring (migration) ───────────────────────
+    // A legacy entry that cannot be removed would keep pointing at its copy
+    // — which the caller's stale sweep deletes on a uuid bump — and would
+    // double-wire the crate beside the manifest entry: unwind everything.
+    if let Err(e) =
+        retire_legacy_wiring(project_root, name, version, &legacy_paths, &mut warnings).await
+    {
+        if let Some(orig) = &lock_original {
+            let _ = cargo_lock::restore_lock_entry(project_root, name, version, orig, false).await;
+        }
+        let prior = ensured.prior_path.as_deref();
+        unwind_manifest(project_root, name, version, &record.uuid, prior, &reserved).await;
+        if !prior_points_here {
+            let _ = remove_tree(&uuid_dir).await;
+        }
+        prune_empty_vendor_levels(&uuid_dir).await;
+        result.success = false;
+        result.error = Some(legacy_kept_error(name, version, &e));
+        return done(result, None, warnings);
+    }
+
     // ── marker + ledger entry ─────────────────────────────────────────────
-    let base_purl = strip_purl_qualifiers(purl).to_string();
-    let marker = VendorMarker::new("cargo", &base_purl, record, vendored_at);
+    let marker = VendorMarker::new("cargo", strip_purl_qualifiers(purl), record, vendored_at);
     write_marker_or_warn(&uuid_dir, &marker, &mut warnings).await;
 
-    let mut wiring = vec![WiringRecord {
-        file: ".cargo/config.toml".to_string(),
-        kind: "cargo_patch_entry".to_string(),
-        action: if prior_path.is_some() {
-            WiringAction::Rewritten
-        } else {
-            WiringAction::Added
-        },
-        key: Some(name.to_string()),
-        original: prior_path.map(serde_json::Value::from),
-        new: Some(serde_json::Value::from(copy_rel.clone())),
-    }];
-    if let Some(orig) = &lock_original {
+    let entry = cargo_entry(purl, record, &copy_rel, &ensured, lock_original);
+    done(result, Some(entry), warnings)
+}
+
+/// The ledger entry for a wired cargo vendor: the manifest `[patch]` record
+/// plus, when this run detached the lock, the lock record and originals.
+fn cargo_entry(
+    purl: &str,
+    record: &PatchRecord,
+    copy_rel: &str,
+    ensured: &cargo_manifest::Ensured,
+    lock_original: Option<CargoLockOriginal>,
+) -> VendorEntry {
+    let base_purl = strip_purl_qualifiers(purl).to_string();
+    let mut wiring = vec![manifest_wiring_record(ensured, copy_rel)];
+    if let (Some(orig), Some((name, version))) = (&lock_original, parse_cargo_purl(&base_purl)) {
         wiring.push(WiringRecord {
             file: "Cargo.lock".to_string(),
             kind: "cargo_lock_entry".to_string(),
@@ -765,13 +912,12 @@ pub async fn vendor_cargo_crate(
             new: None,
         });
     }
-
-    let entry = VendorEntry {
+    VendorEntry {
         ecosystem: "cargo".to_string(),
         base_purl,
         uuid: record.uuid.clone(),
         artifact: VendorArtifact {
-            path: copy_rel,
+            path: copy_rel.to_string(),
             sha256: String::new(), // dir-shaped: integrity is per-file afterHashes
             size: None,
             platform_locked: None,
@@ -788,14 +934,423 @@ pub async fn vendor_cargo_crate(
         poetry: None,
         pdm: None,
         pipenv: None,
+    }
+}
+
+/// The `Cargo.toml` `cargo_patch_entry` wiring record: `key` is the TOML key
+/// the entry lives under, `original` the Socket-owned path a pre-existing
+/// manifest entry held (a re-vendor), `new` the copy path.
+fn manifest_wiring_record(ensured: &cargo_manifest::Ensured, copy_rel: &str) -> WiringRecord {
+    WiringRecord {
+        file: cargo_manifest::CARGO_TOML.to_string(),
+        kind: "cargo_patch_entry".to_string(),
+        action: if ensured.prior_path.is_some() {
+            WiringAction::Rewritten
+        } else {
+            WiringAction::Added
+        },
+        key: Some(ensured.key.clone()),
+        original: ensured.prior_path.clone().map(serde_json::Value::from),
+        new: Some(serde_json::Value::from(copy_rel.to_string())),
+    }
+}
+
+/// The `cargo_wiring_migrated` advisory.
+async fn migration_warning(
+    project_root: &Path,
+    name: &str,
+    version: &str,
+    dry_run: bool,
+) -> VendorWarning {
+    let config = cargo_config::effective_config_rel(project_root).await;
+    VendorWarning::new(
+        "cargo_wiring_migrated",
+        format!(
+            "{} the vendored `[patch.crates-io]` entry for {name}@{version} from {config} \
+             to the workspace-root Cargo.toml",
+            if dry_run { "would move" } else { "moved" }
+        ),
+    )
+}
+
+/// Drop the legacy project-config entries for `name@version` once the
+/// manifest carries the wiring (warning `cargo_wiring_migrated`). `Err` when
+/// they could not be removed — the caller unwinds: a kept legacy entry
+/// double-wires the crate beside the manifest entry and, on a uuid bump,
+/// points at a copy the stale sweep deletes.
+async fn retire_legacy_wiring(
+    project_root: &Path,
+    name: &str,
+    version: &str,
+    legacy_paths: &[String],
+    warnings: &mut Vec<VendorWarning>,
+) -> Result<(), String> {
+    if legacy_paths.is_empty() {
+        return Ok(());
+    }
+    cargo_config::drop_legacy_patch_entries(project_root, name, version, false).await?;
+    warnings.push(migration_warning(project_root, name, version, false).await);
+    Ok(())
+}
+
+/// The failure for a legacy config entry [`retire_legacy_wiring`] could not
+/// remove.
+fn legacy_kept_error(name: &str, version: &str, detail: &str) -> String {
+    format!(
+        "cargo_legacy_wiring_kept: the pre-v5 .cargo/config wiring for {name}@{version} \
+         could not be removed ({detail}); the Cargo.toml edit was unwound and nothing \
+         new was vendored — make the config writable and re-run"
+    )
+}
+
+/// Undo this run's manifest edit: restore the prior Socket-owned entry for
+/// `name@version` (a re-vendor), else drop the entry this run added.
+/// Best-effort — the caller is already failing.
+async fn unwind_manifest(
+    project_root: &Path,
+    name: &str,
+    version: &str,
+    uuid: &str,
+    prior: Option<&str>,
+    reserved: &[String],
+) {
+    match prior {
+        Some(p) => {
+            let _ = cargo_manifest::ensure_patch_entry(
+                project_root,
+                name,
+                version,
+                uuid,
+                p,
+                reserved,
+                false,
+            )
+            .await;
+        }
+        None => {
+            let _ = cargo_manifest::drop_patch_entries(project_root, name, version, false).await;
+        }
+    }
+}
+
+/// The refusal code for a project directory whose Cargo.toml is not the
+/// workspace root (cargo ignores `[patch]` in member manifests).
+pub const NOT_WORKSPACE_ROOT: &str = "cargo_manifest_not_workspace_root";
+
+/// `Some(detail)` when `<project_root>/Cargo.toml` is not the workspace
+/// root cargo reads `[patch]` from: it names another root
+/// (`package.workspace`), or — having no `[workspace]` table of its own —
+/// an ancestor directory's `[workspace]` claims it (cargo's own
+/// `find_root`: the nearest ancestor workspace that does not `exclude` it;
+/// an unparseable ancestor manifest is skipped).
+async fn workspace_root_refusal(
+    project_root: &Path,
+    doc: &toml_edit::DocumentMut,
+) -> Option<String> {
+    if doc
+        .get("workspace")
+        .is_some_and(toml_edit::Item::is_table_like)
+    {
+        return None;
+    }
+    let hint = "cargo ignores `[patch]` outside the workspace-root manifest; run socket-patch \
+                from the workspace root (the directory holding its Cargo.toml and Cargo.lock)";
+    if let Some(ws) = doc
+        .get("package")
+        .and_then(toml_edit::Item::as_table_like)
+        .and_then(|p| p.get("workspace"))
+        .and_then(toml_edit::Item::as_str)
+    {
+        return Some(format!(
+            "Cargo.toml sets `package.workspace = \"{ws}\"`, so it is a workspace member, not \
+             the root; {hint}"
+        ));
+    }
+    let root = tokio::fs::canonicalize(project_root)
+        .await
+        .unwrap_or_else(|_| project_root.to_path_buf());
+    for ancestor in root.ancestors().skip(1) {
+        if ancestor.ends_with("target/package") {
+            break;
+        }
+        let manifest = ancestor.join(cargo_manifest::CARGO_TOML);
+        let Ok(text) = read_regular_to_string(&manifest).await else {
+            continue;
+        };
+        let Ok(ancestor_doc) = cargo_manifest::parse_manifest(&text) else {
+            continue;
+        };
+        let Some(ws) = ancestor_doc
+            .get("workspace")
+            .and_then(toml_edit::Item::as_table_like)
+        else {
+            continue;
+        };
+        let rel = root.strip_prefix(ancestor).ok()?;
+        let listed = |key: &str| {
+            ws.get(key)
+                .and_then(toml_edit::Item::as_array)
+                .is_some_and(|paths| {
+                    paths.iter().filter_map(|v| v.as_str()).any(|p| {
+                        let p = p.trim_start_matches("./").trim_end_matches('/');
+                        !p.is_empty() && rel.starts_with(p)
+                    })
+                })
+        };
+        if listed("exclude") && !listed("members") {
+            continue;
+        }
+        return Some(format!(
+            "{} is a member of the cargo workspace rooted at {}; {hint}",
+            project_root.display(),
+            manifest.display()
+        ));
+    }
+    None
+}
+
+/// Is a committed copy of `name@version` present under any uuid of this
+/// project's `.socket/vendor/cargo/`?
+async fn socket_copy_present(project_root: &Path, name: &str, version: &str) -> bool {
+    let Ok(mut dir) = tokio::fs::read_dir(project_root.join(".socket/vendor/cargo")).await else {
+        return false;
     };
+    let leaf = format!("{name}-{version}");
+    while let Ok(Some(uuid)) = dir.next_entry().await {
+        let canonical = uuid
+            .file_name()
+            .to_str()
+            .is_some_and(|u| vendor_uuid_dir_rel("cargo", u).is_some());
+        if canonical
+            && tokio::fs::metadata(uuid.path().join(&leaf))
+                .await
+                .is_ok_and(|m| m.is_dir())
+        {
+            return true;
+        }
+    }
+    false
+}
 
-    done(result, Some(entry), warnings)
+/// Keys every config file cargo merges already uses in its crates.io
+/// `[patch]` — a config item replaces the manifest item with the same key
+/// (any version), so a manifest key must avoid them — minus the project
+/// config's legacy Socket entries wiring `name@version` (this run retires
+/// those).
+fn reserved_config_keys(
+    chain: &[cargo_config::ChainConfig],
+    name: &str,
+    version: &str,
+) -> Vec<String> {
+    chain
+        .iter()
+        .flat_map(|config| config.entries.iter())
+        .filter(|e| !cargo_manifest::entry_wires(e, name, version))
+        .map(|e| e.key.clone())
+        .collect()
+}
+
+/// A USER-authored crates.io `[patch]` entry — in the root manifest or any
+/// config file cargo merges ([`cargo_config::read_config_chain`]) — that
+/// overrides `name@version`, or may: a git / registry patch, or a path
+/// whose `Cargo.toml` version cannot be read, cannot be proven to patch a
+/// DIFFERENT version. `Some(detail)` names the blocker.
+async fn user_patch_conflict(
+    project_root: &Path,
+    manifest: &[cargo_manifest::ManifestPatchEntry],
+    chain: &[cargo_config::ChainConfig],
+    name: &str,
+    version: &str,
+) -> Option<String> {
+    let candidates = manifest
+        .iter()
+        .map(|e| (cargo_manifest::CARGO_TOML, project_root, e))
+        .chain(chain.iter().flat_map(|config| {
+            config
+                .entries
+                .iter()
+                .map(move |e| (config.file.as_str(), config.base.as_path(), e))
+        }));
+    for (file, base, entry) in candidates {
+        if entry.socket_owned || entry.name != name {
+            continue;
+        }
+        let proven_other = match entry.path.as_deref() {
+            Some(p) => path_crate_version(base, p)
+                .await
+                .is_some_and(|v| v != version),
+            None => false,
+        };
+        if !proven_other {
+            return Some(format!(
+                "`patch.{}.{}` in {file} is user-authored ({}) and overrides (or may \
+                 override) {name}@{version}; refusing to wire a second patch for it",
+                entry.source,
+                entry.key,
+                entry.path.as_deref().unwrap_or("non-path source")
+            ));
+        }
+    }
+    None
+}
+
+/// The `[package] version` of the crate at a `[patch]` path (relative to
+/// `base`: the project root for the manifest and the project config, the
+/// config's own root for any other config file).
+async fn path_crate_version(base: &Path, rel: &str) -> Option<String> {
+    let dir = if Path::new(rel).is_absolute() {
+        PathBuf::from(rel)
+    } else {
+        base.join(rel)
+    };
+    let text = read_regular_to_string(&dir.join("Cargo.toml")).await.ok()?;
+    let doc = text.parse::<toml_edit::DocumentMut>().ok()?;
+    doc.get("package")?
+        .as_table_like()?
+        .get("version")?
+        .as_str()
+        .map(str::to_string)
+}
+
+/// Every Socket-owned `[patch.crates-io]` path wiring crate `name` (any
+/// version): the root manifest's (v5) and the legacy project config's.
+async fn socket_patch_paths(project_root: &Path, name: &str) -> Vec<String> {
+    let mut out: Vec<String> = cargo_manifest::read_patch_entries(project_root)
+        .await
+        .into_iter()
+        .filter(|e| e.socket_owned && e.name == name)
+        .filter_map(|e| e.path)
+        .collect();
+    out.extend(
+        cargo_config::legacy_socket_entries(project_root, name)
+            .await
+            .into_iter()
+            .map(|(_, p)| p),
+    );
+    out
+}
+
+/// Is Socket-owned vendored `[patch.crates-io]` wiring for exactly
+/// `name@version` present — in the root manifest or (legacy) the project
+/// config? Used by the hosted takeover to refuse redirecting over
+/// ledger-less vendored wiring; another vendored version of the same crate
+/// (with its own ledger entry) does not count.
+pub async fn socket_wiring_present(project_root: &Path, name: &str, version: &str) -> bool {
+    socket_patch_paths(project_root, name)
+        .await
+        .iter()
+        .any(|p| cargo_manifest::is_socket_copy_of(p, name, version))
+}
+
+/// Move a ledger entry's legacy project-config wiring into the root
+/// manifest (`repair`'s migration step; `vendor`/`scan`/`get` migrate on
+/// their own re-run). Only a legacy entry pointing at THIS entry's copy is
+/// moved. Also restores LOST wiring: a detached lock entry that no
+/// Socket-owned `[patch]` wires while this entry's committed copy exists
+/// (a pre-v5 second-version vendor overwrote its crate-named config key)
+/// gets its manifest entry back (`cargo_wiring_restored`).
+/// `Ok(Some(entry))` is the updated ledger entry (the `cargo_patch_entry`
+/// record now names `Cargo.toml`); `Ok(None)` when there is nothing to
+/// do; `Err` when the manifest cannot take the entry (nothing was
+/// changed).
+pub async fn migrate_legacy_wiring(
+    entry: &VendorEntry,
+    project_root: &Path,
+    dry_run: bool,
+) -> Result<Option<(VendorEntry, VendorWarning)>, String> {
+    let Some((name, version)) = parse_cargo_purl(&entry.base_purl) else {
+        return Ok(None);
+    };
+    if !is_safe_single_segment(name) || !is_safe_single_segment(version) {
+        return Ok(None);
+    }
+    let Some(base_rel) = vendor_uuid_dir_rel("cargo", &entry.uuid) else {
+        return Ok(None);
+    };
+    let copy_rel = format!("{base_rel}/{name}-{version}");
+    let legacy_here = cargo_config::legacy_socket_entries(project_root, name)
+        .await
+        .into_iter()
+        .any(|(_, p)| cargo_manifest::normalize_socket_path(&p).as_deref() == Some(&copy_rel));
+    let unwired_here = !legacy_here
+        && matches!(
+            cargo_lock::probe_lock_entry(project_root, name, version).await,
+            cargo_lock::LockEntryProbe::Detached
+        )
+        && !socket_wiring_present(project_root, name, version).await
+        && tokio::fs::metadata(project_root.join(&copy_rel))
+            .await
+            .is_ok_and(|m| m.is_dir());
+    if !legacy_here && !unwired_here {
+        return Ok(None);
+    }
+    if is_symlink(&project_root.join(cargo_manifest::CARGO_TOML)).await {
+        return Err("Cargo.toml is a symbolic link; the legacy wiring was left in place".into());
+    }
+    let text = cargo_manifest::read_manifest(project_root)
+        .await
+        .map_err(|e| e.to_string())?;
+    let doc = cargo_manifest::parse_manifest(&text).map_err(|e| e.to_string())?;
+    cargo_manifest::check_source_alias(&doc).map_err(|e| e.to_string())?;
+    if let Some(detail) = workspace_root_refusal(project_root, &doc).await {
+        return Err(detail);
+    }
+    let manifest_entries = cargo_manifest::crates_io_patch_entries(&doc);
+    let chain = cargo_config::read_config_chain(project_root).await;
+    if let Some(detail) =
+        user_patch_conflict(project_root, &manifest_entries, &chain, name, version).await
+    {
+        return Err(detail);
+    }
+    let reserved = reserved_config_keys(&chain, name, version);
+    let ensured = cargo_manifest::ensure_patch_entry(
+        project_root,
+        name,
+        version,
+        &entry.uuid,
+        &copy_rel,
+        &reserved,
+        dry_run,
+    )
+    .await
+    .map_err(|e| e.to_string())?;
+    let warning = if unwired_here {
+        VendorWarning::new(
+            "cargo_wiring_restored",
+            format!(
+                "{} the missing Cargo.toml `[patch.crates-io]` entry for {name}@{version}: its \
+                 Cargo.lock entry is detached but nothing pointed at the committed copy (a \
+                 pre-v5 release overwrote its crate-named .cargo/config key when a second \
+                 version was vendored)",
+                if dry_run { "would restore" } else { "restored" }
+            ),
+        )
+    } else if dry_run {
+        migration_warning(project_root, name, version, true).await
+    } else {
+        let warning = migration_warning(project_root, name, version, false).await;
+        if let Err(e) =
+            cargo_config::drop_legacy_patch_entries(project_root, name, version, false).await
+        {
+            let prior = ensured.prior_path.as_deref();
+            unwind_manifest(project_root, name, version, &entry.uuid, prior, &reserved).await;
+            return Err(format!(
+                "the legacy entry could not be removed ({e}); the Cargo.toml edit was unwound"
+            ));
+        }
+        warning
+    };
+    let mut migrated = entry.clone();
+    migrated.wiring.retain(|w| w.kind != "cargo_patch_entry");
+    migrated
+        .wiring
+        .insert(0, manifest_wiring_record(&ensured, &copy_rel));
+    Ok(Some((migrated, warning)))
 }
 
 /// Revert one vendored cargo crate: restore the lock entry's original
-/// `source`/`checksum`, drop the `[patch.crates-io]` entry, and remove the
-/// uuid dir.
+/// `source`/`checksum`, drop the `[patch.crates-io]` wiring (root manifest
+/// and any legacy project-config entry), and remove the uuid dir.
 pub async fn revert_cargo_vendor(
     entry: &VendorEntry,
     project_root: &Path,
@@ -835,6 +1390,37 @@ pub async fn revert_cargo_vendor_opts(
 
     let mut out = RevertOutcome::ok();
 
+    // Pre-flight the manifest removal: an unreadable / unparseable
+    // Cargo.toml must fail the revert BEFORE the lock is restored — a
+    // restored lock under a still-live `[patch]` entry breaks every
+    // `--locked` build.
+    match cargo_manifest::drop_patch_entries(project_root, name, version, true).await {
+        Err(e) => {
+            return RevertOutcome {
+                kept_artifact: false,
+                success: false,
+                warnings: out.warnings,
+                error: Some(format!("failed to update Cargo.toml: {e}")),
+            };
+        }
+        // The atomic rewrite would replace a symlinked manifest with a
+        // detached regular file, leaving the link's target still wired.
+        Ok(true) if is_symlink(&project_root.join(cargo_manifest::CARGO_TOML)).await => {
+            return RevertOutcome {
+                kept_artifact: false,
+                success: false,
+                warnings: out.warnings,
+                error: Some(
+                    "cargo_manifest_symlink_unsupported: Cargo.toml is a symbolic link; \
+                     remove the vendored `[patch.crates-io]` entry from the link's target \
+                     by hand (nothing was reverted)"
+                        .to_string(),
+                ),
+            };
+        }
+        Ok(_) => {}
+    }
+
     if let Some(lock) = &entry.lock {
         match cargo_lock::restore_lock_entry(project_root, name, version, lock, dry_run).await {
             Ok(true) => {}
@@ -850,7 +1436,7 @@ pub async fn revert_cargo_vendor_opts(
                 "Cargo.lock no longer exists; nothing to restore".to_string(),
             )),
             // Fail-closed on a corrupt/unwritable lock BEFORE touching the
-            // config entry — a half-revert (entry dropped, lock still
+            // `[patch]` wiring — a half-revert (entry dropped, lock still
             // path-form) would break every --locked build with no breadcrumb.
             Err(e) => {
                 return RevertOutcome {
@@ -863,12 +1449,25 @@ pub async fn revert_cargo_vendor_opts(
         }
     }
 
-    if let Err(e) = cargo_config::drop_patch_entry(project_root, name, dry_run).await {
+    if let Err(e) = cargo_manifest::drop_patch_entries(project_root, name, version, dry_run).await {
+        return RevertOutcome {
+            kept_artifact: false,
+            success: false,
+            warnings: out.warnings,
+            error: Some(format!("failed to update Cargo.toml: {e}")),
+        };
+    }
+    // Pre-v5 projects (and half-migrated ones) carry the wiring in the
+    // legacy project config: always clean it too.
+    if let Err(e) =
+        cargo_config::drop_legacy_patch_entries(project_root, name, version, dry_run).await
+    {
+        let config = cargo_config::effective_config_rel(project_root).await;
         return RevertOutcome {
             kept_artifact: false,
             success: false,
             warnings: out.warnings,
-            error: Some(format!("failed to update .cargo/config.toml: {e}")),
+            error: Some(format!("failed to update {config}: {e}")),
         };
     }
 
@@ -910,8 +1509,18 @@ mod tests {
         compute_git_sha256_from_bytes(bytes)
     }
 
-    fn copy_rel() -> String {
-        format!(".socket/vendor/cargo/{UUID}/cfg-if-1.0.4")
+    /// The path of the root manifest's Socket-owned `[patch.crates-io]`
+    /// entry for cfg-if (any key), if any.
+    async fn manifest_path(root: &Path) -> Option<String> {
+        cargo_manifest::read_patch_entries(root)
+            .await
+            .into_iter()
+            .find(|e| e.socket_owned && e.name == "cfg-if")
+            .and_then(|e| e.path)
+    }
+
+    fn copy_rel() -> String {
+        format!(".socket/vendor/cargo/{UUID}/cfg-if-1.0.4")
     }
 
     fn lock_body() -> String {
@@ -1085,9 +1694,19 @@ mod tests {
             PRISTINE
         );
 
-        // Config entry points at the uuid-level copy.
-        let entries = cargo_config::read_patch_entries(root).await;
-        assert_eq!(entries["cfg-if"].path.as_deref(), Some(copy_rel().as_str()));
+        // The ROOT MANIFEST carries the entry (under the Socket-owned key,
+        // never the bare crate name); no project config is created.
+        assert_eq!(
+            tokio::fs::read_to_string(root.join("Cargo.toml"))
+                .await
+                .unwrap(),
+            format!(
+                "[package]\nname = \"app\"\nversion = \"0.1.0\"\n\n[dependencies]\ncfg-if = \"1\"\n\n\
+                 [patch.crates-io]\ncfg-if-socket-9f6b2c4e = {{ package = \"cfg-if\", path = \"{}\" }}\n",
+                copy_rel()
+            )
+        );
+        assert!(!root.join(".cargo").exists(), "no .cargo/ is created");
 
         // The lock entry is detached (source+checksum gone), rest preserved.
         let lock = tokio::fs::read_to_string(root.join("Cargo.lock"))
@@ -1129,10 +1748,10 @@ mod tests {
         let cfg = &entry.wiring[0];
         assert_eq!(
             (cfg.file.as_str(), cfg.kind.as_str()),
-            (".cargo/config.toml", "cargo_patch_entry")
+            ("Cargo.toml", "cargo_patch_entry")
         );
         assert_eq!(cfg.action, WiringAction::Added);
-        assert_eq!(cfg.key.as_deref(), Some("cfg-if"));
+        assert_eq!(cfg.key.as_deref(), Some("cfg-if-socket-9f6b2c4e"));
         assert_eq!(cfg.new, Some(serde_json::Value::from(copy_rel())));
         let lockw = &entry.wiring[1];
         assert_eq!(
@@ -1251,7 +1870,7 @@ mod tests {
         assert_eq!(entry.wiring.len(), 1, "only the config wire is recorded");
         // The copy + config still landed.
         assert!(root.join(copy_rel()).join("src/lib.rs").exists());
-        assert!(cargo_config::read_patch_entries(root).await["cfg-if"].socket_owned);
+        assert!(manifest_path(root).await.is_some());
     }
 
     #[tokio::test]
@@ -1274,7 +1893,7 @@ mod tests {
             "half-built copy must be rolled back"
         );
         // No config entry, lock untouched.
-        assert!(cargo_config::read_patch_entries(root).await.is_empty());
+        assert!(manifest_path(root).await.is_none());
         assert_eq!(
             tokio::fs::read_to_string(root.join("Cargo.lock"))
                 .await
@@ -1324,13 +1943,12 @@ mod tests {
     }
 
     /// A FIFO planted as the project `Cargo.toml` must not wedge the wet
-    /// vendor run: everything ahead of `hosted_redirect_residue` reads only
-    /// Cargo.lock / .cargo/config.toml, so a raw `read_to_string` open(2)
-    /// of the manifest waits for a writer that never comes and hangs the
-    /// vendor forever with no error and no timeout. Same class as the
-    /// `open_regular_file` guards in the setup twins and the crawlers. The
-    /// non-regular manifest must instead be skipped (no residue readable)
-    /// and the vendor must complete.
+    /// vendor run: a raw `read_to_string` open(2) of the manifest waits for
+    /// a writer that never comes and hangs the vendor forever with no error
+    /// and no timeout. Same class as the `open_regular_file` guards in the
+    /// setup twins and the crawlers. The manifest carries the wiring, so the
+    /// non-regular file must be refused promptly (`cargo_manifest_unreadable`)
+    /// with nothing written.
     #[cfg(unix)]
     #[tokio::test]
     async fn test_fifo_cargo_toml_does_not_wedge_vendor() {
@@ -1357,14 +1975,13 @@ mod tests {
                 .open(&manifest);
             panic!("vendor must complete promptly with a FIFO Cargo.toml");
         };
-        let (result, entry, _warnings) = expect_done(outcome);
-        assert!(result.success, "{:?}", result.error);
-        assert!(entry.is_some());
+        expect_refused(outcome, "cargo_manifest_unreadable");
+        assert!(!root.join(format!(".socket/vendor/cargo/{UUID}")).exists());
         assert_eq!(
-            tokio::fs::read(root.join(copy_rel()).join("src/lib.rs"))
+            tokio::fs::read_to_string(root.join("Cargo.lock"))
                 .await
                 .unwrap(),
-            PATCHED
+            lock_body()
         );
     }
 
@@ -1392,7 +2009,7 @@ mod tests {
             result.error
         );
         // Unwound: config entry gone (file pruned), copy gone, lock unchanged.
-        assert!(cargo_config::read_patch_entries(root).await.is_empty());
+        assert!(manifest_path(root).await.is_none());
         assert!(!root.join(copy_rel()).exists());
         assert_eq!(
             tokio::fs::read_to_string(root.join("Cargo.lock"))
@@ -1420,9 +2037,7 @@ mod tests {
         tokio::fs::write(&lib, b"drifted but buildable\n")
             .await
             .unwrap();
-        let cfg1 = tokio::fs::read(root.join(".cargo/config.toml"))
-            .await
-            .unwrap();
+        let cfg1 = tokio::fs::read(root.join("Cargo.toml")).await.unwrap();
         let lock1 = tokio::fs::read(root.join("Cargo.lock")).await.unwrap();
 
         let empty = root.join(".socket/empty-blobs");
@@ -1444,11 +2059,9 @@ mod tests {
             "marker must survive"
         );
         assert_eq!(
-            tokio::fs::read(root.join(".cargo/config.toml"))
-                .await
-                .unwrap(),
+            tokio::fs::read(root.join("Cargo.toml")).await.unwrap(),
             cfg1,
-            "config untouched"
+            "manifest untouched"
         );
         assert_eq!(
             tokio::fs::read(root.join("Cargo.lock")).await.unwrap(),
@@ -1566,9 +2179,7 @@ mod tests {
         assert!(entry.is_none());
         // The restored prior entry still points at a live copy.
         assert_eq!(
-            cargo_config::read_patch_entries(root).await["cfg-if"]
-                .path
-                .as_deref(),
+            manifest_path(root).await.as_deref(),
             Some(copy_rel().as_str())
         );
         assert!(
@@ -1659,7 +2270,7 @@ mod tests {
         expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
 
         let copy = root.join(copy_rel()).join("src/lib.rs");
-        let cfg = root.join(".cargo/config.toml");
+        let cfg = root.join("Cargo.toml");
         let lock = root.join("Cargo.lock");
         let copy1 = tokio::fs::read(&copy).await.unwrap();
         let cfg1 = tokio::fs::read(&cfg).await.unwrap();
@@ -1703,7 +2314,7 @@ mod tests {
         expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
 
         let copy = root.join(copy_rel()).join("src/lib.rs");
-        let cfg = root.join(".cargo/config.toml");
+        let cfg = root.join("Cargo.toml");
         let lock = root.join("Cargo.lock");
         let copy1 = tokio::fs::read(&copy).await.unwrap();
         let cfg1 = tokio::fs::read(&cfg).await.unwrap();
@@ -1782,8 +2393,13 @@ mod tests {
                 .unwrap(),
             lock_body()
         );
-        // Config entry gone — and the socket-created file + .cargo/ pruned.
-        assert!(cargo_config::read_patch_entries(root).await.is_empty());
+        // Manifest byte-identical to the pre-vendor fixture; no .cargo/.
+        assert_eq!(
+            tokio::fs::read_to_string(root.join("Cargo.toml"))
+                .await
+                .unwrap(),
+            "[package]\nname = \"app\"\nversion = \"0.1.0\"\n\n[dependencies]\ncfg-if = \"1\"\n"
+        );
         assert!(!root.join(".cargo").exists());
         // The uuid dir is gone, and the empty eco level pruned with it.
         assert!(!root.join(format!(".socket/vendor/cargo/{UUID}")).exists());
@@ -1942,7 +2558,7 @@ mod tests {
 
         // The refusals deleted nothing: the vendored state is fully intact.
         assert!(root.join(copy_rel()).exists());
-        assert!(cargo_config::read_patch_entries(root).await["cfg-if"].socket_owned);
+        assert!(manifest_path(root).await.is_some());
     }
 
     /// A patch update moves the manifest to a NEW uuid for the same crate.
@@ -1968,12 +2584,7 @@ mod tests {
 
         // The config entry is repointed at the new uuid's copy.
         let new_rel = format!(".socket/vendor/cargo/{UUID2}/cfg-if-1.0.4");
-        assert_eq!(
-            cargo_config::read_patch_entries(root).await["cfg-if"]
-                .path
-                .as_deref(),
-            Some(new_rel.as_str())
-        );
+        assert_eq!(manifest_path(root).await.as_deref(), Some(new_rel.as_str()));
         // The new copy carries the patched bytes; the old uuid dir is left
         // for the caller's stale-artifact sweep (the caller owns the ledger).
         assert_eq!(
@@ -2020,9 +2631,7 @@ mod tests {
         assert!(entry.is_none());
         // The prior entry is restored, not dropped; the new uuid dir is gone.
         assert_eq!(
-            cargo_config::read_patch_entries(root).await["cfg-if"]
-                .path
-                .as_deref(),
+            manifest_path(root).await.as_deref(),
             Some(copy_rel().as_str()),
             "unwind must restore the pre-existing socket entry"
         );
@@ -2239,11 +2848,11 @@ mod tests {
                 .exists(),
             "path-dep copy must not carry a checksum sidecar"
         );
-        let cfg = tokio::fs::read_to_string(root.join(".cargo/config.toml"))
+        let cfg = tokio::fs::read_to_string(root.join("Cargo.toml"))
             .await
             .unwrap();
         assert!(
-            cfg.contains("[patch.crates-io]") && cfg.contains("cfg-if"),
+            cfg.contains("[patch.crates-io]") && cfg.contains(&copy_rel()),
             "{cfg}"
         );
         assert!(warnings
@@ -2883,23 +3492,28 @@ mod tests {
         );
     }
 
-    /// `ensure_patch_entry` failure after a successful local build (a
-    /// DIRECTORY squatting `.cargo/config.toml`: the guarded read errs
-    /// InvalidInput while the preflight `read_patch_entries` degrades to
-    /// empty, so the run proceeds all the way to the config write) unwinds
-    /// the copy and prunes the husks; the lock is never touched.
+    /// A manifest WRITE failure after a successful local build (the
+    /// project root is read-only, so the atomic rewrite cannot stage its
+    /// sibling file, while `.socket/` stays writable) unwinds the copy and
+    /// prunes the husks; the manifest and the lock are never touched.
+    #[cfg(unix)]
     #[tokio::test]
-    async fn config_write_failure_unwinds_copy() {
+    async fn manifest_write_failure_unwinds_copy() {
+        use std::os::unix::fs::PermissionsExt;
+        if unsafe { libc::geteuid() } == 0 {
+            return; // root ignores directory permission bits
+        }
         let (dir, blobs, pristine, record) = fixture().await;
         let root = dir.path();
-        // NOTE: not `.cargo/config` (extensionless) — config_path would
-        // resolve there instead of erroring on the squatted config.toml.
-        tokio::fs::create_dir_all(root.join(".cargo/config.toml"))
+        let manifest_before = tokio::fs::read(root.join("Cargo.toml")).await.unwrap();
+        tokio::fs::create_dir_all(root.join(".socket/vendor/cargo"))
             .await
             .unwrap();
+        std::fs::set_permissions(root, std::fs::Permissions::from_mode(0o555)).unwrap();
+        let outcome = run_vendor(PURL, root, &blobs, &pristine, &record, false).await;
+        std::fs::set_permissions(root, std::fs::Permissions::from_mode(0o755)).unwrap();
 
-        let (result, entry, _warnings) =
-            expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
+        let (result, entry, _warnings) = expect_done(outcome);
         assert!(!result.success);
         assert!(entry.is_none());
         assert!(
@@ -2907,20 +3521,17 @@ mod tests {
                 .error
                 .as_deref()
                 .unwrap_or("")
-                .contains("failed to update .cargo/config.toml"),
-            "error names the config: {:?}",
+                .contains("failed to update Cargo.toml"),
+            "error names the manifest: {:?}",
             result.error
         );
         assert!(
-            !root.join(".socket/vendor").exists(),
-            "the copy is unwound and the husks pruned"
+            !root.join(format!(".socket/vendor/cargo/{UUID}")).exists(),
+            "the copy is unwound"
         );
-        assert!(
-            tokio::fs::metadata(root.join(".cargo/config.toml"))
-                .await
-                .unwrap()
-                .is_dir(),
-            "the squatting directory is left alone"
+        assert_eq!(
+            tokio::fs::read(root.join("Cargo.toml")).await.unwrap(),
+            manifest_before
         );
         assert_eq!(
             tokio::fs::read_to_string(root.join("Cargo.lock"))
@@ -2931,6 +3542,54 @@ mod tests {
         );
     }
 
+    /// A missing or unparseable root manifest is refused up front, before
+    /// any copy or lock edit (the manifest is where the wiring lives).
+    #[tokio::test]
+    async fn missing_or_unparseable_manifest_is_refused() {
+        let (dir, blobs, pristine, record) = fixture().await;
+        let root = dir.path();
+        tokio::fs::write(root.join("Cargo.toml"), "[package\nname = 1\n")
+            .await
+            .unwrap();
+        expect_refused(
+            run_vendor(PURL, root, &blobs, &pristine, &record, false).await,
+            "cargo_manifest_unparseable",
+        );
+        tokio::fs::remove_file(root.join("Cargo.toml"))
+            .await
+            .unwrap();
+        let detail = expect_refused(
+            run_vendor(PURL, root, &blobs, &pristine, &record, false).await,
+            "cargo_manifest_unreadable",
+        );
+        assert!(detail.contains("Cargo.toml"), "{detail}");
+        assert!(!root.join(".socket/vendor").exists());
+        assert_eq!(
+            tokio::fs::read_to_string(root.join("Cargo.lock"))
+                .await
+                .unwrap(),
+            lock_body()
+        );
+    }
+
+    /// A symlinked root manifest is refused: the atomic rewrite would
+    /// replace the link with a detached copy.
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn symlinked_manifest_is_refused() {
+        let (dir, blobs, pristine, record) = fixture().await;
+        let root = dir.path();
+        tokio::fs::rename(root.join("Cargo.toml"), root.join("real.toml"))
+            .await
+            .unwrap();
+        std::os::unix::fs::symlink("real.toml", root.join("Cargo.toml")).unwrap();
+        expect_refused(
+            run_vendor(PURL, root, &blobs, &pristine, &record, false).await,
+            "cargo_manifest_symlink_unsupported",
+        );
+        assert!(!root.join(".socket/vendor").exists());
+    }
+
     /// A failed marker write on a FRESH vendor (a directory squatting the
     /// marker path makes the atomic rename fail) must not undo the
     /// fully-wired vendor: success + a `vendor_marker_write_failed` warning, with
@@ -2958,9 +3617,7 @@ mod tests {
         // The vendor is otherwise fully wired.
         assert_eq!(tokio::fs::read(copy_lib(root)).await.unwrap(), PATCHED);
         assert_eq!(
-            cargo_config::read_patch_entries(root).await["cfg-if"]
-                .path
-                .as_deref(),
+            manifest_path(root).await.as_deref(),
             Some(copy_rel().as_str())
         );
         let lock = tokio::fs::read_to_string(root.join("Cargo.lock"))
@@ -3022,7 +3679,7 @@ mod tests {
             .unwrap_or_else(|| panic!("missing skip warning: {:?}", out.warnings));
         assert!(w.detail.contains("no longer exists"), "{}", w.detail);
         // The rest still reverted: config entry gone, uuid dir gone.
-        assert!(cargo_config::read_patch_entries(root).await.is_empty());
+        assert!(manifest_path(root).await.is_none());
         assert!(!root.join(format!(".socket/vendor/cargo/{UUID}")).exists());
     }
 
@@ -3052,9 +3709,7 @@ mod tests {
         );
         // Fail-closed: the config entry and the artifact both survive.
         assert_eq!(
-            cargo_config::read_patch_entries(root).await["cfg-if"]
-                .path
-                .as_deref(),
+            manifest_path(root).await.as_deref(),
             Some(copy_rel().as_str()),
             "the config entry must not be dropped on a failed lock restore"
         );
@@ -3064,10 +3719,10 @@ mod tests {
         );
     }
 
-    /// Revert `drop_patch_entry` failure (a directory squatting the config
-    /// path) reports "failed to update .cargo/config.toml" and leaves the
-    /// artifact in place (deletion is last). The lock was already restored
-    /// when this fails — documenting the lock-then-config order: a re-run
+    /// Revert's legacy-config cleanup failing (a directory squatting
+    /// `.cargo/config.toml`) reports "failed to update .cargo/config.toml"
+    /// and leaves the artifact in place (deletion is last). The lock restore
+    /// and the manifest drop ran FIRST — documenting the order: a re-run
     /// recovers, with the restore degrading to an Ok(false) skip.
     #[tokio::test]
     async fn test_revert_config_drop_failure_reports_error() {
@@ -3076,9 +3731,6 @@ mod tests {
         let (_result, entry, _warnings) =
             expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
         let entry = entry.unwrap();
-        tokio::fs::remove_file(root.join(".cargo/config.toml"))
-            .await
-            .unwrap();
         tokio::fs::create_dir_all(root.join(".cargo/config.toml"))
             .await
             .unwrap();
@@ -3093,7 +3745,6 @@ mod tests {
             "{:?}",
             out.error
         );
-        // The lock restore ran FIRST and stuck: byte-identical originals.
         assert_eq!(
             tokio::fs::read_to_string(root.join("Cargo.lock"))
                 .await
@@ -3101,148 +3752,530 @@ mod tests {
             lock_body(),
             "the lock is restored before the config edit"
         );
+        assert!(
+            manifest_path(root).await.is_none(),
+            "manifest entry dropped"
+        );
         assert!(
             root.join(copy_rel()).exists(),
             "artifact untouched — its deletion comes after the config edit"
         );
     }
 
-    // ── swap_stage_into_place unit edges ──────────────────────────────────
-
-    /// A failed stage rename with NO pre-existing copy parked (had_old =
-    /// false skips the backup restore): the error propagates and no backup
-    /// is fabricated.
+    /// An unparseable manifest fails the revert BEFORE the lock is restored
+    /// (a restored lock under a still-live `[patch]` breaks `--locked`).
     #[tokio::test]
-    async fn test_swap_missing_stage_and_vacant_copy_errors() {
-        let dir = tempfile::tempdir().unwrap();
-        let copy = dir.path().join("cfg-if-1.0.4");
-        let err = swap_stage_into_place(&stage_dir_for(&copy), &copy)
+    async fn test_revert_unparseable_manifest_fails_before_the_lock() {
+        let (dir, blobs, pristine, record) = fixture().await;
+        let root = dir.path();
+        let (_result, entry, _warnings) =
+            expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
+        let entry = entry.unwrap();
+        let lock_wired = tokio::fs::read(root.join("Cargo.lock")).await.unwrap();
+        tokio::fs::write(root.join("Cargo.toml"), "[package\n")
             .await
-            .expect_err("swapping a missing stage into a vacant copy must fail");
-        assert_eq!(err.kind(), std::io::ErrorKind::NotFound);
+            .unwrap();
+        let out = revert_cargo_vendor(&entry, root, false).await;
+        assert!(!out.success);
         assert!(
-            !backup_dir_for(&copy).exists(),
-            "no fabricated backup litter"
+            out.error
+                .as_deref()
+                .unwrap_or("")
+                .contains("failed to update Cargo.toml"),
+            "{:?}",
+            out.error
         );
-        assert!(!copy.exists(), "no fabricated copy");
+        assert_eq!(
+            tokio::fs::read(root.join("Cargo.lock")).await.unwrap(),
+            lock_wired,
+            "the lock is untouched"
+        );
+        assert!(root.join(copy_rel()).exists());
     }
 
-    /// A park rename (copy → backup) that fails with a non-NotFound error
-    /// (EACCES: read-only parent) must propagate WITHOUT touching the old
-    /// copy — it is never moved, and no backup appears.
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn test_swap_park_failure_propagates_and_keeps_old_copy() {
-        use std::os::unix::fs::PermissionsExt as _;
-        if unsafe { libc::geteuid() } == 0 {
-            return; // root ignores mode bits — the trigger cannot fire
-        }
-        let dir = tempfile::tempdir().unwrap();
-        let parent = dir.path().join("uuid");
-        let copy = parent.join("cfg-if-1.0.4");
-        tokio::fs::create_dir_all(copy.join("src")).await.unwrap();
-        tokio::fs::write(copy.join("src/lib.rs"), b"live\n")
+    // ── v5 manifest wiring: legacy migration, multi-version, conflicts ───
+
+    /// The pre-v5 wiring for the fixture: the legacy `.cargo/config.toml`
+    /// entry (written by the test-only legacy writer), the copy, and a
+    /// detached lock — i.e. what an old release's `vendor` left behind.
+    async fn legacy_vendor(root: &Path, blobs: &Path, pristine: &Path, record: &PatchRecord) {
+        expect_done(run_vendor(PURL, root, blobs, pristine, record, false).await);
+        cargo_manifest::drop_patch_entries(root, "cfg-if", "1.0.4", false)
             .await
             .unwrap();
-        let stage = stage_dir_for(&copy);
-        tokio::fs::create_dir_all(&stage).await.unwrap();
-        tokio::fs::write(stage.join("lib.rs"), b"new\n")
+        cargo_config::ensure_patch_entry(root, "cfg-if", &copy_rel(), false)
             .await
             .unwrap();
+    }
 
-        std::fs::set_permissions(&parent, std::fs::Permissions::from_mode(0o555)).unwrap();
-        let swapped = swap_stage_into_place(&stage, &copy).await;
-        // Restore before any assert so the tempdir can always be cleaned up.
-        std::fs::set_permissions(&parent, std::fs::Permissions::from_mode(0o755)).unwrap();
+    #[tokio::test]
+    async fn legacy_config_wiring_migrates_to_the_manifest_on_rerun() {
+        let (dir, blobs, pristine, record) = fixture().await;
+        let root = dir.path();
+        let manifest_pristine = tokio::fs::read_to_string(root.join("Cargo.toml"))
+            .await
+            .unwrap();
+        legacy_vendor(root, &blobs, &pristine, &record).await;
+        let lock_wired = tokio::fs::read(root.join("Cargo.lock")).await.unwrap();
+        assert!(manifest_path(root).await.is_none());
 
-        assert!(swapped.is_err(), "the park rename failure must propagate");
+        let (result, entry, warnings) =
+            expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
+        assert!(result.success, "{:?}", result.error);
+        assert!(
+            warnings.iter().any(|w| w.code == "cargo_wiring_migrated"),
+            "{warnings:?}"
+        );
+        assert_eq!(manifest_path(root).await, Some(copy_rel()));
+        assert!(
+            !root.join(".cargo").exists(),
+            "the emptied socket-created config (and .cargo/) are cleaned"
+        );
         assert_eq!(
-            tokio::fs::read(copy.join("src/lib.rs")).await.unwrap(),
-            b"live\n",
-            "the old copy is never moved"
+            tokio::fs::read(root.join("Cargo.lock")).await.unwrap(),
+            lock_wired,
+            "the lock is already detached — untouched"
         );
-        assert!(!backup_dir_for(&copy).exists(), "no parked backup");
-        assert!(stage.exists(), "the stage is left for the caller's cleanup");
-    }
-
-    // ── source-flip regression: the hot path decides "in sync" from the
-    //    COMMITTED copy before any service call, so a service ↔ local flip
-    //    between runs is a byte-identical no-op with no request. ──
+        // The fresh entry names the manifest; the lock originals come from
+        // the replaced ledger entry (carry_forward_wiring).
+        let entry = entry.expect("a migration emits the updated entry");
+        assert_eq!(entry.wiring.len(), 1);
+        assert_eq!(entry.wiring[0].file, "Cargo.toml");
+        assert_eq!(entry.lock, None);
+        // A second re-run is the in-sync no-op.
+        let (_, entry2, warnings2) =
+            expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
+        assert!(entry2.is_none() && warnings2.is_empty(), "{warnings2:?}");
 
-    async fn flip_run(
-        root: &Path,
-        blobs: &Path,
-        pristine: &Path,
-        record: &PatchRecord,
-        uri: &str,
-    ) -> (ApplyResult, Option<VendorEntry>, Vec<VendorWarning>) {
-        let sources = PatchSources::blobs_only(blobs);
-        expect_done(
-            vendor_cargo_crate(
-                PURL,
-                pristine,
-                root,
-                record,
-                &sources,
-                "2026-06-09T00:00:00Z",
-                false,
-                false,
-                Some(&cargo_service_cfg(uri, VendorSource::Auto, false)),
-            )
-            .await,
-        )
+        // Revert (with originals carried forward) restores everything.
+        let mut full = entry;
+        full.lock = Some(CargoLockOriginal {
+            source: SOURCE.into(),
+            checksum: Some(CHECKSUM.into()),
+        });
+        let out = revert_cargo_vendor(&full, root, false).await;
+        assert!(out.success, "{:?}", out.error);
+        assert_eq!(
+            tokio::fs::read_to_string(root.join("Cargo.toml"))
+                .await
+                .unwrap(),
+            manifest_pristine
+        );
+        assert_eq!(
+            tokio::fs::read_to_string(root.join("Cargo.lock"))
+                .await
+                .unwrap(),
+            lock_body()
+        );
     }
 
-    /// A service crate that differs from the local build in NON-patched bytes.
-    fn flip_service_crate() -> Vec<u8> {
-        make_crate_tgz(
-            "cfg-if-1.0.4",
-            &[
-                ("src/lib.rs", PATCHED),
-                (
-                    "Cargo.toml",
-                    b"[package]\nname = \"cfg-if\"\nversion = \"1.0.4\"\n# service\n",
-                ),
-                ("README.service.md", b"built by the service\n"),
-            ],
-        )
+    /// A user's own config content survives the migration; only the
+    /// Socket-owned entry moves.
+    #[tokio::test]
+    async fn legacy_migration_keeps_user_config_content() {
+        let (dir, blobs, pristine, record) = fixture().await;
+        let root = dir.path();
+        legacy_vendor(root, &blobs, &pristine, &record).await;
+        let cfg = root.join(".cargo/config.toml");
+        let body = tokio::fs::read_to_string(&cfg).await.unwrap();
+        tokio::fs::write(&cfg, format!("[build]\njobs = 4\n\n{body}"))
+            .await
+            .unwrap();
+        let (result, _, _) =
+            expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
+        assert!(result.success);
+        assert_eq!(
+            tokio::fs::read_to_string(&cfg).await.unwrap(),
+            "[build]\njobs = 4\n"
+        );
     }
 
+    /// A patch update (new uuid) over legacy wiring: the full path wires the
+    /// manifest to the new copy and retires the legacy entry.
     #[tokio::test]
-    async fn flip_local_then_service_is_noop() {
-        use crate::vendor::test_support as ts;
+    async fn uuid_bump_over_legacy_wiring_moves_to_the_manifest() {
         let (dir, blobs, pristine, record) = fixture().await;
         let root = dir.path();
-        let down = wiremock::MockServer::start().await;
-        ts::mount_503(&down).await;
-        let (r1, e1, _) = flip_run(root, &blobs, &pristine, &record, &down.uri()).await;
-        assert!(r1.success && e1.is_some());
-        let before = ts::tree_snapshot(root);
-        let up = wiremock::MockServer::start().await;
-        let tgz = flip_service_crate();
-        mount_cargo_granted(&up, &sri_sha512(&tgz), &tgz).await;
-        let (r2, e2, w2) = flip_run(root, &blobs, &pristine, &record, &up.uri()).await;
-        assert!(r2.success && e2.is_none() && r2.files_patched.is_empty() && w2.is_empty());
-        assert_eq!(ts::tree_snapshot(root), before, "tree byte-identical");
-        assert_eq!(ts::request_count(&up).await, 0);
+        legacy_vendor(root, &blobs, &pristine, &record).await;
+        let mut record2 = record.clone();
+        record2.uuid = UUID2.into();
+        let (result, entry, warnings) =
+            expect_done(run_vendor(PURL, root, &blobs, &pristine, &record2, false).await);
+        assert!(result.success, "{:?}", result.error);
+        let new_rel = format!(".socket/vendor/cargo/{UUID2}/cfg-if-1.0.4");
+        assert_eq!(manifest_path(root).await, Some(new_rel));
+        assert!(cargo_config::legacy_socket_entries(root, "cfg-if")
+            .await
+            .is_empty());
+        assert!(warnings.iter().any(|w| w.code == "cargo_wiring_migrated"));
+        assert_eq!(entry.unwrap().lock, None);
     }
 
+    /// Revert drops a legacy config entry too (pre-v5 ledger entry).
     #[tokio::test]
-    async fn flip_service_then_local_is_noop() {
-        use crate::vendor::test_support as ts;
+    async fn revert_cleans_legacy_config_wiring() {
         let (dir, blobs, pristine, record) = fixture().await;
         let root = dir.path();
-        let up = wiremock::MockServer::start().await;
-        let tgz = flip_service_crate();
-        mount_cargo_granted(&up, &sri_sha512(&tgz), &tgz).await;
-        let (r1, e1, w1) = flip_run(root, &blobs, &pristine, &record, &up.uri()).await;
-        assert!(r1.success && e1.is_some());
-        assert!(ts::has_warning(&w1, "vendor_prebuilt_downloaded"));
-        let before = ts::tree_snapshot(root);
-        let down = wiremock::MockServer::start().await;
-        ts::mount_503(&down).await;
-        let (r2, e2, w2) = flip_run(root, &blobs, &pristine, &record, &down.uri()).await;
-        assert!(r2.success && e2.is_none() && w2.is_empty());
+        let (_, entry, _) =
+            expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
+        cargo_manifest::drop_patch_entries(root, "cfg-if", "1.0.4", false)
+            .await
+            .unwrap();
+        cargo_config::ensure_patch_entry(root, "cfg-if", &copy_rel(), false)
+            .await
+            .unwrap();
+        let mut entry = entry.unwrap();
+        entry.wiring[0].file = ".cargo/config.toml".into();
+        let out = revert_cargo_vendor(&entry, root, false).await;
+        assert!(out.success, "{:?}", out.error);
+        assert!(!root.join(".cargo").exists());
+        assert_eq!(
+            tokio::fs::read_to_string(root.join("Cargo.lock"))
+                .await
+                .unwrap(),
+            lock_body()
+        );
+    }
+
+    /// `repair`'s migration step: legacy wiring pointing at the entry's copy
+    /// moves into the manifest, and the returned entry's patch record names
+    /// Cargo.toml; nothing to do → `None`.
+    #[tokio::test]
+    async fn migrate_legacy_wiring_for_repair() {
+        let (dir, blobs, pristine, record) = fixture().await;
+        let root = dir.path();
+        let (_, entry, _) =
+            expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
+        let mut entry = entry.unwrap();
+        assert!(migrate_legacy_wiring(&entry, root, false)
+            .await
+            .unwrap()
+            .is_none());
+        cargo_manifest::drop_patch_entries(root, "cfg-if", "1.0.4", false)
+            .await
+            .unwrap();
+        cargo_config::ensure_patch_entry(root, "cfg-if", &copy_rel(), false)
+            .await
+            .unwrap();
+        entry.wiring[0].file = ".cargo/config.toml".into();
+        let (dry, _) = migrate_legacy_wiring(&entry, root, true)
+            .await
+            .unwrap()
+            .unwrap();
+        assert_eq!(dry.wiring[0].file, "Cargo.toml");
+        assert!(
+            manifest_path(root).await.is_none(),
+            "dry run writes nothing"
+        );
+        let (migrated, warning) = migrate_legacy_wiring(&entry, root, false)
+            .await
+            .unwrap()
+            .unwrap();
+        assert_eq!(warning.code, "cargo_wiring_migrated");
+        assert_eq!(migrated.wiring.len(), 2);
+        assert_eq!(migrated.wiring[0].file, "Cargo.toml");
+        assert_eq!(migrated.wiring[1].file, "Cargo.lock");
+        assert_eq!(migrated.lock, entry.lock);
+        assert_eq!(manifest_path(root).await, Some(copy_rel()));
+        assert!(!root.join(".cargo").exists());
+    }
+
+    /// A second version of the same crate gets the Socket-owned key with
+    /// `package =` — the first version's entry is never clobbered (the pre-v5
+    /// config wiring keyed by crate name overwrote it).
+    #[tokio::test]
+    async fn two_versions_of_one_crate_get_distinct_keys() {
+        let (dir, blobs, pristine, record) = fixture().await;
+        let root = dir.path();
+        let lock = format!(
+            "{}\n[[package]]\nname = \"cfg-if\"\nversion = \"0.1.10\"\nsource = \"{SOURCE}\"\nchecksum = \"{}\"\n",
+            lock_body(),
+            "e".repeat(64)
+        );
+        tokio::fs::write(root.join("Cargo.lock"), &lock)
+            .await
+            .unwrap();
+        let pristine2 = root.join("registry/cfg-if-0.1.10");
+        crate::patch::copy_tree::fresh_copy(&pristine, &pristine2, None)
+            .await
+            .unwrap();
+        let mut record2 = record.clone();
+        record2.uuid = UUID2.into();
+        let purl2 = "pkg:cargo/cfg-if@0.1.10";
+
+        let (r1, e1, _) =
+            expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
+        let (r2, e2, _) =
+            expect_done(run_vendor(purl2, root, &blobs, &pristine2, &record2, false).await);
+        assert!(r1.success && r2.success, "{:?} {:?}", r1.error, r2.error);
+        let (e1, e2) = (e1.unwrap(), e2.unwrap());
+        assert_eq!(e1.wiring[0].key.as_deref(), Some("cfg-if-socket-9f6b2c4e"));
+        assert_eq!(e2.wiring[0].key.as_deref(), Some("cfg-if-socket-0a1b2c3d"));
+        let manifest = tokio::fs::read_to_string(root.join("Cargo.toml"))
+            .await
+            .unwrap();
+        assert!(manifest.contains(&format!(
+            "cfg-if-socket-9f6b2c4e = {{ package = \"cfg-if\", path = \"{}\" }}",
+            copy_rel()
+        )));
+        assert!(manifest.contains(&format!(
+            "cfg-if-socket-0a1b2c3d = {{ package = \"cfg-if\", path = \".socket/vendor/cargo/{UUID2}/cfg-if-0.1.10\" }}"
+        )));
+        // Both re-runs are in sync; each probe sees its own wiring.
+        for (purl, src, rec) in [(PURL, &pristine, &record), (purl2, &pristine2, &record2)] {
+            let (_, e, w) = expect_done(run_vendor(purl, root, &blobs, src, rec, false).await);
+            assert!(e.is_none() && w.is_empty(), "{purl}: {w:?}");
+        }
+        assert_eq!(vendored_entry_in_use(&e1, root).await, Some(true));
+        assert_eq!(vendored_entry_in_use(&e2, root).await, Some(true));
+        // Reverting one version leaves the other wired.
+        assert!(revert_cargo_vendor(&e2, root, false).await.success);
+        assert_eq!(manifest_path(root).await, Some(copy_rel()));
+        assert!(revert_cargo_vendor(&e1, root, false).await.success);
+        assert_eq!(
+            tokio::fs::read_to_string(root.join("Cargo.lock"))
+                .await
+                .unwrap(),
+            lock
+        );
+    }
+
+    /// A user-authored manifest entry for the crate refuses unless its path
+    /// crate is provably ANOTHER version (then the Socket key is used).
+    #[tokio::test]
+    async fn user_manifest_entry_refuses_unless_provably_another_version() {
+        let (dir, blobs, pristine, record) = fixture().await;
+        let root = dir.path();
+        let base = tokio::fs::read_to_string(root.join("Cargo.toml"))
+            .await
+            .unwrap();
+        for user in [
+            "cfg-if = { git = \"https://example.com/cfg-if\" }",
+            "cfg-if = { path = \"missing-fork\" }",
+            "fork = { package = \"cfg-if\", path = \"fork-104\" }",
+        ] {
+            tokio::fs::create_dir_all(root.join("fork-104"))
+                .await
+                .unwrap();
+            tokio::fs::write(
+                root.join("fork-104/Cargo.toml"),
+                "[package]\nname = \"cfg-if\"\nversion = \"1.0.4\"\n",
+            )
+            .await
+            .unwrap();
+            let manifest = format!("{base}\n[patch.crates-io]\n{user}\n");
+            tokio::fs::write(root.join("Cargo.toml"), &manifest)
+                .await
+                .unwrap();
+            expect_refused(
+                run_vendor(PURL, root, &blobs, &pristine, &record, false).await,
+                "user_authored_patch_entry",
+            );
+            assert_eq!(
+                tokio::fs::read_to_string(root.join("Cargo.toml"))
+                    .await
+                    .unwrap(),
+                manifest
+            );
+        }
+        tokio::fs::create_dir_all(root.join("fork-09"))
+            .await
+            .unwrap();
+        tokio::fs::write(
+            root.join("fork-09/Cargo.toml"),
+            "[package]\nname = \"cfg-if\"\nversion = \"0.9.0\"\n",
+        )
+        .await
+        .unwrap();
+        let manifest = format!("{base}\n[patch.crates-io]\ncfg-if = {{ path = \"fork-09\" }}\n");
+        tokio::fs::write(root.join("Cargo.toml"), &manifest)
+            .await
+            .unwrap();
+        let (result, entry, _) =
+            expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
+        assert!(result.success, "{:?}", result.error);
+        let entry = entry.unwrap();
+        assert_eq!(
+            entry.wiring[0].key.as_deref(),
+            Some("cfg-if-socket-9f6b2c4e")
+        );
+        assert!(revert_cargo_vendor(&entry, root, false).await.success);
+        assert_eq!(
+            tokio::fs::read_to_string(root.join("Cargo.toml"))
+                .await
+                .unwrap(),
+            manifest,
+            "revert is byte-identical around the user's entry"
+        );
+    }
+
+    /// CRLF manifests stay CRLF through vendor and revert.
+    #[tokio::test]
+    async fn crlf_manifest_round_trips() {
+        let (dir, blobs, pristine, record) = fixture().await;
+        let root = dir.path();
+        let crlf = tokio::fs::read_to_string(root.join("Cargo.toml"))
+            .await
+            .unwrap()
+            .replace('\n', "\r\n");
+        tokio::fs::write(root.join("Cargo.toml"), &crlf)
+            .await
+            .unwrap();
+        let (_, entry, _) =
+            expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
+        let wired = tokio::fs::read_to_string(root.join("Cargo.toml"))
+            .await
+            .unwrap();
+        assert!(!wired.replace("\r\n", "").contains('\n'), "{wired:?}");
+        assert!(
+            revert_cargo_vendor(&entry.unwrap(), root, false)
+                .await
+                .success
+        );
+        assert_eq!(
+            tokio::fs::read_to_string(root.join("Cargo.toml"))
+                .await
+                .unwrap(),
+            crlf
+        );
+    }
+
+    // ── swap_stage_into_place unit edges ──────────────────────────────────
+
+    /// A failed stage rename with NO pre-existing copy parked (had_old =
+    /// false skips the backup restore): the error propagates and no backup
+    /// is fabricated.
+    #[tokio::test]
+    async fn test_swap_missing_stage_and_vacant_copy_errors() {
+        let dir = tempfile::tempdir().unwrap();
+        let copy = dir.path().join("cfg-if-1.0.4");
+        let err = swap_stage_into_place(&stage_dir_for(&copy), &copy)
+            .await
+            .expect_err("swapping a missing stage into a vacant copy must fail");
+        assert_eq!(err.kind(), std::io::ErrorKind::NotFound);
+        assert!(
+            !backup_dir_for(&copy).exists(),
+            "no fabricated backup litter"
+        );
+        assert!(!copy.exists(), "no fabricated copy");
+    }
+
+    /// A park rename (copy → backup) that fails with a non-NotFound error
+    /// (EACCES: read-only parent) must propagate WITHOUT touching the old
+    /// copy — it is never moved, and no backup appears.
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn test_swap_park_failure_propagates_and_keeps_old_copy() {
+        use std::os::unix::fs::PermissionsExt as _;
+        if unsafe { libc::geteuid() } == 0 {
+            return; // root ignores mode bits — the trigger cannot fire
+        }
+        let dir = tempfile::tempdir().unwrap();
+        let parent = dir.path().join("uuid");
+        let copy = parent.join("cfg-if-1.0.4");
+        tokio::fs::create_dir_all(copy.join("src")).await.unwrap();
+        tokio::fs::write(copy.join("src/lib.rs"), b"live\n")
+            .await
+            .unwrap();
+        let stage = stage_dir_for(&copy);
+        tokio::fs::create_dir_all(&stage).await.unwrap();
+        tokio::fs::write(stage.join("lib.rs"), b"new\n")
+            .await
+            .unwrap();
+
+        std::fs::set_permissions(&parent, std::fs::Permissions::from_mode(0o555)).unwrap();
+        let swapped = swap_stage_into_place(&stage, &copy).await;
+        // Restore before any assert so the tempdir can always be cleaned up.
+        std::fs::set_permissions(&parent, std::fs::Permissions::from_mode(0o755)).unwrap();
+
+        assert!(swapped.is_err(), "the park rename failure must propagate");
+        assert_eq!(
+            tokio::fs::read(copy.join("src/lib.rs")).await.unwrap(),
+            b"live\n",
+            "the old copy is never moved"
+        );
+        assert!(!backup_dir_for(&copy).exists(), "no parked backup");
+        assert!(stage.exists(), "the stage is left for the caller's cleanup");
+    }
+
+    // ── source-flip regression: the hot path decides "in sync" from the
+    //    COMMITTED copy before any service call, so a service ↔ local flip
+    //    between runs is a byte-identical no-op with no request. ──
+
+    async fn flip_run(
+        root: &Path,
+        blobs: &Path,
+        pristine: &Path,
+        record: &PatchRecord,
+        uri: &str,
+    ) -> (ApplyResult, Option<VendorEntry>, Vec<VendorWarning>) {
+        let sources = PatchSources::blobs_only(blobs);
+        expect_done(
+            vendor_cargo_crate(
+                PURL,
+                pristine,
+                root,
+                record,
+                &sources,
+                "2026-06-09T00:00:00Z",
+                false,
+                false,
+                Some(&cargo_service_cfg(uri, VendorSource::Auto, false)),
+            )
+            .await,
+        )
+    }
+
+    /// A service crate that differs from the local build in NON-patched bytes.
+    fn flip_service_crate() -> Vec<u8> {
+        make_crate_tgz(
+            "cfg-if-1.0.4",
+            &[
+                ("src/lib.rs", PATCHED),
+                (
+                    "Cargo.toml",
+                    b"[package]\nname = \"cfg-if\"\nversion = \"1.0.4\"\n# service\n",
+                ),
+                ("README.service.md", b"built by the service\n"),
+            ],
+        )
+    }
+
+    #[tokio::test]
+    async fn flip_local_then_service_is_noop() {
+        use crate::vendor::test_support as ts;
+        let (dir, blobs, pristine, record) = fixture().await;
+        let root = dir.path();
+        let down = wiremock::MockServer::start().await;
+        ts::mount_503(&down).await;
+        let (r1, e1, _) = flip_run(root, &blobs, &pristine, &record, &down.uri()).await;
+        assert!(r1.success && e1.is_some());
+        let before = ts::tree_snapshot(root);
+        let up = wiremock::MockServer::start().await;
+        let tgz = flip_service_crate();
+        mount_cargo_granted(&up, &sri_sha512(&tgz), &tgz).await;
+        let (r2, e2, w2) = flip_run(root, &blobs, &pristine, &record, &up.uri()).await;
+        assert!(r2.success && e2.is_none() && r2.files_patched.is_empty() && w2.is_empty());
+        assert_eq!(ts::tree_snapshot(root), before, "tree byte-identical");
+        assert_eq!(ts::request_count(&up).await, 0);
+    }
+
+    #[tokio::test]
+    async fn flip_service_then_local_is_noop() {
+        use crate::vendor::test_support as ts;
+        let (dir, blobs, pristine, record) = fixture().await;
+        let root = dir.path();
+        let up = wiremock::MockServer::start().await;
+        let tgz = flip_service_crate();
+        mount_cargo_granted(&up, &sri_sha512(&tgz), &tgz).await;
+        let (r1, e1, w1) = flip_run(root, &blobs, &pristine, &record, &up.uri()).await;
+        assert!(r1.success && e1.is_some());
+        assert!(ts::has_warning(&w1, "vendor_prebuilt_downloaded"));
+        let before = ts::tree_snapshot(root);
+        let down = wiremock::MockServer::start().await;
+        ts::mount_503(&down).await;
+        let (r2, e2, w2) = flip_run(root, &blobs, &pristine, &record, &down.uri()).await;
+        assert!(r2.success && e2.is_none() && w2.is_empty());
         assert_eq!(ts::tree_snapshot(root), before);
         assert_eq!(ts::request_count(&down).await, 0);
     }
@@ -3369,4 +4402,495 @@ mod tests {
         );
         assert_eq!(tokio::fs::read(copy_lib(root)).await.unwrap(), PATCHED);
     }
+
+    // ── review follow-ups: shadowing, workspace root, recovery ───────────
+
+    /// A second locked version (cfg-if 0.1.10) plus its pristine source and
+    /// a record under [`UUID2`].
+    async fn add_second_version(
+        root: &Path,
+        pristine: &Path,
+        record: &PatchRecord,
+    ) -> (PathBuf, PatchRecord, &'static str, String) {
+        let lock = format!(
+            "{}\n[[package]]\nname = \"cfg-if\"\nversion = \"0.1.10\"\nsource = \"{SOURCE}\"\nchecksum = \"{}\"\n",
+            lock_body(),
+            "e".repeat(64)
+        );
+        tokio::fs::write(root.join("Cargo.lock"), &lock)
+            .await
+            .unwrap();
+        let pristine2 = root.join("registry/cfg-if-0.1.10");
+        crate::patch::copy_tree::fresh_copy(pristine, &pristine2, None)
+            .await
+            .unwrap();
+        let mut record2 = record.clone();
+        record2.uuid = UUID2.into();
+        (pristine2, record2, "pkg:cargo/cfg-if@0.1.10", lock)
+    }
+
+    /// Cargo lets a manifest `[patch."<crates.io URL>"]` table replace
+    /// `[patch.crates-io]` wholesale: vendoring refuses before any write.
+    #[tokio::test]
+    async fn url_spelled_crates_io_patch_table_refuses_before_any_write() {
+        let (dir, blobs, pristine, record) = fixture().await;
+        let root = dir.path();
+        let manifest = format!(
+            "{}\n[patch.\"https://github.com/rust-lang/crates.io-index\"]\nitoa = {{ path = \"../itoa\" }}\n",
+            tokio::fs::read_to_string(root.join("Cargo.toml"))
+                .await
+                .unwrap()
+        );
+        tokio::fs::write(root.join("Cargo.toml"), &manifest)
+            .await
+            .unwrap();
+        let detail = expect_refused(
+            run_vendor(PURL, root, &blobs, &pristine, &record, false).await,
+            "cargo_manifest_patch_source_alias",
+        );
+        assert!(detail.contains("crates.io-index"), "{detail}");
+        assert_eq!(
+            tokio::fs::read_to_string(root.join("Cargo.toml"))
+                .await
+                .unwrap(),
+            manifest
+        );
+        assert_eq!(
+            tokio::fs::read_to_string(root.join("Cargo.lock"))
+                .await
+                .unwrap(),
+            lock_body()
+        );
+        assert!(!root.join(".socket/vendor").exists());
+    }
+
+    /// Config files in ANCESTOR directories are merged by cargo too (and
+    /// replace a manifest item with the same key): a user entry there that
+    /// may override this crate@version refuses, and its keys are avoided.
+    #[tokio::test]
+    async fn ancestor_config_patch_entries_are_checked() {
+        let (dir, blobs, pristine, record) = fixture().await;
+        let outer = dir.path();
+        // Nest the project one level down so `outer` is its ancestor.
+        let root = outer.join("rust");
+        tokio::fs::create_dir_all(&root).await.unwrap();
+        for f in ["Cargo.toml", "Cargo.lock"] {
+            tokio::fs::rename(outer.join(f), root.join(f))
+                .await
+                .unwrap();
+        }
+        tokio::fs::create_dir_all(outer.join("forks/cfg-if"))
+            .await
+            .unwrap();
+        tokio::fs::write(
+            outer.join("forks/cfg-if/Cargo.toml"),
+            "[package]\nname = \"cfg-if\"\nversion = \"1.0.4\"\n",
+        )
+        .await
+        .unwrap();
+        tokio::fs::create_dir_all(outer.join(".cargo"))
+            .await
+            .unwrap();
+        // Same version, relative to the ancestor's root: may override.
+        tokio::fs::write(
+            outer.join(".cargo/config.toml"),
+            "[patch.crates-io]\ncfg-if = { path = \"forks/cfg-if\" }\n",
+        )
+        .await
+        .unwrap();
+        let detail = expect_refused(
+            run_vendor(PURL, &root, &blobs, &pristine, &record, false).await,
+            "user_authored_patch_entry",
+        );
+        assert!(detail.contains("config.toml"), "{detail}");
+
+        // Another version under the Socket key's spelling: allowed, and the
+        // key it occupies is avoided (a config item would replace ours).
+        tokio::fs::write(
+            outer.join("forks/cfg-if/Cargo.toml"),
+            "[package]\nname = \"cfg-if\"\nversion = \"0.1.10\"\n",
+        )
+        .await
+        .unwrap();
+        tokio::fs::write(
+            outer.join(".cargo/config.toml"),
+            "[patch.crates-io]\ncfg-if-socket-9f6b2c4e = { package = \"cfg-if\", path = \"forks/cfg-if\" }\n",
+        )
+        .await
+        .unwrap();
+        let (result, entry, _) =
+            expect_done(run_vendor(PURL, &root, &blobs, &pristine, &record, false).await);
+        assert!(result.success, "{:?}", result.error);
+        assert_eq!(
+            entry.unwrap().wiring[0].key.as_deref(),
+            Some("cfg-if-socket-9f6b2c4e1d3a4f6b8c2d7e5a9b1c3d5f")
+        );
+    }
+
+    /// The chain reader covers the project, every ancestor, and
+    /// `$CARGO_HOME` (whose relative paths resolve against its parent);
+    /// only the project's own Socket-shaped paths count as Socket-owned.
+    #[tokio::test]
+    async fn config_chain_reads_ancestors_and_cargo_home() {
+        let dir = tempfile::tempdir().unwrap();
+        let outer = tokio::fs::canonicalize(dir.path()).await.unwrap();
+        let root = outer.join("a/b");
+        let home = outer.join("home/.cargo");
+        let socket = |key: &str| {
+            format!(
+                "[patch.crates-io]\n{key} = {{ path = \".socket/vendor/cargo/{UUID}/cfg-if-1.0.4\" }}\n"
+            )
+        };
+        for (d, body) in [
+            (root.join(".cargo"), socket("proj")),
+            (outer.join("a/.cargo"), socket("anc")),
+            (home.clone(), socket("home")),
+        ] {
+            tokio::fs::create_dir_all(&d).await.unwrap();
+            tokio::fs::write(d.join("config.toml"), body).await.unwrap();
+        }
+        let chain = cargo_config::read_config_chain_with(&root, &home).await;
+        let got: Vec<(String, bool, bool, PathBuf)> = chain
+            .iter()
+            .map(|c| {
+                (
+                    c.entries[0].key.clone(),
+                    c.project,
+                    c.entries[0].socket_owned,
+                    c.base.clone(),
+                )
+            })
+            .collect();
+        assert_eq!(
+            got,
+            vec![
+                ("proj".to_string(), true, true, root.clone()),
+                ("anc".to_string(), false, false, outer.join("a")),
+                ("home".to_string(), false, false, outer.join("home")),
+            ]
+        );
+    }
+
+    /// Cargo ignores `[patch]` in a workspace MEMBER's manifest: vendoring
+    /// from a member directory refuses instead of writing dead wiring.
+    #[tokio::test]
+    async fn member_manifest_is_not_the_workspace_root() {
+        let (dir, blobs, pristine, record) = fixture().await;
+        let outer = dir.path();
+        let member = outer.join("m");
+        tokio::fs::create_dir_all(&member).await.unwrap();
+        tokio::fs::rename(outer.join("Cargo.toml"), member.join("Cargo.toml"))
+            .await
+            .unwrap();
+        tokio::fs::remove_file(outer.join("Cargo.lock"))
+            .await
+            .unwrap();
+        let member_manifest = tokio::fs::read_to_string(member.join("Cargo.toml"))
+            .await
+            .unwrap();
+        for ws in [
+            "[workspace]\nmembers = [\"m\"]\n",
+            "[workspace]\nmembers = [\"*\"]\n",
+            "[workspace]\n",
+        ] {
+            tokio::fs::write(outer.join("Cargo.toml"), ws)
+                .await
+                .unwrap();
+            let detail = expect_refused(
+                run_vendor(PURL, &member, &blobs, &pristine, &record, false).await,
+                NOT_WORKSPACE_ROOT,
+            );
+            assert!(detail.contains("workspace rooted at"), "{detail}");
+            assert_eq!(
+                tokio::fs::read_to_string(member.join("Cargo.toml"))
+                    .await
+                    .unwrap(),
+                member_manifest
+            );
+        }
+        // An explicitly excluded directory is its own root.
+        tokio::fs::write(
+            outer.join("Cargo.toml"),
+            "[workspace]\nmembers = []\nexclude = [\"m\"]\n",
+        )
+        .await
+        .unwrap();
+        let (result, _, _) =
+            expect_done(run_vendor(PURL, &member, &blobs, &pristine, &record, false).await);
+        assert!(result.success, "{:?}", result.error);
+
+        // `package.workspace` names another root.
+        let (dir, blobs, pristine, record) = fixture().await;
+        let root = dir.path();
+        let manifest = tokio::fs::read_to_string(root.join("Cargo.toml"))
+            .await
+            .unwrap()
+            .replace(
+                "version = \"0.1.0\"\n",
+                "version = \"0.1.0\"\nworkspace = \"..\"\n",
+            );
+        tokio::fs::write(root.join("Cargo.toml"), manifest)
+            .await
+            .unwrap();
+        let detail = expect_refused(
+            run_vendor(PURL, root, &blobs, &pristine, &record, false).await,
+            NOT_WORKSPACE_ROOT,
+        );
+        assert!(detail.contains("package.workspace"), "{detail}");
+    }
+
+    /// Cargo lets a config `[patch]` item replace the manifest item with the
+    /// same key (any version): an in-sync re-run over an entry whose key a
+    /// config file now uses moves it to a fresh key instead of reporting
+    /// success over wiring cargo ignores.
+    #[tokio::test]
+    async fn in_sync_rerun_moves_an_entry_off_a_config_shadowed_key() {
+        let (dir, blobs, pristine, record) = fixture().await;
+        let root = dir.path();
+        let (r, first, _) =
+            expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
+        assert!(r.success);
+        assert_eq!(
+            first.unwrap().wiring[0].key.as_deref(),
+            Some("cfg-if-socket-9f6b2c4e")
+        );
+        // A user's fork of ANOTHER version under the same key.
+        tokio::fs::create_dir_all(root.join("fork-01"))
+            .await
+            .unwrap();
+        tokio::fs::write(
+            root.join("fork-01/Cargo.toml"),
+            "[package]\nname = \"cfg-if\"\nversion = \"0.1.10\"\n",
+        )
+        .await
+        .unwrap();
+        tokio::fs::create_dir_all(root.join(".cargo"))
+            .await
+            .unwrap();
+        tokio::fs::write(
+            root.join(".cargo/config.toml"),
+            "[patch.crates-io]\ncfg-if-socket-9f6b2c4e = { package = \"cfg-if\", path = \"fork-01\" }\n",
+        )
+        .await
+        .unwrap();
+        let lock_before = tokio::fs::read(root.join("Cargo.lock")).await.unwrap();
+        let (r, entry, _) =
+            expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
+        assert!(r.success, "{:?}", r.error);
+        let entry = entry.expect("the re-keyed entry is recorded");
+        assert_eq!(
+            entry.wiring[0].key.as_deref(),
+            Some("cfg-if-socket-9f6b2c4e1d3a4f6b8c2d7e5a9b1c3d5f")
+        );
+        let keys: Vec<String> = cargo_manifest::read_patch_entries(root)
+            .await
+            .into_iter()
+            .map(|e| e.key)
+            .collect();
+        assert_eq!(keys, vec!["cfg-if-socket-9f6b2c4e1d3a4f6b8c2d7e5a9b1c3d5f"]);
+        assert_eq!(manifest_path(root).await, Some(copy_rel()));
+        assert_eq!(
+            tokio::fs::read(root.join("Cargo.lock")).await.unwrap(),
+            lock_before
+        );
+        // The user's config is untouched.
+        assert!(tokio::fs::read_to_string(root.join(".cargo/config.toml"))
+            .await
+            .unwrap()
+            .contains("fork-01"));
+    }
+
+    /// The hosted takeover's missing-ledger probe is version-scoped: another
+    /// vendored version of the crate does not count.
+    #[tokio::test]
+    async fn socket_wiring_present_is_version_scoped() {
+        let (dir, blobs, pristine, record) = fixture().await;
+        let root = dir.path();
+        let (pristine2, record2, purl2, _) = add_second_version(root, &pristine, &record).await;
+        let (r, _, _) =
+            expect_done(run_vendor(purl2, root, &blobs, &pristine2, &record2, false).await);
+        assert!(r.success, "{:?}", r.error);
+        assert!(socket_wiring_present(root, "cfg-if", "0.1.10").await);
+        assert!(!socket_wiring_present(root, "cfg-if", "1.0.4").await);
+        // Legacy config wiring is version-scoped too.
+        cargo_config::ensure_patch_entry(root, "cfg-if", &copy_rel(), false)
+            .await
+            .unwrap();
+        assert!(socket_wiring_present(root, "cfg-if", "1.0.4").await);
+    }
+
+    /// A pre-v5 release keyed the config `[patch]` by crate name, so
+    /// vendoring a second version repointed the first version's entry: its
+    /// lock entry stayed detached with no wiring. A v5 re-run heals it
+    /// (the committed copy proves the detach was Socket's) instead of
+    /// failing on the already-detached lock entry.
+    #[tokio::test]
+    async fn pre_v5_multi_version_overwrite_is_healed_by_a_rerun() {
+        let (dir, blobs, pristine, record) = fixture().await;
+        let root = dir.path();
+        let (pristine2, record2, purl2, _) = add_second_version(root, &pristine, &record).await;
+        let mut first: Option<VendorEntry> = None;
+        for (purl, src, rec) in [(PURL, &pristine, &record), (purl2, &pristine2, &record2)] {
+            let (r, e, _) = expect_done(run_vendor(purl, root, &blobs, src, rec, false).await);
+            assert!(r.success, "{purl}: {:?}", r.error);
+            first = first.or(e);
+        }
+        let first = first.unwrap();
+        // Rewrite to the clobbered pre-v5 shape.
+        for v in ["1.0.4", "0.1.10"] {
+            cargo_manifest::drop_patch_entries(root, "cfg-if", v, false)
+                .await
+                .unwrap();
+        }
+        let rel2 = format!(".socket/vendor/cargo/{UUID2}/cfg-if-0.1.10");
+        cargo_config::ensure_patch_entry(root, "cfg-if", &rel2, false)
+            .await
+            .unwrap();
+        let lock_before = tokio::fs::read_to_string(root.join("Cargo.lock"))
+            .await
+            .unwrap();
+
+        // `repair`'s step restores the lost entry (dry run writes nothing)…
+        let (_, dry) = migrate_legacy_wiring(&first, root, true)
+            .await
+            .unwrap()
+            .expect("the unwired entry is restorable");
+        assert_eq!(dry.code, "cargo_wiring_restored");
+        assert!(manifest_path(root).await.is_none());
+        let (restored, warning) = migrate_legacy_wiring(&first, root, false)
+            .await
+            .unwrap()
+            .unwrap();
+        assert_eq!(warning.code, "cargo_wiring_restored");
+        assert_eq!(restored.wiring[0].file, "Cargo.toml");
+        assert_eq!(restored.lock, first.lock, "the lock originals are kept");
+        assert_eq!(manifest_path(root).await, Some(copy_rel()));
+        cargo_manifest::drop_patch_entries(root, "cfg-if", "1.0.4", false)
+            .await
+            .unwrap();
+
+        // …and so does a plain vendor re-run.
+        let (result, entry, _) =
+            expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
+        assert!(result.success, "{:?}", result.error);
+        let entry = entry.expect("rewired");
+        assert_eq!(entry.lock, None, "originals carry forward from the ledger");
+        assert_eq!(manifest_path(root).await, Some(copy_rel()));
+        assert!(root.join(copy_rel()).join("src/lib.rs").exists());
+        assert_eq!(
+            tokio::fs::read_to_string(root.join("Cargo.lock"))
+                .await
+                .unwrap(),
+            lock_before,
+            "the lock entry was already detached"
+        );
+        // The other version migrates on its own re-run; both stay wired.
+        let (r2, _, w2) =
+            expect_done(run_vendor(purl2, root, &blobs, &pristine2, &record2, false).await);
+        assert!(r2.success, "{:?}", r2.error);
+        assert!(
+            w2.iter().any(|w| w.code == "cargo_wiring_migrated"),
+            "{w2:?}"
+        );
+        let keys: Vec<String> = cargo_manifest::read_patch_entries(root)
+            .await
+            .into_iter()
+            .map(|e| e.key)
+            .collect();
+        assert_eq!(keys.len(), 2, "{keys:?}");
+        assert!(!root.join(".cargo").exists());
+    }
+
+    /// A legacy config entry that cannot be removed during a uuid-bump
+    /// migration fails the run and unwinds it: nothing may be left pointing
+    /// at the old copy the caller's stale sweep deletes.
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn unremovable_legacy_wiring_unwinds_a_uuid_bump() {
+        use std::os::unix::fs::PermissionsExt;
+        if unsafe { libc::geteuid() } == 0 {
+            return; // root ignores mode bits
+        }
+        let (dir, blobs, pristine, record) = fixture().await;
+        let root = dir.path();
+        legacy_vendor(root, &blobs, &pristine, &record).await;
+        let manifest_before = tokio::fs::read_to_string(root.join("Cargo.toml"))
+            .await
+            .unwrap();
+        let config_before = tokio::fs::read_to_string(root.join(".cargo/config.toml"))
+            .await
+            .unwrap();
+        let lock_before = tokio::fs::read_to_string(root.join("Cargo.lock"))
+            .await
+            .unwrap();
+        let cargo_dir = root.join(".cargo");
+        std::fs::set_permissions(&cargo_dir, std::fs::Permissions::from_mode(0o555)).unwrap();
+        let mut record2 = record.clone();
+        record2.uuid = UUID2.into();
+        let outcome = run_vendor(PURL, root, &blobs, &pristine, &record2, false).await;
+        std::fs::set_permissions(&cargo_dir, std::fs::Permissions::from_mode(0o755)).unwrap();
+
+        let (result, entry, _) = expect_done(outcome);
+        assert!(!result.success);
+        assert!(entry.is_none());
+        assert!(
+            result
+                .error
+                .as_deref()
+                .is_some_and(|e| e.contains("cargo_legacy_wiring_kept")),
+            "{:?}",
+            result.error
+        );
+        for (file, before) in [
+            ("Cargo.toml", &manifest_before),
+            (".cargo/config.toml", &config_before),
+            ("Cargo.lock", &lock_before),
+        ] {
+            assert_eq!(
+                &tokio::fs::read_to_string(root.join(file)).await.unwrap(),
+                before,
+                "{file}"
+            );
+        }
+        assert!(root.join(copy_rel()).exists(), "the live copy stays");
+        assert!(!root.join(format!(".socket/vendor/cargo/{UUID2}")).exists());
+    }
+
+    /// The atomic rewrite would replace a symlinked manifest with a detached
+    /// regular file: a revert that must edit it refuses before any write.
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn revert_refuses_a_symlinked_manifest() {
+        let (dir, blobs, pristine, record) = fixture().await;
+        let root = dir.path();
+        let (_, entry, _) =
+            expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
+        let entry = entry.unwrap();
+        let target = root.join("shared-Cargo.toml");
+        tokio::fs::rename(root.join("Cargo.toml"), &target)
+            .await
+            .unwrap();
+        std::os::unix::fs::symlink(&target, root.join("Cargo.toml")).unwrap();
+        let lock_before = tokio::fs::read_to_string(root.join("Cargo.lock"))
+            .await
+            .unwrap();
+        let out = revert_cargo_vendor(&entry, root, false).await;
+        assert!(!out.success);
+        assert!(
+            out.error
+                .as_deref()
+                .is_some_and(|e| e.contains("cargo_manifest_symlink_unsupported")),
+            "{:?}",
+            out.error
+        );
+        assert!(crate::utils::fs::is_symlink(&root.join("Cargo.toml")).await);
+        assert_eq!(
+            tokio::fs::read_to_string(root.join("Cargo.lock"))
+                .await
+                .unwrap(),
+            lock_before,
+            "nothing was reverted"
+        );
+        assert!(root.join(copy_rel()).exists());
+    }
 }
diff --git a/crates/socket-patch-core/src/vendor/cargo_config.rs b/crates/socket-patch-core/src/vendor/cargo_config.rs
index 388ab1da..84740b2d 100644
--- a/crates/socket-patch-core/src/vendor/cargo_config.rs
+++ b/crates/socket-patch-core/src/vendor/cargo_config.rs
@@ -1,11 +1,15 @@
-//! Read / write `<project_root>/.cargo/config.toml` for the cargo vendor
-//! backend's `[patch.crates-io]` wiring.
+//! The project cargo config (`.cargo/config.toml`, or the legacy
+//! extensionless `.cargo/config` cargo prefers): the shared `[patch.*]` /
+//! `[registries.*]` readers, and the LEGACY vendored wiring.
 //!
-//! Mirrors the contract style of [`crate::setup::pypi::edit`]: pure
-//! `fn(&str) -> Result<Option<String>, String>` transforms (`Some(new)` =
-//! changed, `None` = already in the desired state) wrapped by async
-//! read-or-create / write helpers that honour `dry_run` and preserve the
-//! user's existing formatting + comments via `toml_edit`.
+//! Before v5 the cargo vendor backend wrote its `[patch.crates-io]` path
+//! entry here; v5 writes it to the workspace-root `Cargo.toml` instead
+//! ([`super::cargo_manifest`]). This module still reads the legacy entries
+//! (liveness probes, takeover guards, lockfile discovery) and removes them
+//! on migration and revert ([`drop_legacy_patch_entries`]) — it never writes
+//! a new one. Transforms are pure `fn(&str) -> Result<Option<String>,
+//! String>` (`Some(new)` = changed) wrapped by an async edit helper that
+//! honours `dry_run` and preserves the user's formatting via `toml_edit`.
 //!
 //! ## Ownership model (no sidecar manifest)
 //! A `[patch.crates-io]` entry is *socket-owned* iff its `path` value is a
@@ -27,7 +31,7 @@ use std::collections::HashMap;
 use std::path::{Path, PathBuf};
 
 use tokio::fs;
-use toml_edit::{DocumentMut, InlineTable, Item, Table, TableLike, Value};
+use toml_edit::{DocumentMut, Item, Table, TableLike};
 
 use crate::utils::fs::{atomic_write_bytes_preserving_mode, read_regular_to_string};
 
@@ -56,13 +60,10 @@ pub struct PatchEntryInfo {
 
 // ── public async API ─────────────────────────────────────────────────────────
 
-/// Upsert `[patch.crates-io].<name> = { path = "<rel_path>" }`, where
-/// `rel_path` is the project-relative copy path
-/// (`.socket/vendor/cargo/<uuid>/<name>-<version>`). Idempotent. A
-/// socket-owned same-name entry is refreshed in place. Returns whether the
-/// file changed. Errors (without writing) if a same-name entry exists but is
-/// user-authored.
-pub async fn ensure_patch_entry(
+/// Upsert `[patch.crates-io].<name> = { path = "<rel_path>" }` — the pre-v5
+/// vendored wiring, kept only to seed legacy projects in migration tests.
+#[cfg(test)]
+pub(crate) async fn ensure_patch_entry(
     project_root: &Path,
     name: &str,
     rel_path: &str,
@@ -74,15 +75,134 @@ pub async fn ensure_patch_entry(
     .await
 }
 
-/// Remove a *socket-owned* `[patch.crates-io].<name>` entry, cleaning up empty
-/// `[patch.crates-io]` / `[patch]` tables. A user-authored or absent entry is a
-/// no-op. Returns whether the file changed.
-pub async fn drop_patch_entry(
+/// Remove every *socket-owned* legacy `[patch.crates-io]` entry wiring
+/// `name@version` (key-agnostic: effective crate name + a
+/// `.socket/vendor/cargo/<uuid>/<name>-<version>` path) from the config
+/// cargo reads, cleaning up emptied `[patch.crates-io]` / `[patch]` tables
+/// and deleting a config file (and `.cargo/`) the removal emptied. A
+/// user-authored or absent entry is a no-op. Returns whether the file
+/// changed.
+pub async fn drop_legacy_patch_entries(
     project_root: &Path,
     name: &str,
+    version: &str,
     dry_run: bool,
 ) -> Result<bool, String> {
-    edit_config(project_root, dry_run, |c| remove_patch_entry(c, name)).await
+    edit_config(project_root, dry_run, |c| {
+        remove_patch_entries(c, name, version)
+    })
+    .await
+}
+
+/// The legacy config's socket-owned `[patch.crates-io]` entries for crate
+/// `name` (any version), as `(key, path)`, from the config cargo reads.
+/// Read-only; a missing or malformed config yields none.
+pub async fn legacy_socket_entries(project_root: &Path, name: &str) -> Vec<(String, String)> {
+    let path = config_path(project_root).await;
+    let Ok(content) = read_regular_to_string(&path).await else {
+        return Vec::new();
+    };
+    let Ok(doc) = content.parse::<DocumentMut>() else {
+        return Vec::new();
+    };
+    patch_entries(&doc)
+        .into_iter()
+        .filter(|e| e.source == "crates-io" && e.name == name)
+        .filter_map(|e| {
+            let p = e.path.filter(|p| path_is_socket_owned(p))?;
+            Some((e.key.to_string(), p.to_string()))
+        })
+        .collect()
+}
+
+/// One config file of the chain cargo merges `[patch]` tables from.
+#[derive(Debug, Clone)]
+pub struct ChainConfig {
+    /// For messages: root-relative for the project config, else absolute.
+    pub file: String,
+    /// The directory relative `[patch]` paths in this file resolve against
+    /// (the parent of the directory holding the file).
+    pub base: PathBuf,
+    /// The project's own config — the only file whose Socket-shaped paths
+    /// are this project's copies (legacy wiring). Every entry of any other
+    /// file is reported as user-authored.
+    pub project: bool,
+    /// Its crates.io `[patch]` items (`crates-io` and URL spellings).
+    pub entries: Vec<super::cargo_manifest::ManifestPatchEntry>,
+}
+
+/// Every cargo config file whose `[patch]` items cargo merges over the root
+/// manifest's when building this project: the project's own `.cargo/config*`,
+/// every ancestor directory's, and `$CARGO_HOME`'s (default `~/.cargo`), in
+/// that order (cargo lets a config item replace the manifest item with the
+/// same key, whatever its version). Read-only and fail-soft: missing /
+/// unreadable / malformed files contribute nothing.
+pub async fn read_config_chain(project_root: &Path) -> Vec<ChainConfig> {
+    let cargo_home = match std::env::var("CARGO_HOME") {
+        Ok(v) if !v.trim().is_empty() => PathBuf::from(v),
+        _ => crate::utils::fs::home_dir().join(".cargo"),
+    };
+    read_config_chain_with(project_root, &cargo_home).await
+}
+
+/// [`read_config_chain`] with an explicit `$CARGO_HOME`.
+pub async fn read_config_chain_with(project_root: &Path, cargo_home: &Path) -> Vec<ChainConfig> {
+    let root = fs::canonicalize(project_root)
+        .await
+        .unwrap_or_else(|_| project_root.to_path_buf());
+    let mut dirs: Vec<(PathBuf, PathBuf, bool)> = root
+        .ancestors()
+        .map(|dir| (dir.join(".cargo"), dir.to_path_buf(), dir == root))
+        .collect();
+    let home_base = cargo_home
+        .parent()
+        .map(Path::to_path_buf)
+        .unwrap_or_else(|| cargo_home.to_path_buf());
+    dirs.push((cargo_home.to_path_buf(), home_base, false));
+    let mut seen: Vec<PathBuf> = Vec::new();
+    let mut out = Vec::new();
+    for (cargo_dir, base, project) in dirs {
+        let legacy = cargo_dir.join("config");
+        let file = if fs::metadata(&legacy).await.is_ok() {
+            legacy
+        } else {
+            cargo_dir.join("config.toml")
+        };
+        let key = fs::canonicalize(&file)
+            .await
+            .unwrap_or_else(|_| file.clone());
+        if seen.contains(&key) {
+            continue;
+        }
+        seen.push(key);
+        let Ok(content) = read_regular_to_string(&file).await else {
+            continue;
+        };
+        let Ok(doc) = content.parse::<DocumentMut>() else {
+            continue;
+        };
+        let mut entries = super::cargo_manifest::crates_io_patch_entries(&doc);
+        if !project {
+            for entry in &mut entries {
+                entry.socket_owned = false;
+            }
+        }
+        if entries.is_empty() {
+            continue;
+        }
+        let file = if project {
+            effective_config_rel(project_root).await.to_string()
+        } else {
+            file.display().to_string()
+        };
+        out.push(ChainConfig {
+            file,
+            base,
+            project,
+            entries,
+        });
+    }
+    out
 }
 
 /// Read all `[patch.crates-io]` entries. Read-only; a missing or malformed
@@ -282,7 +402,7 @@ async fn edit_config(
 /// checkout's `.socket/vendor/cargo/` (`../shared/.socket/vendor/cargo/…`,
 /// `/abs/.socket/vendor/cargo/…`, `sub/.socket/vendor/cargo/…`) is
 /// user-authored and must never be rewritten or removed.
-fn path_is_socket_owned(path: &str) -> bool {
+pub(crate) fn path_is_socket_owned(path: &str) -> bool {
     let norm = path.replace('\\', "/");
     if norm.starts_with('/') {
         return false; // absolute (also covers //unc-style prefixes)
@@ -302,6 +422,7 @@ fn path_is_socket_owned(path: &str) -> bool {
 }
 
 /// The `path` string of a `[patch]` entry (inline table or sub-table), if any.
+#[cfg(test)]
 fn entry_path(item: &Item) -> Option<&str> {
     item.as_table_like()
         .and_then(|t| t.get("path"))
@@ -314,7 +435,7 @@ fn entry_path(item: &Item) -> Option<&str> {
 /// cargo honors identically to `[patch.crates-io]` (a hand edit or another
 /// tool re-serializing this user-owned file produces it), and refusing it
 /// would strand the socket-owned entries inside. Errors on a non-table item.
-fn ensure_table_like<'a>(
+pub(crate) fn ensure_table_like<'a>(
     parent: &'a mut dyn TableLike,
     key: &str,
     implicit: bool,
@@ -332,7 +453,9 @@ fn ensure_table_like<'a>(
         .ok_or_else(|| format!("`{key}` is not a table"))
 }
 
+#[cfg(test)]
 fn upsert_patch_entry(content: &str, name: &str, rel_path: &str) -> Result<Option<String>, String> {
+    use toml_edit::{InlineTable, Value};
     let mut doc = content
         .parse::<DocumentMut>()
         .map_err(|e| format!("Invalid .cargo/config.toml: {e}"))?;
@@ -361,32 +484,42 @@ fn upsert_patch_entry(content: &str, name: &str, rel_path: &str) -> Result<Optio
     Ok(Some(doc.to_string()))
 }
 
-fn remove_patch_entry(content: &str, name: &str) -> Result<Option<String>, String> {
+fn remove_patch_entries(
+    content: &str,
+    name: &str,
+    version: &str,
+) -> Result<Option<String>, String> {
     let mut doc = content
         .parse::<DocumentMut>()
         .map_err(|e| format!("Invalid .cargo/config.toml: {e}"))?;
-
-    let mut removed = false;
-    // Table-like views (as in `entry_path`): the inline `crates-io = { … }`
-    // form is honored by cargo, and a remove blind to it would leave the
-    // entry dangling after the vendor copy it points at is deleted.
+    let keys: Vec<String> = patch_entries(&doc)
+        .into_iter()
+        .filter(|e| {
+            e.source == "crates-io"
+                && e.name == name
+                && e.path
+                    .is_some_and(|p| super::cargo_manifest::is_socket_copy_of(p, name, version))
+        })
+        .map(|e| e.key.to_string())
+        .collect();
+    if keys.is_empty() {
+        return Ok(None);
+    }
+    // Table-like views: the inline `crates-io = { … }` form is honored by
+    // cargo, and a remove blind to it would leave the entry dangling after
+    // the vendor copy it points at is deleted.
     if let Some(patch) = doc.get_mut("patch").and_then(Item::as_table_like_mut) {
         let mut crates_io_empty = false;
         if let Some(crates_io) = patch.get_mut("crates-io").and_then(Item::as_table_like_mut) {
-            if matches!(crates_io.get(name).and_then(entry_path), Some(p) if path_is_socket_owned(p))
-            {
-                crates_io.remove(name);
-                removed = true;
-                crates_io_empty = crates_io.is_empty();
+            for key in &keys {
+                crates_io.remove(key);
             }
+            crates_io_empty = crates_io.is_empty();
         }
         if crates_io_empty {
             patch.remove("crates-io");
         }
     }
-    if !removed {
-        return Ok(None);
-    }
     if doc
         .get("patch")
         .and_then(Item::as_table_like)
@@ -478,7 +611,7 @@ mod tests {
     #[test]
     fn test_remove_foreign_socket_path_entry_is_noop() {
         let toml = "[patch.crates-io]\ncfg-if = { path = \"../other-checkout/.socket/vendor/cargo/9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f/cfg-if-1.0.4\" }\n";
-        let out = remove_patch_entry(toml, "cfg-if").unwrap();
+        let out = remove_patch_entries(toml, "cfg-if", "1.0.4").unwrap();
         assert!(
             out.is_none(),
             "user entry must be a no-op, but it was removed: {out:?}"
@@ -609,7 +742,9 @@ mod tests {
             "[patch.crates-io]\ncfg-if = {{ path = \"{}\" }}\n",
             vendor_path("cfg-if", "1.0.4")
         );
-        let out = remove_patch_entry(&toml, "cfg-if").unwrap().unwrap();
+        let out = remove_patch_entries(&toml, "cfg-if", "1.0.4")
+            .unwrap()
+            .unwrap();
         assert!(!out.contains("cfg-if"));
         // Empty [patch.crates-io] and [patch] are pruned.
         assert!(!out.contains("[patch"));
@@ -620,7 +755,9 @@ mod tests {
         let toml =
             "[patch.crates-io]\ncfg-if = { path = \".socket/cargo-patches/cfg-if-1.0.4\" }\n";
         assert!(
-            remove_patch_entry(toml, "cfg-if").unwrap().is_none(),
+            remove_patch_entries(toml, "cfg-if", "1.0.4")
+                .unwrap()
+                .is_none(),
             "a user-authored entry is never removed"
         );
     }
@@ -631,7 +768,9 @@ mod tests {
             "[patch.crates-io]\ncfg-if = {{ path = \"{}\" }}\nother = {{ git = \"https://example.com/o.git\" }}\n",
             vendor_path("cfg-if", "1.0.4")
         );
-        let out = remove_patch_entry(&toml, "cfg-if").unwrap().unwrap();
+        let out = remove_patch_entries(&toml, "cfg-if", "1.0.4")
+            .unwrap()
+            .unwrap();
         let doc = parse(&out);
         assert!(doc["patch"]["crates-io"].get("cfg-if").is_none());
         assert!(doc["patch"]["crates-io"].get("other").is_some());
@@ -640,9 +779,13 @@ mod tests {
     #[test]
     fn test_remove_user_authored_same_name_is_noop() {
         let toml = "[patch.crates-io]\ncfg-if = { git = \"https://example.com/c.git\" }\n";
-        assert!(remove_patch_entry(toml, "cfg-if").unwrap().is_none());
+        assert!(remove_patch_entries(toml, "cfg-if", "1.0.4")
+            .unwrap()
+            .is_none());
         let toml = "[patch.crates-io]\ncfg-if = { path = \"../my-fork\" }\n";
-        assert!(remove_patch_entry(toml, "cfg-if").unwrap().is_none());
+        assert!(remove_patch_entries(toml, "cfg-if", "1.0.4")
+            .unwrap()
+            .is_none());
     }
 
     /// COVERAGE 2026-09: removal twin of the inline-form blindness. A
@@ -656,7 +799,7 @@ mod tests {
             "[patch]\ncrates-io = {{ cfg-if = {{ path = \"{}\" }} }}\n",
             vendor_path("cfg-if", "1.0.4")
         );
-        let out = remove_patch_entry(&toml, "cfg-if")
+        let out = remove_patch_entries(&toml, "cfg-if", "1.0.4")
             .unwrap()
             .expect("socket-owned inline-form entry must be removed, not no-op'd");
         assert!(!out.contains("cfg-if"));
@@ -667,7 +810,7 @@ mod tests {
             "patch = {{ crates-io = {{ cfg-if = {{ path = \"{}\" }} }} }}\n",
             vendor_path("cfg-if", "1.0.4")
         );
-        let out = remove_patch_entry(&toml, "cfg-if")
+        let out = remove_patch_entries(&toml, "cfg-if", "1.0.4")
             .unwrap()
             .expect("fully-inline patch form entry must be removed");
         assert!(!out.contains("cfg-if"));
@@ -682,7 +825,9 @@ mod tests {
             "[patch]\ncrates-io = {{ cfg-if = {{ path = \"{}\" }}, other = {{ git = \"https://example.com/o.git\" }} }}\n",
             vendor_path("cfg-if", "1.0.4")
         );
-        let out = remove_patch_entry(&toml, "cfg-if").unwrap().unwrap();
+        let out = remove_patch_entries(&toml, "cfg-if", "1.0.4")
+            .unwrap()
+            .unwrap();
         let doc = parse(&out);
         assert!(doc["patch"]["crates-io"].get("cfg-if").is_none());
         assert!(doc["patch"]["crates-io"].get("other").is_some());
@@ -693,16 +838,41 @@ mod tests {
     #[test]
     fn test_remove_inline_form_user_entry_is_noop() {
         let toml = "[patch]\ncrates-io = { cfg-if = { path = \"../my-fork\" } }\n";
-        assert!(remove_patch_entry(toml, "cfg-if").unwrap().is_none());
+        assert!(remove_patch_entries(toml, "cfg-if", "1.0.4")
+            .unwrap()
+            .is_none());
     }
 
+    /// Legacy removal is KEY-AGNOSTIC and VERSION-SCOPED: a renamed
+    /// socket-owned entry for the crate@version goes; another version's
+    /// socket-owned entry stays.
     #[test]
-    fn test_remove_absent_is_noop() {
-        assert!(remove_patch_entry("[build]\njobs = 2\n", "cfg-if")
+    fn test_remove_is_key_agnostic_and_version_scoped() {
+        let toml = format!(
+            "[patch.crates-io]\nalias = {{ package = \"cfg-if\", path = \"{}\" }}\ncfg-if = {{ path = \"{}\" }}\n",
+            vendor_path("cfg-if", "1.0.4"),
+            vendor_path("cfg-if", "0.1.10")
+        );
+        let out = remove_patch_entries(&toml, "cfg-if", "1.0.4")
+            .unwrap()
+            .unwrap();
+        let doc = parse(&out);
+        assert!(doc["patch"]["crates-io"].get("alias").is_none());
+        assert!(doc["patch"]["crates-io"].get("cfg-if").is_some());
+        assert!(remove_patch_entries(&out, "cfg-if", "1.0.4")
             .unwrap()
             .is_none());
     }
 
+    #[test]
+    fn test_remove_absent_is_noop() {
+        assert!(
+            remove_patch_entries("[build]\njobs = 2\n", "cfg-if", "1.0.4")
+                .unwrap()
+                .is_none()
+        );
+    }
+
     /// COVERAGE 2026-09: `[patch]` exists but `crates-io` is absent or not a
     /// table. Only `[patch.crates-io]` is managed — an entry under some other
     /// registry's patch table is never ours, even when its `path` value looks
@@ -716,13 +886,17 @@ mod tests {
             vendor_path("foo", "1.0.0")
         );
         assert!(
-            remove_patch_entry(&toml, "foo").unwrap().is_none(),
+            remove_patch_entries(&toml, "foo", "1.0.0")
+                .unwrap()
+                .is_none(),
             "entries under a foreign registry's patch table are not managed"
         );
         // `crates-io` present but not table-like.
         let toml = "[patch]\ncrates-io = \"oops\"\n";
         assert!(
-            remove_patch_entry(toml, "cfg-if").unwrap().is_none(),
+            remove_patch_entries(toml, "cfg-if", "1.0.4")
+                .unwrap()
+                .is_none(),
             "a non-table crates-io value must be left untouched"
         );
     }
@@ -831,7 +1005,11 @@ mod tests {
             .await
             .unwrap());
         // Drop it.
-        assert!(drop_patch_entry(dir.path(), "cfg-if", false).await.unwrap());
+        assert!(
+            drop_legacy_patch_entries(dir.path(), "cfg-if", "1.0.4", false)
+                .await
+                .unwrap()
+        );
         assert!(read_patch_entries(dir.path()).await.is_empty());
     }
 
@@ -1083,7 +1261,11 @@ mod tests {
         );
         assert!(dir.path().join(".cargo/config.toml").exists());
         // Revert empties it → both the file and the now-empty `.cargo/` go.
-        assert!(drop_patch_entry(dir.path(), "cfg-if", false).await.unwrap());
+        assert!(
+            drop_legacy_patch_entries(dir.path(), "cfg-if", "1.0.4", false)
+                .await
+                .unwrap()
+        );
         assert!(
             !dir.path().join(".cargo/config.toml").exists(),
             "an emptied socket-created config must be deleted, not left empty"
@@ -1108,7 +1290,11 @@ mod tests {
         )
         .await
         .unwrap();
-        assert!(drop_patch_entry(dir.path(), "cfg-if", false).await.unwrap());
+        assert!(
+            drop_legacy_patch_entries(dir.path(), "cfg-if", "1.0.4", false)
+                .await
+                .unwrap()
+        );
         // The file survives (user content remains); only our entry is gone.
         let body = fs::read_to_string(cargo_dir.join("config.toml"))
             .await
@@ -1135,7 +1321,11 @@ mod tests {
                 .await
                 .unwrap()
         );
-        assert!(drop_patch_entry(dir.path(), "cfg-if", false).await.unwrap());
+        assert!(
+            drop_legacy_patch_entries(dir.path(), "cfg-if", "1.0.4", false)
+                .await
+                .unwrap()
+        );
         assert!(
             !cargo_dir.join("config.toml").exists(),
             "emptied config is deleted"
@@ -1148,7 +1338,7 @@ mod tests {
 
     /// COVERAGE 2026-09: a real `remove_file` failure in the delete branch
     /// must propagate as `Err("remove {path}: …")` — a swallowed unlink error
-    /// would make `drop_patch_entry` report a successful revert while the
+    /// would make `drop_legacy_patch_entries` report a successful revert while the
     /// stale `[patch]` wiring still sits on disk.
     #[cfg(unix)]
     #[tokio::test]
@@ -1169,7 +1359,7 @@ mod tests {
         fs::set_permissions(&cargo_dir, std::fs::Permissions::from_mode(0o555))
             .await
             .unwrap();
-        let res = drop_patch_entry(dir.path(), "cfg-if", false).await;
+        let res = drop_legacy_patch_entries(dir.path(), "cfg-if", "1.0.4", false).await;
         // Restore before asserting so the tempdir always cleans up.
         fs::set_permissions(&cargo_dir, std::fs::Permissions::from_mode(0o755))
             .await
diff --git a/crates/socket-patch-core/src/vendor/cargo_manifest.rs b/crates/socket-patch-core/src/vendor/cargo_manifest.rs
new file mode 100644
index 00000000..8b35f5fa
--- /dev/null
+++ b/crates/socket-patch-core/src/vendor/cargo_manifest.rs
@@ -0,0 +1,1220 @@
+//! Read / write the workspace-root `Cargo.toml` `[patch.crates-io]` wiring of
+//! the cargo vendor backend (v5+; the pre-v5 backend wrote the same entry to
+//! `.cargo/config.toml` — see [`super::cargo_config`] for the legacy reader
+//! and the migration cleanup).
+//!
+//! ## Why the manifest
+//! `Cargo.toml` is the file every Socket scanner already ingests, so the
+//! `.socket/vendor/cargo/<uuid>/<name>-<version>` path — and with it the
+//! patch uuid — is recoverable for SBOM annotation without uploading
+//! `.cargo/config*` (which may hold registry tokens and other secrets).
+//! A single vendored version per crate also builds, with no network, on
+//! cargo older than 1.56 (the floor of config-file `[patch]`); two vendored
+//! versions of ONE crate additionally need `--offline` (or a reachable
+//! registry index) on such old cargo, which loads the crates.io index to
+//! tell them apart — current stable does not.
+//!
+//! ## Entry shape and keys
+//! `<name>-socket-<first 8 hex of the uuid> = { package = "<name>", path =
+//! ".socket/vendor/cargo/<uuid>/<name>-<version>" }` under the manifest's
+//! `[patch.crates-io]` (the workspace-root Cargo.toml, next to the
+//! `Cargo.lock` the backend detaches). The key is ALWAYS the Socket-owned
+//! renamed form, never the bare crate name: cargo lets any config-file
+//! `[patch]` item (project, ancestor directory, or `$CARGO_HOME`) replace
+//! the manifest item with the same key regardless of version, so a bare key
+//! could be silently shadowed by a user's same-named config entry. With a
+//! distinct key a conflicting same-version config patch is a loud cargo
+//! error instead, and several versions of one crate get distinct keys. The
+//! fallback when the short key is taken is `<name>-socket-<uuid hex>`.
+//!
+//! A manifest that also spells the crates.io source by URL
+//! (`[patch."https://github.com/rust-lang/crates.io-index"]`) is refused:
+//! cargo keys manifest `[patch]` tables by URL and that table silently
+//! replaces `[patch.crates-io]` wholesale.
+//!
+//! ## Ownership (no sidecar)
+//! Exactly as for the legacy config: an entry is Socket-owned iff its `path`
+//! is a root-anchored relative path under THIS project's
+//! `.socket/vendor/cargo/`. Lookups are KEY-AGNOSTIC — an entry belongs to
+//! `name@version` when its effective crate name (`package` when renamed,
+//! else the key) is `name` and its path's leaf is `<name>-<version>` — so a
+//! re-run, a revert, and lockfile discovery never depend on which key a
+//! previous run picked. User-authored entries are never modified.
+//!
+//! ## Formatting
+//! Edits go through `toml_edit` (comments, ordering, and spacing survive),
+//! and [`reconcile_line_endings`] maps the result back onto the original
+//! file's line endings (`toml_edit` renders LF only): CRLF and mixed files
+//! keep every untouched line's ending, new lines take the file's dominant
+//! ending, the presence or absence of a trailing newline is preserved, and
+//! a leading UTF-8 BOM (which `toml_edit` drops) is put back — so a revert
+//! with nothing else changed restores the manifest byte for byte. A revert
+//! keeps a user's explicit `[patch]` header, and a `[patch.crates-io]`
+//! header that another table follows or that carries a comment (the table
+//! socket-patch creates is appended last and bare).
+
+use std::path::Path;
+
+use toml_edit::{DocumentMut, InlineTable, Item, Value};
+
+use crate::utils::fs::{atomic_write_bytes_preserving_mode, read_regular_to_string};
+
+use super::cargo_config::{ensure_table_like, patch_entries, path_is_socket_owned};
+
+/// The root manifest, relative to the project root.
+pub const CARGO_TOML: &str = "Cargo.toml";
+
+/// The infix of the Socket-owned key
+/// (`<name>-socket-<first 8 hex of the uuid>`).
+pub const SOCKET_KEY_INFIX: &str = "-socket-";
+
+/// The index URL cargo maps the `crates-io` `[patch]` key to.
+pub const CRATES_IO_INDEX_URL: &str = "https://github.com/rust-lang/crates.io-index";
+
+/// Does a `[patch.<source>]` key spell the crates.io index by URL
+/// (case, a trailing `/`, and a `.git` suffix ignored — conservative)?
+pub fn is_crates_io_url_alias(source: &str) -> bool {
+    let lower = source.trim().to_ascii_lowercase();
+    let trimmed = lower.trim_end_matches('/');
+    trimmed.strip_suffix(".git").unwrap_or(trimmed) == CRATES_IO_INDEX_URL
+}
+
+/// Does a `[patch.<source>]` key name crates.io (`crates-io` or the URL)?
+pub fn is_crates_io_source(source: &str) -> bool {
+    source == "crates-io" || is_crates_io_url_alias(source)
+}
+
+/// The `[patch.<url>]` keys of a document that spell crates.io by URL.
+pub fn crates_io_url_alias_tables(doc: &DocumentMut) -> Vec<String> {
+    doc.get("patch")
+        .and_then(Item::as_table_like)
+        .map(|patch| {
+            patch
+                .iter()
+                .filter(|(source, item)| is_crates_io_url_alias(source) && item.is_table_like())
+                .map(|(source, _)| source.to_string())
+                .collect()
+        })
+        .unwrap_or_default()
+}
+
+/// Is `key` a Socket-owned key for crate `name`
+/// (`<name>-socket-<8 or 32 lowercase hex>`)?
+pub fn is_socket_key(key: &str, name: &str) -> bool {
+    key.strip_prefix(name)
+        .and_then(|rest| rest.strip_prefix(SOCKET_KEY_INFIX))
+        .is_some_and(|hex| {
+            (hex.len() == 8 || hex.len() == 32)
+                && hex
+                    .bytes()
+                    .all(|b| b.is_ascii_digit() || (b'a'..=b'f').contains(&b))
+        })
+}
+
+// ── pure reader ──────────────────────────────────────────────────────────────
+// The read-only view of a parsed manifest shared by the writer below, the
+// vendor backend, and lockfile discovery.
+
+/// One crates.io `[patch]` item of a manifest.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ManifestPatchEntry {
+    /// The `[patch.<source>]` key: `crates-io`, or a URL spelling of it.
+    pub source: String,
+    /// The item's key as written.
+    pub key: String,
+    /// The crate it patches: `package = "…"` when renamed, else the key.
+    pub name: String,
+    /// The `path` value as written, `None` for a git / registry patch.
+    pub path: Option<String>,
+    /// True iff `path` is under this project's `.socket/vendor/cargo/`.
+    pub socket_owned: bool,
+}
+
+/// Every crates.io `[patch]` item of a parsed manifest (or config) —
+/// `[patch.crates-io]` and its URL spellings ([`is_crates_io_source`]) — in
+/// document order, header, dotted, sub-table and inline forms alike.
+pub fn crates_io_patch_entries(doc: &DocumentMut) -> Vec<ManifestPatchEntry> {
+    patch_entries(doc)
+        .into_iter()
+        .filter(|entry| is_crates_io_source(entry.source))
+        .map(|entry| ManifestPatchEntry {
+            source: entry.source.to_string(),
+            key: entry.key.to_string(),
+            name: entry.name.to_string(),
+            path: entry.path.map(str::to_string),
+            socket_owned: entry.path.is_some_and(path_is_socket_owned),
+        })
+        .collect()
+}
+
+/// A Socket-owned path normalised to the canonical
+/// `.socket/vendor/cargo/<uuid>/<leaf>` spelling (forward slashes, no `./`
+/// segments, no trailing slash); `None` for a path that is not Socket-owned.
+pub fn normalize_socket_path(path: &str) -> Option<String> {
+    if !path_is_socket_owned(path) {
+        return None;
+    }
+    let norm = path.replace('\\', "/");
+    let segments: Vec<&str> = norm
+        .split('/')
+        .filter(|s| !s.is_empty() && *s != ".")
+        .collect();
+    Some(segments.join("/"))
+}
+
+/// Is `path` a Socket-owned copy of exactly `name@version`: under
+/// `.socket/vendor/cargo/<one uuid level>/` with the leaf
+/// `<name>-<version>`?
+pub fn is_socket_copy_of(path: &str, name: &str, version: &str) -> bool {
+    let Some(norm) = normalize_socket_path(path) else {
+        return false;
+    };
+    let segments: Vec<&str> = norm.split('/').collect();
+    segments.len() == 5 && segments[4] == format!("{name}-{version}")
+}
+
+/// Does `entry` wire `name@version` to one of this project's copies?
+pub fn entry_wires(entry: &ManifestPatchEntry, name: &str, version: &str) -> bool {
+    entry.socket_owned
+        && entry.name == name
+        && entry
+            .path
+            .as_deref()
+            .is_some_and(|p| is_socket_copy_of(p, name, version))
+}
+
+/// The key a fresh entry for `name` takes: `<name>-socket-<uuid8>`, else
+/// `<name>-socket-<uuid without dashes>` — never the bare crate name (see
+/// the module docs). `taken` answers whether a key is occupied (the
+/// manifest table, plus every config-file `[patch]` key cargo merges).
+/// `None` when every candidate is taken.
+pub fn choose_key(name: &str, uuid: &str, taken: impl Fn(&str) -> bool) -> Option<String> {
+    let compact: String = uuid
+        .chars()
+        .filter(|c| *c != '-')
+        .map(|c| c.to_ascii_lowercase())
+        .collect();
+    let short: String = compact.chars().take(8).collect();
+    [
+        format!("{name}{SOCKET_KEY_INFIX}{short}"),
+        format!("{name}{SOCKET_KEY_INFIX}{compact}"),
+    ]
+    .into_iter()
+    .find(|key| !taken(key))
+}
+
+/// Map `edited` (LF-only `toml_edit` output for `original`) back onto
+/// `original`'s line endings. Lines are aligned by content (longest common
+/// subsequence over the region between the common prefix and suffix — the
+/// edits here are localised): an unchanged line keeps its original ending,
+/// an inserted line takes the file's dominant ending, a deleted line goes.
+/// The presence of a trailing newline is preserved.
+pub fn reconcile_line_endings(original: &str, edited: &str) -> String {
+    let orig: Vec<(&str, &str)> = split_lines(original);
+    let crlf = orig.iter().filter(|(_, e)| *e == "\r\n").count();
+    let lf = orig.iter().filter(|(_, e)| *e == "\n").count();
+    let eol = if crlf > lf { "\r\n" } else { "\n" };
+    let new: Vec<&str> = split_lines(edited).into_iter().map(|(l, _)| l).collect();
+
+    let mut pre = 0;
+    while pre < orig.len() && pre < new.len() && orig[pre].0 == new[pre] {
+        pre += 1;
+    }
+    let mut suf = 0;
+    while suf < orig.len() - pre
+        && suf < new.len() - pre
+        && orig[orig.len() - 1 - suf].0 == new[new.len() - 1 - suf]
+    {
+        suf += 1;
+    }
+    let o_mid = &orig[pre..orig.len() - suf];
+    let n_mid = &new[pre..new.len() - suf];
+
+    // `Some(i)`: new line j keeps original line pre+i; `None`: inserted.
+    let mut mapping: Vec<Option<usize>> = (0..pre).map(Some).collect();
+    if o_mid.len().saturating_mul(n_mid.len()) <= 4_000_000 {
+        let (n, m) = (o_mid.len(), n_mid.len());
+        let mut dp = vec![0u32; (n + 1) * (m + 1)];
+        let at = |i: usize, j: usize| i * (m + 1) + j;
+        for i in (0..n).rev() {
+            for j in (0..m).rev() {
+                dp[at(i, j)] = if o_mid[i].0 == n_mid[j] {
+                    dp[at(i + 1, j + 1)] + 1
+                } else {
+                    dp[at(i + 1, j)].max(dp[at(i, j + 1)])
+                };
+            }
+        }
+        let (mut i, mut j) = (0, 0);
+        while j < m {
+            if i < n && o_mid[i].0 == n_mid[j] {
+                mapping.push(Some(pre + i));
+                i += 1;
+                j += 1;
+            } else if i < n && dp[at(i + 1, j)] >= dp[at(i, j + 1)] {
+                i += 1;
+            } else {
+                mapping.push(None);
+                j += 1;
+            }
+        }
+    } else {
+        mapping.extend(std::iter::repeat_n(None, n_mid.len()));
+    }
+    mapping.extend((orig.len() - suf..orig.len()).map(Some));
+
+    let mut out = String::with_capacity(edited.len() + new.len());
+    for (j, keep) in mapping.iter().enumerate() {
+        match keep {
+            Some(i) => {
+                out.push_str(orig[*i].0);
+                out.push_str(if orig[*i].1.is_empty() {
+                    eol
+                } else {
+                    orig[*i].1
+                });
+            }
+            None => {
+                out.push_str(new[j]);
+                out.push_str(eol);
+            }
+        }
+    }
+    let trailing = original.is_empty() || original.ends_with('\n');
+    if !trailing {
+        if let Some(stripped) = out.strip_suffix("\r\n").or_else(|| out.strip_suffix('\n')) {
+            out.truncate(stripped.len());
+        }
+    }
+    out
+}
+
+/// `(content, ending)` per line, ending ∈ {`"\r\n"`, `"\n"`, `""`}; an
+/// empty text has no lines.
+fn split_lines(text: &str) -> Vec<(&str, &str)> {
+    text.split_inclusive('\n')
+        .map(|seg| {
+            if let Some(content) = seg.strip_suffix("\r\n") {
+                (content, "\r\n")
+            } else if let Some(content) = seg.strip_suffix('\n') {
+                (content, "\n")
+            } else {
+                (seg, "")
+            }
+        })
+        .collect()
+}
+
+// ── pure transforms ──────────────────────────────────────────────────────────
+
+/// Why the manifest could not be read or edited. Each variant has a stable
+/// refusal code ([`ManifestError::code`]).
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum ManifestError {
+    /// Missing, not a regular file, or unreadable.
+    Unreadable(String),
+    /// Not valid TOML, or `[patch.crates-io]` is not a table.
+    Unparseable(String),
+    /// No free key for the entry (every Socket-owned candidate is taken).
+    NoFreeKey(String),
+    /// The manifest spells crates.io by URL in a `[patch]` table, which
+    /// makes cargo ignore `[patch.crates-io]`.
+    SourceAlias(String),
+    /// The write failed.
+    Write(String),
+}
+
+impl ManifestError {
+    /// The stable refusal / warning code.
+    pub fn code(&self) -> &'static str {
+        match self {
+            ManifestError::Unreadable(_) => "cargo_manifest_unreadable",
+            ManifestError::Unparseable(_) => "cargo_manifest_unparseable",
+            ManifestError::NoFreeKey(_) => "cargo_manifest_patch_key_conflict",
+            ManifestError::SourceAlias(_) => "cargo_manifest_patch_source_alias",
+            ManifestError::Write(_) => "cargo_manifest_write_failed",
+        }
+    }
+
+    /// The human detail.
+    pub fn detail(&self) -> &str {
+        match self {
+            ManifestError::Unreadable(d)
+            | ManifestError::Unparseable(d)
+            | ManifestError::NoFreeKey(d)
+            | ManifestError::SourceAlias(d)
+            | ManifestError::Write(d) => d,
+        }
+    }
+}
+
+impl std::fmt::Display for ManifestError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(self.detail())
+    }
+}
+
+/// Parse a manifest (CRLF and a leading BOM tolerated).
+pub fn parse_manifest(content: &str) -> Result<DocumentMut, ManifestError> {
+    split_bom(content)
+        .1
+        .replace("\r\n", "\n")
+        .parse::<DocumentMut>()
+        .map_err(|e| ManifestError::Unparseable(format!("Cargo.toml is not valid TOML: {e}")))
+}
+
+/// `(bom, rest)`: a leading UTF-8 BOM (`toml_edit` accepts it but never
+/// renders it back), split off so an edit can restore it.
+fn split_bom(content: &str) -> (&str, &str) {
+    match content.strip_prefix('\u{feff}') {
+        Some(rest) => ("\u{feff}", rest),
+        None => ("", content),
+    }
+}
+
+/// `edited` (the `toml_edit` rendering of `original` after an edit) mapped
+/// back onto `original`'s BOM and line endings.
+fn render_like(original: &str, edited: &str) -> String {
+    let (bom, body) = split_bom(original);
+    format!("{bom}{}", reconcile_line_endings(body, edited))
+}
+
+/// Refuse a manifest that spells crates.io by URL in `[patch]`
+/// ([`ManifestError::SourceAlias`]).
+pub fn check_source_alias(doc: &DocumentMut) -> Result<(), ManifestError> {
+    match crates_io_url_alias_tables(doc).first() {
+        None => Ok(()),
+        Some(alias) => Err(ManifestError::SourceAlias(format!(
+            "Cargo.toml has a `[patch.\"{alias}\"]` table: cargo treats it as the same \
+             source as `[patch.crates-io]` and lets it replace that table wholesale, so a \
+             vendored `[patch.crates-io]` entry would be silently ignored; move its \
+             entries under `[patch.crates-io]` and re-run"
+        ))),
+    }
+}
+
+/// The result of [`upsert_patch_entry`].
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Upsert {
+    /// The new manifest text, `None` when already in the desired state.
+    pub content: Option<String>,
+    /// The key the entry lives under.
+    pub key: String,
+    /// The path a pre-existing Socket-owned entry for `name@version` held.
+    pub prior_path: Option<String>,
+}
+
+/// Wire `name@version` to `rel_path` in the manifest's `[patch.crates-io]`.
+/// A Socket-owned entry already wiring `name@version` (any uuid) is
+/// refreshed in place when it sits under a Socket-owned key that no config
+/// file uses; otherwise it moves to a fresh [`choose_key`] key (a key in
+/// `reserved` — every config-file `[patch]` key — counts as taken, since a
+/// config item replaces the manifest item with the same key). Extra
+/// Socket-owned duplicates for `name@version` are dropped. User-authored
+/// entries are never touched. A `[patch.<crates.io URL>]` table refuses
+/// ([`ManifestError::SourceAlias`]).
+pub fn upsert_patch_entry(
+    content: &str,
+    name: &str,
+    version: &str,
+    uuid: &str,
+    rel_path: &str,
+    reserved: &[String],
+) -> Result<Upsert, ManifestError> {
+    let mut doc = parse_manifest(content)?;
+    check_source_alias(&doc)?;
+    let mine: Vec<ManifestPatchEntry> = crates_io_patch_entries(&doc)
+        .into_iter()
+        .filter(|e| e.source == "crates-io" && entry_wires(e, name, version))
+        .collect();
+    let is_reserved = |k: &str| reserved.iter().any(|r| r == k);
+    let root = doc.as_table_mut();
+    let patch = ensure_table_like(root, "patch", true).map_err(ManifestError::Unparseable)?;
+    let crates_io =
+        ensure_table_like(patch, "crates-io", false).map_err(ManifestError::Unparseable)?;
+
+    let mut changed = false;
+    let fresh_key = |crates_io: &dyn toml_edit::TableLike| {
+        choose_key(name, uuid, |k| crates_io.contains_key(k) || is_reserved(k)).ok_or_else(|| {
+            ManifestError::NoFreeKey(format!(
+                "every `[patch.crates-io]` key socket-patch could use for {name}@{version} \
+                 is already taken in Cargo.toml or a cargo config file"
+            ))
+        })
+    };
+    let fresh_entry = || {
+        let mut entry = InlineTable::new();
+        entry.insert("package", Value::from(name));
+        entry.insert("path", Value::from(rel_path));
+        Item::Value(Value::InlineTable(entry))
+    };
+    let (key, prior_path) = match mine.first() {
+        Some(existing) if !is_socket_key(&existing.key, name) || is_reserved(&existing.key) => {
+            // A bare-name (hand-copied / pre-release) or config-shadowed key:
+            // move the entry to a fresh Socket-owned key.
+            for entry in &mine {
+                crates_io.remove(&entry.key);
+            }
+            let key = fresh_key(&*crates_io)?;
+            crates_io.insert(&key, fresh_entry());
+            changed = true;
+            (key, existing.path.clone())
+        }
+        Some(existing) => {
+            for dup in &mine[1..] {
+                crates_io.remove(&dup.key);
+                changed = true;
+            }
+            let current = existing.path.as_deref().and_then(normalize_socket_path);
+            if current.as_deref() != Some(rel_path) {
+                let path_item = crates_io
+                    .get_mut(&existing.key)
+                    .and_then(Item::as_table_like_mut)
+                    .and_then(|t| t.get_mut("path"))
+                    .and_then(Item::as_value_mut)
+                    .ok_or_else(|| {
+                        ManifestError::Unparseable(format!(
+                            "`patch.crates-io.{}` has no editable `path`",
+                            existing.key
+                        ))
+                    })?;
+                let decor = path_item.decor().clone();
+                *path_item = Value::from(rel_path);
+                *path_item.decor_mut() = decor;
+                changed = true;
+            }
+            (existing.key.clone(), existing.path.clone())
+        }
+        None => {
+            let key = fresh_key(&*crates_io)?;
+            crates_io.insert(&key, fresh_entry());
+            changed = true;
+            (key, None)
+        }
+    };
+    let content = changed.then(|| render_like(content, &doc.to_string()));
+    Ok(Upsert {
+        content,
+        key,
+        prior_path,
+    })
+}
+
+/// Remove every Socket-owned `[patch.crates-io]` entry wiring `name@version`
+/// (key-agnostic), then clean up the tables the removal emptied: an emptied
+/// `[patch.crates-io]` is dropped unless it looks user-authored (another
+/// table follows it, or its header carries a comment — the table
+/// socket-patch creates is appended last and bare), an emptied `[patch]` is
+/// dropped unless the user wrote an explicit `[patch]` header, and a
+/// `[patch.crates-io]` left holding only sub-tables goes back to implicit
+/// (no bare header). A user-authored or absent entry is a no-op (`None`).
+pub fn remove_patch_entries(
+    content: &str,
+    name: &str,
+    version: &str,
+) -> Result<Option<String>, ManifestError> {
+    let mut doc = parse_manifest(content)?;
+    let keys: Vec<String> = crates_io_patch_entries(&doc)
+        .into_iter()
+        .filter(|e| e.source == "crates-io" && entry_wires(e, name, version))
+        .map(|e| e.key)
+        .collect();
+    if keys.is_empty() {
+        return Ok(None);
+    }
+    let last_position = max_table_position(doc.as_table());
+    let mut patch_explicit = false;
+    if let Some(patch_item) = doc.get_mut("patch") {
+        patch_explicit = patch_item.as_table().is_some_and(|t| !t.is_implicit());
+        if let Some(patch) = patch_item.as_table_like_mut() {
+            let mut prune_crates_io = false;
+            if let Some(crates_io) = patch.get_mut("crates-io") {
+                let mut emptied = false;
+                if let Some(table) = crates_io.as_table_like_mut() {
+                    for key in &keys {
+                        table.remove(key);
+                    }
+                    emptied = table.is_empty();
+                }
+                match crates_io.as_table_mut() {
+                    Some(table) if emptied => {
+                        let followed = table
+                            .position()
+                            .zip(last_position)
+                            .is_some_and(|(own, last)| own < last);
+                        let commented = table
+                            .decor()
+                            .suffix()
+                            .and_then(|s| s.as_str())
+                            .is_some_and(|s| s.contains('#'));
+                        prune_crates_io = !followed && !commented;
+                    }
+                    Some(table) => {
+                        if table.iter().all(|(_, item)| item.is_table()) {
+                            table.set_implicit(true);
+                        }
+                    }
+                    None => prune_crates_io = emptied,
+                }
+            }
+            if prune_crates_io {
+                patch.remove("crates-io");
+            }
+        }
+    }
+    if !patch_explicit
+        && doc
+            .get("patch")
+            .and_then(Item::as_table_like)
+            .is_some_and(|t| t.is_empty())
+    {
+        doc.as_table_mut().remove("patch");
+    }
+    Ok(Some(render_like(content, &doc.to_string())))
+}
+
+/// The greatest document position of any header table under `table`.
+fn max_table_position(table: &toml_edit::Table) -> Option<isize> {
+    table
+        .iter()
+        .filter_map(|(_, item)| item.as_table())
+        .flat_map(|t| [t.position(), max_table_position(t)])
+        .flatten()
+        .max()
+}
+
+// ── manifest I/O ─────────────────────────────────────────────────────────────
+
+/// Guarded read of `<project_root>/Cargo.toml` (a FIFO / device / directory
+/// squatting the path errors instead of blocking).
+pub async fn read_manifest(project_root: &Path) -> Result<String, ManifestError> {
+    let path = project_root.join(CARGO_TOML);
+    read_regular_to_string(&path).await.map_err(|e| {
+        if e.kind() == std::io::ErrorKind::NotFound {
+            ManifestError::Unreadable(format!(
+                "no Cargo.toml next to the project's Cargo.lock ({})",
+                path.display()
+            ))
+        } else {
+            ManifestError::Unreadable(format!("cannot read {}: {e}", path.display()))
+        }
+    })
+}
+
+/// The root manifest's `[patch.crates-io]` entries. Read-only and fail-soft:
+/// a missing or malformed manifest yields none.
+pub async fn read_patch_entries(project_root: &Path) -> Vec<ManifestPatchEntry> {
+    match read_manifest(project_root).await {
+        Ok(text) => parse_manifest(&text)
+            .map(|doc| crates_io_patch_entries(&doc))
+            .unwrap_or_default(),
+        Err(_) => Vec::new(),
+    }
+}
+
+/// What [`ensure_patch_entry`] did.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Ensured {
+    /// Whether the manifest changed (or would, under `dry_run`).
+    pub changed: bool,
+    /// The key the entry lives under.
+    pub key: String,
+    /// The path a pre-existing Socket-owned entry for `name@version` held.
+    pub prior_path: Option<String>,
+}
+
+/// [`upsert_patch_entry`] against the project's root manifest, written
+/// atomically (mode-preserving) unless `dry_run`.
+pub async fn ensure_patch_entry(
+    project_root: &Path,
+    name: &str,
+    version: &str,
+    uuid: &str,
+    rel_path: &str,
+    reserved: &[String],
+    dry_run: bool,
+) -> Result<Ensured, ManifestError> {
+    let content = read_manifest(project_root).await?;
+    let up = upsert_patch_entry(&content, name, version, uuid, rel_path, reserved)?;
+    let changed = up.content.is_some();
+    if let (Some(new), false) = (up.content, dry_run) {
+        write_manifest(project_root, &new).await?;
+    }
+    Ok(Ensured {
+        changed,
+        key: up.key,
+        prior_path: up.prior_path,
+    })
+}
+
+/// [`remove_patch_entries`] against the project's root manifest. A missing
+/// manifest has nothing to remove (`Ok(false)`); an unparseable one is an
+/// error (fail closed — the entry may still be live).
+pub async fn drop_patch_entries(
+    project_root: &Path,
+    name: &str,
+    version: &str,
+    dry_run: bool,
+) -> Result<bool, ManifestError> {
+    let content = match read_regular_to_string(&project_root.join(CARGO_TOML)).await {
+        Ok(c) => c,
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(false),
+        Err(e) => {
+            return Err(ManifestError::Unreadable(format!(
+                "cannot read Cargo.toml: {e}"
+            )))
+        }
+    };
+    match remove_patch_entries(&content, name, version)? {
+        None => Ok(false),
+        Some(new) => {
+            if !dry_run {
+                write_manifest(project_root, &new).await?;
+            }
+            Ok(true)
+        }
+    }
+}
+
+async fn write_manifest(project_root: &Path, content: &str) -> Result<(), ManifestError> {
+    let path = project_root.join(CARGO_TOML);
+    atomic_write_bytes_preserving_mode(&path, content.as_bytes())
+        .await
+        .map_err(|e| ManifestError::Write(format!("write {}: {e}", path.display())))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const UUID: &str = "9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f";
+    const UUID2: &str = "0a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d";
+
+    fn rel(uuid: &str, name: &str, version: &str) -> String {
+        format!(".socket/vendor/cargo/{uuid}/{name}-{version}")
+    }
+
+    const PKG: &str =
+        "[package]\nname = \"app\"\nversion = \"0.1.0\"\n\n[dependencies]\ncfg-if = \"1\"\n";
+
+    fn add(content: &str, name: &str, version: &str, uuid: &str) -> Upsert {
+        upsert_patch_entry(content, name, version, uuid, &rel(uuid, name, version), &[]).unwrap()
+    }
+
+    fn add_err(content: &str, name: &str, version: &str, uuid: &str) -> ManifestError {
+        upsert_patch_entry(content, name, version, uuid, &rel(uuid, name, version), &[])
+            .unwrap_err()
+    }
+
+    fn entries(content: &str) -> Vec<ManifestPatchEntry> {
+        crates_io_patch_entries(&parse_manifest(content).unwrap())
+    }
+
+    #[test]
+    fn creates_the_table_and_reverts_byte_identical() {
+        let up = add(PKG, "cfg-if", "1.0.4", UUID);
+        let out = up.content.expect("changed");
+        assert_eq!(up.key, "cfg-if-socket-9f6b2c4e");
+        assert_eq!(up.prior_path, None);
+        assert_eq!(
+            out,
+            format!(
+                "{PKG}\n[patch.crates-io]\ncfg-if-socket-9f6b2c4e = {{ package = \"cfg-if\", \
+                 path = \"{}\" }}\n",
+                rel(UUID, "cfg-if", "1.0.4")
+            )
+        );
+        let back = remove_patch_entries(&out, "cfg-if", "1.0.4")
+            .unwrap()
+            .unwrap();
+        assert_eq!(back, PKG, "revert restores the manifest byte for byte");
+    }
+
+    #[test]
+    fn idempotent_rerun_is_a_noop() {
+        let out = add(PKG, "cfg-if", "1.0.4", UUID).content.unwrap();
+        let again = add(&out, "cfg-if", "1.0.4", UUID);
+        assert_eq!(again.content, None);
+        assert_eq!(again.key, "cfg-if-socket-9f6b2c4e");
+        assert_eq!(
+            again.prior_path.as_deref(),
+            Some(rel(UUID, "cfg-if", "1.0.4").as_str())
+        );
+    }
+
+    #[test]
+    fn crlf_manifest_keeps_crlf_everywhere() {
+        let crlf = PKG.replace('\n', "\r\n");
+        let out = add(&crlf, "cfg-if", "1.0.4", UUID).content.unwrap();
+        assert!(!out.replace("\r\n", "").contains('\n'), "{out:?}");
+        assert!(
+            out.contains("[patch.crates-io]\r\ncfg-if-socket-9f6b2c4e = {"),
+            "{out:?}"
+        );
+        let back = remove_patch_entries(&out, "cfg-if", "1.0.4")
+            .unwrap()
+            .unwrap();
+        assert_eq!(back, crlf);
+    }
+
+    #[test]
+    fn mixed_line_endings_keep_every_untouched_line() {
+        let mixed = "[package]\r\nname = \"app\"\nversion = \"0.1.0\"\r\n\r\n[dependencies]\ncfg-if = \"1\"\r\n";
+        let out = add(mixed, "cfg-if", "1.0.4", UUID).content.unwrap();
+        assert!(out.starts_with(mixed), "{out:?}");
+        let back = remove_patch_entries(&out, "cfg-if", "1.0.4")
+            .unwrap()
+            .unwrap();
+        assert_eq!(back, mixed);
+    }
+
+    #[test]
+    fn missing_trailing_newline_is_preserved() {
+        let bare = PKG.trim_end();
+        let out = add(bare, "cfg-if", "1.0.4", UUID).content.unwrap();
+        assert!(!out.ends_with('\n'), "{out:?}");
+        assert!(
+            out.contains("cfg-if = \"1\"\n\n[patch.crates-io]\n"),
+            "{out:?}"
+        );
+        let back = remove_patch_entries(&out, "cfg-if", "1.0.4")
+            .unwrap()
+            .unwrap();
+        assert_eq!(back, bare);
+    }
+
+    #[test]
+    fn comments_and_existing_user_entries_survive() {
+        let src = "# top comment\n[package]\nname = \"app\" # inline\nversion = \"0.1.0\"\n\n\
+                   [patch.crates-io]\n# user fork\nserde = { git = \"https://example.com/serde\" }\n\n\
+                   [dependencies]\ncfg-if = \"1\"\n";
+        let out = add(src, "cfg-if", "1.0.4", UUID).content.unwrap();
+        assert!(out.contains("# top comment\n"));
+        assert!(out.contains("name = \"app\" # inline\n"));
+        assert!(out.contains(&format!(
+            "# user fork\nserde = {{ git = \"https://example.com/serde\" }}\n\
+             cfg-if-socket-9f6b2c4e = {{ package = \"cfg-if\", path = \"{}\" }}\n",
+            rel(UUID, "cfg-if", "1.0.4")
+        )));
+        let back = remove_patch_entries(&out, "cfg-if", "1.0.4")
+            .unwrap()
+            .unwrap();
+        assert_eq!(back, src, "only our line goes; the user's table stays");
+    }
+
+    #[test]
+    fn subtable_only_crates_io_goes_back_to_implicit() {
+        let src = "[package]\nname = \"app\"\n\n[patch.crates-io.serde]\npath = \"../serde\"\n";
+        let out = add(src, "cfg-if", "1.0.4", UUID).content.unwrap();
+        let back = remove_patch_entries(&out, "cfg-if", "1.0.4")
+            .unwrap()
+            .unwrap();
+        assert_eq!(back, src);
+    }
+
+    #[test]
+    fn virtual_workspace_manifest() {
+        let src = "[workspace]\nmembers = [\"a\", \"b\"]\nresolver = \"2\"\n";
+        let out = add(src, "cfg-if", "1.0.4", UUID).content.unwrap();
+        let doc = parse_manifest(&out).unwrap();
+        assert!(doc.get("package").is_none());
+        assert_eq!(entries(&out).len(), 1);
+        assert_eq!(
+            remove_patch_entries(&out, "cfg-if", "1.0.4")
+                .unwrap()
+                .unwrap(),
+            src
+        );
+    }
+
+    #[test]
+    fn second_version_gets_a_socket_key_with_package() {
+        let first = add(PKG, "cfg-if", "1.0.4", UUID);
+        assert_eq!(first.key, "cfg-if-socket-9f6b2c4e");
+        let one = first.content.unwrap();
+        let up = add(&one, "cfg-if", "0.1.10", UUID2);
+        assert_eq!(up.key, "cfg-if-socket-0a1b2c3d");
+        let two = up.content.unwrap();
+        assert!(
+            two.contains(&format!(
+                "cfg-if-socket-0a1b2c3d = {{ package = \"cfg-if\", path = \"{}\" }}",
+                rel(UUID2, "cfg-if", "0.1.10")
+            )),
+            "{two}"
+        );
+        let es = entries(&two);
+        assert_eq!(es.len(), 2);
+        assert!(es.iter().all(|e| e.name == "cfg-if" && e.socket_owned));
+        // Each version's re-run finds its own entry, whatever its key.
+        assert_eq!(add(&two, "cfg-if", "1.0.4", UUID).content, None);
+        assert_eq!(add(&two, "cfg-if", "0.1.10", UUID2).content, None);
+        // Reverting one version leaves the other.
+        let back = remove_patch_entries(&two, "cfg-if", "0.1.10")
+            .unwrap()
+            .unwrap();
+        assert_eq!(back, one);
+    }
+
+    #[test]
+    fn occupied_crate_key_and_reserved_config_keys_are_avoided() {
+        let user = format!("{PKG}\n[patch.crates-io]\ncfg-if = {{ path = \"../cfg-if-0.1\" }}\n");
+        let up = add(&user, "cfg-if", "1.0.4", UUID);
+        assert_eq!(up.key, "cfg-if-socket-9f6b2c4e");
+        let out = up.content.unwrap();
+        assert!(out.contains("cfg-if = { path = \"../cfg-if-0.1\" }"));
+        assert_eq!(
+            remove_patch_entries(&out, "cfg-if", "1.0.4")
+                .unwrap()
+                .unwrap(),
+            user
+        );
+        let reserved = vec!["cfg-if-socket-9f6b2c4e".to_string()];
+        let up = upsert_patch_entry(
+            PKG,
+            "cfg-if",
+            "1.0.4",
+            UUID,
+            &rel(UUID, "cfg-if", "1.0.4"),
+            &reserved,
+        )
+        .unwrap();
+        assert_eq!(up.key, "cfg-if-socket-9f6b2c4e1d3a4f6b8c2d7e5a9b1c3d5f");
+    }
+
+    /// Cargo lets a config-file `[patch]` item replace the manifest item
+    /// with the same key (any version): a re-run over an entry whose key a
+    /// config now uses moves it to a fresh key instead of refreshing it in
+    /// place under the shadowed one.
+    #[test]
+    fn existing_entry_under_a_reserved_key_moves_to_a_fresh_key() {
+        let out = add(PKG, "cfg-if", "1.0.4", UUID).content.unwrap();
+        let reserved = vec!["cfg-if-socket-9f6b2c4e".to_string()];
+        for uuid in [UUID, UUID2] {
+            let up = upsert_patch_entry(
+                &out,
+                "cfg-if",
+                "1.0.4",
+                uuid,
+                &rel(uuid, "cfg-if", "1.0.4"),
+                &reserved,
+            )
+            .unwrap();
+            assert_ne!(up.key, "cfg-if-socket-9f6b2c4e", "{uuid}");
+            assert!(is_socket_key(&up.key, "cfg-if"), "{}", up.key);
+            let moved = up.content.expect("re-keyed");
+            let es = entries(&moved);
+            assert_eq!(es.len(), 1, "{moved}");
+            assert_eq!(es[0].key, up.key);
+            assert_eq!(es[0].name, "cfg-if");
+            assert_eq!(
+                es[0].path.as_deref(),
+                Some(rel(uuid, "cfg-if", "1.0.4").as_str())
+            );
+        }
+    }
+
+    /// A Socket-owned entry under the bare crate name (hand-copied, or
+    /// written by a pre-release build) moves to the Socket-owned key: a bare
+    /// key is exactly what a user's config entry would silently shadow.
+    #[test]
+    fn bare_crate_name_key_is_rekeyed() {
+        let src = format!(
+            "{PKG}\n[patch.crates-io]\ncfg-if = {{ path = \"{}\" }}\n",
+            rel(UUID, "cfg-if", "1.0.4")
+        );
+        let up = add(&src, "cfg-if", "1.0.4", UUID);
+        assert_eq!(up.key, "cfg-if-socket-9f6b2c4e");
+        assert_eq!(
+            up.prior_path.as_deref(),
+            Some(rel(UUID, "cfg-if", "1.0.4").as_str())
+        );
+        let out = up.content.unwrap();
+        assert!(!out.contains("\ncfg-if = { path"), "{out}");
+        assert_eq!(entries(&out).len(), 1);
+    }
+
+    #[test]
+    fn socket_keys() {
+        assert!(is_socket_key("cfg-if-socket-9f6b2c4e", "cfg-if"));
+        assert!(is_socket_key(
+            "cfg-if-socket-9f6b2c4e1d3a4f6b8c2d7e5a9b1c3d5f",
+            "cfg-if"
+        ));
+        assert!(!is_socket_key("cfg-if", "cfg-if"));
+        assert!(!is_socket_key("cfg-if-socket-9F6B2C4E", "cfg-if"));
+        assert!(!is_socket_key("cfg-if-socket-9f6b", "cfg-if"));
+        assert!(!is_socket_key("serde-socket-9f6b2c4e", "cfg-if"));
+    }
+
+    /// Cargo keys manifest `[patch]` tables by source URL, and the URL
+    /// spelling of crates.io replaces `[patch.crates-io]` wholesale — a
+    /// vendored entry written there would be silently ignored. Refuse.
+    #[test]
+    fn url_spelled_crates_io_patch_table_refuses() {
+        for alias in [
+            "https://github.com/rust-lang/crates.io-index",
+            "https://github.com/rust-lang/crates.io-index/",
+            "HTTPS://GITHUB.COM/rust-lang/crates.io-index.git",
+        ] {
+            let src = format!("{PKG}\n[patch.\"{alias}\"]\nitoa = {{ path = \"../itoa\" }}\n");
+            let err = add_err(&src, "cfg-if", "1.0.4", UUID);
+            assert_eq!(err.code(), "cargo_manifest_patch_source_alias", "{alias}");
+            assert!(err.detail().contains(alias), "{}", err.detail());
+        }
+        // Another registry's URL table is unrelated.
+        let src = format!(
+            "{PKG}\n[patch.\"https://example.com/index\"]\nitoa = {{ path = \"../itoa\" }}\n"
+        );
+        assert!(add(&src, "cfg-if", "1.0.4", UUID).content.is_some());
+        assert!(is_crates_io_source("crates-io"));
+        assert!(!is_crates_io_source("https://example.com/index"));
+    }
+
+    /// `toml_edit` drops a leading BOM; the edit and the revert put it back.
+    #[test]
+    fn utf8_bom_survives_vendor_and_revert() {
+        for src in [
+            format!("\u{feff}{PKG}"),
+            format!("\u{feff}{PKG}").replace('\n', "\r\n"),
+        ] {
+            let out = add(&src, "cfg-if", "1.0.4", UUID).content.unwrap();
+            assert!(out.starts_with('\u{feff}'), "{out:?}");
+            assert_eq!(out.matches('\u{feff}').count(), 1);
+            assert!(out.starts_with(&src), "only lines are appended: {out:?}");
+            let back = remove_patch_entries(&out, "cfg-if", "1.0.4")
+                .unwrap()
+                .unwrap();
+            assert_eq!(back, src);
+            assert_eq!(add(&out, "cfg-if", "1.0.4", UUID).content, None);
+        }
+    }
+
+    /// A revert keeps table headers the user wrote before vendoring.
+    #[test]
+    fn user_authored_empty_patch_headers_survive_revert() {
+        for src in [
+            // An explicit empty table in the middle of the file.
+            "[package]\nname = \"a\"\n\n[patch.crates-io]\n\n[dependencies]\ncfg-if = \"1\"\n"
+                .to_string(),
+            // An explicit `[patch]` header.
+            "[package]\nname = \"a\"\n\n[patch]\n".to_string(),
+            // A header carrying a comment.
+            "[package]\nname = \"a\"\n\n[patch.crates-io] # forks go here\n".to_string(),
+        ] {
+            let out = add(&src, "cfg-if", "1.0.4", UUID).content.unwrap();
+            let back = remove_patch_entries(&out, "cfg-if", "1.0.4")
+                .unwrap()
+                .unwrap();
+            assert_eq!(back, src, "{out}");
+        }
+    }
+
+    #[test]
+    fn uuid_bump_refreshes_in_place_keeping_the_key() {
+        let two = add(
+            &add(PKG, "cfg-if", "1.0.4", UUID).content.unwrap(),
+            "cfg-if",
+            "0.1.10",
+            UUID2,
+        )
+        .content
+        .unwrap();
+        let new_uuid = "11111111-2222-4333-8444-555555555555";
+        let up = upsert_patch_entry(
+            &two,
+            "cfg-if",
+            "0.1.10",
+            new_uuid,
+            &rel(new_uuid, "cfg-if", "0.1.10"),
+            &[],
+        )
+        .unwrap();
+        assert_eq!(up.key, "cfg-if-socket-0a1b2c3d", "the key is sticky");
+        assert_eq!(
+            up.prior_path.as_deref(),
+            Some(rel(UUID2, "cfg-if", "0.1.10").as_str())
+        );
+        let out = up.content.unwrap();
+        assert!(out.contains(&rel(new_uuid, "cfg-if", "0.1.10")));
+        assert!(!out.contains(UUID2));
+    }
+
+    #[test]
+    fn user_entries_are_never_removed_or_rewritten() {
+        for src in [
+            format!("{PKG}\n[patch.crates-io]\ncfg-if = {{ path = \"../fork\" }}\n"),
+            format!(
+                "{PKG}\n[patch.crates-io]\ncfg-if = {{ path = \"../other/{}\" }}\n",
+                rel(UUID, "cfg-if", "1.0.4")
+            ),
+            format!(
+                "{PKG}\n[patch.crates-io]\nx = {{ package = \"other\", path = \"{}\" }}\n",
+                rel(UUID, "cfg-if", "1.0.4")
+            ),
+        ] {
+            assert_eq!(remove_patch_entries(&src, "cfg-if", "1.0.4").unwrap(), None);
+        }
+    }
+
+    #[test]
+    fn inline_and_dotted_spellings_are_found() {
+        for src in [
+            format!(
+                "[patch]\ncrates-io = {{ cfg-if-socket-9f6b2c4e = {{ package = \"cfg-if\", \
+                 path = \"{}\" }} }}\n",
+                rel(UUID, "cfg-if", "1.0.4")
+            ),
+            format!(
+                "[patch.crates-io.cfg-if-socket-9f6b2c4e]\npackage = \"cfg-if\"\npath = \"./{}/\"\n",
+                rel(UUID, "cfg-if", "1.0.4")
+            ),
+        ] {
+            let up = add(&src, "cfg-if", "1.0.4", UUID);
+            assert_eq!(up.content, None, "{src}");
+            let out = remove_patch_entries(&src, "cfg-if", "1.0.4")
+                .unwrap()
+                .unwrap();
+            assert!(!out.contains("cfg-if"), "{out}");
+        }
+    }
+
+    #[test]
+    fn unparseable_manifest_and_scalar_patch_table_are_errors() {
+        let err = upsert_patch_entry("[package\n", "a", "1.0.0", UUID, "x", &[]).unwrap_err();
+        assert_eq!(err.code(), "cargo_manifest_unparseable");
+        let err = upsert_patch_entry("[patch]\ncrates-io = 1\n", "a", "1.0.0", UUID, "x", &[])
+            .unwrap_err();
+        assert_eq!(err.code(), "cargo_manifest_unparseable");
+        assert_eq!(
+            remove_patch_entries("[package\n", "a", "1.0.0")
+                .unwrap_err()
+                .code(),
+            "cargo_manifest_unparseable"
+        );
+    }
+
+    #[test]
+    fn no_free_key_is_reported() {
+        let taken = |_: &str| true;
+        assert_eq!(choose_key("a", UUID, taken), None);
+        assert_eq!(
+            choose_key("a", UUID, |k| k == "a" || k == "a-socket-9f6b2c4e"),
+            Some("a-socket-9f6b2c4e1d3a4f6b8c2d7e5a9b1c3d5f".to_string())
+        );
+    }
+
+    #[test]
+    fn socket_copy_paths() {
+        assert!(is_socket_copy_of(
+            &rel(UUID, "cfg-if", "1.0.4"),
+            "cfg-if",
+            "1.0.4"
+        ));
+        assert!(is_socket_copy_of(
+            &format!("./{}/", rel(UUID, "cfg-if", "1.0.4")),
+            "cfg-if",
+            "1.0.4"
+        ));
+        assert!(!is_socket_copy_of(
+            &rel(UUID, "cfg-if", "1.0.4"),
+            "cfg-if",
+            "1.0.5"
+        ));
+        assert!(!is_socket_copy_of(
+            &format!("{}/nested", rel(UUID, "cfg-if", "1.0.4")),
+            "cfg-if",
+            "1.0.4"
+        ));
+        assert!(!is_socket_copy_of(
+            "../x/.socket/vendor/cargo/u/cfg-if-1.0.4",
+            "cfg-if",
+            "1.0.4"
+        ));
+    }
+
+    #[test]
+    fn reconcile_handles_empty_and_pure_insertions() {
+        assert_eq!(reconcile_line_endings("", "a = 1\n"), "a = 1\n");
+        assert_eq!(
+            reconcile_line_endings("a = 1\r\n", "a = 1\nb = 2\n"),
+            "a = 1\r\nb = 2\r\n"
+        );
+        assert_eq!(
+            reconcile_line_endings("a = 1\r\nb = 2\r\n", "a = 1\n"),
+            "a = 1\r\n"
+        );
+    }
+
+    #[tokio::test]
+    async fn io_wrappers_round_trip_and_fail_closed() {
+        let dir = tempfile::tempdir().unwrap();
+        let root = dir.path();
+        let err = ensure_patch_entry(
+            root,
+            "a",
+            "1.0.0",
+            UUID,
+            &rel(UUID, "a", "1.0.0"),
+            &[],
+            false,
+        )
+        .await
+        .unwrap_err();
+        assert_eq!(err.code(), "cargo_manifest_unreadable");
+        assert!(!drop_patch_entries(root, "a", "1.0.0", false).await.unwrap());
+
+        tokio::fs::write(root.join(CARGO_TOML), PKG).await.unwrap();
+        let dry = ensure_patch_entry(
+            root,
+            "cfg-if",
+            "1.0.4",
+            UUID,
+            &rel(UUID, "cfg-if", "1.0.4"),
+            &[],
+            true,
+        )
+        .await
+        .unwrap();
+        assert!(dry.changed);
+        assert_eq!(
+            tokio::fs::read_to_string(root.join(CARGO_TOML))
+                .await
+                .unwrap(),
+            PKG
+        );
+        let wet = ensure_patch_entry(
+            root,
+            "cfg-if",
+            "1.0.4",
+            UUID,
+            &rel(UUID, "cfg-if", "1.0.4"),
+            &[],
+            false,
+        )
+        .await
+        .unwrap();
+        assert!(wet.changed);
+        assert_eq!(read_patch_entries(root).await.len(), 1);
+        assert!(drop_patch_entries(root, "cfg-if", "1.0.4", false)
+            .await
+            .unwrap());
+        assert_eq!(
+            tokio::fs::read_to_string(root.join(CARGO_TOML))
+                .await
+                .unwrap(),
+            PKG
+        );
+
+        tokio::fs::write(root.join(CARGO_TOML), "[package\n")
+            .await
+            .unwrap();
+        assert_eq!(
+            drop_patch_entries(root, "cfg-if", "1.0.4", false)
+                .await
+                .unwrap_err()
+                .code(),
+            "cargo_manifest_unparseable"
+        );
+        assert!(read_patch_entries(root).await.is_empty());
+    }
+}
diff --git a/crates/socket-patch-core/src/vendor/lock_inventory/mod.rs b/crates/socket-patch-core/src/vendor/lock_inventory/mod.rs
index 963940f0..774ad377 100644
--- a/crates/socket-patch-core/src/vendor/lock_inventory/mod.rs
+++ b/crates/socket-patch-core/src/vendor/lock_inventory/mod.rs
@@ -351,8 +351,8 @@ fn http_url(raw: &str) -> Option<String> {
 /// import the models without bypassing its recognizing ctx reads. The same
 /// rule covers the other readers discovery imports: `vendor::maven_pom`,
 /// `vendor::nuget_config`'s reader half, and the `// ── pure reader ──`
-/// regions of the writer-owned `go_mod_edit`, `go_sum_edit` and
-/// `cargo_config`.
+/// regions of the writer-owned `go_mod_edit`, `go_sum_edit`,
+/// `cargo_config` and `cargo_manifest`.
 #[cfg(test)]
 mod architecture_tests {
     use std::path::Path;
@@ -456,6 +456,7 @@ mod architecture_tests {
             "vendor/go_mod_edit.rs",
             "vendor/go_sum_edit.rs",
             "vendor/cargo_config.rs",
+            "vendor/cargo_manifest.rs",
             "vendor/nuget_config.rs",
             "vendor/maven_pom.rs",
         ] {
diff --git a/crates/socket-patch-core/src/vendor/mod.rs b/crates/socket-patch-core/src/vendor/mod.rs
index d331a849..a8b38e5b 100644
--- a/crates/socket-patch-core/src/vendor/mod.rs
+++ b/crates/socket-patch-core/src/vendor/mod.rs
@@ -14,7 +14,7 @@
 //! | eco      | artifact            | wiring                                         |
 //! |----------|---------------------|------------------------------------------------|
 //! | npm      | deterministic tgz   | per lockfile flavor: package-lock `resolved`+`integrity`, yarn classic, yarn berry, pnpm, bun ([`npm_flavor`] routes) |
-//! | cargo    | crate dir           | `.cargo/config.toml` `[patch.crates-io]` + Cargo.lock surgery |
+//! | cargo    | crate dir           | root `Cargo.toml` `[patch.crates-io]` + Cargo.lock surgery ([`cargo_manifest`]) |
 //! | golang   | module dir          | `go.mod` `replace` ([`ReplaceOwner::Vendor`])  |
 //! | composer | package dir         | composer.lock `dist` → `{type: path}`          |
 //! | gem      | gem dir (+gemspec)  | Gemfile `path:` + Gemfile.lock PATH pair       |
@@ -56,6 +56,7 @@ mod bun_workspace;
 pub mod cargo;
 pub mod cargo_config;
 pub mod cargo_lock;
+pub mod cargo_manifest;
 pub(crate) mod common;
 pub mod composer_lock;
 pub mod gem;
diff --git a/crates/socket-patch-core/src/vendor/state.rs b/crates/socket-patch-core/src/vendor/state.rs
index 92de0880..1edbc120 100644
--- a/crates/socket-patch-core/src/vendor/state.rs
+++ b/crates/socket-patch-core/src/vendor/state.rs
@@ -442,6 +442,13 @@ pub fn carry_forward_wiring(prev: &VendorEntry, entry: &mut VendorEntry) {
 /// Binary IDs are offsets into Bun's package array and may change after an
 /// installer re-save. Match the predecessor's semantic resolution instead.
 fn wiring_surface_matches(previous: &WiringRecord, current: &WiringRecord) -> bool {
+    // A cargo entry has ONE `[patch.crates-io]` surface wherever it lives:
+    // the pre-v5 `.cargo/config*` record and the v5 `Cargo.toml` record (or
+    // a manifest record under another key) are the same wiring, so a
+    // migrated entry never carries the retired config record forward.
+    if previous.kind == "cargo_patch_entry" && current.kind == "cargo_patch_entry" {
+        return true;
+    }
     if previous.file != current.file || previous.kind != current.kind {
         return false;
     }
@@ -673,6 +680,62 @@ mod tests {
         }
     }
 
+    /// A cargo entry migrated from the pre-v5 `.cargo/config.toml` wiring to
+    /// `Cargo.toml` must not carry the retired config record forward (one
+    /// `[patch]` surface per entry), while the lock record and originals
+    /// still carry over.
+    #[test]
+    fn carry_forward_drops_the_legacy_cargo_config_record() {
+        let rec = |file: &str, kind: &str, key: &str| WiringRecord {
+            file: file.into(),
+            kind: kind.into(),
+            action: WiringAction::Added,
+            key: Some(key.into()),
+            original: None,
+            new: None,
+        };
+        let uuid = "9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f";
+        let base = |wiring: Vec<WiringRecord>, lock: Option<CargoLockOriginal>| VendorEntry {
+            ecosystem: "cargo".into(),
+            base_purl: "pkg:cargo/cfg-if@1.0.4".into(),
+            uuid: uuid.into(),
+            artifact: VendorArtifact {
+                path: format!(".socket/vendor/cargo/{uuid}/cfg-if-1.0.4"),
+                sha256: String::new(),
+                size: None,
+                platform_locked: None,
+                file_inventory: None,
+            },
+            wiring,
+            lock,
+            took_over_go_patches: false,
+            detached: false,
+            record: None,
+            flavor: None,
+            uv: None,
+            pnpm: None,
+            poetry: None,
+            pdm: None,
+            pipenv: None,
+        };
+        let orig = CargoLockOriginal {
+            source: "registry+https://github.com/rust-lang/crates.io-index".into(),
+            checksum: Some("a".repeat(64)),
+        };
+        let prev = base(
+            vec![
+                rec(".cargo/config.toml", "cargo_patch_entry", "cfg-if"),
+                rec("Cargo.lock", "cargo_lock_entry", "cfg-if@1.0.4"),
+            ],
+            Some(orig.clone()),
+        );
+        let mut fresh = base(vec![rec("Cargo.toml", "cargo_patch_entry", "cfg-if")], None);
+        carry_forward_wiring(&prev, &mut fresh);
+        let files: Vec<&str> = fresh.wiring.iter().map(|w| w.file.as_str()).collect();
+        assert_eq!(files, vec!["Cargo.toml", "Cargo.lock"]);
+        assert_eq!(fresh.lock, Some(orig));
+    }
+
     /// Every spelling `purl_keys` promises: the (possibly qualified,
     /// percent-encoded) map key, the entry's base purl and the
     /// qualifier-stripped key; an empty ledger yields the empty set.
diff --git a/crates/socket-patch-core/src/vex/discover/cargo.rs b/crates/socket-patch-core/src/vex/discover/cargo.rs
index 9ccc8e22..b4832e60 100644
--- a/crates/socket-patch-core/src/vex/discover/cargo.rs
+++ b/crates/socket-patch-core/src/vex/discover/cargo.rs
@@ -54,18 +54,22 @@
 //! entry (no exact version, or a lock that routes the crate elsewhere) →
 //! [`DIAG_REF_UNATTRIBUTABLE`].
 //!
-//! ## Vendored (`vendor`, `vendor::cargo` + `vendor::cargo_config`)
+//! ## Vendored (`vendor`, `vendor::cargo` + `vendor::cargo_manifest`)
 //!
 //! NOT visible in `Cargo.lock` beyond the entry losing `source` + `checksum`
-//! (`vendor::cargo_lock::detach_lock_entry`). The identity is the config's
-//! `[patch.crates-io] <name> = { path = ".socket/vendor/cargo/<uuid>/<name>-<version>" }`
-//! (inline, sub-table, or `[patch] crates-io = { … }` forms). Read from the
-//! effective config and, for hand-edit tolerance, the root `Cargo.toml`'s
-//! own `[patch.*]` tables (cargo honors both); any `[patch.<source>]` table
-//! counts. The path must be root-anchored ([`vendor_ref`]: a `../` or
-//! absolute spelling consumes some OTHER checkout's copy), the leaf a single
-//! `<name>-<version>` directory for the entry's crate (`package = "…"` when
-//! renamed, else the key). Same liveness truth source as
+//! (`vendor::cargo_lock::detach_lock_entry`). The identity is a
+//! `[patch.crates-io]` path entry
+//! `<key> = { path = ".socket/vendor/cargo/<uuid>/<name>-<version>" }` —
+//! PRIMARILY in the root `Cargo.toml` (what v5+ `vendor` writes; `<key>` is
+//! the Socket-owned `<name>-socket-<uuid8>` with `package = "<name>"`),
+//! and for projects vendored by an older release in the effective project
+//! config (pre-v5 wiring; cargo honors both). Matching is KEY-AGNOSTIC:
+//! the entry's crate is `package = "…"` when renamed, else the key, and any
+//! `[patch.<source>]` table counts (inline, sub-table, or
+//! `[patch] crates-io = { … }` forms). The path must be root-anchored
+//! ([`vendor_ref`]: a `../` or absolute spelling consumes some OTHER
+//! checkout's copy), the leaf a single `<name>-<version>` directory for the
+//! entry's crate. Same liveness truth source as
 //! `vendor::cargo::vendored_entry_in_use`: when a `Cargo.lock` parses, it
 //! must hold a SOURCELESS `[[package]]` for that name + version — an entry
 //! with a registry source (re-resolved, or a hosted takeover) or none at
@@ -74,7 +78,13 @@
 //! a `[patch]` left out of the graph — e.g. by the user's path dependency,
 //! whose lock entry is sourceless too), so no ref ([`DIAG_REF_INVALID`]).
 //! No lock (first build pending) or an unparseable one (cargo refuses to
-//! build) keeps the ref, like `vendored_entry_in_use`.
+//! build) keeps the ref, like `vendored_entry_in_use`. A manifest entry
+//! cargo ignores is no ref ([`DIAG_REF_INVALID`]) either: cargo lets a
+//! project-config `[patch]` item with the same key replace it (unless that
+//! item wires the same path — the half-migrated shape, attested through the
+//! config), and a `[patch."<crates.io URL>"]` table in the manifest
+//! replaces `[patch.crates-io]` wholesale — both leave the lock looking
+//! exactly like live Socket wiring.
 //! A `.socket/cargo-patches/` path (the retired redirect backend) carries no
 //! uuid and is not a ref. Socket-shaped entries in a `.cargo/config.toml`
 //! that cargo ignores (because `.cargo/config` exists) are diagnosed, never
@@ -90,12 +100,13 @@ use super::{
 };
 use crate::utils::digest::is_hex64_lower;
 use crate::vendor::cargo_config::{
-    effective_config_rel, patch_entries, registry_definitions, CONFIG_LEGACY, CONFIG_TOML,
-    SOCKET_REGISTRY_PREFIX,
+    effective_config_rel, patch_entries, registry_definitions, CargoPatchEntry, CONFIG_LEGACY,
+    CONFIG_TOML, SOCKET_REGISTRY_PREFIX,
 };
 use crate::vendor::cargo_lock::{
     locked_packages, unused_patches, vendored_copy_consumed, LockedPackage,
 };
+use crate::vendor::cargo_manifest::{crates_io_url_alias_tables, is_crates_io_source};
 use crate::vendor::lock_inventory::LockIntegrity;
 
 const CARGO_LOCK: &str = "Cargo.lock";
@@ -150,11 +161,44 @@ pub(crate) async fn extract(ctx: &DiscoverCtx<'_>, out: &mut Discovery) {
     if let (Some(decls), Some(doc)) = (&decls, &manifest) {
         unresolved_manifest_pins(ctx, &lock, decls, doc, &definitions, out);
     }
-    if let Some((file, doc)) = &config {
-        vendored_from_patches(file, doc, &lock, out);
-    }
     if let Some(doc) = &manifest {
-        vendored_from_patches(CARGO_TOML, doc, &lock, out);
+        // Cargo drops a manifest crates.io `[patch]` item that the project
+        // config redefines under the same key (any version), and a
+        // `[patch."<crates.io URL>"]` table replaces `[patch.crates-io]`
+        // wholesale — a Socket entry there is dead wiring, never attested.
+        let config_keys: Vec<(&str, String, Option<String>)> = config
+            .iter()
+            .flat_map(|(file, doc)| {
+                patch_entries(doc)
+                    .into_iter()
+                    .filter(|e| is_crates_io_source(e.source))
+                    .map(move |e| (*file, e.key.to_string(), e.path.map(same_path_key)))
+            })
+            .collect();
+        let aliases = crates_io_url_alias_tables(doc);
+        let shadowed = |entry: &CargoPatchEntry<'_>| -> Option<String> {
+            if !is_crates_io_source(entry.source) {
+                return None;
+            }
+            if let (true, Some(alias)) = (entry.source == "crates-io", aliases.first()) {
+                return Some(format!(
+                    "the `[patch.\"{alias}\"]` table replaces `[patch.crates-io]` in cargo"
+                ));
+            }
+            // The same key wiring the same copy (a half-migrated project)
+            // is not a shadow: the config's own ref carries it.
+            let own = entry.path.map(same_path_key);
+            config_keys
+                .iter()
+                .find(|(_, key, path)| key == entry.key && *path != own)
+                .map(|(file, key, _)| {
+                    format!("{file} redefines `[patch]` key `{key}`, which replaces it in cargo")
+                })
+        };
+        vendored_from_patches(CARGO_TOML, doc, &lock, &shadowed, out);
+    }
+    if let Some((file, doc)) = &config {
+        vendored_from_patches(file, doc, &lock, &|_| None, out);
     }
 }
 
@@ -521,7 +565,25 @@ fn unresolved_manifest_pins(
 
 // ── vendored ─────────────────────────────────────────────────────────────
 
-fn vendored_from_patches(file: &str, doc: &DocumentMut, lock: &Lock, out: &mut Discovery) {
+/// A `[patch]` path spelled for comparison (separators, `./` segments and
+/// a trailing slash ignored).
+fn same_path_key(path: &str) -> String {
+    path.replace('\\', "/")
+        .split('/')
+        .filter(|s| !s.is_empty() && *s != ".")
+        .collect::<Vec<_>>()
+        .join("/")
+}
+
+/// Vendored refs from one file's `[patch]` tables. `shadowed` names why
+/// cargo ignores an entry (a higher-precedence item replaces it), if so.
+fn vendored_from_patches(
+    file: &str,
+    doc: &DocumentMut,
+    lock: &Lock,
+    shadowed: &dyn Fn(&CargoPatchEntry<'_>) -> Option<String>,
+    out: &mut Discovery,
+) {
     for entry in patch_entries(doc) {
         let Some(path) = entry.path else {
             continue; // a git / registry patch
@@ -530,6 +592,18 @@ fn vendored_from_patches(file: &str, doc: &DocumentMut, lock: &Lock, out: &mut D
             continue; // a user path, or the uuid-less `.socket/cargo-patches/`
         }
         let name = entry.name;
+        if let Some(why) = shadowed(&entry) {
+            out.diag(
+                DIAG_REF_INVALID,
+                file,
+                format!(
+                    "{file}: [patch] entry `{}` for {name} points at {path:?}, but {why}; \
+                     not counted",
+                    entry.key
+                ),
+            );
+            continue;
+        }
         let Some(vref) = vendor_ref(path).filter(|v| v.eco == "cargo") else {
             out.diag(
                 DIAG_REF_INVALID,
@@ -1400,6 +1474,150 @@ mod tests {
         );
     }
 
+    /// The v5 `vendor` output: the root manifest's `[patch.crates-io]`,
+    /// including a SECOND vendored version of the same crate under the
+    /// Socket-owned `<name>-socket-<uuid8>` key with `package =` — both
+    /// attest, key-agnostically, with no project config at all.
+    #[tokio::test]
+    async fn v5_manifest_wiring_with_two_versions_attests_both() {
+        let p = Project::new();
+        p.write(
+            "Cargo.toml",
+            format!(
+                "{}\n[patch.crates-io]\ncfg-if = {{ path = \"{}\" }}\n\
+                 cfg-if-socket-0a1b2c3d = {{ package = \"cfg-if\", path = \"{}\" }}\n",
+                manifest("cfg-if = \"1\"\nold = { package = \"cfg-if\", version = \"0.1\" }"),
+                vendor_path(UUID_A, "cfg-if-1.0.4"),
+                vendor_path(UUID_B, "cfg-if-0.1.10"),
+            ),
+        );
+        p.write(
+            "Cargo.lock",
+            lock(&[
+                ("cfg-if", "0.1.10", None, None),
+                ("cfg-if", "1.0.4", None, None),
+            ]),
+        );
+        let out = run(&p).await;
+        let mut want = vec![
+            ("pkg:cargo/cfg-if@0.1.10", UUID_B, WiringMode::Vendored),
+            ("pkg:cargo/cfg-if@1.0.4", UUID_A, WiringMode::Vendored),
+        ];
+        want.sort();
+        assert_refs(&out, &want);
+        assert!(out.diagnostics.is_empty(), "{:#?}", out.diagnostics);
+        assert!(out
+            .refs
+            .iter()
+            .all(|r| r.source_file == std::path::Path::new("Cargo.toml")));
+    }
+
+    /// Half-migrated (the legacy config entry could not be removed): the
+    /// manifest and the pre-v5 config wire the SAME copy — one package,
+    /// one patch, no conflict.
+    #[tokio::test]
+    async fn half_migrated_manifest_and_legacy_config_agree() {
+        let rel = vendor_path(UUID_A, "cfg-if-1.0.4");
+        for key in ["cfg-if-socket-aaaaaaaa", "cfg-if"] {
+            let p = Project::new();
+            p.write(
+                "Cargo.toml",
+                format!(
+                    "{}\n[patch.crates-io]\n{key} = {{ package = \"cfg-if\", path = \"{rel}\" }}\n",
+                    manifest("cfg-if = \"1\"")
+                ),
+            );
+            p.write(".cargo/config.toml", patch_config(&[("cfg-if", &rel)]));
+            p.write("Cargo.lock", lock(&[("cfg-if", "1.0.4", None, None)]));
+            let out = p.discover().await;
+            let triples = ref_triples(&out);
+            assert!(
+                triples
+                    .iter()
+                    .all(|t| t.0 == "pkg:cargo/cfg-if@1.0.4" && t.1 == UUID_A),
+                "{triples:?}"
+            );
+            assert!(!triples.is_empty());
+            assert!(out.diagnostics.is_empty(), "{key}: {:#?}", out.diagnostics);
+        }
+    }
+
+    /// Cargo lets a config `[patch]` item replace the manifest item with the
+    /// same key: a Socket manifest entry whose key a user config entry
+    /// redefines is dead wiring (the user's path builds, and the lock looks
+    /// identical), so it is never attested.
+    #[tokio::test]
+    async fn manifest_entry_shadowed_by_a_same_key_config_entry_is_not_a_ref() {
+        let rel = vendor_path(UUID_A, "cfg-if-1.0.4");
+        let p = Project::new();
+        p.write(
+            "Cargo.toml",
+            format!(
+                "{}\n[patch.crates-io]\ncfg-if-socket-aaaaaaaa = {{ package = \"cfg-if\", path = \"{rel}\" }}\n",
+                manifest("cfg-if = \"1\"")
+            ),
+        );
+        p.write(
+            ".cargo/config.toml",
+            "[patch.crates-io]\ncfg-if-socket-aaaaaaaa = { package = \"cfg-if\", path = \"../cfg-if\" }\n",
+        );
+        p.write("Cargo.lock", lock(&[("cfg-if", "1.0.4", None, None)]));
+        let out = p.discover().await;
+        assert!(ref_triples(&out).is_empty(), "{:?}", ref_triples(&out));
+        assert!(
+            out.diagnostics.iter().any(|d| d
+                .detail
+                .contains("redefines `[patch]` key `cfg-if-socket-aaaaaaaa`")),
+            "{:#?}",
+            out.diagnostics
+        );
+    }
+
+    /// A `[patch."<crates.io URL>"]` table replaces `[patch.crates-io]`
+    /// wholesale in cargo: the Socket entry under `crates-io` is dead.
+    #[tokio::test]
+    async fn manifest_entry_under_a_url_replaced_crates_io_table_is_not_a_ref() {
+        let rel = vendor_path(UUID_A, "cfg-if-1.0.4");
+        let p = Project::new();
+        p.write(
+            "Cargo.toml",
+            format!(
+                "{}\n[patch.crates-io]\ncfg-if-socket-aaaaaaaa = {{ package = \"cfg-if\", path = \"{rel}\" }}\n\n\
+                 [patch.\"https://github.com/rust-lang/crates.io-index\"]\nitoa = {{ path = \"../itoa\" }}\n",
+                manifest("cfg-if = \"1\"")
+            ),
+        );
+        p.write("Cargo.lock", lock(&[("cfg-if", "1.0.4", None, None)]));
+        let out = p.discover().await;
+        assert!(ref_triples(&out).is_empty(), "{:?}", ref_triples(&out));
+        assert!(
+            out.diagnostics
+                .iter()
+                .any(|d| d.detail.contains("replaces `[patch.crates-io]`")),
+            "{:#?}",
+            out.diagnostics
+        );
+    }
+
+    /// A Socket-shaped key whose `package` names ANOTHER crate than the
+    /// copy leaf is not a reference (the leaf must be `<package>-<ver>`).
+    #[tokio::test]
+    async fn v5_socket_key_with_a_mismatched_package_is_not_a_ref() {
+        let p = Project::new();
+        p.write(
+            "Cargo.toml",
+            format!(
+                "{}\n[patch.crates-io]\ncfg-if-socket-7c8d9e0f = {{ package = \"libc\", path = \"{}\" }}\n",
+                manifest("cfg-if = \"1\""),
+                vendor_path(UUID_A, "cfg-if-1.0.4"),
+            ),
+        );
+        p.write("Cargo.lock", lock(&[("cfg-if", "1.0.4", None, None)]));
+        let out = run(&p).await;
+        assert_refs(&out, &[]);
+        assert_eq!(diag_codes(&out), vec![DIAG_REF_INVALID]);
+    }
+
     /// The lock is the liveness truth source: a registry-sourced entry
     /// (re-resolved / hosted takeover) or a missing one (`[[patch.unused]]`)
     /// means the copy is not built.
diff --git a/docs/ecosystems.md b/docs/ecosystems.md
index 8f8dae9e..7377b001 100644
--- a/docs/ecosystems.md
+++ b/docs/ecosystems.md
@@ -16,7 +16,7 @@ The backticked slug in each row is the value `-e`/`--ecosystems` accepts (e.g.
 |-----------|------------------------|------------------------------|--------------------------|
 | npm (`npm`) — pnpm / yarn / berry / bun | ✅ any install layout; `setup` postinstall hook | ✅ six lockfile flavors: package-lock, yarn classic, yarn berry (node-modules linker; PnP refused), pnpm v9, pnpm legacy v5.4/v6.0 (`pnpm 7/8` — frozen installs are path-bound because those majors absolutize `file:` override specifiers; moved checkouts run one `pnpm install --offline --no-frozen-lockfile`, surfaced as `vendor_pnpm_legacy_absolute_specifier`), bun text `bun.lock` lockfileVersion 0/1/2 and native binary `bun.lockb` revisions 1/2/3 (binary locks stay binary; text workspace vendoring requires lockfileVersion 2 — see [Bun compatibility](testing/bun-compatibility.md)). Rush monorepos refused (`vendor_rush_unsupported`) — see [Rush notes](#npm-rush-monorepos) | ✅ package-lock / npm-shrinkwrap, pnpm-lock.yaml and legacy shrinkwrap.yaml (pnpm majors 1–12; block and flow resolutions), yarn classic, yarn berry, bun — pnpm, berry, and bun carry constraints, see [npm hosted-mode notes](#npm-hosted-mode-notes) |
 | PyPI (`pypi`) — uv / poetry / pdm / pipenv / pip | ✅ `.pth` startup hook via `setup` | ✅ uv project/script locks, PEP 751 `pylock.toml` / `pylock.<name>.toml`, poetry, pdm, pipenv (Pipenv 2018 or later — every `Pipfile.lock` category is rewired, lock-only checkouts included; Pipenv 2023+ does not hash-check local wheels — `vendor_integrity_unverified`; a venv still holding the upstream release is reported as `pypi_pipenv_stale_install`; see [Pipenv compatibility](testing/pipenv-compatibility.md)), and requirements.txt. Native uv vendoring requires uv ≥ 0.2.35 (the `[[package]]` lock grammar); hosted mode covers native `uv.lock` from uv 0.1.45 (the first release whose `uv lock` writes one) and requirements from uv 0.0.5; see [uv compatibility](testing/uv-compatibility.md). | ✅ requirements.txt including hash continuations, uv project/script locks, and PEP 751 locks. Version/source ambiguity is refused; see [uv compatibility](testing/uv-compatibility.md). Poetry 1.x and 2.x locks are supported; Poetry 0.x ignores URL sources and is refused. See [Poetry compatibility](testing/poetry-compatibility.md). Pipenv `Pipfile.lock` (pipfile-spec 6 — Pipenv 7 and later; `path` references for 7–11, `file` from 2018; lock-only checkouts and Pipenv's out-of-tree venv are discovered; a warm venv that Pipenv will not reinstall over warns `redirect_pypi_stale_install`; see [Pipenv compatibility](testing/pipenv-compatibility.md)). `pdm.lock` is supported for the lock formats PDM 0.12–1.4 and 2.8.1+ write (`lock_version` 2 / 4.3–4.5.1); the identity-losing 3.1 / 4.0–4.2 formats (PDM 1.8–2.7) are refused. PDM 2.8.0 writes an indistinguishable `4.3` lock but shares that identity-loss bug, so a rewritten 2.8.0 lock crashes `pdm sync` — upgrade to ≥ 2.8.1. See [PDM compatibility](testing/pdm-compatibility.md). |
-| Cargo (`cargo`) | ✅ in-place + `.cargo-checksum.json` rewrite (shared registry-cache caveat — see [Cargo: shared registry cache](#cargo-shared-registry-cache)) | ✅ `[patch.crates-io]` path entry | ✅ per-patch sparse registry (`[registries.socket-patch-<uuid>]` + Cargo.lock source/checksum) |
+| Cargo (`cargo`) | ✅ in-place + `.cargo-checksum.json` rewrite (shared registry-cache caveat — see [Cargo: shared registry cache](#cargo-shared-registry-cache)) | ✅ `[patch.crates-io]` path entry in the root `Cargo.toml` (v5; per-version Socket keys; pre-v5 `.cargo/config*` wiring migrates on re-run) | ✅ per-patch sparse registry (`[registries.socket-patch-<uuid>]` + Cargo.lock source/checksum) |
 | RubyGems (`gem`) | ✅ Bundler plugin via `setup` — needs bundler ≥ 2.2 (1.x cannot load `plugin ... path:` directives; `setup` refuses below the floor and `setup --check` red-flags a wired 1.x project) | ✅ Gemfile + Gemfile.lock path pair (`Gemfile` spelling only — a `gems.rb` project cannot vendor yet) | ✅ per-dep `source` block — edits `gems.rb` + `gems.locked` when present (bundler prefers them over `Gemfile`; spellings that diverge beyond Socket's own edits fail closed with `redirect_gem_gemfile_spellings_diverge`); the `CHECKSUMS` pin needs bundler ≥ 2.6 (older locks get a `redirect_gem_no_checksums_section` warning); a stale pre-redirect materialization that `bundle install` would reuse instead of refetching is flagged `redirect_gem_stale_install` with a prescriptive remedy (see CLI_CONTRACT.md's "Gem stale-install guard") |
 | Go (`golang`) | ✅ `go.mod` `replace` → `.socket/go-patches/` — see [Go: directory replaces and go.sum](#go-directory-replaces-and-gosum) | ✅ `replace` → the committed vendor tree | ✅ (free tier) fork-style `replace` → `patch.socket.dev/gopatch/<uuid>` + committed `go.sum` pin; see [golang-hosted.md](design/golang-hosted.md). Paid tier stays ❌ ([golang-hosted-no-go.md](design/golang-hosted-no-go.md)); `redirect_golang_unsupported` names the vendored remedy |
 | Maven (`maven`) | ✅ apply-only (no `setup` hook — reports `no_files`); in-place jar patching leaves the `~/.m2` checksum sidecars stale — prefer vendored / hosted, see [Maven & NuGet caveats](#maven--nuget-caveats) | ✅ committed maven2 `file://` repository. A root pom declaring `<modules>` (multi-module aggregator) is refused (`vendor_maven_multimodule_unsupported`), and a gradle-only project is refused (`vendor_gradle_unsupported`) | ✅ **pom projects only, fail-closed** — the patched jar is pinned at a Socket-only `<version>-socket.<hex8>` suffix; `${property}` versions are refused; Gradle gets a manual `exclusiveContent` snippet — see [Maven & NuGet caveats](#maven--nuget-caveats) |
@@ -206,6 +206,69 @@ crate that means the **shared** `$CARGO_HOME/registry` cache: the patch affects
 project on the machine, and is silently reset by `cargo clean` or a cache prune. Use
 `--mode vendored` for a project-local, committable patch.
 
+## Cargo: vendored wiring in Cargo.toml
+
+Vendored mode (v5+) wires a patched crate with a `[patch.crates-io]` path
+entry in the **workspace-root `Cargo.toml`** (the manifest beside the
+`Cargo.lock` it detaches) plus the lock surgery that drops the crate's
+`source`/`checksum`:
+
+```toml
+[patch.crates-io]
+cfg-if-socket-9f6b2c4e = { package = "cfg-if", path = ".socket/vendor/cargo/<uuid>/cfg-if-1.0.4" }
+# a second vendored version of the same crate:
+cfg-if-socket-0a1b2c3d = { package = "cfg-if", path = ".socket/vendor/cargo/<uuid2>/cfg-if-0.1.10" }
+```
+
+- **Why the manifest.** Socket's scanners already ingest `Cargo.toml`, so
+  the patch uuid in the path is recoverable for SBOM annotation without
+  uploading `.cargo/config*` (which can hold registry tokens), and manifest
+  `[patch]` builds on cargo older than 1.56, the floor of config-file
+  `[patch]` (proven on 1.56 and older toolchains by the old-toolchain e2e
+  tests). On such old cargo, two vendored versions of ONE crate also need
+  `cargo build --offline` (or a reachable registry index): it loads the
+  crates.io index to tell the two entries apart. Current stable needs
+  neither.
+- **Keys.** Always the Socket-owned `<name>-socket-<first 8 hex of the
+  uuid>` with `package = "<name>"` (the full uuid hex if that key is
+  taken), never the bare crate name: cargo lets a config-file `[patch]`
+  item — the project's, an ancestor directory's, or `$CARGO_HOME`'s —
+  replace the manifest item with the same key whatever its version, so a
+  crate-named key could be silently shadowed by your own config. Keys any
+  of those config files already use are avoided. Every lookup (re-run,
+  revert, VEX discovery) is key-agnostic: an entry belongs to
+  `name@version` when its crate (`package`, else the key) is `name` and its
+  path is `.socket/vendor/cargo/<uuid>/<name>-<version>`.
+- **Your entries.** User-authored `[patch.crates-io]` entries are never
+  modified. One — in `Cargo.toml` or any cargo config file cargo merges
+  (project, ancestors, `$CARGO_HOME`) — that patches the same crate and is
+  not provably another version (a git/registry patch, or a path whose
+  `Cargo.toml` version is unreadable or equal) refuses the vendor with
+  `user_authored_patch_entry`.
+- **Refusals.** `cargo_manifest_not_workspace_root`: run from a workspace
+  member (cargo ignores `[patch]` outside the workspace-root manifest) —
+  run from the root. `cargo_manifest_patch_source_alias`: the manifest also
+  has a `[patch."https://github.com/rust-lang/crates.io-index"]` table,
+  which cargo lets replace `[patch.crates-io]` wholesale — move its entries
+  under `[patch.crates-io]`. Also `cargo_manifest_unreadable`,
+  `cargo_manifest_unparseable`, `cargo_manifest_symlink_unsupported`.
+- **Formatting.** Comments, ordering, CRLF / mixed line endings, a UTF-8
+  BOM and the trailing-newline state are preserved; a revert with nothing
+  else changed restores `Cargo.toml` byte for byte, and keeps your own
+  `[patch]` / `[patch.crates-io]` headers (an explicit `[patch]`, or a
+  `[patch.crates-io]` that another table follows or that carries a
+  comment).
+- **Migration.** Projects vendored by an older release carry the entry in
+  `.cargo/config.toml` (or `.cargo/config`). Re-running `vendor`,
+  `scan`/`get --mode vendored`, or `repair` moves it into `Cargo.toml`
+  (`cargo_wiring_migrated`), updates the vendor ledger, and deletes a config
+  file (and `.cargo/`) the move emptied; a legacy entry that cannot be
+  removed fails the run with nothing changed (`cargo_legacy_wiring_kept`).
+  A project hit by the old multi-version overwrite (a second vendored
+  version repointed the crate-named config key, leaving the first
+  version's lock entry detached and unwired) is healed the same way
+  (`cargo_wiring_restored`). Every revert removes both spellings.
+
 ## Go: directory replaces and go.sum
 
 Both Go modes work through a `go.mod` `replace` directive pointing at a committed

From e192661f3372d85d52a0bb4e3daa0b317bbaf7a2 Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Thu, 24 Sep 2026 14:48:44 -0400
Subject: [PATCH 02/13] feat(vendor): tag vendored cargo copies with
 +socket.<uuid>

A vendored cargo copy's own Cargo.toml version is now rewritten to
<version>+socket.<uuid> (existing build metadata is kept:
2.0.1+zstd.1.5.2.socket.<uuid>), and the detached Cargo.lock entry
records that tagged version, with every reference that spells the old
version rewritten, in lock formats v1-v4. This is the lock cargo itself
writes for the tagged copy, so the patch uuid of the copy that actually
builds can be read from Cargo.lock alone. The patched crate now sees
the tag in CARGO_PKG_VERSION.

A lock that cannot be kept consistent is refused before anything is
written (cargo_lock_untaggable). Revert restores the original lock byte
for byte. A uuid bump re-tags the copy and lock, and a re-run or repair
tags projects vendored before this change (cargo_version_tagged). VEX
discovery treats the tagged lock version as the primary identity signal.
The old-toolchain e2e tests prefer the rust:1.41-slim and rust:1.56-slim
docker images.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/ci.yml                      |  15 +-
 CHANGELOG.md                                  |  50 +-
 README.md                                     |   2 +-
 crates/socket-patch-cli/CLI_CONTRACT.md       |   6 +-
 .../src/commands/repair_vendor.rs             |   9 +-
 .../socket-patch-cli/src/commands/vendor.rs   |   3 +-
 .../tests/e2e_vendor_cargo_build.rs           | 478 ++++++++---
 .../tests/e2e_vex_lockfile/cargo.rs           |  86 +-
 .../tests/mode_migration_cargo.rs             |  22 +-
 crates/socket-patch-core/src/vendor/cargo.rs  | 753 ++++++++++++++++--
 .../src/vendor/cargo_lock.rs                  | 724 ++++++++++++++---
 .../socket-patch-core/src/vendor/cargo_tag.rs | 413 ++++++++++
 .../src/vendor/lock_inventory/cargo.rs        |  14 +-
 crates/socket-patch-core/src/vendor/mod.rs    |   1 +
 crates/socket-patch-core/src/vendor/verify.rs |  26 +-
 .../src/vex/discover/cargo.rs                 | 155 +++-
 docs/ecosystems.md                            |  41 +-
 17 files changed, 2476 insertions(+), 322 deletions(-)
 create mode 100644 crates/socket-patch-core/src/vendor/cargo_tag.rs

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8d2396f2..26fa1954 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1458,9 +1458,12 @@ jobs:
           cargo test -p socket-patch-cli --test e2e_redirect_cargo_build --test e2e_vendor_cargo_build --test mode_migration_cargo
           cargo test -p socket-patch-cli --test e2e_safety_cargo_build -- --ignored
 
-  # Manifest `[patch]` (the v5 vendored cargo wiring) on toolchains older
-  # than the 1.56 floor of config-file `[patch]`. The old-toolchain tests
-  # skip when none is installed; this leg installs two and requires them.
+  # Manifest `[patch]` + the tagged detached lock (the v5 vendored cargo
+  # wiring) on cargo 1.41 and 1.56 — below / at the 1.56 floor of
+  # config-file `[patch]`. The old-toolchain tests prefer the local
+  # `rust:1.41-slim` / `rust:1.56-slim` docker images (run `--network none`;
+  # they build AND run the consumer) and skip when no old cargo is
+  # available; this leg pulls both images and requires them.
   cargo-old-toolchains:
     name: cargo old toolchains (manifest [patch])
     needs: test
@@ -1473,10 +1476,10 @@ jobs:
           persist-credentials: false
       - name: Install Rust
         run: rustup show
-      - name: Install the old cargos under test
+      - name: Pull the old cargos under test
         run: |
-          rustup toolchain install 1.41.0 --profile minimal
-          rustup toolchain install 1.56.0 --profile minimal
+          docker pull rust:1.41-slim
+          docker pull rust:1.56-slim
       - name: Cache cargo
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index b6c72a76..1e80cc6f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -20,21 +20,63 @@ into the new version's section — see docs/releasing.md.
 > **Semver note:** this entry changes `rollback`'s default behavior, narrows
 > the meaning of its existing `vendored: []` JSON key, makes vendored mode
 > manifest-free, moves vendored cargo wiring from `.cargo/config*` into
-> `Cargo.toml`, turns a plain non-TTY `scan` report-only, and makes `vex`
+> `Cargo.toml`, tags vendored cargo copies' versions with `+socket.<uuid>`
+> (visible to the patched crate as `CARGO_PKG_VERSION`), turns a plain
+> non-TTY `scan` report-only, and makes `vex`
 > refuse to attest stale ledger records and corrupt vendor ledgers — all
 > MAJOR per CLI_CONTRACT.md's semver policy — so it ships as the next major
 > release (v5.0).
 
 ### Changed (BREAKING)
 
+- **Vendored cargo copies carry a tagged version: `<version>+socket.<uuid>`.**
+  The vendored copy's own `Cargo.toml` `[package] version` is rewritten to
+  the patch-tagged version (`1.0.4+socket.<uuid>`; a version that already
+  has build metadata keeps it: `2.0.1+zstd.1.5.2.socket.<uuid>`), and the
+  detached `Cargo.lock` entry records that tagged version with no
+  `source` / `checksum` — exactly the lock cargo itself writes when it
+  resolves the `[patch]` against the tagged copy (verified on cargo 1.41,
+  1.56 and current stable: `--locked` builds, the patched bytes compile,
+  transitive `^1` / `=1.0.4` dependents resolve to the copy since cargo
+  ignores build metadata when matching requirements, and `cargo metadata`
+  reports the tagged version). Every lock reference that spells the old
+  version (`"cfg-if 1.0.4"`, v1's `"cfg-if 1.0.4 (registry+…)"`) is
+  rewritten to the tagged version, in lock formats v1–v4; a lock the edit
+  cannot keep consistent (a leftover reference in another spelling, a v1
+  `replace`, an entry already at the tagged version) refuses before any
+  write with `cargo_lock_untaggable`, and a copy manifest whose version
+  literal cannot be rewritten byte-exactly fails the package with
+  `cargo_copy_untaggable`. The patch uuid of the copy cargo actually
+  builds is therefore recoverable from `Cargo.lock` alone (a config-level
+  `[patch]` override pointing elsewhere changes the locked version). **The
+  patched crate sees the tag in `CARGO_PKG_VERSION`** (and in
+  `env!("CARGO_PKG_VERSION")`-derived strings such as `--version` output
+  of a vendored binary crate); code that parses its own version with a
+  semver parser is unaffected, code that compares it as a string is not.
+  Re-runs are idempotent; a uuid bump re-tags the copy and the lock;
+  `vendor --revert` / `rollback` / `remove` / GC / the hosted takeover
+  restore the original lock byte for byte (tag dropped with the
+  `source` / `checksum`). Projects vendored before tagged versions (the
+  pre-v5 `.cargo/config*` wiring, or an untagged manifest wiring) are
+  tagged by the next re-run or `repair` (`cargo_version_tagged` note; a
+  tag `repair` cannot write is the `cargo_version_untagged` warning). VEX
+  discovery treats the tagged lock version as the primary identity
+  (`pkg:cargo/<name>@<version>` is the tag stripped): a detached entry
+  tagged for a different uuid than the wiring's copy path is dead wiring
+  (not attested), a tagged entry no visible wiring names is diagnosed
+  unattributable, and an untagged detached entry (vendored before tagged
+  versions) still counts. A patch that edits the crate's own `Cargo.toml`
+  verifies with the tag dropped.
 - **Vendored cargo wiring moved to `Cargo.toml`.** `vendor` / `scan` /
   `get --mode vendored` write the `[patch.crates-io]` path entry into the
   workspace-root `Cargo.toml` (beside the `Cargo.lock` it detaches) instead
   of `.cargo/config.toml` / `.cargo/config`, so Socket scanners can recover
   the patch uuid from the manifest alone and single-version wiring builds
-  on cargo older than 1.56 (the floor of config-file `[patch]`); two
-  vendored versions of one crate additionally need `--offline` (or a
-  reachable registry index) on such old cargo. The edit is
+  on cargo older than 1.56 (the floor of config-file `[patch]`; proven on
+  cargo 1.41 with no network); two vendored versions of one crate need
+  `--offline` on cargo 1.56, and a populated registry index (the crates.io
+  index in `$CARGO_HOME`, or network access) on older cargo such as 1.41,
+  which loads it to tell the two entries apart. The edit is
   format-preserving (comments, ordering, CRLF / mixed line endings, a
   UTF-8 BOM and the trailing-newline state survive; a revert restores the
   manifest byte for byte and keeps a user's own `[patch]` /
diff --git a/README.md b/README.md
index ea4878b5..ab3827e3 100644
--- a/README.md
+++ b/README.md
@@ -1246,7 +1246,7 @@ Behavior worth knowing:
 | pnpm | `pnpm-lock.yaml` (all generations), `shrinkwrap.yaml` (pnpm 1/2), Rush locks | Aliased / nested `resolution` shapes are diagnosed, not attested; `overrides` alone prove nothing |
 | yarn | `yarn.lock` (classic + berry) | Berry vendored entries also need the root `package.json` `resolutions` mapping; member locks are not read |
 | bun | `bun.lock`, else `bun.lockb` | A hosted entry that Bun < 1.3.10 re-saved without its sha512 attests only after install |
-| cargo | `Cargo.lock`, `Cargo.toml`, `.cargo/config[.toml]` | Root manifest + project config only (no `$CARGO_HOME` / parent configs); vendored `[patch.crates-io]` entries are read from `Cargo.toml` first (v5), the project config for pre-v5 projects; a manifest entry cargo ignores (a same-key project-config item, or a URL-spelled crates.io `[patch]` table) is not attested; a lockless hosted pin needs the redirect ledger's record |
+| cargo | `Cargo.lock`, `Cargo.toml`, `.cargo/config[.toml]` | Root manifest + project config only (no `$CARGO_HOME` / parent configs); vendored `[patch.crates-io]` entries are read from `Cargo.toml` first (v5), the project config for pre-v5 projects, and must agree with the detached lock entry's tagged version `<version>+socket.<uuid>` (a tag for another uuid is dead wiring; an untagged pre-tag entry still counts); a manifest entry cargo ignores (a same-key project-config item, or a URL-spelled crates.io `[patch]` table) is not attested; a lockless hosted pin needs the redirect ledger's record |
 | golang | `go.mod`, `go.work`, `go.sum`, `go.work.sum` | A replace that `require` no longer selects is inert; `vendor/modules.txt` is not read |
 | pypi | `uv.lock`, `*.py.lock`, `pylock*.toml`, `poetry.lock`, `pdm.lock`, `Pipfile.lock`, `requirements.txt` (+ `-r` includes), `pyproject.toml` / `hatch.toml` | A `uv.lock` beside a `pyproject.toml` must agree with its `[tool.uv.sources]`; PDM 3.1 / 4.0–4.2 locks are refused; a Pipenv project needs `--product` (or a git remote) |
 | gem | `Gemfile.lock`, `gems.locked` | Platform gems unsupported; a Gemfile-only (pre-bundler-2.6, not yet locked) wiring needs the redirect ledger |
diff --git a/crates/socket-patch-cli/CLI_CONTRACT.md b/crates/socket-patch-cli/CLI_CONTRACT.md
index 68cb48c1..2b4493c2 100644
--- a/crates/socket-patch-cli/CLI_CONTRACT.md
+++ b/crates/socket-patch-cli/CLI_CONTRACT.md
@@ -696,7 +696,7 @@ to **six flavors**.
 | npm / pnpm LEGACY (lockfileVersion 5.4 = pnpm 7, 6.0 = pnpm 8; flavor `pnpm-legacy`) | (same tarball) | root `package.json` `pnpm.overrides` **+** legacy lock surgery (overrides / root dep + specifiers / packages rekey to a bare `file:` key with recomputed integrity / in-package dep refs). **No `pnpm-workspace.yaml` is written** (pnpm ≤ 8 reads overrides only from package.json). The lock's SPECIFIER is machine-ABSOLUTE — pnpm ≤ 8 absolutizes `file:` overrides itself — surfaced as `vendor_pnpm_legacy_absolute_specifier`. Legacy WORKSPACE locks (`importers:`) refused | same-path `pnpm install --frozen-lockfile --offline`, cold store (byte-stable on pnpm 7.33.5 / 8.15.9). A checkout at a DIFFERENT path fails the frozen check (path-bound specifier) and must run `pnpm install --offline --no-frozen-lockfile` once (the flag matters on CI, where pnpm defaults frozen on), which installs the vendored tarball and re-resolves only the specifier line |
 | npm / bun (`bun.lock`, lockfileVersion 0, 1 or 2 — `vendor_lockfile_version_unsupported` otherwise) | (same tarball) | `bun.lock` only: the packages entry's registry 4-tuple → local 3-tuple with recomputed `sha512`; the entry's `{deps}` meta, the lock's version line and its line endings are preserved. A lock holding `workspace:` packages is refused `vendor_bun_workspace_unsupported` unless lockfileVersion is 2 — Bun 1.2–1.3 resolve a workspace member's local-tarball path relative to the MEMBER (ENOENT on our root-relative path), 1.4 relative to the lockfile, and a committed version-2 lock is the only proof every consumer runs Bun ≥ 1.4 (a deliberate over-approximation: a package declared only by the workspace root would install on version 1 too). The gate fires only on a run that would WRITE a new local tuple, so in-sync re-runs, `already_vendored` skips and `repair` rebuilds on such a lock pass. The detail names the version and the remedy: delete `bun.lock` and re-lock with Bun ≥ 1.4 (an in-place `bun install` keeps the existing lockfileVersion), or `--mode hosted`. Native binary support is described in the next row. `scan`/`get --mode vendored` apply all four refusals BEFORE downloading (see the `get --mode vendored` bullet). Bun 1.1.39–1.3.9 re-save the local tuple WITHOUT its `sha512` on any later lock re-save (`bun add`, `bun install` after a manifest change); the digest-less 2-tuple is recognised as the same wiring — an in-sync re-run stays `already_vendored` and re-pins the digest on disk (no new wiring record) when the committed artifact still holds the bytes the lock was written from — otherwise, as for any stale tuple of ours, the line is re-pinned and the fresh entry carries the new fingerprint — `repair` rebuilds through it, and `vendor --revert` / `rollback` restore the registry line over it (a 2-tuple at ANOTHER uuid is still `vendor_lock_entry_drifted`) | `bun install --frozen-lockfile`, cold cache (the local tarball's sha512 is enforced by Bun ≥ 1.3.10; 1.1.39–1.3.9 install it unverified — the committed artifact is the protection there) |
 | npm / bun binary (`bun.lockb`, native binary format 1, 2 or 3) | (same tarball) | Rewrite matching binary package resolutions and integrity in place; preserve topology and unrelated metadata, update binary offsets and the package metadata hash. Text `bun.lock` takes precedence. `bun_lockb_package` wiring snapshots recover pristine registry metadata for repair and support per-package revert and hosted ↔ vendored migration. Binary discovery and rewrites require no installed Bun runtime. Malformed or unsupported content refuses `vendor_bun_lockb_invalid` before download or takeover. | Frozen installs with the original compatible Bun reader; see `docs/testing/bun-compatibility.md` for the release matrix and historical runtime integrity limits. |
-| cargo | crate dir `<name>-<version>/` (no `.cargo-checksum.json`) | (v5.0) `[patch.crates-io]` path entry in the **workspace-root `Cargo.toml`** (the manifest beside the `Cargo.lock` it detaches — never `.cargo/config*`) **+** Cargo.lock surgery (the `[[package]]` entry's `source`/`checksum` removed). Key: always the Socket-owned `<name>-socket-<first 8 hex of the uuid>` with `package = "<name>"` (the full uuid hex when that key is taken), never the bare crate name — cargo lets a config-file `[patch]` item (project, ancestor directory or `$CARGO_HOME`) replace the manifest item with the same key whatever its version, so keys any of those configs use are avoided and a re-run moves an entry off a now-shadowed key; two versions of one crate are wired side by side. Pre-v5 wiring in `.cargo/config.toml` / `.cargo/config` is moved into `Cargo.toml` by a re-run (`vendor`, `scan`/`get --mode vendored`) or `repair` (`cargo_wiring_migrated` note; the ledger's `cargo_patch_entry` record then names `Cargo.toml`); a detached lock entry left unwired by the pre-v5 multi-version overwrite is re-wired the same way (`cargo_wiring_restored`); every revert removes both spellings | `cargo build --locked --offline` on a fresh checkout — single-version manifest `[patch]` also builds with no network on cargo older than 1.56 (the old config-file wiring's floor); two vendored versions of ONE crate need `--offline` (or a reachable registry index) on such old cargo, which loads the index to tell them apart. Note: path deps build **without** `--cap-lints allow` |
+| cargo | crate dir `<name>-<version>/` (no `.cargo-checksum.json`) | (v5.0) `[patch.crates-io]` path entry in the **workspace-root `Cargo.toml`** (the manifest beside the `Cargo.lock` it detaches — never `.cargo/config*`) **+** Cargo.lock surgery (the `[[package]]` entry's `source`/`checksum` removed and its `version` set to the copy's TAGGED version `<version>+socket.<uuid>` — `<core>+<meta>.socket.<uuid>` when the version already has build metadata — with every lock reference that spells the old version rewritten, formats v1–v4; the copy's own `Cargo.toml` version carries the same tag, so the patched crate sees it in `CARGO_PKG_VERSION`; revert restores the lock byte for byte). Key: always the Socket-owned `<name>-socket-<first 8 hex of the uuid>` with `package = "<name>"` (the full uuid hex when that key is taken), never the bare crate name — cargo lets a config-file `[patch]` item (project, ancestor directory or `$CARGO_HOME`) replace the manifest item with the same key whatever its version, so keys any of those configs use are avoided and a re-run moves an entry off a now-shadowed key; two versions of one crate are wired side by side. Pre-v5 wiring in `.cargo/config.toml` / `.cargo/config` is moved into `Cargo.toml` by a re-run (`vendor`, `scan`/`get --mode vendored`) or `repair` (`cargo_wiring_migrated` note; the ledger's `cargo_patch_entry` record then names `Cargo.toml`); a detached lock entry left unwired by the pre-v5 multi-version overwrite is re-wired the same way (`cargo_wiring_restored`); every revert removes both spellings | `cargo build --locked --offline` on a fresh checkout — single-version manifest `[patch]` also builds with no network on cargo older than 1.56 (the old config-file wiring's floor); two vendored versions of ONE crate need `--offline` on cargo 1.56 and a populated registry index (or network access) on older cargo such as 1.41, which loads the index to tell them apart. Note: path deps build **without** `--cap-lints allow` |
 | golang | module dir `<module>@<version>/` | `go.mod` `replace <module> <ver> => ./.socket/vendor/golang/<uuid>/<module>@<ver>` | `go build` with `GOPROXY=off` + empty `GOMODCACHE` (directory replaces bypass go.sum entirely; survives `go mod tidy`) |
 | composer | package dir `<vendor>/<name>@<version>/` | `composer.lock` only: entry's `dist` → `{type: "path", url, reference: null}`, `source` removed, `transport-options: {symlink: false}` added. `content-hash` unaffected; `composer.json` untouched | `composer install` (from the lock alone, real copy not symlink, works under `--network none`). `composer update <pkg>` reverts it |
 | gem | gem dir `<name>-<version>/` + gemspec materialized from `specifications/` | **Gemfile + Gemfile.lock pair**: the `gem` line gains `path:` (or a managed block for transitive deps); the lock's spec block moves GEM→PATH and the DEPENDENCIES entry becomes `<name> (= <ver>)!`, in bundler's exact canonical form | `bundle install` (normal **and** `BUNDLE_FROZEN=true`), byte-stable lock. Lock-only edits are a silent unpatch — hence the mandatory pair |
@@ -1240,6 +1240,10 @@ Every `--json` invocation emits a single JSON object that follows the **unified
 | `would_refuse` | dry-run preview action (`vendor.patches[]`) | scan `--mode vendored --dry-run` / get `--mode vendored --dry-run`: the wet run's Bun preflight would refuse this npm purl; the record carries `errorCode` (one of the four Bun lock codes above, or `vendor_state_unreadable` for an unreadable vendor ledger) + `error`. Exit 0 / `status: "success"`, nothing written. |
 | `cargo_wiring_migrated` | `skipped` (advisory note) | vendor / scan / get `--mode vendored` / repair (v5.0): a pre-v5 `.cargo/config.toml` / `.cargo/config` vendored `[patch.crates-io]` entry was moved into the workspace-root `Cargo.toml` (dry run: "would move"); the ledger entry is rewritten to name `Cargo.toml` (lock originals kept). A vendor re-run that migrates reports the package `applied`, not `already_vendored`. |
 | `cargo_legacy_wiring_kept` | vendor: `failed`; repair: `skipped` (warning) | vendor / scan / get `--mode vendored` (v5.0): the pre-v5 config entry could not be removed after the manifest took the wiring — the run is unwound (manifest, lock and copy as before) and the package fails, since a kept entry would double-wire the crate and, on a uuid bump, point at a copy the stale sweep deletes; the code prefixes the error detail. repair: the move was refused (e.g. an unparseable `Cargo.toml`, a user entry for the crate, or an unremovable legacy entry — the manifest edit is unwound); left in place. |
+| `cargo_version_tagged` | `skipped` (advisory note) | vendor / scan / get `--mode vendored` / repair (v5.0): a vendored copy and its detached Cargo.lock entry were (re)tagged `<version>+socket.<uuid>` — a copy vendored before tagged versions, or a lock entry tagged for another uuid while the wiring points at this copy (dry run: "would tag"). A vendor re-run that tags reports the package `applied`. |
+| `cargo_version_untagged` | `skipped` (warning) | repair (v5.0): the tag could not be written (an unreadable copy manifest, or a lock the retag cannot keep consistent); nothing else was undone — re-run `socket-patch vendor`. |
+| `cargo_lock_untaggable` | `failed` | vendor / scan / get `--mode vendored` (cargo, v5.0): the Cargo.lock entry cannot carry the copy's tagged version consistently (a dependency reference in a spelling the edit does not own, a v1 `replace` naming the crate, or an entry already at the tagged version). Refused before any write. |
+| `cargo_copy_untaggable` | `failed` (error prefix) | vendor / scan / get `--mode vendored` (cargo, v5.0): the copy's `Cargo.toml` has no literal `[package] version` string that can be rewritten byte-exactly (or it names another version); nothing is swapped in. |
 | `cargo_wiring_restored` | `skipped` (advisory note) | repair (v5.0): a vendored crate's Cargo.lock entry was detached with no Socket-owned `[patch]` pointing at its committed copy (a pre-v5 release overwrote its crate-named config key when a second version was vendored); the manifest entry is written back and the ledger updated (dry run: "would restore"). A `vendor` re-run heals the same state as a plain re-vendor. |
 | `cargo_manifest_unreadable` / `cargo_manifest_unparseable` / `cargo_manifest_symlink_unsupported` / `cargo_manifest_not_workspace_root` / `cargo_manifest_patch_source_alias` | `failed` | vendor / scan / get `--mode vendored` (cargo, v5.0): the workspace-root `Cargo.toml` cannot carry the vendored `[patch.crates-io]` entry (or cargo would ignore it there) — see the cargo caveat under "Vendored mode". Refused before any write. |
 | `vendor_would_revert_redirect` / `vendor_takeover_reverted_redirect` | `skipped` (advisory event) | vendor / scan / get `--mode vendored` over a hosted-redirected purl (cargo and the npm family, bun included): dry run — the per-purl hosted revert was PROBED and would succeed (for bun, only after the Bun vendored preflight accepted the lock; a refused lock is previewed as the wet run's `failed <code>` instead) / wet run — the hosted lockfile edits were reverted to their pre-redirect registry values and the redirect-ledger record dropped before vendoring (mode takeover). Fires on the run that takes over, not on re-runs. |
diff --git a/crates/socket-patch-cli/src/commands/repair_vendor.rs b/crates/socket-patch-cli/src/commands/repair_vendor.rs
index e495cf66..2738f58b 100644
--- a/crates/socket-patch-cli/src/commands/repair_vendor.rs
+++ b/crates/socket-patch-cli/src/commands/repair_vendor.rs
@@ -671,11 +671,14 @@ pub(crate) async fn repair_vendored_artifacts_with_references(
         }
         // Pre-v5 cargo wiring in `.cargo/config*`: move it into the root
         // Cargo.toml (the v5 location) and record the move in the ledger —
-        // or restore the manifest entry a pre-v5 multi-version vendor lost.
+        // or restore the manifest entry a pre-v5 multi-version vendor lost —
+        // and tag an untagged copy + lock entry with the patch uuid.
         let entry = if entry.ecosystem == "cargo" {
             match vendor::cargo::migrate_legacy_wiring(&entry, &common.cwd, common.dry_run).await {
-                Ok(Some((migrated, warning))) => {
-                    record_warning(env, purl, &warning, common);
+                Ok(Some((migrated, warnings))) => {
+                    for warning in &warnings {
+                        record_warning(env, purl, warning, common);
+                    }
                     if common.dry_run {
                         entry
                     } else if persist_vendor_entry(
diff --git a/crates/socket-patch-cli/src/commands/vendor.rs b/crates/socket-patch-cli/src/commands/vendor.rs
index 89a1b889..04cd4227 100644
--- a/crates/socket-patch-cli/src/commands/vendor.rs
+++ b/crates/socket-patch-cli/src/commands/vendor.rs
@@ -379,7 +379,8 @@ fn advisory_tier(code: &str) -> AdvisoryTier {
         "vendor_fetched_missing"
         | "vendor_would_revert_redirect"
         | "vendor_takeover_reverted_redirect"
-        | "cargo_wiring_migrated" => AdvisoryTier::Note,
+        | "cargo_wiring_migrated"
+        | "cargo_version_tagged" => AdvisoryTier::Note,
         _ => AdvisoryTier::Warning,
     }
 }
diff --git a/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs b/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs
index 7fd4259b..8ee8300a 100644
--- a/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs
@@ -11,13 +11,15 @@
 //!      and cfg-if's own `#![deny(missing_docs)]` fires on undocumented items
 //!      (spike-verified).
 //!   3. `socket-patch vendor --json --offline` — asserts the patched copy at
-//!      `.socket/vendor/cargo/<uuid>/cfg-if-<ver>/`, the `[patch.crates-io]`
-//!      entry in the root `Cargo.toml` (no `.cargo/` is created), and the
-//!      surgical lock detach (the `[[package]]` entry keeps name+version but
-//!      loses source+checksum).
+//!      `.socket/vendor/cargo/<uuid>/cfg-if-<ver>/` with its `Cargo.toml`
+//!      version TAGGED `<ver>+socket.<uuid>`, the `[patch.crates-io]` entry
+//!      in the root `Cargo.toml` (no `.cargo/` is created), and the surgical
+//!      lock detach (the `[[package]]` entry loses source+checksum and its
+//!      version is the tagged one — what `cargo metadata` reports too).
 //!   4. COMPILE ORACLE: the consumer's `main.rs` is rewritten to call
 //!      `cfg_if::socket_patched()` — it only compiles if the patched bytes
-//!      are what cargo links — and `cargo run --locked --offline` prints it.
+//!      are what cargo links — and `cargo run --locked --offline` prints it,
+//!      plus the patched crate's `CARGO_PKG_VERSION` (the tagged version).
 //!   5. **Fresh-checkout proof**: copy ONLY the committable files
 //!      (Cargo.toml + Cargo.lock + src/ + .socket/) to a new dir
 //!      and `cargo build --locked --offline` with an EMPTY CARGO_HOME — and
@@ -29,11 +31,14 @@
 //! distinct `[patch.crates-io]` keys and both compile under `--locked`),
 //! LEGACY MIGRATION (a pre-v5 `.cargo/config.toml` wiring is moved into
 //! `Cargo.toml` by `repair` and by a `vendor` re-run, and the result still
-//! builds), and an OLD-TOOLCHAIN proof (manifest `[patch]` + the detached
-//! lock type-check the patched copy with no network on every installed
-//! rustup toolchain 1.36..=1.56 — config-file `[patch]` needs 1.56+; two
-//! versions of one crate there need `--offline`; skipped when none is
-//! installed, required by the `cargo-old-toolchains` CI leg). Also: a
+//! builds; an untagged pre-tag copy + lock is tagged by `repair` and by a
+//! re-run), and an OLD-TOOLCHAIN proof (manifest `[patch]` + the detached,
+//! tagged lock build the patched copy with no network on cargo 1.41 / 1.56
+//! — the local `rust:1.41-slim` / `rust:1.56-slim` docker images, preferred,
+//! else installed rustup toolchains 1.36..=1.56 (type-check only) —
+//! config-file `[patch]` needs 1.56+; two versions of one crate there need
+//! `--offline`; skipped when neither is available, required by the
+//! `cargo-old-toolchains` CI leg). Also: a
 //! URL-spelled crates.io `[patch]` table is refused, an ancestor-directory
 //! config entry cannot silently shadow the vendored copy, and the pre-v5
 //! multi-version overwrite is healed by a re-run and by `repair`.
@@ -103,7 +108,86 @@ fn socket_entry(uuid: &str, copy_rel: &str) -> String {
 /// Appended to the dep's `src/lib.rs`. Doc comment required: cfg-if denies
 /// `missing_docs` and path deps get no `--cap-lints allow`.
 const PATCH_SUFFIX: &str =
-    "\n/// Socket-patch capstone marker (added by the vendored patch).\npub fn socket_patched() -> u32 { 1 }\n";
+    "\n/// Socket-patch capstone marker (added by the vendored patch).\npub fn socket_patched() -> u32 { 1 }\n\
+     /// The version cargo compiled this copy as.\npub fn socket_pkg_version() -> &'static str { env!(\"CARGO_PKG_VERSION\") }\n";
+
+/// The consumer `main.rs` of the compile oracle: the patched-only marker and
+/// the patched crate's `CARGO_PKG_VERSION`.
+const ORACLE_MAIN: &str =
+    "fn main() { println!(\"MARKER:{}:{}\", cfg_if::socket_patched(), cfg_if::socket_pkg_version()); }\n";
+
+/// `version` tagged for `uuid` (the vendored copy's version).
+fn tagged(version: &str, uuid: &str) -> String {
+    socket_patch_core::vendor::cargo_tag::tag_version(version, uuid)
+}
+
+/// The oracle's expected output line for `version` vendored under `uuid`.
+fn oracle_line(version: &str, uuid: &str) -> String {
+    format!("MARKER:1:{}", tagged(version, uuid))
+}
+
+/// Assert `proj` carries the tagged vendored version for `uuid` in both
+/// the copy's `Cargo.toml` and the detached `Cargo.lock` entry.
+fn assert_tagged(proj: &Path, version: &str, uuid: &str, tag: &str) {
+    let copy = proj.join(format!(
+        ".socket/vendor/cargo/{uuid}/{DEP}-{version}/Cargo.toml"
+    ));
+    let text = std::fs::read_to_string(&copy).unwrap();
+    assert_eq!(
+        socket_patch_core::vendor::cargo_tag::manifest_tag_uuid(&text).as_deref(),
+        Some(uuid),
+        "{tag}: the copy's version is tagged:\n{text}"
+    );
+    let lock = std::fs::read_to_string(proj.join("Cargo.lock")).unwrap();
+    assert!(
+        lock.contains(&format!(
+            "name = \"{DEP}\"\nversion = \"{}\"\n",
+            tagged(version, uuid)
+        )),
+        "{tag}: the lock entry carries the tagged version:\n{lock}"
+    );
+}
+
+/// Undo the tag in `proj` (copy + lock): the untagged shape a pre-tag
+/// release committed.
+fn untag_project(proj: &Path, version: &str, uuid: &str) {
+    let copy = proj.join(format!(
+        ".socket/vendor/cargo/{uuid}/{DEP}-{version}/Cargo.toml"
+    ));
+    let text = std::fs::read_to_string(&copy).unwrap();
+    let untagged = socket_patch_core::vendor::cargo_tag::untag_manifest_text(&text)
+        .expect("the copy is tagged");
+    std::fs::write(&copy, untagged).unwrap();
+    let lock = std::fs::read_to_string(proj.join("Cargo.lock")).unwrap();
+    std::fs::write(
+        proj.join("Cargo.lock"),
+        lock.replace(&tagged(version, uuid), version),
+    )
+    .unwrap();
+}
+
+/// The version `cargo metadata --locked --offline` reports for the dep.
+fn metadata_version(dir: &Path, cargo_home: &Path) -> String {
+    let out = cargo(
+        dir,
+        &["metadata", "--format-version", "1", "--locked", "--offline"],
+        cargo_home,
+    );
+    assert!(
+        out.status.success(),
+        "cargo metadata:\n{}",
+        String::from_utf8_lossy(&out.stderr)
+    );
+    let doc: serde_json::Value = serde_json::from_slice(&out.stdout).unwrap();
+    doc["packages"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .find(|p| p["name"] == DEP)
+        .and_then(|p| p["version"].as_str())
+        .unwrap_or_default()
+        .to_string()
+}
 
 // ── self-contained helpers ────────────────────────────────────────────
 
@@ -636,14 +720,16 @@ fn cargo_vendor_fresh_checkout_locked_offline_build_and_revert() {
         "the ledger records the manifest wiring: {state}"
     );
 
-    // Lock surgery: the entry keeps name+version but loses source+checksum
-    // (without this, `cargo build --locked` fails closed on the [patch]).
+    // Lock surgery: the entry loses source+checksum (without this, `cargo
+    // build --locked` fails closed on the [patch]) and carries the copy's
+    // tagged version — the uuid is readable from Cargo.lock alone.
     let lock_text = std::fs::read_to_string(&lock_path).unwrap();
     let block = package_block(&lock_text, DEP).expect("cfg-if lock entry must survive");
     assert!(
-        block.contains(&format!("version = \"{version}\"")),
-        "lock entry keeps the version:\n{block}"
+        block.contains(&format!("version = \"{}\"", tagged(&version, UUID))),
+        "lock entry carries the tagged version:\n{block}"
     );
+    assert_tagged(&proj, &version, UUID, "main");
     assert!(
         !block.contains("source = ") && !block.contains("checksum = "),
         "lock entry must be detached from the registry (no source/checksum):\n{block}"
@@ -654,12 +740,9 @@ fn cargo_vendor_fresh_checkout_locked_offline_build_and_revert() {
         "the detach must keep the lock format:\n{lock_text}"
     );
 
-    // COMPILE ORACLE: the consumer references the patched-only symbol.
-    std::fs::write(
-        proj.join("src/main.rs"),
-        "fn main() { println!(\"MARKER:{}\", cfg_if::socket_patched()); }\n",
-    )
-    .unwrap();
+    // COMPILE ORACLE: the consumer references the patched-only symbol, and
+    // the patched crate reports its tagged CARGO_PKG_VERSION.
+    std::fs::write(proj.join("src/main.rs"), ORACLE_MAIN).unwrap();
     let run = cargo(&proj, &["run", "-q", "--locked", "--offline"], &cargo_home);
     assert!(
         run.status.success(),
@@ -668,10 +751,15 @@ fn cargo_vendor_fresh_checkout_locked_offline_build_and_revert() {
         String::from_utf8_lossy(&run.stderr),
     );
     assert!(
-        String::from_utf8_lossy(&run.stdout).contains("MARKER:1"),
-        "patched symbol must be linked: {}",
+        String::from_utf8_lossy(&run.stdout).contains(&oracle_line(&version, UUID)),
+        "patched symbol must be linked, compiled as the tagged version: {}",
         String::from_utf8_lossy(&run.stdout)
     );
+    assert_eq!(
+        std::fs::read(&lock_path).unwrap(),
+        lock_text.as_bytes(),
+        "cargo keeps the tagged lock byte-stable"
+    );
 
     // FRESH-CHECKOUT PROOF: only the committable files, EMPTY CARGO_HOME,
     // --locked --offline (spike claim 3).
@@ -699,10 +787,15 @@ fn cargo_vendor_fresh_checkout_locked_offline_build_and_revert() {
         .output()
         .expect("run fresh consumer binary");
     assert!(
-        String::from_utf8_lossy(&bin.stdout).contains("MARKER:1"),
+        String::from_utf8_lossy(&bin.stdout).contains(&oracle_line(&version, UUID)),
         "fresh build must link the PATCHED dep: {}",
         String::from_utf8_lossy(&bin.stdout)
     );
+    assert_eq!(
+        metadata_version(&fresh, &fresh_home),
+        tagged(&version, UUID),
+        "cargo metadata reports the tagged version"
+    );
     // Zero registry/network access: the empty CARGO_HOME gained no crate
     // sources (cargo only writes its dotfile bookkeeping caches).
     assert!(
@@ -1007,9 +1100,10 @@ async fn cargo_get_uuid_vendored_fresh_checkout_locked_build() {
     let lock_text = std::fs::read_to_string(proj.join("Cargo.lock")).unwrap();
     let block = package_block(&lock_text, DEP).expect("cfg-if lock entry must survive");
     assert!(
-        block.contains(&format!("version = \"{version}\"")),
-        "lock entry keeps the version:\n{block}"
+        block.contains(&format!("version = \"{}\"", tagged(&version, UUID))),
+        "lock entry carries the tagged version:\n{block}"
     );
+    assert_tagged(&proj, &version, UUID, "get");
     assert!(
         !block.contains("source = ") && !block.contains("checksum = "),
         "lock entry must be detached from the registry (no source/checksum):\n{block}"
@@ -1297,6 +1391,9 @@ fn cargo_vendor_two_versions_of_one_crate_locked_build() {
         );
     }
     assert!(!proj.join(".cargo").exists());
+    // Each version's copy and lock entry carry their own patch's tag.
+    assert_tagged(&proj, &new_v, UUID, "multi-version 1.x");
+    assert_tagged(&proj, &old_v, UUID_OLD, "multi-version 0.1.x");
 
     // COMPILE ORACLE: a patched-only symbol from each version.
     std::fs::write(proj.join("src/main.rs"), TWO_VERSION_MAIN).unwrap();
@@ -1340,8 +1437,11 @@ fn cargo_vendor_two_versions_of_one_crate_locked_build() {
 
 /// Turn the v5 wiring of `proj` into what a pre-v5 release wrote: the
 /// `[patch.crates-io]` entry in `.cargo/config.toml` (Cargo.toml without
-/// it), and the ledger's patch-entry record naming the config.
+/// it), the copy and lock entry untagged, and the ledger's patch-entry
+/// record naming the config.
 fn downgrade_to_legacy_wiring(proj: &Path, purl: &str, copy_rel: &str) {
+    let version = purl.rsplit('@').next().unwrap();
+    untag_project(proj, version, UUID);
     let manifest = std::fs::read_to_string(proj.join("Cargo.toml")).unwrap();
     std::fs::write(proj.join("Cargo.toml"), strip_patch_table(&manifest)).unwrap();
     std::fs::create_dir_all(proj.join(".cargo")).unwrap();
@@ -1391,14 +1491,18 @@ fn assert_migrated(proj: &Path, purl: &str, copy_rel: &str, tag: &str) {
         entry["lock"]["source"], "registry+https://github.com/rust-lang/crates.io-index",
         "{tag}: the unrecoverable lock originals survive the migration: {entry}"
     );
+    let version = purl.rsplit('@').next().unwrap();
+    assert_tagged(proj, version, UUID, tag);
 }
 
 /// LEGACY MIGRATION: a project vendored by a pre-v5 release (the
-/// `[patch.crates-io]` entry in `.cargo/config.toml`) still builds, and
-/// both `repair` and a plain `vendor` re-run move the wiring into
-/// Cargo.toml — ledger updated, lock originals kept — after which the
-/// project still builds `--locked --offline` on a fresh checkout and the
-/// revert restores the pristine files.
+/// `[patch.crates-io]` entry in `.cargo/config.toml`, untagged copy and
+/// lock) still builds, and both `repair` and a plain `vendor` re-run move
+/// the wiring into Cargo.toml and tag the copy + lock — ledger updated,
+/// lock originals kept — after which the project still builds `--locked
+/// --offline` on a fresh checkout and the revert restores the pristine
+/// files. The untagged MANIFEST shape (an earlier v5 build) is tagged by
+/// `repair` too.
 #[test]
 fn cargo_legacy_config_wiring_migrates_to_the_manifest() {
     if !cargo_e2e_matrix::cargo_available("e2e_vendor_cargo_build (legacy-migration)") {
@@ -1418,11 +1522,7 @@ fn cargo_legacy_config_wiring_migrates_to_the_manifest() {
     let lock_before = std::fs::read(proj.join("Cargo.lock")).unwrap();
     let manifest_before = std::fs::read(proj.join("Cargo.toml")).unwrap();
     vendor_ok(&proj, &cargo_home, "legacy-migration");
-    std::fs::write(
-        proj.join("src/main.rs"),
-        "fn main() { println!(\"MARKER:{}\", cfg_if::socket_patched()); }\n",
-    )
-    .unwrap();
+    std::fs::write(proj.join("src/main.rs"), ORACLE_MAIN).unwrap();
 
     // The pre-v5 shape builds (config `[patch]`, cargo 1.56+).
     downgrade_to_legacy_wiring(&proj, &purl, &copy_rel);
@@ -1432,8 +1532,8 @@ fn cargo_legacy_config_wiring_migrates_to_the_manifest() {
     );
     let run = cargo(&proj, &["run", "-q", "--locked", "--offline"], &cargo_home);
     assert!(
-        String::from_utf8_lossy(&run.stdout).contains("MARKER:1"),
-        "the legacy wiring builds: {}",
+        String::from_utf8_lossy(&run.stdout).contains(&format!("MARKER:1:{version}\n")),
+        "the legacy (untagged) wiring builds: {}",
         String::from_utf8_lossy(&run.stderr)
     );
 
@@ -1454,18 +1554,41 @@ fn cargo_legacy_config_wiring_migrates_to_the_manifest() {
         "repair failed.\nstdout:\n{stdout}\nstderr:\n{stderr}"
     );
     assert!(stdout.contains("cargo_wiring_migrated"), "{stdout}");
+    assert!(stdout.contains("cargo_version_tagged"), "{stdout}");
     assert_migrated(&proj, &purl, &copy_rel, "repair");
 
     // (2) A plain `vendor` re-run migrates.
     downgrade_to_legacy_wiring(&proj, &purl, &copy_rel);
     let env = vendor_ok(&proj, &cargo_home, "legacy re-run");
     assert!(env.to_string().contains("cargo_wiring_migrated"), "{env}");
+    assert!(env.to_string().contains("cargo_version_tagged"), "{env}");
     assert_migrated(&proj, &purl, &copy_rel, "vendor re-run");
 
+    // (3) The untagged manifest shape: `repair` tags it in place.
+    untag_project(&proj, &version, UUID);
+    let (code, stdout, stderr) = run_socket(
+        &proj,
+        &[
+            "repair",
+            "--json",
+            "--offline",
+            "--cwd",
+            proj.to_str().unwrap(),
+        ],
+        &cargo_home,
+    );
+    assert_eq!(
+        code, 0,
+        "repair (tag) failed.\nstdout:\n{stdout}\nstderr:\n{stderr}"
+    );
+    assert!(stdout.contains("cargo_version_tagged"), "{stdout}");
+    assert!(!stdout.contains("cargo_wiring_migrated"), "{stdout}");
+    assert_migrated(&proj, &purl, &copy_rel, "repair (tag only)");
+
     let run = cargo(&proj, &["run", "-q", "--locked", "--offline"], &cargo_home);
     assert!(
-        String::from_utf8_lossy(&run.stdout).contains("MARKER:1"),
-        "the migrated wiring builds: {}",
+        String::from_utf8_lossy(&run.stdout).contains(&oracle_line(&version, UUID)),
+        "the migrated wiring builds the tagged copy: {}",
         String::from_utf8_lossy(&run.stderr)
     );
     let (fresh, home) = fresh_checkout(&proj, tmp.path(), "migrated");
@@ -1494,11 +1617,57 @@ fn cargo_legacy_config_wiring_migrates_to_the_manifest() {
     assert!(!proj.join(".socket/vendor").exists());
 }
 
-/// Set to `1` by the CI leg that installs old toolchains: then finding none
+/// Set to `1` by the CI leg that provides old cargos: then finding none
 /// is a failure, not a skip (the regular matrix legs set
-/// `SOCKET_PATCH_CARGO_E2E_REQUIRED` but install no old toolchain).
+/// `SOCKET_PATCH_CARGO_E2E_REQUIRED` but provide no old cargo).
 const OLD_TOOLCHAINS_REQUIRED_ENV: &str = "SOCKET_PATCH_CARGO_OLD_TOOLCHAINS_REQUIRED";
 
+/// The official images of the old cargos under test, used when present
+/// locally (the test never pulls; the CI leg does).
+const OLD_CARGO_IMAGES: [(&str, u32); 2] = [("rust:1.41-slim", 41), ("rust:1.56-slim", 56)];
+
+/// One old cargo under test.
+#[derive(Clone, Debug)]
+enum OldCargo {
+    /// A local docker image: runs with `--network none`, and BUILDS (and
+    /// runs) the consumer — Linux links fine.
+    Docker { image: String, minor: u32 },
+    /// A rustup toolchain on the host: type-check only (old rustc cannot
+    /// link against a current Xcode on Apple Silicon).
+    Rustup { toolchain: String, minor: u32 },
+}
+
+impl OldCargo {
+    fn minor(&self) -> u32 {
+        match self {
+            Self::Docker { minor, .. } | Self::Rustup { minor, .. } => *minor,
+        }
+    }
+
+    fn name(&self) -> String {
+        match self {
+            Self::Docker { image, .. } => format!("docker {image}"),
+            Self::Rustup { toolchain, .. } => format!("rustup {toolchain}"),
+        }
+    }
+
+    /// The lock format this cargo writes (v3 from 1.53, v2 from 1.41).
+    fn lock_version(&self) -> u8 {
+        match self.minor() {
+            m if m >= 53 => 3,
+            m if m >= 41 => 2,
+            _ => 1,
+        }
+    }
+}
+
+fn docker_image_present(image: &str) -> bool {
+    Command::new("docker")
+        .args(["image", "inspect", "--format", "{{.Id}}", image])
+        .output()
+        .is_ok_and(|o| o.status.success())
+}
+
 /// Installed rustup toolchains 1.36 (`--offline`) through 1.56 (the floor of
 /// config-file `[patch]`): `(full toolchain name, minor)`.
 fn old_toolchains() -> Vec<(String, u32)> {
@@ -1520,39 +1689,98 @@ fn old_toolchains() -> Vec<(String, u32)> {
         .collect()
 }
 
-/// The old toolchains, or `None` (skip printed) when none is installed —
-/// a failure under [`OLD_TOOLCHAINS_REQUIRED_ENV`].
-fn old_toolchains_or_skip(suite: &str) -> Option<Vec<(String, u32)>> {
-    let toolchains = old_toolchains();
-    if toolchains.is_empty() {
+/// The old cargos available here: the local docker images first
+/// (preferred), then any installed rustup toolchain 1.36..=1.56 for a minor
+/// no image covers.
+fn old_cargos() -> Vec<OldCargo> {
+    let mut out: Vec<OldCargo> = OLD_CARGO_IMAGES
+        .iter()
+        .filter(|(image, _)| docker_image_present(image))
+        .map(|(image, minor)| OldCargo::Docker {
+            image: image.to_string(),
+            minor: *minor,
+        })
+        .collect();
+    for (toolchain, minor) in old_toolchains() {
+        if !out.iter().any(|c| c.minor() == minor) {
+            out.push(OldCargo::Rustup { toolchain, minor });
+        }
+    }
+    out
+}
+
+/// The old cargos, or `None` (skip printed) when none is available — a
+/// failure under [`OLD_TOOLCHAINS_REQUIRED_ENV`].
+fn old_cargos_or_skip(suite: &str) -> Option<Vec<OldCargo>> {
+    let cargos = old_cargos();
+    if cargos.is_empty() {
         assert!(
             std::env::var(OLD_TOOLCHAINS_REQUIRED_ENV).as_deref() != Ok("1"),
-            "{suite}: no rustup toolchain 1.36..=1.56 installed, and \
-             {OLD_TOOLCHAINS_REQUIRED_ENV}=1 is set"
+            "{suite}: no local rust:1.41-slim / rust:1.56-slim docker image and no rustup \
+             toolchain 1.36..=1.56, and {OLD_TOOLCHAINS_REQUIRED_ENV}=1 is set"
+        );
+        println!(
+            "SKIP {suite}: no local rust:1.41-slim / rust:1.56-slim docker image and no \
+             rustup toolchain 1.36..=1.56"
         );
-        println!("SKIP {suite}: no rustup toolchain 1.36..=1.56 installed");
         return None;
     }
-    Some(toolchains)
+    Some(cargos)
 }
 
-/// `cargo check -q --locked` (plus `extra`) on `tc` with a private
-/// CARGO_HOME. `check`, not `build`: old rustc cannot link against a
-/// current Xcode on Apple Silicon, and type-checking the consumer against
-/// the patched-only symbol is already the compile oracle. The network is
-/// made unreachable (a dead proxy), so anything cargo tries to fetch fails.
-fn old_cargo_check(dir: &Path, home: &Path, tc: &str, extra: &[&str]) -> Output {
-    Command::new("cargo")
-        .args(["check", "-q", "--locked"])
-        .args(extra)
-        .current_dir(dir)
-        .env("CARGO_HOME", home)
-        .env("RUSTUP_TOOLCHAIN", tc)
-        .env("CARGO_HTTP_PROXY", "http://127.0.0.1:9")
-        .env("CARGO_NET_RETRY", "0")
-        .env_remove("CARGO_TARGET_DIR")
-        .output()
-        .expect("run old cargo")
+/// What one old-cargo run produced.
+struct OldRun {
+    out: Output,
+    /// The private CARGO_HOME gained a `registry/` (something was fetched).
+    fetched: bool,
+}
+
+/// Run `cargo <build|check> -q --locked` (plus `extra`) on the fresh
+/// checkout `dir` with an empty private CARGO_HOME and NO network: a docker
+/// image runs `--network none` and builds, then runs, the consumer (its
+/// stdout is the oracle's); a rustup toolchain type-checks with the network
+/// pointed at a dead proxy.
+fn old_cargo_run(cargo: &OldCargo, dir: &Path, extra: &[&str]) -> OldRun {
+    let home_rel = ".old-cargo-home";
+    let out = match cargo {
+        OldCargo::Docker { image, .. } => {
+            let id = |flag: &str| {
+                Command::new("id")
+                    .arg(flag)
+                    .output()
+                    .map(|o| String::from_utf8_lossy(&o.stdout).trim().to_string())
+                    .unwrap_or_default()
+            };
+            let script = format!(
+                "cargo build -q --locked {} && ./target/debug/consumer",
+                extra.join(" ")
+            );
+            Command::new("docker")
+                .args(["run", "--rm", "--network", "none"])
+                .args(["-u", &format!("{}:{}", id("-u"), id("-g"))])
+                .args(["-v", &format!("{}:/w", dir.display()), "-w", "/w"])
+                .args(["-e", &format!("CARGO_HOME=/w/{home_rel}"), "-e", "HOME=/w"])
+                .arg(image)
+                .args(["sh", "-c", &script])
+                .output()
+                .expect("run docker")
+        }
+        OldCargo::Rustup { toolchain, .. } => Command::new("cargo")
+            .args(["check", "-q", "--locked"])
+            .args(extra)
+            .current_dir(dir)
+            .env("CARGO_HOME", dir.join(home_rel))
+            .env("RUSTUP_TOOLCHAIN", toolchain)
+            .env("CARGO_HTTP_PROXY", "http://127.0.0.1:9")
+            .env("CARGO_NET_RETRY", "0")
+            .env_remove("CARGO_TARGET_DIR")
+            .output()
+            .expect("run old cargo"),
+    };
+    OldRun {
+        out,
+        fetched: dir.join(home_rel).join("registry").exists(),
+    }
 }
 
 /// A current-cargo (v4) registry-only lock rewritten in the format `minor`
@@ -1564,16 +1792,18 @@ fn lock_for_minor(lock: &str, minor: u32) -> String {
 }
 
 /// OLD TOOLCHAIN: the committed v5 wiring (manifest `[patch]` under the
-/// Socket-owned renamed key + detached lock, in the lock format that
-/// toolchain reads) type-checks the patched copy on every installed
-/// toolchain 1.36..=1.56 — below the 1.56 floor of config-file `[patch]` —
-/// with an empty CARGO_HOME and NO network and NO `--offline`, fetching
-/// nothing. Skips when no such toolchain is installed (never installs one);
-/// the `cargo-old-toolchains` CI leg installs 1.41 and 1.56 and requires it.
+/// Socket-owned renamed key + the detached, TAGGED lock, in the lock format
+/// that cargo writes) builds the patched copy on cargo 1.41 and 1.56 —
+/// below the 1.56 floor of config-file `[patch]` — with an empty
+/// CARGO_HOME, NO network and NO `--offline`, fetching nothing; in docker
+/// the consumer runs and prints the patched marker and the tagged
+/// `CARGO_PKG_VERSION`. Skips when no old cargo is available (never pulls
+/// or installs one); the `cargo-old-toolchains` CI leg pulls the images and
+/// requires it.
 #[test]
 fn cargo_vendored_manifest_patch_builds_on_old_toolchains() {
     const SUITE: &str = "e2e_vendor_cargo_build (old-toolchain)";
-    let Some(toolchains) = old_toolchains_or_skip(SUITE) else {
+    let Some(cargos) = old_cargos_or_skip(SUITE) else {
         return;
     };
     if !cargo_e2e_matrix::cargo_available(SUITE) {
@@ -1602,54 +1832,55 @@ fn cargo_vendored_manifest_patch_builds_on_old_toolchains() {
             .contains(&format!("{} = {{ package = ", socket_key(UUID))),
         "the renamed Socket-owned key is what old cargo must accept"
     );
-    std::fs::write(
-        proj.join("src/main.rs"),
-        "fn main() { println!(\"MARKER:{}\", cfg_if::socket_patched()); }\n",
-    )
-    .unwrap();
+    assert_tagged(&proj, &version, UUID, "old-toolchain");
+    std::fs::write(proj.join("src/main.rs"), ORACLE_MAIN).unwrap();
     let pkgs =
         cargo_e2e_matrix::parse_lock(&std::fs::read_to_string(proj.join("Cargo.lock")).unwrap());
-    for (tc, minor) in toolchains {
-        let (fresh, home) = fresh_checkout(&proj, tmp.path(), &tc);
-        // The lock format that toolchain writes (v3 from 1.53, v2 from 1.41).
-        let lock_version = if minor >= 53 {
-            3
-        } else if minor >= 41 {
-            2
-        } else {
-            1
-        };
+    for old in cargos {
+        let name = old.name();
+        let (fresh, _) = fresh_checkout(&proj, tmp.path(), &format!("old-{}", old.minor()));
+        let lock_version = old.lock_version();
         std::fs::write(
             fresh.join("Cargo.lock"),
             cargo_e2e_matrix::write_lock(&pkgs, lock_version),
         )
         .unwrap();
-        let out = old_cargo_check(&fresh, &home, &tc, &[]);
+        let run = old_cargo_run(&old, &fresh, &[]);
         assert!(
-            out.status.success(),
-            "{tc}: manifest [patch] + detached lock v{lock_version} must type-check the \
+            run.out.status.success(),
+            "{name}: manifest [patch] + detached tagged lock v{lock_version} must build the \
              patched copy with no network:\n{}",
-            String::from_utf8_lossy(&out.stderr)
+            String::from_utf8_lossy(&run.out.stderr)
         );
         assert!(
-            !home.join("registry").exists(),
-            "{tc}: nothing is fetched (not even the registry index)"
+            !run.fetched,
+            "{name}: nothing is fetched (not even the registry index)"
         );
-        println!("old-toolchain {tc}: OK (lock v{lock_version})");
+        if matches!(old, OldCargo::Docker { .. }) {
+            assert!(
+                String::from_utf8_lossy(&run.out.stdout).contains(&oracle_line(&version, UUID)),
+                "{name}: the patched copy runs as the tagged version: {}",
+                String::from_utf8_lossy(&run.out.stdout)
+            );
+        }
+        println!("old-toolchain {name}: OK (lock v{lock_version})");
         let _ = std::fs::remove_dir_all(&fresh);
     }
 }
 
 /// OLD TOOLCHAIN, TWO VERSIONS of one crate: older cargo loads the
-/// crates.io index to tell two same-named `[patch]` entries apart, so the
-/// committed two-version wiring type-checks on 1.36..=1.56 under
-/// `--offline` (what the docs require there); without `--offline` and with
-/// no network the outcome is only reported (current stable needs neither —
-/// see `cargo_vendor_two_versions_of_one_crate_locked_build`).
+/// crates.io index to tell two same-named `[patch]` entries apart. Cargo
+/// 1.56 builds the committed two-version wiring under `--offline` from an
+/// empty CARGO_HOME (what the docs require there); older cargo (1.41) needs
+/// the index itself — it fails even under `--offline` with no registry
+/// cache, the same for tagged and untagged locks — so below 1.56 only that
+/// documented failure is accepted. Without `--offline` the outcome is only
+/// reported (current stable needs neither — see
+/// `cargo_vendor_two_versions_of_one_crate_locked_build`).
 #[test]
 fn cargo_vendored_two_versions_on_old_toolchains_need_offline() {
     const SUITE: &str = "e2e_vendor_cargo_build (old-toolchain multi-version)";
-    let Some(toolchains) = old_toolchains_or_skip(SUITE) else {
+    let Some(cargos) = old_cargos_or_skip(SUITE) else {
         return;
     };
     if !cargo_e2e_matrix::cargo_available(SUITE) {
@@ -1667,24 +1898,43 @@ fn cargo_vendored_two_versions_on_old_toolchains_need_offline() {
         let _ = cargo_e2e_matrix::skip(SUITE, "the baseline lock is not v4 (pinned toolchain)");
         return;
     }
-    for (tc, minor) in toolchains {
-        let (fresh, home) = fresh_checkout(&fx.proj, tmp.path(), &format!("mv-{tc}"));
-        std::fs::write(fresh.join("Cargo.lock"), lock_for_minor(&lock, minor)).unwrap();
-        let online = old_cargo_check(&fresh, &home, &tc, &[]);
+    for old in cargos {
+        let name = old.name();
+        let (fresh, _) = fresh_checkout(&fx.proj, tmp.path(), &format!("mv-{}", old.minor()));
+        std::fs::write(fresh.join("Cargo.lock"), lock_for_minor(&lock, old.minor())).unwrap();
+        let online = old_cargo_run(&old, &fresh, &[]);
         println!(
-            "old-toolchain multi-version {tc} without --offline: {}",
-            if online.status.success() {
+            "old-toolchain multi-version {name} without --offline: {}",
+            if online.out.status.success() {
                 "ok"
             } else {
                 "needs --offline (registry index unreachable)"
             }
         );
-        let out = old_cargo_check(&fresh, &home, &tc, &["--offline"]);
+        let run = old_cargo_run(&old, &fresh, &["--offline"]);
+        if old.minor() < 56 && !run.out.status.success() {
+            let stderr = String::from_utf8_lossy(&run.out.stderr);
+            assert!(
+                stderr.contains("unable to fetch registry") && stderr.contains("in offline mode"),
+                "{name}: the only accepted failure below 1.56 is the missing registry \
+                 index:\n{stderr}"
+            );
+            println!("old-toolchain multi-version {name}: needs a registry index (documented)");
+            let _ = std::fs::remove_dir_all(&fresh);
+            continue;
+        }
         assert!(
-            out.status.success(),
-            "{tc}: two vendored versions must type-check under --offline:\n{}",
-            String::from_utf8_lossy(&out.stderr)
+            run.out.status.success(),
+            "{name}: two vendored versions must build under --offline:\n{}",
+            String::from_utf8_lossy(&run.out.stderr)
         );
+        if matches!(old, OldCargo::Docker { .. }) {
+            assert!(
+                String::from_utf8_lossy(&run.out.stdout).contains("MARKER:1:2"),
+                "{name}: both patched copies run: {}",
+                String::from_utf8_lossy(&run.out.stdout)
+            );
+        }
         let _ = std::fs::remove_dir_all(&fresh);
     }
 }
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/cargo.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/cargo.rs
index a3e6c4e6..c3bc83f2 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/cargo.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/cargo.rs
@@ -507,6 +507,12 @@ const CARGO_HOSTED: CargoHosted = CargoHosted {
 ///   `"name version (source)"`, and the checksum moved to the trailing
 ///   `[metadata]` table (cargo < 1.41).
 fn cargo_lock(version: u8, serde_block_tail: &str) -> String {
+    cargo_lock_at(version, CRATE_VERSION, serde_block_tail)
+}
+
+/// [`cargo_lock`] with serde locked at `crate_version` (a vendored copy's
+/// tagged version).
+fn cargo_lock_at(version: u8, crate_version: &str, serde_block_tail: &str) -> String {
     const HEADER: &str =
         "# This file is automatically @generated by Cargo.\n# It is not intended for manual \
          editing.\n";
@@ -520,8 +526,8 @@ fn cargo_lock(version: u8, serde_block_tail: &str) -> String {
     if version == 1 {
         let source = value("source");
         let dep_ref = match &source {
-            Some(src) => format!("{CRATE} {CRATE_VERSION} ({src})"),
-            None => format!("{CRATE} {CRATE_VERSION}"),
+            Some(src) => format!("{CRATE} {crate_version} ({src})"),
+            None => format!("{CRATE} {crate_version}"),
         };
         let source_line = source
             .as_ref()
@@ -529,13 +535,13 @@ fn cargo_lock(version: u8, serde_block_tail: &str) -> String {
             .unwrap_or_default();
         let metadata = match (&source, value("checksum")) {
             (Some(src), Some(sum)) => {
-                format!("\n[metadata]\n\"checksum {CRATE} {CRATE_VERSION} ({src})\" = \"{sum}\"\n")
+                format!("\n[metadata]\n\"checksum {CRATE} {crate_version} ({src})\" = \"{sum}\"\n")
             }
             _ => String::new(),
         };
         return format!(
             "[[package]]\nname = \"app\"\nversion = \"0.1.0\"\ndependencies = [\n \"{dep_ref}\",\n]\n\n\
-             [[package]]\nname = \"{CRATE}\"\nversion = \"{CRATE_VERSION}\"\n{source_line}{metadata}"
+             [[package]]\nname = \"{CRATE}\"\nversion = \"{crate_version}\"\n{source_line}{metadata}"
         );
     }
     let version_line = if version >= 3 {
@@ -546,7 +552,7 @@ fn cargo_lock(version: u8, serde_block_tail: &str) -> String {
     format!(
         "{HEADER}{version_line}[[package]]\nname = \"app\"\nversion = \"0.1.0\"\n\
          dependencies = [\n \"serde\",\n]\n\n[[package]]\nname = \"{CRATE}\"\nversion = \
-         \"{CRATE_VERSION}\"\n{serde_block_tail}"
+         \"{crate_version}\"\n{serde_block_tail}"
     )
 }
 
@@ -634,14 +640,30 @@ enum CargoVendored {
     LegacyConfig,
 }
 
+/// The copy's (and the detached lock entry's) tagged version for `uuid`.
+fn tagged_version(uuid: &str) -> String {
+    socket_patch_core::vendor::cargo_tag::tag_version(CRATE_VERSION, uuid)
+}
+
 /// The `vendor` cargo backend's committed state: the patched copy dir, the
 /// `[patch.crates-io]` path entry, and the lock entry detached from crates.io
-/// (name + version kept, source + checksum dropped).
+/// (source + checksum dropped). The v5 manifest flavors carry the tagged
+/// version `<version>+socket.<uuid>` in the copy's `Cargo.toml` and the lock
+/// entry; the pre-v5 config flavors are untagged, as those releases wrote.
 fn write_cargo_vendored(fx: &Fx, uuid: &str, flavor: CargoVendored, lib: &[u8]) {
     let rel = cargo_artifact(uuid);
+    let legacy = matches!(
+        flavor,
+        CargoVendored::LegacyConfigToml | CargoVendored::LegacyConfig
+    );
+    let copy_version = if legacy {
+        CRATE_VERSION.to_string()
+    } else {
+        tagged_version(uuid)
+    };
     fx.put(
         &format!("{rel}/Cargo.toml"),
-        format!("[package]\nname = \"{CRATE}\"\nversion = \"{CRATE_VERSION}\"\n"),
+        format!("[package]\nname = \"{CRATE}\"\nversion = \"{copy_version}\"\n"),
     );
     fx.put(&format!("{rel}/src/lib.rs"), lib);
     let dep = format!("[dependencies]\n{CRATE} = \"{CRATE_VERSION}\"\n");
@@ -668,7 +690,7 @@ fn write_cargo_vendored(fx: &Fx, uuid: &str, flavor: CargoVendored, lib: &[u8])
             fx.put(".cargo/config", inline);
         }
     }
-    fx.put("Cargo.lock", cargo_lock(4, ""));
+    fx.put("Cargo.lock", cargo_lock_at(4, &copy_version, ""));
 }
 
 /// The manifest `write_cargo_vendored` writes, minus the `[patch]` wiring.
@@ -1143,25 +1165,28 @@ fn cargo_vendored_a_attests_every_flavor_without_manifest_or_ledgers() {
 
 /// a: the detached (sourceless) lock entry in every Cargo.lock format —
 /// v1's `"name version"` references and `[metadata]` table, v2's missing
-/// `version` key, v3 — is the same live `[patch]`; a v1–v4 lock that
-/// re-resolved the crate from crates.io is not.
+/// `version` key, v3 — is the same live `[patch]`, whether it carries the
+/// copy's tagged version (v5) or the untagged one (vendored before tagged
+/// versions); a v1–v4 lock that re-resolved the crate from crates.io is not.
 #[test]
 fn cargo_vendored_a_attests_in_every_lock_version() {
     let api = Api::start(vec![(U, cargo_view(U))]);
     for version in 1..=4u8 {
         let fx = Fx::new();
         write_cargo_vendored(&fx, U, CargoVendored::Inline, PATCHED_RS);
-        fx.put("Cargo.lock", cargo_lock(version, ""));
-        let run = fx.vex(&["--proxy-url", &api.uri()]);
-        assert_attested(
-            &fx,
-            &run,
-            CARGO_PURL,
-            U,
-            "vendored",
-            &format!("lock v{version}"),
-        );
-        assert!(warning_codes(&run).is_empty(), "v{version}: {}", run.env);
+        for locked in [tagged_version(U), CRATE_VERSION.to_string()] {
+            fx.put("Cargo.lock", cargo_lock_at(version, &locked, ""));
+            let run = fx.vex(&["--proxy-url", &api.uri()]);
+            assert_attested(
+                &fx,
+                &run,
+                CARGO_PURL,
+                U,
+                "vendored",
+                &format!("lock v{version} at {locked}"),
+            );
+            assert!(warning_codes(&run).is_empty(), "v{version}: {}", run.env);
+        }
 
         fx.put(
             "Cargo.lock",
@@ -1178,6 +1203,25 @@ fn cargo_vendored_a_attests_in_every_lock_version() {
     }
 }
 
+/// f: a detached lock entry tagged for ANOTHER patch uuid names a copy
+/// other than the one the `[patch]` points at (a config override elsewhere,
+/// or a stale wiring): never attested — in any lock format, with or
+/// without the ledger.
+#[test]
+fn cargo_vendored_f_lock_tag_for_another_uuid_never_attests() {
+    let api = Api::start(vec![(U, cargo_view(U)), (OTHER_U, cargo_view(OTHER_U))]);
+    for version in 1..=4u8 {
+        let fx = Fx::new();
+        write_cargo_vendored(&fx, U, CargoVendored::Inline, PATCHED_RS);
+        fx.put(
+            "Cargo.lock",
+            cargo_lock_at(version, &tagged_version(OTHER_U), ""),
+        );
+        let run = fx.vex(&["--proxy-url", &api.uri()]);
+        assert_nothing_discovered(&run, &format!("lock v{version} tagged for another uuid"));
+    }
+}
+
 /// a (first build pending): no Cargo.lock yet — the `[patch]` wiring is
 /// what cargo will build, so it attests (the `vendored_entry_in_use` rule).
 #[test]
diff --git a/crates/socket-patch-cli/tests/mode_migration_cargo.rs b/crates/socket-patch-cli/tests/mode_migration_cargo.rs
index 44ef3ef1..3a212c9c 100644
--- a/crates/socket-patch-cli/tests/mode_migration_cargo.rs
+++ b/crates/socket-patch-cli/tests/mode_migration_cargo.rs
@@ -510,6 +510,21 @@ fn fresh_checkout(proj: &Path, tmp: &Path, tag: &str) -> (PathBuf, PathBuf) {
     (fresh, home)
 }
 
+/// `version` tagged for `uuid` (the vendored copy's version).
+fn tagged(version: &str, uuid: &str) -> String {
+    socket_patch_core::vendor::cargo_tag::tag_version(version, uuid)
+}
+
+/// The dep's `Cargo.lock` entry has exactly version `want`.
+fn assert_lock_version(proj: &Path, want: &str, tag: &str) {
+    let lock = read(proj, "Cargo.lock");
+    assert_eq!(
+        locked_version(&lock, DEP).as_deref(),
+        Some(want),
+        "{tag}: the {DEP} lock entry version:\n{lock}"
+    );
+}
+
 fn read(proj: &Path, rel: &str) -> String {
     std::fs::read_to_string(proj.join(rel)).unwrap_or_default()
 }
@@ -596,6 +611,8 @@ async fn vendored_then_hosted_takeover_leaves_pure_hosted() {
         config.contains(&format!("[registries.socket-patch-{UUID_H}]")),
         "{config}"
     );
+    // The hosted lock entry is the registry version, the vendored tag gone.
+    assert_lock_version(&proj, &version, "vendored -> hosted");
     assert!(
         !vendor_ledger_claims(&proj, &purl),
         "the displaced vendored ledger entry must be dropped: {}",
@@ -777,6 +794,7 @@ async fn hosted_then_vendored_takeover_leaves_pure_vendored() {
         !lock_block.contains("source ="),
         "vendored lock entry is detached: {lock_block}"
     );
+    assert_lock_version(&proj, &tagged(&version, UUID_V), "hosted -> vendored");
 
     // C: the vendored contract — fresh checkout, EMPTY home, offline locked
     // build (pre-fix: "no matching package named cfg-if found").
@@ -919,7 +937,9 @@ async fn double_takeover_a_b_a_preserves_lock_originals() {
         "C3: the ledger must keep the registry tarball checksum: {entry}"
     );
 
-    // The vendored contract still holds after the round trip.
+    // The vendored contract still holds after the round trip, and the lock
+    // names the vendored patch again (tagged), not the hosted one.
+    assert_lock_version(&proj, &tagged(&version, UUID_V), "A -> B -> A");
     let (fresh, home) = fresh_checkout(&proj, tmp.path(), "aba");
     assert_build_ok(
         "cargo build --locked --offline (A->B->A fresh checkout)",
diff --git a/crates/socket-patch-core/src/vendor/cargo.rs b/crates/socket-patch-core/src/vendor/cargo.rs
index 875eb772..c2045a6a 100644
--- a/crates/socket-patch-core/src/vendor/cargo.rs
+++ b/crates/socket-patch-core/src/vendor/cargo.rs
@@ -9,6 +9,13 @@
 //! (spike-verified; the whole wiring is proven offline-from-Socket on a fresh
 //! checkout with an empty `CARGO_HOME` — `spikes/PHASE0-FINDINGS.txt`).
 //!
+//! The copy's own `Cargo.toml` version is TAGGED `<version>+socket.<uuid>`
+//! ([`super::cargo_tag`]) and the detached lock entry carries the same
+//! tagged version — the lock cargo itself writes for the tagged copy — so
+//! `Cargo.lock` alone names the patch uuid of the copy that builds. Copies
+//! and locks vendored before tagged versions (or tagged for a previous
+//! uuid) are (re)tagged by the next re-run or `repair`.
+//!
 //! Pre-v5 releases wrote the same entry to `.cargo/config.toml` (or the
 //! legacy `.cargo/config`); a re-run over that wiring moves it into the
 //! manifest (`cargo_wiring_migrated`), and every revert removes both
@@ -30,6 +37,7 @@ use crate::utils::purl::{parse_cargo_purl, strip_purl_qualifiers};
 use super::cargo_config;
 use super::cargo_lock::{self, LockEditError};
 use super::cargo_manifest;
+use super::cargo_tag;
 use super::common::{
     already_patched_result, copy_matches_after_hashes, done, prune_empty_vendor_levels,
     refuse_symlinked, refused, service_offline_conflict, stage_dir_for, swap_stage_into_place,
@@ -72,8 +80,11 @@ async fn is_vendored(project_root: &Path, name: &str, version: &str) -> bool {
 ///   socket-patch takeover) → `Some(false)` — the committed copy is NOT what
 ///   the lock consumes, so GC may reclaim the entry (its revert restores /
 ///   keeps the registry resolution and drops the dead `[patch]` wiring);
-/// * entry detached AND a Socket-owned `[patch.crates-io]` entry (root
-///   manifest, or a legacy project-config one) points at THIS entry's
+/// * entry detached but TAGGED for another patch uuid → `Some(false)` (the
+///   lock builds another generation's copy);
+/// * entry detached (tagged for this entry's uuid, or untagged — vendored
+///   before tagged versions) AND a Socket-owned `[patch.crates-io]` entry
+///   (root manifest, or a legacy project-config one) points at THIS entry's
 ///   committed copy → `Some(true)` (the wired vendored shape);
 /// * detached but the `[patch]` points elsewhere / is gone → `Some(false)`
 ///   (nothing consumes the copy; the revert re-attaches the recorded
@@ -82,10 +93,11 @@ async fn is_vendored(project_root: &Path, name: &str, version: &str) -> bool {
 pub async fn vendored_entry_in_use(entry: &VendorEntry, project_root: &Path) -> Option<bool> {
     let (name, version) = parse_cargo_purl(&entry.base_purl)?;
     match cargo_lock::probe_lock_entry(project_root, name, version).await {
-        cargo_lock::LockEntryProbe::NoLockfile => None,
+        cargo_lock::LockEntryProbe::NoLockfile | cargo_lock::LockEntryProbe::Unreadable => None,
         cargo_lock::LockEntryProbe::EntryMissing => Some(false),
         cargo_lock::LockEntryProbe::Source(_) => Some(false),
-        cargo_lock::LockEntryProbe::Detached => {
+        cargo_lock::LockEntryProbe::Detached(Some(tag)) if tag != entry.uuid => Some(false),
+        cargo_lock::LockEntryProbe::Detached(_) => {
             let marker = vendor_uuid_dir_rel("cargo", &entry.uuid)?;
             let wired = socket_patch_paths(project_root, name)
                 .await
@@ -168,6 +180,7 @@ async fn cargo_service_copy(
     service: Option<&VendorServiceConfig>,
     record: &PatchRecord,
     name: &str,
+    version: &str,
     copy_dir: &Path,
     uuid_dir: &Path,
     warnings: &mut Vec<VendorWarning>,
@@ -233,6 +246,16 @@ async fn cargo_service_copy(
                     ),
                 );
             }
+            // The copy's version carries the patch uuid tag, written in the
+            // stage so a swapped-in copy is never untagged.
+            if let Err(e) = cargo_tag::tag_copy_manifest(&stage, version, &record.uuid).await {
+                cleanup_failed_stage(&stage, uuid_dir, false).await;
+                return miss(
+                    warnings,
+                    "vendor_prebuilt_layout_mismatch",
+                    format!("prebuilt crate for {name}: cannot tag its version ({e})"),
+                );
+            }
             if let Err(e) = swap_stage_into_place(&stage, copy_dir).await {
                 cleanup_failed_stage(&stage, uuid_dir, false).await;
                 return hard(
@@ -294,7 +317,8 @@ async fn cargo_service_copy(
 /// survives, and the failed [`ApplyResult`] is the `Err` for the caller to
 /// bubble. On success the copy carries no `.cargo-checksum.json` (a path-dep
 /// copy must never have one; the fresh copy excludes it, and it is re-removed
-/// defensively in case the patch recreated it).
+/// defensively in case the patch recreated it) and its `Cargo.toml` version
+/// is tagged for the patch uuid.
 #[allow(clippy::too_many_arguments)]
 async fn copy_and_patch(
     purl: &str,
@@ -331,6 +355,14 @@ async fn copy_and_patch(
         return Err(result);
     }
     let _ = tokio::fs::remove_file(stage.join(".cargo-checksum.json")).await;
+    // Tag the copy's version in the stage (after the patch applied, so the
+    // patch pipeline verified the untagged bytes).
+    if let Err(e) = cargo_tag::tag_copy_manifest(&stage, version, &record.uuid).await {
+        cleanup_failed_stage(&stage, uuid_dir, unwind_uuid_dir).await;
+        result.success = false;
+        result.error = Some(format!("{COPY_UNTAGGABLE}: {e}"));
+        return Err(result);
+    }
     if let Err(e) = swap_stage_into_place(&stage, copy_dir).await {
         cleanup_failed_stage(&stage, uuid_dir, unwind_uuid_dir).await;
         result.success = false;
@@ -596,18 +628,49 @@ pub async fn vendor_cargo_crate(
     let points_here = prior_manifest_path.as_deref() == Some(copy_rel.as_str())
         || legacy_paths.contains(&copy_rel);
 
+    // The lock edit this run will make (a registry entry is detached and
+    // tagged; a detached one — an earlier generation, or vendored before
+    // tagged versions — is retagged) must be consistent: prove it before
+    // anything is written.
+    let lock_probe = cargo_lock::probe_lock_entry(project_root, name, version).await;
+    let preflight = match &lock_probe {
+        cargo_lock::LockEntryProbe::Source(_) => {
+            cargo_lock::detach_lock_entry(project_root, name, version, &record.uuid, true)
+                .await
+                .err()
+        }
+        cargo_lock::LockEntryProbe::Detached(tag)
+            if tag.as_deref() != Some(record.uuid.as_str()) =>
+        {
+            cargo_lock::retag_lock_entry(project_root, name, version, &record.uuid, true)
+                .await
+                .err()
+        }
+        _ => None,
+    };
+    if let Some(e @ LockEditError::Inconsistent(_)) = preflight {
+        return refused(
+            LOCK_UNTAGGABLE,
+            format!(
+                "cannot tag the Cargo.lock entry for {name}@{version} with the vendored \
+                 copy's version: {e}"
+            ),
+        );
+    }
+
     // Hot path: the wiring points here and the lock entry needs no detach
     // (no lockfile — the first build writes a path-form lock — or already
-    // sourceless; a dry-run detach's `NotRegistry` IS the detached shape).
-    // Touch nothing but the artifact; a legacy-only wiring is migrated.
+    // sourceless). Touch nothing but the artifact and the version tag; a
+    // legacy-only wiring is migrated, a missing/stale tag re-applied.
     if points_here
         && matches!(
-            cargo_lock::detach_lock_entry(project_root, name, version, true).await,
-            Err(LockEditError::NotRegistry) | Err(LockEditError::NoLockfile)
+            lock_probe,
+            cargo_lock::LockEntryProbe::Detached(_) | cargo_lock::LockEntryProbe::NoLockfile
         )
     {
         let mut warnings: Vec<VendorWarning> = Vec::new();
-        let result = if copy_matches_after_hashes(&copy_dir, &record.files).await {
+        let mut rebuilt = false;
+        let result = if cargo_copy_matches(&copy_dir, &record.files).await {
             already_patched_result(purl, &copy_dir, &record.files)
         } else {
             // Wired but the committed copy is missing/stale: rebuild the
@@ -622,10 +685,12 @@ pub async fn vendor_cargo_crate(
             if let Some(refusal) = service_offline_conflict(service) {
                 return refusal;
             }
+            rebuilt = true;
             let result = match cargo_service_copy(
                 service,
                 record,
                 name,
+                version,
                 &copy_dir,
                 &uuid_dir,
                 &mut warnings,
@@ -677,19 +742,41 @@ pub async fn vendor_cargo_crate(
             }
             result
         };
+        let mut result = result;
+        let tagged = match tag_vendored_copy(
+            project_root,
+            name,
+            version,
+            &record.uuid,
+            &copy_dir,
+            rebuilt,
+            false,
+        )
+        .await
+        {
+            Ok(tagged) => tagged,
+            Err(e) => {
+                result.success = false;
+                result.error = Some(e);
+                return done(result, None, warnings);
+            }
+        };
+        if tagged {
+            warnings.push(tag_warning(name, version, &record.uuid, false));
+        }
         if prior_manifest_path.as_deref() == Some(copy_rel.as_str())
             && legacy_paths.is_empty()
             && prior_key_ok
+            && !tagged
         {
             // In sync: the entry stays with the caller's existing ledger
             // record, which holds the unrecoverable lock originals.
             return done(result, None, warnings);
         }
-        // Migration (legacy config → manifest), or a manifest entry moving
-        // off a key a config file now shadows: a fresh entry naming the
-        // manifest wiring; the caller carries the lock originals forward
-        // from the entry it replaces (`carry_forward_wiring`).
-        let mut result = result;
+        // Migration (legacy config → manifest), a manifest entry moving off
+        // a key a config file now shadows, or a (re)tag: a fresh entry
+        // naming the manifest wiring; the caller carries the lock originals
+        // forward from the entry it replaces (`carry_forward_wiring`).
         let ensured = match cargo_manifest::ensure_patch_entry(
             project_root,
             name,
@@ -749,6 +836,7 @@ pub async fn vendor_cargo_crate(
         service,
         record,
         name,
+        version,
         &copy_dir,
         &uuid_dir,
         &mut warnings,
@@ -812,9 +900,12 @@ pub async fn vendor_cargo_crate(
     let had_prior_wiring =
         ensured.prior_path.is_some() || !legacy_paths.is_empty() || prior_socket_copy;
 
-    // ── detach the lock entry ─────────────────────────────────────────────
+    // ── detach (and tag) the lock entry ───────────────────────────────────
+    // `retagged_from`: the version a retag replaced, for the unwind.
+    let mut retagged_from: Option<String> = None;
     let lock_original: Option<CargoLockOriginal> =
-        match cargo_lock::detach_lock_entry(project_root, name, version, false).await {
+        match cargo_lock::detach_lock_entry(project_root, name, version, &record.uuid, false).await
+        {
             Ok(orig) => Some(orig),
             Err(LockEditError::NoLockfile) => {
                 // No lock to edit: the first `cargo build`/`generate-lockfile`
@@ -831,10 +922,40 @@ pub async fn vendor_cargo_crate(
                 // migrated), or over a committed Socket copy whose wiring a
                 // pre-v5 second-version vendor overwrote: the prior
                 // socket-owned run already detached this entry — source-less
-                // is exactly the shape we produce. The true pre-vendor
-                // originals live only in the ledger entry being replaced,
-                // which the caller carries forward.
-                None
+                // is exactly the shape we produce, once retagged for this
+                // uuid. The true pre-vendor originals live only in the
+                // ledger entry being replaced, which the caller carries
+                // forward.
+                match cargo_lock::retag_lock_entry(project_root, name, version, &record.uuid, false)
+                    .await
+                {
+                    Ok(prev) => {
+                        retagged_from = prev;
+                        None
+                    }
+                    Err(e) => {
+                        let prior = ensured.prior_path.as_deref();
+                        unwind_manifest(
+                            project_root,
+                            name,
+                            version,
+                            &record.uuid,
+                            prior,
+                            &reserved,
+                        )
+                        .await;
+                        if !prior_points_here {
+                            let _ = remove_tree(&uuid_dir).await;
+                        }
+                        prune_empty_vendor_levels(&uuid_dir).await;
+                        result.success = false;
+                        result.error = Some(format!(
+                            "failed to retag the Cargo.lock entry for {name}@{version}: {e} \
+                             (the Cargo.toml edit was unwound and nothing new was vendored)"
+                        ));
+                        return done(result, None, warnings);
+                    }
+                }
             }
             Err(e) => {
                 // Without the lock edit, `--locked` builds fail closed on the
@@ -867,7 +988,18 @@ pub async fn vendor_cargo_crate(
         retire_legacy_wiring(project_root, name, version, &legacy_paths, &mut warnings).await
     {
         if let Some(orig) = &lock_original {
-            let _ = cargo_lock::restore_lock_entry(project_root, name, version, orig, false).await;
+            let _ = cargo_lock::restore_lock_entry(
+                project_root,
+                name,
+                version,
+                &record.uuid,
+                orig,
+                false,
+            )
+            .await;
+        }
+        if let Some(prev) = &retagged_from {
+            let _ = cargo_lock::retag_lock_entry_to(project_root, name, version, prev, false).await;
         }
         let prior = ensured.prior_path.as_deref();
         unwind_manifest(project_root, name, version, &record.uuid, prior, &reserved).await;
@@ -1003,6 +1135,110 @@ fn legacy_kept_error(name: &str, version: &str, detail: &str) -> String {
     )
 }
 
+/// Refusal code: the lock entry cannot carry the copy's tagged version
+/// consistently ([`LockEditError::Inconsistent`]).
+pub const LOCK_UNTAGGABLE: &str = "cargo_lock_untaggable";
+
+/// Failure tag: the copy's `Cargo.toml` version cannot be tagged
+/// ([`cargo_tag::TagError`]).
+pub const COPY_UNTAGGABLE: &str = "cargo_copy_untaggable";
+
+/// Advisory code for a copy / lock entry (re)tagged by a re-run or repair.
+pub const VERSION_TAGGED: &str = "cargo_version_tagged";
+
+/// Does the committed copy verify against the patch record? The tag-aware
+/// twin of [`copy_matches_after_hashes`]: a patched `Cargo.toml` is compared
+/// with its Socket tag dropped (the tag is written after the patch).
+async fn cargo_copy_matches(
+    copy_dir: &Path,
+    files: &std::collections::HashMap<String, crate::manifest::schema::PatchFileInfo>,
+) -> bool {
+    if copy_matches_after_hashes(copy_dir, files).await {
+        return true;
+    }
+    let (manifest, rest): (Vec<_>, Vec<_>) = files
+        .iter()
+        .partition(|(k, _)| cargo_tag::is_copy_manifest_key(k));
+    let Some((_, info)) = manifest.first() else {
+        return false;
+    };
+    let rest: std::collections::HashMap<String, crate::manifest::schema::PatchFileInfo> = rest
+        .into_iter()
+        .map(|(k, v)| (k.clone(), v.clone()))
+        .collect();
+    if !copy_matches_after_hashes(copy_dir, &rest).await {
+        return false;
+    }
+    let Ok(text) = read_regular_to_string(&copy_dir.join("Cargo.toml")).await else {
+        return false;
+    };
+    cargo_tag::untagged_manifest_bytes(text.as_bytes()).is_some_and(|b| {
+        crate::hash::git_sha256::compute_git_sha256_from_bytes(&b) == info.after_hash
+    })
+}
+
+/// Tag the committed copy at `copy_dir` and its DETACHED lock entry for
+/// `uuid` (an untagged copy vendored before tagged versions, or one tagged
+/// for a previous uuid). `Ok(true)` when anything changed (or, with
+/// `dry_run`, would). The lock retag is proven first; a failed lock write
+/// untags the copy again when this call tagged it (or `untag_on_failure`:
+/// the caller just rebuilt it tagged) so copy and lock never disagree.
+/// A missing lock needs no edit (the first build locks the tagged copy).
+async fn tag_vendored_copy(
+    project_root: &Path,
+    name: &str,
+    version: &str,
+    uuid: &str,
+    copy_dir: &Path,
+    untag_on_failure: bool,
+    dry_run: bool,
+) -> Result<bool, String> {
+    let lock_retag = matches!(
+        cargo_lock::probe_lock_entry(project_root, name, version).await,
+        cargo_lock::LockEntryProbe::Detached(tag) if tag.as_deref() != Some(uuid)
+    );
+    if lock_retag {
+        if let Err(e) = cargo_lock::retag_lock_entry(project_root, name, version, uuid, true).await
+        {
+            return Err(format!(
+                "{LOCK_UNTAGGABLE}: cannot tag the Cargo.lock entry for {name}@{version}: {e}"
+            ));
+        }
+    }
+    let copy_retag = cargo_tag::copy_manifest_tag(copy_dir).await.as_deref() != Some(uuid);
+    if dry_run {
+        return Ok(lock_retag || copy_retag);
+    }
+    let copy_changed = cargo_tag::tag_copy_manifest(copy_dir, version, uuid)
+        .await
+        .map_err(|e| format!("{COPY_UNTAGGABLE}: {e}"))?;
+    if lock_retag {
+        if let Err(e) = cargo_lock::retag_lock_entry(project_root, name, version, uuid, false).await
+        {
+            if copy_changed || untag_on_failure {
+                cargo_tag::untag_copy_manifest(copy_dir).await;
+            }
+            return Err(format!(
+                "{LOCK_UNTAGGABLE}: cannot tag the Cargo.lock entry for {name}@{version}: {e}"
+            ));
+        }
+    }
+    Ok(copy_changed || lock_retag)
+}
+
+/// The [`VERSION_TAGGED`] advisory.
+fn tag_warning(name: &str, version: &str, uuid: &str, dry_run: bool) -> VendorWarning {
+    VendorWarning::new(
+        VERSION_TAGGED,
+        format!(
+            "{} the vendored copy of {name}@{version} and its Cargo.lock entry with the \
+             tagged version {}",
+            if dry_run { "would tag" } else { "tagged" },
+            cargo_tag::tag_version(version, uuid)
+        ),
+    )
+}
+
 /// Undo this run's manifest edit: restore the prior Socket-owned entry for
 /// `name@version` (a re-vendor), else drop the entry this run added.
 /// Best-effort — the caller is already failing.
@@ -1178,7 +1414,7 @@ async fn user_patch_conflict(
         let proven_other = match entry.path.as_deref() {
             Some(p) => path_crate_version(base, p)
                 .await
-                .is_some_and(|v| v != version),
+                .is_some_and(|v| !cargo_tag::denotes(&v, version)),
             None => false,
         };
         if !proven_other {
@@ -1242,22 +1478,30 @@ pub async fn socket_wiring_present(project_root: &Path, name: &str, version: &st
         .any(|p| cargo_manifest::is_socket_copy_of(p, name, version))
 }
 
-/// Move a ledger entry's legacy project-config wiring into the root
-/// manifest (`repair`'s migration step; `vendor`/`scan`/`get` migrate on
-/// their own re-run). Only a legacy entry pointing at THIS entry's copy is
-/// moved. Also restores LOST wiring: a detached lock entry that no
-/// Socket-owned `[patch]` wires while this entry's committed copy exists
-/// (a pre-v5 second-version vendor overwrote its crate-named config key)
-/// gets its manifest entry back (`cargo_wiring_restored`).
-/// `Ok(Some(entry))` is the updated ledger entry (the `cargo_patch_entry`
-/// record now names `Cargo.toml`); `Ok(None)` when there is nothing to
-/// do; `Err` when the manifest cannot take the entry (nothing was
-/// changed).
+/// Bring a ledger entry's wiring up to the v5 shape (`repair`'s migration
+/// step; `vendor`/`scan`/`get` migrate on their own re-run):
+///
+/// * a legacy project-config entry pointing at THIS entry's copy is moved
+///   into the root manifest (`cargo_wiring_migrated`);
+/// * LOST wiring is restored: a detached lock entry that no Socket-owned
+///   `[patch]` wires while this entry's committed copy exists (a pre-v5
+///   second-version vendor overwrote its crate-named config key) gets its
+///   manifest entry back (`cargo_wiring_restored`);
+/// * a copy and detached lock entry wired here but not tagged for this
+///   entry's uuid (vendored before tagged versions) are tagged
+///   ([`VERSION_TAGGED`]; a tag that cannot be written is the
+///   `cargo_version_untagged` warning, nothing else undone).
+///
+/// `Ok(Some((entry, warnings)))` is the updated ledger entry (the
+/// `cargo_patch_entry` record names `Cargo.toml`; a recorded file
+/// inventory is refreshed over the tagged copy); `Ok(None)` when there is
+/// nothing to do; `Err` when the manifest cannot take the entry (nothing
+/// was changed).
 pub async fn migrate_legacy_wiring(
     entry: &VendorEntry,
     project_root: &Path,
     dry_run: bool,
-) -> Result<Option<(VendorEntry, VendorWarning)>, String> {
+) -> Result<Option<(VendorEntry, Vec<VendorWarning>)>, String> {
     let Some((name, version)) = parse_cargo_purl(&entry.base_purl) else {
         return Ok(None);
     };
@@ -1268,6 +1512,10 @@ pub async fn migrate_legacy_wiring(
         return Ok(None);
     };
     let copy_rel = format!("{base_rel}/{name}-{version}");
+    let copy_dir = project_root.join(&copy_rel);
+    let copy_present = tokio::fs::metadata(&copy_dir)
+        .await
+        .is_ok_and(|m| m.is_dir());
     let legacy_here = cargo_config::legacy_socket_entries(project_root, name)
         .await
         .into_iter()
@@ -1275,15 +1523,81 @@ pub async fn migrate_legacy_wiring(
     let unwired_here = !legacy_here
         && matches!(
             cargo_lock::probe_lock_entry(project_root, name, version).await,
-            cargo_lock::LockEntryProbe::Detached
+            cargo_lock::LockEntryProbe::Detached(_)
         )
         && !socket_wiring_present(project_root, name, version).await
-        && tokio::fs::metadata(project_root.join(&copy_rel))
-            .await
-            .is_ok_and(|m| m.is_dir());
-    if !legacy_here && !unwired_here {
+        && copy_present;
+    let mut migrated = entry.clone();
+    let mut warnings: Vec<VendorWarning> = Vec::new();
+    if legacy_here || unwired_here {
+        let warning = move_wiring_into_manifest(
+            entry,
+            project_root,
+            name,
+            version,
+            &copy_rel,
+            unwired_here,
+            dry_run,
+            &mut migrated,
+        )
+        .await?;
+        warnings.push(warning);
+    }
+    // The (now) wired copy carries this entry's tag, and so does the lock.
+    let wired_here = socket_patch_paths(project_root, name)
+        .await
+        .iter()
+        .any(|p| cargo_manifest::normalize_socket_path(p).as_deref() == Some(copy_rel.as_str()))
+        || (dry_run && unwired_here);
+    if copy_present && wired_here {
+        match tag_vendored_copy(
+            project_root,
+            name,
+            version,
+            &entry.uuid,
+            &copy_dir,
+            false,
+            dry_run,
+        )
+        .await
+        {
+            Ok(true) => {
+                warnings.push(tag_warning(name, version, &entry.uuid, dry_run));
+                if !dry_run && migrated.artifact.file_inventory.is_some() {
+                    migrated.artifact.file_inventory =
+                        super::verify::compute_dir_inventory(&copy_dir).await.ok();
+                }
+            }
+            Ok(false) => {}
+            Err(e) => warnings.push(VendorWarning::new(
+                "cargo_version_untagged",
+                format!(
+                    "the vendored copy of {name}@{version} could not be tagged with its patch \
+                     uuid ({e}); re-run `socket-patch vendor`"
+                ),
+            )),
+        }
+    }
+    if warnings.is_empty() {
         return Ok(None);
     }
+    Ok(Some((migrated, warnings)))
+}
+
+/// [`migrate_legacy_wiring`]'s manifest step: write this entry's `[patch]`
+/// into the root manifest (retiring the legacy config entry unless the
+/// wiring was lost) and point `migrated`'s `cargo_patch_entry` record at it.
+#[allow(clippy::too_many_arguments)]
+async fn move_wiring_into_manifest(
+    entry: &VendorEntry,
+    project_root: &Path,
+    name: &str,
+    version: &str,
+    copy_rel: &str,
+    unwired_here: bool,
+    dry_run: bool,
+    migrated: &mut VendorEntry,
+) -> Result<VendorWarning, String> {
     if is_symlink(&project_root.join(cargo_manifest::CARGO_TOML)).await {
         return Err("Cargo.toml is a symbolic link; the legacy wiring was left in place".into());
     }
@@ -1308,7 +1622,7 @@ pub async fn migrate_legacy_wiring(
         name,
         version,
         &entry.uuid,
-        &copy_rel,
+        copy_rel,
         &reserved,
         dry_run,
     )
@@ -1340,16 +1654,16 @@ pub async fn migrate_legacy_wiring(
         }
         warning
     };
-    let mut migrated = entry.clone();
     migrated.wiring.retain(|w| w.kind != "cargo_patch_entry");
     migrated
         .wiring
-        .insert(0, manifest_wiring_record(&ensured, &copy_rel));
-    Ok(Some((migrated, warning)))
+        .insert(0, manifest_wiring_record(&ensured, copy_rel));
+    Ok(warning)
 }
 
 /// Revert one vendored cargo crate: restore the lock entry's original
-/// `source`/`checksum`, drop the `[patch.crates-io]` wiring (root manifest
+/// `source`/`checksum` and untagged version (byte-identical to the
+/// pre-vendor lock), drop the `[patch.crates-io]` wiring (root manifest
 /// and any legacy project-config entry), and remove the uuid dir.
 pub async fn revert_cargo_vendor(
     entry: &VendorEntry,
@@ -1422,13 +1736,23 @@ pub async fn revert_cargo_vendor_opts(
     }
 
     if let Some(lock) = &entry.lock {
-        match cargo_lock::restore_lock_entry(project_root, name, version, lock, dry_run).await {
+        match cargo_lock::restore_lock_entry(
+            project_root,
+            name,
+            version,
+            &entry.uuid,
+            lock,
+            dry_run,
+        )
+        .await
+        {
             Ok(true) => {}
             Ok(false) => out.warnings.push(VendorWarning::new(
                 "lock_restore_skipped",
                 format!(
-                    "the Cargo.lock entry for {name}@{version} is no longer in the \
-                     detached form (re-resolved or removed); left as-is"
+                    "the Cargo.lock entry for {name}@{version} is no longer in this \
+                     patch's detached form (re-resolved, removed, or tagged for another \
+                     patch); left as-is"
                 ),
             )),
             Err(LockEditError::NoLockfile) => out.warnings.push(VendorWarning::new(
@@ -1708,13 +2032,24 @@ mod tests {
         );
         assert!(!root.join(".cargo").exists(), "no .cargo/ is created");
 
-        // The lock entry is detached (source+checksum gone), rest preserved.
+        // The lock entry is detached (source+checksum gone) and carries the
+        // copy's tagged version; the rest is preserved.
         let lock = tokio::fs::read_to_string(root.join("Cargo.lock"))
             .await
             .unwrap();
         assert!(!lock.contains("source ="));
         assert!(!lock.contains("checksum ="));
-        assert!(lock.contains("name = \"cfg-if\"\nversion = \"1.0.4\"\n"));
+        assert!(lock.contains(&format!(
+            "name = \"cfg-if\"\nversion = \"1.0.4+socket.{UUID}\"\n"
+        )));
+        assert!(lock.contains("dependencies = [\n \"cfg-if\",\n]"));
+        // So does the copy's own manifest (the only byte the tag adds).
+        assert_eq!(
+            tokio::fs::read_to_string(root.join(copy_rel()).join("Cargo.toml"))
+                .await
+                .unwrap(),
+            format!("[package]\nname = \"cfg-if\"\nversion = \"1.0.4+socket.{UUID}\"\n")
+        );
 
         // Marker sits in the uuid dir, carrying the vuln + uuid + base purl.
         let marker = tokio::fs::read_to_string(
@@ -2594,10 +2929,12 @@ mod tests {
             PATCHED
         );
         assert!(root.join(copy_rel()).exists());
-        // The already-detached lock is untouched.
+        // The already-detached lock is only retagged for the new uuid.
         assert_eq!(
-            tokio::fs::read(root.join("Cargo.lock")).await.unwrap(),
-            lock_detached
+            String::from_utf8(tokio::fs::read(root.join("Cargo.lock")).await.unwrap()).unwrap(),
+            String::from_utf8(lock_detached)
+                .unwrap()
+                .replace(UUID, UUID2)
         );
         // A fresh entry is emitted for the ledger. This run edited no lock,
         // so it records no originals — the true pre-vendor source/checksum
@@ -3967,11 +4304,11 @@ mod tests {
             manifest_path(root).await.is_none(),
             "dry run writes nothing"
         );
-        let (migrated, warning) = migrate_legacy_wiring(&entry, root, false)
+        let (migrated, warnings) = migrate_legacy_wiring(&entry, root, false)
             .await
             .unwrap()
             .unwrap();
-        assert_eq!(warning.code, "cargo_wiring_migrated");
+        assert_eq!(warnings[0].code, "cargo_wiring_migrated");
         assert_eq!(migrated.wiring.len(), 2);
         assert_eq!(migrated.wiring[0].file, "Cargo.toml");
         assert_eq!(migrated.wiring[1].file, "Cargo.lock");
@@ -3999,6 +4336,12 @@ mod tests {
         crate::patch::copy_tree::fresh_copy(&pristine, &pristine2, None)
             .await
             .unwrap();
+        tokio::fs::write(
+            pristine2.join("Cargo.toml"),
+            "[package]\nname = \"cfg-if\"\nversion = \"0.1.10\"\n",
+        )
+        .await
+        .unwrap();
         let mut record2 = record.clone();
         record2.uuid = UUID2.into();
         let purl2 = "pkg:cargo/cfg-if@0.1.10";
@@ -4424,6 +4767,12 @@ mod tests {
         crate::patch::copy_tree::fresh_copy(pristine, &pristine2, None)
             .await
             .unwrap();
+        tokio::fs::write(
+            pristine2.join("Cargo.toml"),
+            "[package]\nname = \"cfg-if\"\nversion = \"0.1.10\"\n",
+        )
+        .await
+        .unwrap();
         let mut record2 = record.clone();
         record2.uuid = UUID2.into();
         (pristine2, record2, "pkg:cargo/cfg-if@0.1.10", lock)
@@ -4755,13 +5104,13 @@ mod tests {
             .await
             .unwrap()
             .expect("the unwired entry is restorable");
-        assert_eq!(dry.code, "cargo_wiring_restored");
+        assert_eq!(dry[0].code, "cargo_wiring_restored");
         assert!(manifest_path(root).await.is_none());
-        let (restored, warning) = migrate_legacy_wiring(&first, root, false)
+        let (restored, warnings) = migrate_legacy_wiring(&first, root, false)
             .await
             .unwrap()
             .unwrap();
-        assert_eq!(warning.code, "cargo_wiring_restored");
+        assert_eq!(warnings[0].code, "cargo_wiring_restored");
         assert_eq!(restored.wiring[0].file, "Cargo.toml");
         assert_eq!(restored.lock, first.lock, "the lock originals are kept");
         assert_eq!(manifest_path(root).await, Some(copy_rel()));
@@ -4893,4 +5242,292 @@ mod tests {
         );
         assert!(root.join(copy_rel()).exists());
     }
+
+    // ── tagged versions ──────────────────────────────────────────────────
+
+    fn tagged(uuid: &str) -> String {
+        format!("1.0.4+socket.{uuid}")
+    }
+
+    async fn lock_text(root: &Path) -> String {
+        tokio::fs::read_to_string(root.join("Cargo.lock"))
+            .await
+            .unwrap()
+    }
+
+    async fn copy_toml(root: &Path) -> String {
+        tokio::fs::read_to_string(root.join(copy_rel()).join("Cargo.toml"))
+            .await
+            .unwrap()
+    }
+
+    /// Strip the tag from a vendored project (the untagged shape an earlier
+    /// v5 build — manifest wiring, untagged copy + lock — left behind).
+    async fn untag_project(root: &Path) {
+        let lock = lock_text(root).await.replace(&tagged(UUID), "1.0.4");
+        tokio::fs::write(root.join("Cargo.lock"), lock)
+            .await
+            .unwrap();
+        cargo_tag::untag_copy_manifest(&root.join(copy_rel())).await;
+    }
+
+    /// An untagged vendored project (copy + lock) is tagged by the next
+    /// re-run — a fresh ledger entry (the caller carries the lock originals
+    /// forward) with the `cargo_version_tagged` advisory — and the run after
+    /// that is in sync. The revert still restores the pre-vendor lock
+    /// byte-identically.
+    #[tokio::test]
+    async fn untagged_vendor_is_tagged_by_a_rerun() {
+        let (dir, blobs, pristine, record) = fixture().await;
+        let root = dir.path();
+        let (_, first, _) =
+            expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
+        let first = first.unwrap();
+        let wired = lock_text(root).await;
+        untag_project(root).await;
+        assert!(!lock_text(root).await.contains("+socket."));
+        assert_eq!(
+            cargo_tag::copy_manifest_tag(&root.join(copy_rel())).await,
+            None
+        );
+
+        let (result, entry, warnings) =
+            expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
+        assert!(result.success, "{:?}", result.error);
+        assert!(
+            warnings.iter().any(|w| w.code == VERSION_TAGGED),
+            "{warnings:?}"
+        );
+        let entry = entry.expect("a (re)tag records a fresh entry");
+        assert_eq!(entry.lock, None, "originals come from the carried entry");
+        assert_eq!(lock_text(root).await, wired, "the lock is tagged again");
+        assert_eq!(
+            cargo_tag::copy_manifest_tag(&root.join(copy_rel()))
+                .await
+                .as_deref(),
+            Some(UUID)
+        );
+
+        let (_, again, warnings) =
+            expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
+        assert!(again.is_none() && warnings.is_empty(), "{warnings:?}");
+
+        let out = revert_cargo_vendor(&first, root, false).await;
+        assert!(out.success && out.warnings.is_empty(), "{out:?}");
+        assert_eq!(lock_text(root).await, lock_body());
+    }
+
+    /// A pre-v5 legacy config wiring over an untagged copy + lock: one
+    /// re-run migrates the wiring AND tags.
+    #[tokio::test]
+    async fn legacy_config_untagged_vendor_is_migrated_and_tagged() {
+        let (dir, blobs, pristine, record) = fixture().await;
+        let root = dir.path();
+        expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
+        untag_project(root).await;
+        cargo_manifest::drop_patch_entries(root, "cfg-if", "1.0.4", false)
+            .await
+            .unwrap();
+        cargo_config::ensure_patch_entry(root, "cfg-if", &copy_rel(), false)
+            .await
+            .unwrap();
+
+        let (result, entry, warnings) =
+            expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
+        assert!(result.success, "{:?}", result.error);
+        let codes: Vec<&str> = warnings.iter().map(|w| w.code).collect();
+        assert!(
+            codes.contains(&"cargo_wiring_migrated") && codes.contains(&VERSION_TAGGED),
+            "{codes:?}"
+        );
+        assert!(entry.is_some());
+        assert_eq!(manifest_path(root).await, Some(copy_rel()));
+        assert!(!root.join(".cargo").exists());
+        assert!(lock_text(root).await.contains(&tagged(UUID)));
+        assert!(copy_toml(root).await.contains(&tagged(UUID)));
+    }
+
+    /// `repair`'s migration step tags an untagged copy + lock (dry run
+    /// writes nothing), and refreshes a recorded file inventory over the
+    /// tagged copy.
+    #[tokio::test]
+    async fn repair_migration_tags_an_untagged_vendor() {
+        let (dir, blobs, pristine, record) = fixture().await;
+        let root = dir.path();
+        let (_, entry, _) =
+            expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
+        let mut entry = entry.unwrap();
+        untag_project(root).await;
+        entry.artifact.file_inventory = Some(
+            crate::vendor::verify::compute_dir_inventory(&root.join(copy_rel()))
+                .await
+                .unwrap(),
+        );
+        let untagged_lock = lock_text(root).await;
+
+        let (_, dry) = migrate_legacy_wiring(&entry, root, true)
+            .await
+            .unwrap()
+            .expect("the untagged vendor needs a tag");
+        assert_eq!(dry[0].code, VERSION_TAGGED);
+        assert!(dry[0].detail.starts_with("would tag"), "{:?}", dry[0]);
+        assert_eq!(
+            lock_text(root).await,
+            untagged_lock,
+            "dry run writes nothing"
+        );
+
+        let (migrated, warnings) = migrate_legacy_wiring(&entry, root, false)
+            .await
+            .unwrap()
+            .unwrap();
+        assert_eq!(warnings.len(), 1);
+        assert_eq!(warnings[0].code, VERSION_TAGGED);
+        assert!(lock_text(root).await.contains(&tagged(UUID)));
+        assert!(copy_toml(root).await.contains(&tagged(UUID)));
+        assert_ne!(
+            migrated.artifact.file_inventory,
+            entry.artifact.file_inventory
+        );
+        assert_eq!(
+            migrated.artifact.file_inventory,
+            Some(
+                crate::vendor::verify::compute_dir_inventory(&root.join(copy_rel()))
+                    .await
+                    .unwrap()
+            )
+        );
+        assert!(migrate_legacy_wiring(&migrated, root, false)
+            .await
+            .unwrap()
+            .is_none());
+    }
+
+    /// A lock whose detached entry is tagged for ANOTHER uuid while the
+    /// wiring points at this copy is retagged by a re-run; GC sees the
+    /// other-tagged lock as not consuming this entry's copy.
+    #[tokio::test]
+    async fn stale_tag_is_retagged_and_gc_sees_it_unconsumed() {
+        let (dir, blobs, pristine, record) = fixture().await;
+        let root = dir.path();
+        let (_, entry, _) =
+            expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
+        let entry = entry.unwrap();
+        assert_eq!(vendored_entry_in_use(&entry, root).await, Some(true));
+        let stale = lock_text(root).await.replace(UUID, UUID2);
+        tokio::fs::write(root.join("Cargo.lock"), &stale)
+            .await
+            .unwrap();
+        assert_eq!(vendored_entry_in_use(&entry, root).await, Some(false));
+
+        let (result, _, warnings) =
+            expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
+        assert!(result.success, "{:?}", result.error);
+        assert!(warnings.iter().any(|w| w.code == VERSION_TAGGED));
+        assert!(lock_text(root).await.contains(&tagged(UUID)));
+        assert_eq!(vendored_entry_in_use(&entry, root).await, Some(true));
+    }
+
+    /// A patch that edits the crate's own `Cargo.toml`: the tag is written
+    /// over the patched manifest, the re-run still sees the copy in sync
+    /// (the tag is dropped before hashing), and the ledger verification
+    /// passes.
+    #[tokio::test]
+    async fn a_patched_cargo_toml_verifies_through_the_tag() {
+        let (dir, blobs, pristine, mut record) = fixture().await;
+        let root = dir.path();
+        let before = b"[package]\nname = \"cfg-if\"\nversion = \"1.0.4\"\n".to_vec();
+        let after = b"[package]\nname = \"cfg-if\"\nversion = \"1.0.4\"\n# patched\n".to_vec();
+        tokio::fs::write(blobs.join(git_sha(&after)), &after)
+            .await
+            .unwrap();
+        record.files.insert(
+            "package/Cargo.toml".to_string(),
+            PatchFileInfo {
+                before_hash: git_sha(&before),
+                after_hash: git_sha(&after),
+            },
+        );
+        let (result, entry, _) =
+            expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
+        assert!(result.success, "{:?}", result.error);
+        let entry = entry.unwrap();
+        assert_eq!(
+            copy_toml(root).await,
+            format!(
+                "[package]\nname = \"cfg-if\"\nversion = \"{}\"\n# patched\n",
+                tagged(UUID)
+            )
+        );
+        let (_, again, warnings) =
+            expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
+        assert!(
+            again.is_none() && warnings.is_empty(),
+            "in sync: {warnings:?}"
+        );
+        crate::vendor::verify::verify_vendored_patch_record(root, &entry, &record)
+            .await
+            .expect("the tagged manifest verifies against its afterHash");
+    }
+
+    /// A lock the tag cannot be written into consistently (a v1 `replace`
+    /// naming the crate) refuses before anything is written.
+    #[tokio::test]
+    async fn untaggable_lock_refuses_before_writing() {
+        let (dir, blobs, pristine, record) = fixture().await;
+        let root = dir.path();
+        let lock = format!(
+            "[[package]]\nname = \"app\"\nversion = \"0.1.0\"\ndependencies = [\n \
+             \"cfg-if 1.0.4 ({SOURCE})\",\n]\nreplace = \"cfg-if 1.0.4 ({SOURCE})\"\n\n\
+             [[package]]\nname = \"cfg-if\"\nversion = \"1.0.4\"\nsource = \"{SOURCE}\"\n\n\
+             [metadata]\n\"checksum cfg-if 1.0.4 ({SOURCE})\" = \"{CHECKSUM}\"\n"
+        );
+        tokio::fs::write(root.join("Cargo.lock"), &lock)
+            .await
+            .unwrap();
+        let manifest = tokio::fs::read(root.join("Cargo.toml")).await.unwrap();
+        expect_refused(
+            run_vendor(PURL, root, &blobs, &pristine, &record, false).await,
+            LOCK_UNTAGGABLE,
+        );
+        assert_eq!(lock_text(root).await, lock);
+        assert_eq!(
+            tokio::fs::read(root.join("Cargo.toml")).await.unwrap(),
+            manifest
+        );
+        assert!(!root.join(".socket/vendor").exists());
+    }
+
+    /// A v1 lock is detached, tagged and restored byte-identically: the
+    /// full-id references follow the tagged version.
+    #[tokio::test]
+    async fn v1_lock_round_trips_through_the_tag() {
+        let (dir, blobs, pristine, record) = fixture().await;
+        let root = dir.path();
+        let lock = format!(
+            "[[package]]\nname = \"app\"\nversion = \"0.1.0\"\ndependencies = [\n \
+             \"cfg-if 1.0.4 ({SOURCE})\",\n]\n\n\
+             [[package]]\nname = \"cfg-if\"\nversion = \"1.0.4\"\nsource = \"{SOURCE}\"\n\n\
+             [metadata]\n\"checksum cfg-if 1.0.4 ({SOURCE})\" = \"{CHECKSUM}\"\n"
+        );
+        tokio::fs::write(root.join("Cargo.lock"), &lock)
+            .await
+            .unwrap();
+        let (result, entry, _) =
+            expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
+        assert!(result.success, "{:?}", result.error);
+        assert_eq!(
+            lock_text(root).await,
+            format!(
+                "[[package]]\nname = \"app\"\nversion = \"0.1.0\"\ndependencies = [\n \
+                 \"cfg-if {t}\",\n]\n\n\
+                 [[package]]\nname = \"cfg-if\"\nversion = \"{t}\"\n\n\
+                 [metadata]\n",
+                t = tagged(UUID)
+            )
+        );
+        let out = revert_cargo_vendor(&entry.unwrap(), root, false).await;
+        assert!(out.success, "{:?}", out.error);
+        assert_eq!(lock_text(root).await, lock);
+    }
 }
diff --git a/crates/socket-patch-core/src/vendor/cargo_lock.rs b/crates/socket-patch-core/src/vendor/cargo_lock.rs
index 17661896..ea834078 100644
--- a/crates/socket-patch-core/src/vendor/cargo_lock.rs
+++ b/crates/socket-patch-core/src/vendor/cargo_lock.rs
@@ -34,6 +34,19 @@
 //! the lock under `--locked` (real cargo 1.93: "cannot update the lock
 //! file … because --locked was passed"). Restore reverses all three.
 //!
+//! Tagged versions (v5): the detached entry's `version` becomes the copy's
+//! TAGGED version `<version>+socket.<uuid>` ([`super::cargo_tag`]) — exactly
+//! what cargo itself locks when it resolves the `[patch]` against the
+//! tagged copy — and every dependency reference that spells the version
+//! (`"<name> <version>"`, v1's `"<name> <version> (<source>)"`) is rewritten
+//! to `"<name> <tagged>"`; plain-name references need nothing. A reference
+//! the rewrite cannot account for (a leftover spelling, a v1 `replace`, an
+//! existing entry at the tagged version) refuses the edit
+//! ([`LockEditError::Inconsistent`]) instead of writing a lock cargo would
+//! reject. [`retag_lock_entry`] moves an already-detached entry to a new
+//! tag (a uuid bump, or an untagged pre-tag vendor), and
+//! [`restore_lock_entry`] drops the tag with the rest of the detach.
+//!
 //! The removed `source`/`checksum` pair is not recoverable offline (the
 //! checksum is the sha256 of the registry `.crate` tarball, not of the
 //! extracted tree), so [`detach_lock_entry`] returns it as the vendor ledger's
@@ -44,6 +57,7 @@ use std::path::Path;
 
 use toml_edit::{DocumentMut, Item, Table};
 
+use super::cargo_tag;
 use super::state::CargoLockOriginal;
 use crate::utils::fs::{atomic_write_bytes_preserving_mode, read_regular_to_string};
 
@@ -58,6 +72,9 @@ pub enum LockEditError {
     /// The entry has no `source` (a workspace/path/git dependency) — there is
     /// nothing registry-shaped to detach; callers refuse upstream.
     NotRegistry,
+    /// The version cannot be (re)tagged consistently: a dependency
+    /// reference or entry the rewrite cannot keep in step with it.
+    Inconsistent(String),
     Io(String),
     Parse(String),
 }
@@ -71,6 +88,7 @@ impl std::fmt::Display for LockEditError {
                 f,
                 "the Cargo.lock entry is not a registry dependency (no `source`)"
             ),
+            Self::Inconsistent(e) => write!(f, "Cargo.lock cannot be retagged consistently: {e}"),
             Self::Io(e) => write!(f, "Cargo.lock I/O error: {e}"),
             Self::Parse(e) => write!(f, "Cargo.lock parse error: {e}"),
         }
@@ -96,8 +114,10 @@ pub(crate) async fn read_lock(
     Ok((path, doc))
 }
 
-/// Find the `[[package]]` table matching `name`+`version`.
-fn find_package_mut<'a>(
+/// The `[[package]]` table for `name` whose version DENOTES `version` —
+/// the version itself or a Socket-tagged spelling of it (multi-entry
+/// name+version shapes are refused upstream by [`count_lock_entries`]).
+fn find_denoting_mut<'a>(
     doc: &'a mut DocumentMut,
     name: &str,
     version: &str,
@@ -107,10 +127,21 @@ fn find_package_mut<'a>(
         .iter_mut()
         .find(|t| {
             t.get("name").and_then(Item::as_str) == Some(name)
-                && t.get("version").and_then(Item::as_str) == Some(version)
+                && t.get("version")
+                    .and_then(Item::as_str)
+                    .is_some_and(|v| cargo_tag::denotes(v, version))
         })
 }
 
+/// Replace the entry's `version` value, keeping its formatting.
+fn set_version(table: &mut Table, version: &str) {
+    if let Some(value) = table.get_mut("version").and_then(Item::as_value_mut) {
+        let decor = value.decor().clone();
+        *value = toml_edit::Value::from(version);
+        *value.decor_mut() = decor;
+    }
+}
+
 /// The `[metadata]` key a v1 lock files `name`+`version`'s checksum under.
 fn metadata_checksum_key(name: &str, version: &str, source: &str) -> String {
     format!("checksum {name} {version} ({source})")
@@ -187,9 +218,12 @@ pub(crate) fn unused_patches(doc: &DocumentMut) -> Vec<(String, String)> {
         .unwrap_or_default()
 }
 
-/// Whether the lock BUILDS a `[patch]` path copy of `name`@`version`: it
-/// holds a SOURCELESS `[[package]]` for that name + version (the detached
-/// shape) and no `[[patch.unused]]` entry for it. A sourceless entry alone
+/// Whether the lock BUILDS the `[patch]` path copy of `name`@`version`
+/// vendored for patch `uuid`: it holds a SOURCELESS `[[package]]` for that
+/// name at the copy's tagged version `<version>+socket.<uuid>` — or, for a
+/// copy vendored before tagged versions, at the untagged version — and no
+/// `[[patch.unused]]` entry for it. A sourceless entry tagged for ANOTHER
+/// uuid is another copy's resolution: not this one. A sourceless entry alone
 /// does not prove the copy builds — a path dependency on the user's own
 /// checkout of the crate is sourceless too, and cargo records the `[patch]`
 /// it resolved but left out of the graph as `[[patch.unused]]` (real cargo
@@ -200,10 +234,28 @@ pub(crate) fn vendored_copy_consumed(
     unused: &[(String, String)],
     name: &str,
     version: &str,
+    uuid: &str,
 ) -> bool {
+    pkgs.iter().any(|p| {
+        p.name == name
+            && p.source.is_none()
+            && (p.version == version || cargo_tag::split_tag(&p.version) == Some((version, uuid)))
+    }) && !unused
+        .iter()
+        .any(|(n, v)| n == name && cargo_tag::denotes(v, version))
+}
+
+/// The uuid of the Socket tag on the SOURCELESS `[[package]]` for `name`
+/// that denotes `version`: `Some(None)` for an untagged sourceless entry,
+/// `None` when there is no sourceless entry for it.
+pub(crate) fn detached_tag<'a>(
+    pkgs: &'a [LockedPackage],
+    name: &str,
+    version: &str,
+) -> Option<Option<&'a str>> {
     pkgs.iter()
-        .any(|p| p.name == name && p.version == version && p.source.is_none())
-        && !unused.iter().any(|(n, v)| n == name && v == version)
+        .find(|p| p.name == name && p.source.is_none() && cargo_tag::denotes(&p.version, version))
+        .map(|p| cargo_tag::tag_uuid(&p.version))
 }
 
 /// A v1 lock: no top-level `version` key and a `[metadata]` table (kept,
@@ -213,27 +265,121 @@ fn is_v1_lock(doc: &DocumentMut) -> bool {
     doc.get("version").is_none() && doc.get("metadata").is_some_and(Item::is_table_like)
 }
 
-/// Rewrite every `dependencies` entry spelled exactly `from` to `to`,
-/// keeping each entry's formatting.
-fn rewrite_dependency_refs(doc: &mut DocumentMut, from: &str, to: &str) {
-    let Some(pkgs) = doc
-        .get_mut("package")
-        .and_then(Item::as_array_of_tables_mut)
-    else {
-        return;
+/// Every table that carries a `dependencies` array: each `[[package]]`,
+/// plus the `[root]` table of the oldest v1 locks.
+fn dependency_tables_mut(doc: &mut DocumentMut) -> Vec<&mut Table> {
+    let mut out: Vec<&mut Table> = Vec::new();
+    let (root, pkgs) = {
+        let table = doc.as_table_mut();
+        let mut root = None;
+        let mut pkgs = None;
+        for (key, item) in table.iter_mut() {
+            match key.get() {
+                "root" => root = item.as_table_mut(),
+                "package" => pkgs = item.as_array_of_tables_mut(),
+                _ => {}
+            }
+        }
+        (root, pkgs)
     };
-    for pkg in pkgs.iter_mut() {
-        let Some(deps) = pkg.get_mut("dependencies").and_then(Item::as_array_mut) else {
+    out.extend(root);
+    if let Some(pkgs) = pkgs {
+        out.extend(pkgs.iter_mut());
+    }
+    out
+}
+
+/// `(name, version, source)` of a dependency reference string
+/// (`"name"`, `"name version"`, `"name version (source)"`).
+fn parse_ref(spelled: &str) -> (&str, Option<&str>, Option<&str>) {
+    let mut parts = spelled.splitn(3, ' ');
+    let name = parts.next().unwrap_or_default();
+    let version = parts.next();
+    let source = parts
+        .next()
+        .and_then(|s| s.strip_prefix('('))
+        .and_then(|s| s.strip_suffix(')'));
+    (name, version, source)
+}
+
+/// Rewrite every dependency reference to `name` at exactly `version` —
+/// `"name version"`, or `"name version (source)"` when `source` is given —
+/// to `to`, keeping each entry's formatting.
+fn rewrite_version_refs(
+    doc: &mut DocumentMut,
+    name: &str,
+    version: &str,
+    source: Option<&str>,
+    to: &str,
+) {
+    for table in dependency_tables_mut(doc) {
+        let Some(deps) = table.get_mut("dependencies").and_then(Item::as_array_mut) else {
             continue;
         };
         for i in 0..deps.len() {
-            if deps.get(i).and_then(toml_edit::Value::as_str) == Some(from) {
+            let hit = deps
+                .get(i)
+                .and_then(toml_edit::Value::as_str)
+                .is_some_and(|spelled| {
+                    let (n, v, s) = parse_ref(spelled);
+                    n == name && v == Some(version) && (s.is_none() || s == source)
+                });
+            if hit {
                 deps.replace(i, to);
             }
         }
     }
 }
 
+/// Fail when anything in the lock still names `name` at exactly
+/// `version` after the rewrite — a reference in a spelling the rewrite
+/// does not own (another source), or a v1 `replace` — or when another
+/// entry already sits at the new version `to`: cargo would reject the
+/// edited lock under `--locked`.
+fn ensure_consistent(
+    doc: &DocumentMut,
+    name: &str,
+    version: &str,
+    to: &str,
+) -> Result<(), LockEditError> {
+    let names = |spelled: &str| {
+        let (n, v, _) = parse_ref(spelled);
+        n == name && v == Some(version)
+    };
+    let tables = doc.get("root").and_then(Item::as_table).into_iter().chain(
+        doc.get("package")
+            .and_then(Item::as_array_of_tables)
+            .into_iter()
+            .flat_map(|pkgs| pkgs.iter()),
+    );
+    let mut at_target = 0;
+    for table in tables {
+        let deps = table
+            .get("dependencies")
+            .and_then(Item::as_array)
+            .into_iter()
+            .flat_map(|a| a.iter())
+            .filter_map(toml_edit::Value::as_str);
+        let replace = table.get("replace").and_then(Item::as_str);
+        if let Some(bad) = deps.chain(replace).find(|s| names(s)) {
+            return Err(LockEditError::Inconsistent(format!(
+                "a reference `{bad}` would be left naming the old version"
+            )));
+        }
+        if table.get("name").and_then(Item::as_str) == Some(name)
+            && table.get("version").and_then(Item::as_str) == Some(to)
+        {
+            at_target += 1;
+        }
+    }
+    if at_target > 1 {
+        return Err(LockEditError::Inconsistent(format!(
+            "another `{name} {to}` entry is already locked"
+        )));
+    }
+    Ok(())
+}
+
 /// Commit the edited lock atomically (stage + fsync + rename). The lock is a
 /// committed file shared with cargo itself; a torn write would corrupt the
 /// whole project's resolution, so never truncate-in-place. Mode-preserving:
@@ -245,21 +391,25 @@ async fn write_lock(path: &Path, doc: &DocumentMut) -> Result<(), LockEditError>
         .map_err(|e| LockEditError::Io(e.to_string()))
 }
 
-/// Detach the `[[package]]` entry for `name`+`version` from the registry:
-/// remove ONLY its `source` and `checksum` keys, returning the verbatim
-/// originals for the vendor ledger. Everything else in the lock — including
-/// the entry's own `name`/`version`/`dependencies` — keeps its exact bytes.
+/// Detach the `[[package]]` entry for `name`+`version` from the registry
+/// and tag it for patch `uuid`: remove its `source` and `checksum` keys,
+/// set its `version` to `<version>+socket.<uuid>` and point every
+/// version-spelled dependency reference at the tagged version, returning
+/// the verbatim originals for the vendor ledger. Everything else in the
+/// lock — including the entry's own `name`/`dependencies` — keeps its exact
+/// bytes.
 ///
-/// `dry_run` performs the full lookup (so refusals are accurate) but writes
-/// nothing.
+/// `dry_run` performs the full lookup and edit (so refusals are accurate)
+/// but writes nothing.
 pub async fn detach_lock_entry(
     project_root: &Path,
     name: &str,
     version: &str,
+    uuid: &str,
     dry_run: bool,
 ) -> Result<CargoLockOriginal, LockEditError> {
     let (path, mut doc) = read_lock(project_root).await?;
-    let table = find_package_mut(&mut doc, name, version).ok_or(LockEditError::EntryMissing)?;
+    let table = find_denoting_mut(&mut doc, name, version).ok_or(LockEditError::EntryMissing)?;
 
     // A workspace/path/git dependency has no `source` — vendoring it would be
     // wrong (the user already controls those bytes); refuse.
@@ -267,13 +417,20 @@ pub async fn detach_lock_entry(
         Some(s) => s.to_string(),
         None => return Err(LockEditError::NotRegistry),
     };
+    if table.get("version").and_then(Item::as_str) != Some(version) {
+        return Err(LockEditError::Inconsistent(format!(
+            "the registry entry for {name} {version} already carries a Socket tag"
+        )));
+    }
     let mut checksum = table
         .get("checksum")
         .and_then(Item::as_str)
         .map(str::to_string);
+    let tagged = cargo_tag::tag_version(version, uuid);
 
     table.remove("source");
     table.remove("checksum");
+    set_version(table, &tagged);
 
     // v1: the checksum lives in `[metadata]`, and dependents name the crate
     // by its full id (any format may spell an ambiguous ref that way).
@@ -283,11 +440,9 @@ pub async fn detach_lock_entry(
             checksum = checksum.or_else(|| sum.as_str().map(str::to_string));
         }
     }
-    rewrite_dependency_refs(
-        &mut doc,
-        &format!("{name} {version} ({source})"),
-        &format!("{name} {version}"),
-    );
+    let to = format!("{name} {tagged}");
+    rewrite_version_refs(&mut doc, name, version, Some(&source), &to);
+    ensure_consistent(&doc, name, version, &tagged)?;
 
     if !dry_run {
         write_lock(&path, &doc).await?;
@@ -295,26 +450,89 @@ pub async fn detach_lock_entry(
     Ok(CargoLockOriginal { source, checksum })
 }
 
+/// Move the already-detached (sourceless) entry for `name`+`version` to the
+/// tag of patch `uuid` — a uuid bump, or an entry an earlier release
+/// detached without a tag — with its version-spelled references.
+/// `Ok(Some(previous version))` when it changed, `Ok(None)` when it
+/// already carries this tag; [`retag_lock_entry_to`] with the returned
+/// version undoes it.
+pub async fn retag_lock_entry(
+    project_root: &Path,
+    name: &str,
+    version: &str,
+    uuid: &str,
+    dry_run: bool,
+) -> Result<Option<String>, LockEditError> {
+    let tagged = cargo_tag::tag_version(version, uuid);
+    retag_lock_entry_to(project_root, name, version, &tagged, dry_run).await
+}
+
+/// [`retag_lock_entry`] to an explicit `target` spelling of `version`
+/// (tagged or not).
+pub async fn retag_lock_entry_to(
+    project_root: &Path,
+    name: &str,
+    version: &str,
+    target: &str,
+    dry_run: bool,
+) -> Result<Option<String>, LockEditError> {
+    let (path, mut doc) = read_lock(project_root).await?;
+    let table = find_denoting_mut(&mut doc, name, version).ok_or(LockEditError::EntryMissing)?;
+    if table.get("source").is_some() {
+        return Err(LockEditError::Inconsistent(format!(
+            "the entry for {name} {version} still carries a registry source"
+        )));
+    }
+    let current = table
+        .get("version")
+        .and_then(Item::as_str)
+        .unwrap_or_default()
+        .to_string();
+    if current == target {
+        return Ok(None);
+    }
+    set_version(table, target);
+    rewrite_version_refs(&mut doc, name, &current, None, &format!("{name} {target}"));
+    ensure_consistent(&doc, name, &current, target)?;
+    if !dry_run {
+        write_lock(&path, &doc).await?;
+    }
+    Ok(Some(current))
+}
+
 /// Re-attach the original `source`/`checksum` to the `name`+`version` entry on
-/// revert. Returns `Ok(false)` when the entry is no longer in the detached
-/// form — it is absent (the dependency was dropped) or already carries a
-/// `source` (cargo/the user re-resolved it) — in which case the lock is left
-/// alone and the caller warns instead of clobbering a newer resolution.
+/// revert and drop its Socket tag (with the references
+/// [`detach_lock_entry`] retargeted). Returns `Ok(false)` when the entry is no
+/// longer in patch `uuid`'s detached form — it is absent (the dependency was
+/// dropped), already carries a `source` (cargo/the user re-resolved it), or
+/// is tagged for ANOTHER patch — in which case the lock is left alone and
+/// the caller warns instead of clobbering a newer resolution. An untagged
+/// sourceless entry (vendored before tagged versions) is restored.
 pub async fn restore_lock_entry(
     project_root: &Path,
     name: &str,
     version: &str,
+    uuid: &str,
     original: &CargoLockOriginal,
     dry_run: bool,
 ) -> Result<bool, LockEditError> {
     let (path, mut doc) = read_lock(project_root).await?;
     let v1 = is_v1_lock(&doc);
-    let Some(table) = find_package_mut(&mut doc, name, version) else {
+    let Some(table) = find_denoting_mut(&mut doc, name, version) else {
         return Ok(false);
     };
     if table.get("source").is_some() {
         return Ok(false);
     }
+    let current = table
+        .get("version")
+        .and_then(Item::as_str)
+        .unwrap_or_default()
+        .to_string();
+    if current != version && cargo_tag::tag_uuid(&current) != Some(uuid) {
+        return Ok(false);
+    }
+    set_version(table, version);
 
     table.insert("source", toml_edit::value(original.source.as_str()));
     if let (Some(checksum), false) = (&original.checksum, v1) {
@@ -334,8 +552,7 @@ pub async fn restore_lock_entry(
     table.sort_values_by(|k1, _, k2, _| rank(k1.get()).cmp(&rank(k2.get())));
 
     if v1 {
-        // Back into `[metadata]` (cargo writes its keys sorted) and the
-        // dependents' references back to the full id.
+        // Back into `[metadata]` (cargo writes its keys sorted).
         if let (Some(checksum), Some(meta)) = (
             &original.checksum,
             doc.get_mut("metadata").and_then(Item::as_table_mut),
@@ -346,11 +563,16 @@ pub async fn restore_lock_entry(
             );
             meta.sort_values();
         }
-        rewrite_dependency_refs(
-            &mut doc,
-            &format!("{name} {version}"),
-            &format!("{name} {version} ({})", original.source),
-        );
+    }
+    // Dependents named the detached entry `"<name> <tagged>"`: back to the
+    // original spelling (v1's full id, v2+'s `"<name> <version>"`).
+    let back = if v1 {
+        format!("{name} {version} ({})", original.source)
+    } else {
+        format!("{name} {version}")
+    };
+    if v1 || current != version {
+        rewrite_version_refs(&mut doc, name, &current, None, &back);
     }
 
     if !dry_run {
@@ -364,13 +586,15 @@ pub async fn restore_lock_entry(
 /// `[[package]]` array — in every such case the caller's version cross-check
 /// is skipped (a malformed lock would itself break a real `cargo build`).
 /// Multi-version aware: a v4 lock may resolve the same name at several
-/// versions. Reads only the project lockfile: no registry, no network.
+/// versions. A Socket-tagged vendored entry counts as its untagged version.
+/// Reads only the project lockfile: no registry, no network.
 pub async fn read_locked_versions(project_root: &Path) -> Option<HashMap<String, HashSet<String>>> {
     let (_path, doc) = read_lock(project_root).await.ok()?;
     doc.get("package")?.as_array_of_tables()?;
     let mut map: HashMap<String, HashSet<String>> = HashMap::new();
     for pkg in locked_packages(&doc) {
-        map.entry(pkg.name).or_default().insert(pkg.version);
+        let version = cargo_tag::strip_tag(&pkg.version).to_string();
+        map.entry(pkg.name).or_default().insert(version);
     }
     Some(map)
 }
@@ -380,35 +604,42 @@ pub async fn read_locked_versions(project_root: &Path) -> Option<HashMap<String,
 /// crate's resolution actually points at right now).
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub enum LockEntryProbe {
-    /// No readable/parseable `Cargo.lock`.
+    /// No `Cargo.lock`.
     NoLockfile,
+    /// A `Cargo.lock` that cannot be read or parsed.
+    Unreadable,
     /// The lock parses but has no entry at this name+version.
     EntryMissing,
     /// Entry present with no `source` — the vendored detached shape (the
-    /// `[patch.crates-io]` path copy is the lock's sole provider).
-    Detached,
+    /// `[patch.crates-io]` path copy is the lock's sole provider) — with the
+    /// uuid of its Socket tag (`None`: untagged, vendored before tagged
+    /// versions).
+    Detached(Option<String>),
     /// Entry present with this registry `source` (crates.io, a hosted
     /// socket-patch sparse index, or any other registry).
     Source(String),
 }
 
-/// Probe the `[[package]]` entry for `name`+`version` without editing
-/// anything. Unreadable/unparseable locks read as [`LockEntryProbe::NoLockfile`]
-/// so callers stay fail-safe (cannot determine ⇒ keep / stay silent).
+/// Probe the `[[package]]` entry for `name`+`version` (or a Socket-tagged
+/// spelling of it) without editing anything. Unreadable/unparseable locks
+/// read as [`LockEntryProbe::Unreadable`] so callers stay fail-safe (cannot
+/// determine ⇒ keep / stay silent).
 pub async fn probe_lock_entry(project_root: &Path, name: &str, version: &str) -> LockEntryProbe {
-    let Ok((_path, doc)) = read_lock(project_root).await else {
-        return LockEntryProbe::NoLockfile;
+    let doc = match read_lock(project_root).await {
+        Ok((_path, doc)) => doc,
+        Err(LockEditError::NoLockfile) => return LockEntryProbe::NoLockfile,
+        Err(_) => return LockEntryProbe::Unreadable,
     };
     match locked_packages(&doc)
         .into_iter()
-        .find(|p| p.name == name && p.version == version)
+        .find(|p| p.name == name && cargo_tag::denotes(&p.version, version))
     {
         None => LockEntryProbe::EntryMissing,
         Some(LockedPackage {
             source: Some(source),
             ..
         }) => LockEntryProbe::Source(source),
-        Some(_) => LockEntryProbe::Detached,
+        Some(p) => LockEntryProbe::Detached(cargo_tag::tag_uuid(&p.version).map(str::to_string)),
     }
 }
 
@@ -425,7 +656,7 @@ pub async fn count_lock_entries(project_root: &Path, name: &str, version: &str)
     };
     locked_packages(&doc)
         .iter()
-        .filter(|p| p.name == name && p.version == version)
+        .filter(|p| p.name == name && cargo_tag::denotes(&p.version, version))
         .count()
 }
 
@@ -435,6 +666,8 @@ mod tests {
 
     const SOURCE: &str = "registry+https://github.com/rust-lang/crates.io-index";
     const CHECKSUM: &str = "9d8f4e3bd2c8f1f5d1a3f5e7c9b1d3f5e7a9b1c3d5f7e9a1b3c5d7e9f1a3b5c7";
+    const UUID: &str = "9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f";
+    const UUID2: &str = "0a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d";
 
     /// A realistic cargo-1.93-shaped v4 lock (header comment, version line,
     /// plain-name dependencies array — spike claim 8).
@@ -486,7 +719,7 @@ mod tests {
         let lock = dir.path().join("Cargo.lock");
         tokio::fs::write(&lock, &v1).await.unwrap();
 
-        let orig = detach_lock_entry(dir.path(), "cfg-if", "1.0.4", false)
+        let orig = detach_lock_entry(dir.path(), "cfg-if", "1.0.4", UUID, false)
             .await
             .unwrap();
         assert_eq!(orig.source, SOURCE);
@@ -500,20 +733,20 @@ mod tests {
             detached,
             format!(
                 "[[package]]\nname = \"app\"\nversion = \"0.1.0\"\ndependencies = [\n \
-                 \"cfg-if 1.0.4\",\n \"log 0.4.20 ({SOURCE})\",\n]\n\n\
-                 [[package]]\nname = \"cfg-if\"\nversion = \"1.0.4\"\n\n\
+                 \"cfg-if 1.0.4+socket.{UUID}\",\n \"log 0.4.20 ({SOURCE})\",\n]\n\n\
+                 [[package]]\nname = \"cfg-if\"\nversion = \"1.0.4+socket.{UUID}\"\n\n\
                  [[package]]\nname = \"log\"\nversion = \"0.4.20\"\nsource = \"{SOURCE}\"\n\
-                 dependencies = [\n \"cfg-if 1.0.4\",\n]\n\n\
+                 dependencies = [\n \"cfg-if 1.0.4+socket.{UUID}\",\n]\n\n\
                  [metadata]\n\"checksum log 0.4.20 ({SOURCE})\" = \"{other}\"\n"
             )
         );
         assert_eq!(
             probe_lock_entry(dir.path(), "cfg-if", "1.0.4").await,
-            LockEntryProbe::Detached
+            LockEntryProbe::Detached(Some(UUID.to_string()))
         );
 
         assert!(
-            restore_lock_entry(dir.path(), "cfg-if", "1.0.4", &orig, false)
+            restore_lock_entry(dir.path(), "cfg-if", "1.0.4", UUID, &orig, false)
                 .await
                 .unwrap()
         );
@@ -523,7 +756,7 @@ mod tests {
     #[tokio::test]
     async fn detach_removes_only_source_and_checksum() {
         let dir = fixture().await;
-        let orig = detach_lock_entry(dir.path(), "cfg-if", "1.0.4", false)
+        let orig = detach_lock_entry(dir.path(), "cfg-if", "1.0.4", UUID, false)
             .await
             .unwrap();
         assert_eq!(orig.source, SOURCE);
@@ -535,12 +768,15 @@ mod tests {
         assert!(!body.contains("source ="), "source line gone");
         assert!(!body.contains("checksum ="), "checksum line gone");
         // Everything else is byte-preserved: header, version line, the app
-        // entry with its dependencies array, and cfg-if's name/version pair.
+        // entry with its plain-name dependencies array, and cfg-if's name;
+        // its version carries the patch uuid tag.
         assert!(body.starts_with("# This file is automatically @generated by Cargo.\n"));
         assert!(body.contains("version = 4\n"));
         assert!(body
             .contains("name = \"app\"\nversion = \"0.1.0\"\ndependencies = [\n \"cfg-if\",\n]\n"));
-        assert!(body.contains("[[package]]\nname = \"cfg-if\"\nversion = \"1.0.4\"\n"));
+        assert!(body.contains(&format!(
+            "[[package]]\nname = \"cfg-if\"\nversion = \"1.0.4+socket.{UUID}\"\n"
+        )));
     }
 
     #[tokio::test]
@@ -550,11 +786,11 @@ mod tests {
             .await
             .unwrap();
 
-        let orig = detach_lock_entry(dir.path(), "cfg-if", "1.0.4", false)
+        let orig = detach_lock_entry(dir.path(), "cfg-if", "1.0.4", UUID, false)
             .await
             .unwrap();
         assert!(
-            restore_lock_entry(dir.path(), "cfg-if", "1.0.4", &orig, false)
+            restore_lock_entry(dir.path(), "cfg-if", "1.0.4", UUID, &orig, false)
                 .await
                 .unwrap()
         );
@@ -572,7 +808,7 @@ mod tests {
     #[tokio::test]
     async fn detach_missing_lock_is_no_lockfile() {
         let dir = tempfile::tempdir().unwrap();
-        let err = detach_lock_entry(dir.path(), "cfg-if", "1.0.4", false)
+        let err = detach_lock_entry(dir.path(), "cfg-if", "1.0.4", UUID, false)
             .await
             .unwrap_err();
         assert_eq!(err, LockEditError::NoLockfile);
@@ -581,12 +817,12 @@ mod tests {
     #[tokio::test]
     async fn detach_missing_entry_and_wrong_version() {
         let dir = fixture().await;
-        let err = detach_lock_entry(dir.path(), "nope", "1.0.4", false)
+        let err = detach_lock_entry(dir.path(), "nope", "1.0.4", UUID, false)
             .await
             .unwrap_err();
         assert_eq!(err, LockEditError::EntryMissing);
         // Version is part of the key — a different version must not match.
-        let err = detach_lock_entry(dir.path(), "cfg-if", "9.9.9", false)
+        let err = detach_lock_entry(dir.path(), "cfg-if", "9.9.9", UUID, false)
             .await
             .unwrap_err();
         assert_eq!(err, LockEditError::EntryMissing);
@@ -603,7 +839,7 @@ mod tests {
     async fn detach_path_dep_is_not_registry() {
         let dir = fixture().await;
         // `app` is the workspace member: no `source` key.
-        let err = detach_lock_entry(dir.path(), "app", "0.1.0", false)
+        let err = detach_lock_entry(dir.path(), "app", "0.1.0", UUID, false)
             .await
             .unwrap_err();
         assert_eq!(err, LockEditError::NotRegistry);
@@ -612,7 +848,7 @@ mod tests {
     #[tokio::test]
     async fn detach_dry_run_reports_but_does_not_write() {
         let dir = fixture().await;
-        let orig = detach_lock_entry(dir.path(), "cfg-if", "1.0.4", true)
+        let orig = detach_lock_entry(dir.path(), "cfg-if", "1.0.4", UUID, true)
             .await
             .unwrap();
         assert_eq!(orig.source, SOURCE);
@@ -631,7 +867,7 @@ mod tests {
         tokio::fs::write(dir.path().join("Cargo.lock"), "not = = toml [[[")
             .await
             .unwrap();
-        let err = detach_lock_entry(dir.path(), "cfg-if", "1.0.4", false)
+        let err = detach_lock_entry(dir.path(), "cfg-if", "1.0.4", UUID, false)
             .await
             .unwrap_err();
         assert!(matches!(err, LockEditError::Parse(_)));
@@ -645,7 +881,7 @@ mod tests {
     #[tokio::test]
     async fn restore_tolerates_patch_unused_table_gained_post_vendor() {
         let dir = fixture().await;
-        let orig = detach_lock_entry(dir.path(), "cfg-if", "1.0.4", false)
+        let orig = detach_lock_entry(dir.path(), "cfg-if", "1.0.4", UUID, false)
             .await
             .unwrap();
 
@@ -658,7 +894,7 @@ mod tests {
             .await
             .unwrap();
 
-        let restored = restore_lock_entry(dir.path(), "cfg-if", "1.0.4", &orig, false)
+        let restored = restore_lock_entry(dir.path(), "cfg-if", "1.0.4", UUID, &orig, false)
             .await
             .unwrap();
         assert!(
@@ -687,13 +923,13 @@ mod tests {
         // The entry still has its registry source (the user/cargo re-resolved
         // it after a hand-revert) — restoring would clobber it: Ok(false).
         assert!(
-            !restore_lock_entry(dir.path(), "cfg-if", "1.0.4", &orig, false)
+            !restore_lock_entry(dir.path(), "cfg-if", "1.0.4", UUID, &orig, false)
                 .await
                 .unwrap()
         );
         // The entry is gone entirely (the dependency was dropped): Ok(false).
         assert!(
-            !restore_lock_entry(dir.path(), "gone", "1.0.0", &orig, false)
+            !restore_lock_entry(dir.path(), "gone", "1.0.0", UUID, &orig, false)
                 .await
                 .unwrap()
         );
@@ -709,14 +945,14 @@ mod tests {
     #[tokio::test]
     async fn restore_dry_run_does_not_write() {
         let dir = fixture().await;
-        let orig = detach_lock_entry(dir.path(), "cfg-if", "1.0.4", false)
+        let orig = detach_lock_entry(dir.path(), "cfg-if", "1.0.4", UUID, false)
             .await
             .unwrap();
         let detached = tokio::fs::read_to_string(dir.path().join("Cargo.lock"))
             .await
             .unwrap();
         assert!(
-            restore_lock_entry(dir.path(), "cfg-if", "1.0.4", &orig, true)
+            restore_lock_entry(dir.path(), "cfg-if", "1.0.4", UUID, &orig, true)
                 .await
                 .unwrap()
         );
@@ -739,13 +975,15 @@ mod tests {
         )
         .await
         .unwrap();
-        let orig = detach_lock_entry(dir.path(), "x", "1.0.0", false)
+        let orig = detach_lock_entry(dir.path(), "x", "1.0.0", UUID, false)
             .await
             .unwrap();
         assert_eq!(orig.checksum, None);
-        assert!(restore_lock_entry(dir.path(), "x", "1.0.0", &orig, false)
-            .await
-            .unwrap());
+        assert!(
+            restore_lock_entry(dir.path(), "x", "1.0.0", UUID, &orig, false)
+                .await
+                .unwrap()
+        );
         let body = tokio::fs::read_to_string(dir.path().join("Cargo.lock"))
             .await
             .unwrap();
@@ -791,7 +1029,7 @@ mod tests {
             .await
             .unwrap();
 
-        let orig = detach_lock_entry(dir.path(), "cfg-if", "1.0.4", false)
+        let orig = detach_lock_entry(dir.path(), "cfg-if", "1.0.4", UUID, false)
             .await
             .unwrap();
         let mode = tokio::fs::metadata(&path)
@@ -803,7 +1041,7 @@ mod tests {
         assert_eq!(mode, 0o600, "detach must not reset the lock's mode");
 
         assert!(
-            restore_lock_entry(dir.path(), "cfg-if", "1.0.4", &orig, false)
+            restore_lock_entry(dir.path(), "cfg-if", "1.0.4", UUID, &orig, false)
                 .await
                 .unwrap()
         );
@@ -849,11 +1087,11 @@ mod tests {
             .await
             .unwrap();
 
-        let orig = detach_lock_entry(dir.path(), "serde", "1.0.219", false)
+        let orig = detach_lock_entry(dir.path(), "serde", "1.0.219", UUID, false)
             .await
             .unwrap();
         assert!(
-            restore_lock_entry(dir.path(), "serde", "1.0.219", &orig, false)
+            restore_lock_entry(dir.path(), "serde", "1.0.219", UUID, &orig, false)
                 .await
                 .unwrap()
         );
@@ -926,7 +1164,7 @@ mod tests {
     /// `open(2)` that waits for a writer that never comes. Same
     /// `open_regular_file` guard class as the Cargo.toml and
     /// .cargo/config.toml twins in this module's siblings. Probes stay
-    /// fail-safe (`NoLockfile` / `None` / zero); edits refuse loudly with
+    /// fail-safe (`Unreadable` / `None` / zero); edits refuse loudly with
     /// `Io`.
     #[cfg(unix)]
     #[tokio::test]
@@ -948,8 +1186,8 @@ mod tests {
                 probe_lock_entry(dir.path(), "cfg-if", "1.0.4").await,
                 read_locked_versions(dir.path()).await,
                 count_lock_entries(dir.path(), "cfg-if", "1.0.4").await,
-                detach_lock_entry(dir.path(), "cfg-if", "1.0.4", false).await,
-                restore_lock_entry(dir.path(), "cfg-if", "1.0.4", &orig, false).await,
+                detach_lock_entry(dir.path(), "cfg-if", "1.0.4", UUID, false).await,
+                restore_lock_entry(dir.path(), "cfg-if", "1.0.4", UUID, &orig, false).await,
             )
         };
         let Ok((probe, versions, count, detach, restore)) =
@@ -962,7 +1200,7 @@ mod tests {
                 .open(&path);
             panic!("lock reads must fail fast on a FIFO Cargo.lock");
         };
-        assert_eq!(probe, LockEntryProbe::NoLockfile);
+        assert_eq!(probe, LockEntryProbe::Unreadable);
         assert!(versions.is_none());
         assert_eq!(count, 0);
         assert!(matches!(detach, Err(LockEditError::Io(_))), "{detach:?}");
@@ -972,7 +1210,7 @@ mod tests {
     #[tokio::test]
     async fn edits_leave_no_stage_litter() {
         let dir = fixture().await;
-        detach_lock_entry(dir.path(), "cfg-if", "1.0.4", false)
+        detach_lock_entry(dir.path(), "cfg-if", "1.0.4", UUID, false)
             .await
             .unwrap();
         for e in std::fs::read_dir(dir.path()).unwrap() {
@@ -980,4 +1218,306 @@ mod tests {
             assert!(!name.contains("socket-stage"), "stage litter: {name}");
         }
     }
+
+    // ── tagged versions ──────────────────────────────────────────────────
+
+    async fn lock_dir(body: &str) -> tempfile::TempDir {
+        let dir = tempfile::tempdir().unwrap();
+        tokio::fs::write(dir.path().join("Cargo.lock"), body)
+            .await
+            .unwrap();
+        dir
+    }
+
+    async fn read(dir: &tempfile::TempDir) -> String {
+        tokio::fs::read_to_string(dir.path().join("Cargo.lock"))
+            .await
+            .unwrap()
+    }
+
+    /// Two locked versions of one crate: v2+ dependents spell the version
+    /// (`"cfg-if 1.0.4"`), which the detach must retarget at the tagged
+    /// version and the restore must put back — the other version's
+    /// references stay untouched.
+    #[tokio::test]
+    async fn detach_retargets_version_spelled_refs_and_restore_reverses() {
+        let body = format!(
+            "# This file is automatically @generated by Cargo.\n\
+             # It is not intended for manual editing.\n\
+             version = 3\n\n\
+             [[package]]\nname = \"app\"\nversion = \"0.1.0\"\n\
+             dependencies = [\n \"cfg-if 0.1.10\",\n \"cfg-if 1.0.4\",\n]\n\n\
+             [[package]]\nname = \"cfg-if\"\nversion = \"0.1.10\"\nsource = \"{SOURCE}\"\nchecksum = \"{}\"\n\n\
+             [[package]]\nname = \"cfg-if\"\nversion = \"1.0.4\"\nsource = \"{SOURCE}\"\nchecksum = \"{CHECKSUM}\"\n",
+            "e".repeat(64)
+        );
+        let dir = lock_dir(&body).await;
+        let orig = detach_lock_entry(dir.path(), "cfg-if", "1.0.4", UUID, false)
+            .await
+            .unwrap();
+        let tagged = format!("1.0.4+socket.{UUID}");
+        assert_eq!(
+            read(&dir).await,
+            body.replace(" \"cfg-if 1.0.4\",", &format!(" \"cfg-if {tagged}\","))
+                .replace(
+                    &format!(
+                        "version = \"1.0.4\"\nsource = \"{SOURCE}\"\nchecksum = \"{CHECKSUM}\"\n"
+                    ),
+                    &format!("version = \"{tagged}\"\n"),
+                )
+        );
+        assert_eq!(
+            probe_lock_entry(dir.path(), "cfg-if", "1.0.4").await,
+            LockEntryProbe::Detached(Some(UUID.to_string()))
+        );
+        assert_eq!(count_lock_entries(dir.path(), "cfg-if", "1.0.4").await, 1);
+        let versions = read_locked_versions(dir.path()).await.unwrap();
+        assert!(
+            versions["cfg-if"].contains("1.0.4"),
+            "tag stripped: {versions:?}"
+        );
+        assert!(
+            restore_lock_entry(dir.path(), "cfg-if", "1.0.4", UUID, &orig, false)
+                .await
+                .unwrap()
+        );
+        assert_eq!(read(&dir).await, body, "restore is byte-identical");
+    }
+
+    /// A version with its own build metadata (`zstd-sys 2.0.1+zstd.1.5.2`
+    /// style) keeps it and appends the tag.
+    #[tokio::test]
+    async fn detach_tags_a_version_that_already_has_build_metadata() {
+        let body = format!(
+            "version = 4\n\n\
+             [[package]]\nname = \"app\"\nversion = \"0.1.0\"\ndependencies = [\n \"zstd-sys\",\n]\n\n\
+             [[package]]\nname = \"zstd-sys\"\nversion = \"2.0.1+zstd.1.5.2\"\nsource = \"{SOURCE}\"\nchecksum = \"{CHECKSUM}\"\n"
+        );
+        let dir = lock_dir(&body).await;
+        let orig = detach_lock_entry(dir.path(), "zstd-sys", "2.0.1+zstd.1.5.2", UUID, false)
+            .await
+            .unwrap();
+        assert!(read(&dir)
+            .await
+            .contains(&format!("version = \"2.0.1+zstd.1.5.2.socket.{UUID}\"\n")));
+        assert!(restore_lock_entry(
+            dir.path(),
+            "zstd-sys",
+            "2.0.1+zstd.1.5.2",
+            UUID,
+            &orig,
+            false
+        )
+        .await
+        .unwrap());
+        assert_eq!(read(&dir).await, body);
+    }
+
+    /// A uuid bump (or an untagged pre-tag vendor) moves the detached entry
+    /// and its version-spelled references to the new tag; the returned
+    /// previous version undoes it, and a re-run is a no-op.
+    #[tokio::test]
+    async fn retag_moves_a_detached_entry_and_undoes() {
+        let untagged = "version = 3\n\n\
+             [[package]]\nname = \"app\"\nversion = \"0.1.0\"\n\
+             dependencies = [\n \"cfg-if 0.1.10\",\n \"cfg-if 1.0.4\",\n]\n\n\
+             [[package]]\nname = \"cfg-if\"\nversion = \"0.1.10\"\n\n\
+             [[package]]\nname = \"cfg-if\"\nversion = \"1.0.4\"\n";
+        let dir = lock_dir(untagged).await;
+        assert_eq!(
+            probe_lock_entry(dir.path(), "cfg-if", "1.0.4").await,
+            LockEntryProbe::Detached(None)
+        );
+        let prev = retag_lock_entry(dir.path(), "cfg-if", "1.0.4", UUID, false)
+            .await
+            .unwrap();
+        assert_eq!(prev.as_deref(), Some("1.0.4"));
+        let t1 = format!("1.0.4+socket.{UUID}");
+        assert_eq!(read(&dir).await, untagged.replace("1.0.4", &t1));
+        assert_eq!(
+            retag_lock_entry(dir.path(), "cfg-if", "1.0.4", UUID, false)
+                .await
+                .unwrap(),
+            None,
+            "already tagged"
+        );
+        let prev = retag_lock_entry(dir.path(), "cfg-if", "1.0.4", UUID2, false)
+            .await
+            .unwrap();
+        assert_eq!(prev.as_deref(), Some(t1.as_str()));
+        assert_eq!(
+            read(&dir).await,
+            untagged.replace("1.0.4", &format!("1.0.4+socket.{UUID2}"))
+        );
+        retag_lock_entry_to(dir.path(), "cfg-if", "1.0.4", "1.0.4", false)
+            .await
+            .unwrap();
+        assert_eq!(read(&dir).await, untagged, "undo restores the bytes");
+        // A registry entry is not retaggable (it needs the detach).
+        let reg = fixture().await;
+        assert!(matches!(
+            retag_lock_entry(reg.path(), "cfg-if", "1.0.4", UUID, true).await,
+            Err(LockEditError::Inconsistent(_))
+        ));
+        assert_eq!(
+            retag_lock_entry(reg.path(), "nope", "1.0.4", UUID, true).await,
+            Err(LockEditError::EntryMissing)
+        );
+    }
+
+    /// Restore owns only its own generation: an untagged detached entry
+    /// (vendored before tagged versions) restores, an entry tagged for
+    /// another uuid is left alone.
+    #[tokio::test]
+    async fn restore_takes_untagged_and_refuses_another_uuids_tag() {
+        let orig = CargoLockOriginal {
+            source: SOURCE.to_string(),
+            checksum: Some(CHECKSUM.to_string()),
+        };
+        let detached_untagged = "version = 4\n\n[[package]]\nname = \"app\"\nversion = \"0.1.0\"\n\
+             dependencies = [\n \"cfg-if\",\n]\n\n[[package]]\nname = \"cfg-if\"\nversion = \"1.0.4\"\n";
+        let dir = lock_dir(detached_untagged).await;
+        assert!(
+            restore_lock_entry(dir.path(), "cfg-if", "1.0.4", UUID, &orig, false)
+                .await
+                .unwrap()
+        );
+        assert_eq!(read(&dir).await, lock_body().replace("# This file is automatically @generated by Cargo.\n# It is not intended for manual editing.\n", ""));
+
+        let other = detached_untagged.replace(
+            "version = \"1.0.4\"",
+            &format!("version = \"1.0.4+socket.{UUID2}\""),
+        );
+        let dir = lock_dir(&other).await;
+        assert!(
+            !restore_lock_entry(dir.path(), "cfg-if", "1.0.4", UUID, &orig, false)
+                .await
+                .unwrap(),
+            "another generation's tag is not ours to restore"
+        );
+        assert_eq!(read(&dir).await, other);
+    }
+
+    /// Shapes the retargeting cannot keep consistent refuse without
+    /// writing: a reference to the version in a spelling the edit does not
+    /// own (another source), a v1 `replace` naming it, and an entry already
+    /// at the tagged version.
+    #[tokio::test]
+    async fn inconsistent_lock_shapes_refuse_the_detach() {
+        let git = "git+https://example.com/fork/cfg-if#abc";
+        let cases = [
+            format!(
+                "[[package]]\nname = \"app\"\nversion = \"0.1.0\"\ndependencies = [\n \
+                 \"cfg-if 1.0.4 ({git})\",\n]\n\n\
+                 [[package]]\nname = \"cfg-if\"\nversion = \"1.0.4\"\nsource = \"{SOURCE}\"\n\n\
+                 [metadata]\n\"checksum cfg-if 1.0.4 ({SOURCE})\" = \"{CHECKSUM}\"\n"
+            ),
+            format!(
+                "[[package]]\nname = \"app\"\nversion = \"0.1.0\"\nreplace = \"cfg-if 1.0.4 ({SOURCE})\"\n\n\
+                 [[package]]\nname = \"cfg-if\"\nversion = \"1.0.4\"\nsource = \"{SOURCE}\"\n\n\
+                 [metadata]\n\"checksum cfg-if 1.0.4 ({SOURCE})\" = \"{CHECKSUM}\"\n"
+            ),
+            format!(
+                "version = 4\n\n\
+                 [[package]]\nname = \"cfg-if\"\nversion = \"1.0.4\"\nsource = \"{SOURCE}\"\nchecksum = \"{CHECKSUM}\"\n\n\
+                 [[package]]\nname = \"cfg-if\"\nversion = \"1.0.4+socket.{UUID}\"\n"
+            ),
+        ];
+        for body in cases {
+            let dir = lock_dir(&body).await;
+            let err = detach_lock_entry(dir.path(), "cfg-if", "1.0.4", UUID, false)
+                .await
+                .unwrap_err();
+            assert!(
+                matches!(err, LockEditError::Inconsistent(_)),
+                "{err:?}\n{body}"
+            );
+            assert_eq!(read(&dir).await, body, "a refused edit writes nothing");
+        }
+    }
+
+    /// The oldest v1 locks list the root package in a `[root]` table whose
+    /// `dependencies` reference the crate by full id too.
+    #[tokio::test]
+    async fn detach_and_restore_follow_a_v1_root_table() {
+        let body = format!(
+            "[root]\nname = \"app\"\nversion = \"0.1.0\"\ndependencies = [\n \
+             \"cfg-if 1.0.4 ({SOURCE})\",\n]\n\n\
+             [[package]]\nname = \"cfg-if\"\nversion = \"1.0.4\"\nsource = \"{SOURCE}\"\n\n\
+             [metadata]\n\"checksum cfg-if 1.0.4 ({SOURCE})\" = \"{CHECKSUM}\"\n"
+        );
+        let dir = lock_dir(&body).await;
+        let orig = detach_lock_entry(dir.path(), "cfg-if", "1.0.4", UUID, false)
+            .await
+            .unwrap();
+        let detached = read(&dir).await;
+        assert!(
+            detached.contains(&format!(" \"cfg-if 1.0.4+socket.{UUID}\",\n")),
+            "{detached}"
+        );
+        assert!(
+            restore_lock_entry(dir.path(), "cfg-if", "1.0.4", UUID, &orig, false)
+                .await
+                .unwrap()
+        );
+        assert_eq!(read(&dir).await, body);
+    }
+
+    #[test]
+    fn copy_consumption_is_tag_aware() {
+        let pkg = |version: &str, source: Option<&str>| LockedPackage {
+            name: "cfg-if".into(),
+            version: version.into(),
+            source: source.map(str::to_string),
+            checksum: None,
+        };
+        let tagged = format!("1.0.4+socket.{UUID}");
+        let other = format!("1.0.4+socket.{UUID2}");
+        let none: Vec<(String, String)> = Vec::new();
+        assert!(vendored_copy_consumed(
+            &[pkg(&tagged, None)],
+            &none,
+            "cfg-if",
+            "1.0.4",
+            UUID
+        ));
+        assert!(!vendored_copy_consumed(
+            &[pkg(&other, None)],
+            &none,
+            "cfg-if",
+            "1.0.4",
+            UUID
+        ));
+        assert!(
+            vendored_copy_consumed(&[pkg("1.0.4", None)], &none, "cfg-if", "1.0.4", UUID),
+            "an untagged pre-tag vendor still counts"
+        );
+        assert!(!vendored_copy_consumed(
+            &[pkg("1.0.4", Some(SOURCE))],
+            &none,
+            "cfg-if",
+            "1.0.4",
+            UUID
+        ));
+        let unused = vec![("cfg-if".to_string(), tagged.clone())];
+        assert!(!vendored_copy_consumed(
+            &[pkg(&tagged, None)],
+            &unused,
+            "cfg-if",
+            "1.0.4",
+            UUID
+        ));
+        assert_eq!(
+            detached_tag(&[pkg(&other, None)], "cfg-if", "1.0.4"),
+            Some(Some(UUID2))
+        );
+        assert_eq!(
+            detached_tag(&[pkg("1.0.4", None)], "cfg-if", "1.0.4"),
+            Some(None)
+        );
+        assert_eq!(
+            detached_tag(&[pkg("1.0.4", Some(SOURCE))], "cfg-if", "1.0.4"),
+            None
+        );
+    }
 }
diff --git a/crates/socket-patch-core/src/vendor/cargo_tag.rs b/crates/socket-patch-core/src/vendor/cargo_tag.rs
new file mode 100644
index 00000000..2f943a1a
--- /dev/null
+++ b/crates/socket-patch-core/src/vendor/cargo_tag.rs
@@ -0,0 +1,413 @@
+//! Tagged vendored cargo versions (`<version>+socket.<uuid>`).
+//!
+//! A vendored copy's own `Cargo.toml` `[package] version` is rewritten to a
+//! TAGGED version carrying the patch uuid as semver build metadata:
+//!
+//! * `1.0.4` → `1.0.4+socket.<uuid>`;
+//! * a version that already has build metadata keeps it and appends the tag
+//!   as two more identifiers (semver allows one `+`):
+//!   `2.0.1+zstd.1.5.2` → `2.0.1+zstd.1.5.2.socket.<uuid>`.
+//!
+//! Cargo ignores build metadata when matching version requirements, so
+//! every dependent's `=1.0.4` / `1` / `^1` still selects the copy, while the
+//! resolver records the tagged version in `Cargo.lock` — the lock alone then
+//! names the patch uuid of the copy cargo actually built (a config-level
+//! `[patch]` pointing somewhere else changes the locked version). The
+//! patched crate sees the tag in `CARGO_PKG_VERSION`.
+//!
+//! The tag is the LAST two build-metadata identifiers, `socket` and a
+//! canonical lowercase uuid; stripping it restores the original version
+//! string exactly (the purl version, the `<name>-<version>` copy directory,
+//! the registry version the lock originally pinned).
+//!
+//! Manifest edits are textual: only the bytes of the `version` string
+//! literal change, so tagging and untagging round-trip byte-identically
+//! (comments, key order, line endings and the quote style survive).
+
+use std::path::Path;
+
+use crate::patch::apply::normalize_file_path;
+use crate::patch::path_safety::is_canonical_uuid;
+use crate::utils::fs::{atomic_write_bytes_preserving_mode, read_regular_to_string};
+
+/// The build-metadata identifier that introduces the uuid.
+pub const TAG_IDENT: &str = "socket";
+
+/// The copy manifest the tag lives in.
+const COPY_MANIFEST: &str = "Cargo.toml";
+
+// ── versions and manifest text ───────────────────────────────────────────
+
+/// `version` tagged with `uuid` (see the module docs). An already-tagged
+/// `version` is re-tagged (its old tag replaced), so the result carries
+/// exactly one Socket tag.
+pub fn tag_version(version: &str, uuid: &str) -> String {
+    let base = strip_tag(version);
+    if base.contains('+') {
+        format!("{base}.{TAG_IDENT}.{uuid}")
+    } else {
+        format!("{base}+{TAG_IDENT}.{uuid}")
+    }
+}
+
+/// `(original version, uuid)` of a tagged version; `None` when `version`
+/// carries no Socket tag (no build metadata, or metadata that does not end
+/// in `socket.<canonical uuid>`).
+pub fn split_tag(version: &str) -> Option<(&str, &str)> {
+    let (core, meta) = version.split_once('+')?;
+    let (rest, uuid) = meta.rsplit_once('.')?;
+    if !is_canonical_uuid(uuid) {
+        return None;
+    }
+    let prefix = if rest == TAG_IDENT {
+        // `<core>+socket.<uuid>`: the original had no build metadata.
+        return Some((core, uuid));
+    } else {
+        rest.strip_suffix(TAG_IDENT)?.strip_suffix('.')?
+    };
+    if prefix.is_empty() {
+        return None;
+    }
+    // `<core>+<meta>.socket.<uuid>`: the original is `<core>+<meta>`.
+    Some((&version[..core.len() + 1 + prefix.len()], uuid))
+}
+
+/// `version` without its Socket tag (itself when untagged).
+pub fn strip_tag(version: &str) -> &str {
+    split_tag(version).map_or(version, |(base, _)| base)
+}
+
+/// The uuid a tagged version carries.
+pub fn tag_uuid(version: &str) -> Option<&str> {
+    split_tag(version).map(|(_, uuid)| uuid)
+}
+
+/// Does the lock/manifest version `found` denote `version` — the version
+/// itself, or any Socket-tagged spelling of it?
+pub fn denotes(found: &str, version: &str) -> bool {
+    strip_tag(found) == version
+}
+
+/// Why a copy manifest's `[package] version` cannot be (un)tagged.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum TagError {
+    /// Not TOML.
+    Unparseable(String),
+    /// No `[package] version` string literal (a workspace-inherited or
+    /// missing version: never a crates.io-published manifest).
+    NoVersion,
+    /// The manifest names another version than the copy is for.
+    VersionMismatch(String),
+    /// The literal is spelled with escapes / a multi-line form the
+    /// byte-exact rewrite does not reproduce.
+    UnsupportedLiteral(String),
+    Io(String),
+}
+
+impl std::fmt::Display for TagError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::Unparseable(e) => write!(f, "the copy's Cargo.toml is not valid TOML: {e}"),
+            Self::NoVersion => write!(
+                f,
+                "the copy's Cargo.toml has no literal `[package] version` string"
+            ),
+            Self::VersionMismatch(v) => write!(
+                f,
+                "the copy's Cargo.toml declares version {v:?}, not the vendored version"
+            ),
+            Self::UnsupportedLiteral(raw) => write!(
+                f,
+                "the copy's Cargo.toml spells its version as {raw}, which cannot be \
+                 rewritten byte-exactly"
+            ),
+            Self::Io(e) => write!(f, "the copy's Cargo.toml: {e}"),
+        }
+    }
+}
+
+/// The `[package] version` string of `text`, with the byte range of its
+/// literal (quotes included) and the quote character.
+fn version_literal(text: &str) -> Result<(String, std::ops::Range<usize>, char), TagError> {
+    let doc = toml_edit::Document::parse(text).map_err(|e| TagError::Unparseable(e.to_string()))?;
+    let item = doc
+        .get("package")
+        .and_then(toml_edit::Item::as_table_like)
+        .and_then(|p| p.get("version"))
+        .ok_or(TagError::NoVersion)?;
+    let value = item.as_str().ok_or(TagError::NoVersion)?.to_string();
+    let span = item.span().ok_or(TagError::NoVersion)?;
+    let raw = text.get(span.clone()).ok_or(TagError::NoVersion)?;
+    // Only a plain one-line literal whose body IS the value round-trips
+    // byte-exactly: `"1.0.4"` / `'1.0.4'`.
+    let quote = raw.chars().next().unwrap_or('"');
+    let plain = (quote == '"' || quote == '\'')
+        && raw.len() == value.len() + 2
+        && raw.ends_with(quote)
+        && raw[1..raw.len() - 1] == value;
+    if !plain {
+        return Err(TagError::UnsupportedLiteral(raw.to_string()));
+    }
+    Ok((value, span, quote))
+}
+
+/// `text` (a vendored copy's `Cargo.toml`) with its `[package] version`
+/// tagged for `uuid`. The version must denote `version` (untagged, or tagged
+/// for any uuid — re-tagged). `Ok(None)`: already tagged for `uuid`.
+pub fn tag_manifest_text(
+    text: &str,
+    version: &str,
+    uuid: &str,
+) -> Result<Option<String>, TagError> {
+    let (found, span, quote) = version_literal(text)?;
+    if !denotes(&found, version) {
+        return Err(TagError::VersionMismatch(found));
+    }
+    let tagged = tag_version(version, uuid);
+    if found == tagged {
+        return Ok(None);
+    }
+    Ok(Some(splice(text, span, quote, &tagged)))
+}
+
+/// `text` with the Socket tag dropped from its `[package] version` —
+/// byte-identical to the manifest before [`tag_manifest_text`]. `None` when
+/// the version is untagged (or unreadable).
+pub fn untag_manifest_text(text: &str) -> Option<String> {
+    let (found, span, quote) = version_literal(text).ok()?;
+    let (base, _) = split_tag(&found)?;
+    Some(splice(text, span, quote, base))
+}
+
+/// The uuid the `[package] version` of a copy manifest is tagged with.
+pub fn manifest_tag_uuid(text: &str) -> Option<String> {
+    let (found, _, _) = version_literal(text).ok()?;
+    tag_uuid(&found).map(str::to_string)
+}
+
+fn splice(text: &str, span: std::ops::Range<usize>, quote: char, value: &str) -> String {
+    format!(
+        "{}{quote}{value}{quote}{}",
+        &text[..span.start],
+        &text[span.end..]
+    )
+}
+
+/// Is `file_key` (a patch record key) the copy's `Cargo.toml` — the one
+/// patched file the tag rewrites after the patch applied?
+pub fn is_copy_manifest_key(file_key: &str) -> bool {
+    normalize_file_path(file_key) == COPY_MANIFEST
+}
+
+/// The bytes a patch record's `afterHash` covers for the copy manifest:
+/// `bytes` with the Socket tag dropped (the tag is vendor wiring written
+/// after the patch applied). `None` when `bytes` carries no tag.
+pub fn untagged_manifest_bytes(bytes: &[u8]) -> Option<Vec<u8>> {
+    let text = std::str::from_utf8(bytes).ok()?;
+    untag_manifest_text(text).map(String::into_bytes)
+}
+
+// ── copy edits ───────────────────────────────────────────────────────────
+
+/// Tag the `Cargo.toml` of the copy at `copy_dir` for `uuid` (atomic,
+/// mode-preserving). `Ok(true)` when it was rewritten, `Ok(false)` when it
+/// already carried this tag.
+pub async fn tag_copy_manifest(
+    copy_dir: &Path,
+    version: &str,
+    uuid: &str,
+) -> Result<bool, TagError> {
+    let path = copy_dir.join(COPY_MANIFEST);
+    let text = read_regular_to_string(&path)
+        .await
+        .map_err(|e| TagError::Io(e.to_string()))?;
+    match tag_manifest_text(&text, version, uuid)? {
+        None => Ok(false),
+        Some(tagged) => {
+            atomic_write_bytes_preserving_mode(&path, tagged.as_bytes())
+                .await
+                .map_err(|e| TagError::Io(e.to_string()))?;
+            Ok(true)
+        }
+    }
+}
+
+/// Drop the tag from the copy manifest (best-effort undo of
+/// [`tag_copy_manifest`] when a later step fails).
+pub async fn untag_copy_manifest(copy_dir: &Path) {
+    let path = copy_dir.join(COPY_MANIFEST);
+    if let Ok(text) = read_regular_to_string(&path).await {
+        if let Some(untagged) = untag_manifest_text(&text) {
+            let _ = atomic_write_bytes_preserving_mode(&path, untagged.as_bytes()).await;
+        }
+    }
+}
+
+/// The uuid the copy manifest at `copy_dir` is tagged with, if any.
+pub async fn copy_manifest_tag(copy_dir: &Path) -> Option<String> {
+    let text = read_regular_to_string(&copy_dir.join(COPY_MANIFEST))
+        .await
+        .ok()?;
+    manifest_tag_uuid(&text)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const UUID: &str = "9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f";
+    const UUID2: &str = "0a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d";
+
+    #[test]
+    fn tags_plain_prerelease_and_build_metadata_versions() {
+        for (version, tagged) in [
+            ("1.0.4", format!("1.0.4+socket.{UUID}")),
+            ("0.1.10", format!("0.1.10+socket.{UUID}")),
+            ("1.0.0-rc.1", format!("1.0.0-rc.1+socket.{UUID}")),
+            ("1.0.0-alpha+001", format!("1.0.0-alpha+001.socket.{UUID}")),
+            (
+                "2.0.1+zstd.1.5.2",
+                format!("2.0.1+zstd.1.5.2.socket.{UUID}"),
+            ),
+            (
+                "0.25.12+spec-1.1.0",
+                format!("0.25.12+spec-1.1.0.socket.{UUID}"),
+            ),
+        ] {
+            assert_eq!(tag_version(version, UUID), tagged, "{version}");
+            assert_eq!(split_tag(&tagged), Some((version, UUID)), "{tagged}");
+            assert_eq!(strip_tag(&tagged), version);
+            assert_eq!(tag_uuid(&tagged), Some(UUID));
+            assert!(denotes(&tagged, version) && denotes(version, version));
+            assert_eq!(split_tag(version), None, "{version} is untagged");
+            // Re-tagging replaces, never stacks.
+            let retagged = tag_version(&tagged, UUID2);
+            assert_eq!(split_tag(&retagged), Some((version, UUID2)));
+            assert_eq!(retagged.matches("socket").count(), 1);
+        }
+    }
+
+    #[test]
+    fn split_rejects_look_alikes() {
+        for v in [
+            "1.0.4+socket",
+            "1.0.4+socket.",
+            "1.0.4+socket.not-a-uuid",
+            "1.0.4+socket.9F6B2C4E-1D3A-4F6B-8C2D-7E5A9B1C3D5F",
+            "1.0.4+xsocket.9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f",
+            "1.0.4+.socket.9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f",
+            "1.0.4+9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f",
+            "1.0.4",
+        ] {
+            assert_eq!(split_tag(v), None, "{v}");
+            assert_eq!(strip_tag(v), v);
+        }
+        assert!(!denotes("1.0.5", "1.0.4"));
+        assert!(!denotes(&format!("1.0.5+socket.{UUID}"), "1.0.4"));
+    }
+
+    const CRATE_TOML: &str = "# THIS FILE IS AUTOMATICALLY GENERATED BY CARGO\r\n\r\n[package]\r\nedition = \"2018\"\r\nname = \"cfg-if\"\r\nversion = \"1.0.4\" # pinned\r\nauthors = [\"a\"]\r\n\r\n[dependencies.core]\r\nversion = \"1.0.0\"\r\n";
+
+    #[test]
+    fn manifest_tag_round_trips_byte_identically() {
+        let tagged = tag_manifest_text(CRATE_TOML, "1.0.4", UUID)
+            .unwrap()
+            .unwrap();
+        assert_eq!(
+            tagged,
+            CRATE_TOML.replace(
+                "version = \"1.0.4\" #",
+                &format!("version = \"1.0.4+socket.{UUID}\" #")
+            ),
+            "only the [package] version literal changes (CRLF, comments and the \
+             dependency's own version kept)"
+        );
+        assert_eq!(manifest_tag_uuid(&tagged).as_deref(), Some(UUID));
+        assert_eq!(tag_manifest_text(&tagged, "1.0.4", UUID).unwrap(), None);
+        assert_eq!(untag_manifest_text(&tagged).as_deref(), Some(CRATE_TOML));
+        assert_eq!(untag_manifest_text(CRATE_TOML), None);
+        // Re-tag for a new uuid.
+        let bumped = tag_manifest_text(&tagged, "1.0.4", UUID2).unwrap().unwrap();
+        assert_eq!(manifest_tag_uuid(&bumped).as_deref(), Some(UUID2));
+        assert_eq!(untag_manifest_text(&bumped).as_deref(), Some(CRATE_TOML));
+    }
+
+    #[test]
+    fn manifest_tag_keeps_literal_quotes_and_existing_metadata() {
+        let text = "[package]\nname = \"zstd-sys\"\nversion = '2.0.1+zstd.1.5.2'\n";
+        let tagged = tag_manifest_text(text, "2.0.1+zstd.1.5.2", UUID)
+            .unwrap()
+            .unwrap();
+        assert_eq!(
+            tagged,
+            format!("[package]\nname = \"zstd-sys\"\nversion = '2.0.1+zstd.1.5.2.socket.{UUID}'\n")
+        );
+        assert_eq!(untag_manifest_text(&tagged).as_deref(), Some(text));
+        let inline = "package = { name = \"x\", version = \"1.0.0-rc.1\" }\n";
+        let tagged = tag_manifest_text(inline, "1.0.0-rc.1", UUID)
+            .unwrap()
+            .unwrap();
+        assert!(tagged.contains(&format!("\"1.0.0-rc.1+socket.{UUID}\"")));
+        assert_eq!(untag_manifest_text(&tagged).as_deref(), Some(inline));
+    }
+
+    #[test]
+    fn manifest_tag_refuses_unrecognized_shapes() {
+        assert!(matches!(
+            tag_manifest_text("[package]\nversion = \"2.0.0\"\n", "1.0.4", UUID),
+            Err(TagError::VersionMismatch(v)) if v == "2.0.0"
+        ));
+        assert_eq!(
+            tag_manifest_text("[package]\nname = \"x\"\n", "1.0.4", UUID),
+            Err(TagError::NoVersion)
+        );
+        assert_eq!(
+            tag_manifest_text("[package]\nversion.workspace = true\n", "1.0.4", UUID),
+            Err(TagError::NoVersion)
+        );
+        assert!(matches!(
+            tag_manifest_text("[package]\nversion = \"1.0.\\u0034\"\n", "1.0.4", UUID),
+            Err(TagError::UnsupportedLiteral(_))
+        ));
+        assert!(matches!(
+            tag_manifest_text("[package\n", "1.0.4", UUID),
+            Err(TagError::Unparseable(_))
+        ));
+    }
+
+    #[test]
+    fn untagged_bytes_recover_the_patched_manifest() {
+        let tagged = tag_manifest_text(CRATE_TOML, "1.0.4", UUID)
+            .unwrap()
+            .unwrap();
+        assert_eq!(
+            untagged_manifest_bytes(tagged.as_bytes()).as_deref(),
+            Some(CRATE_TOML.as_bytes())
+        );
+        assert_eq!(untagged_manifest_bytes(CRATE_TOML.as_bytes()), None);
+        assert!(is_copy_manifest_key("Cargo.toml"));
+        assert!(is_copy_manifest_key("package/Cargo.toml"));
+        assert!(!is_copy_manifest_key("src/Cargo.toml"));
+        assert!(!is_copy_manifest_key("Cargo.toml.orig"));
+    }
+
+    #[tokio::test]
+    async fn copy_manifest_edits_are_idempotent() {
+        let dir = tempfile::tempdir().unwrap();
+        std::fs::write(dir.path().join("Cargo.toml"), CRATE_TOML).unwrap();
+        assert!(tag_copy_manifest(dir.path(), "1.0.4", UUID).await.unwrap());
+        assert!(!tag_copy_manifest(dir.path(), "1.0.4", UUID).await.unwrap());
+        assert_eq!(copy_manifest_tag(dir.path()).await.as_deref(), Some(UUID));
+        untag_copy_manifest(dir.path()).await;
+        assert_eq!(
+            std::fs::read_to_string(dir.path().join("Cargo.toml")).unwrap(),
+            CRATE_TOML
+        );
+        assert_eq!(copy_manifest_tag(dir.path()).await, None);
+        let missing = tempfile::tempdir().unwrap();
+        assert!(matches!(
+            tag_copy_manifest(missing.path(), "1.0.4", UUID).await,
+            Err(TagError::Io(_))
+        ));
+    }
+}
diff --git a/crates/socket-patch-core/src/vendor/lock_inventory/cargo.rs b/crates/socket-patch-core/src/vendor/lock_inventory/cargo.rs
index b9c6754e..d2df4c47 100644
--- a/crates/socket-patch-core/src/vendor/lock_inventory/cargo.rs
+++ b/crates/socket-patch-core/src/vendor/lock_inventory/cargo.rs
@@ -13,9 +13,12 @@ use super::{dedup_prefer_integrity, LockIntegrity, LockfileEntry, SourceKind};
 /// backend's lock model ([`crate::vendor::cargo_lock::locked_packages`]; a v1 lock's
 /// `[metadata]` checksums included). Only crates.io-sourced entries are
 /// fetchable (their `checksum` is the sha256 of the `.crate` file);
-/// workspace members (no `source`) are skipped, and git/custom-registry
-/// sources stay listed for discovery without a verifier. A lock that is not
-/// TOML yields nothing — cargo itself refuses to build from it.
+/// workspace members and vendored copies (no `source`; a vendored copy's
+/// version carries the `+socket.<uuid>` tag, see `vendor::cargo_tag`) are
+/// skipped, and git/custom-registry sources stay listed for discovery
+/// without a verifier. A version is inventoried under its purl identity:
+/// a Socket tag, should a sourced entry carry one, is stripped. A lock
+/// that is not TOML yields nothing — cargo itself refuses to build from it.
 pub(super) async fn inventory_cargo_lock(project_root: &Path) -> Option<Vec<LockfileEntry>> {
     inventory_cargo_lock_raw(project_root)
         .await
@@ -33,7 +36,8 @@ pub(super) async fn inventory_cargo_lock_raw(project_root: &Path) -> Option<Vec<
         let Some(source) = pkg.source else {
             continue; // workspace member
         };
-        let Some(purl) = simple_purl("cargo", &pkg.name, &pkg.version) else {
+        let version = crate::vendor::cargo_tag::strip_tag(&pkg.version).to_string();
+        let Some(purl) = simple_purl("cargo", &pkg.name, &version) else {
             continue;
         };
         let crates_io = source.contains("github.com/rust-lang/crates.io-index")
@@ -51,7 +55,7 @@ pub(super) async fn inventory_cargo_lock_raw(project_root: &Path) -> Option<Vec<
             source_kind,
             purl,
             name: pkg.name,
-            version: pkg.version,
+            version,
             resolved: None,
             integrity,
         });
diff --git a/crates/socket-patch-core/src/vendor/mod.rs b/crates/socket-patch-core/src/vendor/mod.rs
index a8b38e5b..0421c09a 100644
--- a/crates/socket-patch-core/src/vendor/mod.rs
+++ b/crates/socket-patch-core/src/vendor/mod.rs
@@ -57,6 +57,7 @@ pub mod cargo;
 pub mod cargo_config;
 pub mod cargo_lock;
 pub mod cargo_manifest;
+pub mod cargo_tag;
 pub(crate) mod common;
 pub mod composer_lock;
 pub mod gem;
diff --git a/crates/socket-patch-core/src/vendor/verify.rs b/crates/socket-patch-core/src/vendor/verify.rs
index 87aba918..361fab7c 100644
--- a/crates/socket-patch-core/src/vendor/verify.rs
+++ b/crates/socket-patch-core/src/vendor/verify.rs
@@ -97,7 +97,7 @@ pub async fn verify_vendored_patch_record(
     let is_zip =
         path_str.ends_with(".whl") || path_str.ends_with(".nupkg") || path_str.ends_with(".jar");
     if !is_tarball && !is_zip {
-        verify_dir_members(&artifact, record).await?;
+        verify_dir_members(&artifact, record, entry.ecosystem == "cargo").await?;
         // Whole-tree cross-check: a dir-shaped artifact's bytes are covered
         // by NO lockfile integrity (bundler path sources, cargo path deps,
         // …), so the members above are the only thing the record can vouch
@@ -124,12 +124,22 @@ pub async fn verify_vendored_patch_record(
 
 /// Dir-shaped ecosystems (cargo/golang/composer/gem): hash files in place,
 /// reusing the hardened per-file verifier (it normalizes manifest keys and
-/// fail-closes on path-escaping keys).
-async fn verify_dir_members(dir: &Path, record: &PatchRecord) -> Result<(), String> {
+/// fail-closes on path-escaping keys). A cargo copy's `Cargo.toml` carries
+/// the `+socket.<uuid>` version tag written after the patch applied
+/// (`vendor::cargo_tag`): a patched `Cargo.toml` verifies with the tag
+/// dropped.
+async fn verify_dir_members(dir: &Path, record: &PatchRecord, cargo: bool) -> Result<(), String> {
     for (file_name, info) in &record.files {
         let result = verify_file_patch(dir, file_name, info).await;
         match result.status {
             VerifyStatus::AlreadyPatched => continue,
+            VerifyStatus::Ready | VerifyStatus::HashMismatch
+                if cargo
+                    && super::cargo_tag::is_copy_manifest_key(file_name)
+                    && untagged_manifest_matches(dir, &info.after_hash).await =>
+            {
+                continue
+            }
             VerifyStatus::Ready | VerifyStatus::HashMismatch => {
                 return Err("vendor_hash_mismatch".to_string())
             }
@@ -139,6 +149,16 @@ async fn verify_dir_members(dir: &Path, record: &PatchRecord) -> Result<(), Stri
     Ok(())
 }
 
+/// Does the cargo copy's `Cargo.toml`, Socket tag dropped, hash to
+/// `after_hash`?
+async fn untagged_manifest_matches(dir: &Path, after_hash: &str) -> bool {
+    let Ok(text) = crate::utils::fs::read_regular_to_string(&dir.join("Cargo.toml")).await else {
+        return false;
+    };
+    super::cargo_tag::untagged_manifest_bytes(text.as_bytes())
+        .is_some_and(|b| compute_git_sha256_from_bytes(&b).eq_ignore_ascii_case(after_hash))
+}
+
 fn read_wheel_to_map(whl: &Path) -> Result<HashMap<String, Vec<u8>>, String> {
     // The shared guarded opener: non-blocking open + regular-file check on
     // the handle, so a FIFO planted at the artifact path fails the audit
diff --git a/crates/socket-patch-core/src/vex/discover/cargo.rs b/crates/socket-patch-core/src/vex/discover/cargo.rs
index b4832e60..7ec7bd78 100644
--- a/crates/socket-patch-core/src/vex/discover/cargo.rs
+++ b/crates/socket-patch-core/src/vex/discover/cargo.rs
@@ -56,8 +56,18 @@
 //!
 //! ## Vendored (`vendor`, `vendor::cargo` + `vendor::cargo_manifest`)
 //!
-//! NOT visible in `Cargo.lock` beyond the entry losing `source` + `checksum`
-//! (`vendor::cargo_lock::detach_lock_entry`). The identity is a
+//! `Cargo.lock` is the PRIMARY identity signal: the detached entry loses
+//! `source` + `checksum` and its version is the copy's TAGGED version
+//! `<version>+socket.<uuid>` (`vendor::cargo_lock::detach_lock_entry`,
+//! `vendor::cargo_tag`) — what cargo locks for the tagged copy it builds.
+//! The purl version is the tag stripped (`pkg:cargo/<name>@<version>`), and
+//! the tag's uuid must be the uuid of the wiring's copy path: a sourceless
+//! entry tagged for ANOTHER uuid means the copy cargo builds is not the one
+//! this wiring names (a config override elsewhere, or a stale `[patch]`) →
+//! no ref ([`DIAG_REF_INVALID`]). A tagged entry that no visible wiring
+//! names (the `[patch]` lives in a config discovery does not read, or was
+//! removed) is [`DIAG_REF_UNATTRIBUTABLE`]. An UNTAGGED sourceless entry is
+//! a copy vendored before tagged versions and still counts. The wiring is a
 //! `[patch.crates-io]` path entry
 //! `<key> = { path = ".socket/vendor/cargo/<uuid>/<name>-<version>" }` —
 //! PRIMARILY in the root `Cargo.toml` (what v5+ `vendor` writes; `<key>` is
@@ -96,7 +106,8 @@ use toml_edit::{DocumentMut, Item, TableLike};
 
 use super::{
     names_vendor_dir, simple_purl, socket_patch_name_uuid, toml_or_diag, vendor_ref, DiscoverCtx,
-    Discovery, PatchedRef, TomlDiag, UnlockedPin, DIAG_REF_INVALID, DIAG_REF_UNATTRIBUTABLE,
+    Discovery, PatchedRef, TomlDiag, UnlockedPin, VendorRef, DIAG_REF_INVALID,
+    DIAG_REF_UNATTRIBUTABLE,
 };
 use crate::utils::digest::is_hex64_lower;
 use crate::vendor::cargo_config::{
@@ -104,9 +115,10 @@ use crate::vendor::cargo_config::{
     CONFIG_TOML, SOCKET_REGISTRY_PREFIX,
 };
 use crate::vendor::cargo_lock::{
-    locked_packages, unused_patches, vendored_copy_consumed, LockedPackage,
+    detached_tag, locked_packages, unused_patches, vendored_copy_consumed, LockedPackage,
 };
 use crate::vendor::cargo_manifest::{crates_io_url_alias_tables, is_crates_io_source};
+use crate::vendor::cargo_tag;
 use crate::vendor::lock_inventory::LockIntegrity;
 
 const CARGO_LOCK: &str = "Cargo.lock";
@@ -200,6 +212,50 @@ pub(crate) async fn extract(ctx: &DiscoverCtx<'_>, out: &mut Discovery) {
     if let Some((file, doc)) = &config {
         vendored_from_patches(file, doc, &lock, &|_| None, out);
     }
+    let wired: Vec<VendorRef> = manifest
+        .iter()
+        .chain(config.iter().map(|(_, doc)| doc))
+        .flat_map(socket_copies)
+        .collect();
+    unattributed_tags(&lock, &wired, out);
+}
+
+/// Every Socket copy a file's `[patch]` tables point at.
+fn socket_copies(doc: &DocumentMut) -> Vec<VendorRef> {
+    patch_entries(doc)
+        .into_iter()
+        .filter_map(|e| e.path.and_then(vendor_ref))
+        .filter(|v| v.eco == "cargo")
+        .collect()
+}
+
+/// Diagnose Socket-tagged sourceless lock entries that no visible
+/// `[patch]` wiring names (`.socket/vendor/cargo/<uuid>/<name>-<version>`):
+/// the lock records a vendored copy the files discovery reads cannot
+/// attribute, so it is not attested.
+fn unattributed_tags(lock: &Lock, wired: &[VendorRef], out: &mut Discovery) {
+    for pkg in lock.packages() {
+        if pkg.source.is_some() {
+            continue;
+        }
+        let Some((version, uuid)) = cargo_tag::split_tag(&pkg.version) else {
+            continue;
+        };
+        let leaf = format!("{}-{version}", pkg.name);
+        if wired.iter().any(|v| v.uuid == uuid && v.leaf == leaf) {
+            continue;
+        }
+        out.diag(
+            DIAG_REF_UNATTRIBUTABLE,
+            CARGO_LOCK,
+            format!(
+                "{CARGO_LOCK}: {} {} is a Socket-vendored copy (patch {uuid}), but no \
+                 [patch] entry in {CARGO_TOML} or the project cargo config points at \
+                 .socket/vendor/cargo/{uuid}/{leaf}; not counted",
+                pkg.name, pkg.version
+            ),
+        );
+    }
 }
 
 // ── reads ────────────────────────────────────────────────────────────────
@@ -635,7 +691,23 @@ fn vendored_from_patches(
             continue;
         };
         if let Lock::Parsed { pkgs, unused } = lock {
-            if !vendored_copy_consumed(pkgs, unused, name, version) {
+            if let Some(Some(tag)) = detached_tag(pkgs, name, version) {
+                if tag != vref.uuid {
+                    out.diag(
+                        DIAG_REF_INVALID,
+                        file,
+                        format!(
+                            "{file}: [patch] entry for {name} points at {}, but {CARGO_LOCK} \
+                             builds the copy tagged for patch {tag} \
+                             ({name} {}); not counted",
+                            vref.artifact_rel,
+                            cargo_tag::tag_version(version, tag)
+                        ),
+                    );
+                    continue;
+                }
+            }
+            if !vendored_copy_consumed(pkgs, unused, name, version, &vref.uuid) {
                 out.diag(
                     DIAG_REF_INVALID,
                     file,
@@ -1777,4 +1849,77 @@ mod tests {
         );
         assert!(out.diagnostics.is_empty(), "{:#?}", out.diagnostics);
     }
+
+    // ── tagged vendored versions ─────────────────────────────────────
+
+    fn socket_manifest(rel: &str) -> String {
+        format!(
+            "{}\n[patch.crates-io]\ncfg-if-socket-aaaaaaaa = {{ package = \"cfg-if\", path = \"{rel}\" }}\n",
+            manifest("cfg-if = \"1\"")
+        )
+    }
+
+    /// The v5 shape: the lock's detached entry carries the copy's tagged
+    /// version. The purl is the tag stripped; a pre-release and a version
+    /// with its own build metadata read the same way.
+    #[tokio::test]
+    async fn tagged_lock_version_is_the_identity() {
+        for version in ["1.0.4", "1.0.0-rc.1", "2.0.1+zstd.1.5.2"] {
+            let rel = vendor_path(UUID_A, &format!("cfg-if-{version}"));
+            let tagged = crate::vendor::cargo_tag::tag_version(version, UUID_A);
+            let p = Project::new();
+            p.write("Cargo.toml", socket_manifest(&rel));
+            p.write("Cargo.lock", lock(&[("cfg-if", &tagged, None, None)]));
+            let out = run(&p).await;
+            let purl = format!("pkg:cargo/cfg-if@{version}");
+            assert_refs(&out, &[(purl.as_str(), UUID_A, WiringMode::Vendored)]);
+            assert!(
+                out.diagnostics.is_empty(),
+                "{version}: {:#?}",
+                out.diagnostics
+            );
+        }
+    }
+
+    /// A detached entry tagged for ANOTHER uuid: cargo builds a different
+    /// copy than the wiring names — no ref, and the ledger entry for the
+    /// named copy is dead.
+    #[tokio::test]
+    async fn lock_tag_for_another_uuid_is_dead_wiring() {
+        let rel = vendor_path(UUID_A, "cfg-if-1.0.4");
+        let p = Project::new();
+        p.write("Cargo.toml", socket_manifest(&rel));
+        p.write(
+            "Cargo.lock",
+            lock(&[("cfg-if", &format!("1.0.4+socket.{UUID_B}"), None, None)]),
+        );
+        let out = run(&p).await;
+        assert_refs(&out, &[]);
+        assert_eq!(
+            diag_codes(&out),
+            vec![DIAG_REF_INVALID, DIAG_REF_UNATTRIBUTABLE],
+            "{:#?}",
+            out.diagnostics
+        );
+        assert!(out.diagnostics.iter().any(|d| d.detail.contains(UUID_B)));
+        assert_eq!(
+            out.vendored_claim("pkg:cargo/cfg-if@1.0.4", UUID_A, &rel),
+            Some(false)
+        );
+    }
+
+    /// A tagged lock entry no visible wiring points at is diagnosed, never
+    /// attested from the lock alone.
+    #[tokio::test]
+    async fn tagged_lock_entry_without_wiring_is_unattributable() {
+        let p = Project::new();
+        p.write("Cargo.toml", manifest("cfg-if = \"1\""));
+        p.write(
+            "Cargo.lock",
+            lock(&[("cfg-if", &format!("1.0.4+socket.{UUID_A}"), None, None)]),
+        );
+        let out = run(&p).await;
+        assert_refs(&out, &[]);
+        assert_eq!(diag_codes(&out), vec![DIAG_REF_UNATTRIBUTABLE]);
+    }
 }
diff --git a/docs/ecosystems.md b/docs/ecosystems.md
index 7377b001..5da090e5 100644
--- a/docs/ecosystems.md
+++ b/docs/ecosystems.md
@@ -211,7 +211,7 @@ project on the machine, and is silently reset by `cargo clean` or a cache prune.
 Vendored mode (v5+) wires a patched crate with a `[patch.crates-io]` path
 entry in the **workspace-root `Cargo.toml`** (the manifest beside the
 `Cargo.lock` it detaches) plus the lock surgery that drops the crate's
-`source`/`checksum`:
+`source`/`checksum` and records the copy's **tagged version**:
 
 ```toml
 [patch.crates-io]
@@ -220,15 +220,40 @@ cfg-if-socket-9f6b2c4e = { package = "cfg-if", path = ".socket/vendor/cargo/<uui
 cfg-if-socket-0a1b2c3d = { package = "cfg-if", path = ".socket/vendor/cargo/<uuid2>/cfg-if-0.1.10" }
 ```
 
+```toml
+# Cargo.lock
+[[package]]
+name = "cfg-if"
+version = "1.0.4+socket.<uuid>"
+```
+
+- **Tagged versions.** The vendored copy's own `Cargo.toml` version is
+  rewritten to `<version>+socket.<uuid>` (a version with build metadata
+  keeps it: `2.0.1+zstd.1.5.2` → `2.0.1+zstd.1.5.2.socket.<uuid>`), and the
+  detached lock entry carries the same tagged version — the lock cargo
+  itself writes for the tagged copy. Cargo ignores build metadata when
+  matching requirements, so `1.0.4`, `=1.0.4`, `1`, `^1` in any dependent
+  still select the copy. The lock alone therefore names the patch uuid of
+  the copy cargo builds (a `[patch]` override elsewhere changes the locked
+  version), and stripping the tag gives the purl version. Every lock
+  reference that spells the version (`"cfg-if 1.0.4"`, v1's full ids) is
+  rewritten with it, in lock formats v1–v4; a lock that cannot be kept
+  consistent refuses with `cargo_lock_untaggable` before any write.
+  **The patched crate sees the tag in `CARGO_PKG_VERSION`** — e.g. a
+  vendored binary crate's `--version` output shows it; semver-parsing code
+  is unaffected. Revert restores the original lock byte for byte. Copies
+  and locks vendored before tagged versions are tagged by the next re-run
+  or `repair` (`cargo_version_tagged`).
 - **Why the manifest.** Socket's scanners already ingest `Cargo.toml`, so
   the patch uuid in the path is recoverable for SBOM annotation without
   uploading `.cargo/config*` (which can hold registry tokens), and manifest
   `[patch]` builds on cargo older than 1.56, the floor of config-file
-  `[patch]` (proven on 1.56 and older toolchains by the old-toolchain e2e
-  tests). On such old cargo, two vendored versions of ONE crate also need
-  `cargo build --offline` (or a reachable registry index): it loads the
-  crates.io index to tell the two entries apart. Current stable needs
-  neither.
+  `[patch]` (proven by the old-toolchain e2e tests on cargo 1.41 in docker,
+  which builds and runs the patched copy with no network, and on 1.56).
+  Two vendored versions of ONE crate need `cargo build --offline` on 1.56,
+  and on older cargo (1.41) a populated crates.io index in `$CARGO_HOME`
+  (or network access) — it loads the index to tell the two entries apart.
+  Current stable needs neither.
 - **Keys.** Always the Socket-owned `<name>-socket-<first 8 hex of the
   uuid>` with `package = "<name>"` (the full uuid hex if that key is
   taken), never the bare crate name: cargo lets a config-file `[patch]`
@@ -267,7 +292,9 @@ cfg-if-socket-0a1b2c3d = { package = "cfg-if", path = ".socket/vendor/cargo/<uui
   A project hit by the old multi-version overwrite (a second vendored
   version repointed the crate-named config key, leaving the first
   version's lock entry detached and unwired) is healed the same way
-  (`cargo_wiring_restored`). Every revert removes both spellings.
+  (`cargo_wiring_restored`). The same re-run or `repair` also tags an
+  untagged copy and lock entry (`cargo_version_tagged`). Every revert
+  removes both spellings.
 
 ## Go: directory replaces and go.sum
 

From 2a2bebb1d22f621309e88767f97f54016110a033 Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Thu, 24 Sep 2026 18:19:29 -0400
Subject: [PATCH 03/13] fix(vendor): harden tagged cargo copies after review

- Keep a recorded whole-tree inventory when repair tags a pre-tag copy
  instead of re-baselining it over unverified bytes; the inventory check
  accepts the copy's Cargo.toml only with exactly this uuid's tag
  dropped, the cargo inventory carries forward for the same copy, and
  repair refreshes it only from a member-verified rebuild.
- Select Cargo.lock entries by rank (this uuid's tagged copy, another
  tagged copy, a registry entry, then an untagged sourceless one), so a
  user's same-version path fork locked beside the copy is never
  restored, retagged or counted as a multi-source conflict; the revert
  spells the restored registry entry by its full id, exactly as cargo
  writes it.
- GC keeps an entry whose lock tag is stale while the manifest still
  wires its copy (cargo re-locks to it; the next re-run retags).
- Revert drops the tag the first build locked when no lock originals
  were recorded (vendored before any Cargo.lock), so a hosted takeover
  finds the crate again.
- Dry runs preview "would tag" and the cargo_lock_untaggable /
  cargo_copy_untaggable refusals.
- lock_inventory lists a sourced Socket-tagged entry with no verifier.
- Docs: semver Version equality/ordering sees the tag; 1.56 is built in
  CI docker; an untagged detached entry counts only beside an untagged
  copy.
- Tests: fork-shape lock units (v1/v4, cargo's exact lock), vendor-flow
  tests for revert/dry-run/untaggable copies, tag-aware inventory and
  carry-forward units, VEX discovery copy-tag units, VEX e2e split and
  ledger leg, and real-cargo cells for a transitive registry dependent,
  the repair inventory refresh and a lockless vendor + hosted takeover.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 CHANGELOG.md                                  |  53 +-
 README.md                                     |   2 +-
 crates/socket-patch-cli/CLI_CONTRACT.md       |   4 +-
 .../src/commands/repair_vendor.rs             |   7 +-
 .../tests/e2e_vendor_cargo_build.rs           | 213 ++++++-
 .../tests/e2e_vex_lockfile/cargo.rs           |  72 ++-
 .../tests/mode_migration_cargo.rs             |  90 +++
 crates/socket-patch-core/src/vendor/cargo.rs  | 558 +++++++++++++++---
 .../src/vendor/cargo_lock.rs                  | 506 +++++++++++++---
 .../socket-patch-core/src/vendor/cargo_tag.rs |  27 +-
 .../src/vendor/lock_inventory/cargo.rs        |  10 +-
 .../src/vendor/lock_inventory/tests.rs        |  43 ++
 crates/socket-patch-core/src/vendor/state.rs  |  71 +++
 crates/socket-patch-core/src/vendor/verify.rs | 105 +++-
 .../src/vex/discover/cargo.rs                 | 227 ++++++-
 docs/ecosystems.md                            |  22 +-
 16 files changed, 1770 insertions(+), 240 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1e80cc6f..bae4ae27 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -35,9 +35,12 @@ into the new version's section — see docs/releasing.md.
   has build metadata keeps it: `2.0.1+zstd.1.5.2.socket.<uuid>`), and the
   detached `Cargo.lock` entry records that tagged version with no
   `source` / `checksum` — exactly the lock cargo itself writes when it
-  resolves the `[patch]` against the tagged copy (verified on cargo 1.41,
-  1.56 and current stable: `--locked` builds, the patched bytes compile,
-  transitive `^1` / `=1.0.4` dependents resolve to the copy since cargo
+  resolves the `[patch]` against the tagged copy (verified by building on
+  cargo 1.41 in docker and on current stable, and by the CI
+  `cargo-old-toolchains` leg on the 1.41 / 1.56 docker images — a local
+  run without those images only type-checks on rustup toolchains:
+  `--locked` builds, the patched bytes compile, a registry crate that
+  depends on the patched one (`^1`) resolves to the copy too, since cargo
   ignores build metadata when matching requirements, and `cargo metadata`
   reports the tagged version). Every lock reference that spells the old
   version (`"cfg-if 1.0.4"`, v1's `"cfg-if 1.0.4 (registry+…)"`) is
@@ -51,22 +54,40 @@ into the new version's section — see docs/releasing.md.
   `[patch]` override pointing elsewhere changes the locked version). **The
   patched crate sees the tag in `CARGO_PKG_VERSION`** (and in
   `env!("CARGO_PKG_VERSION")`-derived strings such as `--version` output
-  of a vendored binary crate); code that parses its own version with a
-  semver parser is unaffected, code that compares it as a string is not.
-  Re-runs are idempotent; a uuid bump re-tags the copy and the lock;
-  `vendor --revert` / `rollback` / `remove` / GC / the hosted takeover
-  restore the original lock byte for byte (tag dropped with the
-  `source` / `checksum`). Projects vendored before tagged versions (the
-  pre-v5 `.cargo/config*` wiring, or an untagged manifest wiring) are
-  tagged by the next re-run or `repair` (`cargo_version_tagged` note; a
-  tag `repair` cannot write is the `cargo_version_untagged` warning). VEX
+  of a vendored binary crate): requirement matching on it
+  (`semver::VersionReq::matches`) is unaffected, but string comparisons
+  AND equality / ordering on a parsed `semver::Version` see the tag
+  (`semver` 1.x compares build metadata: `1.0.4+socket.<uuid>` is not
+  `== Version::new(1, 0, 4)` and sorts above it). Re-runs are idempotent
+  (a dry run previews the tag as "would tag", and the wet run's
+  `cargo_lock_untaggable` / `cargo_copy_untaggable` refusals); a uuid bump
+  re-tags the copy and the lock; `vendor --revert` / `rollback` /
+  `remove` / GC / the hosted takeover restore the original lock byte for
+  byte (tag dropped with the `source` / `checksum`; a crate vendored
+  before any `Cargo.lock` existed has no originals, so only the tag its
+  first build locked is dropped). A user's own same-version path crate
+  that cargo later locks beside the tagged copy (an untagged sourceless
+  entry) is never mistaken for it: re-runs stay in sync, and the revert
+  restores the registry entry — spelled by its full id while the fork
+  shares its name+version, exactly as cargo writes it — without touching
+  the fork. GC keeps an entry whose lock tag is stale (another uuid) while
+  the manifest still wires this entry's copy: cargo re-locks any unlocked
+  build to the wired copy, and the next re-run retags. Projects vendored
+  before tagged versions (the pre-v5 `.cargo/config*` wiring, or an
+  untagged manifest wiring) are tagged by the next re-run or `repair`
+  (`cargo_version_tagged` note; a tag `repair` cannot write is the
+  `cargo_version_untagged` warning); a whole-tree file inventory recorded
+  for the copy is kept, and still verifies through exactly this uuid's
+  tag, so tagging never re-baselines it over unverified bytes. VEX
   discovery treats the tagged lock version as the primary identity
   (`pkg:cargo/<name>@<version>` is the tag stripped): a detached entry
   tagged for a different uuid than the wiring's copy path is dead wiring
-  (not attested), a tagged entry no visible wiring names is diagnosed
-  unattributable, and an untagged detached entry (vendored before tagged
-  versions) still counts. A patch that edits the crate's own `Cargo.toml`
-  verifies with the tag dropped.
+  (not attested), and so is a copy whose own `Cargo.toml` is tagged for
+  another uuid than its path; a tagged entry no visible wiring names is
+  diagnosed unattributable; an untagged detached entry counts only beside
+  an untagged copy (the pre-tag vendored shape) — beside a tagged copy it
+  is some other crate cargo built, not attested. A patch that edits the
+  crate's own `Cargo.toml` verifies with the tag dropped.
 - **Vendored cargo wiring moved to `Cargo.toml`.** `vendor` / `scan` /
   `get --mode vendored` write the `[patch.crates-io]` path entry into the
   workspace-root `Cargo.toml` (beside the `Cargo.lock` it detaches) instead
diff --git a/README.md b/README.md
index ab3827e3..21e18aa8 100644
--- a/README.md
+++ b/README.md
@@ -1246,7 +1246,7 @@ Behavior worth knowing:
 | pnpm | `pnpm-lock.yaml` (all generations), `shrinkwrap.yaml` (pnpm 1/2), Rush locks | Aliased / nested `resolution` shapes are diagnosed, not attested; `overrides` alone prove nothing |
 | yarn | `yarn.lock` (classic + berry) | Berry vendored entries also need the root `package.json` `resolutions` mapping; member locks are not read |
 | bun | `bun.lock`, else `bun.lockb` | A hosted entry that Bun < 1.3.10 re-saved without its sha512 attests only after install |
-| cargo | `Cargo.lock`, `Cargo.toml`, `.cargo/config[.toml]` | Root manifest + project config only (no `$CARGO_HOME` / parent configs); vendored `[patch.crates-io]` entries are read from `Cargo.toml` first (v5), the project config for pre-v5 projects, and must agree with the detached lock entry's tagged version `<version>+socket.<uuid>` (a tag for another uuid is dead wiring; an untagged pre-tag entry still counts); a manifest entry cargo ignores (a same-key project-config item, or a URL-spelled crates.io `[patch]` table) is not attested; a lockless hosted pin needs the redirect ledger's record |
+| cargo | `Cargo.lock`, `Cargo.toml`, `.cargo/config[.toml]` | Root manifest + project config only (no `$CARGO_HOME` / parent configs); vendored `[patch.crates-io]` entries are read from `Cargo.toml` first (v5), the project config for pre-v5 projects, and must agree with the detached lock entry's tagged version `<version>+socket.<uuid>` (a tag for another uuid — in the lock or in the copy's own `Cargo.toml` — is dead wiring; an untagged detached entry counts only beside an untagged, pre-tag copy); a manifest entry cargo ignores (a same-key project-config item, or a URL-spelled crates.io `[patch]` table) is not attested; a lockless hosted pin needs the redirect ledger's record |
 | golang | `go.mod`, `go.work`, `go.sum`, `go.work.sum` | A replace that `require` no longer selects is inert; `vendor/modules.txt` is not read |
 | pypi | `uv.lock`, `*.py.lock`, `pylock*.toml`, `poetry.lock`, `pdm.lock`, `Pipfile.lock`, `requirements.txt` (+ `-r` includes), `pyproject.toml` / `hatch.toml` | A `uv.lock` beside a `pyproject.toml` must agree with its `[tool.uv.sources]`; PDM 3.1 / 4.0–4.2 locks are refused; a Pipenv project needs `--product` (or a git remote) |
 | gem | `Gemfile.lock`, `gems.locked` | Platform gems unsupported; a Gemfile-only (pre-bundler-2.6, not yet locked) wiring needs the redirect ledger |
diff --git a/crates/socket-patch-cli/CLI_CONTRACT.md b/crates/socket-patch-cli/CLI_CONTRACT.md
index 2b4493c2..4c4595fc 100644
--- a/crates/socket-patch-cli/CLI_CONTRACT.md
+++ b/crates/socket-patch-cli/CLI_CONTRACT.md
@@ -1242,8 +1242,8 @@ Every `--json` invocation emits a single JSON object that follows the **unified
 | `cargo_legacy_wiring_kept` | vendor: `failed`; repair: `skipped` (warning) | vendor / scan / get `--mode vendored` (v5.0): the pre-v5 config entry could not be removed after the manifest took the wiring — the run is unwound (manifest, lock and copy as before) and the package fails, since a kept entry would double-wire the crate and, on a uuid bump, point at a copy the stale sweep deletes; the code prefixes the error detail. repair: the move was refused (e.g. an unparseable `Cargo.toml`, a user entry for the crate, or an unremovable legacy entry — the manifest edit is unwound); left in place. |
 | `cargo_version_tagged` | `skipped` (advisory note) | vendor / scan / get `--mode vendored` / repair (v5.0): a vendored copy and its detached Cargo.lock entry were (re)tagged `<version>+socket.<uuid>` — a copy vendored before tagged versions, or a lock entry tagged for another uuid while the wiring points at this copy (dry run: "would tag"). A vendor re-run that tags reports the package `applied`. |
 | `cargo_version_untagged` | `skipped` (warning) | repair (v5.0): the tag could not be written (an unreadable copy manifest, or a lock the retag cannot keep consistent); nothing else was undone — re-run `socket-patch vendor`. |
-| `cargo_lock_untaggable` | `failed` | vendor / scan / get `--mode vendored` (cargo, v5.0): the Cargo.lock entry cannot carry the copy's tagged version consistently (a dependency reference in a spelling the edit does not own, a v1 `replace` naming the crate, or an entry already at the tagged version). Refused before any write. |
-| `cargo_copy_untaggable` | `failed` (error prefix) | vendor / scan / get `--mode vendored` (cargo, v5.0): the copy's `Cargo.toml` has no literal `[package] version` string that can be rewritten byte-exactly (or it names another version); nothing is swapped in. |
+| `cargo_lock_untaggable` | `failed` | vendor / scan / get `--mode vendored` (cargo, v5.0): the Cargo.lock entry cannot carry the copy's tagged version consistently (a dependency reference in a spelling the edit does not own, a v1 `replace` naming the crate, or an entry already at the tagged version). Refused before any write; a dry run previews the same refusal. |
+| `cargo_copy_untaggable` | `failed` (error prefix) | vendor / scan / get `--mode vendored` (cargo, v5.0): the copy's `Cargo.toml` has no literal `[package] version` string that can be rewritten byte-exactly (or it names another version); nothing is swapped in. A dry run over an already-vendored copy reports the same failure; a patch-service crate that cannot be tagged is a miss (`vendor_prebuilt_layout_mismatch`: `auto` builds locally, `service` fails `vendor_prebuilt_required`). |
 | `cargo_wiring_restored` | `skipped` (advisory note) | repair (v5.0): a vendored crate's Cargo.lock entry was detached with no Socket-owned `[patch]` pointing at its committed copy (a pre-v5 release overwrote its crate-named config key when a second version was vendored); the manifest entry is written back and the ledger updated (dry run: "would restore"). A `vendor` re-run heals the same state as a plain re-vendor. |
 | `cargo_manifest_unreadable` / `cargo_manifest_unparseable` / `cargo_manifest_symlink_unsupported` / `cargo_manifest_not_workspace_root` / `cargo_manifest_patch_source_alias` | `failed` | vendor / scan / get `--mode vendored` (cargo, v5.0): the workspace-root `Cargo.toml` cannot carry the vendored `[patch.crates-io]` entry (or cargo would ignore it there) — see the cargo caveat under "Vendored mode". Refused before any write. |
 | `vendor_would_revert_redirect` / `vendor_takeover_reverted_redirect` | `skipped` (advisory event) | vendor / scan / get `--mode vendored` over a hosted-redirected purl (cargo and the npm family, bun included): dry run — the per-purl hosted revert was PROBED and would succeed (for bun, only after the Bun vendored preflight accepted the lock; a refused lock is previewed as the wet run's `failed <code>` instead) / wet run — the hosted lockfile edits were reverted to their pre-redirect registry values and the redirect-ledger record dropped before vendoring (mode takeover). Fires on the run that takes over, not on re-runs. |
diff --git a/crates/socket-patch-cli/src/commands/repair_vendor.rs b/crates/socket-patch-cli/src/commands/repair_vendor.rs
index 2738f58b..c283c8d3 100644
--- a/crates/socket-patch-cli/src/commands/repair_vendor.rs
+++ b/crates/socket-patch-cli/src/commands/repair_vendor.rs
@@ -1659,8 +1659,11 @@ pub(crate) async fn repair_vendored_artifacts_with_references(
                 // here would delete the rebuild, strand the wired pair on a
                 // dead dir, and deterministically re-fail every later
                 // repair — so refresh the inventory from the verified
-                // rebuild instead, loudly.
-                if !from_backend
+                // rebuild instead, loudly. A backend entry whose inventory
+                // is the repaired entry's own (carried forward — the cargo
+                // backend records none) is the same case.
+                if (!from_backend
+                    || check_entry.artifact.file_inventory == c.entry.artifact.file_inventory)
                     && !c.reconstructed
                     && matches!(&health, ArtifactHealth::Corrupt { reason }
                         if reason == "vendor_inventory_mismatch")
diff --git a/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs b/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs
index 8ee8300a..be3eacb3 100644
--- a/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs
@@ -41,7 +41,12 @@
 //! `cargo-old-toolchains` CI leg). Also: a
 //! URL-spelled crates.io `[patch]` table is refused, an ancestor-directory
 //! config entry cannot silently shadow the vendored copy, and the pre-v5
-//! multi-version overwrite is healed by a re-run and by `repair`.
+//! multi-version overwrite is healed by a re-run and by `repair`. TRANSITIVE:
+//! a registry crate (`log 0.4.14`) that depends on the patched one follows
+//! the tag in every lock format (v1's full-id reference is rewritten) and
+//! links the patched copy under `--locked --offline`. REPAIR INVENTORY: a
+//! recorded whole-tree inventory carried onto a tagged rebuild is refreshed
+//! from the verified rebuild (`vendor_inventory_refreshed`), never deleted.
 //!
 //! A get-driven twin (`cargo_get_uuid_vendored_fresh_checkout_locked_build`,
 //! v3.6) reaches the same committed state through `get <uuid> --mode
@@ -360,6 +365,16 @@ fn find_registry_crate(cargo_home: &Path, leaf: &str) -> Option<PathBuf> {
 /// when the toolchain/network makes the fixture impossible (caller skips;
 /// `tag` names the calling test in the skip message).
 fn stage_fixture(tmp: &Path, tag: &str) -> Option<(PathBuf, PathBuf, String, PathBuf)> {
+    stage_fixture_with(tmp, tag, "")
+}
+
+/// [`stage_fixture`] with `extra_deps` (TOML lines) appended to the
+/// consumer's `[dependencies]`.
+fn stage_fixture_with(
+    tmp: &Path,
+    tag: &str,
+    extra_deps: &str,
+) -> Option<(PathBuf, PathBuf, String, PathBuf)> {
     let proj = tmp.join("proj");
     let cargo_home = tmp.join("cargo-home");
     std::fs::create_dir_all(proj.join("src")).unwrap();
@@ -367,7 +382,7 @@ fn stage_fixture(tmp: &Path, tag: &str) -> Option<(PathBuf, PathBuf, String, Pat
     std::fs::write(
         proj.join("Cargo.toml"),
         format!(
-            "[package]\nname = \"consumer\"\nversion = \"0.1.0\"\nedition = \"2021\"\n\n[dependencies]\n{DEP} = \"1.0\"\n"
+            "[package]\nname = \"consumer\"\nversion = \"0.1.0\"\nedition = \"2021\"\n\n[dependencies]\n{DEP} = \"1.0\"\n{extra_deps}"
         ),
     )
     .unwrap();
@@ -1435,6 +1450,200 @@ fn cargo_vendor_two_versions_of_one_crate_locked_build() {
     assert!(!proj.join(".socket/vendor").exists());
 }
 
+/// TRANSITIVE: the patched crate is also a dependency of a REGISTRY crate
+/// (`log 0.4.14` requires `cfg-if ^1.0`) — the usual real-world shape. The
+/// registry crate's own `dependencies` entry must follow the tag (a v1
+/// lock spells it `"cfg-if <v> (registry+…)"`, the form the detach
+/// rewrites to `"cfg-if <tagged>"`), so under every
+/// `SOCKET_PATCH_CARGO_E2E_LOCK_VERSION` the lock names no untagged
+/// cfg-if, `cargo run --locked --offline` links the patched bytes for both
+/// dependents, the lock is byte-stable across the build, and the revert
+/// restores it byte-identically.
+#[test]
+fn cargo_vendor_transitive_registry_dependent_locked_build() {
+    if !cargo_e2e_matrix::cargo_available("e2e_vendor_cargo_build (transitive)") {
+        return;
+    }
+    let tmp = tempfile::tempdir().unwrap();
+    let Some((proj, cargo_home, version, crate_dir)) =
+        stage_fixture_with(tmp.path(), "transitive", "log = \"=0.4.14\"\n")
+    else {
+        return;
+    };
+    let purl = format!("pkg:cargo/{DEP}@{version}");
+    let orig = std::fs::read(crate_dir.join("src/lib.rs")).unwrap();
+    let patched: Vec<u8> = [orig.as_slice(), PATCH_SUFFIX.as_bytes()].concat();
+    stage_patch(&proj, &purl, "src/lib.rs", &orig, &patched);
+    let lock_before = std::fs::read(proj.join("Cargo.lock")).unwrap();
+    let manifest_before = std::fs::read(proj.join("Cargo.toml")).unwrap();
+    let log_before = package_block(&String::from_utf8_lossy(&lock_before), "log")
+        .expect("the fixture locks log");
+    assert!(
+        log_before.contains(&format!("\"{DEP}")),
+        "the registry crate depends on {DEP}:\n{log_before}"
+    );
+
+    let env = vendor_ok(&proj, &cargo_home, "transitive");
+    assert_eq!(env["summary"]["failed"], 0, "{env}");
+    assert_tagged(&proj, &version, UUID, "transitive");
+    let lock = std::fs::read_to_string(proj.join("Cargo.lock")).unwrap();
+    let t = tagged(&version, UUID);
+    for stale in [
+        format!("\"{DEP} {version}\""),
+        format!("\"{DEP} {version} ("),
+    ] {
+        assert!(
+            !lock.contains(&stale),
+            "no dependency still names the untagged {DEP} ({stale}):\n{lock}"
+        );
+    }
+    let log_after = package_block(&lock, "log").unwrap();
+    if cargo_e2e_matrix::lock_format(&lock) == 1 {
+        assert!(
+            log_after.contains(&format!("\"{DEP} {t}\"")),
+            "v1: the registry crate's full-id reference follows the tag:\n{log_after}"
+        );
+    } else {
+        assert_eq!(
+            log_after, log_before,
+            "v2+: a plain-name reference needs nothing"
+        );
+    }
+
+    std::fs::write(proj.join("src/main.rs"), ORACLE_MAIN).unwrap();
+    let run = cargo(&proj, &["run", "-q", "--locked", "--offline"], &cargo_home);
+    assert!(
+        run.status.success()
+            && String::from_utf8_lossy(&run.stdout).contains(&oracle_line(&version, UUID)),
+        "the patched copy must be linked for the direct AND the transitive dependent.\n\
+         stdout:\n{}\nstderr:\n{}",
+        String::from_utf8_lossy(&run.stdout),
+        String::from_utf8_lossy(&run.stderr)
+    );
+    assert_eq!(
+        std::fs::read_to_string(proj.join("Cargo.lock")).unwrap(),
+        lock,
+        "the tagged lock is byte-stable across the locked build"
+    );
+    assert_eq!(metadata_version(&proj, &cargo_home), t);
+    assert_eq!(
+        lock.matches(&format!("name = \"{DEP}\"\n")).count(),
+        1,
+        "one {DEP} in the graph — the tagged copy — so log builds it too:\n{lock}"
+    );
+
+    std::fs::write(proj.join("src/main.rs"), "fn main() {}\n").unwrap();
+    revert_ok(&proj, &cargo_home, "transitive");
+    assert_eq!(std::fs::read(proj.join("Cargo.lock")).unwrap(), lock_before);
+    assert_eq!(
+        std::fs::read(proj.join("Cargo.toml")).unwrap(),
+        manifest_before
+    );
+    assert!(!proj.join(".socket/vendor").exists());
+}
+
+/// Plain-sha256 inventory of every file under `dir` (forward-slashed
+/// relative paths) — the ledger's `fileInventory` shape.
+fn dir_inventory(dir: &Path) -> serde_json::Map<String, serde_json::Value> {
+    fn walk(base: &Path, dir: &Path, out: &mut serde_json::Map<String, serde_json::Value>) {
+        for entry in std::fs::read_dir(dir).unwrap() {
+            let path = entry.unwrap().path();
+            if path.is_dir() {
+                walk(base, &path, out);
+            } else {
+                let rel = path
+                    .strip_prefix(base)
+                    .unwrap()
+                    .to_string_lossy()
+                    .replace('\\', "/");
+                let digest = hex::encode(Sha256::digest(std::fs::read(&path).unwrap()));
+                out.insert(rel, serde_json::Value::String(digest));
+            }
+        }
+    }
+    let mut out = serde_json::Map::new();
+    walk(dir, dir, &mut out);
+    out
+}
+
+/// `repair` over a pre-tag cargo vendor whose ledger carries a whole-tree
+/// inventory of ANOTHER build source's tree (an extra file the local
+/// rebuild does not reproduce) and whose copy is gone: the rebuild (tagged,
+/// with its lock retag) comes back from the backend as a fresh entry with
+/// the recorded inventory carried forward, the patched members verify, and
+/// the tree mismatch is refreshed from the verified rebuild
+/// (`vendor_inventory_refreshed`) — never a deleted rebuild stranding the
+/// wiring on a dead dir. The result builds `--locked --offline`.
+#[test]
+fn cargo_repair_refreshes_a_carried_inventory_over_a_verified_rebuild() {
+    if !cargo_e2e_matrix::cargo_available("e2e_vendor_cargo_build (repair-inventory)") {
+        return;
+    }
+    let tmp = tempfile::tempdir().unwrap();
+    let Some((proj, cargo_home, version, crate_dir)) =
+        stage_fixture(tmp.path(), "repair-inventory")
+    else {
+        return;
+    };
+    let purl = format!("pkg:cargo/{DEP}@{version}");
+    let copy_rel = format!(".socket/vendor/cargo/{UUID}/{DEP}-{version}");
+    let orig = std::fs::read(crate_dir.join("src/lib.rs")).unwrap();
+    let patched: Vec<u8> = [orig.as_slice(), PATCH_SUFFIX.as_bytes()].concat();
+    stage_patch(&proj, &purl, "src/lib.rs", &orig, &patched);
+    vendor_ok(&proj, &cargo_home, "repair-inventory");
+    untag_project(&proj, &version, UUID);
+
+    let copy = proj.join(&copy_rel);
+    std::fs::write(copy.join("PREBUILT_STUB"), "service-only file\n").unwrap();
+    let recorded = dir_inventory(&copy);
+    let state_path = proj.join(".socket/vendor/state.json");
+    let mut state: serde_json::Value =
+        serde_json::from_str(&std::fs::read_to_string(&state_path).unwrap()).unwrap();
+    state["entries"][purl.as_str()]["artifact"]["fileInventory"] =
+        serde_json::Value::Object(recorded.clone());
+    std::fs::write(&state_path, serde_json::to_string_pretty(&state).unwrap()).unwrap();
+    std::fs::remove_dir_all(&copy).unwrap();
+
+    let (code, stdout, stderr) = run_socket(
+        &proj,
+        &[
+            "repair",
+            "--json",
+            "--offline",
+            "--cwd",
+            proj.to_str().unwrap(),
+        ],
+        &cargo_home,
+    );
+    assert_eq!(
+        code, 0,
+        "repair failed.\nstdout:\n{stdout}\nstderr:\n{stderr}"
+    );
+    assert!(stdout.contains("vendor_inventory_refreshed"), "{stdout}");
+    assert!(stdout.contains("cargo_version_tagged"), "{stdout}");
+    assert_tagged(&proj, &version, UUID, "repair-inventory");
+    assert_eq!(std::fs::read(copy.join("src/lib.rs")).unwrap(), patched);
+    let state: serde_json::Value =
+        serde_json::from_str(&std::fs::read_to_string(&state_path).unwrap()).unwrap();
+    let inventory = state["entries"][purl.as_str()]["artifact"]["fileInventory"]
+        .as_object()
+        .unwrap_or_else(|| panic!("the refreshed inventory is persisted: {state}"));
+    assert!(!inventory.contains_key("PREBUILT_STUB"), "{inventory:?}");
+    assert_eq!(
+        inventory,
+        &dir_inventory(&copy),
+        "the verified rebuild's tree"
+    );
+
+    std::fs::write(proj.join("src/main.rs"), ORACLE_MAIN).unwrap();
+    let run = cargo(&proj, &["run", "-q", "--locked", "--offline"], &cargo_home);
+    assert!(
+        String::from_utf8_lossy(&run.stdout).contains(&oracle_line(&version, UUID)),
+        "the repaired copy builds: {}",
+        String::from_utf8_lossy(&run.stderr)
+    );
+}
+
 /// Turn the v5 wiring of `proj` into what a pre-v5 release wrote: the
 /// `[patch.crates-io]` entry in `.cargo/config.toml` (Cargo.toml without
 /// it), the copy and lock entry untagged, and the ledger's patch-entry
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/cargo.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/cargo.rs
index c3bc83f2..ad3908cf 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/cargo.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/cargo.rs
@@ -1171,10 +1171,18 @@ fn cargo_vendored_a_attests_every_flavor_without_manifest_or_ledgers() {
 #[test]
 fn cargo_vendored_a_attests_in_every_lock_version() {
     let api = Api::start(vec![(U, cargo_view(U))]);
+    let copy_toml = format!("{}/Cargo.toml", cargo_artifact(U));
+    let copy_at = |v: &str| format!("[package]\nname = \"{CRATE}\"\nversion = \"{v}\"\n");
     for version in 1..=4u8 {
         let fx = Fx::new();
         write_cargo_vendored(&fx, U, CargoVendored::Inline, PATCHED_RS);
-        for locked in [tagged_version(U), CRATE_VERSION.to_string()] {
+        // The tagged copy + tagged lock (v5), and the pre-tag shape: an
+        // untagged copy with its untagged lock entry.
+        for (copy, locked) in [
+            (tagged_version(U), tagged_version(U)),
+            (CRATE_VERSION.to_string(), CRATE_VERSION.to_string()),
+        ] {
+            fx.put(&copy_toml, copy_at(&copy));
             fx.put("Cargo.lock", cargo_lock_at(version, &locked, ""));
             let run = fx.vex(&["--proxy-url", &api.uri()]);
             assert_attested(
@@ -1183,10 +1191,41 @@ fn cargo_vendored_a_attests_in_every_lock_version() {
                 CARGO_PURL,
                 U,
                 "vendored",
-                &format!("lock v{version} at {locked}"),
+                &format!("lock v{version} at {locked}, copy at {copy}"),
             );
             assert!(warning_codes(&run).is_empty(), "v{version}: {}", run.env);
         }
+        // A TAGGED copy beside an untagged lock entry: cargo locks the copy
+        // at its tagged version, so the untagged entry is some other crate
+        // cargo built — never attested, and explained.
+        fx.put(&copy_toml, copy_at(&tagged_version(U)));
+        fx.put("Cargo.lock", cargo_lock_at(version, CRATE_VERSION, ""));
+        let run = fx.vex(&["--proxy-url", &api.uri()]);
+        assert_nothing_discovered(
+            &run,
+            &format!("lock v{version}: tagged copy, untagged lock"),
+        );
+        assert!(
+            warning_codes(&run)
+                .iter()
+                .any(|c| c == "patched_ref_invalid"),
+            "v{version}: {}",
+            run.env
+        );
+        // A copy whose own Cargo.toml is tagged for ANOTHER uuid than its
+        // path names is dead wiring, whatever the lock says.
+        fx.put(&copy_toml, copy_at(&tagged_version(OTHER_U)));
+        fx.put("Cargo.lock", cargo_lock_at(version, &tagged_version(U), ""));
+        let run = fx.vex(&["--proxy-url", &api.uri()]);
+        assert!(
+            run.doc.is_none()
+                && warning_codes(&run)
+                    .iter()
+                    .any(|c| c == "patched_ref_invalid"),
+            "v{version}: copy tagged for another uuid: {}",
+            run.env
+        );
+        fx.put(&copy_toml, copy_at(&tagged_version(U)));
 
         fx.put(
             "Cargo.lock",
@@ -1206,7 +1245,8 @@ fn cargo_vendored_a_attests_in_every_lock_version() {
 /// f: a detached lock entry tagged for ANOTHER patch uuid names a copy
 /// other than the one the `[patch]` points at (a config override elsewhere,
 /// or a stale wiring): never attested — in any lock format, with or
-/// without the ledger.
+/// without the ledger (a vendor ledger entry for the wired copy is dead
+/// evidence too: the lock does not build it).
 #[test]
 fn cargo_vendored_f_lock_tag_for_another_uuid_never_attests() {
     let api = Api::start(vec![(U, cargo_view(U)), (OTHER_U, cargo_view(OTHER_U))]);
@@ -1219,6 +1259,32 @@ fn cargo_vendored_f_lock_tag_for_another_uuid_never_attests() {
         );
         let run = fx.vex(&["--proxy-url", &api.uri()]);
         assert_nothing_discovered(&run, &format!("lock v{version} tagged for another uuid"));
+
+        write_vendor_ledger(
+            &fx,
+            "cargo",
+            CARGO_PURL,
+            U,
+            &cargo_artifact(U),
+            Some(cargo_record(U)),
+            &[
+                ("Cargo.toml", "cargo_patch_entry"),
+                ("Cargo.lock", "cargo_lock_entry"),
+            ],
+        );
+        for extra in [&["--offline"][..], &["--proxy-url", &api.uri()][..]] {
+            let run = fx.vex(extra);
+            assert!(
+                run.doc.is_none(),
+                "lock v{version} tagged for another uuid, ledger for U, {extra:?}: {}",
+                run.env
+            );
+            assert!(
+                run.code != Some(0) && run.env["status"] != "success",
+                "lock v{version}, ledger, {extra:?}: nothing attested: {}",
+                run.env
+            );
+        }
     }
 }
 
diff --git a/crates/socket-patch-cli/tests/mode_migration_cargo.rs b/crates/socket-patch-cli/tests/mode_migration_cargo.rs
index 3a212c9c..d8cd2fb6 100644
--- a/crates/socket-patch-cli/tests/mode_migration_cargo.rs
+++ b/crates/socket-patch-cli/tests/mode_migration_cargo.rs
@@ -695,6 +695,96 @@ async fn vendored_then_hosted_takeover_leaves_pure_hosted() {
     );
 }
 
+// ── no-lock vendor → first build → hosted takeover ─────────────────────────
+// Vendored before any Cargo.lock existed, the ledger records no lock
+// originals; the first build then locks the TAGGED copy. The takeover's
+// revert must drop that tag (back to the untagged sourceless entry), so the
+// redirect finds the crate by its version and the project ends fully hosted
+// and `--locked`-buildable — not a lock naming a tagged version nothing
+// provides.
+#[tokio::test(flavor = "multi_thread")]
+async fn lockless_vendor_then_first_build_then_hosted_takeover() {
+    let tmp = tempfile::tempdir().unwrap();
+    let Some((proj, cargo_home, version, crate_dir)) = stage_fixture(tmp.path()) else {
+        return;
+    };
+    let purl = format!("pkg:cargo/{DEP}@{version}");
+    let orig = std::fs::read(crate_dir.join("src/lib.rs")).unwrap();
+    let patched: Vec<u8> = [orig.as_slice(), PATCH_SUFFIX.as_bytes()].concat();
+    stage_patch(&proj, &purl, &orig, &patched);
+    std::fs::remove_file(proj.join("Cargo.lock")).unwrap();
+
+    let (code, stdout, stderr) = run_socket(
+        &proj,
+        &[
+            "vendor",
+            "--json",
+            "--offline",
+            "--cwd",
+            proj.to_str().unwrap(),
+        ],
+        &cargo_home,
+    );
+    assert_eq!(code, 0, "vendor failed: {stdout}\n{stderr}");
+    assert!(stdout.contains("no_lockfile"), "{stdout}");
+    assert_build_ok(
+        "first build (locks the tagged copy)",
+        &cargo(&proj, &["build", "--offline"], &cargo_home),
+    );
+    assert_lock_version(&proj, &tagged(&version, UUID_V), "first build");
+
+    let server = MockServer::start().await;
+    let crate_bytes =
+        build_patched_crate(&tmp.path().join("stage"), &crate_dir, &version, &patched);
+    mount_hosted_mocks(&server, &purl, &version, &crate_bytes, &orig, &patched).await;
+    let (code, stdout, stderr) = run_socket(
+        &proj,
+        &[
+            "scan",
+            "--mode",
+            "hosted",
+            "--json",
+            "--yes",
+            "--cwd",
+            proj.to_str().unwrap(),
+            "--api-url",
+            &server.uri(),
+            "--org",
+            ORG,
+            "--api-token",
+            "fake",
+        ],
+        &cargo_home,
+    );
+    assert_eq!(code, 0, "hosted scan failed: {stdout}\n{stderr}");
+    let envelope: serde_json::Value = serde_json::from_str(&stdout).expect("json envelope");
+    assert!(
+        stdout.contains("redirect_takeover_reverted_vendored"),
+        "takeover warning missing: {stdout}"
+    );
+    assert!(
+        !stdout.contains("redirect_cargo_lock_pkg_not_found"),
+        "the reverted lock names the crate by its version: {stdout}"
+    );
+    assert_eq!(envelope["redirect"]["redirected"], 1, "{stdout}");
+    assert_lock_version(&proj, &version, "lockless vendor -> hosted");
+    let lock_block = package_block(&read(&proj, "Cargo.lock"), DEP).unwrap_or_default();
+    assert!(
+        lock_block.contains("sparse+"),
+        "lock points hosted: {lock_block}"
+    );
+
+    let (fresh, home) = fresh_checkout(&proj, tmp.path(), "lockless");
+    assert_build_ok(
+        "cargo fetch --locked",
+        &cargo(&fresh, &["fetch", "--locked"], &home),
+    );
+    assert_build_ok(
+        "cargo build --locked",
+        &cargo(&fresh, &["build", "--locked"], &home),
+    );
+}
+
 // ── C2 / C7: hosted → vendored takeover via the plain `vendor` command ──────
 // The primary migration entry point must revert the hosted edits first (from
 // the redirect ledger), surface the takeover, leave the project PURELY
diff --git a/crates/socket-patch-core/src/vendor/cargo.rs b/crates/socket-patch-core/src/vendor/cargo.rs
index c2045a6a..603a74be 100644
--- a/crates/socket-patch-core/src/vendor/cargo.rs
+++ b/crates/socket-patch-core/src/vendor/cargo.rs
@@ -80,23 +80,26 @@ async fn is_vendored(project_root: &Path, name: &str, version: &str) -> bool {
 ///   socket-patch takeover) → `Some(false)` — the committed copy is NOT what
 ///   the lock consumes, so GC may reclaim the entry (its revert restores /
 ///   keeps the registry resolution and drops the dead `[patch]` wiring);
-/// * entry detached but TAGGED for another patch uuid → `Some(false)` (the
-///   lock builds another generation's copy);
-/// * entry detached (tagged for this entry's uuid, or untagged — vendored
-///   before tagged versions) AND a Socket-owned `[patch.crates-io]` entry
-///   (root manifest, or a legacy project-config one) points at THIS entry's
-///   committed copy → `Some(true)` (the wired vendored shape);
+/// * entry detached (tagged for any uuid, or untagged — vendored before
+///   tagged versions) AND a Socket-owned `[patch.crates-io]` entry (root
+///   manifest, or a legacy project-config one) points at THIS entry's
+///   committed copy → `Some(true)` (the wired vendored shape). A lock tag
+///   for ANOTHER uuid is then only stale (a checkout/merge of the lock from
+///   another patch generation): cargo re-locks any unlocked build to this
+///   copy, and the vendor hot path retags it — reclaiming the entry would
+///   leave the stale tag with no provider and silently build pristine
+///   crates.io bytes;
 /// * detached but the `[patch]` points elsewhere / is gone → `Some(false)`
-///   (nothing consumes the copy; the revert re-attaches the recorded
-///   registry originals, repairing the half-wired lock);
+///   (nothing consumes the copy — a lock tagged for another uuid builds
+///   that generation's copy; the revert re-attaches the recorded registry
+///   originals, repairing the half-wired lock);
 /// * no readable lock → `None` (cannot determine — callers keep, fail-safe).
 pub async fn vendored_entry_in_use(entry: &VendorEntry, project_root: &Path) -> Option<bool> {
     let (name, version) = parse_cargo_purl(&entry.base_purl)?;
-    match cargo_lock::probe_lock_entry(project_root, name, version).await {
+    match cargo_lock::probe_lock_entry_for(project_root, name, version, Some(&entry.uuid)).await {
         cargo_lock::LockEntryProbe::NoLockfile | cargo_lock::LockEntryProbe::Unreadable => None,
         cargo_lock::LockEntryProbe::EntryMissing => Some(false),
         cargo_lock::LockEntryProbe::Source(_) => Some(false),
-        cargo_lock::LockEntryProbe::Detached(Some(tag)) if tag != entry.uuid => Some(false),
         cargo_lock::LockEntryProbe::Detached(_) => {
             let marker = vendor_uuid_dir_rel("cargo", &entry.uuid)?;
             let wired = socket_patch_paths(project_root, name)
@@ -564,6 +567,10 @@ pub async fn vendor_cargo_crate(
     // already detached — exactly the shape this run produces.
     let prior_socket_copy = socket_copy_present(project_root, name, version).await;
 
+    // Wiring (manifest or legacy config) already points at THIS copy.
+    let points_here = prior_manifest_path.as_deref() == Some(copy_rel.as_str())
+        || legacy_paths.contains(&copy_rel);
+
     // A patch with no files is meaningless: no-op success, nothing wired.
     if record.files.is_empty() {
         return done(
@@ -597,6 +604,57 @@ pub async fn vendor_cargo_crate(
         if !legacy_paths.is_empty() {
             dry_warnings.push(migration_warning(project_root, name, version, true).await);
         }
+        // Preview the wet run's lock edit — unless a live hosted redirect
+        // still owns the lock entry: the wet run reverts it from the
+        // redirect ledger first, so its lock is not this one.
+        if hosted_redirect_residue(project_root, name, version)
+            .await
+            .is_none()
+        {
+            let (lock_probe, refusal) =
+                lock_tag_preflight(project_root, name, version, &record.uuid).await;
+            if let Some(refusal) = refusal {
+                return refusal;
+            }
+            // The hot path (re)tags a copy + detached lock vendored before
+            // tagged versions (or for another uuid): say so, and prove the
+            // copy takes the tag. A missing / stale copy is rebuilt tagged
+            // by the wet run, so only its lock retag is previewed.
+            if points_here
+                && matches!(
+                    lock_probe,
+                    cargo_lock::LockEntryProbe::Detached(_)
+                        | cargo_lock::LockEntryProbe::NoLockfile
+                )
+            {
+                let would_tag = if cargo_copy_matches(&copy_dir, &record.files).await {
+                    tag_vendored_copy(
+                        project_root,
+                        name,
+                        version,
+                        &record.uuid,
+                        &copy_dir,
+                        false,
+                        true,
+                    )
+                    .await
+                } else {
+                    Ok(matches!(
+                        &lock_probe,
+                        cargo_lock::LockEntryProbe::Detached(tag)
+                            if tag.as_deref() != Some(record.uuid.as_str())
+                    ))
+                };
+                match would_tag {
+                    Ok(true) => dry_warnings.push(tag_warning(name, version, &record.uuid, true)),
+                    Ok(false) => {}
+                    Err(e) => {
+                        result.success = false;
+                        result.error = Some(e);
+                    }
+                }
+            }
+        }
         return done(result, None, dry_warnings);
     }
 
@@ -624,38 +682,10 @@ pub async fn vendor_cargo_crate(
         );
     }
 
-    // Wiring (manifest or legacy config) already points at THIS copy.
-    let points_here = prior_manifest_path.as_deref() == Some(copy_rel.as_str())
-        || legacy_paths.contains(&copy_rel);
-
-    // The lock edit this run will make (a registry entry is detached and
-    // tagged; a detached one — an earlier generation, or vendored before
-    // tagged versions — is retagged) must be consistent: prove it before
-    // anything is written.
-    let lock_probe = cargo_lock::probe_lock_entry(project_root, name, version).await;
-    let preflight = match &lock_probe {
-        cargo_lock::LockEntryProbe::Source(_) => {
-            cargo_lock::detach_lock_entry(project_root, name, version, &record.uuid, true)
-                .await
-                .err()
-        }
-        cargo_lock::LockEntryProbe::Detached(tag)
-            if tag.as_deref() != Some(record.uuid.as_str()) =>
-        {
-            cargo_lock::retag_lock_entry(project_root, name, version, &record.uuid, true)
-                .await
-                .err()
-        }
-        _ => None,
-    };
-    if let Some(e @ LockEditError::Inconsistent(_)) = preflight {
-        return refused(
-            LOCK_UNTAGGABLE,
-            format!(
-                "cannot tag the Cargo.lock entry for {name}@{version} with the vendored \
-                 copy's version: {e}"
-            ),
-        );
+    let (lock_probe, lock_refusal) =
+        lock_tag_preflight(project_root, name, version, &record.uuid).await;
+    if let Some(refusal) = lock_refusal {
+        return refusal;
     }
 
     // Hot path: the wiring points here and the lock entry needs no detach
@@ -1180,10 +1210,12 @@ async fn cargo_copy_matches(
 /// Tag the committed copy at `copy_dir` and its DETACHED lock entry for
 /// `uuid` (an untagged copy vendored before tagged versions, or one tagged
 /// for a previous uuid). `Ok(true)` when anything changed (or, with
-/// `dry_run`, would). The lock retag is proven first; a failed lock write
-/// untags the copy again when this call tagged it (or `untag_on_failure`:
-/// the caller just rebuilt it tagged) so copy and lock never disagree.
-/// A missing lock needs no edit (the first build locks the tagged copy).
+/// `dry_run`, would — the dry run proves both edits, lock and copy
+/// manifest, writing nothing). The lock retag is proven first; a failed
+/// lock write untags the copy again when this call tagged it (or
+/// `untag_on_failure`: the caller just rebuilt it tagged) so copy and lock
+/// never disagree. A missing lock needs no edit (the first build locks the
+/// tagged copy).
 async fn tag_vendored_copy(
     project_root: &Path,
     name: &str,
@@ -1194,7 +1226,7 @@ async fn tag_vendored_copy(
     dry_run: bool,
 ) -> Result<bool, String> {
     let lock_retag = matches!(
-        cargo_lock::probe_lock_entry(project_root, name, version).await,
+        cargo_lock::probe_lock_entry_for(project_root, name, version, Some(uuid)).await,
         cargo_lock::LockEntryProbe::Detached(tag) if tag.as_deref() != Some(uuid)
     );
     if lock_retag {
@@ -1205,8 +1237,13 @@ async fn tag_vendored_copy(
             ));
         }
     }
-    let copy_retag = cargo_tag::copy_manifest_tag(copy_dir).await.as_deref() != Some(uuid);
     if dry_run {
+        let text = read_regular_to_string(&copy_dir.join("Cargo.toml"))
+            .await
+            .map_err(|e| format!("{COPY_UNTAGGABLE}: the copy's Cargo.toml: {e}"))?;
+        let copy_retag = cargo_tag::tag_manifest_text(&text, version, uuid)
+            .map_err(|e| format!("{COPY_UNTAGGABLE}: {e}"))?
+            .is_some();
         return Ok(lock_retag || copy_retag);
     }
     let copy_changed = cargo_tag::tag_copy_manifest(copy_dir, version, uuid)
@@ -1226,6 +1263,44 @@ async fn tag_vendored_copy(
     Ok(copy_changed || lock_retag)
 }
 
+/// The lock edit a vendor run makes (a registry entry is detached and
+/// tagged; a detached one — an earlier generation, or vendored before
+/// tagged versions — is retagged) must be consistent: prove it read-only
+/// before anything is written. Returns the probe and, when the edit cannot
+/// be made consistently, the [`LOCK_UNTAGGABLE`] refusal.
+async fn lock_tag_preflight(
+    project_root: &Path,
+    name: &str,
+    version: &str,
+    uuid: &str,
+) -> (cargo_lock::LockEntryProbe, Option<VendorOutcome>) {
+    let probe = cargo_lock::probe_lock_entry_for(project_root, name, version, Some(uuid)).await;
+    let preflight = match &probe {
+        cargo_lock::LockEntryProbe::Source(_) => {
+            cargo_lock::detach_lock_entry(project_root, name, version, uuid, true)
+                .await
+                .err()
+        }
+        cargo_lock::LockEntryProbe::Detached(tag) if tag.as_deref() != Some(uuid) => {
+            cargo_lock::retag_lock_entry(project_root, name, version, uuid, true)
+                .await
+                .err()
+        }
+        _ => None,
+    };
+    let refusal = match preflight {
+        Some(e @ LockEditError::Inconsistent(_)) => Some(refused(
+            LOCK_UNTAGGABLE,
+            format!(
+                "cannot tag the Cargo.lock entry for {name}@{version} with the vendored \
+                 copy's version: {e}"
+            ),
+        )),
+        _ => None,
+    };
+    (probe, refusal)
+}
+
 /// The [`VERSION_TAGGED`] advisory.
 fn tag_warning(name: &str, version: &str, uuid: &str, dry_run: bool) -> VendorWarning {
     VendorWarning::new(
@@ -1493,8 +1568,13 @@ pub async fn socket_wiring_present(project_root: &Path, name: &str, version: &st
 ///   `cargo_version_untagged` warning, nothing else undone).
 ///
 /// `Ok(Some((entry, warnings)))` is the updated ledger entry (the
-/// `cargo_patch_entry` record names `Cargo.toml`; a recorded file
-/// inventory is refreshed over the tagged copy); `Ok(None)` when there is
+/// `cargo_patch_entry` record names `Cargo.toml`). A recorded file
+/// inventory is KEPT as is: it was taken over the untagged copy, and the
+/// inventory check accepts the copy's `Cargo.toml` with exactly this
+/// entry's tag dropped (`verify::verify_vendored_patch_record`) — so the
+/// tag step never re-baselines the inventory over bytes nobody verified,
+/// and a copy that drifted before it was tagged still fails verification.
+/// `Ok(None)` when there is
 /// nothing to do; `Err` when the manifest cannot take the entry (nothing
 /// was changed).
 pub async fn migrate_legacy_wiring(
@@ -1522,7 +1602,7 @@ pub async fn migrate_legacy_wiring(
         .any(|(_, p)| cargo_manifest::normalize_socket_path(&p).as_deref() == Some(&copy_rel));
     let unwired_here = !legacy_here
         && matches!(
-            cargo_lock::probe_lock_entry(project_root, name, version).await,
+            cargo_lock::probe_lock_entry_for(project_root, name, version, Some(&entry.uuid)).await,
             cargo_lock::LockEntryProbe::Detached(_)
         )
         && !socket_wiring_present(project_root, name, version).await
@@ -1561,13 +1641,7 @@ pub async fn migrate_legacy_wiring(
         )
         .await
         {
-            Ok(true) => {
-                warnings.push(tag_warning(name, version, &entry.uuid, dry_run));
-                if !dry_run && migrated.artifact.file_inventory.is_some() {
-                    migrated.artifact.file_inventory =
-                        super::verify::compute_dir_inventory(&copy_dir).await.ok();
-                }
-            }
+            Ok(true) => warnings.push(tag_warning(name, version, &entry.uuid, dry_run)),
             Ok(false) => {}
             Err(e) => warnings.push(VendorWarning::new(
                 "cargo_version_untagged",
@@ -1771,6 +1845,26 @@ pub async fn revert_cargo_vendor_opts(
                 }
             }
         }
+    } else if matches!(
+        cargo_lock::probe_lock_entry_for(project_root, name, version, Some(&entry.uuid)).await,
+        cargo_lock::LockEntryProbe::Detached(Some(ref tag)) if *tag == entry.uuid
+    ) {
+        // Vendored before any Cargo.lock existed (no originals recorded):
+        // the first build then locked the tagged copy. Drop the tag, back
+        // to the untagged sourceless entry such a vendor always left — an
+        // unlocked build re-resolves it, and a hosted takeover finds it by
+        // its version; a tag nothing provides would do neither.
+        if let Err(e) =
+            cargo_lock::retag_lock_entry_to(project_root, name, version, version, dry_run).await
+        {
+            out.warnings.push(VendorWarning::new(
+                "lock_restore_skipped",
+                format!(
+                    "the Cargo.lock entry for {name}@{version} keeps the tagged version of \
+                     the removed copy ({e}); re-lock it with `cargo update -p {name}`"
+                ),
+            ));
+        }
     }
 
     if let Err(e) = cargo_manifest::drop_patch_entries(project_root, name, version, dry_run).await {
@@ -5348,8 +5442,9 @@ mod tests {
     }
 
     /// `repair`'s migration step tags an untagged copy + lock (dry run
-    /// writes nothing), and refreshes a recorded file inventory over the
-    /// tagged copy.
+    /// writes nothing) and KEEPS a recorded file inventory: it still
+    /// verifies over the tagged copy (the check drops exactly this uuid's
+    /// tag from `Cargo.toml`), so nothing is re-baselined.
     #[tokio::test]
     async fn repair_migration_tags_an_untagged_vendor() {
         let (dir, blobs, pristine, record) = fixture().await;
@@ -5385,29 +5480,81 @@ mod tests {
         assert_eq!(warnings[0].code, VERSION_TAGGED);
         assert!(lock_text(root).await.contains(&tagged(UUID)));
         assert!(copy_toml(root).await.contains(&tagged(UUID)));
-        assert_ne!(
-            migrated.artifact.file_inventory,
-            entry.artifact.file_inventory
-        );
         assert_eq!(
-            migrated.artifact.file_inventory,
-            Some(
-                crate::vendor::verify::compute_dir_inventory(&root.join(copy_rel()))
-                    .await
-                    .unwrap()
-            )
+            migrated.artifact.file_inventory, entry.artifact.file_inventory,
+            "the recorded inventory is kept, never re-baselined"
         );
+        crate::vendor::verify::verify_vendored_patch_record(root, &migrated, &record)
+            .await
+            .expect("the kept inventory verifies through this uuid's tag");
         assert!(migrate_legacy_wiring(&migrated, root, false)
             .await
             .unwrap()
             .is_none());
     }
 
+    /// A copy that drifted BEFORE it was tagged (an unpatched file edited,
+    /// or one planted) still fails the inventory check after the migration
+    /// tags it; so does a copy manifest tagged for another uuid.
+    #[tokio::test]
+    async fn repair_migration_never_launders_pre_tag_drift() {
+        for drift in ["manifest", "planted", "other_tag"] {
+            let (dir, blobs, pristine, record) = fixture().await;
+            let root = dir.path();
+            let (_, entry, _) =
+                expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
+            let mut entry = entry.unwrap();
+            untag_project(root).await;
+            let copy = root.join(copy_rel());
+            entry.artifact.file_inventory = Some(
+                crate::vendor::verify::compute_dir_inventory(&copy)
+                    .await
+                    .unwrap(),
+            );
+            match drift {
+                "manifest" => {
+                    let text = copy_toml(root).await + "build = \"build.rs\"\n";
+                    tokio::fs::write(copy.join("Cargo.toml"), text)
+                        .await
+                        .unwrap();
+                }
+                "planted" => {
+                    tokio::fs::write(copy.join("build.rs"), "fn main() {}\n")
+                        .await
+                        .unwrap();
+                }
+                _ => {}
+            }
+            let (migrated, _) = migrate_legacy_wiring(&entry, root, false)
+                .await
+                .unwrap()
+                .unwrap();
+            if drift == "other_tag" {
+                let text = copy_toml(root).await.replace(UUID, UUID2);
+                tokio::fs::write(copy.join("Cargo.toml"), text)
+                    .await
+                    .unwrap();
+            }
+            assert_eq!(
+                migrated.artifact.file_inventory,
+                entry.artifact.file_inventory
+            );
+            let err = crate::vendor::verify::verify_vendored_patch_record(root, &migrated, &record)
+                .await
+                .expect_err(drift);
+            assert!(err.contains("vendor_inventory_mismatch"), "{drift}: {err}");
+        }
+    }
+
     /// A lock whose detached entry is tagged for ANOTHER uuid while the
-    /// wiring points at this copy is retagged by a re-run; GC sees the
-    /// other-tagged lock as not consuming this entry's copy.
+    /// wiring points at this copy (a lock checked out from another patch
+    /// generation) is only stale: cargo re-locks an unlocked build to the
+    /// wired copy, so GC keeps the entry (reclaiming it would leave the
+    /// stale tag with no provider and build pristine crates.io bytes), the
+    /// other uuid's entry — wired nowhere — is reclaimable, and a re-run
+    /// retags the lock.
     #[tokio::test]
-    async fn stale_tag_is_retagged_and_gc_sees_it_unconsumed() {
+    async fn stale_tag_is_retagged_and_gc_keeps_the_wired_entry() {
         let (dir, blobs, pristine, record) = fixture().await;
         let root = dir.path();
         let (_, entry, _) =
@@ -5418,7 +5565,12 @@ mod tests {
         tokio::fs::write(root.join("Cargo.lock"), &stale)
             .await
             .unwrap();
-        assert_eq!(vendored_entry_in_use(&entry, root).await, Some(false));
+        assert_eq!(vendored_entry_in_use(&entry, root).await, Some(true));
+        assert_eq!(
+            vendored_entry_in_use(&ledger_entry_for(UUID2), root).await,
+            Some(false),
+            "the lock's uuid is wired nowhere"
+        );
 
         let (result, _, warnings) =
             expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
@@ -5471,7 +5623,8 @@ mod tests {
     }
 
     /// A lock the tag cannot be written into consistently (a v1 `replace`
-    /// naming the crate) refuses before anything is written.
+    /// naming the crate) refuses before anything is written — the dry run
+    /// previews the same refusal.
     #[tokio::test]
     async fn untaggable_lock_refuses_before_writing() {
         let (dir, blobs, pristine, record) = fixture().await;
@@ -5486,10 +5639,12 @@ mod tests {
             .await
             .unwrap();
         let manifest = tokio::fs::read(root.join("Cargo.toml")).await.unwrap();
-        expect_refused(
-            run_vendor(PURL, root, &blobs, &pristine, &record, false).await,
-            LOCK_UNTAGGABLE,
-        );
+        for dry_run in [true, false] {
+            expect_refused(
+                run_vendor(PURL, root, &blobs, &pristine, &record, dry_run).await,
+                LOCK_UNTAGGABLE,
+            );
+        }
         assert_eq!(lock_text(root).await, lock);
         assert_eq!(
             tokio::fs::read(root.join("Cargo.toml")).await.unwrap(),
@@ -5530,4 +5685,249 @@ mod tests {
         assert!(out.success, "{:?}", out.error);
         assert_eq!(lock_text(root).await, lock);
     }
+
+    /// Vendored before any Cargo.lock existed (no originals recorded), then
+    /// the first build locked the tagged copy: the revert drops the tag,
+    /// back to the untagged sourceless entry such a vendor always left (an
+    /// unlocked build re-resolves it; a hosted takeover finds it). A dry run
+    /// writes nothing.
+    #[tokio::test]
+    async fn revert_without_originals_drops_the_first_builds_tag() {
+        let (dir, blobs, pristine, record) = fixture().await;
+        let root = dir.path();
+        tokio::fs::remove_file(root.join("Cargo.lock"))
+            .await
+            .unwrap();
+        let (result, entry, warnings) =
+            expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
+        assert!(result.success, "{:?}", result.error);
+        assert!(warnings.iter().any(|w| w.code == "no_lockfile"));
+        let entry = entry.unwrap();
+        assert_eq!(entry.lock, None);
+        let first_build = format!(
+            "version = 4\n\n[[package]]\nname = \"app\"\nversion = \"0.1.0\"\n\
+             dependencies = [\n \"cfg-if\",\n]\n\n[[package]]\nname = \"cfg-if\"\nversion = \"{}\"\n",
+            tagged(UUID)
+        );
+        tokio::fs::write(root.join("Cargo.lock"), &first_build)
+            .await
+            .unwrap();
+
+        let dry = revert_cargo_vendor(&entry, root, true).await;
+        assert!(dry.success && dry.warnings.is_empty(), "{dry:?}");
+        assert_eq!(lock_text(root).await, first_build);
+
+        let out = revert_cargo_vendor(&entry, root, false).await;
+        assert!(out.success && out.warnings.is_empty(), "{out:?}");
+        assert_eq!(
+            lock_text(root).await,
+            first_build.replace(&tagged(UUID), "1.0.4")
+        );
+        assert!(!root.join(".socket/vendor").exists());
+    }
+
+    /// The same, when another uuid's tag is locked (not this entry's
+    /// copy): left alone.
+    #[tokio::test]
+    async fn revert_without_originals_leaves_another_uuids_tag() {
+        let (dir, blobs, pristine, record) = fixture().await;
+        let root = dir.path();
+        tokio::fs::remove_file(root.join("Cargo.lock"))
+            .await
+            .unwrap();
+        let (_, entry, _) =
+            expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
+        let other = format!(
+            "version = 4\n\n[[package]]\nname = \"cfg-if\"\nversion = \"{}\"\n",
+            tagged(UUID2)
+        );
+        tokio::fs::write(root.join("Cargo.lock"), &other)
+            .await
+            .unwrap();
+        let out = revert_cargo_vendor(&entry.unwrap(), root, false).await;
+        assert!(out.success, "{out:?}");
+        assert_eq!(lock_text(root).await, other);
+    }
+
+    /// The lock real cargo 1.97 writes once a workspace member path-depends
+    /// on its own same-version fork of the vendored crate: the fork's
+    /// untagged sourceless entry sorts before the tagged copy.
+    fn lock_with_fork(copy_version: &str, app_ref: &str) -> String {
+        format!(
+            "# This file is automatically @generated by Cargo.\n\
+             # It is not intended for manual editing.\n\
+             version = 4\n\n\
+             [[package]]\nname = \"app\"\nversion = \"0.1.0\"\ndependencies = [\n \"{app_ref}\",\n]\n\n\
+             [[package]]\nname = \"cfg-if\"\nversion = \"1.0.4\"\n\n\
+             [[package]]\nname = \"cfg-if\"\n{copy_version}\n\
+             [[package]]\nname = \"m\"\nversion = \"0.1.0\"\ndependencies = [\n \"cfg-if 1.0.4\",\n]\n"
+        )
+    }
+
+    /// A same-version path fork locked beside the vendored copy after the
+    /// vendor: re-runs stay in sync (no `locked_multi_source_conflict`), GC
+    /// sees the copy in use, and the revert restores the REGISTRY entry
+    /// (spelled by its full id beside the fork) — never the fork — leaving
+    /// exactly the lock cargo writes for the fork plus crates.io.
+    #[tokio::test]
+    async fn a_user_path_fork_beside_the_copy_survives_rerun_and_revert() {
+        let (dir, blobs, pristine, record) = fixture().await;
+        let root = dir.path();
+        let (_, entry, _) =
+            expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
+        let entry = entry.unwrap();
+        let t = tagged(UUID);
+        let with_fork = lock_with_fork(&format!("version = \"{t}\"\n"), &format!("cfg-if {t}"));
+        tokio::fs::write(root.join("Cargo.lock"), &with_fork)
+            .await
+            .unwrap();
+        assert_eq!(vendored_entry_in_use(&entry, root).await, Some(true));
+
+        let (result, again, warnings) =
+            expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
+        assert!(result.success, "{:?}", result.error);
+        assert!(again.is_none() && warnings.is_empty(), "{warnings:?}");
+        assert_eq!(lock_text(root).await, with_fork);
+
+        let out = revert_cargo_vendor(&entry, root, false).await;
+        assert!(out.success && out.warnings.is_empty(), "{out:?}");
+        assert_eq!(
+            lock_text(root).await,
+            lock_with_fork(
+                &format!("version = \"1.0.4\"\nsource = \"{SOURCE}\"\nchecksum = \"{CHECKSUM}\"\n"),
+                &format!("cfg-if 1.0.4 ({SOURCE})"),
+            )
+        );
+    }
+
+    /// Dry runs preview the wet run's tag work: `would tag` for an
+    /// untagged vendor (nothing written), and the wet run's refusals — a
+    /// lock the tag cannot be written into, a copy manifest that cannot
+    /// take it.
+    #[tokio::test]
+    async fn dry_runs_preview_the_tag_edit_and_its_refusals() {
+        let (dir, blobs, pristine, record) = fixture().await;
+        let root = dir.path();
+        expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
+        untag_project(root).await;
+        let lock = lock_text(root).await;
+        let copy = copy_toml(root).await;
+        let (result, entry, warnings) =
+            expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, true).await);
+        assert!(result.success && entry.is_none(), "{:?}", result.error);
+        let tag = warnings
+            .iter()
+            .find(|w| w.code == VERSION_TAGGED)
+            .unwrap_or_else(|| panic!("{warnings:?}"));
+        assert!(tag.detail.starts_with("would tag"), "{tag:?}");
+        assert_eq!(lock_text(root).await, lock, "dry run writes nothing");
+        assert_eq!(copy_toml(root).await, copy);
+
+        // A copy manifest that names another version cannot take the tag.
+        tokio::fs::write(
+            root.join(copy_rel()).join("Cargo.toml"),
+            copy.replace("1.0.4", "1.0.5"),
+        )
+        .await
+        .unwrap();
+        let (result, _, _) =
+            expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, true).await);
+        assert!(!result.success);
+        assert!(
+            result
+                .error
+                .as_deref()
+                .is_some_and(|e| e.starts_with(COPY_UNTAGGABLE)),
+            "{:?}",
+            result.error
+        );
+        let (wet, _, _) =
+            expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
+        assert!(!wet.success, "the wet run fails the same way");
+        assert_eq!(lock_text(root).await, lock);
+    }
+
+    /// A pristine crate whose `Cargo.toml` cannot take the tag
+    /// (a workspace-inherited version) fails the local build with
+    /// `cargo_copy_untaggable`: nothing is swapped in, no stage or vendor
+    /// dir survives, and the manifest and lock are untouched. The same
+    /// crate from the patch service is a MISS: auto mode falls back to the
+    /// local build.
+    #[tokio::test]
+    async fn an_untaggable_copy_manifest_swaps_nothing_in() {
+        let (dir, blobs, pristine, record) = fixture().await;
+        let root = dir.path();
+        tokio::fs::write(
+            pristine.join("Cargo.toml"),
+            "[package]\nname = \"cfg-if\"\nversion.workspace = true\n",
+        )
+        .await
+        .unwrap();
+        let manifest = tokio::fs::read(root.join("Cargo.toml")).await.unwrap();
+        let (result, entry, _) =
+            expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
+        assert!(!result.success && entry.is_none());
+        assert!(
+            result
+                .error
+                .as_deref()
+                .is_some_and(|e| e.starts_with(COPY_UNTAGGABLE)),
+            "{:?}",
+            result.error
+        );
+        assert!(
+            !root.join(".socket/vendor").exists(),
+            "no copy, stage or husk"
+        );
+        assert_eq!(lock_text(root).await, lock_body());
+        assert_eq!(
+            tokio::fs::read(root.join("Cargo.toml")).await.unwrap(),
+            manifest
+        );
+
+        // Service crate untaggable, pristine fine: auto falls back.
+        let (dir, blobs, pristine, record) = fixture().await;
+        let root = dir.path();
+        let crate_tgz = make_crate_tgz(
+            "cfg-if-1.0.4",
+            &[
+                (
+                    "Cargo.toml",
+                    b"[package]\nname = \"cfg-if\"\nversion.workspace = true\n",
+                ),
+                ("src/lib.rs", PATCHED),
+            ],
+        );
+        let sri = sri_sha512(&crate_tgz);
+        let server = wiremock::MockServer::start().await;
+        mount_cargo_granted(&server, &sri, &crate_tgz).await;
+        let sources = PatchSources::blobs_only(&blobs);
+        let outcome = vendor_cargo_crate(
+            PURL,
+            &pristine,
+            root,
+            &record,
+            &sources,
+            "2026-06-09T00:00:00Z",
+            false,
+            false,
+            Some(&cargo_service_cfg(&server.uri(), VendorSource::Auto, false)),
+        )
+        .await;
+        let (result, entry, warnings) = expect_done(outcome);
+        assert!(result.success, "{:?}", result.error);
+        assert!(entry.is_some());
+        assert!(
+            warnings
+                .iter()
+                .any(|w| w.code == "vendor_prebuilt_layout_mismatch"
+                    && w.detail.contains("cannot tag its version")),
+            "{warnings:?}"
+        );
+        assert!(
+            copy_toml(root).await.contains(&tagged(UUID)),
+            "the local build"
+        );
+        assert_eq!(tokio::fs::read(copy_lib(root)).await.unwrap(), PATCHED);
+    }
 }
diff --git a/crates/socket-patch-core/src/vendor/cargo_lock.rs b/crates/socket-patch-core/src/vendor/cargo_lock.rs
index ea834078..b3de2ffa 100644
--- a/crates/socket-patch-core/src/vendor/cargo_lock.rs
+++ b/crates/socket-patch-core/src/vendor/cargo_lock.rs
@@ -16,7 +16,12 @@
 //! `dependencies` arrays disambiguate with FULL package-id strings
 //! (`"cfg-if 1.0.0 (registry+…)"`); detaching `source`/`checksum` from one
 //! entry dangles those references and breaks `--locked` builds. Vendor
-//! refuses that shape upstream via [`count_lock_entries`].
+//! refuses that shape upstream via [`count_lock_entries`]. Once a copy is
+//! vendored, a user's same-version PATH crate may still be locked beside it
+//! (an untagged sourceless `"<name> <version>"` next to the tagged copy):
+//! every helper here selects entries by [`entry_rank`], so the fork is never
+//! mistaken for the copy, and the restore spells the registry entry by its
+//! full id while the fork shares its name+version.
 //!
 //! The lock is generated-but-committed, so edits are text-preserving
 //! (`toml_edit`): untouched entries, the `@generated` header comment, and the
@@ -114,23 +119,58 @@ pub(crate) async fn read_lock(
     Ok((path, doc))
 }
 
-/// The `[[package]]` table for `name` whose version DENOTES `version` —
-/// the version itself or a Socket-tagged spelling of it (multi-entry
-/// name+version shapes are refused upstream by [`count_lock_entries`]).
-fn find_denoting_mut<'a>(
+/// How strongly a `[[package]]` at `found` (with a `source` or not) is THE
+/// entry Socket's lock edits for `version` (and patch `uuid`, when known)
+/// act on — lower wins, `None` when it does not denote `version` at all:
+///
+/// 0. sourceless at exactly `<version>+socket.<uuid>` (this patch's copy);
+/// 1. sourceless and Socket-tagged for another uuid (another copy);
+/// 2. registry-sourced (the pre-vendor / re-resolved shape);
+/// 3. sourceless and untagged — a copy vendored before tagged versions, or
+///    a user's own same-version path crate: real cargo 1.97 locks a
+///    member's path fork `cfg-if 1.0.4` beside the tagged copy
+///    `cfg-if 1.0.4+socket.<uuid>` (sorted first), so an untagged
+///    sourceless entry is only ever picked when nothing better denotes the
+///    version.
+fn entry_rank(found: &str, sourced: bool, version: &str, uuid: Option<&str>) -> Option<u8> {
+    if !cargo_tag::denotes(found, version) {
+        return None;
+    }
+    Some(match (sourced, cargo_tag::tag_uuid(found)) {
+        (false, Some(tag)) if Some(tag) == uuid => 0,
+        (false, Some(_)) => 1,
+        (true, _) => 2,
+        (false, None) => 3,
+    })
+}
+
+/// Index (into the `[[package]]` array) of the entry for `name` that
+/// [`entry_rank`] picks for `version`/`uuid`; ties keep lock order.
+fn pick_index(doc: &DocumentMut, name: &str, version: &str, uuid: Option<&str>) -> Option<usize> {
+    doc.get("package")?
+        .as_array_of_tables()?
+        .iter()
+        .enumerate()
+        .filter(|(_, t)| t.get("name").and_then(Item::as_str) == Some(name))
+        .filter_map(|(i, t)| {
+            let found = t.get("version").and_then(Item::as_str)?;
+            entry_rank(found, t.contains_key("source"), version, uuid).map(|r| (r, i))
+        })
+        .min()
+        .map(|(_, i)| i)
+}
+
+/// The `[[package]]` table [`pick_index`] selects.
+fn find_entry_mut<'a>(
     doc: &'a mut DocumentMut,
     name: &str,
     version: &str,
+    uuid: Option<&str>,
 ) -> Option<&'a mut Table> {
+    let idx = pick_index(doc, name, version, uuid)?;
     doc.get_mut("package")?
         .as_array_of_tables_mut()?
-        .iter_mut()
-        .find(|t| {
-            t.get("name").and_then(Item::as_str) == Some(name)
-                && t.get("version")
-                    .and_then(Item::as_str)
-                    .is_some_and(|v| cargo_tag::denotes(v, version))
-        })
+        .get_mut(idx)
 }
 
 /// Replace the entry's `version` value, keeping its formatting.
@@ -218,44 +258,92 @@ pub(crate) fn unused_patches(doc: &DocumentMut) -> Vec<(String, String)> {
         .unwrap_or_default()
 }
 
+/// How `Cargo.lock` relates to the `[patch]` path copy of `name`@`version`
+/// vendored for patch `uuid` ([`vendored_copy_claim`]).
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) enum CopyClaim<'a> {
+    /// The lock builds this copy.
+    Consumed,
+    /// The lock builds the copy tagged for ANOTHER patch uuid (and none
+    /// tagged for this one): a stale lock, or a `[patch]` override
+    /// elsewhere.
+    OtherTag(&'a str),
+    /// The copy is tagged, but the lock holds only UNTAGGED sourceless
+    /// entries: cargo built some other untagged crate (a config-level
+    /// override, a user path dependency), never this copy.
+    UntaggedOverride,
+    /// No sourceless entry for it, or cargo recorded the patch as
+    /// `[[patch.unused]]`.
+    NotConsumed,
+}
+
 /// Whether the lock BUILDS the `[patch]` path copy of `name`@`version`
-/// vendored for patch `uuid`: it holds a SOURCELESS `[[package]]` for that
-/// name at the copy's tagged version `<version>+socket.<uuid>` — or, for a
-/// copy vendored before tagged versions, at the untagged version — and no
-/// `[[patch.unused]]` entry for it. A sourceless entry tagged for ANOTHER
-/// uuid is another copy's resolution: not this one. A sourceless entry alone
-/// does not prove the copy builds — a path dependency on the user's own
-/// checkout of the crate is sourceless too, and cargo records the `[patch]`
-/// it resolved but left out of the graph as `[[patch.unused]]` (real cargo
-/// 1.97: `serde = { path = "my-serde" }` beside a stale `[patch]` locks a
-/// sourceless serde AND `[[patch.unused]] serde`).
-pub(crate) fn vendored_copy_consumed(
-    pkgs: &[LockedPackage],
+/// vendored for patch `uuid`. `copy_tagged`: the copy's own `Cargo.toml`
+/// carries a Socket version tag (every copy vendored since tagged
+/// versions; `false` for a copy vendored before them, or none on disk).
+///
+/// * a SOURCELESS entry at the tagged version `<version>+socket.<uuid>`
+///   (and no `[[patch.unused]]` for it) is this copy — whatever untagged
+///   sourceless siblings exist (real cargo 1.97 locks a member's own path
+///   dependency on a same-version fork beside the tagged copy);
+/// * otherwise a sourceless entry tagged for ANOTHER uuid is another
+///   copy's resolution → [`CopyClaim::OtherTag`], even beside an untagged
+///   sibling;
+/// * an UNTAGGED sourceless entry is the pre-tag legacy shape only while
+///   the copy is untagged too: cargo locks a tagged copy at its tagged
+///   version, so for a tagged copy the untagged entry is something else
+///   cargo built → [`CopyClaim::UntaggedOverride`].
+///
+/// A sourceless entry alone does not prove the copy builds — a path
+/// dependency on the user's own checkout of the crate is sourceless too,
+/// and cargo records the `[patch]` it resolved but left out of the graph as
+/// `[[patch.unused]]` (real cargo 1.97: `serde = { path = "my-serde" }`
+/// beside a stale `[patch]` locks a sourceless serde AND
+/// `[[patch.unused]] serde`).
+pub(crate) fn vendored_copy_claim<'a>(
+    pkgs: &'a [LockedPackage],
     unused: &[(String, String)],
     name: &str,
     version: &str,
     uuid: &str,
-) -> bool {
-    pkgs.iter().any(|p| {
-        p.name == name
-            && p.source.is_none()
-            && (p.version == version || cargo_tag::split_tag(&p.version) == Some((version, uuid)))
-    }) && !unused
+    copy_tagged: bool,
+) -> CopyClaim<'a> {
+    let mut own = false;
+    let mut other: Option<&'a str> = None;
+    let mut untagged = false;
+    for p in pkgs
         .iter()
-        .any(|(n, v)| n == name && cargo_tag::denotes(v, version))
-}
-
-/// The uuid of the Socket tag on the SOURCELESS `[[package]]` for `name`
-/// that denotes `version`: `Some(None)` for an untagged sourceless entry,
-/// `None` when there is no sourceless entry for it.
-pub(crate) fn detached_tag<'a>(
-    pkgs: &'a [LockedPackage],
-    name: &str,
-    version: &str,
-) -> Option<Option<&'a str>> {
-    pkgs.iter()
-        .find(|p| p.name == name && p.source.is_none() && cargo_tag::denotes(&p.version, version))
-        .map(|p| cargo_tag::tag_uuid(&p.version))
+        .filter(|p| p.name == name && p.source.is_none() && cargo_tag::denotes(&p.version, version))
+    {
+        match cargo_tag::tag_uuid(&p.version) {
+            Some(tag) if tag == uuid => own = true,
+            Some(tag) => {
+                other.get_or_insert(tag);
+            }
+            None => untagged = true,
+        }
+    }
+    let unused_hit = unused
+        .iter()
+        .any(|(n, v)| n == name && cargo_tag::denotes(v, version));
+    if own {
+        return if unused_hit {
+            CopyClaim::NotConsumed
+        } else {
+            CopyClaim::Consumed
+        };
+    }
+    if let Some(tag) = other {
+        return CopyClaim::OtherTag(tag);
+    }
+    if !untagged || unused_hit {
+        return CopyClaim::NotConsumed;
+    }
+    if copy_tagged {
+        CopyClaim::UntaggedOverride
+    } else {
+        CopyClaim::Consumed
+    }
 }
 
 /// A v1 lock: no top-level `version` key and a `[metadata]` table (kept,
@@ -409,7 +497,28 @@ pub async fn detach_lock_entry(
     dry_run: bool,
 ) -> Result<CargoLockOriginal, LockEditError> {
     let (path, mut doc) = read_lock(project_root).await?;
-    let table = find_denoting_mut(&mut doc, name, version).ok_or(LockEditError::EntryMissing)?;
+    // The registry entry is what gets detached (an entry already at the
+    // tagged version beside it then refuses in `ensure_consistent`).
+    let registry = doc
+        .get("package")
+        .and_then(Item::as_array_of_tables)
+        .and_then(|pkgs| {
+            pkgs.iter().position(|t| {
+                t.get("name").and_then(Item::as_str) == Some(name)
+                    && t.contains_key("source")
+                    && t.get("version")
+                        .and_then(Item::as_str)
+                        .is_some_and(|v| cargo_tag::denotes(v, version))
+            })
+        });
+    let table = match registry {
+        Some(idx) => doc
+            .get_mut("package")
+            .and_then(Item::as_array_of_tables_mut)
+            .and_then(|pkgs| pkgs.get_mut(idx)),
+        None => find_entry_mut(&mut doc, name, version, Some(uuid)),
+    }
+    .ok_or(LockEditError::EntryMissing)?;
 
     // A workspace/path/git dependency has no `source` — vendoring it would be
     // wrong (the user already controls those bytes); refuse.
@@ -468,7 +577,10 @@ pub async fn retag_lock_entry(
 }
 
 /// [`retag_lock_entry`] to an explicit `target` spelling of `version`
-/// (tagged or not).
+/// (tagged or not). The entry moved is the one already at `target`, else a
+/// Socket-tagged sourceless one, else the untagged sourceless one
+/// ([`entry_rank`]) — never a user's untagged path fork beside a tagged
+/// copy.
 pub async fn retag_lock_entry_to(
     project_root: &Path,
     name: &str,
@@ -477,7 +589,8 @@ pub async fn retag_lock_entry_to(
     dry_run: bool,
 ) -> Result<Option<String>, LockEditError> {
     let (path, mut doc) = read_lock(project_root).await?;
-    let table = find_denoting_mut(&mut doc, name, version).ok_or(LockEditError::EntryMissing)?;
+    let table = find_entry_mut(&mut doc, name, version, cargo_tag::tag_uuid(target))
+        .ok_or(LockEditError::EntryMissing)?;
     if table.get("source").is_some() {
         return Err(LockEditError::Inconsistent(format!(
             "the entry for {name} {version} still carries a registry source"
@@ -507,7 +620,17 @@ pub async fn retag_lock_entry_to(
 /// dropped), already carries a `source` (cargo/the user re-resolved it), or
 /// is tagged for ANOTHER patch — in which case the lock is left alone and
 /// the caller warns instead of clobbering a newer resolution. An untagged
-/// sourceless entry (vendored before tagged versions) is restored.
+/// sourceless entry (vendored before tagged versions) is restored only when
+/// nothing better denotes the version ([`entry_rank`]).
+///
+/// A user's own same-version path crate locked beside the tagged copy (a
+/// sourceless `"<name> <version>"`, which cargo sorts first) is never
+/// touched: the tagged entry is restored, and since the restored registry
+/// entry then shares its name+version with that sibling, dependents name it
+/// by its full id `"<name> <version> (<source>)"` — exactly the lock cargo
+/// writes for the fork plus the registry crate (real cargo 1.97). A
+/// registry entry for the same source already beside it (a partial
+/// re-resolve) is `Ok(false)`.
 pub async fn restore_lock_entry(
     project_root: &Path,
     name: &str,
@@ -518,7 +641,27 @@ pub async fn restore_lock_entry(
 ) -> Result<bool, LockEditError> {
     let (path, mut doc) = read_lock(project_root).await?;
     let v1 = is_v1_lock(&doc);
-    let Some(table) = find_denoting_mut(&mut doc, name, version) else {
+    let Some(idx) = pick_index(&doc, name, version, Some(uuid)) else {
+        return Ok(false);
+    };
+    // Same-name entries already at the plain `version` besides this one.
+    let siblings: Vec<Option<String>> = doc
+        .get("package")
+        .and_then(Item::as_array_of_tables)
+        .into_iter()
+        .flat_map(|pkgs| pkgs.iter().enumerate())
+        .filter(|(i, t)| {
+            *i != idx
+                && t.get("name").and_then(Item::as_str) == Some(name)
+                && t.get("version").and_then(Item::as_str) == Some(version)
+        })
+        .map(|(_, t)| t.get("source").and_then(Item::as_str).map(str::to_string))
+        .collect();
+    let Some(table) = doc
+        .get_mut("package")
+        .and_then(Item::as_array_of_tables_mut)
+        .and_then(|pkgs| pkgs.get_mut(idx))
+    else {
         return Ok(false);
     };
     if table.get("source").is_some() {
@@ -532,6 +675,13 @@ pub async fn restore_lock_entry(
     if current != version && cargo_tag::tag_uuid(&current) != Some(uuid) {
         return Ok(false);
     }
+    if siblings
+        .iter()
+        .any(|s| s.as_deref() == Some(original.source.as_str()))
+    {
+        return Ok(false);
+    }
+    let ambiguous = !siblings.is_empty();
     set_version(table, version);
 
     table.insert("source", toml_edit::value(original.source.as_str()));
@@ -565,8 +715,9 @@ pub async fn restore_lock_entry(
         }
     }
     // Dependents named the detached entry `"<name> <tagged>"`: back to the
-    // original spelling (v1's full id, v2+'s `"<name> <version>"`).
-    let back = if v1 {
+    // original spelling (v1's full id, v2+'s `"<name> <version>"` — or the
+    // full id too while a same-version sibling makes that ambiguous).
+    let back = if v1 || ambiguous {
         format!("{name} {version} ({})", original.source)
     } else {
         format!("{name} {version}")
@@ -625,6 +776,20 @@ pub enum LockEntryProbe {
 /// read as [`LockEntryProbe::Unreadable`] so callers stay fail-safe (cannot
 /// determine ⇒ keep / stay silent).
 pub async fn probe_lock_entry(project_root: &Path, name: &str, version: &str) -> LockEntryProbe {
+    probe_lock_entry_for(project_root, name, version, None).await
+}
+
+/// [`probe_lock_entry`] for the copy of patch `uuid`: of several entries
+/// denoting the version, the one [`entry_rank`] picks — this patch's tagged
+/// entry, else another Socket-tagged one, else a registry one, else an
+/// untagged sourceless one (so a user's same-version path fork beside the
+/// tagged copy never masks it).
+pub async fn probe_lock_entry_for(
+    project_root: &Path,
+    name: &str,
+    version: &str,
+    uuid: Option<&str>,
+) -> LockEntryProbe {
     let doc = match read_lock(project_root).await {
         Ok((_path, doc)) => doc,
         Err(LockEditError::NoLockfile) => return LockEntryProbe::NoLockfile,
@@ -632,7 +797,10 @@ pub async fn probe_lock_entry(project_root: &Path, name: &str, version: &str) ->
     };
     match locked_packages(&doc)
         .into_iter()
-        .find(|p| p.name == name && cargo_tag::denotes(&p.version, version))
+        .filter(|p| p.name == name)
+        .filter_map(|p| entry_rank(&p.version, p.source.is_some(), version, uuid).map(|r| (r, p)))
+        .min_by_key(|(r, _)| *r)
+        .map(|(_, p)| p)
     {
         None => LockEntryProbe::EntryMissing,
         Some(LockedPackage {
@@ -650,13 +818,27 @@ pub async fn probe_lock_entry(project_root: &Path, name: &str, version: &str) ->
 /// callers refuse to vendor it. A missing/unparseable lock (or one without a
 /// `[[package]]` array) counts zero: the same "no usable lock" treatment as
 /// [`read_locked_versions`].
+///
+/// An untagged sourceless entry beside a Socket-tagged sourceless one does
+/// not count: it is a user's same-version path crate that cargo locks next
+/// to the vendored copy (dependents name each by its distinct version), and
+/// the only lock edits a vendored crate still needs — a retag between tags —
+/// never touch it.
 pub async fn count_lock_entries(project_root: &Path, name: &str, version: &str) -> usize {
     let Ok((_path, doc)) = read_lock(project_root).await else {
         return 0;
     };
-    locked_packages(&doc)
-        .iter()
+    let hits: Vec<LockedPackage> = locked_packages(&doc)
+        .into_iter()
         .filter(|p| p.name == name && cargo_tag::denotes(&p.version, version))
+        .collect();
+    let untagged_detached =
+        |p: &LockedPackage| p.source.is_none() && cargo_tag::tag_uuid(&p.version).is_none();
+    let tagged_detached = hits
+        .iter()
+        .any(|p| p.source.is_none() && cargo_tag::tag_uuid(&p.version).is_some());
+    hits.iter()
+        .filter(|p| !(tagged_detached && untagged_detached(p)))
         .count()
 }
 
@@ -1474,50 +1656,186 @@ mod tests {
         let tagged = format!("1.0.4+socket.{UUID}");
         let other = format!("1.0.4+socket.{UUID2}");
         let none: Vec<(String, String)> = Vec::new();
-        assert!(vendored_copy_consumed(
-            &[pkg(&tagged, None)],
-            &none,
-            "cfg-if",
-            "1.0.4",
-            UUID
-        ));
-        assert!(!vendored_copy_consumed(
-            &[pkg(&other, None)],
-            &none,
-            "cfg-if",
-            "1.0.4",
-            UUID
-        ));
-        assert!(
-            vendored_copy_consumed(&[pkg("1.0.4", None)], &none, "cfg-if", "1.0.4", UUID),
-            "an untagged pre-tag vendor still counts"
-        );
-        assert!(!vendored_copy_consumed(
-            &[pkg("1.0.4", Some(SOURCE))],
-            &none,
-            "cfg-if",
-            "1.0.4",
-            UUID
-        ));
-        let unused = vec![("cfg-if".to_string(), tagged.clone())];
-        assert!(!vendored_copy_consumed(
-            &[pkg(&tagged, None)],
-            &unused,
-            "cfg-if",
-            "1.0.4",
-            UUID
-        ));
+        let claim = |pkgs: &[LockedPackage], unused: &[(String, String)], copy_tagged: bool| {
+            format!(
+                "{:?}",
+                vendored_copy_claim(pkgs, unused, "cfg-if", "1.0.4", UUID, copy_tagged)
+            )
+        };
+        let consumed = format!("{:?}", CopyClaim::Consumed);
+        let not = format!("{:?}", CopyClaim::NotConsumed);
+        let other_tag = format!("{:?}", CopyClaim::OtherTag(UUID2));
+        let override_ = format!("{:?}", CopyClaim::UntaggedOverride);
+        assert_eq!(claim(&[pkg(&tagged, None)], &none, true), consumed);
+        assert_eq!(claim(&[pkg(&other, None)], &none, true), other_tag);
         assert_eq!(
-            detached_tag(&[pkg(&other, None)], "cfg-if", "1.0.4"),
-            Some(Some(UUID2))
+            claim(&[pkg("1.0.4", None)], &none, false),
+            consumed,
+            "an untagged pre-tag vendor (untagged copy) still counts"
         );
         assert_eq!(
-            detached_tag(&[pkg("1.0.4", None)], "cfg-if", "1.0.4"),
-            Some(None)
+            claim(&[pkg("1.0.4", None)], &none, true),
+            override_,
+            "cargo locks a TAGGED copy at its tagged version: an untagged entry is \
+             something else cargo built"
         );
-        assert_eq!(
-            detached_tag(&[pkg("1.0.4", Some(SOURCE))], "cfg-if", "1.0.4"),
-            None
+        assert_eq!(claim(&[pkg("1.0.4", Some(SOURCE))], &none, true), not);
+        assert_eq!(claim(&[], &none, false), not);
+        let unused = vec![("cfg-if".to_string(), tagged.clone())];
+        assert_eq!(claim(&[pkg(&tagged, None)], &unused, true), not);
+        // A user's same-version path fork beside a copy (cargo sorts the
+        // untagged entry first): the tag decides, in either order.
+        for pkgs in [
+            [pkg("1.0.4", None), pkg(&other, None)],
+            [pkg(&other, None), pkg("1.0.4", None)],
+        ] {
+            assert_eq!(claim(&pkgs, &none, true), other_tag, "{pkgs:?}");
+            assert_eq!(claim(&pkgs, &none, false), other_tag, "{pkgs:?}");
+        }
+        for pkgs in [
+            [pkg("1.0.4", None), pkg(&tagged, None)],
+            [pkg(&tagged, None), pkg("1.0.4", None)],
+        ] {
+            assert_eq!(claim(&pkgs, &none, true), consumed, "{pkgs:?}");
+        }
+    }
+
+    /// The lock real cargo 1.97 writes for a workspace whose member `m`
+    /// path-depends on its own same-version fork of cfg-if 1.0.4 while
+    /// `app` builds the vendored copy tagged for `UUID` (the fork sorts
+    /// first) — and, unpatched, the lock cargo writes for the fork plus the
+    /// crates.io crate (dependents then name the registry one by full id).
+    fn fork_locks(v1: bool) -> (String, String) {
+        let tagged = format!("1.0.4+socket.{UUID}");
+        let header = if v1 {
+            ""
+        } else {
+            "# This file is automatically @generated by Cargo.\n\
+             # It is not intended for manual editing.\n\
+             version = 4\n\n"
+        };
+        let entries = |app_ref: &str, copy: &str| {
+            format!(
+                "{header}[[package]]\nname = \"app\"\nversion = \"0.1.0\"\ndependencies = [\n \"{app_ref}\",\n]\n\n\
+                 [[package]]\nname = \"cfg-if\"\nversion = \"1.0.4\"\n\n\
+                 [[package]]\nname = \"cfg-if\"\n{copy}\n\
+                 [[package]]\nname = \"m\"\nversion = \"0.1.0\"\ndependencies = [\n \"cfg-if 1.0.4\",\n]\n"
+            )
+        };
+        let patched = entries(
+            &format!("cfg-if {tagged}"),
+            &format!("version = \"{tagged}\"\n"),
+        );
+        let unpatched = if v1 {
+            entries(
+                &format!("cfg-if 1.0.4 ({SOURCE})"),
+                &format!("version = \"1.0.4\"\nsource = \"{SOURCE}\"\n"),
+            )
+        } else {
+            entries(
+                &format!("cfg-if 1.0.4 ({SOURCE})"),
+                &format!("version = \"1.0.4\"\nsource = \"{SOURCE}\"\nchecksum = \"{CHECKSUM}\"\n"),
+            )
+        };
+        if v1 {
+            (
+                format!("{patched}\n[metadata]\n"),
+                format!("{unpatched}\n[metadata]\n\"checksum cfg-if 1.0.4 ({SOURCE})\" = \"{CHECKSUM}\"\n"),
+            )
+        } else {
+            (patched, unpatched)
+        }
+    }
+
+    /// A user's same-version path fork locked beside the tagged copy is
+    /// never the entry the probes, a retag or the restore act on: the probe
+    /// sees the copy, the count ignores the fork, a uuid bump moves only the
+    /// copy, a stale uuid's restore is refused, and the restore turns the
+    /// copy back into the registry entry with the full-id reference — the
+    /// exact lock cargo writes without the patch (v4 and v1).
+    #[tokio::test]
+    async fn a_same_version_path_fork_beside_the_copy_is_never_touched() {
+        let orig = CargoLockOriginal {
+            source: SOURCE.to_string(),
+            checksum: Some(CHECKSUM.to_string()),
+        };
+        let tagged = format!("1.0.4+socket.{UUID}");
+        for v1 in [false, true] {
+            let (patched, unpatched) = fork_locks(v1);
+            let dir = lock_dir(&patched).await;
+            let root = dir.path();
+            for uuid in [Some(UUID), None] {
+                assert_eq!(
+                    probe_lock_entry_for(root, "cfg-if", "1.0.4", uuid).await,
+                    LockEntryProbe::Detached(Some(UUID.to_string())),
+                    "v1={v1}"
+                );
+            }
+            assert_eq!(count_lock_entries(root, "cfg-if", "1.0.4").await, 1);
+
+            let prev = retag_lock_entry(root, "cfg-if", "1.0.4", UUID2, false)
+                .await
+                .unwrap();
+            assert_eq!(prev.as_deref(), Some(tagged.as_str()));
+            assert_eq!(read(&dir).await, patched.replace(UUID, UUID2), "v1={v1}");
+            assert!(
+                !restore_lock_entry(root, "cfg-if", "1.0.4", UUID, &orig, false)
+                    .await
+                    .unwrap(),
+                "the lock builds another uuid's copy: not ours to restore"
+            );
+            assert_eq!(read(&dir).await, patched.replace(UUID, UUID2));
+            retag_lock_entry_to(root, "cfg-if", "1.0.4", &tagged, false)
+                .await
+                .unwrap();
+            assert_eq!(read(&dir).await, patched);
+
+            assert!(
+                restore_lock_entry(root, "cfg-if", "1.0.4", UUID, &orig, false)
+                    .await
+                    .unwrap()
+            );
+            assert_eq!(read(&dir).await, unpatched, "v1={v1}");
+            assert_eq!(
+                probe_lock_entry(root, "cfg-if", "1.0.4").await,
+                LockEntryProbe::Source(SOURCE.to_string())
+            );
+            assert_eq!(
+                count_lock_entries(root, "cfg-if", "1.0.4").await,
+                2,
+                "registry + fork: a fresh vendor refuses it"
+            );
+            assert!(
+                !restore_lock_entry(root, "cfg-if", "1.0.4", UUID, &orig, false)
+                    .await
+                    .unwrap(),
+                "a second restore finds the registry entry and leaves it"
+            );
+        }
+    }
+
+    /// Only the untagged fork left (the copy's entry is gone) beside the
+    /// registry entry: the restore does not mistake the fork for a pre-tag
+    /// copy.
+    #[tokio::test]
+    async fn restore_never_attaches_the_registry_source_to_a_fork() {
+        let orig = CargoLockOriginal {
+            source: SOURCE.to_string(),
+            checksum: Some(CHECKSUM.to_string()),
+        };
+        let (_, unpatched) = fork_locks(false);
+        let dir = lock_dir(&unpatched).await;
+        assert!(
+            !restore_lock_entry(dir.path(), "cfg-if", "1.0.4", UUID, &orig, false)
+                .await
+                .unwrap()
+        );
+        assert_eq!(read(&dir).await, unpatched);
+        assert!(
+            retag_lock_entry(dir.path(), "cfg-if", "1.0.4", UUID, true)
+                .await
+                .is_err(),
+            "the registry entry outranks the fork: nothing sourceless to retag"
         );
     }
 }
diff --git a/crates/socket-patch-core/src/vendor/cargo_tag.rs b/crates/socket-patch-core/src/vendor/cargo_tag.rs
index 2f943a1a..4c371282 100644
--- a/crates/socket-patch-core/src/vendor/cargo_tag.rs
+++ b/crates/socket-patch-core/src/vendor/cargo_tag.rs
@@ -93,8 +93,9 @@ pub fn denotes(found: &str, version: &str) -> bool {
 pub enum TagError {
     /// Not TOML.
     Unparseable(String),
-    /// No `[package] version` string literal (a workspace-inherited or
-    /// missing version: never a crates.io-published manifest).
+    /// No `[package]` (or legacy `[project]`) version string literal (a
+    /// workspace-inherited or missing version: never a crates.io-published
+    /// manifest).
     NoVersion,
     /// The manifest names another version than the copy is for.
     VersionMismatch(String),
@@ -130,9 +131,11 @@ impl std::fmt::Display for TagError {
 /// literal (quotes included) and the quote character.
 fn version_literal(text: &str) -> Result<(String, std::ops::Range<usize>, char), TagError> {
     let doc = toml_edit::Document::parse(text).map_err(|e| TagError::Unparseable(e.to_string()))?;
-    let item = doc
-        .get("package")
-        .and_then(toml_edit::Item::as_table_like)
+    // `[project]` is the legacy spelling of `[package]` cargo still accepts
+    // (crates published before manifest normalization ship it verbatim).
+    let item = ["package", "project"]
+        .iter()
+        .find_map(|table| doc.get(table).and_then(toml_edit::Item::as_table_like))
         .and_then(|p| p.get("version"))
         .ok_or(TagError::NoVersion)?;
     let value = item.as_str().ok_or(TagError::NoVersion)?.to_string();
@@ -375,6 +378,20 @@ mod tests {
         ));
     }
 
+    /// Cargo still accepts the legacy `[project]` table, and crates.io
+    /// uploads that predate manifest normalization ship it verbatim.
+    #[test]
+    fn manifest_tag_reads_the_legacy_project_table() {
+        let text = "[project]\nname = \"x\"\nversion = \"0.1.2\"\n";
+        let tagged = tag_manifest_text(text, "0.1.2", UUID).unwrap().unwrap();
+        assert_eq!(
+            tagged,
+            format!("[project]\nname = \"x\"\nversion = \"0.1.2+socket.{UUID}\"\n")
+        );
+        assert_eq!(manifest_tag_uuid(&tagged).as_deref(), Some(UUID));
+        assert_eq!(untag_manifest_text(&tagged).as_deref(), Some(text));
+    }
+
     #[test]
     fn untagged_bytes_recover_the_patched_manifest() {
         let tagged = tag_manifest_text(CRATE_TOML, "1.0.4", UUID)
diff --git a/crates/socket-patch-core/src/vendor/lock_inventory/cargo.rs b/crates/socket-patch-core/src/vendor/lock_inventory/cargo.rs
index d2df4c47..d0158d87 100644
--- a/crates/socket-patch-core/src/vendor/lock_inventory/cargo.rs
+++ b/crates/socket-patch-core/src/vendor/lock_inventory/cargo.rs
@@ -17,8 +17,11 @@ use super::{dedup_prefer_integrity, LockIntegrity, LockfileEntry, SourceKind};
 /// version carries the `+socket.<uuid>` tag, see `vendor::cargo_tag`) are
 /// skipped, and git/custom-registry sources stay listed for discovery
 /// without a verifier. A version is inventoried under its purl identity:
-/// a Socket tag, should a sourced entry carry one, is stripped. A lock
-/// that is not TOML yields nothing — cargo itself refuses to build from it.
+/// a Socket tag, should a sourced entry carry one (no Socket writer does —
+/// a hand-edited or foreign lock), is stripped, and that entry gets no
+/// verifier (its checksum pins a tagged version no registry serves under
+/// the purl's version). A lock that is not TOML yields nothing — cargo
+/// itself refuses to build from it.
 pub(super) async fn inventory_cargo_lock(project_root: &Path) -> Option<Vec<LockfileEntry>> {
     inventory_cargo_lock_raw(project_root)
         .await
@@ -37,6 +40,7 @@ pub(super) async fn inventory_cargo_lock_raw(project_root: &Path) -> Option<Vec<
             continue; // workspace member
         };
         let version = crate::vendor::cargo_tag::strip_tag(&pkg.version).to_string();
+        let tagged = version != pkg.version;
         let Some(purl) = simple_purl("cargo", &pkg.name, &version) else {
             continue;
         };
@@ -45,7 +49,7 @@ pub(super) async fn inventory_cargo_lock_raw(project_root: &Path) -> Option<Vec<
         // The crates.io provenance is recorded exactly where the checksum is
         // kept as the `.crate`'s sha256.
         let (integrity, source_kind) = match pkg.checksum {
-            Some(c) if crates_io && is_hex(&c, 64) => {
+            Some(c) if crates_io && !tagged && is_hex(&c, 64) => {
                 (LockIntegrity::Sha256Hex(c), SourceKind::CratesIo)
             }
             _ => (LockIntegrity::None, SourceKind::Unspecified),
diff --git a/crates/socket-patch-core/src/vendor/lock_inventory/tests.rs b/crates/socket-patch-core/src/vendor/lock_inventory/tests.rs
index 90c2047a..2dbdf96b 100644
--- a/crates/socket-patch-core/src/vendor/lock_inventory/tests.rs
+++ b/crates/socket-patch-core/src/vendor/lock_inventory/tests.rs
@@ -1106,6 +1106,49 @@ checksum = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
     assert_eq!(entry(&entries, "git-dep").integrity, LockIntegrity::None);
 }
 
+/// A sourced entry carrying a Socket tag (hand-edited / foreign: vendoring
+/// writes tagged entries SOURCELESS, which are skipped) is listed under its
+/// purl version with no verifier; the sourceless tagged copy is not listed.
+#[tokio::test]
+async fn cargo_lock_strips_a_socket_tag_and_drops_its_verifier() {
+    let tmp = tempfile::tempdir().unwrap();
+    write(
+        tmp.path(),
+        "Cargo.lock",
+        r#"version = 4
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4+socket.9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddc6f9cc94d67c0e21aaf7eda3a010fd3af78ebf6e096aa6e2e13c79749cce4f"
+
+[[package]]
+name = "zstd-sys"
+version = "2.0.1+zstd.1.5.2.socket.9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f"
+
+[[package]]
+name = "keep-meta"
+version = "2.0.1+zstd.1.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+"#,
+    )
+    .await;
+    let entries = inventory_cargo_lock(tmp.path()).await.unwrap();
+    let cfg_if = entry(&entries, "cfg-if");
+    assert_eq!(cfg_if.version, "1.0.4");
+    assert_eq!(cfg_if.purl, "pkg:cargo/cfg-if@1.0.4");
+    assert_eq!(cfg_if.integrity, LockIntegrity::None);
+    assert!(!entries.iter().any(|e| e.name == "zstd-sys"), "{entries:?}");
+    let meta = entry(&entries, "keep-meta");
+    assert_eq!(
+        meta.version, "2.0.1+zstd.1.5.2",
+        "non-Socket build metadata stays"
+    );
+    assert!(matches!(meta.integrity, LockIntegrity::Sha256Hex(_)));
+}
+
 #[tokio::test]
 async fn go_sum_inventories_module_zip_lines() {
     let tmp = tempfile::tempdir().unwrap();
diff --git a/crates/socket-patch-core/src/vendor/state.rs b/crates/socket-patch-core/src/vendor/state.rs
index 1edbc120..6dd6f56c 100644
--- a/crates/socket-patch-core/src/vendor/state.rs
+++ b/crates/socket-patch-core/src/vendor/state.rs
@@ -369,6 +369,13 @@ impl Default for VendorState {
 ///     entry is its only home. A re-vendor over already-detached wiring
 ///     records `lock: None` (there was nothing left to detach), and taking
 ///     the fresh entry verbatim would destroy the first run's originals;
+///   * carries forward a cargo copy's whole-tree file inventory when the
+///     fresh entry names the SAME copy (same uuid + artifact path) and
+///     records none — the cargo backend never inventories, and a re-run
+///     that only (re)tags or migrates the wiring of that copy must not
+///     silently downgrade whole-tree verification to the patched members
+///     (the inventory check compares the copy's `Cargo.toml` with this
+///     uuid's tag dropped, so the tag itself still verifies);
 ///   * preserves the go-patch-takeover flag.
 ///
 /// The wiring UNION is scoped to a re-vendor of the SAME patch generation
@@ -388,6 +395,14 @@ pub fn carry_forward_wiring(prev: &VendorEntry, entry: &mut VendorEntry) {
     if entry.lock.is_none() {
         entry.lock = prev.lock.clone();
     }
+    if entry.ecosystem == "cargo"
+        && prev.ecosystem == "cargo"
+        && entry.artifact.file_inventory.is_none()
+        && prev.uuid == entry.uuid
+        && prev.artifact.path == entry.artifact.path
+    {
+        entry.artifact.file_inventory = prev.artifact.file_inventory.clone();
+    }
 
     for rec in &mut entry.wiring {
         if rec.action == WiringAction::Rewritten && rec.original.is_none() {
@@ -736,6 +751,62 @@ mod tests {
         assert_eq!(fresh.lock, Some(orig));
     }
 
+    /// A cargo re-run that only (re)tags or migrates the SAME copy records
+    /// no inventory (the cargo backend never takes one): the previous
+    /// entry's whole-tree inventory carries forward, so verification is not
+    /// silently downgraded to the patched members. A new uuid or copy path
+    /// is a new tree: nothing carries.
+    #[test]
+    fn carry_forward_keeps_a_cargo_inventory_for_the_same_copy() {
+        let uuid2 = "0a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d";
+        let cargo = |uuid: &str, inventory: Option<BTreeMap<String, String>>| {
+            let mut e = sample_entry();
+            e.ecosystem = "cargo".into();
+            e.base_purl = "pkg:cargo/cfg-if@1.0.4".into();
+            e.uuid = uuid.into();
+            e.wiring.clear();
+            e.artifact.path = format!(".socket/vendor/cargo/{uuid}/cfg-if-1.0.4");
+            e.artifact.file_inventory = inventory;
+            e
+        };
+        let inventory: BTreeMap<String, String> = [("Cargo.toml".to_string(), "ab".repeat(32))]
+            .into_iter()
+            .collect();
+        let prev = cargo(UUID, Some(inventory.clone()));
+
+        let mut same = cargo(UUID, None);
+        carry_forward_wiring(&prev, &mut same);
+        assert_eq!(same.artifact.file_inventory, Some(inventory.clone()));
+
+        let mut fresh_inventory: BTreeMap<String, String> = BTreeMap::new();
+        fresh_inventory.insert("src/lib.rs".into(), "cd".repeat(32));
+        let mut own = cargo(UUID, Some(fresh_inventory.clone()));
+        carry_forward_wiring(&prev, &mut own);
+        assert_eq!(
+            own.artifact.file_inventory,
+            Some(fresh_inventory),
+            "never overwritten"
+        );
+
+        let mut bumped = cargo(uuid2, None);
+        carry_forward_wiring(&prev, &mut bumped);
+        assert_eq!(
+            bumped.artifact.file_inventory, None,
+            "another uuid: another tree"
+        );
+
+        let mut moved = cargo(UUID, None);
+        moved.artifact.path = format!(".socket/vendor/cargo/{UUID}/cfg-if-1.0.5");
+        carry_forward_wiring(&prev, &mut moved);
+        assert_eq!(moved.artifact.file_inventory, None, "another copy path");
+
+        let mut npm_prev = sample_entry();
+        npm_prev.artifact.file_inventory = Some(inventory);
+        let mut npm = sample_entry();
+        carry_forward_wiring(&npm_prev, &mut npm);
+        assert_eq!(npm.artifact.file_inventory, None, "cargo only");
+    }
+
     /// Every spelling `purl_keys` promises: the (possibly qualified,
     /// percent-encoded) map key, the entry's base purl and the
     /// qualifier-stripped key; an empty ledger yields the empty set.
diff --git a/crates/socket-patch-core/src/vendor/verify.rs b/crates/socket-patch-core/src/vendor/verify.rs
index 361fab7c..c7c4d506 100644
--- a/crates/socket-patch-core/src/vendor/verify.rs
+++ b/crates/socket-patch-core/src/vendor/verify.rs
@@ -105,7 +105,8 @@ pub async fn verify_vendored_patch_record(
         // (missing / extra / modified unpatched files, the stub gemspec).
         // Pre-inventory entries carry `None` and keep member-only behavior.
         if let Some(inventory) = &entry.artifact.file_inventory {
-            verify_dir_inventory(&artifact, inventory).await?;
+            let cargo_uuid = (entry.ecosystem == "cargo").then_some(entry.uuid.as_str());
+            verify_dir_inventory(&artifact, inventory, cargo_uuid).await?;
         }
         return Ok(());
     }
@@ -347,9 +348,17 @@ pub async fn compute_dir_inventory(dir: &Path) -> Result<BTreeMap<String, String
 /// missing, extra and modified files all fail with the
 /// `vendor_inventory_mismatch` routing tag; a tree that cannot be walked
 /// (planted symlink/FIFO, unreadable file) is `vendor_artifact_unreadable`.
+///
+/// `cargo_uuid` (a cargo copy's patch uuid): the copy's root `Cargo.toml`
+/// may ALSO match with its Socket version tag dropped, provided the tag is
+/// exactly `cargo_uuid` — an inventory recorded over a copy vendored
+/// before tagged versions keeps verifying once a re-run / repair tags it,
+/// while every other byte (including any other tag) stays pinned. So the
+/// tag step never re-baselines the inventory over bytes nobody verified.
 async fn verify_dir_inventory(
     dir: &Path,
     inventory: &BTreeMap<String, String>,
+    cargo_uuid: Option<&str>,
 ) -> Result<(), String> {
     let actual = compute_dir_inventory(dir)
         .await
@@ -357,15 +366,39 @@ async fn verify_dir_inventory(
     if actual.len() != inventory.len() {
         return Err("vendor_inventory_mismatch".to_string());
     }
+    let untagged_manifest = match cargo_uuid {
+        Some(uuid) => untagged_manifest_sha256(dir, uuid).await,
+        None => None,
+    };
     for (rel, recorded) in inventory {
         match actual.get(rel) {
             Some(live) if live.eq_ignore_ascii_case(recorded) => {}
+            Some(_)
+                if rel == "Cargo.toml"
+                    && untagged_manifest
+                        .as_deref()
+                        .is_some_and(|h| h.eq_ignore_ascii_case(recorded)) => {}
             _ => return Err("vendor_inventory_mismatch".to_string()),
         }
     }
     Ok(())
 }
 
+/// Plain sha256 of the cargo copy manifest `<dir>/Cargo.toml` with its
+/// Socket tag dropped — `None` unless the manifest is tagged for exactly
+/// `uuid`.
+async fn untagged_manifest_sha256(dir: &Path, uuid: &str) -> Option<String> {
+    use sha2::{Digest, Sha256};
+    let text = crate::utils::fs::read_regular_to_string(&dir.join("Cargo.toml"))
+        .await
+        .ok()?;
+    if super::cargo_tag::manifest_tag_uuid(&text).as_deref() != Some(uuid) {
+        return None;
+    }
+    super::cargo_tag::untagged_manifest_bytes(text.as_bytes())
+        .map(|b| hex::encode(Sha256::digest(&b)))
+}
+
 /// Classified health of one ledger entry's committed artifact, for
 /// `repair`-style callers that need a DECISION (rebuild or not), not just a
 /// routing tag.
@@ -663,6 +696,76 @@ mod tests {
         );
     }
 
+    /// A cargo copy's inventory taken before tagged versions keeps
+    /// verifying once its `Cargo.toml` carries THIS entry's tag (the check
+    /// drops exactly that tag); a tag for another uuid, a drifted byte in
+    /// the manifest beside the tag, or the same tag on a non-cargo entry all
+    /// fail.
+    #[tokio::test]
+    async fn cargo_inventory_accepts_only_this_uuids_manifest_tag() {
+        const OTHER: &str = "0a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d";
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path();
+        let rel = format!(".socket/vendor/cargo/{UUID}/cfg-if-1.0.4");
+        let dir = root.join(&rel);
+        tokio::fs::create_dir_all(dir.join("src")).await.unwrap();
+        tokio::fs::write(dir.join("src/lib.rs"), PATCHED)
+            .await
+            .unwrap();
+        let untagged = "[package]\nname = \"cfg-if\"\nversion = \"1.0.4\"\n";
+        tokio::fs::write(dir.join("Cargo.toml"), untagged)
+            .await
+            .unwrap();
+
+        let rec = record(UUID, "package/src/lib.rs");
+        let mut ent = entry("cargo", UUID, &rel);
+        ent.base_purl = "pkg:cargo/cfg-if@1.0.4".into();
+        ent.artifact.file_inventory = Some(compute_dir_inventory(&dir).await.unwrap());
+        assert!(verify_vendored_patch_record(root, &ent, &rec).await.is_ok());
+
+        let tagged = |uuid: &str| untagged.replace("1.0.4", &format!("1.0.4+socket.{uuid}"));
+        tokio::fs::write(dir.join("Cargo.toml"), tagged(UUID))
+            .await
+            .unwrap();
+        assert!(
+            verify_vendored_patch_record(root, &ent, &rec).await.is_ok(),
+            "this uuid's tag verifies"
+        );
+
+        for (why, text) in [
+            ("another uuid's tag", tagged(OTHER)),
+            (
+                "drift beside the tag",
+                tagged(UUID) + "build = \"build.rs\"\n",
+            ),
+        ] {
+            tokio::fs::write(dir.join("Cargo.toml"), text)
+                .await
+                .unwrap();
+            assert_eq!(
+                verify_vendored_patch_record(root, &ent, &rec)
+                    .await
+                    .unwrap_err(),
+                "vendor_inventory_mismatch",
+                "{why}"
+            );
+        }
+
+        tokio::fs::write(dir.join("Cargo.toml"), tagged(UUID))
+            .await
+            .unwrap();
+        let rec_gem = record(UUID, "src/lib.rs");
+        let mut gem = entry("gem", UUID, &rel);
+        gem.artifact.file_inventory = ent.artifact.file_inventory.clone();
+        assert_eq!(
+            verify_vendored_patch_record(root, &gem, &rec_gem)
+                .await
+                .unwrap_err(),
+            "vendor_inventory_mismatch",
+            "the tag allowance is cargo's alone"
+        );
+    }
+
     /// The whole-tree inventory closes the dir-shaped blindspot: with only
     /// afterHashes, a tampered UNPATCHED file (or stub gemspec), a deleted
     /// file, or a planted extra file were all blessed Healthy. Each arm of
diff --git a/crates/socket-patch-core/src/vex/discover/cargo.rs b/crates/socket-patch-core/src/vex/discover/cargo.rs
index 7ec7bd78..b454e502 100644
--- a/crates/socket-patch-core/src/vex/discover/cargo.rs
+++ b/crates/socket-patch-core/src/vex/discover/cargo.rs
@@ -66,8 +66,17 @@
 //! this wiring names (a config override elsewhere, or a stale `[patch]`) →
 //! no ref ([`DIAG_REF_INVALID`]). A tagged entry that no visible wiring
 //! names (the `[patch]` lives in a config discovery does not read, or was
-//! removed) is [`DIAG_REF_UNATTRIBUTABLE`]. An UNTAGGED sourceless entry is
-//! a copy vendored before tagged versions and still counts. The wiring is a
+//! removed) is [`DIAG_REF_UNATTRIBUTABLE`]. The entry tagged for the path
+//! uuid decides whenever one exists (a same-version untagged sibling — the
+//! user's own path fork, which cargo locks beside the tagged copy — does
+//! not matter); failing that, a tagged sibling for another uuid rejects it.
+//! An UNTAGGED sourceless entry alone is a copy vendored before tagged
+//! versions and counts only while the copy's own `Cargo.toml` is untagged
+//! too: cargo locks a tagged copy at its tagged version, so beside a tagged
+//! copy an untagged entry is some OTHER crate cargo built (a `[patch]`
+//! override in a config discovery does not read, a path dependency) → no
+//! ref ([`DIAG_REF_INVALID`]). A copy whose `Cargo.toml` is tagged for
+//! another uuid than its path is no ref either. The wiring is a
 //! `[patch.crates-io]` path entry
 //! `<key> = { path = ".socket/vendor/cargo/<uuid>/<name>-<version>" }` —
 //! PRIMARILY in the root `Cargo.toml` (what v5+ `vendor` writes; `<key>` is
@@ -115,7 +124,7 @@ use crate::vendor::cargo_config::{
     CONFIG_TOML, SOCKET_REGISTRY_PREFIX,
 };
 use crate::vendor::cargo_lock::{
-    detached_tag, locked_packages, unused_patches, vendored_copy_consumed, LockedPackage,
+    locked_packages, unused_patches, vendored_copy_claim, CopyClaim, LockedPackage,
 };
 use crate::vendor::cargo_manifest::{crates_io_url_alias_tables, is_crates_io_source};
 use crate::vendor::cargo_tag;
@@ -207,10 +216,10 @@ pub(crate) async fn extract(ctx: &DiscoverCtx<'_>, out: &mut Discovery) {
                     format!("{file} redefines `[patch]` key `{key}`, which replaces it in cargo")
                 })
         };
-        vendored_from_patches(CARGO_TOML, doc, &lock, &shadowed, out);
+        vendored_from_patches(ctx, CARGO_TOML, doc, &lock, &shadowed, out).await;
     }
     if let Some((file, doc)) = &config {
-        vendored_from_patches(file, doc, &lock, &|_| None, out);
+        vendored_from_patches(ctx, file, doc, &lock, &|_| None, out).await;
     }
     let wired: Vec<VendorRef> = manifest
         .iter()
@@ -631,9 +640,39 @@ fn same_path_key(path: &str) -> String {
         .join("/")
 }
 
+/// The Socket version tag of a wired copy's own `Cargo.toml`.
+enum CopyTag {
+    /// No copy manifest on disk (the copy is missing: verification says so).
+    Absent,
+    /// Untagged: a copy vendored before tagged versions.
+    Untagged,
+    Tagged(String),
+    /// Present but unreadable: treated as tagged (fail-closed — an untagged
+    /// lock entry then never counts).
+    Unreadable,
+}
+
+/// Read the tag of the copy at root-relative `artifact_rel` (the only
+/// identity its manifest can mention is the uuid its `[patch]` path already
+/// names).
+async fn copy_tag(ctx: &DiscoverCtx<'_>, artifact_rel: &str, out: &mut Discovery) -> CopyTag {
+    let rel = format!("{artifact_rel}/{CARGO_TOML}");
+    if !ctx.exists(&rel).await {
+        return CopyTag::Absent;
+    }
+    match ctx.read_text(&rel, out).await {
+        Some(text) => match cargo_tag::manifest_tag_uuid(&text) {
+            Some(uuid) => CopyTag::Tagged(uuid),
+            None => CopyTag::Untagged,
+        },
+        None => CopyTag::Unreadable,
+    }
+}
+
 /// Vendored refs from one file's `[patch]` tables. `shadowed` names why
 /// cargo ignores an entry (a higher-precedence item replaces it), if so.
-fn vendored_from_patches(
+async fn vendored_from_patches(
+    ctx: &DiscoverCtx<'_>,
     file: &str,
     doc: &DocumentMut,
     lock: &Lock,
@@ -690,31 +729,48 @@ fn vendored_from_patches(
             );
             continue;
         };
-        if let Lock::Parsed { pkgs, unused } = lock {
-            if let Some(Some(tag)) = detached_tag(pkgs, name, version) {
-                if tag != vref.uuid {
-                    out.diag(
-                        DIAG_REF_INVALID,
-                        file,
-                        format!(
-                            "{file}: [patch] entry for {name} points at {}, but {CARGO_LOCK} \
-                             builds the copy tagged for patch {tag} \
-                             ({name} {}); not counted",
-                            vref.artifact_rel,
-                            cargo_tag::tag_version(version, tag)
-                        ),
-                    );
-                    continue;
-                }
+        let tag = copy_tag(ctx, &vref.artifact_rel, out).await;
+        if let CopyTag::Tagged(t) = &tag {
+            if *t != vref.uuid {
+                // Cargo builds this copy as `<version>+socket.<t>`: not the
+                // patch its path names.
+                out.diag(
+                    DIAG_REF_INVALID,
+                    file,
+                    format!(
+                        "{file}: [patch] entry for {name} points at {}, but that copy's \
+                         {CARGO_TOML} is tagged for patch {t}; not counted",
+                        vref.artifact_rel
+                    ),
+                );
+                continue;
             }
-            if !vendored_copy_consumed(pkgs, unused, name, version, &vref.uuid) {
+        }
+        let copy_tagged = matches!(tag, CopyTag::Tagged(_) | CopyTag::Unreadable);
+        if let Lock::Parsed { pkgs, unused } = lock {
+            let why =
+                match vendored_copy_claim(pkgs, unused, name, version, &vref.uuid, copy_tagged) {
+                    CopyClaim::Consumed => None,
+                    CopyClaim::OtherTag(other) => Some(format!(
+                        "{CARGO_LOCK} builds the copy tagged for patch {other} ({name} {})",
+                        cargo_tag::tag_version(version, other)
+                    )),
+                    CopyClaim::UntaggedOverride => Some(format!(
+                        "{CARGO_LOCK} builds an untagged {name} {version}, not the copy (which \
+                     cargo would lock as {}): another [patch] or path dependency overrides it",
+                        cargo_tag::tag_version(version, &vref.uuid)
+                    )),
+                    CopyClaim::NotConsumed => Some(format!(
+                        "{CARGO_LOCK} does not build {name}@{version} from it (an unused patch, \
+                     or the lock resolves it from a registry)"
+                    )),
+                };
+            if let Some(why) = why {
                 out.diag(
                     DIAG_REF_INVALID,
                     file,
                     format!(
-                        "{file}: [patch] entry for {name} points at {}, but {CARGO_LOCK} \
-                         does not build {name}@{version} from it (an unused patch, or the \
-                         lock resolves it from a registry); not counted",
+                        "{file}: [patch] entry for {name} points at {}, but {why}; not counted",
                         vref.artifact_rel
                     ),
                 );
@@ -1922,4 +1978,123 @@ mod tests {
         assert_refs(&out, &[]);
         assert_eq!(diag_codes(&out), vec![DIAG_REF_UNATTRIBUTABLE]);
     }
+
+    /// The copy's own `Cargo.toml` tag decides an UNTAGGED sourceless lock
+    /// entry: it is the pre-tag vendored shape only beside an untagged (or
+    /// missing — verification reports that) copy; beside a tagged or
+    /// unreadable copy it is some other crate cargo built. A copy tagged for
+    /// another uuid than its path is dead wiring whatever the lock says.
+    #[tokio::test]
+    async fn copy_manifest_tag_decides_an_untagged_lock_entry() {
+        let rel = vendor_path(UUID_A, "cfg-if-1.0.4");
+        let copy_toml = format!("{rel}/Cargo.toml");
+        let at = |v: &str| format!("[package]\nname = \"cfg-if\"\nversion = \"{v}\"\n");
+        let tag = |u: &str| crate::vendor::cargo_tag::tag_version("1.0.4", u);
+        let purl = "pkg:cargo/cfg-if@1.0.4";
+        let untagged_lock = lock(&[("cfg-if", "1.0.4", None, None)]);
+        let tagged_lock = lock(&[("cfg-if", &tag(UUID_A), None, None)]);
+
+        for (what, copy, lock_text, attests) in [
+            ("no copy manifest", None, &untagged_lock, true),
+            ("untagged copy", Some(at("1.0.4")), &untagged_lock, true),
+            (
+                "tagged copy, untagged lock",
+                Some(at(&tag(UUID_A))),
+                &untagged_lock,
+                false,
+            ),
+            (
+                "tagged copy, tagged lock",
+                Some(at(&tag(UUID_A))),
+                &tagged_lock,
+                true,
+            ),
+            (
+                "copy tagged for another uuid",
+                Some(at(&tag(UUID_B))),
+                &tagged_lock,
+                false,
+            ),
+            (
+                "copy tagged for another uuid, untagged lock",
+                Some(at(&tag(UUID_B))),
+                &untagged_lock,
+                false,
+            ),
+        ] {
+            let p = Project::new();
+            p.write("Cargo.toml", socket_manifest(&rel));
+            p.write("Cargo.lock", lock_text);
+            if let Some(copy) = copy {
+                p.write(&copy_toml, copy);
+            }
+            let out = run(&p).await;
+            if attests {
+                assert_refs(&out, &[(purl, UUID_A, WiringMode::Vendored)]);
+                assert!(out.diagnostics.is_empty(), "{what}: {:#?}", out.diagnostics);
+            } else {
+                assert_refs(&out, &[]);
+                assert!(
+                    diag_codes(&out).contains(&DIAG_REF_INVALID),
+                    "{what}: {:#?}",
+                    out.diagnostics
+                );
+            }
+        }
+
+        // Unreadable (a directory where the manifest should be): fail
+        // closed — the untagged entry never counts.
+        let p = Project::new();
+        p.write("Cargo.toml", socket_manifest(&rel));
+        p.write("Cargo.lock", &untagged_lock);
+        std::fs::create_dir_all(p.root().join(&copy_toml)).unwrap();
+        let out = run(&p).await;
+        assert_refs(&out, &[]);
+        assert!(
+            diag_codes(&out).contains(&DIAG_REF_INVALID),
+            "{:#?}",
+            out.diagnostics
+        );
+    }
+
+    /// A user's same-version path fork locked beside the tagged copy (real
+    /// cargo 1.97 sorts the untagged entry first) does not hide the copy;
+    /// beside another uuid's tagged entry the wiring is still dead.
+    #[tokio::test]
+    async fn a_same_version_fork_beside_the_tagged_copy_is_ignored() {
+        let rel = vendor_path(UUID_A, "cfg-if-1.0.4");
+        let tag = |u: &str| crate::vendor::cargo_tag::tag_version("1.0.4", u);
+        for (tagged_for, attests) in [(UUID_A, true), (UUID_B, false)] {
+            let p = Project::new();
+            p.write("Cargo.toml", socket_manifest(&rel));
+            p.write(
+                &format!("{rel}/Cargo.toml"),
+                format!(
+                    "[package]\nname = \"cfg-if\"\nversion = \"{}\"\n",
+                    tag(UUID_A)
+                ),
+            );
+            p.write(
+                "Cargo.lock",
+                lock(&[
+                    ("cfg-if", "1.0.4", None, None),
+                    ("cfg-if", &tag(tagged_for), None, None),
+                ]),
+            );
+            let out = run(&p).await;
+            if attests {
+                assert_refs(
+                    &out,
+                    &[("pkg:cargo/cfg-if@1.0.4", UUID_A, WiringMode::Vendored)],
+                );
+            } else {
+                assert_refs(&out, &[]);
+                assert!(
+                    diag_codes(&out).contains(&DIAG_REF_INVALID),
+                    "{:#?}",
+                    out.diagnostics
+                );
+            }
+        }
+    }
 }
diff --git a/docs/ecosystems.md b/docs/ecosystems.md
index 5da090e5..a3f3a7e1 100644
--- a/docs/ecosystems.md
+++ b/docs/ecosystems.md
@@ -240,16 +240,26 @@ version = "1.0.4+socket.<uuid>"
   rewritten with it, in lock formats v1–v4; a lock that cannot be kept
   consistent refuses with `cargo_lock_untaggable` before any write.
   **The patched crate sees the tag in `CARGO_PKG_VERSION`** — e.g. a
-  vendored binary crate's `--version` output shows it; semver-parsing code
-  is unaffected. Revert restores the original lock byte for byte. Copies
-  and locks vendored before tagged versions are tagged by the next re-run
-  or `repair` (`cargo_version_tagged`).
+  vendored binary crate's `--version` output shows it; requirement
+  matching (`semver::VersionReq`) is unaffected, but string comparisons
+  and equality / ordering on a parsed `semver::Version` (which compares
+  build metadata) see it. Revert restores the original lock byte for
+  byte — including when you later lock your own same-version path crate
+  beside the copy: that entry is left alone and the registry entry comes
+  back under its full id, as cargo writes it. Copies and locks vendored
+  before tagged versions are tagged by the next re-run or `repair`
+  (`cargo_version_tagged`; a dry run says "would tag"). For VEX, an
+  untagged detached lock entry counts only beside an untagged (pre-tag)
+  copy, and a copy whose `Cargo.toml` is tagged for another uuid than its
+  path is dead wiring.
 - **Why the manifest.** Socket's scanners already ingest `Cargo.toml`, so
   the patch uuid in the path is recoverable for SBOM annotation without
   uploading `.cargo/config*` (which can hold registry tokens), and manifest
   `[patch]` builds on cargo older than 1.56, the floor of config-file
-  `[patch]` (proven by the old-toolchain e2e tests on cargo 1.41 in docker,
-  which builds and runs the patched copy with no network, and on 1.56).
+  `[patch]` (proven by the old-toolchain e2e tests, which build and run
+  the patched copy with no network on the cargo 1.41 and 1.56 docker
+  images — the CI `cargo-old-toolchains` leg; without the images a local
+  run falls back to type-checking on rustup toolchains).
   Two vendored versions of ONE crate need `cargo build --offline` on 1.56,
   and on older cargo (1.41) a populated crates.io index in `$CARGO_HOME`
   (or network access) — it loads the index to tell the two entries apart.

From 47543ecb3bb526c4a1d21f27910f50825feedf7a Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Thu, 24 Sep 2026 18:56:45 -0400
Subject: [PATCH 04/13] test(vendor): cover cargo tag rollbacks and 1.41 index

- A failed Cargo.lock retag write (read-only project root) untags the
  copy again, through both the vendor re-run and repair's migration.
- repair's migration over a copy whose Cargo.toml cannot take the tag
  reports cargo_version_untagged and writes nothing.
- The cargo 1.41 two-version leg now proves the documented remedy: a
  populated crates.io index in $CARGO_HOME builds and runs both patched
  copies with no network, instead of only accepting the failure.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .../tests/e2e_vendor_cargo_build.rs           | 72 +++++++++++++--
 crates/socket-patch-core/src/vendor/cargo.rs  | 88 +++++++++++++++++++
 2 files changed, 152 insertions(+), 8 deletions(-)

diff --git a/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs b/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs
index be3eacb3..79b3e3df 100644
--- a/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs
@@ -2081,11 +2081,12 @@ fn cargo_vendored_manifest_patch_builds_on_old_toolchains() {
 /// crates.io index to tell two same-named `[patch]` entries apart. Cargo
 /// 1.56 builds the committed two-version wiring under `--offline` from an
 /// empty CARGO_HOME (what the docs require there); older cargo (1.41) needs
-/// the index itself — it fails even under `--offline` with no registry
-/// cache, the same for tagged and untagged locks — so below 1.56 only that
-/// documented failure is accepted. Without `--offline` the outcome is only
-/// reported (current stable needs neither — see
-/// `cargo_vendor_two_versions_of_one_crate_locked_build`).
+/// the index itself — it fails under `--offline` with no registry cache
+/// (only that failure is accepted from an empty CARGO_HOME), and the
+/// documented remedy, a populated crates.io index in `$CARGO_HOME`, must
+/// then build (and run) both patched copies with no network. Without
+/// `--offline` the outcome is only reported (current stable needs neither
+/// — see `cargo_vendor_two_versions_of_one_crate_locked_build`).
 #[test]
 fn cargo_vendored_two_versions_on_old_toolchains_need_offline() {
     const SUITE: &str = "e2e_vendor_cargo_build (old-toolchain multi-version)";
@@ -2120,7 +2121,7 @@ fn cargo_vendored_two_versions_on_old_toolchains_need_offline() {
                 "needs --offline (registry index unreachable)"
             }
         );
-        let run = old_cargo_run(&old, &fresh, &["--offline"]);
+        let mut run = old_cargo_run(&old, &fresh, &["--offline"]);
         if old.minor() < 56 && !run.out.status.success() {
             let stderr = String::from_utf8_lossy(&run.out.stderr);
             assert!(
@@ -2129,8 +2130,8 @@ fn cargo_vendored_two_versions_on_old_toolchains_need_offline() {
                  index:\n{stderr}"
             );
             println!("old-toolchain multi-version {name}: needs a registry index (documented)");
-            let _ = std::fs::remove_dir_all(&fresh);
-            continue;
+            seed_old_crates_io_index(&fresh.join(".old-cargo-home"), &[&fx.new_v, &fx.old_v]);
+            run = old_cargo_run(&old, &fresh, &["--offline"]);
         }
         assert!(
             run.out.status.success(),
@@ -2148,6 +2149,61 @@ fn cargo_vendored_two_versions_on_old_toolchains_need_offline() {
     }
 }
 
+/// The documented remedy for two vendored versions on cargo older than
+/// 1.56: a populated crates.io index in `$CARGO_HOME`. Writes the minimal
+/// one an old cargo reads offline — the git index at the pre-1.85
+/// `registry/index/github.com-1ecc6299db9ec823` path (`origin/HEAD` names
+/// the tree cargo loads), listing `versions` of the patched crate. No
+/// `.crate` is cached: every listed version is patched to a path copy, so
+/// nothing is downloaded.
+fn seed_old_crates_io_index(cargo_home: &Path, versions: &[&str]) {
+    let index = cargo_home.join("registry/index/github.com-1ecc6299db9ec823");
+    let file = index.join(&DEP[..2]).join(&DEP[2..4]).join(DEP);
+    std::fs::create_dir_all(file.parent().unwrap()).unwrap();
+    std::fs::write(
+        index.join("config.json"),
+        "{\"dl\":\"https://crates.io/api/v1/crates\",\"api\":\"https://crates.io\"}\n",
+    )
+    .unwrap();
+    let lines: String = versions
+        .iter()
+        .map(|v| {
+            format!(
+                "{{\"name\":\"{DEP}\",\"vers\":\"{v}\",\"deps\":[],\"cksum\":\"{}\",\
+                 \"features\":{{}},\"yanked\":false}}\n",
+                "0".repeat(64)
+            )
+        })
+        .collect();
+    std::fs::write(&file, lines).unwrap();
+    let git = |args: &[&str]| {
+        let out = Command::new("git")
+            .args([
+                "-c",
+                "user.name=socket-patch-e2e",
+                "-c",
+                "user.email=e2e@invalid",
+                "-c",
+                "commit.gpgsign=false",
+                "-c",
+                "core.hooksPath=/dev/null",
+            ])
+            .args(args)
+            .current_dir(&index)
+            .output()
+            .expect("run git");
+        assert!(
+            out.status.success(),
+            "git {args:?}: {}",
+            String::from_utf8_lossy(&out.stderr)
+        );
+    };
+    git(&["init", "-q", "."]);
+    git(&["add", "-A"]);
+    git(&["commit", "-q", "-m", "index"]);
+    git(&["update-ref", "refs/remotes/origin/HEAD", "HEAD"]);
+}
+
 /// A root manifest that spells crates.io by URL in `[patch]` (cargo lets
 /// that table replace `[patch.crates-io]` wholesale) is refused with no
 /// write, so the project keeps building `--locked --offline` exactly as
diff --git a/crates/socket-patch-core/src/vendor/cargo.rs b/crates/socket-patch-core/src/vendor/cargo.rs
index 603a74be..7c74cdbb 100644
--- a/crates/socket-patch-core/src/vendor/cargo.rs
+++ b/crates/socket-patch-core/src/vendor/cargo.rs
@@ -5546,6 +5546,94 @@ mod tests {
         }
     }
 
+    /// `repair`'s migration over a wired copy whose `Cargo.toml` cannot
+    /// take the tag (no literal version) is the `cargo_version_untagged`
+    /// warning — dry run and wet run alike — and nothing is written: the
+    /// lock keeps its untagged entry, so copy and lock still agree.
+    #[tokio::test]
+    async fn repair_migration_over_an_untaggable_copy_warns_untagged() {
+        let (dir, blobs, pristine, record) = fixture().await;
+        let root = dir.path();
+        let (_, entry, _) =
+            expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
+        let entry = entry.unwrap();
+        untag_project(root).await;
+        let untaggable = "[package]\nname = \"cfg-if\"\nversion.workspace = true\n";
+        tokio::fs::write(root.join(copy_rel()).join("Cargo.toml"), untaggable)
+            .await
+            .unwrap();
+        let lock = lock_text(root).await;
+        for dry_run in [true, false] {
+            let (_, warnings) = migrate_legacy_wiring(&entry, root, dry_run)
+                .await
+                .unwrap()
+                .expect("the untaggable copy is reported");
+            let codes: Vec<&str> = warnings.iter().map(|w| w.code).collect();
+            assert_eq!(codes, ["cargo_version_untagged"], "dry_run={dry_run}");
+            assert!(
+                warnings[0].detail.contains(COPY_UNTAGGABLE),
+                "{:?}",
+                warnings[0]
+            );
+            assert_eq!(lock_text(root).await, lock, "dry_run={dry_run}");
+            assert_eq!(copy_toml(root).await, untaggable, "dry_run={dry_run}");
+        }
+    }
+
+    /// A lock retag that passes its read-only proof but whose WRITE fails
+    /// (the project root is read-only, so the atomic rewrite cannot stage
+    /// its sibling, while the copy under `.socket/` stays writable) untags
+    /// the copy again: copy and lock never disagree. Both callers — the
+    /// vendor re-run's hot path and `repair`'s migration — report it.
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn a_failed_lock_retag_write_untags_the_copy_again() {
+        use std::os::unix::fs::PermissionsExt;
+        if unsafe { libc::geteuid() } == 0 {
+            return; // root ignores directory permission bits
+        }
+        for via_repair in [false, true] {
+            let (dir, blobs, pristine, record) = fixture().await;
+            let root = dir.path();
+            let (_, entry, _) =
+                expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
+            let entry = entry.unwrap();
+            untag_project(root).await;
+            let lock = lock_text(root).await;
+            let copy = copy_toml(root).await;
+
+            std::fs::set_permissions(root, std::fs::Permissions::from_mode(0o555)).unwrap();
+            let error = if via_repair {
+                let outcome = migrate_legacy_wiring(&entry, root, false).await;
+                std::fs::set_permissions(root, std::fs::Permissions::from_mode(0o755)).unwrap();
+                let (_, warnings) = outcome.unwrap().expect("the failed tag is reported");
+                assert_eq!(warnings.len(), 1, "{warnings:?}");
+                assert_eq!(warnings[0].code, "cargo_version_untagged");
+                warnings[0].detail.clone()
+            } else {
+                let outcome = run_vendor(PURL, root, &blobs, &pristine, &record, false).await;
+                std::fs::set_permissions(root, std::fs::Permissions::from_mode(0o755)).unwrap();
+                let (result, again, _) = expect_done(outcome);
+                assert!(!result.success && again.is_none());
+                result.error.unwrap_or_default()
+            };
+            assert!(
+                error.contains(LOCK_UNTAGGABLE),
+                "via_repair={via_repair}: {error}"
+            );
+            assert_eq!(lock_text(root).await, lock, "via_repair={via_repair}");
+            assert_eq!(
+                copy_toml(root).await,
+                copy,
+                "via_repair={via_repair}: the copy is untagged again"
+            );
+            assert_eq!(
+                cargo_tag::copy_manifest_tag(&root.join(copy_rel())).await,
+                None
+            );
+        }
+    }
+
     /// A lock whose detached entry is tagged for ANOTHER uuid while the
     /// wiring points at this copy (a lock checked out from another patch
     /// generation) is only stale: cargo re-locks an unlocked build to the

From 85785a79b9b5527d83ba1c9620c12860c1ced79f Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Thu, 24 Sep 2026 23:06:22 -0400
Subject: [PATCH 05/13] fix(vendor): see every hosted pin shape before
 vendoring
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The cross-mode guard that refuses to wire [patch.crates-io] on top of a
live hosted redirect read Cargo.toml with a single-line regex, so it saw
only `<crate> = { ... registry = "socket-patch-<uuid>" }`. The hosted
rewriter also writes a standalone `registry = ...` line under a
`[dependencies.<crate>]` header, pins renamed declarations by their
`package` key, and accepts a quoted key — all read as "not redirected".

With a Cargo.lock restored from version control (so the lock probe sees
crates.io again) and no redirect ledger, vendor then reported success on
a project pinned to the hosted registry and patched through
[patch.crates-io] at once: cargo resolves the crate from a non-crates.io
source, which [patch.crates-io] does not cover, so the build either
fails or silently links the unpatched copy.

The probe now reuses the rewriter's own manifest reader, so detection
and writing stay in step, and the refusal names the registry it found.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .../src/patch/redirect/mod.rs                 | 185 ++++++++++++++++++
 crates/socket-patch-core/src/vendor/cargo.rs  | 114 ++++++++++-
 2 files changed, 292 insertions(+), 7 deletions(-)

diff --git a/crates/socket-patch-core/src/patch/redirect/mod.rs b/crates/socket-patch-core/src/patch/redirect/mod.rs
index 4a4eebc6..8c885688 100644
--- a/crates/socket-patch-core/src/patch/redirect/mod.rs
+++ b/crates/socket-patch-core/src/patch/redirect/mod.rs
@@ -985,6 +985,118 @@ fn is_socket_patch_registry_name(value: &str) -> bool {
     socket_patch_name_uuid_exact(value, false).is_some()
 }
 
+/// The `socket-patch-<uuid>` registry name pinning `crate_name` in this
+/// manifest, in EVERY declaration shape [`plan_cargo_toml`] writes: a
+/// `[…dependencies.<key>]` header table (whose pin is a standalone
+/// `registry = …` line), an inline table, a quoted key, and a rename
+/// (`package = "<crate>"` under any key). Readers that probe for a LIVE
+/// hosted redirect use this rather than a single-line regex, which saw only
+/// the inline spelling and read the other three as "not redirected".
+pub(crate) fn cargo_socket_registry_pin(content: &str, crate_name: &str) -> Option<String> {
+    let lines: Vec<&str> = content.split('\n').collect();
+    let socket_value = |text: &str| -> Option<String> {
+        CARGO_TOML_REGISTRY_VAL_RE
+            .captures(text)
+            .map(|c| c[1].to_string())
+            .filter(|v| is_socket_patch_registry_name(v))
+    };
+    let mut section = CargoTomlSection::Other;
+    for (idx, raw) in lines.iter().enumerate() {
+        let trimmed = raw.trim_start();
+        if trimmed.is_empty() || trimmed.starts_with('#') {
+            continue;
+        }
+        if trimmed.starts_with('[') && !trimmed.starts_with("[[") {
+            section = match CARGO_TOML_HEADER_RE.captures(trimmed) {
+                Some(c) => classify_cargo_section(
+                    c.get(1)
+                        .expect("header_re always captures group 1 (section name)")
+                        .as_str(),
+                ),
+                None => CargoTomlSection::Other,
+            };
+            let CargoTomlSection::DepEntry { key, .. } = section.clone() else {
+                continue;
+            };
+            let end = lines
+                .iter()
+                .enumerate()
+                .skip(idx + 1)
+                .find(|(_, l)| l.trim_start().starts_with('['))
+                .map_or(lines.len(), |(j, _)| j);
+            let block: Vec<&str> = (idx + 1..end)
+                .map(|j| lines[j].trim_start())
+                .filter(|t| !t.is_empty() && !t.starts_with('#'))
+                .collect();
+            let value_of = |name: &str| -> Option<String> {
+                block.iter().find_map(|t| {
+                    let (k, rest) = parse_cargo_entry_key(t)?;
+                    if k != name {
+                        return None;
+                    }
+                    let v = rest.trim_start().strip_prefix('=')?.trim();
+                    Some(
+                        v.strip_prefix('"')
+                            .and_then(|s| s.split('"').next())
+                            .unwrap_or(v)
+                            .to_string(),
+                    )
+                })
+            };
+            let is_ours = match value_of("package") {
+                Some(package) => package == crate_name,
+                None => key == crate_name,
+            };
+            if is_ours {
+                if let Some(reg) = value_of("registry").filter(|v| is_socket_patch_registry_name(v))
+                {
+                    return Some(reg);
+                }
+            }
+            continue;
+        }
+        let CargoTomlSection::DepTable { .. } = section else {
+            continue;
+        };
+        let Some((key, rest)) = parse_cargo_entry_key(trimmed) else {
+            continue;
+        };
+        let rest_trim = rest.trim_start();
+        if let Some(dotted) = rest_trim.strip_prefix('.') {
+            // `<crate>.registry = "socket-patch-…"`: a spelling this rewriter
+            // refuses to write, but a hand edit can leave one behind.
+            if key == crate_name
+                && parse_cargo_entry_key(dotted).is_some_and(|(k, _)| k == "registry")
+            {
+                if let Some(reg) = socket_value(trimmed) {
+                    return Some(reg);
+                }
+            }
+            continue;
+        }
+        let Some(value) = rest_trim.strip_prefix('=').map(str::trim_start) else {
+            continue;
+        };
+        if !value.starts_with('{') {
+            continue;
+        }
+        let Some(close) = value.find('}') else {
+            continue;
+        };
+        let inner = &value[1..close];
+        let is_ours = match CARGO_TOML_PACKAGE_RE.captures(inner) {
+            Some(c) => c[1] == *crate_name,
+            None => key == crate_name,
+        };
+        if is_ours {
+            if let Some(reg) = socket_value(inner) {
+                return Some(reg);
+            }
+        }
+    }
+    None
+}
+
 /// Split a TOML table-header path into dot segments, respecting quoted
 /// segments (`target.'cfg(unix)'.dependencies`). `None` on unbalanced quotes.
 fn split_toml_header_segments(inner: &str) -> Option<Vec<String>> {
@@ -7887,6 +7999,79 @@ mod tests {
         assert!(r.confirmed_cargo_uuids.contains(CARGO_UUID));
     }
 
+    /// The residue probe (`vendor`'s fail-closed guard against wiring
+    /// `[patch.crates-io]` on top of a live hosted redirect) reads back
+    /// EVERY declaration shape this rewriter pins — driven through the
+    /// rewriter itself so the two can never drift apart. A single-line
+    /// `<name> = { … }` regex saw only the first of these.
+    #[test]
+    fn cargo_socket_registry_pin_reads_back_every_written_shape() {
+        let head = "[package]\nname = \"app\"\nversion = \"0.1.0\"\n\n";
+        let shapes = [
+            ("plain version", "[dependencies]\nserde = \"1.0.190\"\n"),
+            ("quoted key", "[dependencies]\n\"serde\" = \"1.0.190\"\n"),
+            (
+                "inline table",
+                "[dependencies]\nserde = { version = \"1.0.190\" }\n",
+            ),
+            (
+                "renamed inline table",
+                "[dependencies]\nlegacy = { package = \"serde\", version = \"1.0.190\" }\n",
+            ),
+            (
+                "table form",
+                "[dependencies.serde]\nversion = \"1.0.190\"\n",
+            ),
+            (
+                "renamed table form",
+                "[dependencies.legacy]\npackage = \"serde\"\nversion = \"1.0.190\"\n",
+            ),
+            (
+                "dev-dependency table form",
+                "[dev-dependencies.serde]\nversion = \"1.0.190\"\n",
+            ),
+            (
+                "target table",
+                "[target.'cfg(unix)'.dependencies]\nserde = \"1.0.190\"\n",
+            ),
+            (
+                "workspace dependencies table form",
+                "[workspace.dependencies.serde]\nversion = \"1.0.190\"\n",
+            ),
+        ];
+        for (shape, body) in shapes {
+            let pristine = format!("{head}{body}");
+            assert_eq!(
+                cargo_socket_registry_pin(&pristine, "serde"),
+                None,
+                "{shape}: an unpinned manifest is not residue"
+            );
+            let r = rewrite_registry_redirect(&cargo_files(&pristine), &[cargo_sparse_override()]);
+            assert!(r.warnings.is_empty(), "{shape}: {:?}", r.warnings);
+            let written = r.files.get("Cargo.toml").expect("Cargo.toml rewritten");
+            assert_eq!(
+                cargo_socket_registry_pin(written, "serde").as_deref(),
+                Some(cargo_reg().as_str()),
+                "{shape}: the probe must read back what the rewriter wrote: {written}"
+            );
+        }
+        // Another crate's pin, and a registry that is not ours, are not this
+        // crate's residue.
+        let other = format!(
+            "{head}[dependencies]\nother = {{ version = \"1\", registry = \"{}\" }}\n\
+             serde = {{ version = \"1.0.190\", registry = \"corp-mirror\" }}\n",
+            cargo_reg()
+        );
+        assert_eq!(cargo_socket_registry_pin(&other, "serde"), None);
+        // A renamed key declaring ANOTHER crate never answers for `serde`.
+        let renamed_other = format!(
+            "{head}[dependencies]\nserde = {{ package = \"serde_json\", version = \"1\", \
+             registry = \"{}\" }}\n",
+            cargo_reg()
+        );
+        assert_eq!(cargo_socket_registry_pin(&renamed_other, "serde"), None);
+    }
+
     fn cargo_lock_with(name: &str, version: &str) -> String {
         format!(
             "# This file is automatically @generated by Cargo.\n\
diff --git a/crates/socket-patch-core/src/vendor/cargo.rs b/crates/socket-patch-core/src/vendor/cargo.rs
index 7c74cdbb..bc8a83e3 100644
--- a/crates/socket-patch-core/src/vendor/cargo.rs
+++ b/crates/socket-patch-core/src/vendor/cargo.rs
@@ -138,14 +138,15 @@ async fn hosted_redirect_residue(project_root: &Path, name: &str, version: &str)
     // run in an open(2) that waits for a writer; an unreadable manifest has
     // no readable residue, matching the read_to_string Err arm this guards.
     if let Ok(toml) = read_regular_to_string(&project_root.join("Cargo.toml")).await {
-        let c = regex::escape(name);
-        let re = regex::Regex::new(&format!(
-            r#"(?m)^\s*{c}\s*=\s*\{{[^}}\n]*registry\s*=\s*"socket-patch-[0-9a-fA-F-]{{36}}""#
-        ))
-        .expect("static regex");
-        if re.is_match(&toml) {
+        // The rewriter's own reader, not a single-line regex: the hosted pin
+        // is just as often a standalone `registry = …` line under a
+        // `[dependencies.<crate>]` header, or sits under a renamed key
+        // (`legacy = { package = "<crate>", … }`) — shapes a
+        // `<name> = { … }` regex reads as "not redirected", which is exactly
+        // the half-reverted state this guard exists for.
+        if let Some(reg) = crate::patch::redirect::cargo_socket_registry_pin(&toml, name) {
             return Some(format!(
-                "Cargo.toml pins `{name}` to a socket-patch hosted registry"
+                "Cargo.toml pins `{name}` to the socket-patch hosted registry `{reg}`"
             ));
         }
     }
@@ -3612,6 +3613,105 @@ mod tests {
         );
     }
 
+    /// FAIL CLOSED in EVERY manifest shape the hosted rewriter writes: a
+    /// standalone `registry = …` line under a `[dependencies.<crate>]`
+    /// header, a renamed declaration (`legacy = { package = "cfg-if", … }`)
+    /// and a quoted key. The lock is the pristine crates.io one — a
+    /// re-resolve or a `git checkout Cargo.lock` puts it back while the
+    /// manifest pin survives — so the manifest probe is the ONLY thing
+    /// standing between `vendor` and a project wired for both modes at once.
+    #[tokio::test]
+    async fn test_refuses_live_hosted_redirect_in_every_manifest_shape() {
+        let index = "sparse+http://127.0.0.1:5555/index/";
+        let shapes = [
+            (
+                "table form",
+                format!(
+                    "[package]\nname = \"app\"\nversion = \"0.1.0\"\n\n\
+                     [dependencies.cfg-if]\nversion = \"1\"\n\
+                     registry = \"socket-patch-{UUID}\"\n"
+                ),
+            ),
+            (
+                "renamed declaration",
+                format!(
+                    "[package]\nname = \"app\"\nversion = \"0.1.0\"\n\n\
+                     [dependencies]\ncfg-if-legacy = {{ package = \"cfg-if\", \
+                     version = \"1\", registry = \"socket-patch-{UUID}\" }}\n"
+                ),
+            ),
+            (
+                "quoted key",
+                format!(
+                    "[package]\nname = \"app\"\nversion = \"0.1.0\"\n\n\
+                     [dependencies]\n\"cfg-if\" = {{ version = \"1\", \
+                     registry = \"socket-patch-{UUID}\" }}\n"
+                ),
+            ),
+            (
+                "dev-dependency table",
+                format!(
+                    "[package]\nname = \"app\"\nversion = \"0.1.0\"\n\n\
+                     [dev-dependencies.cfg-if]\n\
+                     registry = \"socket-patch-{UUID}\"\nversion = \"1\"\n"
+                ),
+            ),
+        ];
+        for (shape, manifest) in shapes {
+            let (dir, blobs, pristine, record) = fixture().await;
+            let root = dir.path();
+            tokio::fs::write(root.join("Cargo.toml"), &manifest)
+                .await
+                .unwrap();
+            tokio::fs::create_dir_all(root.join(".cargo"))
+                .await
+                .unwrap();
+            tokio::fs::write(
+                root.join(".cargo/config.toml"),
+                format!("[registries.socket-patch-{UUID}]\nindex = \"{index}\"\n"),
+            )
+            .await
+            .unwrap();
+            let detail = expect_refused(
+                run_vendor(PURL, root, &blobs, &pristine, &record, false).await,
+                "hosted_redirect_live",
+            );
+            assert!(
+                detail.contains(&format!("socket-patch-{UUID}")),
+                "{shape}: the refusal names the live registry: {detail}"
+            );
+            assert!(
+                !root.join(format!(".socket/vendor/cargo/{UUID}")).exists(),
+                "{shape}: nothing was half-vendored"
+            );
+            assert_eq!(
+                tokio::fs::read_to_string(root.join("Cargo.toml"))
+                    .await
+                    .unwrap(),
+                manifest,
+                "{shape}: the manifest is untouched"
+            );
+        }
+    }
+
+    /// A dependency pinned to a registry that is NOT ours, and an unpinned
+    /// one, are not hosted residue: vendoring proceeds.
+    #[tokio::test]
+    async fn test_foreign_registry_pin_is_not_hosted_residue() {
+        let (dir, blobs, pristine, record) = fixture().await;
+        let root = dir.path();
+        tokio::fs::write(
+            root.join("Cargo.toml"),
+            "[package]\nname = \"app\"\nversion = \"0.1.0\"\n\n\
+             [dependencies.cfg-if]\nversion = \"1\"\nregistry = \"corp-mirror\"\n",
+        )
+        .await
+        .unwrap();
+        let (result, _entry, _warnings) =
+            expect_done(run_vendor(PURL, root, &blobs, &pristine, &record, false).await);
+        assert!(result.success, "vendor failed: {:?}", result.error);
+    }
+
     // ── service status arms: pending / unavailable / failed ──────────────
 
     /// `auto` + a still-building service artifact falls back to the local

From c07fa667cfb4f69774a1f4263b23a4103ffe4659 Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Thu, 24 Sep 2026 23:06:36 -0400
Subject: [PATCH 06/13] fix(vendor): pin the cargo tag allowance to this patch
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A cargo patch that edits the crate's own Cargo.toml verifies with the
Socket version tag dropped. The whole-tree inventory check drops only
THIS entry's tag; the per-file check dropped whatever Socket tag it
found, so a copy under <uuidA>'s path whose manifest is tagged for
<uuidB> — a hand edit, a merged vendored tree, a half-applied uuid bump
— verified clean and repair reported it healthy, while VEX discovery
refused the same bytes as dead wiring. Cargo builds it as the version
the tag names, which is not the version the detached lock pins.

Cargo entries record no file inventory, so this per-file path is the
live one for every vendored crate, not a legacy fallback. It now
applies the same uuid pin, with the four-arm test the inventory path
already had.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 CHANGELOG.md                                  |   5 +-
 crates/socket-patch-core/src/vendor/verify.rs | 114 ++++++++++++++++--
 2 files changed, 110 insertions(+), 9 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index bae4ae27..4f496bb8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -87,7 +87,10 @@ into the new version's section — see docs/releasing.md.
   diagnosed unattributable; an untagged detached entry counts only beside
   an untagged copy (the pre-tag vendored shape) — beside a tagged copy it
   is some other crate cargo built, not attested. A patch that edits the
-  crate's own `Cargo.toml` verifies with the tag dropped.
+  crate's own `Cargo.toml` verifies with the tag dropped — the tag being
+  this copy's own uuid, the same pin the inventory check applies, so a copy
+  tagged for another patch stays a mismatch instead of verifying clean
+  while VEX refuses it.
 - **Vendored cargo wiring moved to `Cargo.toml`.** `vendor` / `scan` /
   `get --mode vendored` write the `[patch.crates-io]` path entry into the
   workspace-root `Cargo.toml` (beside the `Cargo.lock` it detaches) instead
diff --git a/crates/socket-patch-core/src/vendor/verify.rs b/crates/socket-patch-core/src/vendor/verify.rs
index c7c4d506..32c0e58b 100644
--- a/crates/socket-patch-core/src/vendor/verify.rs
+++ b/crates/socket-patch-core/src/vendor/verify.rs
@@ -97,7 +97,8 @@ pub async fn verify_vendored_patch_record(
     let is_zip =
         path_str.ends_with(".whl") || path_str.ends_with(".nupkg") || path_str.ends_with(".jar");
     if !is_tarball && !is_zip {
-        verify_dir_members(&artifact, record, entry.ecosystem == "cargo").await?;
+        let cargo_uuid = (entry.ecosystem == "cargo").then_some(entry.uuid.as_str());
+        verify_dir_members(&artifact, record, cargo_uuid).await?;
         // Whole-tree cross-check: a dir-shaped artifact's bytes are covered
         // by NO lockfile integrity (bundler path sources, cargo path deps,
         // …), so the members above are the only thing the record can vouch
@@ -128,16 +129,28 @@ pub async fn verify_vendored_patch_record(
 /// fail-closes on path-escaping keys). A cargo copy's `Cargo.toml` carries
 /// the `+socket.<uuid>` version tag written after the patch applied
 /// (`vendor::cargo_tag`): a patched `Cargo.toml` verifies with the tag
-/// dropped.
-async fn verify_dir_members(dir: &Path, record: &PatchRecord, cargo: bool) -> Result<(), String> {
+/// dropped, provided the tag is exactly `cargo_uuid` (the entry's own patch)
+/// — the same pin [`verify_dir_inventory`] applies. A copy tagged for ANOTHER
+/// patch is a different build than the lock's `<version>+socket.<uuid>` names,
+/// so it stays a mismatch here instead of verifying clean while VEX discovery
+/// refuses it.
+async fn verify_dir_members(
+    dir: &Path,
+    record: &PatchRecord,
+    cargo_uuid: Option<&str>,
+) -> Result<(), String> {
     for (file_name, info) in &record.files {
         let result = verify_file_patch(dir, file_name, info).await;
         match result.status {
             VerifyStatus::AlreadyPatched => continue,
             VerifyStatus::Ready | VerifyStatus::HashMismatch
-                if cargo
-                    && super::cargo_tag::is_copy_manifest_key(file_name)
-                    && untagged_manifest_matches(dir, &info.after_hash).await =>
+                if match cargo_uuid {
+                    Some(uuid) => {
+                        super::cargo_tag::is_copy_manifest_key(file_name)
+                            && untagged_manifest_matches(dir, uuid, &info.after_hash).await
+                    }
+                    None => false,
+                } =>
             {
                 continue
             }
@@ -151,11 +164,16 @@ async fn verify_dir_members(dir: &Path, record: &PatchRecord, cargo: bool) -> Re
 }
 
 /// Does the cargo copy's `Cargo.toml`, Socket tag dropped, hash to
-/// `after_hash`?
-async fn untagged_manifest_matches(dir: &Path, after_hash: &str) -> bool {
+/// `after_hash` — with the tag being exactly `uuid`'s? A manifest tagged for
+/// another patch (a hand edit, a merged vendored tree, a half-applied uuid
+/// bump) is NOT this entry's copy, so it never matches.
+async fn untagged_manifest_matches(dir: &Path, uuid: &str, after_hash: &str) -> bool {
     let Ok(text) = crate::utils::fs::read_regular_to_string(&dir.join("Cargo.toml")).await else {
         return false;
     };
+    if super::cargo_tag::manifest_tag_uuid(&text).as_deref() != Some(uuid) {
+        return false;
+    }
     super::cargo_tag::untagged_manifest_bytes(text.as_bytes())
         .is_some_and(|b| compute_git_sha256_from_bytes(&b).eq_ignore_ascii_case(after_hash))
 }
@@ -766,6 +784,86 @@ mod tests {
         );
     }
 
+    /// The MEMBER path (a record keyed on the copy's own `Cargo.toml`, the
+    /// shape a patch that edits the crate's manifest takes) applies the same
+    /// uuid pin as the inventory path: the tag is dropped only when it is
+    /// THIS entry's. Cargo entries carry no inventory
+    /// (`vendor::cargo` records `file_inventory: None`), so this is the live
+    /// path, not a legacy one — and a copy tagged for another patch builds
+    /// as a version the lock does not name, which VEX discovery already
+    /// refuses to attest.
+    #[tokio::test]
+    async fn cargo_member_path_accepts_only_this_uuids_manifest_tag() {
+        const OTHER: &str = "0a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d";
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path();
+        let rel = format!(".socket/vendor/cargo/{UUID}/cfg-if-1.0.4");
+        let dir = root.join(&rel);
+        tokio::fs::create_dir_all(&dir).await.unwrap();
+        let untagged = "[package]\nname = \"cfg-if\"\nversion = \"1.0.4\"\n\
+                        \n[dependencies]\nlibc = \"0.2.155\"\n";
+        let mut rec = record(UUID, "Cargo.toml");
+        rec.files.insert(
+            "Cargo.toml".to_string(),
+            PatchFileInfo {
+                before_hash: "b".into(),
+                after_hash: compute_git_sha256_from_bytes(untagged.as_bytes()),
+            },
+        );
+        let mut ent = entry("cargo", UUID, &rel);
+        ent.base_purl = "pkg:cargo/cfg-if@1.0.4".into();
+        assert!(ent.artifact.file_inventory.is_none(), "cargo records none");
+
+        let tagged = |uuid: &str| untagged.replace("1.0.4\"", &format!("1.0.4+socket.{uuid}\""));
+        for (why, text, want) in [
+            (
+                "untagged (the patch's own bytes)",
+                untagged.to_string(),
+                None,
+            ),
+            ("this uuid's tag", tagged(UUID), None),
+            (
+                "another uuid's tag",
+                tagged(OTHER),
+                Some("vendor_hash_mismatch"),
+            ),
+            (
+                "drift beside this uuid's tag",
+                tagged(UUID) + "build = \"build.rs\"\n",
+                Some("vendor_hash_mismatch"),
+            ),
+        ] {
+            tokio::fs::write(dir.join("Cargo.toml"), &text)
+                .await
+                .unwrap();
+            let got = verify_vendored_patch_record(root, &ent, &rec).await;
+            match want {
+                None => assert!(got.is_ok(), "{why}: {got:?}"),
+                Some(err) => assert_eq!(got.as_ref().unwrap_err(), err, "{why}"),
+            }
+            let health = check_vendored_artifact(root, &ent, &rec).await;
+            assert_eq!(
+                health == ArtifactHealth::Healthy,
+                want.is_none(),
+                "{why}: repair's rebuild decision follows the same verdict ({health:?})"
+            );
+        }
+
+        // The allowance is cargo's alone: the same bytes under another
+        // dir-shaped ecosystem stay pinned to the recorded hash.
+        tokio::fs::write(dir.join("Cargo.toml"), tagged(UUID))
+            .await
+            .unwrap();
+        let mut gem = entry("gem", UUID, &rel);
+        gem.base_purl = "pkg:gem/cfg-if@1.0.4".into();
+        assert_eq!(
+            verify_vendored_patch_record(root, &gem, &rec)
+                .await
+                .unwrap_err(),
+            "vendor_hash_mismatch"
+        );
+    }
+
     /// The whole-tree inventory closes the dir-shaped blindspot: with only
     /// afterHashes, a tampered UNPATCHED file (or stub gemspec), a deleted
     /// file, or a planted extra file were all blessed Healthy. Each arm of

From c3ddd7247168a56be47ff42966479173a63f2da0 Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Thu, 24 Sep 2026 23:06:50 -0400
Subject: [PATCH 07/13] test(vendor): assert the old-toolchain index constraint
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The two-version old-toolchain test only printed whether a build without
--offline worked, and reached the documented 1.41 remedy (a populated
crates.io index in $CARGO_HOME) only when the plain --offline build
happened to fail. Both arms run with no network, so the unasserted run
could only fail, for a reason nothing checked — and a cargo that stopped
needing the index would have skipped the remedy and still passed.

Both directions are now asserted: the run without --offline must fail
on the unreachable crates.io index, and below 1.56 the empty-CARGO_HOME
--offline run must fail with the missing registry index before the
seeded index is required to build and run both patched copies.

The docs said 1.56 needs --offline; what 1.56 needs is --offline or a
reachable index, exactly like 1.41, which additionally needs the index
populated. Both the changelog and the ecosystem notes now say that.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 CHANGELOG.md                                  | 10 ++--
 .../tests/e2e_vendor_cargo_build.rs           | 59 +++++++++++++------
 docs/ecosystems.md                            | 12 ++--
 3 files changed, 55 insertions(+), 26 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4f496bb8..e65787d6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -97,10 +97,12 @@ into the new version's section — see docs/releasing.md.
   of `.cargo/config.toml` / `.cargo/config`, so Socket scanners can recover
   the patch uuid from the manifest alone and single-version wiring builds
   on cargo older than 1.56 (the floor of config-file `[patch]`; proven on
-  cargo 1.41 with no network); two vendored versions of one crate need
-  `--offline` on cargo 1.56, and a populated registry index (the crates.io
-  index in `$CARGO_HOME`, or network access) on older cargo such as 1.41,
-  which loads it to tell the two entries apart. The edit is
+  cargo 1.41 with no network); two vendored versions of one crate make older cargo
+  load the crates.io index to tell the two entries apart: `--offline` from
+  an empty `$CARGO_HOME` is enough on cargo 1.56, while older cargo such as
+  1.41 needs the index itself (the crates.io index in `$CARGO_HOME`, or
+  network access), and without `--offline` either one first tries to update
+  the index and fails when it is unreachable. The edit is
   format-preserving (comments, ordering, CRLF / mixed line endings, a
   UTF-8 BOM and the trailing-newline state survive; a revert restores the
   manifest byte for byte and keeps a user's own `[patch]` /
diff --git a/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs b/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs
index 79b3e3df..5a9d78cb 100644
--- a/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs
@@ -2078,15 +2078,23 @@ fn cargo_vendored_manifest_patch_builds_on_old_toolchains() {
 }
 
 /// OLD TOOLCHAIN, TWO VERSIONS of one crate: older cargo loads the
-/// crates.io index to tell two same-named `[patch]` entries apart. Cargo
-/// 1.56 builds the committed two-version wiring under `--offline` from an
-/// empty CARGO_HOME (what the docs require there); older cargo (1.41) needs
-/// the index itself — it fails under `--offline` with no registry cache
-/// (only that failure is accepted from an empty CARGO_HOME), and the
-/// documented remedy, a populated crates.io index in `$CARGO_HOME`, must
-/// then build (and run) both patched copies with no network. Without
-/// `--offline` the outcome is only reported (current stable needs neither
-/// — see `cargo_vendor_two_versions_of_one_crate_locked_build`).
+/// crates.io index to tell two same-named `[patch]` entries apart. Every
+/// clause of the documented constraint is ASSERTED here, in both
+/// directions, because both arms run with no network (docker `--network
+/// none`, rustup pointed at a dead proxy):
+///
+/// * without `--offline` the build MUST fail, and fail on the unreachable
+///   index — the negative control for "pass `--offline`";
+/// * cargo 1.56 then builds under `--offline` from an EMPTY CARGO_HOME;
+/// * older cargo (1.41) MUST first fail even under `--offline` (no registry
+///   cache to read), and the documented remedy — a populated crates.io
+///   index in `$CARGO_HOME` — must then build (and run) both patched
+///   copies with no network. That step is unconditional below 1.56, so a
+///   cargo that stops needing it fails this test instead of silently
+///   skipping the remedy.
+///
+/// Current stable needs neither — see
+/// `cargo_vendor_two_versions_of_one_crate_locked_build`.
 #[test]
 fn cargo_vendored_two_versions_on_old_toolchains_need_offline() {
     const SUITE: &str = "e2e_vendor_cargo_build (old-toolchain multi-version)";
@@ -2112,18 +2120,33 @@ fn cargo_vendored_two_versions_on_old_toolchains_need_offline() {
         let name = old.name();
         let (fresh, _) = fresh_checkout(&fx.proj, tmp.path(), &format!("mv-{}", old.minor()));
         std::fs::write(fresh.join("Cargo.lock"), lock_for_minor(&lock, old.minor())).unwrap();
+        // What an old cargo says when it must load the crates.io index and
+        // cannot reach it: 1.56 fails to update the registry, 1.41 fails to
+        // resolve the index host. Both name the index or its host, which is
+        // what distinguishes this from a wiring failure.
+        const INDEX_UNREACHABLE: [&str; 3] = ["crates.io-index", "crates-io", "github.com"];
         let online = old_cargo_run(&old, &fresh, &[]);
-        println!(
-            "old-toolchain multi-version {name} without --offline: {}",
-            if online.out.status.success() {
-                "ok"
-            } else {
-                "needs --offline (registry index unreachable)"
-            }
+        let online_stderr = String::from_utf8_lossy(&online.out.stderr).into_owned();
+        assert!(
+            !online.out.status.success(),
+            "{name}: with no network and no --offline the two-version wiring must NOT \
+             build — the constraint the docs state:\n{online_stderr}"
+        );
+        assert!(
+            INDEX_UNREACHABLE.iter().any(|m| online_stderr.contains(m)),
+            "{name}: it must fail on the unreachable crates.io index, not on the \
+             wiring:\n{online_stderr}"
         );
+        println!("old-toolchain multi-version {name} without --offline: needs the index");
         let mut run = old_cargo_run(&old, &fresh, &["--offline"]);
-        if old.minor() < 56 && !run.out.status.success() {
-            let stderr = String::from_utf8_lossy(&run.out.stderr);
+        if old.minor() < 56 {
+            let stderr = String::from_utf8_lossy(&run.out.stderr).into_owned();
+            assert!(
+                !run.out.status.success(),
+                "{name}: below 1.56 an EMPTY CARGO_HOME cannot tell the two [patch] \
+                 entries apart offline — the reason the index remedy is documented:\n\
+                 {stderr}"
+            );
             assert!(
                 stderr.contains("unable to fetch registry") && stderr.contains("in offline mode"),
                 "{name}: the only accepted failure below 1.56 is the missing registry \
diff --git a/docs/ecosystems.md b/docs/ecosystems.md
index a3f3a7e1..7fbbd168 100644
--- a/docs/ecosystems.md
+++ b/docs/ecosystems.md
@@ -260,10 +260,14 @@ version = "1.0.4+socket.<uuid>"
   the patched copy with no network on the cargo 1.41 and 1.56 docker
   images — the CI `cargo-old-toolchains` leg; without the images a local
   run falls back to type-checking on rustup toolchains).
-  Two vendored versions of ONE crate need `cargo build --offline` on 1.56,
-  and on older cargo (1.41) a populated crates.io index in `$CARGO_HOME`
-  (or network access) — it loads the index to tell the two entries apart.
-  Current stable needs neither.
+  Two vendored versions of ONE crate make older cargo load the crates.io
+  index to tell the two `[patch]` entries apart: on 1.56 `cargo build
+  --offline` from an empty `$CARGO_HOME` is enough, while older cargo
+  (1.41) needs the index itself — a populated crates.io index in
+  `$CARGO_HOME`, or network access. Without `--offline` either one tries to
+  update the index first and fails when it is unreachable. Current stable
+  needs neither. Each clause is asserted by the old-toolchain e2e test, in
+  both directions.
 - **Keys.** Always the Socket-owned `<name>-socket-<first 8 hex of the
   uuid>` with `package = "<name>"` (the full uuid hex if that key is
   taken), never the bare crate name: cargo lets a config-file `[patch]`

From 397259cf6f8a84c321c0c676fda991e8da59642d Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Fri, 25 Sep 2026 00:06:03 -0400
Subject: [PATCH 08/13] fix(purl): decode build-metadata versions before
 matching
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The patches API serves canonical PURLs, so a semver build-metadata
version arrives percent-encoded — pkg:cargo/wasi@0.11.0%2Bwasi-snapshot-
preview1. The parsers compared that raw spelling against Cargo.lock's
0.11.0+wasi-snapshot-preview1, never matched, and refused the package
with vendor_fetched_missing and then locked_version_mismatch. It failed
closed, but no cargo crate with build metadata could be vendored at all,
and wasi is in most Rust dependency graphs.

Every ecosystem's parse now percent-decodes the namespace, name and
version exactly once, after the / and @ split and before the callers'
path-safety guards, so an escaped separator still cannot introduce a
path segment and an already-decoded %2B cannot become a second +. The
crawler and the ledger revert paths that decoded by hand, or fed an
already-canonical PURL back in, drop their extra pass.

Hosted mode already went through a decoding parse and is unchanged.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 CHANGELOG.md                                  |  13 +
 .../tests/e2e_vendor_cargo_build.rs           | 154 +++++++++
 .../src/crawlers/cargo_crawler.rs             |   1 +
 .../src/crawlers/composer_crawler.rs          |   2 +
 .../src/crawlers/go_crawler.rs                |   5 +-
 .../src/crawlers/maven_crawler.rs             |   2 +
 .../src/crawlers/nuget_crawler.rs             |   5 +-
 .../src/crawlers/python_crawler.rs            |   6 +-
 .../src/crawlers/ruby_crawler.rs              |   1 +
 .../src/patch/redirect/golang_local.rs        |  14 +-
 .../src/patch/redirect/takeover.rs            |  16 +-
 crates/socket-patch-core/src/utils/purl.rs    | 312 ++++++++++++++----
 crates/socket-patch-core/src/vendor/cargo.rs  |   5 +
 .../src/vendor/composer_lock.rs               |   1 +
 crates/socket-patch-core/src/vendor/gem.rs    |   6 +-
 crates/socket-patch-core/src/vendor/golang.rs |   4 +-
 .../src/vendor/maven_repo.rs                  |   2 +
 .../src/vendor/nuget_feed.rs                  |   1 +
 crates/socket-patch-core/src/vendor/pypi.rs   |   1 +
 .../src/vex/discover/maven.rs                 |   1 +
 20 files changed, 458 insertions(+), 94 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e65787d6..b305cc4b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -726,6 +726,19 @@ into the new version's section — see docs/releasing.md.
   `setup --remove` could not land byte-identical on the pre-setup file.
   `package.json` is now written in its own layout (BOM, indent, line ending,
   trailing-newline shape), the same helper the vendored backends use.
+- **Vendored mode can patch a package whose version carries build
+  metadata.** The patches API serves canonical PURLs, so a semver build
+  metadata version arrives percent-encoded
+  (`pkg:cargo/wasi@0.11.0%2Bwasi-snapshot-preview1`). The PURL parsers
+  compared that raw spelling against the lockfile / install directory's
+  `0.11.0+wasi-snapshot-preview1`, never matched, and refused the package
+  (`vendor_fetched_missing`, then `locked_version_mismatch`) — so no cargo
+  crate with build metadata (`wasi` is in most Rust dependency graphs)
+  could be vendored at all. Every ecosystem's PURL parse now
+  percent-decodes the namespace, name and version once, after the
+  `/`-and-`@` split and before the path-safety guards, so an escaped
+  separator still cannot introduce a path segment. Hosted mode was already
+  correct.
 - **A vendoring-service outage no longer re-vendors packages.** An npm
   re-run (every lock flavor, `bun.lockb` included) re-acquired its tarball
   from whichever source answered — the service's prebuilt, or a local pack
diff --git a/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs b/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs
index 5a9d78cb..cab8c87c 100644
--- a/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs
@@ -1826,6 +1826,160 @@ fn cargo_legacy_config_wiring_migrates_to_the_manifest() {
     assert!(!proj.join(".socket/vendor").exists());
 }
 
+// ── build-metadata versions (the encoded purl the API serves) ─────────
+
+/// A dep-free crates.io crate whose version carries semver BUILD METADATA.
+const META_DEP: &str = "wasi";
+const META_VERSION: &str = "0.11.0+wasi-snapshot-preview1";
+
+/// BUILD METADATA: the patches API serves canonical purls, so this crate's
+/// version arrives percent-encoded (`0.11.0%2Bwasi-snapshot-preview1`).
+/// REGRESSION: the vendored backend compared that raw spelling against
+/// Cargo.lock's `0.11.0+wasi-snapshot-preview1` and refused
+/// (`vendor_fetched_missing` then `locked_version_mismatch`), so no crate
+/// with build metadata — `wasi` is in most Rust dependency graphs — could
+/// ever be vendored. Proves the whole committable shape for one: the copy
+/// dir keeps the DECODED version, its manifest is tagged
+/// `<version>.socket.<uuid>` (the tag appends to existing metadata), the
+/// lock entry is detached at the tagged version, real cargo builds and runs
+/// the patched bytes under `--locked --offline`, and `--revert` restores
+/// both files byte-for-byte.
+#[test]
+fn cargo_vendor_build_metadata_version_from_encoded_purl() {
+    const SUITE: &str = "e2e_vendor_cargo_build (build-metadata)";
+    if !cargo_e2e_matrix::cargo_available(SUITE) {
+        return;
+    }
+    let tmp = tempfile::tempdir().unwrap();
+    // A consumer whose ONLY dependency is the build-metadata crate, so the
+    // fresh-checkout build below has no unvendored registry dep to fetch.
+    let proj = tmp.path().join("proj");
+    let cargo_home = tmp.path().join("cargo-home");
+    std::fs::create_dir_all(proj.join("src")).unwrap();
+    std::fs::create_dir_all(&cargo_home).unwrap();
+    std::fs::write(
+        proj.join("Cargo.toml"),
+        format!(
+            "[package]\nname = \"consumer\"\nversion = \"0.1.0\"\nedition = \"2021\"\n\n\
+             [dependencies]\n{META_DEP} = \"={META_VERSION}\"\n"
+        ),
+    )
+    .unwrap();
+    std::fs::write(
+        proj.join("src/main.rs"),
+        "fn main() { println!(\"baseline\"); }\n",
+    )
+    .unwrap();
+    let build = cargo(&proj, &["build", "-q"], &cargo_home);
+    if !build.status.success() {
+        let _ = cargo_e2e_matrix::skip(
+            SUITE,
+            &format!(
+                "baseline `cargo build` failed (crates.io unreachable?):\n{}",
+                String::from_utf8_lossy(&build.stderr)
+            ),
+        );
+        return;
+    }
+    cargo_e2e_matrix::apply_lock_version(&proj);
+    let lock_text = std::fs::read_to_string(proj.join("Cargo.lock")).unwrap();
+    let version = locked_version(&lock_text, META_DEP)
+        .unwrap_or_else(|| panic!("Cargo.lock must lock {META_DEP}:\n{lock_text}"));
+    assert_eq!(
+        version, META_VERSION,
+        "the fixture pins the build-metadata version"
+    );
+    let crate_dir = find_registry_crate(&cargo_home, &format!("{META_DEP}-{version}"))
+        .unwrap_or_else(|| panic!("{META_DEP}-{version} must be extracted under registry/src"));
+
+    // EXACTLY what the API serves: the version percent-encoded.
+    let purl = format!("pkg:cargo/{META_DEP}@{}", version.replace('+', "%2B"));
+    let orig = std::fs::read(crate_dir.join("src/lib.rs")).unwrap();
+    let suffix = b"\n/// Socket-patch build-metadata marker.\npub fn socket_patched() -> u32 { 1 }\n\
+                   /// The version cargo compiled this copy as.\npub fn socket_pkg_version() -> &'static str { env!(\"CARGO_PKG_VERSION\") }\n";
+    let patched: Vec<u8> = [orig.as_slice(), suffix.as_slice()].concat();
+    stage_patch(&proj, &purl, "src/lib.rs", &orig, &patched);
+
+    let manifest_before = std::fs::read(proj.join("Cargo.toml")).unwrap();
+    let lock_before = std::fs::read(proj.join("Cargo.lock")).unwrap();
+
+    let env = vendor_ok(&proj, &cargo_home, "build-metadata");
+    assert_eq!(
+        env["summary"]["failed"], 0,
+        "no refusal for a build-metadata version: {env}"
+    );
+
+    // The copy dir and the ledger key off the DECODED version.
+    let copy_rel = format!(".socket/vendor/cargo/{UUID}/{META_DEP}-{version}");
+    let copy_manifest = std::fs::read_to_string(proj.join(&copy_rel).join("Cargo.toml")).unwrap();
+    assert_eq!(
+        socket_patch_core::vendor::cargo_tag::manifest_tag_uuid(&copy_manifest).as_deref(),
+        Some(UUID),
+        "the copy's version is tagged:\n{copy_manifest}"
+    );
+    let tagged_version = socket_patch_core::vendor::cargo_tag::tag_version(&version, UUID);
+    assert_eq!(
+        tagged_version,
+        format!("{version}.socket.{UUID}"),
+        "the tag appends to the existing build metadata"
+    );
+    let lock_after = std::fs::read_to_string(proj.join("Cargo.lock")).unwrap();
+    assert!(
+        lock_after.contains(&format!(
+            "name = \"{META_DEP}\"\nversion = \"{tagged_version}\"\n"
+        )),
+        "the lock entry carries the tagged version:\n{lock_after}"
+    );
+    let manifest_after = std::fs::read_to_string(proj.join("Cargo.toml")).unwrap();
+    assert!(
+        manifest_after.contains(&format!(
+            "{META_DEP}-socket-{} = {{ package = \"{META_DEP}\", path = \"{copy_rel}\" }}",
+            &UUID.replace('-', "")[..8]
+        )),
+        "the [patch.crates-io] entry pins the copy:\n{manifest_after}"
+    );
+
+    // COMPILE ORACLE: only the patched bytes have `socket_patched`.
+    std::fs::write(
+        proj.join("src/main.rs"),
+        format!(
+            "fn main() {{ println!(\"MARKER:{{}}:{{}}\", {META_DEP}::socket_patched(), {META_DEP}::socket_pkg_version()); }}\n"
+        ),
+    )
+    .unwrap();
+    let run = cargo(&proj, &["run", "-q", "--locked", "--offline"], &cargo_home);
+    assert!(
+        String::from_utf8_lossy(&run.stdout).contains(&format!("MARKER:1:{tagged_version}")),
+        "the patched copy builds and runs as the tagged version:\nstdout:\n{}\nstderr:\n{}",
+        String::from_utf8_lossy(&run.stdout),
+        String::from_utf8_lossy(&run.stderr)
+    );
+
+    // Fresh checkout: committable, and nothing is fetched.
+    let (fresh, home) = fresh_checkout(&proj, tmp.path(), "build-metadata");
+    let build = cargo(&fresh, &["build", "-q", "--locked", "--offline"], &home);
+    assert!(
+        build.status.success(),
+        "the fresh checkout must build:\n{}",
+        String::from_utf8_lossy(&build.stderr)
+    );
+    assert!(!home.join("registry").exists(), "zero crate downloads");
+
+    // Revert is byte-identical.
+    std::fs::write(
+        proj.join("src/main.rs"),
+        "fn main() { println!(\"baseline\"); }\n",
+    )
+    .unwrap();
+    revert_ok(&proj, &cargo_home, "build-metadata");
+    assert_eq!(
+        std::fs::read(proj.join("Cargo.toml")).unwrap(),
+        manifest_before
+    );
+    assert_eq!(std::fs::read(proj.join("Cargo.lock")).unwrap(), lock_before);
+    assert!(!proj.join(".socket/vendor").exists());
+}
+
 /// Set to `1` by the CI leg that provides old cargos: then finding none
 /// is a failure, not a skip (the regular matrix legs set
 /// `SOCKET_PATCH_CARGO_E2E_REQUIRED` but provide no old cargo).
diff --git a/crates/socket-patch-core/src/crawlers/cargo_crawler.rs b/crates/socket-patch-core/src/crawlers/cargo_crawler.rs
index e7fc1df9..0667cdc8 100644
--- a/crates/socket-patch-core/src/crawlers/cargo_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/cargo_crawler.rs
@@ -211,6 +211,7 @@ impl CargoCrawler {
 
         for purl in purls {
             if let Some((name, version)) = crate::utils::purl::parse_cargo_purl(purl) {
+                let (name, version) = (name.as_ref(), version.as_ref());
                 // Both coordinates are joined onto the scanned source root
                 // below and the resolved crate dir is patched IN PLACE, so a
                 // tampered PURL must not be able to traverse out of the
diff --git a/crates/socket-patch-core/src/crawlers/composer_crawler.rs b/crates/socket-patch-core/src/crawlers/composer_crawler.rs
index 5a298a42..4253176b 100644
--- a/crates/socket-patch-core/src/crawlers/composer_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/composer_crawler.rs
@@ -165,6 +165,8 @@ impl ComposerCrawler {
             if let Some(((namespace, name), version)) =
                 crate::utils::purl::parse_composer_purl(purl)
             {
+                let (namespace, name, version) =
+                    (namespace.as_ref(), name.as_ref(), version.as_ref());
                 let full_name = format!("{namespace}/{name}").to_ascii_lowercase();
 
                 let Some(entry) = installed.get(&full_name) else {
diff --git a/crates/socket-patch-core/src/crawlers/go_crawler.rs b/crates/socket-patch-core/src/crawlers/go_crawler.rs
index 98d5f137..bd109d3c 100644
--- a/crates/socket-patch-core/src/crawlers/go_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/go_crawler.rs
@@ -181,7 +181,7 @@ impl GoCrawler {
 
         for purl in purls {
             if let Some((module_path, version)) = crate::utils::purl::parse_golang_purl(purl) {
-                let (module_path, version) = (&*module_path, &*version);
+                let (module_path, version) = (module_path.as_ref(), version.as_ref());
                 // SECURITY: `module_path`/`version` come straight from the
                 // (untrusted) manifest PURL and are joined onto the cache root
                 // below. In global mode the resolved directory is patched IN
@@ -1222,8 +1222,7 @@ mod tests {
         // FIRST GOPATH entry is skipped in favor of the next non-empty one
         // (GOPATH is an OS-separator-delimited list; Go uses the first
         // usable entry for the module cache).
-        let gopath_list =
-            std::env::join_paths(["".as_ref(), gopath_a.path().as_os_str()]).unwrap();
+        let gopath_list = std::env::join_paths(["".as_ref(), gopath_a.path().as_os_str()]).unwrap();
         let _gomodcache = EnvGuard::set("GOMODCACHE", "");
         let _gopath = EnvGuard::set("GOPATH", gopath_list.to_str().unwrap());
         let _home = EnvGuard::set("HOME", "/nonexistent-home-unused");
diff --git a/crates/socket-patch-core/src/crawlers/maven_crawler.rs b/crates/socket-patch-core/src/crawlers/maven_crawler.rs
index 232da792..d77c00df 100644
--- a/crates/socket-patch-core/src/crawlers/maven_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/maven_crawler.rs
@@ -421,6 +421,8 @@ impl MavenCrawler {
             if let Some((group_id, artifact_id, version)) =
                 crate::utils::purl::parse_maven_purl(purl)
             {
+                let (group_id, artifact_id, version) =
+                    (group_id.as_ref(), artifact_id.as_ref(), version.as_ref());
                 // SECURITY: the coordinates are untrusted manifest input joined
                 // onto the repo root and then patched IN PLACE. Reject anything
                 // that could traverse out of the repository before touching the
diff --git a/crates/socket-patch-core/src/crawlers/nuget_crawler.rs b/crates/socket-patch-core/src/crawlers/nuget_crawler.rs
index ce85b161..7c37b980 100644
--- a/crates/socket-patch-core/src/crawlers/nuget_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/nuget_crawler.rs
@@ -114,6 +114,7 @@ impl NuGetCrawler {
             let Some((name, version)) = crate::utils::purl::parse_nuget_purl(purl) else {
                 continue;
             };
+            let (name, version) = (name.as_ref(), version.as_ref());
             // SECURITY: the coordinates are untrusted manifest input
             // joined onto the package root and then patched IN PLACE
             // (NuGet has no redirect backend). Reject anything that
@@ -748,7 +749,9 @@ mod tests {
     async fn test_scan_package_dir_dedups_same_package_across_two_scans() {
         let dir = tempfile::tempdir().unwrap();
         let pkg_dir = dir.path().join("newtonsoft.json").join("13.0.3");
-        tokio::fs::create_dir_all(pkg_dir.join("lib")).await.unwrap();
+        tokio::fs::create_dir_all(pkg_dir.join("lib"))
+            .await
+            .unwrap();
 
         let crawler = NuGetCrawler::new();
         let mut seen = HashSet::new();
diff --git a/crates/socket-patch-core/src/crawlers/python_crawler.rs b/crates/socket-patch-core/src/crawlers/python_crawler.rs
index d63c311a..bce50479 100644
--- a/crates/socket-patch-core/src/crawlers/python_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/python_crawler.rs
@@ -1365,13 +1365,11 @@ impl PythonCrawler {
 
         // Build lookup: canonicalized-name@version -> purl. The API serves
         // purls percent-encoded (a PEP 440 local/epoch version carries
-        // `+`/`!`, arriving as `%2B`/`%21`), so decode the coordinates
-        // before keying or the installed package never matches.
+        // `+`/`!`, arriving as `%2B`/`%21`), and `parse_pypi_purl` decodes
+        // the coordinates — undecoded, the installed package never matches.
         let mut purl_lookup: HashMap<String, &str> = HashMap::new();
         for purl in purls {
             if let Some((name, version)) = crate::utils::purl::parse_pypi_purl(purl) {
-                let name = crate::utils::purl::percent_decode_purl_component(name);
-                let version = crate::utils::purl::percent_decode_purl_component(version);
                 let key = format!("{}@{}", canonicalize_pypi_name(&name), version);
                 purl_lookup.insert(key, purl.as_str());
             }
diff --git a/crates/socket-patch-core/src/crawlers/ruby_crawler.rs b/crates/socket-patch-core/src/crawlers/ruby_crawler.rs
index c3dc66f9..1a027d7a 100644
--- a/crates/socket-patch-core/src/crawlers/ruby_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/ruby_crawler.rs
@@ -168,6 +168,7 @@ impl RubyCrawler {
 
         for purl in purls {
             if let Some((name, version)) = crate::utils::purl::parse_gem_purl(purl) {
+                let (name, version) = (name.as_ref(), version.as_ref());
                 // SECURITY: name/version come straight from the (untrusted)
                 // manifest PURL and are formatted into a `<name>-<version>`
                 // dir name joined onto `gem_path` below. A real gem
diff --git a/crates/socket-patch-core/src/patch/redirect/golang_local.rs b/crates/socket-patch-core/src/patch/redirect/golang_local.rs
index 10a5d436..ee4a9138 100644
--- a/crates/socket-patch-core/src/patch/redirect/golang_local.rs
+++ b/crates/socket-patch-core/src/patch/redirect/golang_local.rs
@@ -325,7 +325,7 @@ pub async fn remove_go_redirect(
             format!("not a golang purl: {purl}"),
         )
     })?;
-    let (module, version) = (&*module, &*version);
+    let (module, version) = (module.as_ref(), version.as_ref());
 
     // SECURITY: the copy dir is `<base_rel>/<module>@<version>/` and is about
     // to be `remove_tree`d. Unsafe coordinates (`..` segment / separator /
@@ -361,9 +361,9 @@ pub async fn reconcile_go_redirects(
     desired: &HashSet<String>,
     dry_run: bool,
 ) -> Vec<String> {
-    let desired_modules: HashSet<std::borrow::Cow<str>> = desired
+    let desired_modules: HashSet<String> = desired
         .iter()
-        .filter_map(|p| parse_golang_purl(p).map(|(m, _)| m))
+        .filter_map(|p| parse_golang_purl(p).map(|(m, _)| m.into_owned()))
         .collect();
 
     let mut removed: Vec<String> = Vec::new();
@@ -408,7 +408,7 @@ pub async fn reconcile_go_redirects(
             // Path-exact on purpose: a directive already repointed at the
             // desired version's copy is never touched.
             if let Some((module, version)) = parse_golang_purl(&purl) {
-                let (module, version) = (&*module, &*version);
+                let (module, version) = (module.as_ref(), version.as_ref());
                 let target = replace_target_path(GO_PATCHES_DIR, module, version);
                 if entries.iter().any(|e| {
                     e.owner == Some(ReplaceOwner::GoPatches)
@@ -458,16 +458,16 @@ pub async fn verify_go_redirect_state(
     // Required versions from go.mod (None ⇒ no go.mod ⇒ skip the version
     // cross-check). Read once, project-local, offline.
     let required = read_required_versions(project_root).await;
-    let desired_modules: HashSet<std::borrow::Cow<str>> = desired
+    let desired_modules: HashSet<String> = desired
         .iter()
-        .filter_map(|p| parse_golang_purl(p).map(|(m, _)| m))
+        .filter_map(|p| parse_golang_purl(p).map(|(m, _)| m.into_owned()))
         .collect();
 
     for purl in desired {
         let Some((module, version)) = parse_golang_purl(purl) else {
             continue;
         };
-        let (module, version) = (&*module, &*version);
+        let (module, version) = (module.as_ref(), version.as_ref());
         let Some(record) = manifest.patches.get(purl) else {
             continue;
         };
diff --git a/crates/socket-patch-core/src/patch/redirect/takeover.rs b/crates/socket-patch-core/src/patch/redirect/takeover.rs
index a26862cb..6c7d6dd4 100644
--- a/crates/socket-patch-core/src/patch/redirect/takeover.rs
+++ b/crates/socket-patch-core/src/patch/redirect/takeover.rs
@@ -51,7 +51,9 @@ use std::sync::LazyLock;
 use regex::Regex;
 use serde_json::Value;
 
-use crate::utils::purl::{canonical_purl, parse_cargo_purl, parse_golang_purl, parse_name_version};
+use crate::utils::purl::{
+    parse_cargo_purl, parse_golang_purl, parse_name_version, strip_purl_qualifiers,
+};
 use crate::vendor::go_mod_edit::{
     is_hosted_module_path, parse_replace_entries, HOSTED_GO_MODULE_PREFIX,
 };
@@ -119,7 +121,11 @@ fn find_record_key(state: &RedirectState, purl: &str) -> Result<(String, String)
             "the redirect ledger records no hosted redirect for {purl}"
         ));
     };
-    Ok((record_key, canonical_purl(purl)))
+    // The target keeps the purl's ORIGINAL (percent-encoded) spelling minus
+    // its qualifiers: `parse_cargo_purl` / `parse_name_version` decode the
+    // components themselves, and `canonical_purl` here would decode a second
+    // time (a literal `%2B` in a name would become `+`).
+    Ok((record_key, strip_purl_qualifiers(purl).to_string()))
 }
 
 /// Drop the claimed edits (by ledger index) and the purl's record from the
@@ -163,7 +169,7 @@ pub async fn revert_cargo_redirect_purl(
     let Some((name, version)) = parse_cargo_purl(&target) else {
         return Err(format!("not a cargo purl: {purl}"));
     };
-    let (name, version) = (name.to_string(), version.to_string());
+    let (name, version) = (name.into_owned(), version.into_owned());
     let lock_key = format!("{name}@{version}");
 
     let is_wiring_edit = |e: &FileEdit| {
@@ -589,11 +595,11 @@ pub async fn revert_npm_redirect_purl(
     dry_run: bool,
 ) -> Result<RedirectRevert, String> {
     let (record_key, target) = find_record_key(state, purl)?;
-    // `target` is canonical (percent-decoded); the name keeps its `@scope/`.
+    // The parse percent-decodes both components; the name keeps its `@scope/`.
     let Some((name, version)) = parse_name_version(&target, "pkg:npm/") else {
         return Err(format!("not an npm purl: {purl}"));
     };
-    let (name, version) = (name.to_string(), version.to_string());
+    let (name, version) = (name.into_owned(), version.into_owned());
     let lock_key = format!("{name}@{version}");
 
     // The package-lock/shrinkwrap files any `redirect_npm_lock_entry` edits
diff --git a/crates/socket-patch-core/src/utils/purl.rs b/crates/socket-patch-core/src/utils/purl.rs
index a18634ca..9a84498e 100644
--- a/crates/socket-patch-core/src/utils/purl.rs
+++ b/crates/socket-patch-core/src/utils/purl.rs
@@ -171,12 +171,17 @@ pub fn purl_parts(purl: &str) -> Option<(String, String, String)> {
     ))
 }
 
-/// Shared split for `pkg:<type>/<name>@<version>` purls: strip
-/// `?qualifiers`/`#subpath` FIRST (a qualifier value can itself embed an
-/// `@`, e.g. a `git@github.com` source URL), require `prefix`, then split
+/// Shared split for `pkg:<type>/<name>@<version>` purls, WITHOUT decoding:
+/// strip `?qualifiers`/`#subpath` FIRST (a qualifier value can itself embed
+/// an `@`, e.g. a `git@github.com` source URL), require `prefix`, then split
 /// the version off at the LAST `@` — so the name/path keeps any internal
 /// slashes and `@`s.
-pub(crate) fn parse_name_version<'a>(purl: &'a str, prefix: &str) -> Option<(&'a str, &'a str)> {
+///
+/// Private: every caller goes through [`parse_name_version`] /
+/// [`parse_namespaced`], which percent-decode the split-out components. The
+/// split has to happen on the ENCODED text so an escaped separator (`%2f`,
+/// `%40`) can never introduce a new segment or a second `@` at parse time.
+fn split_name_version<'a>(purl: &'a str, prefix: &str) -> Option<(&'a str, &'a str)> {
     let rest = strip_purl_qualifiers(purl).strip_prefix(prefix)?;
     let at_idx = rest.rfind('@')?;
     let name = &rest[..at_idx];
@@ -187,29 +192,62 @@ pub(crate) fn parse_name_version<'a>(purl: &'a str, prefix: &str) -> Option<(&'a
     Some((name, version))
 }
 
-/// [`parse_name_version`], then split the name at its FIRST `/` into a
+/// `(name, version)` from a `pkg:<type>/<name>@<version>` purl, each
+/// component percent-decoded ([`percent_decode_purl_component`]).
+///
+/// Decoding is NOT optional: the patches API serves purls in canonical
+/// (percent-encoded) form, so a semver build-metadata version arrives as
+/// `0.11.0%2Bwasi-snapshot-preview1` while the lockfile, the registry
+/// checkout and the install directory all spell it `0.11.0+wasi-snapshot-preview1`.
+/// Comparing the raw form against either one never matches, and the callers
+/// fail closed — the package simply cannot be patched. Decoding happens
+/// AFTER the split and BEFORE the callers' `is_safe_*` path guards, exactly
+/// as [`percent_decode_purl_component`] requires.
+///
+/// Feed this the purl as it arrived: an ALREADY-decoded spelling (e.g.
+/// [`canonical_purl`] output) would be decoded a second time.
+pub(crate) fn parse_name_version<'a>(
+    purl: &'a str,
+    prefix: &str,
+) -> Option<(Cow<'a, str>, Cow<'a, str>)> {
+    let (name, version) = split_name_version(purl, prefix)?;
+    Some((
+        percent_decode_purl_component(name),
+        percent_decode_purl_component(version),
+    ))
+}
+
+/// [`parse_name_version`], but the name is split at its FIRST `/` into a
 /// `(namespace, name)` pair (maven groupId/artifactId, composer
-/// vendor/name, jsr @scope/name).
-fn parse_namespaced<'a>(purl: &'a str, prefix: &str) -> Option<((&'a str, &'a str), &'a str)> {
-    let (name_part, version) = parse_name_version(purl, prefix)?;
+/// vendor/name, jsr @scope/name). The split is on the ENCODED name, so a
+/// `%2f` inside either half stays inside it; all three components are
+/// decoded afterwards.
+fn parse_namespaced<'a>(purl: &'a str, prefix: &str) -> Option<NamespacedPurlParts<'a>> {
+    let (name_part, version) = split_name_version(purl, prefix)?;
     let (namespace, name) = name_part.split_once('/')?;
     if namespace.is_empty() || name.is_empty() {
         return None;
     }
-    Some(((namespace, name), version))
+    Some((
+        (
+            percent_decode_purl_component(namespace),
+            percent_decode_purl_component(name),
+        ),
+        percent_decode_purl_component(version),
+    ))
 }
 
 /// Parse a PyPI PURL to extract name and version.
 ///
 /// e.g., `"pkg:pypi/requests@2.28.0?artifact_id=abc"` -> `Some(("requests", "2.28.0"))`
-pub(crate) fn parse_pypi_purl(purl: &str) -> Option<(&str, &str)> {
+pub(crate) fn parse_pypi_purl(purl: &str) -> Option<(Cow<'_, str>, Cow<'_, str>)> {
     parse_name_version(purl, "pkg:pypi/")
 }
 
 /// Parse a gem PURL to extract name and version.
 ///
 /// e.g., `"pkg:gem/rails@7.1.0"` -> `Some(("rails", "7.1.0"))`
-pub(crate) fn parse_gem_purl(purl: &str) -> Option<(&str, &str)> {
+pub(crate) fn parse_gem_purl(purl: &str) -> Option<(Cow<'_, str>, Cow<'_, str>)> {
     parse_name_version(purl, "pkg:gem/")
 }
 
@@ -221,7 +259,7 @@ pub(crate) fn build_gem_purl(name: &str, version: &str) -> String {
 /// Parse a Maven PURL to extract groupId, artifactId, and version.
 ///
 /// e.g., `"pkg:maven/org.apache.commons/commons-lang3@3.12.0"` -> `Some(("org.apache.commons", "commons-lang3", "3.12.0"))`
-pub(crate) fn parse_maven_purl(purl: &str) -> Option<(&str, &str, &str)> {
+pub(crate) fn parse_maven_purl(purl: &str) -> Option<(Cow<'_, str>, Cow<'_, str>, Cow<'_, str>)> {
     let ((group_id, artifact_id), version) = parse_namespaced(purl, "pkg:maven/")?;
     Some((group_id, artifact_id, version))
 }
@@ -237,11 +275,7 @@ pub(crate) fn build_maven_purl(group_id: &str, artifact_id: &str, version: &str)
 ///
 /// e.g., `"pkg:golang/github.com/gin-gonic/gin@v1.9.1"` -> `Some(("github.com/gin-gonic/gin", "v1.9.1"))`
 pub fn parse_golang_purl(purl: &str) -> Option<(Cow<'_, str>, Cow<'_, str>)> {
-    let (module, version) = parse_name_version(purl, "pkg:golang/")?;
-    Some((
-        percent_decode_purl_component(module),
-        percent_decode_purl_component(version),
-    ))
+    parse_name_version(purl, "pkg:golang/")
 }
 
 /// Build a Go module PURL from components.
@@ -253,7 +287,7 @@ pub fn build_golang_purl(module_path: &str, version: &str) -> String {
 ///
 /// Composer packages always have a namespace (vendor).
 /// e.g., `"pkg:composer/monolog/monolog@3.5.0"` -> `Some((("monolog", "monolog"), "3.5.0"))`
-pub(crate) fn parse_composer_purl(purl: &str) -> Option<((&str, &str), &str)> {
+pub(crate) fn parse_composer_purl(purl: &str) -> Option<NamespacedPurlParts<'_>> {
     parse_namespaced(purl, "pkg:composer/")
 }
 
@@ -274,19 +308,19 @@ pub(crate) fn build_composer_purl(namespace: &str, name: &str, version: &str) ->
 /// We follow the same shape as `parse_composer_purl` since both
 /// have a `<scope>/<name>` namespace structure. The leading `@` on
 /// the scope is preserved (matching npm's `@scope/name` convention).
-/// `((scope, name), version)` from a JSR purl, percent-decoded.
-pub(crate) type JsrPurlParts<'a> = ((Cow<'a, str>, Cow<'a, str>), Cow<'a, str>);
+/// `((namespace, name), version)` from a namespaced purl, percent-decoded
+/// (jsr `@scope/name`, composer `vendor/name`).
+pub(crate) type NamespacedPurlParts<'a> = ((Cow<'a, str>, Cow<'a, str>), Cow<'a, str>);
+
+/// [`NamespacedPurlParts`] under the JSR crawler's own name.
+pub(crate) type JsrPurlParts<'a> = NamespacedPurlParts<'a>;
 
 pub(crate) fn parse_jsr_purl(purl: &str) -> Option<JsrPurlParts<'_>> {
+    // `parse_namespaced` decodes AFTER splitting on `/`/`@` and BEFORE the
+    // shape check below (and the caller's `is_safe_jsr_component` gate) —
+    // see `percent_decode_purl_component`. The API serves `%40scope`.
     let ((scope, name), version) = parse_namespaced(purl, "pkg:jsr/")?;
 
-    // Decode AFTER splitting on `/`/`@` and BEFORE the shape check below
-    // (and the caller's `is_safe_jsr_component` gate) — see
-    // `percent_decode_purl_component`. The API serves `%40scope`.
-    let scope = percent_decode_purl_component(scope);
-    let name = percent_decode_purl_component(name);
-    let version = percent_decode_purl_component(version);
-
     // Scope must be `@<non-empty>`. The bare `@` (length 1) is
     // invalid — there's no actual scope after the marker.
     if !scope.starts_with('@') || scope.len() < 2 {
@@ -304,7 +338,7 @@ pub(crate) fn build_jsr_purl(scope: &str, name: &str, version: &str) -> String {
 /// Parse a NuGet PURL to extract name and version.
 ///
 /// e.g., `"pkg:nuget/Newtonsoft.Json@13.0.3"` -> `Some(("Newtonsoft.Json", "13.0.3"))`
-pub(crate) fn parse_nuget_purl(purl: &str) -> Option<(&str, &str)> {
+pub(crate) fn parse_nuget_purl(purl: &str) -> Option<(Cow<'_, str>, Cow<'_, str>)> {
     parse_name_version(purl, "pkg:nuget/")
 }
 
@@ -315,8 +349,13 @@ pub(crate) fn build_nuget_purl(name: &str, version: &str) -> String {
 
 /// Parse a Cargo PURL to extract name and version.
 ///
+/// The API serves cargo purls with the version percent-encoded, so a build
+/// metadata version arrives as `0.11.0%2Bwasi-snapshot-preview1`; the
+/// decoded `0.11.0+wasi-snapshot-preview1` is what Cargo.lock, the registry
+/// checkout and the vendored copy dir all spell.
+///
 /// e.g., `"pkg:cargo/serde@1.0.200"` -> `Some(("serde", "1.0.200"))`
-pub(crate) fn parse_cargo_purl(purl: &str) -> Option<(&str, &str)> {
+pub(crate) fn parse_cargo_purl(purl: &str) -> Option<(Cow<'_, str>, Cow<'_, str>)> {
     parse_name_version(purl, "pkg:cargo/")
 }
 
@@ -532,15 +571,33 @@ mod tests {
         );
     }
 
+    /// Parser output as owned strings, so an assertion can spell the
+    /// expected pair literally.
+    fn nv(parsed: Option<(Cow<'_, str>, Cow<'_, str>)>) -> Option<(String, String)> {
+        parsed.map(|(a, b)| (a.into_owned(), b.into_owned()))
+    }
+
+    /// [`nv`] for the three-component maven parse.
+    fn nv3(
+        parsed: Option<(Cow<'_, str>, Cow<'_, str>, Cow<'_, str>)>,
+    ) -> Option<(String, String, String)> {
+        parsed.map(|(a, b, c)| (a.into_owned(), b.into_owned(), c.into_owned()))
+    }
+
+    /// [`nv`] for a namespaced parse (`((namespace, name), version)`).
+    fn nsv(parsed: Option<NamespacedPurlParts<'_>>) -> Option<((String, String), String)> {
+        parsed.map(|((a, b), c)| ((a.into_owned(), b.into_owned()), c.into_owned()))
+    }
+
     #[test]
     fn test_parse_pypi_purl() {
         assert_eq!(
-            parse_pypi_purl("pkg:pypi/requests@2.28.0"),
-            Some(("requests", "2.28.0"))
+            nv(parse_pypi_purl("pkg:pypi/requests@2.28.0")),
+            Some(("requests".into(), "2.28.0".into()))
         );
         assert_eq!(
-            parse_pypi_purl("pkg:pypi/requests@2.28.0?artifact_id=abc"),
-            Some(("requests", "2.28.0"))
+            nv(parse_pypi_purl("pkg:pypi/requests@2.28.0?artifact_id=abc")),
+            Some(("requests".into(), "2.28.0".into()))
         );
         assert_eq!(parse_pypi_purl("pkg:npm/lodash@4.17.21"), None);
         assert_eq!(parse_pypi_purl("pkg:pypi/@2.28.0"), None);
@@ -599,18 +656,107 @@ mod tests {
     #[test]
     fn test_parse_cargo_purl() {
         assert_eq!(
-            parse_cargo_purl("pkg:cargo/serde@1.0.200"),
-            Some(("serde", "1.0.200"))
+            nv(parse_cargo_purl("pkg:cargo/serde@1.0.200")),
+            Some(("serde".into(), "1.0.200".into()))
         );
         assert_eq!(
-            parse_cargo_purl("pkg:cargo/serde_json@1.0.120"),
-            Some(("serde_json", "1.0.120"))
+            nv(parse_cargo_purl("pkg:cargo/serde_json@1.0.120")),
+            Some(("serde_json".into(), "1.0.120".into()))
         );
         assert_eq!(parse_cargo_purl("pkg:npm/lodash@4.17.21"), None);
         assert_eq!(parse_cargo_purl("pkg:cargo/@1.0.0"), None);
         assert_eq!(parse_cargo_purl("pkg:cargo/serde@"), None);
     }
 
+    /// REGRESSION: the API serves canonical (percent-encoded) purls, so a
+    /// semver build-metadata version arrives as `0.11.0%2Bwasi-…`. Compared
+    /// undecoded against Cargo.lock / the registry checkout it never
+    /// matched, and cargo vendoring of every such crate failed closed.
+    #[test]
+    fn parsers_percent_decode_the_version() {
+        assert_eq!(
+            nv(parse_cargo_purl(
+                "pkg:cargo/wasi@0.11.0%2Bwasi-snapshot-preview1"
+            )),
+            Some(("wasi".into(), "0.11.0+wasi-snapshot-preview1".into()))
+        );
+        // Every other ecosystem's version arrives through the same encoder.
+        assert_eq!(
+            nv(parse_gem_purl("pkg:gem/rails@7.1.0%2Bsocket")),
+            Some(("rails".into(), "7.1.0+socket".into()))
+        );
+        assert_eq!(
+            nv(parse_nuget_purl("pkg:nuget/Foo.Bar@1.0.0%2Bbuild.5")),
+            Some(("Foo.Bar".into(), "1.0.0+build.5".into()))
+        );
+        assert_eq!(
+            nv(parse_pypi_purl("pkg:pypi/torch@2.0.1%2Bcu118")),
+            Some(("torch".into(), "2.0.1+cu118".into()))
+        );
+        assert_eq!(
+            nv(parse_golang_purl(
+                "pkg:golang/github.com/foo/bar@v1.2.3%2Bincompatible"
+            )),
+            Some(("github.com/foo/bar".into(), "v1.2.3+incompatible".into()))
+        );
+        assert_eq!(
+            nv3(parse_maven_purl("pkg:maven/com.example/lib@1.0.0%2Bmeta")),
+            Some(("com.example".into(), "lib".into(), "1.0.0+meta".into()))
+        );
+        assert_eq!(
+            nsv(parse_composer_purl(
+                "pkg:composer/monolog/monolog@3.5.0%2Bpatch"
+            )),
+            Some((("monolog".into(), "monolog".into()), "3.5.0+patch".into()))
+        );
+    }
+
+    /// The namespace and name halves are decoded too — and the split runs on
+    /// the ENCODED text, so an escaped separator stays INSIDE the component
+    /// it was written in instead of creating a new one (the path-safety
+    /// guards then see the literal `/` and reject it).
+    #[test]
+    fn parsers_decode_name_and_namespace_after_the_split() {
+        assert_eq!(
+            nsv(parse_jsr_purl("pkg:jsr/%40std/path@0.220.0")),
+            Some((("@std".into(), "path".into()), "0.220.0".into()))
+        );
+        let ((ns, name), _) = nsv(parse_composer_purl("pkg:composer/a%2Fb/c@1.0.0")).unwrap();
+        assert_eq!(ns, "a/b", "an escaped separator decodes inside its half");
+        assert_eq!(name, "c");
+        let (name, version) = nv(parse_cargo_purl("pkg:cargo/x%2Fy@1.0.0")).unwrap();
+        assert_eq!(name, "x/y");
+        assert_eq!(version, "1.0.0");
+    }
+
+    /// Decoding happens EXACTLY once: a literal `%2B` in an already-decoded
+    /// spelling must not become `+`. `%252B` is the canonical encoding of
+    /// the literal text `%2B`, and one decode is all it gets.
+    #[test]
+    fn parsers_decode_exactly_once() {
+        let (_, version) = nv(parse_cargo_purl("pkg:cargo/x@1.0.0%252Bmeta")).unwrap();
+        assert_eq!(version, "1.0.0%2Bmeta");
+        // A `%` that is not a valid escape leaves the component verbatim.
+        let (_, version) = nv(parse_cargo_purl("pkg:cargo/x@1.0.0%zz")).unwrap();
+        assert_eq!(version, "1.0.0%zz");
+    }
+
+    /// Round trip through the canonical (encoded) spelling the API serves.
+    #[test]
+    fn cargo_purl_round_trips_through_the_encoded_spelling() {
+        let (name, version) = ("wasi", "0.11.0+wasi-snapshot-preview1");
+        let encoded = build_cargo_purl(name, &version.replace('+', "%2B"));
+        assert_eq!(
+            nv(parse_cargo_purl(&encoded)),
+            Some((name.into(), version.into()))
+        );
+        // The decoded spelling parses to the same pair (both are served).
+        assert_eq!(
+            nv(parse_cargo_purl(&build_cargo_purl(name, version))),
+            Some((name.into(), version.into()))
+        );
+    }
+
     #[test]
     fn test_build_cargo_purl() {
         assert_eq!(
@@ -630,12 +776,12 @@ mod tests {
     #[test]
     fn test_parse_gem_purl() {
         assert_eq!(
-            parse_gem_purl("pkg:gem/rails@7.1.0"),
-            Some(("rails", "7.1.0"))
+            nv(parse_gem_purl("pkg:gem/rails@7.1.0")),
+            Some(("rails".into(), "7.1.0".into()))
         );
         assert_eq!(
-            parse_gem_purl("pkg:gem/nokogiri@1.16.5"),
-            Some(("nokogiri", "1.16.5"))
+            nv(parse_gem_purl("pkg:gem/nokogiri@1.16.5")),
+            Some(("nokogiri".into(), "1.16.5".into()))
         );
         assert_eq!(parse_gem_purl("pkg:npm/lodash@4.17.21"), None);
         assert_eq!(parse_gem_purl("pkg:gem/@1.0.0"), None);
@@ -658,12 +804,24 @@ mod tests {
     #[test]
     fn test_parse_maven_purl() {
         assert_eq!(
-            parse_maven_purl("pkg:maven/org.apache.commons/commons-lang3@3.12.0"),
-            Some(("org.apache.commons", "commons-lang3", "3.12.0"))
+            nv3(parse_maven_purl(
+                "pkg:maven/org.apache.commons/commons-lang3@3.12.0"
+            )),
+            Some((
+                "org.apache.commons".into(),
+                "commons-lang3".into(),
+                "3.12.0".into()
+            ))
         );
         assert_eq!(
-            parse_maven_purl("pkg:maven/com.google.guava/guava@32.1.3-jre"),
-            Some(("com.google.guava", "guava", "32.1.3-jre"))
+            nv3(parse_maven_purl(
+                "pkg:maven/com.google.guava/guava@32.1.3-jre"
+            )),
+            Some((
+                "com.google.guava".into(),
+                "guava".into(),
+                "32.1.3-jre".into()
+            ))
         );
         assert_eq!(parse_maven_purl("pkg:npm/lodash@4.17.21"), None);
         assert_eq!(parse_maven_purl("pkg:maven/@3.12.0"), None);
@@ -697,11 +855,13 @@ mod tests {
     #[test]
     fn test_parse_golang_purl() {
         assert_eq!(
-            parse_golang_purl("pkg:golang/github.com/gin-gonic/gin@v1.9.1"),
+            nv(parse_golang_purl(
+                "pkg:golang/github.com/gin-gonic/gin@v1.9.1"
+            )),
             Some(("github.com/gin-gonic/gin".into(), "v1.9.1".into()))
         );
         assert_eq!(
-            parse_golang_purl("pkg:golang/golang.org/x/text@v0.14.0"),
+            nv(parse_golang_purl("pkg:golang/golang.org/x/text@v0.14.0")),
             Some(("golang.org/x/text".into(), "v0.14.0".into()))
         );
         assert_eq!(parse_golang_purl("pkg:npm/lodash@4.17.21"), None);
@@ -743,12 +903,12 @@ mod tests {
     #[test]
     fn test_parse_composer_purl() {
         assert_eq!(
-            parse_composer_purl("pkg:composer/monolog/monolog@3.5.0"),
-            Some((("monolog", "monolog"), "3.5.0"))
+            nsv(parse_composer_purl("pkg:composer/monolog/monolog@3.5.0")),
+            Some((("monolog".into(), "monolog".into()), "3.5.0".into()))
         );
         assert_eq!(
-            parse_composer_purl("pkg:composer/symfony/console@6.4.1"),
-            Some((("symfony", "console"), "6.4.1"))
+            nsv(parse_composer_purl("pkg:composer/symfony/console@6.4.1")),
+            Some((("symfony".into(), "console".into()), "6.4.1".into()))
         );
         assert_eq!(parse_composer_purl("pkg:npm/lodash@4.17.21"), None);
         assert_eq!(parse_composer_purl("pkg:composer/@3.5.0"), None);
@@ -817,12 +977,12 @@ mod tests {
     #[test]
     fn test_parse_nuget_purl() {
         assert_eq!(
-            parse_nuget_purl("pkg:nuget/Newtonsoft.Json@13.0.3"),
-            Some(("Newtonsoft.Json", "13.0.3"))
+            nv(parse_nuget_purl("pkg:nuget/Newtonsoft.Json@13.0.3")),
+            Some(("Newtonsoft.Json".into(), "13.0.3".into()))
         );
         assert_eq!(
-            parse_nuget_purl("pkg:nuget/System.Text.Json@8.0.0"),
-            Some(("System.Text.Json", "8.0.0"))
+            nv(parse_nuget_purl("pkg:nuget/System.Text.Json@8.0.0")),
+            Some(("System.Text.Json".into(), "8.0.0".into()))
         );
         assert_eq!(parse_nuget_purl("pkg:npm/lodash@4.17.21"), None);
         assert_eq!(parse_nuget_purl("pkg:nuget/@1.0.0"), None);
@@ -866,16 +1026,18 @@ mod tests {
         // The `@github.com` inside the qualifier value must not be read
         // as the version separator.
         assert_eq!(
-            parse_pypi_purl("pkg:pypi/requests@2.28.0?vcs_url=git@github.com"),
-            Some(("requests", "2.28.0"))
+            nv(parse_pypi_purl(
+                "pkg:pypi/requests@2.28.0?vcs_url=git@github.com"
+            )),
+            Some(("requests".into(), "2.28.0".into()))
         );
     }
 
     #[test]
     fn test_parse_gem_with_trailing_qualifier() {
         assert_eq!(
-            parse_gem_purl("pkg:gem/nokogiri@1.16.5?platform=java"),
-            Some(("nokogiri", "1.16.5"))
+            nv(parse_gem_purl("pkg:gem/nokogiri@1.16.5?platform=java")),
+            Some(("nokogiri".into(), "1.16.5".into()))
         );
     }
 
@@ -923,18 +1085,24 @@ mod tests {
         // groupId/artifactId split must survive an `@` buried in a
         // qualifier value.
         assert_eq!(
-            parse_maven_purl(
+            nv3(parse_maven_purl(
                 "pkg:maven/org.apache.commons/commons-lang3@3.12.0?repository_url=user@host"
-            ),
-            Some(("org.apache.commons", "commons-lang3", "3.12.0"))
+            )),
+            Some((
+                "org.apache.commons".into(),
+                "commons-lang3".into(),
+                "3.12.0".into()
+            ))
         );
     }
 
     #[test]
     fn test_parse_composer_qualifier_with_embedded_at() {
         assert_eq!(
-            parse_composer_purl("pkg:composer/monolog/monolog@3.5.0?source=git@github.com"),
-            Some((("monolog", "monolog"), "3.5.0"))
+            nsv(parse_composer_purl(
+                "pkg:composer/monolog/monolog@3.5.0?source=git@github.com"
+            )),
+            Some((("monolog".into(), "monolog".into()), "3.5.0".into()))
         );
     }
 
@@ -943,7 +1111,9 @@ mod tests {
         // The module path retains its internal slashes — only the
         // version is split off. A trailing qualifier is ignored.
         assert_eq!(
-            parse_golang_purl("pkg:golang/github.com/gin-gonic/gin@v1.9.1?type=module"),
+            nv(parse_golang_purl(
+                "pkg:golang/github.com/gin-gonic/gin@v1.9.1?type=module"
+            )),
             Some(("github.com/gin-gonic/gin".into(), "v1.9.1".into()))
         );
     }
@@ -1009,8 +1179,8 @@ mod tests {
     fn test_parse_pypi_subpath_not_folded_into_version() {
         // The `#dist` must not bleed into the parsed version.
         assert_eq!(
-            parse_pypi_purl("pkg:pypi/requests@2.28.0#dist"),
-            Some(("requests", "2.28.0"))
+            nv(parse_pypi_purl("pkg:pypi/requests@2.28.0#dist")),
+            Some(("requests".into(), "2.28.0".into()))
         );
     }
 
@@ -1019,7 +1189,9 @@ mod tests {
         // Go subpaths point at a sub-package of the same module; the parsed
         // version must remain clean.
         assert_eq!(
-            parse_golang_purl("pkg:golang/github.com/gin-gonic/gin@v1.9.1#middleware"),
+            nv(parse_golang_purl(
+                "pkg:golang/github.com/gin-gonic/gin@v1.9.1#middleware"
+            )),
             Some(("github.com/gin-gonic/gin".into(), "v1.9.1".into()))
         );
     }
@@ -1130,8 +1302,8 @@ mod tests {
         // `rfind('@')` (not `find`) ensures the *last* `@` splits the
         // version, so a name/path that itself contained an `@` keeps it.
         assert_eq!(
-            parse_pypi_purl("pkg:pypi/weird@name@1.0.0"),
-            Some(("weird@name", "1.0.0"))
+            nv(parse_pypi_purl("pkg:pypi/weird@name@1.0.0")),
+            Some(("weird@name".into(), "1.0.0".into()))
         );
     }
 }
diff --git a/crates/socket-patch-core/src/vendor/cargo.rs b/crates/socket-patch-core/src/vendor/cargo.rs
index bc8a83e3..899c3a05 100644
--- a/crates/socket-patch-core/src/vendor/cargo.rs
+++ b/crates/socket-patch-core/src/vendor/cargo.rs
@@ -96,6 +96,7 @@ async fn is_vendored(project_root: &Path, name: &str, version: &str) -> bool {
 /// * no readable lock → `None` (cannot determine — callers keep, fail-safe).
 pub async fn vendored_entry_in_use(entry: &VendorEntry, project_root: &Path) -> Option<bool> {
     let (name, version) = parse_cargo_purl(&entry.base_purl)?;
+    let (name, version) = (name.as_ref(), version.as_ref());
     match cargo_lock::probe_lock_entry_for(project_root, name, version, Some(&entry.uuid)).await {
         cargo_lock::LockEntryProbe::NoLockfile | cargo_lock::LockEntryProbe::Unreadable => None,
         cargo_lock::LockEntryProbe::EntryMissing => Some(false),
@@ -408,6 +409,7 @@ pub async fn vendor_cargo_crate(
     let Some((name, version)) = parse_cargo_purl(purl) else {
         return refused("unsafe_coordinates", format!("not a cargo purl: {purl}"));
     };
+    let (name, version) = (name.as_ref(), version.as_ref());
     // SECURITY: `name`/`version` key the on-disk copy dir
     // (`.socket/vendor/cargo/<uuid>/<name>-<version>/`) and the `[patch]`
     // path. A `..`/separator from a tampered manifest PURL would let the copy
@@ -1063,6 +1065,7 @@ fn cargo_entry(
     let base_purl = strip_purl_qualifiers(purl).to_string();
     let mut wiring = vec![manifest_wiring_record(ensured, copy_rel)];
     if let (Some(orig), Some((name, version))) = (&lock_original, parse_cargo_purl(&base_purl)) {
+        let (name, version) = (name.as_ref(), version.as_ref());
         wiring.push(WiringRecord {
             file: "Cargo.lock".to_string(),
             kind: "cargo_lock_entry".to_string(),
@@ -1586,6 +1589,7 @@ pub async fn migrate_legacy_wiring(
     let Some((name, version)) = parse_cargo_purl(&entry.base_purl) else {
         return Ok(None);
     };
+    let (name, version) = (name.as_ref(), version.as_ref());
     if !is_safe_single_segment(name) || !is_safe_single_segment(version) {
         return Ok(None);
     }
@@ -1765,6 +1769,7 @@ pub async fn revert_cargo_vendor_opts(
     let Some((name, version)) = parse_cargo_purl(&entry.base_purl) else {
         return RevertOutcome::failed(format!("not a cargo purl: {}", entry.base_purl));
     };
+    let (name, version) = (name.as_ref(), version.as_ref());
     if !is_safe_single_segment(name) || !is_safe_single_segment(version) {
         return RevertOutcome::failed(format!(
             "refusing to revert unsafe cargo coordinates `{name}`/`{version}`"
diff --git a/crates/socket-patch-core/src/vendor/composer_lock.rs b/crates/socket-patch-core/src/vendor/composer_lock.rs
index ee1e6574..a20875eb 100644
--- a/crates/socket-patch-core/src/vendor/composer_lock.rs
+++ b/crates/socket-patch-core/src/vendor/composer_lock.rs
@@ -90,6 +90,7 @@ pub async fn vendor_composer(
     let Some(((vendor, name), version)) = parse_composer_purl(purl) else {
         return refused("unsafe_coordinates", format!("not a composer purl: {purl}"));
     };
+    let version = version.as_ref();
     // Canonical (packagist) lowercase form keys the on-disk copy dir and the
     // dist URL; the lock's own pretty casing is preserved untouched.
     let vendor = vendor.to_lowercase();
diff --git a/crates/socket-patch-core/src/vendor/gem.rs b/crates/socket-patch-core/src/vendor/gem.rs
index e5587937..cb2afb94 100644
--- a/crates/socket-patch-core/src/vendor/gem.rs
+++ b/crates/socket-patch-core/src/vendor/gem.rs
@@ -143,6 +143,7 @@ pub async fn vendor_gem(
     let Some((name, version)) = parse_gem_purl(purl) else {
         return refused("unsafe_coordinates", format!("not a gem purl: {purl}"));
     };
+    let (name, version) = (name.as_ref(), version.as_ref());
     // SECURITY: `uuid`, `name` and `version` come from committed, tamper-able
     // manifest data. They key the copy dir vendor creates and `--revert`
     // deletes, and — stricter than the path guard — they are embedded
@@ -1214,8 +1215,8 @@ pub async fn revert_gem_opts(
     // in — the patch would silently stay applied.
     if entry.wiring.is_empty() {
         let name = parse_gem_purl(&entry.base_purl)
-            .map(|(n, _)| n)
-            .unwrap_or("<unknown>");
+            .map(|(n, _)| n.into_owned())
+            .unwrap_or_else(|| "<unknown>".to_string());
         return RevertOutcome::failed(format!(
             "vendor_wiring_unknown: the ledger records no wiring for `{name}` (a \
              reconstructed entry without recoverable originals); refusing to delete {} and \
@@ -1350,6 +1351,7 @@ pub async fn reconstruct_gem_wiring(
     let Some((name, version)) = parse_gem_purl(&entry.base_purl) else {
         return Err(format!("not a gem purl: {}", entry.base_purl));
     };
+    let (name, version) = (name.as_ref(), version.as_ref());
     // SECURITY: the coordinates come from a re-synthesized entry
     // (manifest/API purl) and are matched against Gemfile/lock line
     // grammar — the same fail-closed token guard as `vendor_gem`.
diff --git a/crates/socket-patch-core/src/vendor/golang.rs b/crates/socket-patch-core/src/vendor/golang.rs
index 6711ef2d..45440785 100644
--- a/crates/socket-patch-core/src/vendor/golang.rs
+++ b/crates/socket-patch-core/src/vendor/golang.rs
@@ -69,7 +69,7 @@ pub async fn vendor_go_module(
     let Some((module, version)) = parse_golang_purl(purl) else {
         return refused("unsafe_coordinates", format!("not a golang purl: {purl}"));
     };
-    let (module, version) = (&*module, &*version);
+    let (module, version) = (module.as_ref(), version.as_ref());
     // SECURITY: `module`+`version` key the on-disk copy dir
     // (`.socket/vendor/golang/<uuid>/<module>@<version>/`) and the `replace`
     // target path. A `..` segment / absolute path / backslash from a tampered
@@ -706,7 +706,7 @@ pub async fn revert_go_vendor_opts(
     let Some((module, version)) = parse_golang_purl(&entry.base_purl) else {
         return RevertOutcome::failed(format!("not a golang purl: {}", entry.base_purl));
     };
-    let (module, version) = (&*module, &*version);
+    let (module, version) = (module.as_ref(), version.as_ref());
     if !are_safe_redirect_coords(module, version) {
         return RevertOutcome::failed(format!(
             "refusing to revert unsafe golang coordinates `{module}`/`{version}`"
diff --git a/crates/socket-patch-core/src/vendor/maven_repo.rs b/crates/socket-patch-core/src/vendor/maven_repo.rs
index 53505a43..31a07a30 100644
--- a/crates/socket-patch-core/src/vendor/maven_repo.rs
+++ b/crates/socket-patch-core/src/vendor/maven_repo.rs
@@ -165,6 +165,8 @@ pub async fn vendor_maven(
     let Some((group_id, artifact_id, version)) = parse_maven_purl(purl) else {
         return refused("unsafe_coordinates", format!("not a maven purl: {purl}"));
     };
+    let (group_id, artifact_id, version) =
+        (group_id.as_ref(), artifact_id.as_ref(), version.as_ref());
     // SECURITY: `uuid`, `group_id`, `artifact_id`, and `version` come from
     // committed, tamper-able manifest data. They key the uuid dir vendor
     // creates and `--revert` deletes, the nested maven2 path, the vendored
diff --git a/crates/socket-patch-core/src/vendor/nuget_feed.rs b/crates/socket-patch-core/src/vendor/nuget_feed.rs
index fecdc675..9f3f8fb5 100644
--- a/crates/socket-patch-core/src/vendor/nuget_feed.rs
+++ b/crates/socket-patch-core/src/vendor/nuget_feed.rs
@@ -227,6 +227,7 @@ pub async fn vendor_nuget(
     let Some((name, version)) = parse_nuget_purl(purl) else {
         return refused("unsafe_coordinates", format!("not a nuget purl: {purl}"));
     };
+    let (name, version) = (name.as_ref(), version.as_ref());
     // SECURITY: `uuid`, `name`, and `version` come from committed, tamper-able
     // manifest data. They key the uuid dir vendor creates and `--revert`
     // deletes, the vendored filename, and — via `nuget.config` — XML attribute
diff --git a/crates/socket-patch-core/src/vendor/pypi.rs b/crates/socket-patch-core/src/vendor/pypi.rs
index f15695b2..48a1ba98 100644
--- a/crates/socket-patch-core/src/vendor/pypi.rs
+++ b/crates/socket-patch-core/src/vendor/pypi.rs
@@ -552,6 +552,7 @@ pub async fn vendor_pypi_with_pipenv_version(
             format!("{purl} is not a pkg:pypi PURL with a version"),
         );
     };
+    let (raw_name, version) = (raw_name.as_ref(), version.as_ref());
     let canon_name = canonicalize_pypi_name(raw_name);
 
     // SECURITY: the uuid comes from a committed, tamper-able manifest and
diff --git a/crates/socket-patch-core/src/vex/discover/maven.rs b/crates/socket-patch-core/src/vex/discover/maven.rs
index 824969b2..970fa4cb 100644
--- a/crates/socket-patch-core/src/vex/discover/maven.rs
+++ b/crates/socket-patch-core/src/vex/discover/maven.rs
@@ -384,6 +384,7 @@ async fn extract_vendored(
         let Some((group, artifact, version)) = crate::utils::purl::parse_maven_purl(purl) else {
             continue;
         };
+        let (group, artifact, version) = (group.as_ref(), artifact.as_ref(), version.as_ref());
         let rel = format!(
             "{dir}/{}",
             local_repo_artifact_path(group, artifact, version, "jar")

From 4247daa8715db0c7126e4b0b3419363a73715cc5 Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Fri, 25 Sep 2026 00:15:59 -0400
Subject: [PATCH 09/13] fix(vendor): keep the Cargo.lock line endings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

toml_edit renders LF only and drops the \r of every CRLF line, including
the ones no edit touched, so vendoring rewrote a lock committed with
Windows line endings as all-LF. vendor --revert then "restored" that
file, so the rollback differed from the original in every line ending
and was not byte-identical. The copy's Cargo.toml already mapped its
rendering back onto the original endings; the lock did not.

The lock edits — detach, retag and restore — now go through the same
reconciliation, in lock formats v1 through v4. A CRLF lock stays CRLF, a
missing trailing newline stays missing, and every line a mixed-ending
lock's edit leaves alone keeps its own ending. A line the edit rewrites,
removes or re-inserts still takes the file's dominant ending, because
its original one is not recoverable from the text, so a mixed lock is
promised an unchanged remainder rather than a byte-identical revert.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 CHANGELOG.md                                  |   9 +
 .../tests/e2e_vendor_cargo_build.rs           |  81 +++++++
 .../src/vendor/cargo_lock.rs                  | 203 ++++++++++++++++--
 .../src/vendor/lock_inventory/cargo.rs        |   2 +-
 4 files changed, 281 insertions(+), 14 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b305cc4b..8f907062 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -726,6 +726,15 @@ into the new version's section — see docs/releasing.md.
   `setup --remove` could not land byte-identical on the pre-setup file.
   `package.json` is now written in its own layout (BOM, indent, line ending,
   trailing-newline shape), the same helper the vendored backends use.
+- **A CRLF `Cargo.lock` stays CRLF, and reverts byte-for-byte.** Vendoring
+  rewrote every line of a lock committed with Windows line endings as LF
+  (`toml_edit` renders LF only), and `vendor --revert` then "restored" the
+  all-LF file — a whole-file diff on a Windows checkout and a rollback that
+  was not byte-identical. The lock edits (detach, retag, restore) now map
+  the rendering back onto the file's own line endings, the way the copy's
+  `Cargo.toml` already did, in lock formats v1–v4: a CRLF lock stays CRLF,
+  a missing trailing newline stays missing, and every line a mixed-ending
+  lock's edit leaves alone keeps its own ending.
 - **Vendored mode can patch a package whose version carries build
   metadata.** The patches API serves canonical PURLs, so a semver build
   metadata version arrives percent-encoded
diff --git a/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs b/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs
index cab8c87c..82c4749c 100644
--- a/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs
@@ -1826,6 +1826,87 @@ fn cargo_legacy_config_wiring_migrates_to_the_manifest() {
     assert!(!proj.join(".socket/vendor").exists());
 }
 
+/// CRLF: a `Cargo.lock` (and `Cargo.toml`) committed with Windows line
+/// endings must come out of vendoring with those endings intact and revert
+/// byte-for-byte. REGRESSION: `toml_edit` renders LF only, so the lock
+/// surgery rewrote every line of a CRLF lock, and `vendor --revert`
+/// "restored" an all-LF file — a whole-file diff on a Windows checkout and
+/// a rollback that was not byte-identical. The manifest already reconciled
+/// endings; the lock did not.
+#[test]
+fn cargo_vendor_keeps_crlf_line_endings_and_reverts_byte_identically() {
+    const SUITE: &str = "e2e_vendor_cargo_build (crlf)";
+    if !cargo_e2e_matrix::cargo_available(SUITE) {
+        return;
+    }
+    let tmp = tempfile::tempdir().unwrap();
+    let Some((proj, cargo_home, version, crate_dir)) = stage_fixture(tmp.path(), "crlf") else {
+        return;
+    };
+    // Commit both files with CRLF, as a Windows checkout would.
+    let to_crlf = |p: &Path| {
+        let text = std::fs::read_to_string(p).unwrap();
+        std::fs::write(p, text.replace("\r\n", "\n").replace('\n', "\r\n")).unwrap();
+    };
+    to_crlf(&proj.join("Cargo.toml"));
+    to_crlf(&proj.join("Cargo.lock"));
+    let manifest_before = std::fs::read(proj.join("Cargo.toml")).unwrap();
+    let lock_before = std::fs::read(proj.join("Cargo.lock")).unwrap();
+
+    let purl = format!("pkg:cargo/{DEP}@{version}");
+    let orig = std::fs::read(crate_dir.join("src/lib.rs")).unwrap();
+    let patched: Vec<u8> = [orig.as_slice(), PATCH_SUFFIX.as_bytes()].concat();
+    stage_patch(&proj, &purl, "src/lib.rs", &orig, &patched);
+
+    let env = vendor_ok(&proj, &cargo_home, "crlf");
+    assert_eq!(env["summary"]["failed"], 0, "{env}");
+
+    let all_crlf = |p: &Path, what: &str| {
+        let text = std::fs::read_to_string(p).unwrap();
+        assert!(
+            !text.replace("\r\n", "").contains('\n'),
+            "{what} must stay CRLF after vendoring:\n{text:?}"
+        );
+        text
+    };
+    all_crlf(&proj.join("Cargo.toml"), "Cargo.toml");
+    let lock_after = all_crlf(&proj.join("Cargo.lock"), "Cargo.lock");
+    assert!(
+        lock_after.contains(&format!(
+            "name = \"{DEP}\"\r\nversion = \"{}\"\r\n",
+            tagged(&version, UUID)
+        )),
+        "the detached entry is tagged:\n{lock_after}"
+    );
+
+    // Real cargo accepts the CRLF lock under --locked and builds the copy.
+    std::fs::write(proj.join("src/main.rs"), ORACLE_MAIN).unwrap();
+    let run = cargo(&proj, &["run", "-q", "--locked", "--offline"], &cargo_home);
+    assert!(
+        String::from_utf8_lossy(&run.stdout).contains(&oracle_line(&version, UUID)),
+        "the CRLF-locked project builds the patched copy:\nstdout:\n{}\nstderr:\n{}",
+        String::from_utf8_lossy(&run.stdout),
+        String::from_utf8_lossy(&run.stderr)
+    );
+
+    std::fs::write(
+        proj.join("src/main.rs"),
+        "fn main() { println!(\"baseline\"); }\n",
+    )
+    .unwrap();
+    revert_ok(&proj, &cargo_home, "crlf");
+    assert_eq!(
+        std::fs::read(proj.join("Cargo.lock")).unwrap(),
+        lock_before,
+        "the revert must restore the CRLF lock byte-for-byte"
+    );
+    assert_eq!(
+        std::fs::read(proj.join("Cargo.toml")).unwrap(),
+        manifest_before
+    );
+    assert!(!proj.join(".socket/vendor").exists());
+}
+
 // ── build-metadata versions (the encoded purl the API serves) ─────────
 
 /// A dep-free crates.io crate whose version carries semver BUILD METADATA.
diff --git a/crates/socket-patch-core/src/vendor/cargo_lock.rs b/crates/socket-patch-core/src/vendor/cargo_lock.rs
index b3de2ffa..f644695f 100644
--- a/crates/socket-patch-core/src/vendor/cargo_lock.rs
+++ b/crates/socket-patch-core/src/vendor/cargo_lock.rs
@@ -102,9 +102,13 @@ impl std::fmt::Display for LockEditError {
 
 /// Read + parse `<root>/Cargo.lock`, mapping errors to [`LockEditError`]
 /// (the lock inventory reads the lock through it too).
+///
+/// The verbatim `content` comes back with the parse: `toml_edit` renders
+/// LF only, so [`write_lock`] needs the original bytes to put the file's
+/// own line endings back (see [`super::cargo_manifest::reconcile_line_endings`]).
 pub(crate) async fn read_lock(
     project_root: &Path,
-) -> Result<(std::path::PathBuf, DocumentMut), LockEditError> {
+) -> Result<(std::path::PathBuf, DocumentMut, String), LockEditError> {
     let path = project_root.join("Cargo.lock");
     let content = match read_regular_to_string(&path).await {
         Ok(c) => c,
@@ -116,7 +120,7 @@ pub(crate) async fn read_lock(
     let doc = content
         .parse::<DocumentMut>()
         .map_err(|e| LockEditError::Parse(e.to_string()))?;
-    Ok((path, doc))
+    Ok((path, doc, content))
 }
 
 /// How strongly a `[[package]]` at `found` (with a `source` or not) is THE
@@ -473,8 +477,17 @@ fn ensure_consistent(
 /// whole project's resolution, so never truncate-in-place. Mode-preserving:
 /// the lock is a user-owned file we merely edit, so the swapped-in inode must
 /// keep its permission bits rather than reset them to umask defaults.
-async fn write_lock(path: &Path, doc: &DocumentMut) -> Result<(), LockEditError> {
-    atomic_write_bytes_preserving_mode(path, doc.to_string().as_bytes())
+///
+/// `original` is the text [`read_lock`] parsed. `toml_edit` renders LF only
+/// — it drops the `\r` of every CRLF line, even the ones no edit touched —
+/// so the rendering is mapped back onto the original's line endings, the
+/// same way the copy's `Cargo.toml` is written. A CRLF lock therefore stays
+/// CRLF, a mixed-ending lock keeps each line's own ending, and a lock with
+/// no trailing newline keeps that too, so `vendor --revert` restores the
+/// file byte-for-byte.
+async fn write_lock(path: &Path, doc: &DocumentMut, original: &str) -> Result<(), LockEditError> {
+    let rendered = super::cargo_manifest::reconcile_line_endings(original, &doc.to_string());
+    atomic_write_bytes_preserving_mode(path, rendered.as_bytes())
         .await
         .map_err(|e| LockEditError::Io(e.to_string()))
 }
@@ -496,7 +509,7 @@ pub async fn detach_lock_entry(
     uuid: &str,
     dry_run: bool,
 ) -> Result<CargoLockOriginal, LockEditError> {
-    let (path, mut doc) = read_lock(project_root).await?;
+    let (path, mut doc, lock_text) = read_lock(project_root).await?;
     // The registry entry is what gets detached (an entry already at the
     // tagged version beside it then refuses in `ensure_consistent`).
     let registry = doc
@@ -554,7 +567,7 @@ pub async fn detach_lock_entry(
     ensure_consistent(&doc, name, version, &tagged)?;
 
     if !dry_run {
-        write_lock(&path, &doc).await?;
+        write_lock(&path, &doc, &lock_text).await?;
     }
     Ok(CargoLockOriginal { source, checksum })
 }
@@ -588,7 +601,7 @@ pub async fn retag_lock_entry_to(
     target: &str,
     dry_run: bool,
 ) -> Result<Option<String>, LockEditError> {
-    let (path, mut doc) = read_lock(project_root).await?;
+    let (path, mut doc, lock_text) = read_lock(project_root).await?;
     let table = find_entry_mut(&mut doc, name, version, cargo_tag::tag_uuid(target))
         .ok_or(LockEditError::EntryMissing)?;
     if table.get("source").is_some() {
@@ -608,7 +621,7 @@ pub async fn retag_lock_entry_to(
     rewrite_version_refs(&mut doc, name, &current, None, &format!("{name} {target}"));
     ensure_consistent(&doc, name, &current, target)?;
     if !dry_run {
-        write_lock(&path, &doc).await?;
+        write_lock(&path, &doc, &lock_text).await?;
     }
     Ok(Some(current))
 }
@@ -639,7 +652,7 @@ pub async fn restore_lock_entry(
     original: &CargoLockOriginal,
     dry_run: bool,
 ) -> Result<bool, LockEditError> {
-    let (path, mut doc) = read_lock(project_root).await?;
+    let (path, mut doc, lock_text) = read_lock(project_root).await?;
     let v1 = is_v1_lock(&doc);
     let Some(idx) = pick_index(&doc, name, version, Some(uuid)) else {
         return Ok(false);
@@ -727,7 +740,7 @@ pub async fn restore_lock_entry(
     }
 
     if !dry_run {
-        write_lock(&path, &doc).await?;
+        write_lock(&path, &doc, &lock_text).await?;
     }
     Ok(true)
 }
@@ -740,7 +753,7 @@ pub async fn restore_lock_entry(
 /// versions. A Socket-tagged vendored entry counts as its untagged version.
 /// Reads only the project lockfile: no registry, no network.
 pub async fn read_locked_versions(project_root: &Path) -> Option<HashMap<String, HashSet<String>>> {
-    let (_path, doc) = read_lock(project_root).await.ok()?;
+    let (_path, doc, _) = read_lock(project_root).await.ok()?;
     doc.get("package")?.as_array_of_tables()?;
     let mut map: HashMap<String, HashSet<String>> = HashMap::new();
     for pkg in locked_packages(&doc) {
@@ -791,7 +804,7 @@ pub async fn probe_lock_entry_for(
     uuid: Option<&str>,
 ) -> LockEntryProbe {
     let doc = match read_lock(project_root).await {
-        Ok((_path, doc)) => doc,
+        Ok((_path, doc, _)) => doc,
         Err(LockEditError::NoLockfile) => return LockEntryProbe::NoLockfile,
         Err(_) => return LockEntryProbe::Unreadable,
     };
@@ -825,7 +838,7 @@ pub async fn probe_lock_entry_for(
 /// the only lock edits a vendored crate still needs — a retag between tags —
 /// never touch it.
 pub async fn count_lock_entries(project_root: &Path, name: &str, version: &str) -> usize {
-    let Ok((_path, doc)) = read_lock(project_root).await else {
+    let Ok((_path, doc, _)) = read_lock(project_root).await else {
         return 0;
     };
     let hits: Vec<LockedPackage> = locked_packages(&doc)
@@ -872,6 +885,170 @@ mod tests {
         )
     }
 
+    /// A minimal registry-shaped lock in format `v` (1..=4): v1 keeps the
+    /// checksum in `[metadata]` and references the crate by full id; v2 is
+    /// the header with no `version` key; v3/v4 add the version marker.
+    fn lock_in_format(v: u8) -> String {
+        let header = "# This file is automatically @generated by Cargo.\n\
+                      # It is not intended for manual editing.\n";
+        match v {
+            1 => format!(
+                "[[package]]\nname = \"app\"\nversion = \"0.1.0\"\ndependencies = [\n \
+                 \"cfg-if 1.0.4 ({SOURCE})\",\n]\n\n\
+                 [[package]]\nname = \"cfg-if\"\nversion = \"1.0.4\"\nsource = \"{SOURCE}\"\n\n\
+                 [metadata]\n\"checksum cfg-if 1.0.4 ({SOURCE})\" = \"{CHECKSUM}\"\n"
+            ),
+            2 => format!(
+                "{header}\n[[package]]\nname = \"app\"\nversion = \"0.1.0\"\n\
+                 dependencies = [\n \"cfg-if\",\n]\n\n\
+                 [[package]]\nname = \"cfg-if\"\nversion = \"1.0.4\"\n\
+                 source = \"{SOURCE}\"\nchecksum = \"{CHECKSUM}\"\n"
+            ),
+            3 | 4 => format!(
+                "{header}version = {v}\n\n[[package]]\nname = \"app\"\n\
+                 version = \"0.1.0\"\ndependencies = [\n \"cfg-if\",\n]\n\n\
+                 [[package]]\nname = \"cfg-if\"\nversion = \"1.0.4\"\n\
+                 source = \"{SOURCE}\"\nchecksum = \"{CHECKSUM}\"\n"
+            ),
+            _ => unreachable!("lock formats 1..=4"),
+        }
+    }
+
+    /// `(content, ending)` per line of `text` (ending `""` on a final line
+    /// with no newline).
+    fn line_endings(text: &str) -> Vec<(&str, &str)> {
+        text.split_inclusive('\n')
+            .map(|seg| match seg.strip_suffix("\r\n") {
+                Some(c) => (c, "\r\n"),
+                None => match seg.strip_suffix('\n') {
+                    Some(c) => (c, "\n"),
+                    None => (seg, ""),
+                },
+            })
+            .collect()
+    }
+
+    /// REGRESSION: `toml_edit` renders LF only, so writing the edited lock
+    /// back rewrote a CRLF `Cargo.lock` as all-LF — and `vendor --revert`
+    /// then "restored" a file that differed from the original in every line
+    /// ending, so the rollback was not byte-identical (the copy's
+    /// `Cargo.toml` already reconciled endings; the lock did not). Covers
+    /// CRLF, LF and a missing trailing newline, in lock formats v1–v4,
+    /// across detach → retag → restore.
+    #[tokio::test]
+    async fn lock_edits_keep_line_endings_and_revert_byte_identically() {
+        for v in 1u8..=4 {
+            let lf = lock_in_format(v);
+            let crlf = lf.replace('\n', "\r\n");
+            let no_trailing = crlf.trim_end_matches("\r\n").to_string();
+
+            for (kind, before) in [
+                ("lf", &lf),
+                ("crlf", &crlf),
+                ("crlf-no-trailing-newline", &no_trailing),
+            ] {
+                let label = format!("v{v}/{kind}");
+                let dir = tempfile::tempdir().unwrap();
+                let lock = dir.path().join("Cargo.lock");
+                tokio::fs::write(&lock, before).await.unwrap();
+
+                let orig = detach_lock_entry(dir.path(), "cfg-if", "1.0.4", UUID, false)
+                    .await
+                    .unwrap_or_else(|e| panic!("{label}: detach failed: {e}"));
+                let detached = tokio::fs::read_to_string(&lock).await.unwrap();
+                if kind == "lf" {
+                    assert!(!detached.contains('\r'), "{label}: an LF lock stays LF");
+                } else {
+                    assert!(
+                        !detached.replace("\r\n", "").contains('\n'),
+                        "{label}: a CRLF lock stays CRLF:\n{detached:?}"
+                    );
+                }
+                assert_eq!(
+                    before.ends_with('\n'),
+                    detached.ends_with('\n'),
+                    "{label}: the trailing newline must be preserved"
+                );
+
+                // A uuid bump goes through `retag_lock_entry`: same contract.
+                retag_lock_entry(dir.path(), "cfg-if", "1.0.4", UUID2, false)
+                    .await
+                    .unwrap_or_else(|e| panic!("{label}: retag failed: {e}"));
+
+                assert!(
+                    restore_lock_entry(dir.path(), "cfg-if", "1.0.4", UUID2, &orig, false)
+                        .await
+                        .unwrap_or_else(|e| panic!("{label}: restore failed: {e}")),
+                    "{label}: the detached entry must restore"
+                );
+                assert_eq!(
+                    tokio::fs::read_to_string(&lock).await.unwrap(),
+                    *before,
+                    "{label}: revert must be byte-identical"
+                );
+            }
+        }
+    }
+
+    /// A lock whose lines do NOT agree on an ending: every line the edit
+    /// leaves alone keeps its own ending, and the trailing newline is
+    /// preserved. A line the edit rewrites, removes or re-inserts takes the
+    /// file's dominant ending — its original one is not recoverable from
+    /// text alone — so a mixed lock is NOT promised a byte-identical
+    /// revert, only an unchanged remainder (the same contract
+    /// `Cargo.toml` has had).
+    #[tokio::test]
+    async fn a_mixed_ending_lock_keeps_every_untouched_line() {
+        for v in 1u8..=4 {
+            let lf = lock_in_format(v);
+            let lines: Vec<&str> = lf.split_inclusive('\n').collect();
+            let half = lines.len() / 2;
+            let mixed: String = lines
+                .iter()
+                .enumerate()
+                .map(|(i, seg)| {
+                    if i < half {
+                        seg.replace('\n', "\r\n")
+                    } else {
+                        (*seg).to_string()
+                    }
+                })
+                .collect();
+            let label = format!("v{v}/mixed");
+            let dir = tempfile::tempdir().unwrap();
+            let lock = dir.path().join("Cargo.lock");
+            tokio::fs::write(&lock, &mixed).await.unwrap();
+
+            detach_lock_entry(dir.path(), "cfg-if", "1.0.4", UUID, false)
+                .await
+                .unwrap_or_else(|e| panic!("{label}: detach failed: {e}"));
+            let detached = tokio::fs::read_to_string(&lock).await.unwrap();
+
+            // Only lines whose content is UNIQUE can be identified in the
+            // output (`[[package]]` appears twice, with different endings).
+            let mut counts: HashMap<&str, usize> = HashMap::new();
+            for (content, _) in line_endings(&mixed) {
+                *counts.entry(content).or_default() += 1;
+            }
+            let original: HashMap<&str, &str> = line_endings(&mixed)
+                .into_iter()
+                .filter(|(c, _)| counts[c] == 1)
+                .collect();
+            for (content, ending) in line_endings(&detached) {
+                if let Some(want) = original.get(content) {
+                    assert_eq!(
+                        ending, *want,
+                        "{label}: untouched line {content:?} changed its ending"
+                    );
+                }
+            }
+            assert!(
+                detached.ends_with('\n'),
+                "{label}: the trailing newline must be preserved"
+            );
+        }
+    }
+
     async fn fixture() -> tempfile::TempDir {
         let dir = tempfile::tempdir().unwrap();
         tokio::fs::write(dir.path().join("Cargo.lock"), lock_body())
diff --git a/crates/socket-patch-core/src/vendor/lock_inventory/cargo.rs b/crates/socket-patch-core/src/vendor/lock_inventory/cargo.rs
index d0158d87..8cc89d11 100644
--- a/crates/socket-patch-core/src/vendor/lock_inventory/cargo.rs
+++ b/crates/socket-patch-core/src/vendor/lock_inventory/cargo.rs
@@ -31,7 +31,7 @@ pub(super) async fn inventory_cargo_lock(project_root: &Path) -> Option<Vec<Lock
 /// [`inventory_cargo_lock`] before its collapse: every instance
 /// ([`super::inventory_project_every_lock`]).
 pub(super) async fn inventory_cargo_lock_raw(project_root: &Path) -> Option<Vec<LockfileEntry>> {
-    let (_, doc) = crate::vendor::cargo_lock::read_lock(project_root)
+    let (_, doc, _) = crate::vendor::cargo_lock::read_lock(project_root)
         .await
         .ok()?;
     let mut out = Vec::new();

From a18ffd14507abe0a3e59fdfbefc0db6c548eb44c Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Fri, 25 Sep 2026 00:41:42 -0400
Subject: [PATCH 10/13] fix(vendor): state the real cargo floor for two
 versions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Cargo before 1.56 resolves every source-less Cargo.lock entry for a crate
through ONE [patch.crates-io] path — the entry whose key sorts last — so
with two vendored versions one lock entry is pinned to the other
version's copy and cargo build --locked fails closed with "patch for
<crate> did not resolve to any crates". The docs claimed older cargo
needed only a populated crates.io index; the index does not help. The
old-toolchain e2e passed because its fixture uuids happened to sort so
that the lower version's key came last, the one order 1.41 can take.

Verified on the rust:1.41-slim and rust:1.56-slim images with two crates
(cfg-if 1.0.5/0.1.10, lazy_static 1.5.0/0.2.11) and with three versions
(bitflags 1.2.1/0.9.1/0.8.2): only the key sort order decides, the lock
entry order does not, and 1.56 builds either way.

The e2e fixture now uses uuids whose keys sort adversarially, asserts
that order so a future uuid cannot quietly make the test toothless, and
pins the refusal below 1.56 while requiring 1.56 to build both copies.
Vendoring a second version of a crate warns with
cargo_multi_version_old_cargo unless the project's rust-version or
rust-toolchain[.toml] promises cargo 1.56 or newer; socket-patch never
runs cargo, so those files are the only signal it has. A single vendored
version still builds on 1.41.

A key-naming scheme that puts the lowest version's key last does make
1.41 resolve every entry correctly, but it would replace the documented
<name>-socket-<uuid8> key with a version-rank encoding in every project's
committed manifest, and rest correctness on an undocumented cargo
iteration order. Left out deliberately; the failure is loud, not silent.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 CHANGELOG.md                                  |  31 +-
 .../tests/e2e_vendor_cargo_build.rs           | 153 +++++++---
 crates/socket-patch-core/src/vendor/cargo.rs  | 272 ++++++++++++++++++
 docs/ecosystems.md                            |  36 ++-
 4 files changed, 429 insertions(+), 63 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8f907062..9c1f2d5a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -97,12 +97,13 @@ into the new version's section — see docs/releasing.md.
   of `.cargo/config.toml` / `.cargo/config`, so Socket scanners can recover
   the patch uuid from the manifest alone and single-version wiring builds
   on cargo older than 1.56 (the floor of config-file `[patch]`; proven on
-  cargo 1.41 with no network); two vendored versions of one crate make older cargo
-  load the crates.io index to tell the two entries apart: `--offline` from
-  an empty `$CARGO_HOME` is enough on cargo 1.56, while older cargo such as
-  1.41 needs the index itself (the crates.io index in `$CARGO_HOME`, or
-  network access), and without `--offline` either one first tries to update
-  the index and fails when it is unreachable. The edit is
+  cargo 1.41 with no network). TWO vendored versions of one crate need
+  cargo 1.45 or newer: from 1.45 `--offline` from an empty `$CARGO_HOME` is
+  enough (without `--offline` it first tries to update the crates.io index
+  and fails when that is unreachable), while cargo before 1.45 resolves
+  every source-less lock entry for a crate through one `[patch]` path and
+  fails closed on the other — see the `cargo_multi_version_old_cargo`
+  entry under Fixed. The edit is
   format-preserving (comments, ordering, CRLF / mixed line endings, a
   UTF-8 BOM and the trailing-newline state survive; a revert restores the
   manifest byte for byte and keeps a user's own `[patch]` /
@@ -726,6 +727,24 @@ into the new version's section — see docs/releasing.md.
   `setup --remove` could not land byte-identical on the pre-setup file.
   `package.json` is now written in its own layout (BOM, indent, line ending,
   trailing-newline shape), the same helper the vendored backends use.
+- **Two vendored versions of one cargo crate are documented — and now
+  warned about — as needing cargo 1.45.** The docs said older cargo (1.41)
+  only needed a populated crates.io index. It needs more than that: cargo
+  before 1.45 resolves every source-less `Cargo.lock` entry for a crate
+  through ONE `[patch.crates-io]` path — the entry whose KEY sorts last —
+  so one of the two versions is pinned to the other's copy and `cargo build
+  --locked` fails closed with ``patch for `<crate>` … did not resolve to
+  any crates``, index or no index. The old-toolchain e2e passed only
+  because its fixture uuids happened to sort the other way; it now uses the
+  adversarial order, and the floor was measured rather than assumed — on
+  one two-version fixture in both key orders, 1.41.1, 1.42, 1.43 and 1.44
+  refuse the adversarial order while 1.45, 1.49, 1.53, 1.56 and current
+  stable resolve either order, each lock entry to its own copy. Vendoring a
+  second version of a crate warns with `cargo_multi_version_old_cargo`
+  unless the project's `rust-version` or `rust-toolchain[.toml]` promises
+  cargo 1.45 or newer (socket-patch never runs `cargo`, so those files are
+  the only signal it has). A SINGLE vendored version still builds on cargo
+  1.41, as before.
 - **A CRLF `Cargo.lock` stays CRLF, and reverts byte-for-byte.** Vendoring
   rewrote every line of a lock committed with Windows line endings as LF
   (`toml_edit` renders LF only), and `vendor --revert` then "restored" the
diff --git a/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs b/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs
index 82c4749c..ad6d6d57 100644
--- a/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs
@@ -36,8 +36,8 @@
 //! tagged lock build the patched copy with no network on cargo 1.41 / 1.56
 //! — the local `rust:1.41-slim` / `rust:1.56-slim` docker images, preferred,
 //! else installed rustup toolchains 1.36..=1.56 (type-check only) —
-//! config-file `[patch]` needs 1.56+; two versions of one crate there need
-//! `--offline`; skipped when neither is available, required by the
+//! config-file `[patch]` needs 1.56+; two versions of one crate need cargo
+//! 1.45+ and `--offline`; skipped when neither is available, required by the
 //! `cargo-old-toolchains` CI leg). Also: a
 //! URL-spelled crates.io `[patch]` table is refused, an ancestor-directory
 //! config entry cannot silently shadow the vendored copy, and the pre-v5
@@ -1190,7 +1190,14 @@ async fn cargo_get_uuid_vendored_fresh_checkout_locked_build() {
 
 // ── v5 manifest wiring: multi-version, legacy migration, old toolchains ─
 
-const UUID_OLD: &str = "3c4d5e6f-7081-4b2c-9d3e-123456789abc";
+/// The second patch uuid of the multi-version fixtures. Deliberately
+/// ADVERSARIAL: its `cfg-if-socket-1a2b3c4d` key sorts BEFORE `UUID`'s, so
+/// the HIGHER version's `[patch.crates-io]` key sorts LAST — the order
+/// cargo before 1.45 cannot resolve (see
+/// `cargo_vendored_two_versions_are_refused_by_cargo_below_1_45`). With the
+/// opposite order 1.41 happens to build, so a favorable pair would let a
+/// regression in the modern-cargo path go unnoticed here.
+const UUID_OLD: &str = "1a2b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d";
 const PATCH_SUFFIX_OLD: &str =
     "\n/// Socket-patch marker for the OLD major (added by the vendored patch).\npub fn socket_patched_old() -> u32 { 2 }\n";
 
@@ -2070,6 +2077,12 @@ const OLD_TOOLCHAINS_REQUIRED_ENV: &str = "SOCKET_PATCH_CARGO_OLD_TOOLCHAINS_REQ
 /// locally (the test never pulls; the CI leg does).
 const OLD_CARGO_IMAGES: [(&str, u32); 2] = [("rust:1.41-slim", 41), ("rust:1.56-slim", 56)];
 
+/// The cargo minor from which two vendored versions of one crate resolve in
+/// EITHER `[patch.crates-io]` key order — the floor
+/// `socket_patch_core`'s `MULTI_VERSION_CARGO_MINOR` warns below. Measured
+/// on 1.41.1/1.42/1.43/1.44 (refuse) and 1.45/1.49/1.53/1.56 (build).
+const MULTI_VERSION_FLOOR: u32 = 45;
+
 /// One old cargo under test.
 #[derive(Clone, Debug)]
 enum OldCargo {
@@ -2312,26 +2325,33 @@ fn cargo_vendored_manifest_patch_builds_on_old_toolchains() {
     }
 }
 
-/// OLD TOOLCHAIN, TWO VERSIONS of one crate: older cargo loads the
-/// crates.io index to tell two same-named `[patch]` entries apart. Every
-/// clause of the documented constraint is ASSERTED here, in both
-/// directions, because both arms run with no network (docker `--network
-/// none`, rustup pointed at a dead proxy):
+/// OLD TOOLCHAIN, TWO VERSIONS of one crate: cargo 1.45 is the FLOOR.
+///
+/// Cargo before 1.45 resolves every source-less `Cargo.lock` entry for a
+/// crate through ONE `[patch.crates-io]` path — the entry whose KEY sorts
+/// last — so with two vendored versions one lock entry is pinned to the
+/// other version's copy. The fixture uuids are chosen so the HIGHER
+/// version's key sorts last (see `UUID_OLD`), the order 1.41 cannot take;
+/// with the opposite order 1.41 happens to build, which is how the
+/// limitation went unnoticed. Asserted in every direction, with no network
+/// (docker `--network none`, rustup pointed at a dead proxy):
 ///
-/// * without `--offline` the build MUST fail, and fail on the unreachable
-///   index — the negative control for "pass `--offline`";
-/// * cargo 1.56 then builds under `--offline` from an EMPTY CARGO_HOME;
-/// * older cargo (1.41) MUST first fail even under `--offline` (no registry
-///   cache to read), and the documented remedy — a populated crates.io
-///   index in `$CARGO_HOME` — must then build (and run) both patched
-///   copies with no network. That step is unconditional below 1.56, so a
-///   cargo that stops needing it fails this test instead of silently
-///   skipping the remedy.
+/// * without `--offline` EVERY old cargo fails on the unreachable
+///   crates.io index (it loads the index to tell two same-named `[patch]`
+///   entries apart) — the negative control for "pass `--offline`";
+/// * cargo 1.45 and later then build BOTH copies under `--offline` from an
+///   EMPTY CARGO_HOME (measured on 1.45, 1.49, 1.53 and 1.56);
+/// * below 1.45 `--offline` fails on the patch resolution itself —
+///   ``patch for `cfg-if` … did not resolve to any crates`` — from an empty
+///   CARGO_HOME AND with the index remedy that makes a single vendored
+///   version work there (measured on 1.41.1, 1.42, 1.43 and 1.44). A cargo
+///   below 1.45 that starts building this fails the test instead of
+///   silently widening the supported range.
 ///
-/// Current stable needs neither — see
+/// Current stable needs none of it — see
 /// `cargo_vendor_two_versions_of_one_crate_locked_build`.
 #[test]
-fn cargo_vendored_two_versions_on_old_toolchains_need_offline() {
+fn cargo_vendored_two_versions_are_refused_by_cargo_below_1_45() {
     const SUITE: &str = "e2e_vendor_cargo_build (old-toolchain multi-version)";
     let Some(cargos) = old_cargos_or_skip(SUITE) else {
         return;
@@ -2345,6 +2365,22 @@ fn cargo_vendored_two_versions_on_old_toolchains_need_offline() {
     };
     let env = vendor_ok(&fx.proj, &fx.cargo_home, "old-toolchain multi-version");
     assert_eq!(env["summary"]["failed"], 0, "{env}");
+    // The vendor says the project now needs cargo 1.45 (the fixture
+    // declares no `rust-version` and pins no toolchain).
+    assert!(
+        env["events"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .any(|e| e["errorCode"] == "cargo_multi_version_old_cargo"),
+        "the second version must warn about the cargo floor: {env}"
+    );
+    // The adversarial key order is what this test pins.
+    let manifest = std::fs::read_to_string(fx.proj.join("Cargo.toml")).unwrap();
+    assert!(
+        socket_key(UUID_OLD) < socket_key(UUID),
+        "the HIGHER version's key must sort last: {manifest}"
+    );
     std::fs::write(fx.proj.join("src/main.rs"), TWO_VERSION_MAIN).unwrap();
     let lock = std::fs::read_to_string(fx.proj.join("Cargo.lock")).unwrap();
     if !lock.contains("version = 4\n") {
@@ -2373,43 +2409,66 @@ fn cargo_vendored_two_versions_on_old_toolchains_need_offline() {
              wiring:\n{online_stderr}"
         );
         println!("old-toolchain multi-version {name} without --offline: needs the index");
-        let mut run = old_cargo_run(&old, &fresh, &["--offline"]);
-        if old.minor() < 56 {
-            let stderr = String::from_utf8_lossy(&run.out.stderr).into_owned();
-            assert!(
-                !run.out.status.success(),
-                "{name}: below 1.56 an EMPTY CARGO_HOME cannot tell the two [patch] \
-                 entries apart offline — the reason the index remedy is documented:\n\
-                 {stderr}"
-            );
+
+        let run = old_cargo_run(&old, &fresh, &["--offline"]);
+        let stderr = String::from_utf8_lossy(&run.out.stderr).into_owned();
+        if old.minor() >= MULTI_VERSION_FLOOR {
             assert!(
-                stderr.contains("unable to fetch registry") && stderr.contains("in offline mode"),
-                "{name}: the only accepted failure below 1.56 is the missing registry \
-                 index:\n{stderr}"
+                run.out.status.success(),
+                "{name}: 1.{MULTI_VERSION_FLOOR}+ must build two vendored versions under \
+                 --offline from an empty CARGO_HOME:\n{stderr}"
             );
-            println!("old-toolchain multi-version {name}: needs a registry index (documented)");
-            seed_old_crates_io_index(&fresh.join(".old-cargo-home"), &[&fx.new_v, &fx.old_v]);
-            run = old_cargo_run(&old, &fresh, &["--offline"]);
+            if matches!(old, OldCargo::Docker { .. }) {
+                assert!(
+                    String::from_utf8_lossy(&run.out.stdout).contains("MARKER:1:2"),
+                    "{name}: both patched copies run: {}",
+                    String::from_utf8_lossy(&run.out.stdout)
+                );
+            }
+            let _ = std::fs::remove_dir_all(&fresh);
+            continue;
         }
+
+        // Below 1.45 the patch resolution itself fails, with an empty
+        // CARGO_HOME and with the documented index remedy alike.
         assert!(
-            run.out.status.success(),
-            "{name}: two vendored versions must build under --offline:\n{}",
-            String::from_utf8_lossy(&run.out.stderr)
+            !run.out.status.success(),
+            "{name}: below 1.{MULTI_VERSION_FLOOR} two vendored versions must NOT build \
+             offline:\n{stderr}"
+        );
+        assert!(
+            stderr.contains("did not resolve to any crates"),
+            "{name}: below 1.{MULTI_VERSION_FLOOR} the failure is the unresolvable second \
+             `[patch]` entry:\n{stderr}"
+        );
+        seed_old_crates_io_index(&fresh.join(".old-cargo-home"), &[&fx.new_v, &fx.old_v]);
+        let seeded = old_cargo_run(&old, &fresh, &["--offline"]);
+        let seeded_stderr = String::from_utf8_lossy(&seeded.out.stderr).into_owned();
+        assert!(
+            !seeded.out.status.success(),
+            "{name}: below 1.{MULTI_VERSION_FLOOR} two vendored versions must NOT build \
+             even with a populated crates.io index — if this cargo now resolves both \
+             `[patch]` entries, the documented floor is wrong:\nstdout:\n{}\nstderr:\n\
+             {seeded_stderr}",
+            String::from_utf8_lossy(&seeded.out.stdout)
+        );
+        assert!(
+            seeded_stderr.contains("did not resolve to any crates"),
+            "{name}: the pinned failure is the unresolvable second `[patch]` entry, not \
+             something else:\n{seeded_stderr}"
+        );
+        println!(
+            "old-toolchain multi-version {name}: refused below 1.{MULTI_VERSION_FLOOR} \
+             (documented)"
         );
-        if matches!(old, OldCargo::Docker { .. }) {
-            assert!(
-                String::from_utf8_lossy(&run.out.stdout).contains("MARKER:1:2"),
-                "{name}: both patched copies run: {}",
-                String::from_utf8_lossy(&run.out.stdout)
-            );
-        }
         let _ = std::fs::remove_dir_all(&fresh);
     }
 }
 
-/// The documented remedy for two vendored versions on cargo older than
-/// 1.56: a populated crates.io index in `$CARGO_HOME`. Writes the minimal
-/// one an old cargo reads offline — the git index at the pre-1.85
+/// A populated crates.io index in `$CARGO_HOME` — what an old cargo needs
+/// before it can even look at two same-named `[patch]` entries offline, and
+/// the state in which the sub-1.45 refusal is pinned. Writes the minimal
+/// index an old cargo reads offline — the git index at the pre-1.85
 /// `registry/index/github.com-1ecc6299db9ec823` path (`origin/HEAD` names
 /// the tree cargo loads), listing `versions` of the patched crate. No
 /// `.crate` is cached: every listed version is patched to a path copy, so
diff --git a/crates/socket-patch-core/src/vendor/cargo.rs b/crates/socket-patch-core/src/vendor/cargo.rs
index 899c3a05..bb783c5b 100644
--- a/crates/socket-patch-core/src/vendor/cargo.rs
+++ b/crates/socket-patch-core/src/vendor/cargo.rs
@@ -52,6 +52,122 @@ use super::state::{
 };
 use super::{RevertOpts, RevertOutcome, VendorOutcome, VendorServiceConfig, VendorWarning};
 
+/// The cargo release where a project may vendor TWO versions of one crate.
+///
+/// Cargo before 1.45 resolves every source-less `Cargo.lock` entry of a
+/// crate through a single `[patch.crates-io]` path — the entry whose KEY
+/// sorts last — so with two vendored versions one of the two lock entries
+/// is pinned to the other version's copy. It fails closed
+/// (``patch for `<crate>` … did not resolve to any crates`` under
+/// `--locked`, with or without `--offline` and with or without a populated
+/// crates.io index), and which of the two orders happens to work is an
+/// accident of the patch uuids. Measured on one two-version fixture, both
+/// key orders, `cargo check --locked --offline` from an empty CARGO_HOME:
+/// 1.41.1, 1.42, 1.43 and 1.44 refuse the adversarial order; 1.45, 1.49,
+/// 1.53, 1.56 and current stable resolve either order, each lock entry to
+/// its own copy.
+const MULTI_VERSION_CARGO_MINOR: u32 = 45;
+
+/// The lowest cargo minor this project TELLS us it must build on, read
+/// offline from the project itself: the workspace root's `rust-version`
+/// (`[package]`, else `[workspace.package]`), else `rust-toolchain.toml`'s
+/// `[toolchain] channel`, else the legacy plain-text `rust-toolchain` file.
+///
+/// `None` when the project declares nothing, or pins a rolling channel
+/// (`stable`, `nightly`, …) — socket-patch never runs `cargo`, so there is
+/// no other signal, and "no declaration" is NOT evidence of a modern cargo.
+async fn declared_cargo_minor(project_root: &Path) -> Option<u32> {
+    fn minor_of(spec: &str) -> Option<u32> {
+        let spec = spec.trim().trim_matches('"');
+        let rest = spec.strip_prefix("1.")?;
+        rest.split(['.', '-', '+']).next()?.parse().ok()
+    }
+    if let Ok(text) = read_regular_to_string(&project_root.join(cargo_manifest::CARGO_TOML)).await {
+        if let Ok(doc) = text.parse::<toml_edit::DocumentMut>() {
+            let rust_version = doc
+                .get("package")
+                .and_then(|p| p.get("rust-version"))
+                .or_else(|| {
+                    doc.get("workspace")
+                        .and_then(|w| w.get("package"))
+                        .and_then(|p| p.get("rust-version"))
+                })
+                .and_then(|v| v.as_str())
+                .and_then(minor_of);
+            if rust_version.is_some() {
+                return rust_version;
+            }
+        }
+    }
+    if let Ok(text) = read_regular_to_string(&project_root.join("rust-toolchain.toml")).await {
+        if let Ok(doc) = text.parse::<toml_edit::DocumentMut>() {
+            if let Some(channel) = doc
+                .get("toolchain")
+                .and_then(|t| t.get("channel"))
+                .and_then(|v| v.as_str())
+            {
+                return minor_of(channel);
+            }
+        }
+    }
+    // The legacy file is a bare channel name, but rustup also accepts the
+    // TOML form under this name.
+    if let Ok(text) = read_regular_to_string(&project_root.join("rust-toolchain")).await {
+        if let Ok(doc) = text.parse::<toml_edit::DocumentMut>() {
+            if let Some(channel) = doc
+                .get("toolchain")
+                .and_then(|t| t.get("channel"))
+                .and_then(|v| v.as_str())
+            {
+                return minor_of(channel);
+            }
+        }
+        return minor_of(&text);
+    }
+    None
+}
+
+/// A warning when THIS vendor puts a SECOND version of `name` behind
+/// `[patch.crates-io]` in a project that may be built by a cargo older than
+/// [`MULTI_VERSION_CARGO_MINOR`] — `None` when the crate has only this one
+/// vendored version, or the project declares a new enough cargo.
+///
+/// `other` is another vendored version's copy path (for the message).
+async fn multi_version_warning(
+    project_root: &Path,
+    name: &str,
+    version: &str,
+) -> Option<VendorWarning> {
+    let other = socket_patch_paths(project_root, name)
+        .await
+        .into_iter()
+        .find(|p| !cargo_manifest::is_socket_copy_of(p, name, version))?;
+    let declared = declared_cargo_minor(project_root).await;
+    if declared.is_some_and(|m| m >= MULTI_VERSION_CARGO_MINOR) {
+        return None;
+    }
+    let says = match declared {
+        Some(m) => format!("this project pins cargo 1.{m}"),
+        None => "this project declares no `rust-version` or toolchain, so the cargo \
+                 that builds it is unknown"
+            .to_string(),
+    };
+    Some(VendorWarning::new(
+        "cargo_multi_version_old_cargo",
+        format!(
+            "{name} is now vendored at TWO versions ({version} beside {other}), which needs \
+             cargo {MULTI_VERSION_CARGO_MINOR_SPELLED} or newer — {says}. Older cargo resolves \
+             every source-less Cargo.lock entry for a crate through ONE `[patch.crates-io]` \
+             path (the entry whose key sorts last), so one of the two versions is pinned to the \
+             other's copy and `cargo build --locked` fails closed with `patch for `{name}` … \
+             did not resolve to any crates` — a populated crates.io index does not help. Build \
+             with cargo {MULTI_VERSION_CARGO_MINOR_SPELLED}+, or vendor only one version of \
+             {name}.",
+            MULTI_VERSION_CARGO_MINOR_SPELLED = format_args!("1.{MULTI_VERSION_CARGO_MINOR}"),
+        ),
+    ))
+}
+
 /// True if a crate is vendored under `<project_root>/vendor/` (in either the
 /// `<name>-<version>/` or bare `<name>/` layout the cargo crawler probes). A
 /// real `cargo vendor` tree already provides committed, project-owned bytes
@@ -607,6 +723,9 @@ pub async fn vendor_cargo_crate(
         if !legacy_paths.is_empty() {
             dry_warnings.push(migration_warning(project_root, name, version, true).await);
         }
+        if let Some(w) = multi_version_warning(project_root, name, version).await {
+            dry_warnings.push(w);
+        }
         // Preview the wet run's lock edit — unless a live hosted redirect
         // still owns the lock entry: the wet run reverts it from the
         // redirect ledger first, so its lock is not this one.
@@ -932,6 +1051,9 @@ pub async fn vendor_cargo_crate(
     };
     let had_prior_wiring =
         ensured.prior_path.is_some() || !legacy_paths.is_empty() || prior_socket_copy;
+    if let Some(w) = multi_version_warning(project_root, name, version).await {
+        warnings.push(w);
+    }
 
     // ── detach (and tag) the lock entry ───────────────────────────────────
     // `retagged_from`: the version a retag replaced, for the unwind.
@@ -1933,6 +2055,156 @@ mod tests {
         compute_git_sha256_from_bytes(bytes)
     }
 
+    /// A project root with `Cargo.toml` and, optionally, a
+    /// `[patch.crates-io]` table and toolchain files.
+    async fn toolchain_fixture(files: &[(&str, &str)]) -> tempfile::TempDir {
+        let dir = tempfile::tempdir().unwrap();
+        for (name, body) in files {
+            tokio::fs::write(dir.path().join(name), body).await.unwrap();
+        }
+        dir
+    }
+
+    /// The only signals socket-patch can read offline for "which cargo will
+    /// build this project" — it never runs `cargo` itself.
+    #[tokio::test]
+    async fn declared_cargo_minor_reads_rust_version_and_toolchain_files() {
+        /// `(project files, the declared cargo minor)`.
+        type Case = (&'static [(&'static str, &'static str)], Option<u32>);
+        let cases: [Case; 8] = [
+            (
+                &[(
+                    "Cargo.toml",
+                    "[package]\nname = \"a\"\nrust-version = \"1.70\"\n",
+                )],
+                Some(70),
+            ),
+            (
+                &[(
+                    "Cargo.toml",
+                    "[package]\nname = \"a\"\nrust-version = \"1.41.1\"\n",
+                )],
+                Some(41),
+            ),
+            (
+                &[(
+                    "Cargo.toml",
+                    "[workspace]\nmembers = []\n\n[workspace.package]\nrust-version = \"1.56\"\n",
+                )],
+                Some(56),
+            ),
+            (
+                &[
+                    ("Cargo.toml", "[package]\nname = \"a\"\n"),
+                    ("rust-toolchain.toml", "[toolchain]\nchannel = \"1.63.0\"\n"),
+                ],
+                Some(63),
+            ),
+            (
+                &[
+                    ("Cargo.toml", "[package]\nname = \"a\"\n"),
+                    ("rust-toolchain", "1.48.0\n"),
+                ],
+                Some(48),
+            ),
+            // A rolling channel says nothing about the cargo in use.
+            (
+                &[
+                    ("Cargo.toml", "[package]\nname = \"a\"\n"),
+                    ("rust-toolchain.toml", "[toolchain]\nchannel = \"stable\"\n"),
+                ],
+                None,
+            ),
+            (&[("Cargo.toml", "[package]\nname = \"a\"\n")], None),
+            // `rust-version` wins over a toolchain file: it is the floor the
+            // project promises, the toolchain file only what one dev uses.
+            (
+                &[
+                    (
+                        "Cargo.toml",
+                        "[package]\nname = \"a\"\nrust-version = \"1.41\"\n",
+                    ),
+                    ("rust-toolchain.toml", "[toolchain]\nchannel = \"1.80.0\"\n"),
+                ],
+                Some(41),
+            ),
+        ];
+        for (files, want) in cases {
+            let dir = toolchain_fixture(files).await;
+            assert_eq!(
+                declared_cargo_minor(dir.path()).await,
+                want,
+                "files: {files:?}"
+            );
+        }
+    }
+
+    /// The `[patch.crates-io]` table wiring `versions` of cfg-if, each under
+    /// its own Socket-owned key/uuid.
+    fn patch_table(versions: &[(&str, &str)]) -> String {
+        let mut out =
+            String::from("[package]\nname = \"app\"\nversion = \"0.1.0\"\n\n[patch.crates-io]\n");
+        for (version, uuid) in versions {
+            out.push_str(&format!(
+                "cfg-if-socket-{} = {{ package = \"cfg-if\", path = \".socket/vendor/cargo/{uuid}/cfg-if-{version}\" }}\n",
+                &uuid.replace('-', "")[..8]
+            ));
+        }
+        out
+    }
+
+    /// REGRESSION: cargo before 1.45 resolves every source-less lock entry
+    /// of a crate through ONE `[patch.crates-io]` path (the entry whose key
+    /// sorts last), so a second vendored version of the same crate cannot
+    /// build there — verified on the `rust:1.41-slim` image and cargo
+    /// 1.42/1.43/1.44, where the adversarial key order fails ``patch for
+    /// `cfg-if` … did not resolve to any crates`` even with a populated
+    /// index, while 1.45 and later build either order. The vendor says so
+    /// when the project does not promise a cargo that can take it.
+    #[tokio::test]
+    async fn a_second_vendored_version_warns_unless_the_project_pins_cargo_1_45() {
+        // One version: nothing to warn about.
+        let dir = toolchain_fixture(&[("Cargo.toml", &patch_table(&[("1.0.4", UUID)]))]).await;
+        assert!(multi_version_warning(dir.path(), "cfg-if", "1.0.4")
+            .await
+            .is_none());
+
+        // Two versions, no declared cargo: warn.
+        let two = patch_table(&[("1.0.4", UUID), ("0.1.10", UUID2)]);
+        let dir = toolchain_fixture(&[("Cargo.toml", &two)]).await;
+        let warning = multi_version_warning(dir.path(), "cfg-if", "1.0.4")
+            .await
+            .expect("a second version warns");
+        assert_eq!(warning.code, "cargo_multi_version_old_cargo");
+        assert!(warning.detail.contains("cfg-if-0.1.10"), "{warning:?}");
+        assert!(warning.detail.contains("1.45"), "{warning:?}");
+        // Either version's vendor says it.
+        assert!(multi_version_warning(dir.path(), "cfg-if", "0.1.10")
+            .await
+            .is_some());
+
+        // The project promises a cargo that can take it: silent.
+        let dir = toolchain_fixture(&[
+            ("Cargo.toml", &two),
+            ("rust-toolchain.toml", "[toolchain]\nchannel = \"1.45.0\"\n"),
+        ])
+        .await;
+        assert!(multi_version_warning(dir.path(), "cfg-if", "1.0.4")
+            .await
+            .is_none());
+
+        // A project that pins an OLDER cargo says so in the warning.
+        let dir = toolchain_fixture(&[
+            ("Cargo.toml", &two),
+            ("rust-toolchain.toml", "[toolchain]\nchannel = \"1.41.0\"\n"),
+        ])
+        .await;
+        let warning = multi_version_warning(dir.path(), "cfg-if", "1.0.4")
+            .await
+            .expect("an old pinned cargo warns");
+        assert!(warning.detail.contains("pins cargo 1.41"), "{warning:?}");
+    }
+
     /// The path of the root manifest's Socket-owned `[patch.crates-io]`
     /// entry for cfg-if (any key), if any.
     async fn manifest_path(root: &Path) -> Option<String> {
diff --git a/docs/ecosystems.md b/docs/ecosystems.md
index 7fbbd168..d070106f 100644
--- a/docs/ecosystems.md
+++ b/docs/ecosystems.md
@@ -216,7 +216,7 @@ entry in the **workspace-root `Cargo.toml`** (the manifest beside the
 ```toml
 [patch.crates-io]
 cfg-if-socket-9f6b2c4e = { package = "cfg-if", path = ".socket/vendor/cargo/<uuid>/cfg-if-1.0.4" }
-# a second vendored version of the same crate:
+# a second vendored version of the same crate (needs cargo 1.45+):
 cfg-if-socket-0a1b2c3d = { package = "cfg-if", path = ".socket/vendor/cargo/<uuid2>/cfg-if-0.1.10" }
 ```
 
@@ -260,14 +260,27 @@ version = "1.0.4+socket.<uuid>"
   the patched copy with no network on the cargo 1.41 and 1.56 docker
   images — the CI `cargo-old-toolchains` leg; without the images a local
   run falls back to type-checking on rustup toolchains).
-  Two vendored versions of ONE crate make older cargo load the crates.io
-  index to tell the two `[patch]` entries apart: on 1.56 `cargo build
-  --offline` from an empty `$CARGO_HOME` is enough, while older cargo
-  (1.41) needs the index itself — a populated crates.io index in
-  `$CARGO_HOME`, or network access. Without `--offline` either one tries to
-  update the index first and fails when it is unreachable. Current stable
-  needs neither. Each clause is asserted by the old-toolchain e2e test, in
-  both directions.
+  **Two vendored versions of ONE crate need cargo 1.45 or newer.** Cargo
+  before 1.45 resolves every source-less `Cargo.lock` entry for a crate
+  through ONE `[patch.crates-io]` path — the entry whose KEY sorts last —
+  so with two vendored versions one of the two lock entries is pinned to
+  the other version's copy and `cargo build --locked` fails closed with
+  ``patch for `<crate>` … did not resolve to any crates``. A populated
+  crates.io index in `$CARGO_HOME` does not help; whether a given pair of
+  patch uuids happens to build there is an accident of how their keys
+  sort. The floor was measured on one two-version fixture in both key
+  orders (`cargo check --locked --offline`, empty `$CARGO_HOME`): 1.41.1,
+  1.42, 1.43 and 1.44 refuse the adversarial order; 1.45, 1.49, 1.53, 1.56
+  and current stable resolve either order, each lock entry to its own copy.
+  Vendoring a second version of a crate therefore warns
+  (`cargo_multi_version_old_cargo`) unless the project's `rust-version` or
+  `rust-toolchain[.toml]` promises cargo 1.45+ — socket-patch never runs
+  `cargo`, so those files are the only signal it has. On an old cargo,
+  `cargo build --offline` from an empty `$CARGO_HOME` is enough; without
+  `--offline` it loads the crates.io index first and fails when that is
+  unreachable. Current stable needs neither. A SINGLE vendored version
+  still builds on 1.41. Each clause is asserted by the old-toolchain e2e
+  test, in both directions, with the adversarial key order.
 - **Keys.** Always the Socket-owned `<name>-socket-<first 8 hex of the
   uuid>` with `package = "<name>"` (the full uuid hex if that key is
   taken), never the bare crate name: cargo lets a config-file `[patch]`
@@ -277,7 +290,10 @@ version = "1.0.4+socket.<uuid>"
   of those config files already use are avoided. Every lookup (re-run,
   revert, VEX discovery) is key-agnostic: an entry belongs to
   `name@version` when its crate (`package`, else the key) is `name` and its
-  path is `.socket/vendor/cargo/<uuid>/<name>-<version>`.
+  path is `.socket/vendor/cargo/<uuid>/<name>-<version>`. The key is a
+  function of the patch uuid, so the order two versions' keys sort in is
+  arbitrary — which is why cargo below 1.45 cannot be relied on for a
+  multi-version project (above).
 - **Your entries.** User-authored `[patch.crates-io]` entries are never
   modified. One — in `Cargo.toml` or any cargo config file cargo merges
   (project, ancestors, `$CARGO_HOME`) — that patches the same crate and is

From eec2c51ffcb22c81c366c4b5784c91696803b961 Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Fri, 25 Sep 2026 11:22:37 -0400
Subject: [PATCH 11/13] test(vendor): check the wasi oracle at compile time

The build-metadata e2e vendored `wasi` and then ran a consumer binary
calling the patched marker fns. `wasi` declares 46 `extern "C"` WASI
syscalls that only resolve on wasm targets; GNU and Apple linkers
dead-strip the never-called wrappers, but MSVC refuses the executable
(`LNK1120: 46 unresolved externals`), so the test failed on the
windows-latest leg. The fresh-checkout `cargo build` of the same binary
consumer would have failed identically.

Keep `wasi` as the fixture (it is the real-world build-metadata crate
the bug hit) and make the consumer a library whose oracle is
compile-time: the patch suffix exposes `SOCKET_PATCHED` and
`SOCKET_PKG_VERSION` constants and the consumer's `src/lib.rs` holds a
`const fn bytes_eq` plus two `const _: () = assert!(...)` items, so
`cargo build --locked --offline` of the library proves both that the
patched bytes are what cargo compiled and that `CARGO_PKG_VERSION`
carries the exact `<version>.socket.<uuid>` tag, without linking
anything on any OS. The byte-identical revert leg and the zero-downloads
assertion are unchanged.

Negative controls, run by hand against the vendored tree: removing the
suffix from the copy fails with E0425 (`SOCKET_PATCHED` not found in
`wasi`); stripping the tag from the copy's manifest and lock entry fails
with E0080 (the const assertion). Verified under cargo 1.93.1 and
1.83.0 and all four lock formats.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 .../tests/e2e_vendor_cargo_build.rs           | 78 ++++++++++++-------
 1 file changed, 49 insertions(+), 29 deletions(-)

diff --git a/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs b/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs
index ad6d6d57..16e324e0 100644
--- a/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs
@@ -1917,9 +1917,39 @@ fn cargo_vendor_keeps_crlf_line_endings_and_reverts_byte_identically() {
 // ── build-metadata versions (the encoded purl the API serves) ─────────
 
 /// A dep-free crates.io crate whose version carries semver BUILD METADATA.
+/// Its 46 `extern "C"` WASI syscalls (`fd_read`, `proc_exit`, ...) only
+/// resolve on wasm targets, so the consumer below is a LIBRARY and its
+/// oracle is compile-time: linking `wasi` into a native executable fails on
+/// MSVC (`LNK1120: 46 unresolved externals`) while GNU/Apple linkers
+/// dead-strip the never-called wrappers.
 const META_DEP: &str = "wasi";
 const META_VERSION: &str = "0.11.0+wasi-snapshot-preview1";
 
+/// The consumer's baseline `src/lib.rs`.
+const META_BASELINE_LIB: &str = "pub fn baseline() {}\n";
+
+/// The patch suffix: constants, so the oracle needs nothing linked or run.
+const META_PATCH_SUFFIX: &[u8] = b"\n/// Socket-patch build-metadata marker.\npub const SOCKET_PATCHED: u32 = 1;\n\
+    /// The version cargo compiled this copy as.\npub const SOCKET_PKG_VERSION: &str = env!(\"CARGO_PKG_VERSION\");\n";
+
+/// The consumer's oracle `src/lib.rs`: it compiles only when the patched
+/// bytes are what cargo compiled (`SOCKET_PATCHED` exists) AND their
+/// `CARGO_PKG_VERSION` is exactly `expected` — both evaluated by rustc's
+/// const evaluator (`while` in `const fn` needs 1.46, `assert!` in a const
+/// needs 1.57; the matrix floor is 1.82), so `cargo build` of this library
+/// never links anything.
+fn meta_oracle_lib(expected: &str) -> String {
+    const BYTES_EQ: &str = "const fn bytes_eq(a: &[u8], b: &[u8]) -> bool {\n\
+        \x20   if a.len() != b.len() {\n        return false;\n    }\n\
+        \x20   let mut i = 0;\n\
+        \x20   while i < a.len() {\n        if a[i] != b[i] {\n            return false;\n        }\n        i += 1;\n    }\n\
+        \x20   true\n}\n";
+    format!(
+        "{BYTES_EQ}const _: () = assert!({META_DEP}::SOCKET_PATCHED == 1);\n\
+         const _: () = assert!(bytes_eq({META_DEP}::SOCKET_PKG_VERSION.as_bytes(), b\"{expected}\"));\n"
+    )
+}
+
 /// BUILD METADATA: the patches API serves canonical purls, so this crate's
 /// version arrives percent-encoded (`0.11.0%2Bwasi-snapshot-preview1`).
 /// REGRESSION: the vendored backend compared that raw spelling against
@@ -1929,9 +1959,11 @@ const META_VERSION: &str = "0.11.0+wasi-snapshot-preview1";
 /// ever be vendored. Proves the whole committable shape for one: the copy
 /// dir keeps the DECODED version, its manifest is tagged
 /// `<version>.socket.<uuid>` (the tag appends to existing metadata), the
-/// lock entry is detached at the tagged version, real cargo builds and runs
-/// the patched bytes under `--locked --offline`, and `--revert` restores
-/// both files byte-for-byte.
+/// lock entry is detached at the tagged version, real cargo compiles the
+/// patched bytes as that tagged version under `--locked --offline` (a
+/// compile-time oracle in a library consumer — see `META_DEP` for why no
+/// native binary may link `wasi`), and `--revert` restores both files
+/// byte-for-byte.
 #[test]
 fn cargo_vendor_build_metadata_version_from_encoded_purl() {
     const SUITE: &str = "e2e_vendor_cargo_build (build-metadata)";
@@ -1953,11 +1985,7 @@ fn cargo_vendor_build_metadata_version_from_encoded_purl() {
         ),
     )
     .unwrap();
-    std::fs::write(
-        proj.join("src/main.rs"),
-        "fn main() { println!(\"baseline\"); }\n",
-    )
-    .unwrap();
+    std::fs::write(proj.join("src/lib.rs"), META_BASELINE_LIB).unwrap();
     let build = cargo(&proj, &["build", "-q"], &cargo_home);
     if !build.status.success() {
         let _ = cargo_e2e_matrix::skip(
@@ -1983,9 +2011,7 @@ fn cargo_vendor_build_metadata_version_from_encoded_purl() {
     // EXACTLY what the API serves: the version percent-encoded.
     let purl = format!("pkg:cargo/{META_DEP}@{}", version.replace('+', "%2B"));
     let orig = std::fs::read(crate_dir.join("src/lib.rs")).unwrap();
-    let suffix = b"\n/// Socket-patch build-metadata marker.\npub fn socket_patched() -> u32 { 1 }\n\
-                   /// The version cargo compiled this copy as.\npub fn socket_pkg_version() -> &'static str { env!(\"CARGO_PKG_VERSION\") }\n";
-    let patched: Vec<u8> = [orig.as_slice(), suffix.as_slice()].concat();
+    let patched: Vec<u8> = [orig.as_slice(), META_PATCH_SUFFIX].concat();
     stage_patch(&proj, &purl, "src/lib.rs", &orig, &patched);
 
     let manifest_before = std::fs::read(proj.join("Cargo.toml")).unwrap();
@@ -2027,20 +2053,18 @@ fn cargo_vendor_build_metadata_version_from_encoded_purl() {
         "the [patch.crates-io] entry pins the copy:\n{manifest_after}"
     );
 
-    // COMPILE ORACLE: only the patched bytes have `socket_patched`.
-    std::fs::write(
-        proj.join("src/main.rs"),
-        format!(
-            "fn main() {{ println!(\"MARKER:{{}}:{{}}\", {META_DEP}::socket_patched(), {META_DEP}::socket_pkg_version()); }}\n"
-        ),
-    )
-    .unwrap();
-    let run = cargo(&proj, &["run", "-q", "--locked", "--offline"], &cargo_home);
+    // COMPILE ORACLE: only the patched bytes have `SOCKET_PATCHED`, and the
+    // const assert pins `CARGO_PKG_VERSION` to the tagged version.
+    std::fs::write(proj.join("src/lib.rs"), meta_oracle_lib(&tagged_version)).unwrap();
+    let build = cargo(
+        &proj,
+        &["build", "-q", "--locked", "--offline"],
+        &cargo_home,
+    );
     assert!(
-        String::from_utf8_lossy(&run.stdout).contains(&format!("MARKER:1:{tagged_version}")),
-        "the patched copy builds and runs as the tagged version:\nstdout:\n{}\nstderr:\n{}",
-        String::from_utf8_lossy(&run.stdout),
-        String::from_utf8_lossy(&run.stderr)
+        build.status.success(),
+        "the patched copy compiles as the tagged version:\n{}",
+        String::from_utf8_lossy(&build.stderr)
     );
 
     // Fresh checkout: committable, and nothing is fetched.
@@ -2054,11 +2078,7 @@ fn cargo_vendor_build_metadata_version_from_encoded_purl() {
     assert!(!home.join("registry").exists(), "zero crate downloads");
 
     // Revert is byte-identical.
-    std::fs::write(
-        proj.join("src/main.rs"),
-        "fn main() { println!(\"baseline\"); }\n",
-    )
-    .unwrap();
+    std::fs::write(proj.join("src/lib.rs"), META_BASELINE_LIB).unwrap();
     revert_ok(&proj, &cargo_home, "build-metadata");
     assert_eq!(
         std::fs::read(proj.join("Cargo.toml")).unwrap(),

From a4fdde9389dbafd00aaf0e973f47a387edf4c201 Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Fri, 25 Sep 2026 11:22:37 -0400
Subject: [PATCH 12/13] test(vex): label cargo lock shapes in assert messages

CodeQL's default setup raised 14 new `rust/cleartext-logging` alerts
on this branch, all in `assert_attested`'s panic messages. The SARIF
code flows start at the `uuid` reads inside `cargo_tag::tag_version`'s
`format!` (CodeQL's name heuristics classify any `uid`/`uuid`-named
identifier as sensitive), pass through the test's `tagged_version(U)`
wrapper into the `copy`/`locked` strings of
`cargo_vendored_a_attests_in_every_lock_version`, and end in the `what`
label interpolated into every assertion message of the helper.

A Socket patch uuid is a public identifier, so the alerts are false
positives, but they gate the PR and no CodeQL config file exists to
exclude tests. Break the path where the value entered the messages: the
loop now labels its two cases `tagged` / `untagged` instead of
embedding the tagged version strings, and `assert_attested` documents
that `what` is a shape label so the next test does not reintroduce the
flow.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 .../tests/e2e_vex_lockfile/cargo.rs              | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/cargo.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/cargo.rs
index ad3908cf..a0bc1cd2 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/cargo.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/cargo.rs
@@ -377,7 +377,9 @@ type Shape = dyn Fn(&Fx);
 
 /// Exactly one statement: `purl` fixed by `uuid`'s GHSA (CVE alias), with the
 /// provenance `marker`; exit 0; a `verified` event carrying the vuln; the
-/// manifest is never written.
+/// manifest is never written. `what` is a shape label, never a tagged
+/// version: CodeQL classifies every `uuid`-derived string as sensitive and
+/// flags it in panic messages (`rust/cleartext-logging`).
 fn assert_attested(fx: &Fx, run: &Run, purl: &str, uuid: &str, marker: &str, what: &str) {
     assert_eq!(run.code, Some(0), "{what}: {}", run.env);
     assert_eq!(run.env["status"], "success", "{what}: {}", run.env);
@@ -1178,12 +1180,12 @@ fn cargo_vendored_a_attests_in_every_lock_version() {
         write_cargo_vendored(&fx, U, CargoVendored::Inline, PATCHED_RS);
         // The tagged copy + tagged lock (v5), and the pre-tag shape: an
         // untagged copy with its untagged lock entry.
-        for (copy, locked) in [
-            (tagged_version(U), tagged_version(U)),
-            (CRATE_VERSION.to_string(), CRATE_VERSION.to_string()),
+        for (shape, at) in [
+            ("tagged", tagged_version(U)),
+            ("untagged", CRATE_VERSION.to_string()),
         ] {
-            fx.put(&copy_toml, copy_at(&copy));
-            fx.put("Cargo.lock", cargo_lock_at(version, &locked, ""));
+            fx.put(&copy_toml, copy_at(&at));
+            fx.put("Cargo.lock", cargo_lock_at(version, &at, ""));
             let run = fx.vex(&["--proxy-url", &api.uri()]);
             assert_attested(
                 &fx,
@@ -1191,7 +1193,7 @@ fn cargo_vendored_a_attests_in_every_lock_version() {
                 CARGO_PURL,
                 U,
                 "vendored",
-                &format!("lock v{version} at {locked}, copy at {copy}"),
+                &format!("lock v{version}, {shape} copy and lock entry"),
             );
             assert!(warning_codes(&run).is_empty(), "v{version}: {}", run.env);
         }

From 44c629fad788e2ee1b720564ca160c39580a32b0 Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Fri, 25 Sep 2026 12:22:24 -0400
Subject: [PATCH 13/13] Fix ten hosted cargo redirect bugs found by a
 real-cargo matrix (#255)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(redirect): pin and revert each cargo version separately

A project that locks two versions of one crate (cfg-if 1.0.4 beside a
renamed cfg-if-legacy at 0.1.10) had every same-named declaration pinned
to the last patch's registry: the manifest planner matched the crate name
only, so `^0.1.10` pointed at a registry that serves 1.0.4 and
`cargo fetch --locked` failed. `get <uuid>` for one version broke it the
same way.

The planner now pins a declaration only when its version requirement
selects the patched version. A requirement that also matches another
locked version refuses the dep (nothing written); `workspace = true`
inheritors of an entry naming another version are skipped.

`remove` had the matching defect: manifest edits are keyed by crate name,
so removing one version also reverted the other version's pin (leaving its
lock entry hosted) and dropped its registry edit from the ledger, so the
created `.cargo/config.toml` survived the second removal. Manifest edits
whose pin names a sibling version's registry lineage are no longer claimed.

Golden: cargo/cargo/multi-version (the depscan TS twin lags; list it in
TS_LAGGING on the next submodule bump). Real-cargo regression:
e2e_redirect_cargo_shapes multi-version (fresh `cargo fetch --locked` +
offline build links both patched copies; removing both purls restores
every byte).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix(redirect): restore a cargo config's bytes on hosted remove

`remove` of a hosted cargo patch deleted the `[registries.socket-patch-…]`
block it had appended to an existing config but kept the blank separator
line it inserted before it, so a legacy `.cargo/config` holding
`[net]\nretry = 2\n` came back as `[net]\nretry = 2\n\n`. It also collapsed
every run of three newlines anywhere in the file, rewriting the user's own
spacing.

The block now leaves through the replay path's fragment removal, which
takes the block's own separator and nothing else.

Real-cargo regression: e2e_redirect_cargo_shapes legacy-config.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix(redirect): pin cargo workspace members' own declarations

Hosted mode pinned only the root Cargo.toml. In a workspace whose member
declares the patched crate itself (`cfg-if = "1.0.4"` beside siblings
that inherit `[workspace.dependencies]`), the member stayed on crates.io
while Cargo.lock was repointed at the patch registry, so
`cargo fetch --locked` failed — and the dep was still reported
redirected and attested.

`scan`/`get --mode hosted` now read every workspace member manifest
(`[workspace] members` globs minus `exclude`, plus in-root path
dependencies) and the rewriter plans them all in the dep's single
transaction: each direct declaration is pinned, `workspace = true`
inheritors resolve against the root's entry, and a member that cannot be
pinned refuses the dep everywhere. `remove` already reverts edits by path;
its registry-block reference probe now covers member manifests too.

Golden: cargo/cargo/workspace-member (the depscan TS twin is handed no
member manifests and lags; list it in TS_LAGGING on the next submodule
bump). Real-cargo regression: e2e_redirect_cargo_shapes
workspace-direct-member.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* test(redirect): attest every cargo shape post-install

The real-cargo shape suite now also runs `socket-patch vex` over each
fresh checkout (ledger kept, patch server admitted) and requires exactly
the shape's patches to be attested — multi-version and workspace-member
redirects included.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix(redirect): redirect CRLF cargo projects in hosted mode

Every hosted cargo planner matched LF text, so a Windows checkout with
CRLF Cargo.toml / Cargo.lock was refused outright
(redirect_cargo_toml_dep_unrewritable / redirect_cargo_lock_pkg_not_found).

A manifest, lock or config whose every line break is CRLF is now planned
as LF and written back as CRLF, and its recorded edit fragments are
stored CRLF so `remove` and rollback find them in the file. Files with
mixed endings are left alone and keep refusing where the grammar does not
match. The shared fragment remover (used for the appended registry block)
inverts CRLF files as LF so it no longer strands a `\r` line.

Golden: cargo/cargo/crlf (CRLF manifest, lock and legacy config; the
depscan TS twin lags — list it in TS_LAGGING on the next submodule bump).
Real-cargo regression: e2e_redirect_cargo_shapes crlf (endings kept,
fresh `cargo fetch --locked` + offline build, byte-identical remove).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix(redirect): say why a transitive-only crate is not redirected

A hosted cargo redirect pins a crate with `registry = "…"` on its
manifest declaration, which reaches only that declaration: a crate the
project gets purely through another dependency cannot be redirected in
hosted mode. That stays a refusal — nothing is written, recorded or
attested, and a requested VEX fails the run — but the warning said only
"no [dependencies] entry for X in Cargo.toml", which reads like a
discovery bug.

When Cargo.lock resolves the crate at the patched version the warning
now says it is a transitive-only dependency, that it was NOT redirected
and stays unpatched, and that `scan --mode vendored` (whose
`[patch.crates-io]` covers the whole graph) or a direct declaration can
patch it. The code (`redirect_cargo_toml_dep_not_found`) is unchanged.

Golden: cargo/cargo/transitive-refusal (pins the refusal and its warning
code). In-process: the refusal writes nothing, is not attested, and the
envelope carries the transitive-only warning.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* test(redirect): run the cargo shape suite in every lock format

The multi-version, workspace-member, legacy-config and CRLF shapes ran
only against the toolchain's own v4 lock, so nothing in-repo checked
them against a committed v1 lock (full-id dependency edges, checksums
in `[metadata]`) or v2/v3.

The shape suite now honours SOCKET_PATCH_CARGO_E2E_LOCK_VERSION like
the other real-cargo suites and joins the cargo-vex-matrix CI job. The
shared lock re-encoder kept only dependency names, which cannot tell
two locked versions of one crate apart; it now keeps each edge's
package id and writes the shortest form cargo writes for that format
(`name`, `name version`, or the full id; always the full id in v1).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix(redirect): refuse a cargo crate other crates depend on

A hosted cargo redirect pins a crate with `registry = "…"` on each
manifest declaration and repoints its one Cargo.lock entry. When a
crates.io (or git) crate in the lock also depends on it — cfg-if, libc
and serde usually are both direct and transitive — that edge keeps
resolving from crates.io. The repointed lock then fails
`cargo fetch --locked`, a plain build adds the crates.io copy back
beside the patched one, and the dependent crate compiles the unpatched
code, while scan reported the crate redirected and VEX attested it.
The same happened for a path package whose manifest the rewriter never
saw (outside the project root, or behind a symlink).

Before committing a dep, every Cargo.lock package that depends on it
(any edge spelling: `name`, `name version`, or the full v1 id) must be
a source-less package whose manifest was planned and pinned. Otherwise
the dep is skipped with the new additive warning
`redirect_cargo_transitive_dependents`, which names the dependents,
says the crate was NOT redirected and stays unpatched, and points to
`scan --mode vendored`. Nothing is written, recorded or attested.

Golden: cargo/cargo/shared-dependency (the depscan TS twin lags — list
it in TS_LAGGING on the next submodule bump). Unit: registry, git, v1
full-id and unplanned-path dependents refuse; another version's edge
and a planned member do not. Real cargo: e2e_redirect_cargo_shapes
direct-and-transitive (cfg-if beside crc32fast) is refused and the
untouched project still fetches `--locked`; before this change the
same shape reported redirected: 1.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix(redirect): never follow a symlink to a cargo member

Workspace member discovery checked the project root only lexically. A
literal `members = ["linked"]` entry or a path dependency through a
symlinked directory was returned as a rewrite target, and `scan --mode
hosted` then wrote the registry pin into a Cargo.toml outside the
project (the whole-run symlink guard checks only the file itself, not
its parent directories). The same link matched by a `crates/*` glob
was skipped instead, because the glob does not follow links.

Discovery now returns only manifests reached without crossing a
symbolic link: a symlinked member directory (literal or glob), a
symlinked path dependency, a symlinked intermediate directory and a
symlinked Cargo.toml are all left out. Cargo still reads those
manifests, so a crate one of them depends on is refused by the
Cargo.lock dependents check (redirect_cargo_transitive_dependents),
exactly like a member or path dependency outside the root.

Unit: symlinked literal/glob/nested members, a symlinked path
dependency and manifest, and out-of-root members/path dependencies are
not returned. In-process: an out-of-root path dependency and a glob or
literal symlinked member each refuse the crate loudly and leave every
file, the one outside the project included, untouched (the literal
case reported redirected: 1 and wrote outside the project before).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix(redirect): remove v1-lock cargo patches in any order

A v1 Cargo.lock names every dependency by its full id, so repointing a
crate also rewrites its dependents' references. Each dependent's whole
`[[package]]` block was recorded as one edit. When one block referenced
two patched packages (the root, for two cfg-if versions or any two
patched crates it declares) the second edit's `original` was the first
edit's `new`, and removing the first-applied purl alone found neither
fragment: `remove`, scoped rollback and the hosted-to-vendored takeover
refused as "drifted" unless purls went in exact reverse apply order.

The dependents' references are now one `redirect_cargo_lock_reference`
edit holding just the quoted full id `"name version (source)"`. It
names that package exactly, so its inverse puts back every occurrence,
independently of any other package's edits; the per-purl revert and the
whole-ledger replay both handle it. The v1 whole-block edits were never
released, so no existing ledger carries them.

Unit: two cfg-if versions and two crates sharing a dependent block each
remove in both orders byte-for-byte (both refused as drifted before); a
full id named by two members replays clean. Real cargo:
e2e_redirect_cargo_shapes now removes every multi-patch shape in apply
order and in reverse, from the same post-scan state, and passes with
SOCKET_PATCH_CARGO_E2E_LOCK_VERSION=1, 2 and 4.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix(redirect): restore a cargo config's exact trailing bytes

The earlier bug-H fix removed the appended `[registries.…]` block with
the shared fragment remover, which collapses the whole trailing newline
run at EOF to one newline. That fixed a config ending in exactly one
newline but lost a config's trailing blank line (restored byte-for-byte
before that change) and still added a newline to a config without one.

The block removal now inverts exactly what the rewriter appended: the
recorded fragment plus the single blank separator before it. The
newline a config without a final one needs rides in the recorded
fragment, so that case is exact too; content the user appended after
the block is kept; a config the rewrite created still ends empty and is
deleted. `remove` and the whole-ledger replay share the helper (replay
no longer leaves an emptied created config behind). All-CRLF configs
are inverted as LF, and a fragment recorded with the other line endings
still matches. Existing ledgers keep reverting as before.

Unit: the bug-H revert test covers no final newline (LF and CRLF),
trailing blank lines (LF and CRLF) and a whitespace-only config through
both `remove` and the replay; helper pins for every append shape. Real
cargo: e2e_redirect_cargo_shapes config-unterminated and
config-trailing-blank restore the config byte-for-byte.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix(redirect): remove cargo patches across line-ending changes

The CRLF support records a CRLF project's edit fragments with CRLF, and
the ledger is JSON, so git line-ending normalization never touches
them while it does rewrite the committed Cargo.toml / Cargo.lock /
.cargo/config. A hosted redirect scanned on Windows (core.autocrlf)
therefore could not be removed on a Linux checkout, nor an LF scan on
a CRLF checkout: `remove`, rollback and the vendored takeover matched
fragments byte-for-byte and refused as "drifted", and the suggested
re-scan was a no-op that kept the same fragments.

The cargo per-purl revert and the whole-ledger replay now match
fragments regardless of CRLF/LF: an all-CRLF file is matched as LF and
written back CRLF, any other file is tried with the recorded fragments
and then with their LF forms. The file keeps its current line endings.
The registry-block checks and removals use the same matching. Drift
of the text itself still refuses exactly as before.

Unit: a ledger recorded CRLF reverts LF files and a ledger recorded LF
reverts CRLF files, each through `remove` and through the replay, with
the ledger round-tripped through JSON (all four refused before).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix(redirect): remove each cargo version from older ledgers

Manifest edits are keyed by crate name, so the per-version revert told
two redirected versions' edits apart by the registry each pin names.
Ledgers an older CLI wrote with its name-only matcher break that rule:
each version's run pinned BOTH declarations to its own registry, and a
project it mis-pinned is later repaired by superseding that pin. On
such a ledger `remove pkg:cargo/cfg-if@1.0.4` claimed half of a
declaration's re-pin chain (or the superseded mis-pin) and refused as
"drifted" — for exactly the users bug B had already hurt — and the
other removal order dropped a still-pinned registry edit, leaving the
created .cargo/config.toml behind.

With another version of the crate still redirected, each manifest edit
is now attributed to the version its declaration's requirement selects
(the planner's own rule); a line without a readable requirement falls
back to the registry it pins. A sibling version's registry is never
claimed, and a still-referenced block keeps its ledger edit when
another recorded wiring edit still pins to it, so the removal that
retires that pin removes the block. A block kept for a hand pin still
leaves the ledger, and the whole-ledger replay now keeps such a block
too instead of deleting it from under the hand pin.

Unit: a name-only two-version ledger and a repaired mis-pin ledger each
remove in both orders back to the pristine project with no config and
an empty ledger (removing 1.0.4 first refused before); the replay keeps
a hand-pinned block.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix(redirect): keep identical hosted edits from one scan

The hosted flow appends a run's edits to the redirect ledger, skipping
any edit already in it. The check also ran against the edits appended
earlier in the same run, so identical edits from one rewrite collapsed
into one. The cargo rewriter records one edit per occurrence, and a
Cargo.toml that declares the crate with the same line in two sections
(`[dependencies]` and `[dev-dependencies]`) yields two identical edits.
With only one in the ledger, `remove` reverted one pin, kept the other
and the registry block it references, and still reported success.

Edits are now deduplicated only against the ledger as the run found it,
so a re-run still records nothing twice.

Real cargo: e2e_redirect_cargo_shapes two-sections (scan, fresh
`--locked` build, VEX, byte-identical `remove`); it failed on the
leftover pin before.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* docs: describe the hosted cargo redirect fixes

CLI_CONTRACT.md still said the hosted rewriter reads only root candidate
files, but cargo now also reads and pins workspace-member and in-root
path-dependency manifests, which can show up in `rewrittenFiles`. The
contract now covers that (members globs minus `exclude`, no symlinks,
never `.socket/`), the new `redirect_cargo_transitive_dependents`
refusal, the transitive-only and multi-version refusals, and CRLF
handling across a checkout conversion.

CHANGELOG [Unreleased] gains Fixed entries for this branch's
user-visible hosted cargo changes, and docs/ecosystems.md notes that
hosted cargo reaches direct dependencies only.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix(redirect): refuse cargo requirements the patch misses

A crate declared only with version requirements the patched version
does not satisfy resolves those declarations to another version, so a
pin cannot reach the locked crate. Hosted cargo now refuses it with
redirect_cargo_toml_dep_unrewritable, the code the Socket backend
uses for the same shape, instead of reporting it not found.

Shared golden fixtures pin both refusals the backend and CLI must
agree on: requirement-excludes-patched-version, path-dependency and
transitive-dependents-git (a git crate also depending on the patched
crate).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix(vendor): see a hosted pin in a workspace member

The hosted rewriter pins the patched crate in every manifest that
declares it, workspace members included, but the guard that refuses to
vendor on top of a live hosted redirect read the root Cargo.toml alone.
A member-only pin was invisible, so with the redirect ledger gone
vendor wired [patch.crates-io] beside a member still resolving the
crate from the hosted registry — where [patch.crates-io] does not
reach — and reported success.

The guard now reads the root manifest and every member manifest the
rewriter itself discovers, and the refusal names the file it found.

Real cargo: mode_migration_cargo's takeover refusal gains the shape
the guard exists for — the lock restored from version control while a
table-form manifest pin survives.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(redirect): repoint a v1 lock's [root] table

A v1 Cargo.lock written before cargo dropped [root] keeps the root
package in that table, whose dependencies spell full package ids. The
reference rewrite walked the [[package]] array only, so a redirected
crate left [root] naming the crates.io id of a package the lock no
longer held: cargo build --locked then fails, an unlocked build
discards the lock and re-resolves, and the scan reported the crate
redirected either way.

The walk now covers that table too, recorded by the same
every-occurrence reference edit, so remove still restores the lock byte
for byte in any order. The vendored backend has read [root] since it
learned v1 locks.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(redirect): spend one cargo edit per occurrence

One scan records one cargo edit per occurrence, so a manifest that
declares the crate with the same line in two sections leaves two
identical edits in the ledger, and the per-purl revert unwinds one
occurrence per edit. The whole-ledger replay — the path a run whose
patch-record fetch failed leaves behind, records empty — instead
refused as soon as the fragment appeared more than once, and that
refusal dropped every other cargo edit with it: the project stayed
fully redirected, with a suggested remedy (re-run the scan) that
cannot change a duplication the manifest itself carries.

The replay now allows as many occurrences as there are identical edits
left to spend on them, and still refuses a surplus no edit accounts
for.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(redirect): never pin a manifest under target/

Member discovery skipped cargo's build directory only while expanding
a glob: a literal `members = ["target/gen"]` entry, or a path
dependency pointing into target/, was returned and pinned — which the
key predicate's own doc comment said could not happen. The next
`cargo clean` deletes that manifest, and a recorded hosted edit whose
file no longer exists refuses the rollback of every other cargo edit.

A `target` segment is now excluded wherever a member path is accepted,
in discovery and in the key predicate both.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(redirect): refuse a lockless cargo pin

A `registry = …` pin reaches only the declarations it sits on, so a
crate another package also pulls in is refused — but that check reads
Cargo.lock, and a project without one was pinned unconditionally. Rust
libraries routinely gitignore their lock, so the silent shape was the
common one: the scan reported the crate redirected, vex attested it,
and the next build resolved the patched copy for the root and an
unpatched crates.io copy for whatever else depends on the crate.

Without a lock the dependents question is now answered from the
manifests instead: a crate declared beside any other dependency — or
beside a workspace member this run could not read (a members glob, or
a member outside the project or behind a symbolic link) — is refused
`redirect_cargo_lockless_dependents`, whose detail names both remedies.
A path dependency on a manifest the same run pins is not company, and
a project whose only dependency is the patched crate has nothing that
could pull it in and still redirects.

Real cargo: e2e_redirect_cargo_shapes lockless-other-dependencies, the
direct-and-transitive project with its lock deleted.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/ci.yml                      |    2 +-
 CHANGELOG.md                                  |   35 +
 crates/socket-patch-cli/CLI_CONTRACT.md       |    2 +-
 .../src/commands/scan/hosted.rs               |   22 +-
 .../tests/cargo_e2e_matrix/mod.rs             |   81 +-
 .../tests/e2e_redirect_cargo_shapes.rs        |  935 ++++++++++
 .../tests/in_process_redirect.rs              |  187 ++
 .../tests/mode_migration_cargo.rs             |   48 +
 .../src/patch/redirect/mod.rs                 | 1627 +++++++++++++++--
 .../src/patch/redirect/replay.rs              |  354 +++-
 .../src/patch/redirect/takeover.rs            | 1079 ++++++++++-
 .../src/utils/cargo_workspace.rs              |  432 +++++
 crates/socket-patch-core/src/utils/mod.rs     |    1 +
 crates/socket-patch-core/src/vendor/cargo.rs  |   74 +-
 .../cargo/cargo/crlf/expected-edits.json      |   25 +
 .../cargo/cargo/crlf/expected-warnings.json   |    1 +
 .../cargo/cargo/crlf/expected/.cargo/config   |    5 +
 .../cargo/cargo/crlf/expected/Cargo.lock      |   16 +
 .../cargo/cargo/crlf/expected/Cargo.toml      |    8 +
 .../cargo/cargo/crlf/input/.cargo/config      |    2 +
 .../cargo/cargo/crlf/input/Cargo.lock         |   16 +
 .../cargo/cargo/crlf/input/Cargo.toml         |    8 +
 .../redirect/cargo/cargo/crlf/overrides.json  |   22 +
 .../lockless-dependents/expected-edits.json   |    1 +
 .../expected-warnings.json                    |    3 +
 .../lockless-dependents/input/Cargo.toml      |    8 +
 .../cargo/lockless-dependents/overrides.json  |   22 +
 .../cargo/multi-version/expected-edits.json   |   48 +
 .../multi-version/expected-warnings.json      |    1 +
 .../multi-version/expected/.cargo/config.toml |    5 +
 .../cargo/multi-version/expected/Cargo.lock   |   23 +
 .../cargo/multi-version/expected/Cargo.toml   |    8 +
 .../cargo/multi-version/input/Cargo.lock      |   23 +
 .../cargo/multi-version/input/Cargo.toml      |    8 +
 .../cargo/cargo/multi-version/overrides.json  |   42 +
 .../cargo/path-dependency/expected-edits.json |    1 +
 .../path-dependency/expected-warnings.json    |    3 +
 .../cargo/path-dependency/input/Cargo.lock    |   14 +
 .../cargo/path-dependency/input/Cargo.toml    |    7 +
 .../cargo/path-dependency/overrides.json      |   22 +
 .../expected-edits.json                       |    1 +
 .../expected-warnings.json                    |    3 +
 .../input/Cargo.lock                          |   16 +
 .../input/Cargo.toml                          |    7 +
 .../overrides.json                            |   22 +
 .../shared-dependency/expected-edits.json     |    1 +
 .../shared-dependency/expected-warnings.json  |    3 +
 .../cargo/shared-dependency/input/Cargo.lock  |   26 +
 .../cargo/shared-dependency/input/Cargo.toml  |    8 +
 .../cargo/shared-dependency/overrides.json    |   22 +
 .../expected-edits.json                       |    1 +
 .../expected-warnings.json                    |    3 +
 .../input/Cargo.lock                          |   25 +
 .../input/Cargo.toml                          |    8 +
 .../transitive-dependents-git/overrides.json  |   22 +
 .../transitive-refusal/expected-edits.json    |    1 +
 .../transitive-refusal/expected-warnings.json |    3 +
 .../cargo/transitive-refusal/input/Cargo.lock |   25 +
 .../cargo/transitive-refusal/input/Cargo.toml |    7 +
 .../cargo/transitive-refusal/overrides.json   |   22 +
 .../workspace-member/expected-edits.json      |   33 +
 .../workspace-member/expected-warnings.json   |    1 +
 .../expected/.cargo/config.toml               |    2 +
 .../workspace-member/expected/Cargo.lock      |   23 +
 .../workspace-member/expected/Cargo.toml      |    5 +
 .../workspace-member/expected/b/Cargo.toml    |    7 +
 .../cargo/workspace-member/input/Cargo.lock   |   23 +
 .../cargo/workspace-member/input/Cargo.toml   |    5 +
 .../cargo/workspace-member/input/a/Cargo.toml |    7 +
 .../cargo/workspace-member/input/b/Cargo.toml |    7 +
 .../cargo/workspace-member/overrides.json     |   22 +
 .../vex-discover-golden/redirect-cargo.json   |  249 +++
 docs/ecosystems.md                            |    2 +-
 73 files changed, 5665 insertions(+), 168 deletions(-)
 create mode 100644 crates/socket-patch-cli/tests/e2e_redirect_cargo_shapes.rs
 create mode 100644 crates/socket-patch-core/src/utils/cargo_workspace.rs
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/crlf/expected-edits.json
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/crlf/expected-warnings.json
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/crlf/expected/.cargo/config
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/crlf/expected/Cargo.lock
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/crlf/expected/Cargo.toml
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/crlf/input/.cargo/config
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/crlf/input/Cargo.lock
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/crlf/input/Cargo.toml
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/crlf/overrides.json
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/lockless-dependents/expected-edits.json
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/lockless-dependents/expected-warnings.json
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/lockless-dependents/input/Cargo.toml
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/lockless-dependents/overrides.json
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/multi-version/expected-edits.json
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/multi-version/expected-warnings.json
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/multi-version/expected/.cargo/config.toml
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/multi-version/expected/Cargo.lock
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/multi-version/expected/Cargo.toml
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/multi-version/input/Cargo.lock
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/multi-version/input/Cargo.toml
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/multi-version/overrides.json
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/path-dependency/expected-edits.json
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/path-dependency/expected-warnings.json
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/path-dependency/input/Cargo.lock
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/path-dependency/input/Cargo.toml
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/path-dependency/overrides.json
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/requirement-excludes-patched-version/expected-edits.json
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/requirement-excludes-patched-version/expected-warnings.json
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/requirement-excludes-patched-version/input/Cargo.lock
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/requirement-excludes-patched-version/input/Cargo.toml
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/requirement-excludes-patched-version/overrides.json
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/shared-dependency/expected-edits.json
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/shared-dependency/expected-warnings.json
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/shared-dependency/input/Cargo.lock
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/shared-dependency/input/Cargo.toml
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/shared-dependency/overrides.json
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-dependents-git/expected-edits.json
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-dependents-git/expected-warnings.json
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-dependents-git/input/Cargo.lock
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-dependents-git/input/Cargo.toml
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-dependents-git/overrides.json
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-refusal/expected-edits.json
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-refusal/expected-warnings.json
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-refusal/input/Cargo.lock
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-refusal/input/Cargo.toml
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-refusal/overrides.json
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/expected-edits.json
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/expected-warnings.json
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/expected/.cargo/config.toml
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/expected/Cargo.lock
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/expected/Cargo.toml
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/expected/b/Cargo.toml
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/input/Cargo.lock
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/input/Cargo.toml
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/input/a/Cargo.toml
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/input/b/Cargo.toml
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/overrides.json

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 26fa1954..fea73c77 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1455,7 +1455,7 @@ jobs:
           SOCKET_PATCH_CARGO_E2E_LOCK_VERSION: ${{ matrix.lock }}
         run: |
           set -euo pipefail
-          cargo test -p socket-patch-cli --test e2e_redirect_cargo_build --test e2e_vendor_cargo_build --test mode_migration_cargo
+          cargo test -p socket-patch-cli --test e2e_redirect_cargo_build --test e2e_redirect_cargo_shapes --test e2e_vendor_cargo_build --test mode_migration_cargo
           cargo test -p socket-patch-cli --test e2e_safety_cargo_build -- --ignored
 
   # Manifest `[patch]` + the tagged detached lock (the v5 vendored cargo
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9c1f2d5a..21874c7e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -967,6 +967,41 @@ into the new version's section — see docs/releasing.md.
   vendored rewrites now follow the `[metadata]` checksum table and rewrite
   dependents' full-id references, so `cargo --locked` accepts the lock (and
   the revert stays byte-identical).
+- **Hosted cargo pins every declaration of the patched version.** Each
+  version of a multi-version crate is pinned only in the declarations whose
+  requirement selects it (a requirement matching several locked versions is
+  refused `redirect_cargo_toml_dep_unrewritable`), and workspace-member and
+  in-root path-dependency manifests are pinned beside the root, so
+  `cargo --locked` accepts the redirected lock. Member discovery never
+  follows a symbolic link, so nothing outside the project is rewritten.
+- **Hosted cargo refuses crates a pin cannot reach.** A crate another
+  `Cargo.lock` package also depends on (a crates.io or git crate, or a path
+  package outside the project) now warns
+  `redirect_cargo_transitive_dependents` and is skipped instead of being
+  reported redirected while that package compiled the unpatched copy; a
+  transitive-only crate's `redirect_cargo_toml_dep_not_found` detail now
+  says so and points to `--mode vendored`. A crate declared only with
+  requirements the patched version does not satisfy (cargo resolves those
+  declarations to another version) is refused
+  `redirect_cargo_toml_dep_unrewritable`, the Socket backend's code for the
+  same shape, instead of `redirect_cargo_toml_dep_not_found`. A project with
+  NO `Cargo.lock` has no resolved graph to ask, so a crate declared beside
+  any other dependency — anything but a path dependency on a manifest the
+  same run pins — or beside a workspace member this run did not read (a
+  glob, a member outside the project or behind a symbolic link) is refused
+  `redirect_cargo_lockless_dependents` (commit a lockfile, or use `--mode
+  vendored`); a project whose only dependency is the patched crate has
+  nothing that could pull it in and still redirects.
+- **CRLF cargo projects redirect in hosted mode.** All-CRLF `Cargo.toml`,
+  `Cargo.lock` and cargo configs are rewritten with their endings kept
+  (they were refused), and `remove` / rollback still find the recorded
+  edits after a checkout converts the line endings.
+- **Hosted cargo `remove` restores every byte, in any order.** An appended
+  registry block leaves the user's config exactly as it was (trailing blank
+  lines or a missing final newline included) and a created config is
+  deleted with the last block; v1-lock and multi-version patches, ledgers
+  written by older CLIs included, can be removed in any order; and a crate
+  declared with the same line in two sections gets both pins reverted.
 - **yarn 4.0.x checksums keep the lock's own spelling.** Vendored and hosted
   berry rewrites write bare-hex `cacheKey: 10c0` checksums when the lock
   does, so `yarn install --immutable` no longer fails with YN0028.
diff --git a/crates/socket-patch-cli/CLI_CONTRACT.md b/crates/socket-patch-cli/CLI_CONTRACT.md
index 4c4595fc..f6991b70 100644
--- a/crates/socket-patch-cli/CLI_CONTRACT.md
+++ b/crates/socket-patch-cli/CLI_CONTRACT.md
@@ -125,7 +125,7 @@ For a **9.0 root lock**, the CLI ensures `pnpm-workspace.yaml` carries `trustLoc
 
 `scan --mode hosted` (== `--redirect`) swaps the in-place apply for the registry-redirect pipeline: discover → resolve hosted-patch references (grant token + integrity + per-dep registry override) → rewrite ONLY the patched dependencies' lockfile / registry-config entries to point at the hosted packages. A dep counts as **redirected** only when its hosted-artifact URL (or per-dep registry index URL) actually landed in a project file — a granted reference whose rewriter found nothing to edit is neither recorded nor attested. Cargo and golang are confirmed only by their rewriter's own report (`confirmed_cargo_uuids` / `confirmed_golang_uuids`): a golang dep counts only when its go.mod `replace M V => patch.socket.dev/gopatch/<uuid> <sver>` and both go.sum lines are in place, never because the patch-server origin or leftover go.sum lines appear somewhere. A golang module that go.mod does not require and go.sum does not list at the patched version is outside the build graph and is refused with `redirect_golang_not_in_module_graph` (nothing written). Only the exact module `patch.socket.dev/gopatch/<canonical uuid>` is socket-owned; any other module path is refused with `redirect_golang_untrusted_module_path`. A vendored golang module is taken over like cargo and the npm family: its vendor wiring, committed copy and ledger entry are reverted first (`redirect_takeover_reverted_vendored`). Re-runs over already-rewritten output record zero new edits. **Lock (v5.0)**: the hosted engine acquires `<.socket>/apply.lock` around its first wet write (the takeover pre-reverts) — not on `--dry-run`, and not when the run would write nothing (zero redirects, all skipped) — so previews and no-op runs never create `.socket/` (and never quarantine: a `--dry-run` or a zero-grant wet run that finds a malformed `redirect-state.json` reports it as the hard error it is — exit 1, the repair-or-move-aside remedy — but moves nothing; only a run holding the lock moves it aside to `redirect-state.json.corrupt`); contention is `lock_held` and a lock-file I/O fault (a read-only project root, a file squatting on `.socket/`) is `lock_io` — both exit 1, refused BEFORE the redirect ledger is read or written, and rendered like every other lock holder: human `Error (<code>): <message>` on stderr (+ the `--lock-timeout` hint for a live holder); JSON keeps the hosted shape — top-level `status: "error"`, `errorCode: "lock_held" | "lock_io"`, a string `error`, and `redirect: {mode: "hosted"}` retained (NOT the vendored `error: {code, message}` object). **Takeover symlink pre-check (v5.0)**: a vendored→hosted takeover whose recorded wiring file is a symlink is refused up front with `redirect_symlinked_file_unsupported` — wet and `--dry-run` alike, before any revert — so "nothing was written" holds. **Human mode (v5.0)**: `scan --mode hosted` prints the results table and update detection like the other modes and confirms once — `Redirect N packages to the hosted patch server?` (singular for one), default yes, skipped by `--yes`/`--json`, on `--dry-run` (the engine honors the preview itself; nothing mutates), and when the detail fetch leaves nothing to redirect (that run enters the engine as a no-op — `Redirected 0 packages; rewrote 0 files.`, no lock, no `.socket/` — without prompting); without `--yes` on a non-TTY stdin the shared prompt prints `Non-interactive mode detected, proceeding automatically.` to stderr (unless `--silent`) and proceeds — before rewriting anything (parity with the agent/vendored arms and with `get --mode hosted`). The detail fetch prints the same progress counter and per-package `Warning: could not fetch details for …` lines as the agent arm. An EMPTY hosted discovery prints `No patches available for installed packages.` and exits 0 without entering the engine (previously `Redirected 0 packages; rewrote 0 files.`); a discovery whose every offer is paid-tier for an org without paid access prints the table's paid nudge, then `No downloadable patches (paid subscription required).`, and exits 0 without entering the engine (parity with the agent/vendored arms). A malformed redirect ledger on a human hosted run that returns before the engine (empty discovery, nothing downloadable, a detail-fetch failure, a declined confirm) is surfaced there as the read-only `Warning: the redirect ledger … is malformed …` advisory (muted by `--silent`), never moved; the `--json` arm always enters the engine and hard-errors instead. JSON output gains a `redirect` sub-object: `{ mode: "hosted", redirected, rewrittenFiles, skipped, warnings, dryRun }` (`mode` is additive so consumers can dispatch without inferring it). Rewriter warnings carry stable `redirect_*` codes (e.g. `redirect_npm_no_lockfile`, `redirect_gradle_manual_snippet`, `redirect_golang_unsupported`); new codes are additive (MINOR). v5.0 additive codes: `redirect_composer_no_lockfile` / `redirect_gem_no_gemfile` (composer / gem: neither manifest nor lock present — once per run, after the intake gates), `redirect_maven_no_pom` (no `pom.xml` and no Gradle build), `redirect_nuget_lock_unparseable` (a present-but-corrupt `packages.lock.json` — warned once, nothing mutated; an absent lock still proceeds), `redirect_cargo_lock_pkg_ambiguous` (several same-name+version `[[package]]` blocks and none carries the index `source` — transactional skip). Also v5.0: a registry override of the wrong kind (or none at all) warns the arm's missing-override code for nuget/gem/golang where it used to skip silently, and the ledger's `redirect_nuget_source` edit records `action: "added"` when `nuget.config` was authored from scratch (`rewritten` otherwise). Refusals stay fail-closed with a diagnosis that names the actual cause: a yarn-berry lock entry resolving through a non-`npm:` protocol keeps `redirect_yarn_berry_unsupported_protocol` with the entry's ACTUAL protocol in the detail — except socket-patch's OWN vendored wiring (a `file:` range into `.socket/vendor/`), which gets the distinct `redirect_yarn_berry_vendored_entry` code whose detail names the retirement path (`remove <purl>` per package, or `vendor --revert` which unwinds every vendored package, then re-run `scan --mode hosted`). Both leave the entry byte-identical; neither changes exit code or status. **yarn berry line endings (v5.0)**: yarn writes a NEW `yarn.lock` with the OS line ending (`os.EOL` — CRLF on Windows) and keeps an existing lock's majority ending on every later write, and a `core.autocrlf` checkout turns an LF lock CRLF on any OS — so a uniformly CRLF lock is rewritten in its own ending: every untouched byte (a leading BOM included) round-trips, and the `redirect_yarn_berry_entry` ledger edits record the lock's ON-DISK (CRLF) fragments, which the reverts match byte-exactly. A lock that MIXES CRLF and LF (or holds a bare CR) has no single ending to keep — yarn's own `--immutable` check rejects it too (YN0028) — so it is refused untouched with `redirect_yarn_berry_mixed_line_endings` (the detail names `yarn install`, which normalizes it). This replaces v4's `redirect_yarn_berry_crlf_unsupported`, which refused every CRLF lock and is no longer emitted. A vendored→hosted takeover runs these berry gates (mixed line endings, unsupported `cacheKey`, a non-zero `.yarnrc.yml` `compressionLevel`) BEFORE reverting a vendored berry purl — wet and `--dry-run` alike — so a refused purl keeps its vendored wiring, ledger entry and artifact byte-identical and is skipped with the gate's code (never announced as `redirect_takeover_reverted_vendored` and then left unpatched in both modes).
 
-The rewriter reads a fixed set of candidate files from the project root: the npm-family locks (`package-lock.json`, `npm-shrinkwrap.json`, `pnpm-lock.yaml`, `shrinkwrap.yaml`, `yarn.lock`, plus `.yarnrc.yml` for the berry cache-config gate and `bun.lock` / `bun.lockb`), `requirements.txt` / `uv.lock` / `Pipfile.lock` (pipfile-spec 6; see the Pipenv section below) / `poetry.lock` (every Poetry lock generation from 1.0 on — the 0.12 `[metadata.hashes]` layout is refused because that installer ignores URL sources; a Poetry < 1.4 writer additionally gets `redirect_poetry_stale_install_risk`, see `docs/testing/poetry-compatibility.md`) / `pdm.lock` (PDM lock formats `2` and `4.3`–`4.5.1`; the identity-losing `3.1` / `4.0`–`4.2` formats and unknown future formats are refused with `redirect_pdm_refused`, and a lock-format-`2` writer additionally gets `redirect_pdm_legacy_sync_required`, see `docs/testing/pdm-compatibility.md`; when `uv.lock` or `poetry.lock` sits beside it they drive and `pdm.lock` is left alone), `Cargo.toml` / `Cargo.lock` / `.cargo/config.toml` (plus the legacy extensionless `.cargo/config` — cargo reads that spelling in preference when both exist, so the managed `[registries.…]` block is written into whichever one is present), `composer.lock`, `nuget.config` / `packages.lock.json`, `Gemfile` / `Gemfile.lock`, `pom.xml` (+ `.mvn/maven.config` / `.mvn/checksums/checksums.sha256` for maven Trusted Checksums merge, and the Gradle build scripts read only to trigger the manual-snippet warning). **npm-family flavor coverage**: package-lock / npm-shrinkwrap, pnpm (root OR any nested `*/pnpm-lock.yaml`), yarn classic, **yarn berry** (`yarn.lock` entry only — `resolution: ::__archiveUrl=` + `yarnBerry10c0` checksum; cacheKey `10c0` and `.yarnrc.yml compressionLevel 0` gated by `redirect_yarn_berry_cache_unsupported`), and **bun** (text `bun.lock` lockfileVersion 0, 1 or 2 — 0 is the `--save-text-lockfile` opt-in lock of Bun 1.1.39–1.1.45, 1 the 1.2–1.3 default, 2 the 1.4+ default; all three emit one `packages` grammar, so the registry 4-tuple → URL 3-tuple rewrite is version-independent and the lock's own version line is kept. Any other or missing version, or a `packages` section outside bun's single-line grammar, is refused `redirect_bun_lock_unsupported` — the detail is the shared version gate's text (a newer version: update socket-patch, re-locking would reproduce it; no integer: re-lock with Bun ≥ 1.2), identical to the vendored refusal. A version-0 lock holding `workspace:` packages is refused `redirect_bun_workspace_unsupported` (its 2-tuple workspace grammar cannot keep the hosted tuple through a frozen install); the remedy is to delete `bun.lock` and re-run `bun install` with Bun ≥ 1.2, which writes lockfileVersion 1 (accepted). A plain in-place `bun install` bumps the version only when a workspace depends on another workspace (e.g. root → member — the shape the matrix measured); otherwise Bun 1.2.0 keeps version 0 and Bun 1.2.23+ fail to resolve, so the in-place bump is not the documented remedy. Bun lock version, grammar and workspace compatibility are checked before a vendored takeover, including during dry-run: these refusals preserve the existing lock, artifact and vendor ledger. Version-1 and version-2 workspace locks are rewritten, nested versions included. A granted dep with no rewritable entry warns `redirect_bun_entry_not_found`, a grant without a sha512 `redirect_bun_missing_sha512`; a CRLF lock keeps `\r\n` on the rewritten line, and a hosted URL left by an earlier grant of the same `name@version` is re-pinned in place. **Digest-less re-saves (Bun 1.1.39–1.3.9)**: every text-lock Bun below 1.3.10 re-saves a URL tuple WITHOUT its `sha512` whenever the lock is re-saved for another reason (`bun add`, `bun install` after a package.json or workspace change), leaving the 2-tuple `["name@<url>", {meta}]` — the spec Bun installs from is intact. The CLI treats that spelling as its own wiring: a repeat hosted run counts the dep as redirected (no `redirect_bun_entry_not_found`) and HEALS the line back to the 3-tuple with the current `sha512`, recording the heal as a further `redirect_bun_lock_package` edit whose `original` is the 2-tuple (a stale URL is re-pinned from either spelling); `rollback`, scoped `rollback <purl>` / `remove <purl>` and the vendored takeover accept the digest-less spelling of a recorded `new` line (same key, spec and meta, only the trailing `"sha512-…"` missing) and restore the recorded original over it, so the chain always unwinds to the pristine registry line. Anything else — another uuid/token, another version, a re-laid meta object — is still drift. **Native `bun.lockb`**: when no text `bun.lock` exists, binary format versions 1, 2 and 3 are read and rewritten directly. Socket Patch does not invoke Bun or convert the project to a text lockfile. Exact matching package records are rewritten to hosted tarballs with the granted integrity, preserving dependency resolution IDs, workspace/dependency topology and unrelated package metadata; binary pointers and the package metadata hash are updated. Per-package `redirect_bun_lockb_package` snapshots support scoped rollback, repeat runs, superseding grants and hosted ↔ vendored takeover. A regular binary lock is discoverable even with no Bun runtime or `node_modules`; a dry run previews the same binary edits without writing them. A malformed, unreadable, unsupported or unverified binary structure is `redirect_bun_lockb_invalid` (exit 0, `redirected: 0`), and it refuses the npm rewrite before any takeover or sibling npm-family lock mutation. A symlinked binary write target is `redirect_symlinked_file_unsupported` (exit 1, including dry-run). `bun.lock` wins when both spellings exist. Binary-only projects do not receive `redirect_npm_no_lockfile`. Measured boundaries and the real-Bun matrix: `docs/testing/bun-compatibility.md`). **Rush monorepos**: when `rush.json` is present the rewriter also reads `common/config/rush/pnpm-lock.yaml` and each `common/config/subspaces/<name>/pnpm-lock.yaml` (sorted for determinism) under their repo-relative keys and repoints them in place; editing them emits `redirect_rush_repo_state_stale` when `common/config/rush/repo-state.json` exists (the `pnpmShrinkwrapHash` desync is refreshed by `rush update`, which the redirect survives). **maven** is fail-closed via version suffixing: a `mavenSuffixedVersion` + `mavenPomSha256` override pins the Socket-only `<version>-socket.<hex8>` by rewriting the literal `<version>` (`redirect_maven_dep_version`) or adding a `<dependencyManagement>` entry (`redirect_maven_dep_management_added`), plus optional Trusted Checksums (`redirect_maven_trusted_checksums`, conflicts as `redirect_maven_trusted_checksums_conflict`); a `${property}` version is refused (`redirect_maven_dep_unpinned`), a non-matching literal skipped (`redirect_maven_dep_version_mismatch`), and an override without a suffixed version falls back to same-GAV repository injection (`redirect_maven_same_gav_fallback`, NOT fail-closed).
+The rewriter reads a fixed set of candidate files from the project root: the npm-family locks (`package-lock.json`, `npm-shrinkwrap.json`, `pnpm-lock.yaml`, `shrinkwrap.yaml`, `yarn.lock`, plus `.yarnrc.yml` for the berry cache-config gate and `bun.lock` / `bun.lockb`), `requirements.txt` / `uv.lock` / `Pipfile.lock` (pipfile-spec 6; see the Pipenv section below) / `poetry.lock` (every Poetry lock generation from 1.0 on — the 0.12 `[metadata.hashes]` layout is refused because that installer ignores URL sources; a Poetry < 1.4 writer additionally gets `redirect_poetry_stale_install_risk`, see `docs/testing/poetry-compatibility.md`) / `pdm.lock` (PDM lock formats `2` and `4.3`–`4.5.1`; the identity-losing `3.1` / `4.0`–`4.2` formats and unknown future formats are refused with `redirect_pdm_refused`, and a lock-format-`2` writer additionally gets `redirect_pdm_legacy_sync_required`, see `docs/testing/pdm-compatibility.md`; when `uv.lock` or `poetry.lock` sits beside it they drive and `pdm.lock` is left alone), `Cargo.toml` / `Cargo.lock` / `.cargo/config.toml` (plus the legacy extensionless `.cargo/config` — cargo reads that spelling in preference when both exist, so the managed `[registries.…]` block is written into whichever one is present; **cargo also reads every workspace-member manifest** — the `[workspace] members` globs minus `exclude` — and every in-root path-dependency manifest, recursively, reached without crossing a symbolic link and never under `.socket/`, and pins the crate in each one that declares it, so those `<dir>/Cargo.toml` files can appear in `rewrittenFiles`. A crate is redirected only when every declaration pins and every other `Cargo.lock` package depending on it is a planned member: one a registry or git crate — or a path package outside the root or behind a link — also depends on is refused `redirect_cargo_transitive_dependents` (a pin reaches only the declarations it sits on), a crate no manifest declares keeps `redirect_cargo_toml_dep_not_found` with a transitive-only detail naming `--mode vendored`, a crate every declaration of which requires another version (no requirement accepts the patched version) is refused `redirect_cargo_toml_dep_unrewritable`, and so is a requirement that also matches another locked version of the crate — each a transactional skip, never recorded or attested. With NO `Cargo.lock` there is no resolved graph to ask, so the dependents question is answered from the manifests instead: a crate declared beside any other dependency — anything but a path dependency on a manifest this run also pins, or a `workspace = true` inheritor of a table it scans — or beside a workspace member this run did not read (a `members` glob, or a member outside the project or behind a symbolic link, which member discovery drops) is refused `redirect_cargo_lockless_dependents`, whose detail names the remedies (commit a lockfile, or `--mode vendored`); a project whose only dependency is the patched crate has nothing that could pull it in and still redirects. All-CRLF manifests, locks and configs are rewritten with CRLF kept (mixed endings keep refusing where the grammar does not match), and `remove` / rollback match the recorded fragments across a later CRLF↔LF checkout conversion), `composer.lock`, `nuget.config` / `packages.lock.json`, `Gemfile` / `Gemfile.lock`, `pom.xml` (+ `.mvn/maven.config` / `.mvn/checksums/checksums.sha256` for maven Trusted Checksums merge, and the Gradle build scripts read only to trigger the manual-snippet warning). **npm-family flavor coverage**: package-lock / npm-shrinkwrap, pnpm (root OR any nested `*/pnpm-lock.yaml`), yarn classic, **yarn berry** (`yarn.lock` entry only — `resolution: ::__archiveUrl=` + `yarnBerry10c0` checksum; cacheKey `10c0` and `.yarnrc.yml compressionLevel 0` gated by `redirect_yarn_berry_cache_unsupported`), and **bun** (text `bun.lock` lockfileVersion 0, 1 or 2 — 0 is the `--save-text-lockfile` opt-in lock of Bun 1.1.39–1.1.45, 1 the 1.2–1.3 default, 2 the 1.4+ default; all three emit one `packages` grammar, so the registry 4-tuple → URL 3-tuple rewrite is version-independent and the lock's own version line is kept. Any other or missing version, or a `packages` section outside bun's single-line grammar, is refused `redirect_bun_lock_unsupported` — the detail is the shared version gate's text (a newer version: update socket-patch, re-locking would reproduce it; no integer: re-lock with Bun ≥ 1.2), identical to the vendored refusal. A version-0 lock holding `workspace:` packages is refused `redirect_bun_workspace_unsupported` (its 2-tuple workspace grammar cannot keep the hosted tuple through a frozen install); the remedy is to delete `bun.lock` and re-run `bun install` with Bun ≥ 1.2, which writes lockfileVersion 1 (accepted). A plain in-place `bun install` bumps the version only when a workspace depends on another workspace (e.g. root → member — the shape the matrix measured); otherwise Bun 1.2.0 keeps version 0 and Bun 1.2.23+ fail to resolve, so the in-place bump is not the documented remedy. Bun lock version, grammar and workspace compatibility are checked before a vendored takeover, including during dry-run: these refusals preserve the existing lock, artifact and vendor ledger. Version-1 and version-2 workspace locks are rewritten, nested versions included. A granted dep with no rewritable entry warns `redirect_bun_entry_not_found`, a grant without a sha512 `redirect_bun_missing_sha512`; a CRLF lock keeps `\r\n` on the rewritten line, and a hosted URL left by an earlier grant of the same `name@version` is re-pinned in place. **Digest-less re-saves (Bun 1.1.39–1.3.9)**: every text-lock Bun below 1.3.10 re-saves a URL tuple WITHOUT its `sha512` whenever the lock is re-saved for another reason (`bun add`, `bun install` after a package.json or workspace change), leaving the 2-tuple `["name@<url>", {meta}]` — the spec Bun installs from is intact. The CLI treats that spelling as its own wiring: a repeat hosted run counts the dep as redirected (no `redirect_bun_entry_not_found`) and HEALS the line back to the 3-tuple with the current `sha512`, recording the heal as a further `redirect_bun_lock_package` edit whose `original` is the 2-tuple (a stale URL is re-pinned from either spelling); `rollback`, scoped `rollback <purl>` / `remove <purl>` and the vendored takeover accept the digest-less spelling of a recorded `new` line (same key, spec and meta, only the trailing `"sha512-…"` missing) and restore the recorded original over it, so the chain always unwinds to the pristine registry line. Anything else — another uuid/token, another version, a re-laid meta object — is still drift. **Native `bun.lockb`**: when no text `bun.lock` exists, binary format versions 1, 2 and 3 are read and rewritten directly. Socket Patch does not invoke Bun or convert the project to a text lockfile. Exact matching package records are rewritten to hosted tarballs with the granted integrity, preserving dependency resolution IDs, workspace/dependency topology and unrelated package metadata; binary pointers and the package metadata hash are updated. Per-package `redirect_bun_lockb_package` snapshots support scoped rollback, repeat runs, superseding grants and hosted ↔ vendored takeover. A regular binary lock is discoverable even with no Bun runtime or `node_modules`; a dry run previews the same binary edits without writing them. A malformed, unreadable, unsupported or unverified binary structure is `redirect_bun_lockb_invalid` (exit 0, `redirected: 0`), and it refuses the npm rewrite before any takeover or sibling npm-family lock mutation. A symlinked binary write target is `redirect_symlinked_file_unsupported` (exit 1, including dry-run). `bun.lock` wins when both spellings exist. Binary-only projects do not receive `redirect_npm_no_lockfile`. Measured boundaries and the real-Bun matrix: `docs/testing/bun-compatibility.md`). **Rush monorepos**: when `rush.json` is present the rewriter also reads `common/config/rush/pnpm-lock.yaml` and each `common/config/subspaces/<name>/pnpm-lock.yaml` (sorted for determinism) under their repo-relative keys and repoints them in place; editing them emits `redirect_rush_repo_state_stale` when `common/config/rush/repo-state.json` exists (the `pnpmShrinkwrapHash` desync is refreshed by `rush update`, which the redirect survives). **maven** is fail-closed via version suffixing: a `mavenSuffixedVersion` + `mavenPomSha256` override pins the Socket-only `<version>-socket.<hex8>` by rewriting the literal `<version>` (`redirect_maven_dep_version`) or adding a `<dependencyManagement>` entry (`redirect_maven_dep_management_added`), plus optional Trusted Checksums (`redirect_maven_trusted_checksums`, conflicts as `redirect_maven_trusted_checksums_conflict`); a `${property}` version is refused (`redirect_maven_dep_unpinned`), a non-matching literal skipped (`redirect_maven_dep_version_mismatch`), and an override without a suffixed version falls back to same-GAV repository injection (`redirect_maven_same_gav_fallback`, NOT fail-closed).
 
 **Gem stale-install guard (additive warning — the canonical narrative; other mentions point here)**: the gem hosted rewrite is pure Gemfile/lock text, so a gem ALREADY materialized under the project's bundle paths keeps its upstream bytes — the next `bundle install` prints `Using <gem>` and never refetches, on **every** bundler major (live-verified 2026-08-19 on 1.17.3 / 2.7.2 / 4.0.18: bundler 4's CHECKSUMS verify at download time only, and nothing is downloaded; `bundle install --force`/`--redownload` re-install from the stale cached `.gem` instead of re-fetching — bundler 1 silently, bundler 4 with an exit-37 checksum refusal that still leaves the upstream bytes installed; the **verified** remedy is removing the installed dir + cache `.gem` + `specifications` entry, then `bundle install`). After the rewrite, a hosted run therefore probes the installed-gem discovery paths (the same ruby-crawler discovery `apply` uses, honoring `--global`/`--global-prefix` like scan's own discovery) for each confirmed gem redirect and judges the materialization against the patch record's `afterHash` file map. Judgment rules: records are found **by uuid** — this run's fetched records first, then the redirect ledger's persisted ones, so a transiently failed `/patches/view` fetch cannot retire the warning (it re-fires on every re-scan until the stale materialization is gone); a materialization with every file at `afterHash` is already patched and never warns (an agent→hosted migration stays quiet by construction), and when several confirmed variant purls resolve to one installed dir, ANY of them judging it patched keeps it quiet; staleness needs **positive evidence** — at least one record file whose bytes were actually read and hash to neither state's expectation — so missing or unreadable files never produce a warning. Warnings emit `redirect_gem_stale_install` (JSON `redirect.warnings[]` + a code-tagged stderr line) in three flavors: a PROJECT-LOCAL dir gets the verified delete-list remedy (installed dir, cache `.gem`, `specifications` entry — plus the project's committed `vendor/cache/<leaf>.gem` when present and not proven to be the patched artifact, since bundler installs from `vendor/cache` in preference to fetching); a SHARED gem-env home gets a caveat that the home is shared machine-wide and prefers migrating the project to a local bundle path over deleting shared files; and a committed `vendor/cache` archive whose sha256 differs from the patched artifact's warns standalone even with no installed dir at all (a fresh checkout with a committed stale cache re-materializes the upstream bytes forever). A stale-flagged purl is additionally **excluded from the same run's `--vex` `assume_applied` set** — the envelope must never attest a CVE its own warning says is live; the purl falls back to normal installed-tree verification (a patched install still attests, a stale one is omitted). The probe is read-only (nothing is deleted) and skipped on `--dry-run` — deliberately explicit, since nothing was rewritten but the ledger fallback could otherwise judge an already-redirected project. Exit code and `status` are unchanged (warning-only, the hosted-refusal posture); a same-run `--vex` may still fail on "nothing to attest" per the embedded-VEX contract.
 
diff --git a/crates/socket-patch-cli/src/commands/scan/hosted.rs b/crates/socket-patch-cli/src/commands/scan/hosted.rs
index d0e3a1df..2c218c53 100644
--- a/crates/socket-patch-cli/src/commands/scan/hosted.rs
+++ b/crates/socket-patch-cli/src/commands/scan/hosted.rs
@@ -1709,6 +1709,19 @@ pub(crate) async fn run_redirect_selected(
             }
         }
 
+        // Cargo workspace members (and in-root path dependencies) declare
+        // dependencies of their own: a member's direct `cfg-if = "1"` must
+        // be pinned alongside the root's, or the redirected lock entry is
+        // unsatisfiable. Keyed `<dir>/Cargo.toml` for the cargo rewriter.
+        if files.contains_key("Cargo.toml") && candidates.iter().any(|c| c.dep.ecosystem == "cargo")
+        {
+            for rel in socket_patch_core::utils::cargo_workspace::member_manifests(&common.cwd) {
+                if let Ok(content) = read_regular_to_string(&common.cwd.join(&rel)).await {
+                    files.insert(rel, content);
+                }
+            }
+        }
+
         if let Ok(paths) = socket_patch_core::utils::python_lock::python_lock_paths(&common.cwd) {
             for path in paths {
                 if let Some(script_path) =
@@ -2579,6 +2592,13 @@ pub(crate) async fn run_redirect_selected(
                     }
                 }
             }
+            // Dedup against the ledger as this run found it, never within
+            // this run: one run legitimately records identical edits (a
+            // Cargo.toml declaring the crate with the same line in two
+            // sections), and each one reverts one occurrence — collapsing
+            // them made `remove` leave the second pin (and its registry
+            // block) in place while reporting success.
+            let recorded = ledger.edits.len();
             for edit in &rewrite.edits {
                 let is_rebased = REBASE_KINDS.contains(&edit.kind.as_str())
                     && rebased.iter().any(|&t| {
@@ -2588,7 +2608,7 @@ pub(crate) async fn run_redirect_selected(
                             && old.key == edit.key
                             && old.new == edit.new
                     });
-                if !is_rebased && !ledger.edits.contains(edit) {
+                if !is_rebased && !ledger.edits[..recorded].contains(edit) {
                     ledger.edits.push(edit.clone());
                 }
             }
diff --git a/crates/socket-patch-cli/tests/cargo_e2e_matrix/mod.rs b/crates/socket-patch-cli/tests/cargo_e2e_matrix/mod.rs
index 863f33ef..f58f8fcf 100644
--- a/crates/socket-patch-cli/tests/cargo_e2e_matrix/mod.rs
+++ b/crates/socket-patch-cli/tests/cargo_e2e_matrix/mod.rs
@@ -1,6 +1,7 @@
 //! Toolchain / Cargo.lock-format knobs shared by the real-cargo e2e suites
-//! (`e2e_redirect_cargo_build`, `e2e_vendor_cargo_build`,
-//! `mode_migration_cargo`, `e2e_safety_cargo_build`), so one local loop (or
+//! (`e2e_redirect_cargo_build`, `e2e_redirect_cargo_shapes`,
+//! `e2e_vendor_cargo_build`, `mode_migration_cargo`,
+//! `e2e_safety_cargo_build`), so one local loop (or
 //! one CI matrix leg per cell) drives every hosted + vendored flow through a
 //! given cargo release and lock format:
 //!
@@ -28,6 +29,7 @@
 //!   SOCKET_PATCH_CARGO_E2E_REQUIRED=1 SOCKET_PATCH_CARGO_E2E_TOOLCHAIN=$tc \
 //!   SOCKET_PATCH_CARGO_E2E_LOCK_VERSION=$lv \
 //!   cargo test -p socket-patch-cli --test e2e_redirect_cargo_build \
+//!     --test e2e_redirect_cargo_shapes \
 //!     --test e2e_vendor_cargo_build --test mode_migration_cargo
 //! done; done
 //! ```
@@ -145,10 +147,21 @@ pub struct LockPackage {
     pub version: String,
     pub source: Option<String>,
     pub checksum: Option<String>,
-    /// Dependency NAMES (the fixtures never lock two versions of a crate).
+    /// Dependency package ids (`name version`, plus ` (source)` for a
+    /// sourced package), resolved from whichever short form the lock used —
+    /// so two locked versions of one crate stay distinct across formats.
     pub dependencies: Vec<String>,
 }
 
+impl LockPackage {
+    fn id(&self) -> String {
+        match &self.source {
+            Some(src) => format!("{} {} ({src})", self.name, self.version),
+            None => format!("{} {}", self.name, self.version),
+        }
+    }
+}
+
 /// The lock format of `text`: `version = N` (3 / 4), else v1 when it has
 /// a `[metadata]` table or `"name version (source)"` references, else v2.
 pub fn lock_format(text: &str) -> u8 {
@@ -208,8 +221,7 @@ pub fn parse_lock(text: &str) -> Vec<LockPackage> {
                     if t == "]" {
                         in_deps = false;
                     } else if let Some(dep) = quoted(t.trim_end_matches(',')) {
-                        let name = dep.split(' ').next().unwrap_or_default().to_string();
-                        pkg.dependencies.push(name);
+                        pkg.dependencies.push(dep);
                     }
                     continue;
                 }
@@ -235,6 +247,38 @@ pub fn parse_lock(text: &str) -> Vec<LockPackage> {
             _ => {}
         }
     }
+    // A dependency is written as `name`, `name version` or the full
+    // `name version (source)`, whichever is unambiguous in its lock.
+    let ids: Vec<(String, String, Option<String>, String)> = pkgs
+        .iter()
+        .map(|p| (p.name.clone(), p.version.clone(), p.source.clone(), p.id()))
+        .collect();
+    for pkg in &mut pkgs {
+        for dep in &mut pkg.dependencies {
+            let (head, source) = match dep.split_once(" (") {
+                Some((head, rest)) => (head, rest.strip_suffix(')').map(str::to_string)),
+                None => (dep.as_str(), None),
+            };
+            let mut parts = head.split(' ');
+            let name = parts.next().unwrap_or_default();
+            let version = parts.next();
+            let matches: Vec<&String> = ids
+                .iter()
+                .filter(|(n, v, s, _)| {
+                    n == name
+                        && version.is_none_or(|want| want == v)
+                        && (source.is_none() || *s == source)
+                })
+                .map(|(_, _, _, id)| id)
+                .collect();
+            assert_eq!(
+                matches.len(),
+                1,
+                "lock dependency {dep:?} must name exactly one locked package"
+            );
+            *dep = matches[0].clone();
+        }
+    }
     for pkg in &mut pkgs {
         if pkg.checksum.is_none() {
             if let Some(src) = &pkg.source {
@@ -265,17 +309,26 @@ pub fn write_lock(pkgs: &[LockPackage], version: u8) -> String {
     if version >= 3 {
         out.push_str(&format!("version = {version}\n\n"));
     }
-    let dep_ref = |name: &str| -> String {
-        if version >= 2 {
-            return name.to_string();
-        }
+    // v1 always writes the full id; v2+ the shortest unambiguous form.
+    let dep_ref = |id: &str| -> String {
         let dep = sorted
             .iter()
-            .find(|p| p.name == name)
-            .unwrap_or_else(|| panic!("lock dependency {name} is not a locked package"));
-        match &dep.source {
-            Some(src) => format!("{} {} ({src})", dep.name, dep.version),
-            None => format!("{} {}", dep.name, dep.version),
+            .find(|p| p.id() == id)
+            .unwrap_or_else(|| panic!("lock dependency {id} is not a locked package"));
+        if version == 1 {
+            return dep.id();
+        }
+        let same_name = sorted.iter().filter(|p| p.name == dep.name).count();
+        let same_version = sorted
+            .iter()
+            .filter(|p| p.name == dep.name && p.version == dep.version)
+            .count();
+        if same_name == 1 {
+            dep.name.clone()
+        } else if same_version == 1 {
+            format!("{} {}", dep.name, dep.version)
+        } else {
+            dep.id()
         }
     };
     let blocks: Vec<String> = sorted
diff --git a/crates/socket-patch-cli/tests/e2e_redirect_cargo_shapes.rs b/crates/socket-patch-cli/tests/e2e_redirect_cargo_shapes.rs
new file mode 100644
index 00000000..b5abf52e
--- /dev/null
+++ b/crates/socket-patch-cli/tests/e2e_redirect_cargo_shapes.rs
@@ -0,0 +1,935 @@
+//! Real-cargo hosted-mode regressions for project SHAPES beyond the single
+//! root dependency `e2e_redirect_cargo_build` covers — each one a defect a
+//! real-cargo capture matrix found in the hosted rewriter / revert:
+//!
+//! * `multi_version` — two patched versions of one crate (`cfg-if` 1.0.4 and
+//!   a renamed `cfg-if-legacy` at 0.1.10): each declaration is pinned to its
+//!   own version's registry, and removing both purls restores every byte.
+//! * `legacy_config` — an existing legacy `.cargo/config`: the registry
+//!   block lands there, and `remove` restores the file byte-for-byte —
+//!   also when it lacks a final newline or ends in a blank line.
+//! * `crlf` — CRLF `Cargo.toml` + `Cargo.lock`: rewritten with CRLF kept,
+//!   and restored byte-for-byte.
+//! * `workspace_direct_member` — a virtual workspace whose root pins
+//!   `[workspace.dependencies]`, one member inheriting and one declaring the
+//!   crate itself: both members build against the patched copy.
+//! * `two_sections` — the same declaration line in `[dependencies]` and
+//!   `[dev-dependencies]`: both pins revert on `remove`.
+//! * `direct_and_transitive` — the crate is also a dependency of another
+//!   crates.io crate: hosted mode refuses it loudly and rewrites nothing.
+//! * `lockless_other_dependencies` — the same project with no committed
+//!   `Cargo.lock`: with no resolved graph to read, a crate declared beside
+//!   any other dependency is refused just as loudly.
+//!
+//! Every shape runs the same chain against the real cargo: a baseline build
+//! with a private CARGO_HOME (network to crates.io for fixture setup only),
+//! patched `.crate`s rebuilt from the ACTUAL crates.io bytes and served by a
+//! wiremock sparse registry per patch, `scan --mode hosted`, then a FRESH
+//! checkout (only the committed files travel) where `cargo fetch --locked`
+//! and an offline `cargo build --locked` must link each patched-only symbol
+//! and a post-install `vex` must attest exactly the patches, and finally
+//! `remove <purl>` for every patch — in apply order and, from the same
+//! post-scan state, in reverse — which must leave the project
+//! byte-identical to its pre-scan state.
+//!
+//! `SOCKET_PATCH_CARGO_E2E_LOCK_VERSION` / `_TOOLCHAIN` (see
+//! `cargo_e2e_matrix`) re-encode the baseline lock, so a v1 lock's full-id
+//! dependency edges and `[metadata]` checksums meet every shape too.
+//!
+//! Skips (with a println) when `cargo` is missing or crates.io is
+//! unreachable (a failure instead under `SOCKET_PATCH_CARGO_E2E_REQUIRED=1`).
+
+use std::collections::BTreeMap;
+use std::path::{Path, PathBuf};
+use std::process::{Command, Output};
+
+use sha2::{Digest, Sha256};
+use socket_patch_core::hash::git_sha256::compute_git_sha256_from_bytes;
+use wiremock::{Mock, MockServer, Request, ResponseTemplate};
+
+#[path = "cargo_e2e_matrix/mod.rs"]
+mod cargo_e2e_matrix;
+
+const ORG: &str = "test-org";
+/// Appended to each patched crate's `src/lib.rs`: the oracle links it.
+const PATCH_SUFFIX: &str =
+    "\n/// Socket-patch shape marker (added by the hosted patch).\npub fn socket_patched() -> u32 { 1 }\n";
+
+/// One patched crate version the fixture serves.
+#[derive(Clone, Copy)]
+struct Patch {
+    name: &'static str,
+    version: &'static str,
+    uuid: &'static str,
+    token: &'static str,
+}
+
+impl Patch {
+    fn purl(&self) -> String {
+        format!("pkg:cargo/{}@{}", self.name, self.version)
+    }
+}
+
+const CFG_IF_1: Patch = Patch {
+    name: "cfg-if",
+    version: "1.0.4",
+    uuid: "c1f90104-5a0c-4e7a-9c0d-1a2b3c4d5e01",
+    token: "70ce0104-1111-4111-8111-111111111101",
+};
+const CFG_IF_0: Patch = Patch {
+    name: "cfg-if",
+    version: "0.1.10",
+    uuid: "c1f90010-5a0c-4e7a-9c0d-1a2b3c4d5e02",
+    token: "70ce0010-1111-4111-8111-111111111102",
+};
+
+/// A project shape: its files before the lock exists, the patches, and the
+/// oracle sources that reference each patched crate's marker.
+struct Shape {
+    tag: &'static str,
+    files: Vec<(&'static str, String)>,
+    patches: Vec<Patch>,
+    /// Written into the fresh checkout before the offline build.
+    oracle: Vec<(&'static str, String)>,
+    /// Re-encode every `Cargo.toml` and the generated `Cargo.lock` with CRLF
+    /// line endings (a Windows checkout) before the scan.
+    crlf: bool,
+    /// Delete `Cargo.lock` after the baseline build, before the scan: the
+    /// shape a Rust library that gitignores its lock presents.
+    lockless: bool,
+    /// A shape hosted mode must REFUSE: the rewriter warning code every
+    /// patch is skipped with. The scan must leave every file untouched.
+    refused: Option<&'static str>,
+}
+
+fn binary() -> PathBuf {
+    PathBuf::from(env!("CARGO_BIN_EXE_socket-patch"))
+}
+
+fn run_socket(cwd: &Path, args: &[&str], cargo_home: &Path) -> (i32, String, String) {
+    let mut cmd = Command::new(binary());
+    cmd.args(args).current_dir(cwd);
+    for (k, _) in std::env::vars_os() {
+        if k.to_string_lossy().starts_with("SOCKET_") {
+            cmd.env_remove(&k);
+        }
+    }
+    cmd.env("SOCKET_NO_CONFIG", "1");
+    cmd.env("CARGO_HOME", cargo_home);
+    let out = cmd.output().expect("failed to run socket-patch binary");
+    (
+        out.status.code().unwrap_or(-1),
+        String::from_utf8_lossy(&out.stdout).into_owned(),
+        String::from_utf8_lossy(&out.stderr).into_owned(),
+    )
+}
+
+fn cargo(cwd: &Path, args: &[&str], cargo_home: &Path) -> Output {
+    cargo_e2e_matrix::cargo_command(cwd, cargo_home)
+        .args(args)
+        .output()
+        .expect("failed to run cargo")
+}
+
+fn stderr(out: &Output) -> String {
+    String::from_utf8_lossy(&out.stderr).into_owned()
+}
+
+fn find_registry_crate(cargo_home: &Path, leaf: &str) -> Option<PathBuf> {
+    let src = cargo_home.join("registry").join("src");
+    std::fs::read_dir(src)
+        .ok()?
+        .filter_map(|e| e.ok())
+        .map(|e| e.path().join(leaf))
+        .find(|p| p.is_dir())
+}
+
+fn sparse_index_rel(name: &str) -> String {
+    match name.len() {
+        1 => format!("1/{name}"),
+        2 => format!("2/{name}"),
+        3 => format!("3/{}/{name}", &name[..1]),
+        _ => format!("{}/{}/{name}", &name[..2], &name[2..4]),
+    }
+}
+
+fn build_crate(stage: &Path, crate_dir: &Path, leaf: &str, patched: &[u8]) -> Vec<u8> {
+    let pkg = stage.join(leaf);
+    copy_tree(crate_dir, &pkg);
+    let _ = std::fs::remove_file(pkg.join(".cargo-checksum.json"));
+    std::fs::write(pkg.join("src/lib.rs"), patched).unwrap();
+    let mut bytes = Vec::new();
+    {
+        let enc = flate2::write::GzEncoder::new(&mut bytes, flate2::Compression::new(6));
+        let mut builder = tar::Builder::new(enc);
+        builder.append_dir_all(leaf, &pkg).unwrap();
+        builder.into_inner().unwrap().finish().unwrap();
+    }
+    bytes
+}
+
+fn copy_tree(src: &Path, dst: &Path) {
+    std::fs::create_dir_all(dst).unwrap();
+    for entry in std::fs::read_dir(src).unwrap() {
+        let entry = entry.unwrap();
+        let to = dst.join(entry.file_name());
+        if entry.file_type().unwrap().is_dir() {
+            copy_tree(&entry.path(), &to);
+        } else {
+            std::fs::copy(entry.path(), &to).unwrap();
+        }
+    }
+}
+
+/// Every project file except build output and the `.socket/` ledger dir.
+fn snapshot(root: &Path) -> BTreeMap<String, Vec<u8>> {
+    fn walk(root: &Path, dir: &Path, out: &mut BTreeMap<String, Vec<u8>>) {
+        for entry in std::fs::read_dir(dir).unwrap() {
+            let path = entry.unwrap().path();
+            let rel = path
+                .strip_prefix(root)
+                .unwrap()
+                .to_string_lossy()
+                .replace('\\', "/");
+            if rel == "target" || rel == ".socket" || rel.ends_with("/target") {
+                continue;
+            }
+            if path.is_dir() {
+                walk(root, &path, out);
+            } else {
+                out.insert(rel, std::fs::read(&path).unwrap());
+            }
+        }
+    }
+    let mut out = BTreeMap::new();
+    walk(root, root, &mut out);
+    out
+}
+
+struct Served {
+    patch: Patch,
+    orig: Vec<u8>,
+    patched: Vec<u8>,
+    crate_bytes: Vec<u8>,
+}
+
+/// Route every patch-API, sparse-index and download request the CLI and
+/// cargo make, for any number of patches.
+fn router(origin: String, served: Vec<Served>) -> impl Fn(&Request) -> ResponseTemplate {
+    move |req: &Request| {
+        let path = req.url.path().to_string();
+        let find = |uuid: &str| served.iter().find(|s| s.patch.uuid == uuid);
+        let index_url = |p: &Patch| {
+            format!(
+                "sparse+{origin}/patch-registry/cargo/{}/{}/index/",
+                p.token, p.uuid
+            )
+        };
+        let hosted_url = |p: &Patch| {
+            format!(
+                "{origin}/patch/cargo/{0}/{1}/{2}/{3}/{0}-{1}.crate",
+                p.name, p.version, p.token, p.uuid
+            )
+        };
+        let segs: Vec<&str> = path.split('/').filter(|s| !s.is_empty()).collect();
+        let api = format!("/v0/orgs/{ORG}/patches/");
+        if path == format!("{api}batch") {
+            let packages: Vec<serde_json::Value> = served
+                .iter()
+                .map(|s| {
+                    serde_json::json!({
+                        "purl": s.patch.purl(),
+                        "patches": [{
+                            "uuid": s.patch.uuid, "purl": s.patch.purl(), "tier": "free",
+                            "cveIds": [], "ghsaIds": [format!("GHSA-shape-{}", &s.patch.uuid[..8])],
+                            "severity": "high", "title": "cargo shape fixture"
+                        }]
+                    })
+                })
+                .collect();
+            return ResponseTemplate::new(200).set_body_json(
+                serde_json::json!({ "packages": packages, "canAccessPaidPatches": false }),
+            );
+        }
+        if let Some(rest) = path.strip_prefix(&format!("{api}by-package/")) {
+            let purl = urlencoding_decode(rest);
+            let patches: Vec<serde_json::Value> = served
+                .iter()
+                .filter(|s| s.patch.purl() == purl)
+                .map(|s| {
+                    serde_json::json!({
+                        "uuid": s.patch.uuid, "purl": s.patch.purl(),
+                        "publishedAt": "2026-01-01T00:00:00Z", "description": "x",
+                        "license": "MIT", "tier": "free", "vulnerabilities": {}
+                    })
+                })
+                .collect();
+            return ResponseTemplate::new(200).set_body_json(
+                serde_json::json!({ "patches": patches, "canAccessPaidPatches": false }),
+            );
+        }
+        if path == format!("{api}package") {
+            let body: serde_json::Value = serde_json::from_slice(&req.body).unwrap_or_default();
+            let mut results = serde_json::Map::new();
+            for uuid in body["uuids"].as_array().into_iter().flatten() {
+                let uuid = uuid.as_str().unwrap_or_default();
+                let value = match find(uuid) {
+                    Some(s) => {
+                        let cksum = hex::encode(Sha256::digest(&s.crate_bytes));
+                        serde_json::json!({
+                            "status": "granted",
+                            "url": hosted_url(&s.patch),
+                            "purl": s.patch.purl(),
+                            "artifacts": [{
+                                "kind": "tarball", "url": hosted_url(&s.patch),
+                                "integrity": { "sha256": cksum }
+                            }],
+                            "registryOverride": {
+                                "kind": "cargo-sparse",
+                                "indexUrl": index_url(&s.patch),
+                                "identifiers": {
+                                    "name": s.patch.name, "version": s.patch.version,
+                                    "cargoCksumSha256": cksum,
+                                }
+                            }
+                        })
+                    }
+                    None => serde_json::json!({ "status": "not_found" }),
+                };
+                results.insert(uuid.to_string(), value);
+            }
+            return ResponseTemplate::new(200)
+                .set_body_json(serde_json::json!({ "results": results }));
+        }
+        if let Some(uuid) = path.strip_prefix(&format!("{api}view/")) {
+            if let Some(s) = find(uuid) {
+                return ResponseTemplate::new(200).set_body_json(serde_json::json!({
+                    "uuid": uuid, "purl": s.patch.purl(),
+                    "publishedAt": "2026-01-01T00:00:00Z",
+                    "files": { "src/lib.rs": {
+                        "beforeHash": compute_git_sha256_from_bytes(&s.orig),
+                        "afterHash": compute_git_sha256_from_bytes(&s.patched),
+                    }},
+                    "vulnerabilities": { format!("GHSA-shape-{}", &uuid[..8]): {
+                        "cves": [], "summary": "s", "severity": "high", "description": "d"
+                    }},
+                    "description": "x", "license": "MIT", "tier": "free"
+                }));
+            }
+        }
+        // /patch-registry/cargo/<token>/<uuid>/index/...
+        if segs.len() >= 6 && segs[..2] == ["patch-registry", "cargo"] && segs[4] == "index" {
+            if let Some(s) = find(segs[3]) {
+                let rest = segs[5..].join("/");
+                if rest == "config.json" {
+                    return ResponseTemplate::new(200).set_body_json(serde_json::json!({
+                        "dl": format!("{origin}/dl/{}", s.patch.uuid),
+                    }));
+                }
+                if rest == sparse_index_rel(s.patch.name) {
+                    let line = serde_json::json!({
+                        "name": s.patch.name, "vers": s.patch.version, "deps": [],
+                        "cksum": hex::encode(Sha256::digest(&s.crate_bytes)),
+                        "features": {}, "yanked": false,
+                    });
+                    return ResponseTemplate::new(200).set_body_string(line.to_string());
+                }
+            }
+        }
+        // /dl/<uuid>/<crate>/<version>/download
+        if segs.len() == 5 && segs[0] == "dl" && segs[4] == "download" {
+            if let Some(s) = find(segs[1]) {
+                return ResponseTemplate::new(200).set_body_bytes(s.crate_bytes.clone());
+            }
+        }
+        ResponseTemplate::new(404)
+    }
+}
+
+fn urlencoding_decode(s: &str) -> String {
+    let bytes = s.as_bytes();
+    let mut out = Vec::with_capacity(bytes.len());
+    let mut i = 0;
+    while i < bytes.len() {
+        if bytes[i] == b'%' && i + 2 < bytes.len() {
+            if let Ok(b) = u8::from_str_radix(&s[i + 1..i + 3], 16) {
+                out.push(b);
+                i += 3;
+                continue;
+            }
+        }
+        out.push(bytes[i]);
+        i += 1;
+    }
+    String::from_utf8_lossy(&out).into_owned()
+}
+
+/// Run one shape through scan → fresh-checkout fetch + offline build →
+/// remove. Returns `None` when the fixture could not be built (skipped).
+async fn run_shape(shape: Shape) -> Option<()> {
+    let suite = format!("e2e_redirect_cargo_shapes ({})", shape.tag);
+    if !cargo_e2e_matrix::cargo_available(&suite) {
+        return None;
+    }
+    let tmp = tempfile::tempdir().unwrap();
+    let proj = tmp.path().join("proj");
+    let home = tmp.path().join("cargo-home");
+    std::fs::create_dir_all(&home).unwrap();
+    for (rel, content) in &shape.files {
+        let path = proj.join(rel);
+        std::fs::create_dir_all(path.parent().unwrap()).unwrap();
+        std::fs::write(path, content).unwrap();
+    }
+    let generate = cargo(&proj, &["generate-lockfile"], &home);
+    if !generate.status.success() {
+        let _ = cargo_e2e_matrix::skip(
+            &suite,
+            &format!(
+                "`cargo generate-lockfile` failed (crates.io unreachable?):\n{}",
+                stderr(&generate)
+            ),
+        );
+        return None;
+    }
+    pin_patched_versions(&proj, &home, &shape.patches);
+    cargo_e2e_matrix::apply_lock_version(&proj);
+    let build = cargo(&proj, &["build", "-q", "--locked"], &home);
+    if !build.status.success() {
+        let _ = cargo_e2e_matrix::skip(
+            &suite,
+            &format!(
+                "baseline `cargo build` failed (crates.io unreachable?):\n{}",
+                stderr(&build)
+            ),
+        );
+        return None;
+    }
+    let _ = std::fs::remove_dir_all(proj.join("target"));
+    if shape.crlf {
+        for rel in snapshot(&proj).keys() {
+            if rel.ends_with("Cargo.toml") || rel == "Cargo.lock" {
+                let path = proj.join(rel);
+                let text = std::fs::read_to_string(&path).unwrap();
+                std::fs::write(&path, text.replace('\n', "\r\n")).unwrap();
+            }
+        }
+        let rebuilt = cargo(&proj, &["build", "-q", "--locked"], &home);
+        assert!(
+            rebuilt.status.success(),
+            "{}: the CRLF baseline must build:\n{}",
+            shape.tag,
+            stderr(&rebuilt)
+        );
+        let _ = std::fs::remove_dir_all(proj.join("target"));
+    }
+    if shape.lockless {
+        std::fs::remove_file(proj.join("Cargo.lock")).unwrap();
+    }
+    let before = snapshot(&proj);
+
+    let mut served = Vec::new();
+    for patch in &shape.patches {
+        let leaf = format!("{}-{}", patch.name, patch.version);
+        let dir = find_registry_crate(&home, &leaf)
+            .unwrap_or_else(|| panic!("{leaf} must be extracted by the baseline build"));
+        let orig = std::fs::read(dir.join("src/lib.rs")).unwrap();
+        let patched = [orig.as_slice(), PATCH_SUFFIX.as_bytes()].concat();
+        let crate_bytes = build_crate(&tmp.path().join("stage"), &dir, &leaf, &patched);
+        served.push(Served {
+            patch: *patch,
+            orig,
+            patched,
+            crate_bytes,
+        });
+    }
+    let server = MockServer::start().await;
+    Mock::given(wiremock::matchers::any())
+        .respond_with(router(server.uri(), served))
+        .mount(&server)
+        .await;
+
+    let uri = server.uri();
+    let proj_s = proj.to_str().unwrap().to_string();
+    let (code, stdout, err) = run_socket(
+        &proj,
+        &[
+            "scan",
+            "--mode",
+            "hosted",
+            "--json",
+            "--yes",
+            "--no-telemetry",
+            "--cwd",
+            &proj_s,
+            "--api-url",
+            &uri,
+            "--org",
+            ORG,
+            "--api-token",
+            "fake",
+        ],
+        &home,
+    );
+    assert_eq!(
+        code, 0,
+        "{}: scan failed\nstdout:\n{stdout}\nstderr:\n{err}",
+        shape.tag
+    );
+    let env: serde_json::Value = serde_json::from_str(&stdout).unwrap();
+    if let Some(code) = shape.refused {
+        assert_eq!(env["redirect"]["redirected"], 0, "{}: {env}", shape.tag);
+        let codes: Vec<&str> = env["redirect"]["warnings"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .filter_map(|w| w["code"].as_str())
+            .collect();
+        assert_eq!(
+            codes,
+            vec![code; shape.patches.len()],
+            "{}: every patch refused loudly: {env}",
+            shape.tag
+        );
+        assert_eq!(
+            snapshot(&proj),
+            before,
+            "{}: a refused redirect rewrites nothing",
+            shape.tag
+        );
+        assert!(!proj.join(".socket").exists(), "{}", shape.tag);
+        if !shape.lockless {
+            let fetch = cargo(&proj, &["fetch", "--locked"], &home);
+            assert!(
+                fetch.status.success(),
+                "{}: the untouched project still fetches --locked:\n{}",
+                shape.tag,
+                stderr(&fetch)
+            );
+        }
+        return Some(());
+    }
+    assert_eq!(
+        env["redirect"]["redirected"],
+        shape.patches.len(),
+        "{}: every patch redirected: {env}",
+        shape.tag
+    );
+    assert_eq!(
+        env["redirect"]["warnings"],
+        serde_json::json!([]),
+        "{}: {env}",
+        shape.tag
+    );
+
+    if shape.crlf {
+        for (rel, bytes) in snapshot(&proj) {
+            if rel.ends_with("Cargo.toml") || rel == "Cargo.lock" {
+                let text = String::from_utf8(bytes).unwrap();
+                assert_eq!(
+                    text.matches("\r\n").count(),
+                    text.matches('\n').count(),
+                    "{}: {rel} must keep CRLF endings:\n{text}",
+                    shape.tag
+                );
+            }
+        }
+    }
+
+    // Fresh checkout: only committed files travel; an EMPTY CARGO_HOME.
+    let fresh = tmp.path().join("fresh");
+    for (rel, _) in snapshot(&proj) {
+        let to = fresh.join(&rel);
+        std::fs::create_dir_all(to.parent().unwrap()).unwrap();
+        std::fs::copy(proj.join(&rel), to).unwrap();
+    }
+    if proj.join(".socket").is_dir() {
+        copy_tree(&proj.join(".socket"), &fresh.join(".socket"));
+    }
+    let fresh_home = tmp.path().join("fresh-home");
+    std::fs::create_dir_all(&fresh_home).unwrap();
+    let fetch = cargo(&fresh, &["fetch", "--locked"], &fresh_home);
+    assert!(
+        fetch.status.success(),
+        "{}: fresh `cargo fetch --locked` failed:\n{}",
+        shape.tag,
+        stderr(&fetch)
+    );
+    for (rel, content) in &shape.oracle {
+        std::fs::write(fresh.join(rel), content).unwrap();
+    }
+    let build = cargo(&fresh, &["build", "--locked", "--offline"], &fresh_home);
+    assert!(
+        build.status.success(),
+        "{}: offline `cargo build --locked` must link every patched marker:\n{}",
+        shape.tag,
+        stderr(&build)
+    );
+
+    // Post-install VEX over the fresh checkout: every patch is attested,
+    // hash-verified against the extracted (patched) registry sources.
+    let doc_path = fresh.join("doc.vex.json");
+    let fresh_s = fresh.to_str().unwrap().to_string();
+    let (code, stdout, err) = run_socket(
+        &fresh,
+        &[
+            "vex",
+            "--output",
+            doc_path.to_str().unwrap(),
+            "--product",
+            "pkg:cargo/consumer@0.1.0",
+            "--patch-server-url",
+            &uri,
+            "--cwd",
+            &fresh_s,
+        ],
+        &fresh_home,
+    );
+    assert_eq!(
+        code, 0,
+        "{}: vex\nstdout:\n{stdout}\nstderr:\n{err}",
+        shape.tag
+    );
+    let doc: serde_json::Value =
+        serde_json::from_slice(&std::fs::read(&doc_path).unwrap()).unwrap();
+    let mut attested: Vec<String> = doc["statements"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .flat_map(|st| st["products"].as_array().unwrap().clone())
+        .flat_map(|p| p["subcomponents"].as_array().unwrap().clone())
+        .map(|c| c["@id"].as_str().unwrap().to_string())
+        .collect();
+    attested.sort();
+    attested.dedup();
+    let mut expected: Vec<String> = shape.patches.iter().map(Patch::purl).collect();
+    expected.sort();
+    assert_eq!(attested, expected, "{}: attested purls: {doc}", shape.tag);
+
+    // Rollback: removing every purl restores the pre-scan project exactly —
+    // in apply order AND in reverse (a v1 lock's shared dependent blocks
+    // once made the first-applied purl unremovable before its sibling).
+    let post_scan = tmp.path().join("post-scan");
+    copy_tree(&proj, &post_scan);
+    let mut orders = vec![shape.patches.clone()];
+    if shape.patches.len() > 1 {
+        orders.push(shape.patches.iter().rev().copied().collect());
+    }
+    for (n, order) in orders.iter().enumerate() {
+        if n > 0 {
+            std::fs::remove_dir_all(&proj).unwrap();
+            copy_tree(&post_scan, &proj);
+        }
+        for patch in order {
+            let purl = patch.purl();
+            let (code, stdout, err) = run_socket(
+                &proj,
+                &[
+                    "remove",
+                    &purl,
+                    "--cwd",
+                    &proj_s,
+                    "--json",
+                    "--yes",
+                    "--no-telemetry",
+                ],
+                &home,
+            );
+            assert_eq!(
+                code, 0,
+                "{} (removal order {n}): remove {purl}\nstdout:\n{stdout}\nstderr:\n{err}",
+                shape.tag
+            );
+        }
+        let after = snapshot(&proj);
+        for (rel, bytes) in &before {
+            assert_eq!(
+                after
+                    .get(rel)
+                    .map(|b| String::from_utf8_lossy(b).into_owned()),
+                Some(String::from_utf8_lossy(bytes).into_owned()),
+                "{} (removal order {n}): {rel} not restored byte-for-byte by remove",
+                shape.tag
+            );
+        }
+        let extra: Vec<&String> = after.keys().filter(|k| !before.contains_key(*k)).collect();
+        assert!(
+            extra.is_empty(),
+            "{} (removal order {n}): remove left files behind: {extra:?}",
+            shape.tag
+        );
+    }
+    Some(())
+}
+
+/// Pin each patched version: a caret requirement locks the newest
+/// compatible release, which moves as crates.io publishes.
+fn pin_patched_versions(proj: &Path, home: &Path, patches: &[Patch]) {
+    for patch in patches {
+        let lock = std::fs::read_to_string(proj.join("Cargo.lock")).unwrap();
+        let locked = cargo_e2e_matrix::parse_lock(&lock);
+        if locked
+            .iter()
+            .any(|p| p.name == patch.name && p.version == patch.version)
+        {
+            continue;
+        }
+        let pinned = locked
+            .iter()
+            .filter(|p| p.name == patch.name)
+            .filter(|p| {
+                !patches
+                    .iter()
+                    .any(|q| q.name == p.name && q.version == p.version)
+            })
+            .any(|p| {
+                let spec = format!("{}@{}", p.name, p.version);
+                cargo(
+                    proj,
+                    &["update", "-p", &spec, "--precise", patch.version],
+                    home,
+                )
+                .status
+                .success()
+            });
+        assert!(
+            pinned,
+            "cannot lock {}@{}:\n{lock}",
+            patch.name, patch.version
+        );
+    }
+}
+
+fn consumer_manifest(deps: &str) -> String {
+    format!("[package]\nname = \"consumer\"\nversion = \"0.1.0\"\nedition = \"2018\"\n\n[dependencies]\n{deps}")
+}
+
+/// Bugs B + I: two patched versions of one crate.
+#[tokio::test(flavor = "multi_thread")]
+async fn cargo_hosted_multi_version_pins_each_declaration_and_removes_cleanly() {
+    let shape = Shape {
+        tag: "multi-version",
+        files: vec![
+            (
+                "Cargo.toml",
+                consumer_manifest(
+                    "cfg-if = \"1.0.4\"\ncfg-if-legacy = { package = \"cfg-if\", version = \"0.1.10\" }\n",
+                ),
+            ),
+            ("src/main.rs", "fn main() {}\n".to_string()),
+        ],
+        patches: vec![CFG_IF_1, CFG_IF_0],
+        oracle: vec![(
+            "src/main.rs",
+            "fn main() { println!(\"{}\", cfg_if::socket_patched() + cfg_if_legacy::socket_patched()); }\n"
+                .to_string(),
+        )],
+        crlf: false,
+        lockless: false,
+        refused: None,
+    };
+    let _ = run_shape(shape).await;
+}
+
+/// Bug H: an existing legacy `.cargo/config` gets the registry block
+/// appended; removing the purl must restore its exact bytes.
+#[tokio::test(flavor = "multi_thread")]
+async fn cargo_hosted_legacy_config_is_restored_byte_for_byte() {
+    let shape = Shape {
+        tag: "legacy-config",
+        files: vec![
+            ("Cargo.toml", consumer_manifest("cfg-if = \"1.0.4\"\n")),
+            ("src/main.rs", "fn main() {}\n".to_string()),
+            (".cargo/config", "[net]\nretry = 2\n".to_string()),
+        ],
+        patches: vec![CFG_IF_1],
+        oracle: vec![(
+            "src/main.rs",
+            "fn main() { println!(\"{}\", cfg_if::socket_patched()); }\n".to_string(),
+        )],
+        crlf: false,
+        lockless: false,
+        refused: None,
+    };
+    let _ = run_shape(shape).await;
+}
+
+/// Bug H, exactly: a config without a final newline, and one ending in a
+/// blank line, both come back byte-for-byte (the appended block's removal
+/// once normalized the trailing newline run).
+#[tokio::test(flavor = "multi_thread")]
+async fn cargo_hosted_config_trailing_bytes_are_restored() {
+    for (tag, rel, config) in [
+        (
+            "config-unterminated",
+            ".cargo/config.toml",
+            "[net]\nretry = 2",
+        ),
+        (
+            "config-trailing-blank",
+            ".cargo/config",
+            "[net]\nretry = 2\n\n",
+        ),
+    ] {
+        let shape = Shape {
+            tag,
+            files: vec![
+                ("Cargo.toml", consumer_manifest("cfg-if = \"1.0.4\"\n")),
+                ("src/main.rs", "fn main() {}\n".to_string()),
+                (rel, config.to_string()),
+            ],
+            patches: vec![CFG_IF_1],
+            oracle: vec![(
+                "src/main.rs",
+                "fn main() { println!(\"{}\", cfg_if::socket_patched()); }\n".to_string(),
+            )],
+            crlf: false,
+            lockless: false,
+            refused: None,
+        };
+        if run_shape(shape).await.is_none() {
+            return;
+        }
+    }
+}
+
+/// The crate declared with the SAME line in two dependency sections: the
+/// rewrite records two identical manifest edits, and the ledger must keep
+/// both — it collapsed them, so `remove` reverted one pin, kept the other
+/// (and the registry block it references) and still reported success.
+#[tokio::test(flavor = "multi_thread")]
+async fn cargo_hosted_same_line_in_two_sections_removes_cleanly() {
+    let shape = Shape {
+        tag: "two-sections",
+        files: vec![
+            (
+                "Cargo.toml",
+                format!(
+                    "{}\n[dev-dependencies]\ncfg-if = \"1.0.4\"\n",
+                    consumer_manifest("cfg-if = \"1.0.4\"\n")
+                ),
+            ),
+            ("src/main.rs", "fn main() {}\n".to_string()),
+        ],
+        patches: vec![CFG_IF_1],
+        oracle: vec![(
+            "src/main.rs",
+            "fn main() { println!(\"{}\", cfg_if::socket_patched()); }\n".to_string(),
+        )],
+        crlf: false,
+        lockless: false,
+        refused: None,
+    };
+    let _ = run_shape(shape).await;
+}
+
+/// Bug F: a workspace member's own declaration must be pinned too.
+#[tokio::test(flavor = "multi_thread")]
+async fn cargo_hosted_workspace_member_declaration_is_pinned() {
+    let member = |name: &str, dep: &str| {
+        format!(
+            "[package]\nname = \"{name}\"\nversion = \"0.1.0\"\nedition = \"2018\"\n\n\
+             [dependencies]\n{dep}\n"
+        )
+    };
+    let oracle = "pub fn marker() -> u32 { cfg_if::socket_patched() }\n".to_string();
+    let shape = Shape {
+        tag: "workspace-direct-member",
+        files: vec![
+            (
+                "Cargo.toml",
+                "[workspace]\nmembers = [\"inherits\", \"direct\"]\n\n\
+                 [workspace.dependencies]\ncfg-if = \"1.0.4\"\n"
+                    .to_string(),
+            ),
+            (
+                "inherits/Cargo.toml",
+                member("inherits", "cfg-if = { workspace = true }"),
+            ),
+            ("inherits/src/lib.rs", String::new()),
+            ("direct/Cargo.toml", member("direct", "cfg-if = \"1.0.4\"")),
+            ("direct/src/lib.rs", String::new()),
+        ],
+        patches: vec![CFG_IF_1],
+        oracle: vec![
+            ("inherits/src/lib.rs", oracle.clone()),
+            ("direct/src/lib.rs", oracle),
+        ],
+        crlf: false,
+        lockless: false,
+        refused: None,
+    };
+    let _ = run_shape(shape).await;
+}
+
+/// Bug K: a CRLF checkout is redirected (it was refused) with its line
+/// endings kept, and removed byte-for-byte.
+#[tokio::test(flavor = "multi_thread")]
+async fn cargo_hosted_crlf_project_keeps_its_line_endings() {
+    let shape = Shape {
+        tag: "crlf",
+        files: vec![
+            ("Cargo.toml", consumer_manifest("cfg-if = \"1.0.4\"\n")),
+            ("src/main.rs", "fn main() {}\n".to_string()),
+        ],
+        patches: vec![CFG_IF_1],
+        oracle: vec![(
+            "src/main.rs",
+            "fn main() { println!(\"{}\", cfg_if::socket_patched()); }\n".to_string(),
+        )],
+        crlf: true,
+        lockless: false,
+        refused: None,
+    };
+    let _ = run_shape(shape).await;
+}
+
+/// A crate that is both a direct dependency and a dependency of another
+/// crates.io crate (`crc32fast` depends on `cfg-if ^1`): a hosted pin cannot
+/// reach crc32fast's edge, so the redirect is refused loudly instead of
+/// repointing the lock (`--locked` then fails, and crc32fast compiled the
+/// unpatched crates.io copy while scan reported the crate redirected).
+#[tokio::test(flavor = "multi_thread")]
+async fn cargo_hosted_refuses_a_crate_another_crate_depends_on() {
+    let shape = Shape {
+        tag: "direct-and-transitive",
+        files: vec![
+            (
+                "Cargo.toml",
+                consumer_manifest("cfg-if = \"1.0.4\"\ncrc32fast = \"=1.5.0\"\n"),
+            ),
+            ("src/main.rs", "fn main() {}\n".to_string()),
+        ],
+        patches: vec![CFG_IF_1],
+        oracle: Vec::new(),
+        crlf: false,
+        lockless: false,
+        refused: Some("redirect_cargo_transitive_dependents"),
+    };
+    let _ = run_shape(shape).await;
+}
+
+/// The SAME project with its `Cargo.lock` gitignored (the common shape for
+/// a Rust library): with no resolved graph the dependents check above has
+/// nothing to read, so the manifests answer instead — cfg-if is declared
+/// beside crc32fast, which may well pull it in, and the redirect is refused
+/// rather than reported as one while the build links an unpatched copy
+/// through crc32fast.
+#[tokio::test(flavor = "multi_thread")]
+async fn cargo_hosted_refuses_a_lockless_project_with_other_dependencies() {
+    let shape = Shape {
+        tag: "lockless-other-dependencies",
+        files: vec![
+            (
+                "Cargo.toml",
+                consumer_manifest("cfg-if = \"1.0.4\"\ncrc32fast = \"=1.5.0\"\n"),
+            ),
+            ("src/main.rs", "fn main() {}\n".to_string()),
+        ],
+        patches: vec![CFG_IF_1],
+        oracle: Vec::new(),
+        crlf: false,
+        lockless: true,
+        refused: Some("redirect_cargo_lockless_dependents"),
+    };
+    let _ = run_shape(shape).await;
+}
diff --git a/crates/socket-patch-cli/tests/in_process_redirect.rs b/crates/socket-patch-cli/tests/in_process_redirect.rs
index 7338c7d4..abdb014e 100644
--- a/crates/socket-patch-cli/tests/in_process_redirect.rs
+++ b/crates/socket-patch-cli/tests/in_process_redirect.rs
@@ -3964,6 +3964,193 @@ async fn cargo_granted_but_nothing_pinned_is_not_confirmed_or_attested() {
     );
 }
 
+/// A granted cargo patch for a crate the project reaches only
+/// TRANSITIVELY (in Cargo.lock, declared by no manifest) stays a refusal —
+/// a manifest `registry` pin cannot reach it — but a loud one: nothing is
+/// written, recorded or attested, the requested VEX fails the run, and the
+/// warning names the crate transitive-only and points at vendored mode.
+#[tokio::test]
+#[serial]
+async fn cargo_transitive_only_crate_is_refused_loudly_and_not_attested() {
+    const CARGO_PURL: &str = "pkg:cargo/cfg-if@1.0.0";
+    const CARGO_UUID: &str = "22222222-2222-4222-8222-222222222222";
+    let cksum = "cd".repeat(32);
+    let index_url = format!("sparse+http://patch.test/registry/cargo/{CARGO_UUID}/index/");
+    let server = MockServer::start().await;
+    mock_cargo_patch(
+        &server,
+        CARGO_PURL,
+        CARGO_UUID,
+        "cfg-if",
+        "1.0.0",
+        &index_url,
+        &cksum,
+        "GHSA-carg-tttt-tttt",
+    )
+    .await;
+
+    let tmp = tempfile::tempdir().unwrap();
+    std::fs::write(
+        tmp.path().join("Cargo.toml"),
+        "[package]\nname = \"consumer\"\nversion = \"0.0.0\"\nedition = \"2021\"\n\n[dependencies]\nlog = \"0.4\"\n",
+    )
+    .unwrap();
+    std::fs::write(
+        tmp.path().join("Cargo.lock"),
+        "version = 3\n\n[[package]]\nname = \"cfg-if\"\nversion = \"1.0.0\"\nsource = \"registry+https://github.com/rust-lang/crates.io-index\"\nchecksum = \"ee\"\n\n[[package]]\nname = \"log\"\nversion = \"0.4.20\"\nsource = \"registry+https://github.com/rust-lang/crates.io-index\"\nchecksum = \"ff\"\ndependencies = [\n \"cfg-if\",\n]\n",
+    )
+    .unwrap();
+    write_vendored_crate(tmp.path(), "cfg-if", "1.0.0");
+    let toml_before = std::fs::read(tmp.path().join("Cargo.toml")).unwrap();
+    let lock_before = std::fs::read(tmp.path().join("Cargo.lock")).unwrap();
+
+    let vex_path = tmp.path().join("out.vex.json");
+    let mut args = redirect_args(tmp.path(), server.uri());
+    args.vex = socket_patch_cli::commands::vex::VexEmbedArgs {
+        vex: Some(vex_path.clone()),
+        vex_product: Some("pkg:cargo/consumer@0.0.0".to_string()),
+        ..Default::default()
+    };
+    let code = run(args).await;
+
+    assert_eq!(
+        std::fs::read(tmp.path().join("Cargo.toml")).unwrap(),
+        toml_before
+    );
+    assert_eq!(
+        std::fs::read(tmp.path().join("Cargo.lock")).unwrap(),
+        lock_before
+    );
+    assert!(
+        !tmp.path().join(".cargo").exists(),
+        "no registry block may be written for an unpinnable crate"
+    );
+    assert!(
+        !tmp.path()
+            .join(".socket/vendor/redirect-state.json")
+            .exists(),
+        "nothing redirected, nothing recorded"
+    );
+    assert!(
+        !vex_path.exists(),
+        "a transitive-only crate is never attested"
+    );
+    assert_eq!(code, 1, "the requested attestation must fail the run");
+
+    // Without --vex the run succeeds, reporting nothing redirected and the
+    // transitive-only warning in the envelope.
+    let env = run_redirect_subprocess(tmp.path(), &server.uri());
+    assert_eq!(env["redirect"]["redirected"], 0, "{env}");
+    let warning = env["redirect"]["warnings"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .find(|w| w["code"] == "redirect_cargo_toml_dep_not_found")
+        .unwrap_or_else(|| panic!("{env}"));
+    let detail = warning["detail"].as_str().unwrap();
+    assert!(
+        detail.contains("cfg-if@1.0.0 is a transitive-only dependency")
+            && detail.contains("--mode vendored"),
+        "{detail}"
+    );
+    assert_eq!(
+        std::fs::read(tmp.path().join("Cargo.lock")).unwrap(),
+        lock_before
+    );
+}
+
+/// A workspace member or path dependency the rewriter must not write —
+/// outside the project root, or reached through a symbolic link — still
+/// declares the patched crate to cargo. Pinning only the root would leave
+/// that package resolving crates.io (`--locked` fails, the unpatched copy is
+/// compiled) while the crate is reported redirected. REGRESSION: the root
+/// was pinned and the dep confirmed; a literal symlinked member was even
+/// written through the link, outside the project. Now the Cargo.lock
+/// dependents check refuses the crate and nothing is written anywhere.
+#[cfg(unix)]
+#[tokio::test]
+#[serial]
+async fn cargo_member_outside_the_project_or_behind_a_symlink_refuses_the_crate() {
+    const CARGO_PURL: &str = "pkg:cargo/cfg-if@1.0.0";
+    const CARGO_UUID: &str = "33333333-3333-4333-8333-333333333333";
+    let cksum = "cd".repeat(32);
+    let index_url = format!("sparse+http://patch.test/registry/cargo/{CARGO_UUID}/index/");
+    let server = MockServer::start().await;
+    mock_cargo_patch(
+        &server,
+        CARGO_PURL,
+        CARGO_UUID,
+        "cfg-if",
+        "1.0.0",
+        &index_url,
+        &cksum,
+        "GHSA-carg-ssss-ssss",
+    )
+    .await;
+
+    let lib_manifest =
+        "[package]\nname = \"lib\"\nversion = \"0.1.0\"\nedition = \"2021\"\n\n[dependencies]\ncfg-if = \"1\"\n";
+    let lock = "version = 3\n\n[[package]]\nname = \"cfg-if\"\nversion = \"1.0.0\"\nsource = \"registry+https://github.com/rust-lang/crates.io-index\"\nchecksum = \"ee\"\n\n[[package]]\nname = \"consumer\"\nversion = \"0.0.0\"\ndependencies = [\n \"cfg-if\",\n \"lib\",\n]\n\n[[package]]\nname = \"lib\"\nversion = \"0.1.0\"\ndependencies = [\n \"cfg-if\",\n]\n";
+    for (shape, root_manifest, link) in [
+        (
+            "out-of-root path dependency",
+            "[package]\nname = \"consumer\"\nversion = \"0.0.0\"\nedition = \"2021\"\n\n[dependencies]\ncfg-if = \"1.0.0\"\nlib = { path = \"../lib\" }\n",
+            None,
+        ),
+        (
+            "glob-matched symlinked member",
+            "[workspace]\nmembers = [\"crates/*\"]\n\n[package]\nname = \"consumer\"\nversion = \"0.0.0\"\nedition = \"2021\"\n\n[dependencies]\ncfg-if = \"1.0.0\"\n",
+            Some("crates/lib"),
+        ),
+        (
+            "literal symlinked member",
+            "[workspace]\nmembers = [\"lib\"]\n\n[package]\nname = \"consumer\"\nversion = \"0.0.0\"\nedition = \"2021\"\n\n[dependencies]\ncfg-if = \"1.0.0\"\n",
+            Some("lib"),
+        ),
+    ] {
+        let tmp = tempfile::tempdir().unwrap();
+        let outside = tmp.path().join("lib");
+        std::fs::create_dir_all(&outside).unwrap();
+        std::fs::write(outside.join("Cargo.toml"), lib_manifest).unwrap();
+        let app = tmp.path().join("app");
+        std::fs::create_dir_all(&app).unwrap();
+        std::fs::write(app.join("Cargo.toml"), root_manifest).unwrap();
+        std::fs::write(app.join("Cargo.lock"), lock).unwrap();
+        if let Some(link) = link {
+            let at = app.join(link);
+            std::fs::create_dir_all(at.parent().unwrap()).unwrap();
+            std::os::unix::fs::symlink(&outside, at).unwrap();
+        }
+        write_vendored_crate(&app, "cfg-if", "1.0.0");
+
+        let env = run_redirect_subprocess(&app, &server.uri());
+        assert_eq!(env["redirect"]["redirected"], 0, "{shape}: {env}");
+        let warning = env["redirect"]["warnings"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .find(|w| w["code"] == "redirect_cargo_transitive_dependents")
+            .unwrap_or_else(|| panic!("{shape}: {env}"));
+        let detail = warning["detail"].as_str().unwrap();
+        assert!(
+            detail.contains("lib 0.1.0 (a path package") && detail.contains("--mode vendored"),
+            "{shape}: {detail}"
+        );
+        assert_eq!(
+            std::fs::read_to_string(outside.join("Cargo.toml")).unwrap(),
+            lib_manifest,
+            "{shape}: a manifest outside the project is never written"
+        );
+        assert_eq!(
+            std::fs::read_to_string(app.join("Cargo.toml")).unwrap(),
+            root_manifest,
+            "{shape}"
+        );
+        assert_eq!(std::fs::read_to_string(app.join("Cargo.lock")).unwrap(), lock, "{shape}");
+        assert!(!app.join(".cargo").exists(), "{shape}");
+    }
+}
+
 /// AUDIT A2 (green side): the multi-line `[dependencies.<name>]` table form —
 /// with NO Cargo.lock — is fully pinned: the manifest entry gains a registry
 /// line, the managed registry block is wired in, and the patch is recorded +
diff --git a/crates/socket-patch-cli/tests/mode_migration_cargo.rs b/crates/socket-patch-cli/tests/mode_migration_cargo.rs
index d8cd2fb6..de3d8197 100644
--- a/crates/socket-patch-cli/tests/mode_migration_cargo.rs
+++ b/crates/socket-patch-cli/tests/mode_migration_cargo.rs
@@ -1087,6 +1087,9 @@ async fn vendor_over_hosted_without_ledger_is_refused() {
     let purl = format!("pkg:cargo/{DEP}@{version}");
     let orig = std::fs::read(crate_dir.join("src/lib.rs")).unwrap();
     let patched: Vec<u8> = [orig.as_slice(), PATCH_SUFFIX.as_bytes()].concat();
+    // Kept for the second arm: the pristine crates.io lock a checkout
+    // restores over the redirected one.
+    let pristine_lock = std::fs::read_to_string(proj.join("Cargo.lock")).unwrap();
 
     let server = MockServer::start().await;
     let crate_bytes =
@@ -1142,4 +1145,49 @@ async fn vendor_over_hosted_without_ledger_is_refused() {
     assert!(!read(&proj, ".cargo/config.toml").contains("[patch.crates-io]"));
     assert!(!read(&proj, "Cargo.toml").contains("[patch.crates-io]"));
     assert!(!vendor_ledger_claims(&proj, &purl));
+
+    // The half-reverted state this guard really exists for: the lock is
+    // back on crates.io (restored from version control, or re-resolved)
+    // while the manifest pin survives — here in the TABLE form the hosted
+    // rewriter writes for a `[dependencies.<crate>]` declaration, which a
+    // `<name> = { … }` probe reads as "not redirected".
+    let registry = toml_before
+        .split("registry = \"")
+        .nth(1)
+        .and_then(|rest| rest.split('"').next())
+        .expect("the hosted scan pinned a socket-patch registry")
+        .to_string();
+    assert!(registry.starts_with("socket-patch-"), "{registry}");
+    std::fs::write(proj.join("Cargo.lock"), &pristine_lock).unwrap();
+    std::fs::write(
+        proj.join("Cargo.toml"),
+        format!(
+            "[package]\nname = \"consumer\"\nversion = \"0.1.0\"\nedition = \"2021\"\n\n\
+             [dependencies.{DEP}]\nversion = \"1.0\"\nregistry = \"{registry}\"\n"
+        ),
+    )
+    .unwrap();
+    let table_toml = read(&proj, "Cargo.toml");
+    let (code, stdout, stderr) = run_socket(
+        &proj,
+        &[
+            "vendor",
+            "--json",
+            "--offline",
+            "--cwd",
+            proj.to_str().unwrap(),
+        ],
+        &cargo_home,
+    );
+    assert_eq!(
+        code, 1,
+        "the table-form pin must fail closed too: {stdout}\n{stderr}"
+    );
+    assert!(
+        stdout.contains("hosted_redirect_live"),
+        "actionable refusal code missing: {stdout}"
+    );
+    assert_eq!(read(&proj, "Cargo.toml"), table_toml);
+    assert_eq!(read(&proj, "Cargo.lock"), pristine_lock);
+    assert!(!vendor_ledger_claims(&proj, &purl));
 }
diff --git a/crates/socket-patch-core/src/patch/redirect/mod.rs b/crates/socket-patch-core/src/patch/redirect/mod.rs
index 8c885688..ebcd2fab 100644
--- a/crates/socket-patch-core/src/patch/redirect/mod.rs
+++ b/crates/socket-patch-core/src/patch/redirect/mod.rs
@@ -733,8 +733,51 @@ fn rewrite_cargo(
     if cargo.is_empty() {
         return;
     }
-    let mut cargo_toml = files.get("Cargo.toml").cloned();
-    let mut cargo_lock = files.get("Cargo.lock").cloned();
+    // The root manifest first, then every workspace-member manifest the
+    // caller supplied (`<dir>/Cargo.toml`): a member's own declaration of the
+    // crate resolves exactly like the root's, so it must be pinned too, or
+    // the lock's repointed entry is unsatisfiable (`--locked` fails) while
+    // the dep is reported redirected.
+    let mut manifests: Vec<(String, String)> = files
+        .iter()
+        .filter(|(k, _)| k.as_str() == "Cargo.toml")
+        .chain(
+            files
+                .iter()
+                .filter(|(k, _)| is_cargo_member_manifest_key(k)),
+        )
+        .map(|(k, v)| (k.clone(), v.clone()))
+        .collect();
+    // Every planner below matches LF text. A file whose every line ends in
+    // CRLF (a Windows checkout) is planned as LF and written back — edit
+    // fragments included, so `remove` finds them — as CRLF. Mixed endings
+    // stay as they are (and refuse where the LF grammar does not match).
+    let mut crlf_paths: std::collections::BTreeSet<String> = std::collections::BTreeSet::new();
+    let mut to_lf = |path: &str, text: String| -> String {
+        match crlf_to_lf(&text) {
+            Some(lf) => {
+                crlf_paths.insert(path.to_string());
+                lf
+            }
+            None => text,
+        }
+    };
+    for (path, text) in manifests.iter_mut() {
+        *text = to_lf(path, std::mem::take(text));
+    }
+    // Each manifest's own `[package] name` — how Cargo.lock names the
+    // source-less (workspace / path) package it declares.
+    let manifest_packages: Vec<Option<String>> = manifests
+        .iter()
+        .map(|(_, text)| cargo_manifest_package_name(text))
+        .collect();
+    let edits_before = result.edits.len();
+    let mut changed_manifests: std::collections::BTreeSet<String> =
+        std::collections::BTreeSet::new();
+    let mut cargo_lock = files
+        .get("Cargo.lock")
+        .cloned()
+        .map(|t| to_lf("Cargo.lock", t));
     // Cargo reads the LEGACY extensionless `.cargo/config` in preference to
     // `config.toml` when both exist (it warns about the duplicate), so a
     // managed `[registries.…]` block written to `config.toml` there is
@@ -746,8 +789,12 @@ fn rewrite_cargo(
     } else {
         ".cargo/config.toml"
     };
-    let mut cargo_config = files.get(cargo_config_key).cloned().unwrap_or_default();
-    let (mut toml_changed, mut lock_changed, mut config_changed) = (false, false, false);
+    let mut cargo_config = files
+        .get(cargo_config_key)
+        .cloned()
+        .map(|t| to_lf(cargo_config_key, t))
+        .unwrap_or_default();
+    let (mut lock_changed, mut config_changed) = (false, false);
 
     for dep in &cargo {
         let Some(ov) = registry_override_of_kind(dep, "cargo-sparse") else {
@@ -816,7 +863,7 @@ fn rewrite_cargo(
         // 1. Plan the Cargo.toml pin FIRST — it is the gate for everything
         // else. Without a manifest pin nothing forces resolution through the
         // managed registry, so no other file may be touched for this dep.
-        let Some(toml_text) = cargo_toml.as_ref() else {
+        if !manifests.iter().any(|(k, _)| k == "Cargo.toml") {
             result.warnings.push(RewriteWarning {
                 code: "redirect_cargo_toml_dep_not_found".into(),
                 detail: format!(
@@ -825,40 +872,126 @@ fn rewrite_cargo(
                 ),
             });
             continue;
-        };
-        let toml_plan = match plan_cargo_toml(toml_text, &dep.name, &reg) {
-            Ok(plan) => plan,
-            Err(CargoTomlPlanError::NotFound) => {
+        }
+        let other_versions =
+            cargo_lock_other_versions(cargo_lock.as_deref(), &dep.name, &dep.version);
+        // The root manifest's `[workspace.dependencies]` verdicts feed its
+        // members' `workspace = true` inheritors.
+        let mut root_workspace: BTreeMap<String, CargoWorkspaceEntry> = BTreeMap::new();
+        let mut toml_plans: Vec<(usize, CargoTomlPlan)> = Vec::new();
+        let mut excluded: Vec<(String, String)> = Vec::new();
+        let mut refused: Option<(String, String)> = None;
+        for (i, (path, text)) in manifests.iter().enumerate() {
+            match plan_cargo_toml(
+                text,
+                path,
+                &dep.name,
+                &dep.version,
+                &other_versions,
+                &reg,
+                &root_workspace,
+            ) {
+                Ok(plan) => {
+                    if path == "Cargo.toml" {
+                        root_workspace = plan.workspace.clone();
+                    }
+                    excluded.extend(plan.excluded.iter().map(|req| (path.clone(), req.clone())));
+                    if plan.found {
+                        toml_plans.push((i, plan));
+                    }
+                }
+                Err(reason) => {
+                    refused = Some((path.clone(), reason));
+                    break;
+                }
+            }
+        }
+        if let Some((path, reason)) = refused {
+            result.warnings.push(RewriteWarning {
+                code: "redirect_cargo_toml_dep_unrewritable".into(),
+                detail: format!(
+                    "{} in {path} cannot be pinned ({reason}); dependency skipped \
+                     (nothing rewritten)",
+                    dep.name
+                ),
+            });
+            continue;
+        }
+        // Declared, but no declaration's requirement accepts the patched
+        // version: cargo resolves each to another version, so a pin cannot
+        // reach the locked one (the TS twin's requirement-coverage refusal).
+        if toml_plans.is_empty() && !excluded.is_empty() {
+            result.warnings.push(RewriteWarning {
+                code: "redirect_cargo_toml_dep_unrewritable".into(),
+                detail: cargo_requirement_excludes_detail(
+                    &dep.name,
+                    &dep.version,
+                    &excluded,
+                    cargo_lock.as_deref(),
+                ),
+            });
+            continue;
+        }
+        if toml_plans.is_empty() {
+            result.warnings.push(RewriteWarning {
+                code: "redirect_cargo_toml_dep_not_found".into(),
+                detail: cargo_not_declared_detail(
+                    &dep.name,
+                    &dep.version,
+                    manifests.len(),
+                    cargo_lock.as_deref(),
+                ),
+            });
+            continue;
+        }
+        // A pin reaches only the declarations it sits on: every OTHER lock
+        // package depending on the crate — a registry/git crate, or a path
+        // package whose manifest was not planned (outside the project, behind
+        // a symlink) — keeps resolving it from crates.io, so the repointed
+        // lock is unsatisfiable and that consumer compiles the unpatched copy.
+        if let Some(lock_text) = cargo_lock.as_deref() {
+            let pinned_packages: std::collections::BTreeSet<&str> = toml_plans
+                .iter()
+                .filter_map(|(i, _)| manifest_packages[*i].as_deref())
+                .collect();
+            let blocking =
+                cargo_unpinnable_dependents(lock_text, &dep.name, &dep.version, &pinned_packages);
+            if !blocking.is_empty() {
                 result.warnings.push(RewriteWarning {
-                    code: "redirect_cargo_toml_dep_not_found".into(),
-                    detail: format!(
-                        "no [dependencies] entry for {} in Cargo.toml; dependency skipped \
-                         (nothing rewritten)",
-                        dep.name
-                    ),
+                    code: "redirect_cargo_transitive_dependents".into(),
+                    detail: cargo_transitive_dependents_detail(&dep.name, &dep.version, &blocking),
                 });
                 continue;
             }
-            Err(CargoTomlPlanError::Refused(reason)) => {
+        } else {
+            // NO Cargo.lock: the resolved graph the check above reads does
+            // not exist, so nothing here can say whether some other
+            // dependency's own graph also pulls in the crate. Any other
+            // declared dependency might, and the pin reaches only the
+            // declarations it sits on — that consumer would compile the
+            // unpatched crates.io copy while the scan reports the crate
+            // redirected and VEX attests it. Fail closed, exactly as the
+            // locked path does for a dependent it CAN see; a project whose
+            // only dependency is the patched crate has nothing that could
+            // pull it in, and still redirects.
+            let others = cargo_lockless_other_dependencies(&manifests, &dep.name);
+            if !others.is_empty() {
                 result.warnings.push(RewriteWarning {
-                    code: "redirect_cargo_toml_dep_unrewritable".into(),
-                    detail: format!(
-                        "{} in Cargo.toml cannot be pinned ({reason}); dependency skipped \
-                         (nothing rewritten)",
-                        dep.name
-                    ),
+                    code: "redirect_cargo_lockless_dependents".into(),
+                    detail: cargo_lockless_dependents_detail(&dep.name, &dep.version, &others),
                 });
                 continue;
             }
-        };
+        }
 
         // 2. Plan the Cargo.lock repoint. A lock that exists but has no
         // [[package]] for the dep means the project does not actually resolve
         // it — rewriting the manifest anyway would desync manifest and lock.
         // Skip the dep entirely (discarding the manifest plan). A project
-        // with NO lockfile is fine: the manifest pin alone forces the next
-        // resolution through the managed registry, which serves the patched
-        // checksum.
+        // with NO lockfile reaches here only when the patched crate is its
+        // one declared dependency (the dependents gate above): the manifest
+        // pin alone then forces the next resolution through the managed
+        // registry, which serves the patched checksum.
         enum LockCommit {
             Write(String, Vec<FileEdit>),
             InPlace,
@@ -908,10 +1041,12 @@ fn rewrite_cargo(
             result.edits.push(plan.edit);
             config_changed = true;
         }
-        if toml_plan.changed {
-            cargo_toml = Some(toml_plan.content);
-            result.edits.extend(toml_plan.edits);
-            toml_changed = true;
+        for (i, plan) in toml_plans {
+            if plan.changed {
+                changed_manifests.insert(manifests[i].0.clone());
+                manifests[i].1 = plan.content;
+                result.edits.extend(plan.edits);
+            }
         }
         match lock_commit {
             LockCommit::Write(content, edits) => {
@@ -924,19 +1059,367 @@ fn rewrite_cargo(
         result.confirmed_cargo_uuids.insert(dep.patch_uuid.clone());
     }
 
-    if toml_changed {
-        if let Some(t) = cargo_toml {
-            result.files.insert("Cargo.toml".into(), t);
+    let restore = |path: &str, text: String| -> String {
+        if crlf_paths.contains(path) {
+            text.replace('\n', "\r\n")
+        } else {
+            text
+        }
+    };
+    for edit in &mut result.edits[edits_before..] {
+        if crlf_paths.contains(&edit.path) {
+            for fragment in [&mut edit.original, &mut edit.new] {
+                if let Some(Value::String(text)) = fragment {
+                    *text = text.replace('\n', "\r\n");
+                }
+            }
+        }
+    }
+    for (path, text) in manifests {
+        if changed_manifests.contains(&path) {
+            let text = restore(&path, text);
+            result.files.insert(path, text);
         }
     }
     if lock_changed {
         if let Some(l) = cargo_lock {
-            result.files.insert("Cargo.lock".into(), l);
+            result
+                .files
+                .insert("Cargo.lock".into(), restore("Cargo.lock", l));
         }
     }
     if config_changed {
-        result.files.insert(cargo_config_key.into(), cargo_config);
+        result.files.insert(
+            cargo_config_key.into(),
+            restore(cargo_config_key, cargo_config),
+        );
+    }
+}
+
+/// `text` with every CRLF turned into LF, when every line break in it is a
+/// CRLF (and there is at least one); `None` for LF-only or mixed text.
+fn crlf_to_lf(text: &str) -> Option<String> {
+    let crlf = text.matches("\r\n").count();
+    (crlf > 0 && crlf == text.matches('\n').count()).then(|| text.replace("\r\n", "\n"))
+}
+
+/// A workspace-member manifest key the caller supplied: `<dir>/Cargo.toml`,
+/// a plain repo-relative path (never absolute, never `..`, never under the
+/// ledger's `.socket/` or a build `target/`).
+fn is_cargo_member_manifest_key(key: &str) -> bool {
+    let Some(dir) = key.strip_suffix("/Cargo.toml") else {
+        return false;
+    };
+    !dir.is_empty()
+        && !key.starts_with('/')
+        && !key.contains('\\')
+        && !key.contains(':')
+        && dir.split('/').all(|seg| {
+            !seg.is_empty() && seg != "." && seg != ".." && seg != ".socket" && seg != "target"
+        })
+}
+
+/// The not-declared warning for a crate no manifest names at the patched
+/// version. A crate Cargo.lock nonetheless resolves is a TRANSITIVE-only
+/// dependency: a `registry = "…"` pin reaches only the declaration it sits
+/// on, so hosted mode cannot redirect it at all — say so, and name the mode
+/// that can (vendored `[patch.crates-io]` applies to the whole graph).
+fn cargo_not_declared_detail(
+    crate_name: &str,
+    version: &str,
+    manifests: usize,
+    lock: Option<&str>,
+) -> String {
+    let scope = if manifests > 1 {
+        format!("any of the {manifests} workspace manifests")
+    } else {
+        "Cargo.toml".to_string()
+    };
+    let head = format!("[[package]]\nname = \"{crate_name}\"\nversion = \"{version}\"\n");
+    let transitive = lock.is_some_and(|lock| {
+        lock.match_indices(head.as_str())
+            .any(|(at, _)| at == 0 || lock.as_bytes()[at - 1] == b'\n')
+    });
+    if transitive {
+        format!(
+            "{crate_name}@{version} is a transitive-only dependency (Cargo.lock resolves it, \
+             but no [dependencies] entry in {scope} declares it); hosted mode can pin only \
+             direct dependencies, so it was NOT redirected and stays unpatched — patch it with \
+             `socket-patch scan --mode vendored`, or declare it directly and re-run \
+             (nothing rewritten)"
+        )
+    } else {
+        format!(
+            "no [dependencies] entry for {crate_name} in {scope}; dependency skipped \
+             (nothing rewritten)"
+        )
+    }
+}
+
+/// The refusal for a crate every declaration of which requires another
+/// version (`excluded`: each declaring manifest and its requirement).
+fn cargo_requirement_excludes_detail(
+    crate_name: &str,
+    version: &str,
+    excluded: &[(String, String)],
+    lock: Option<&str>,
+) -> String {
+    let declared = excluded
+        .iter()
+        .map(|(path, req)| format!("\"{req}\" in {path}"))
+        .collect::<Vec<_>>()
+        .join(", ");
+    let head = format!("[[package]]\nname = \"{crate_name}\"\nversion = \"{version}\"\n");
+    let locked = lock.is_some_and(|lock| {
+        lock.match_indices(head.as_str())
+            .any(|(at, _)| at == 0 || lock.as_bytes()[at - 1] == b'\n')
+    });
+    let remedy = if locked {
+        "; Cargo.lock resolves it for another package, which a pin cannot reach — patch it \
+         with `socket-patch scan --mode vendored`"
+    } else {
+        ""
+    };
+    format!(
+        "{crate_name} is declared as {declared}, which {version} does not satisfy (cargo \
+         resolves that declaration to another version){remedy}; dependency skipped (nothing \
+         rewritten)"
+    )
+}
+
+/// The `[package] name` a manifest declares (`None` for a virtual workspace
+/// root or an unparseable file).
+fn cargo_manifest_package_name(text: &str) -> Option<String> {
+    let doc = text.parse::<toml_edit::DocumentMut>().ok()?;
+    doc.get("package")?
+        .get("name")?
+        .as_str()
+        .map(str::to_string)
+}
+
+/// The Cargo.lock packages that depend on `crate_name@version` and that a
+/// manifest pin cannot reach: any package with a `source` (a registry or
+/// git crate), and any source-less (workspace / path) package whose
+/// manifest is not among `pinned_packages`. Dependency edges are matched
+/// in every spelling — `"name"`, `"name version"` and the full
+/// `"name version (source)"` id — so a v1 lock and a twin's full id are
+/// covered alike. A lock that does not parse yields one entry saying so.
+fn cargo_unpinnable_dependents(
+    lock: &str,
+    crate_name: &str,
+    version: &str,
+    pinned_packages: &std::collections::BTreeSet<&str>,
+) -> Vec<String> {
+    let Ok(doc) = lock.parse::<toml_edit::DocumentMut>() else {
+        return vec!["Cargo.lock (it does not parse as TOML)".to_string()];
+    };
+    let Some(packages) = doc
+        .get("package")
+        .and_then(toml_edit::Item::as_array_of_tables)
+    else {
+        return Vec::new();
+    };
+    let mut out = Vec::new();
+    for package in packages.iter() {
+        let field = |key: &str| package.get(key).and_then(toml_edit::Item::as_str);
+        let (Some(name), Some(pkg_version)) = (field("name"), field("version")) else {
+            continue;
+        };
+        let depends = package
+            .get("dependencies")
+            .and_then(toml_edit::Item::as_array)
+            .is_some_and(|deps| {
+                deps.iter().filter_map(|d| d.as_str()).any(|d| {
+                    let mut parts = d.splitn(3, ' ');
+                    parts.next() == Some(crate_name) && parts.next().is_none_or(|v| v == version)
+                })
+            });
+        if !depends {
+            continue;
+        }
+        match field("source") {
+            Some(source) => {
+                let kind = if source.starts_with("git+") {
+                    "git"
+                } else {
+                    "registry"
+                };
+                out.push(format!("{name} {pkg_version} ({kind})"));
+            }
+            None if !pinned_packages.contains(name) => {
+                out.push(format!(
+                    "{name} {pkg_version} (a path package whose Cargo.toml is outside the \
+                     project or not rewritable)"
+                ));
+            }
+            None => {}
+        }
+    }
+    out
+}
+
+/// Dependencies OTHER than `crate_name` declared across the manifests this
+/// rewriter can pin, as `<name> (in <manifest>)`. This is the question a
+/// Cargo.lock answers outright; without one, every such dependency is a
+/// possible second consumer of the patched crate. A path dependency on a
+/// manifest in this same list is NOT one of them — that package's own
+/// declarations are listed here too — and a `workspace = true` inheritor
+/// resolves to the root's `[workspace.dependencies]` entry, which is.
+/// A manifest that does not parse is itself blocking (fail closed).
+fn cargo_lockless_other_dependencies(
+    manifests: &[(String, String)],
+    crate_name: &str,
+) -> Vec<String> {
+    fn field<'a>(entry: &'a toml_edit::Item, key: &str) -> Option<&'a str> {
+        match entry {
+            toml_edit::Item::Table(t) => t.get(key).and_then(toml_edit::Item::as_str),
+            toml_edit::Item::Value(v) => v
+                .as_inline_table()
+                .and_then(|t| t.get(key))
+                .and_then(toml_edit::Value::as_str),
+            _ => None,
+        }
+    }
+    fn flag(entry: &toml_edit::Item, key: &str) -> bool {
+        match entry {
+            toml_edit::Item::Table(t) => t.get(key).and_then(toml_edit::Item::as_bool),
+            toml_edit::Item::Value(v) => v
+                .as_inline_table()
+                .and_then(|t| t.get(key))
+                .and_then(toml_edit::Value::as_bool),
+            _ => None,
+        }
+        .unwrap_or(false)
+    }
+    const KINDS: [&str; 3] = ["dependencies", "dev-dependencies", "build-dependencies"];
+    let known: std::collections::BTreeSet<&str> =
+        manifests.iter().map(|(k, _)| k.as_str()).collect();
+    let mut out: Vec<String> = Vec::new();
+    for (path, text) in manifests {
+        let dir = path.strip_suffix("/Cargo.toml").unwrap_or("");
+        let Ok(doc) = text.parse::<toml_edit::DocumentMut>() else {
+            out.push(format!("{path} (it does not parse as TOML)"));
+            continue;
+        };
+        let scan = |item: Option<&toml_edit::Item>, out: &mut Vec<String>| {
+            let Some(table) = item.and_then(toml_edit::Item::as_table_like) else {
+                return;
+            };
+            for (key, entry) in table.iter() {
+                let name = field(entry, "package").unwrap_or(key);
+                if name == crate_name || flag(entry, "workspace") {
+                    continue;
+                }
+                if let Some(rel) = field(entry, "path") {
+                    let inside = crate::utils::cargo_workspace::normalize_rel(dir, rel)
+                        .is_some_and(|d| {
+                            d.is_empty() || known.contains(format!("{d}/Cargo.toml").as_str())
+                        });
+                    if inside {
+                        continue;
+                    }
+                }
+                let named = if path == "Cargo.toml" {
+                    name.to_string()
+                } else {
+                    format!("{name} (in {path})")
+                };
+                if !out.contains(&named) {
+                    out.push(named);
+                }
+            }
+        };
+        for kind in KINDS {
+            scan(doc.get(kind), &mut out);
+        }
+        if let Some(targets) = doc.get("target").and_then(toml_edit::Item::as_table) {
+            for (_, target) in targets.iter() {
+                let Some(target) = target.as_table() else {
+                    continue;
+                };
+                for kind in KINDS {
+                    scan(target.get(kind), &mut out);
+                }
+            }
+        }
+        if let Some(ws) = doc.get("workspace").and_then(toml_edit::Item::as_table) {
+            scan(ws.get("dependencies"), &mut out);
+            // A member manifest this run did not read is a second consumer
+            // nothing can rule out: it may declare the crate itself (a pin
+            // never reaches it) or a dependency that pulls it in. Member
+            // discovery drops what it must not follow — a symbolic link, a
+            // path outside the project — and a glob's expansion is not
+            // visible here at all, so only a literal member whose manifest
+            // IS in this run's set is accounted for.
+            let members = ws
+                .get("members")
+                .and_then(toml_edit::Item::as_array)
+                .into_iter()
+                .flat_map(|a| a.iter().filter_map(toml_edit::Value::as_str));
+            for member in members {
+                let named = if member.contains(['*', '?']) {
+                    format!("the workspace members pattern `{member}`")
+                } else if crate::utils::cargo_workspace::normalize_rel(dir, member)
+                    .is_some_and(|d| known.contains(format!("{d}/Cargo.toml").as_str()))
+                {
+                    continue;
+                } else {
+                    format!("the workspace member `{member}`")
+                };
+                if !out.contains(&named) {
+                    out.push(named);
+                }
+            }
+        }
+    }
+    out
+}
+
+/// The refusal for a lockless project that declares other dependencies.
+fn cargo_lockless_dependents_detail(crate_name: &str, version: &str, others: &[String]) -> String {
+    const SHOWN: usize = 5;
+    let mut names = others
+        .iter()
+        .take(SHOWN)
+        .cloned()
+        .collect::<Vec<_>>()
+        .join(", ");
+    if others.len() > SHOWN {
+        names.push_str(&format!(" and {} more", others.len() - SHOWN));
+    }
+    format!(
+        "this project has no Cargo.lock, so nothing says whether {names} also pull in \
+         {crate_name}@{version}; a `registry = …` pin reaches only the declarations it sits \
+         on, so such a consumer would compile the unpatched crates.io copy while \
+         {crate_name} is reported redirected — commit a lockfile (`cargo generate-lockfile`) \
+         and re-run, or patch it with `socket-patch scan --mode vendored`, whose \
+         `[patch.crates-io]` covers the whole graph (nothing rewritten)"
+    )
+}
+
+/// The refusal for a crate other lock packages also depend on.
+fn cargo_transitive_dependents_detail(
+    crate_name: &str,
+    version: &str,
+    blocking: &[String],
+) -> String {
+    const SHOWN: usize = 5;
+    let mut names = blocking
+        .iter()
+        .take(SHOWN)
+        .cloned()
+        .collect::<Vec<_>>()
+        .join(", ");
+    if blocking.len() > SHOWN {
+        names.push_str(&format!(" and {} more", blocking.len() - SHOWN));
     }
+    format!(
+        "{crate_name}@{version} is also a dependency of {names} in Cargo.lock; a `registry = …` \
+         pin reaches only the declarations it sits on, so those would keep resolving \
+         {crate_name} from crates.io (a `--locked` build fails, and the unpatched copy is \
+         compiled) — it was NOT redirected and stays unpatched; patch it with \
+         `socket-patch scan --mode vendored` (nothing rewritten)"
+    )
 }
 
 /// Sparse index URLs land verbatim inside quoted TOML strings in both
@@ -1218,15 +1701,17 @@ struct CargoTomlPlan {
     /// `false` when every occurrence already carried our registry (idempotent
     /// re-run) — the pin is in place, nothing to write.
     changed: bool,
-}
-
-enum CargoTomlPlanError {
-    /// The crate is not declared anywhere in this manifest (rename-aware:
-    /// a key that matches but has `package = "<other>"` is NOT the crate).
-    NotFound,
-    /// At least one occurrence exists that cannot be pinned to the managed
-    /// registry — the whole dep must be skipped.
-    Refused(String),
+    /// Whether this manifest declares the crate at the patched version at
+    /// all (rename-aware: a key that matches but has `package = "<other>"`
+    /// is NOT the crate). `false` plans nothing.
+    found: bool,
+    /// This manifest's `[workspace.dependencies]` verdicts, per key — what
+    /// its members' `workspace = true` inheritors resolve against.
+    workspace: BTreeMap<String, CargoWorkspaceEntry>,
+    /// The requirements of this manifest's declarations of the crate that
+    /// do NOT accept the patched version (cargo resolves each to another
+    /// version).
+    excluded: Vec<String>,
 }
 
 /// How one occurrence of the dep will be handled.
@@ -1274,11 +1759,98 @@ static CARGO_TOML_PATH_GIT_RE: LazyLock<Regex> = LazyLock::new(|| {
     Regex::new(r"\b(?:path|git)\s*=").expect("static path/git probe regex is valid")
 });
 
+static CARGO_TOML_VERSION_VAL_RE: LazyLock<Regex> = LazyLock::new(|| {
+    Regex::new(r#"\bversion\s*=\s*"([^"]*)""#).expect("static version-value regex is valid")
+});
+
+/// Whether one declaration's version requirement selects the patched
+/// version. Cargo resolves a declaration to ONE version, so a project that
+/// locks several versions of a crate (`cfg-if = "1"` beside a renamed
+/// `cfg-if-legacy = { package = "cfg-if", version = "0.1" }`) must pin
+/// only the declaration whose requirement matches the patched version —
+/// pinning every same-named declaration to one registry leaves the other
+/// requirement unsatisfiable there.
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub(crate) enum CargoReqMatch {
+    Ours,
+    NotOurs,
+    /// The requirement also matches another locked version (or cannot be
+    /// read while another version is locked): which one cargo picked for
+    /// this declaration cannot be told from the manifest.
+    Ambiguous,
+}
+
+pub(crate) fn cargo_req_selects(
+    req: Option<&str>,
+    version: &str,
+    other_versions: &[String],
+) -> CargoReqMatch {
+    let unknown = if other_versions.is_empty() {
+        CargoReqMatch::Ours
+    } else {
+        CargoReqMatch::Ambiguous
+    };
+    let (Some(req), Ok(patched)) = (req, semver::Version::parse(version)) else {
+        return unknown;
+    };
+    let Ok(req) = semver::VersionReq::parse(req.trim()) else {
+        return unknown;
+    };
+    if !req.matches(&patched) {
+        return CargoReqMatch::NotOurs;
+    }
+    let also_other = other_versions
+        .iter()
+        .any(|v| semver::Version::parse(v).is_ok_and(|v| req.matches(&v)));
+    if also_other {
+        CargoReqMatch::Ambiguous
+    } else {
+        CargoReqMatch::Ours
+    }
+}
+
+/// What a `[workspace.dependencies]` entry means for the patched version —
+/// resolved per entry KEY, since `workspace = true` inherits by key.
+#[derive(Debug, Clone, Copy, PartialEq)]
+enum CargoWorkspaceEntry {
+    /// The entry lands (or already carries) the pin.
+    Pinned,
+    /// The entry names the crate at another version.
+    OtherVersion,
+}
+
+/// Every version of `crate_name` a Cargo.lock holds other than `version`.
+fn cargo_lock_other_versions(lock: Option<&str>, crate_name: &str, version: &str) -> Vec<String> {
+    let Some(lock) = lock else {
+        return Vec::new();
+    };
+    let head = format!("[[package]]\nname = \"{crate_name}\"\nversion = \"");
+    let mut versions: Vec<String> = lock
+        .match_indices(head.as_str())
+        .filter(|&(at, _)| at == 0 || lock.as_bytes()[at - 1] == b'\n')
+        .filter_map(|(at, _)| {
+            let rest = &lock[at + head.len()..];
+            rest.split_once('"').map(|(v, _)| v.to_string())
+        })
+        .filter(|v| v != version)
+        .collect();
+    versions.sort();
+    versions.dedup();
+    versions
+}
+
+/// `Err` carries the refusal reason: an occurrence exists that cannot be
+/// pinned to the managed registry, so the whole dep must be skipped.
+/// `inherited` is the workspace root's verdicts when planning a member.
 fn plan_cargo_toml(
     content: &str,
+    path: &str,
     crate_name: &str,
+    version: &str,
+    other_versions: &[String],
     reg: &str,
-) -> Result<CargoTomlPlan, CargoTomlPlanError> {
+    inherited: &BTreeMap<String, CargoWorkspaceEntry>,
+) -> Result<CargoTomlPlan, String> {
     let lines: Vec<&str> = content.split('\n').collect();
     let header_re: &Regex = &CARGO_TOML_HEADER_RE;
     let package_re: &Regex = &CARGO_TOML_PACKAGE_RE;
@@ -1287,18 +1859,24 @@ fn plan_cargo_toml(
     let registry_index_re: &Regex = &CARGO_TOML_REGISTRY_INDEX_RE;
     let workspace_key_re: &Regex = &CARGO_TOML_WORKSPACE_KEY_RE;
     let path_git_re: &Regex = &CARGO_TOML_PATH_GIT_RE;
+    let version_val_re: &Regex = &CARGO_TOML_VERSION_VAL_RE;
+    let ambiguous =
+        || format!("its version requirement also matches another locked version of {crate_name}");
 
     // A pending occurrence: what was found, resolved to an action in pass 2
     // (workspace-inheriting entries need the whole file scanned first).
     enum Pending {
         Action(CargoTomlAction),
-        NeedsWorkspacePin,
+        /// `workspace = true` under this key.
+        NeedsWorkspacePin(String),
         Refuse(String),
     }
     let mut pending: Vec<Pending> = Vec::new();
-    // Whether the `[workspace.dependencies]` entry for the crate lands (or
-    // already carries) the pin — satisfies `workspace = true` inheritors.
-    let mut workspace_pinned = false;
+    // Per `[workspace.dependencies]` key naming the crate: whether that
+    // entry lands (or already carries) the pin — satisfies `workspace =
+    // true` inheritors of the same key — or names another version.
+    let mut ws_entries: BTreeMap<String, CargoWorkspaceEntry> = BTreeMap::new();
+    let mut excluded: Vec<String> = Vec::new();
 
     let mut section = CargoTomlSection::Other;
     for (idx, raw) in lines.iter().enumerate() {
@@ -1362,8 +1940,23 @@ fn plan_cargo_toml(
                         })
                     })
                 };
+                let req = find_value("version").map(|(_, v)| v);
+                let selects = if has("workspace") {
+                    CargoReqMatch::Ours
+                } else {
+                    cargo_req_selects(req.as_deref(), version, other_versions)
+                };
+                if selects == CargoReqMatch::NotOurs {
+                    excluded.extend(req);
+                    if ws {
+                        ws_entries.insert(key.clone(), CargoWorkspaceEntry::OtherVersion);
+                    }
+                    continue;
+                }
                 if has("workspace") {
-                    pending.push(Pending::NeedsWorkspacePin);
+                    pending.push(Pending::NeedsWorkspacePin(key.clone()));
+                } else if selects == CargoReqMatch::Ambiguous {
+                    pending.push(Pending::Refuse(ambiguous()));
                 } else if has("path") || has("git") {
                     pending.push(Pending::Refuse(
                         "declared as a path/git dependency".to_string(),
@@ -1377,7 +1970,7 @@ fn plan_cargo_toml(
                     if value == reg {
                         pending.push(Pending::Action(CargoTomlAction::Already));
                         if ws {
-                            workspace_pinned = true;
+                            ws_entries.insert(key.clone(), CargoWorkspaceEntry::Pinned);
                         }
                     } else if is_socket_patch_registry_name(&value) {
                         let old_line = lines[line_idx];
@@ -1389,7 +1982,7 @@ fn plan_cargo_toml(
                             new_text,
                         }));
                         if ws {
-                            workspace_pinned = true;
+                            ws_entries.insert(key.clone(), CargoWorkspaceEntry::Pinned);
                         }
                     } else {
                         pending.push(Pending::Refuse(format!(
@@ -1403,7 +1996,7 @@ fn plan_cargo_toml(
                         inserted: format!("{indent}registry = \"{reg}\""),
                     }));
                     if ws {
-                        workspace_pinned = true;
+                        ws_entries.insert(key.clone(), CargoWorkspaceEntry::Pinned);
                     }
                 }
             }
@@ -1422,7 +2015,7 @@ fn plan_cargo_toml(
             let sub = parse_cargo_entry_key(dotted).map(|(k, _)| k);
             if key == crate_name {
                 if sub.as_deref() == Some("workspace") {
-                    pending.push(Pending::NeedsWorkspacePin);
+                    pending.push(Pending::NeedsWorkspacePin(key.clone()));
                 } else {
                     pending.push(Pending::Refuse(
                         "declared with dotted keys this rewriter does not edit".to_string(),
@@ -1465,8 +2058,25 @@ fn plan_cargo_toml(
                 continue;
             }
             if workspace_key_re.is_match(inner) {
-                pending.push(Pending::NeedsWorkspacePin);
-            } else if path_git_re.is_match(inner) {
+                pending.push(Pending::NeedsWorkspacePin(key.clone()));
+                continue;
+            }
+            let req = version_val_re.captures(inner).map(|c| c[1].to_string());
+            match cargo_req_selects(req.as_deref(), version, other_versions) {
+                CargoReqMatch::NotOurs => {
+                    excluded.extend(req);
+                    if workspace {
+                        ws_entries.insert(key.clone(), CargoWorkspaceEntry::OtherVersion);
+                    }
+                    continue;
+                }
+                CargoReqMatch::Ambiguous => {
+                    pending.push(Pending::Refuse(ambiguous()));
+                    continue;
+                }
+                CargoReqMatch::Ours => {}
+            }
+            if path_git_re.is_match(inner) {
                 pending.push(Pending::Refuse(
                     "declared as a path/git dependency".to_string(),
                 ));
@@ -1475,7 +2085,7 @@ fn plan_cargo_toml(
                 if value == reg {
                     pending.push(Pending::Action(CargoTomlAction::Already));
                     if workspace {
-                        workspace_pinned = true;
+                        ws_entries.insert(key.clone(), CargoWorkspaceEntry::Pinned);
                     }
                 } else if is_socket_patch_registry_name(&value) {
                     let new_text = registry_val_re
@@ -1486,7 +2096,7 @@ fn plan_cargo_toml(
                         new_text,
                     }));
                     if workspace {
-                        workspace_pinned = true;
+                        ws_entries.insert(key.clone(), CargoWorkspaceEntry::Pinned);
                     }
                 } else {
                     pending.push(Pending::Refuse(format!(
@@ -1518,7 +2128,7 @@ fn plan_cargo_toml(
                     new_text,
                 }));
                 if workspace {
-                    workspace_pinned = true;
+                    ws_entries.insert(key.clone(), CargoWorkspaceEntry::Pinned);
                 }
             }
         } else if value.starts_with('"') {
@@ -1540,6 +2150,24 @@ fn plan_cargo_toml(
                 ));
                 continue;
             };
+            let req = m
+                .get(2)
+                .expect("line_re always captures group 2 (version)")
+                .as_str();
+            match cargo_req_selects(Some(req), version, other_versions) {
+                CargoReqMatch::NotOurs => {
+                    excluded.push(req.to_string());
+                    if workspace {
+                        ws_entries.insert(key.clone(), CargoWorkspaceEntry::OtherVersion);
+                    }
+                    continue;
+                }
+                CargoReqMatch::Ambiguous => {
+                    pending.push(Pending::Refuse(ambiguous()));
+                    continue;
+                }
+                CargoReqMatch::Ours => {}
+            }
             let new_text = format!(
                 "{}{{ version = \"{}\", registry = \"{reg}\" }}{}",
                 m.get(1)
@@ -1557,7 +2185,7 @@ fn plan_cargo_toml(
                 new_text,
             }));
             if workspace {
-                workspace_pinned = true;
+                ws_entries.insert(key.clone(), CargoWorkspaceEntry::Pinned);
             }
         } else if key == crate_name {
             pending.push(Pending::Refuse(
@@ -1566,8 +2194,16 @@ fn plan_cargo_toml(
         }
     }
 
+    let not_found = |ws_entries: BTreeMap<String, CargoWorkspaceEntry>| CargoTomlPlan {
+        content: content.to_string(),
+        edits: Vec::new(),
+        changed: false,
+        found: false,
+        workspace: ws_entries,
+        excluded: excluded.clone(),
+    };
     if pending.is_empty() {
-        return Err(CargoTomlPlanError::NotFound);
+        return Ok(not_found(ws_entries));
     }
     // Resolve: any refusal (including an unsatisfiable `workspace = true`
     // inheritor) refuses the WHOLE dep — no partial pin is ever applied.
@@ -1575,20 +2211,25 @@ fn plan_cargo_toml(
     for p in pending {
         match p {
             Pending::Action(a) => actions.push(a),
-            Pending::NeedsWorkspacePin => {
-                if workspace_pinned {
+            Pending::NeedsWorkspacePin(key) => match ws_entries.get(&key).or(inherited.get(&key)) {
+                Some(CargoWorkspaceEntry::Pinned) => {
                     actions.push(CargoTomlAction::InheritsWorkspace);
-                } else {
-                    return Err(CargoTomlPlanError::Refused(
-                        "inherits from [workspace.dependencies] with no rewritable entry \
-                         in this manifest"
-                            .to_string(),
-                    ));
                 }
-            }
-            Pending::Refuse(reason) => return Err(CargoTomlPlanError::Refused(reason)),
+                // Inherits another version of the crate: not this dep.
+                Some(CargoWorkspaceEntry::OtherVersion) => {}
+                None => {
+                    return Err("inherits from [workspace.dependencies] with no rewritable \
+                                entry for it"
+                        .to_string());
+                }
+            },
+            Pending::Refuse(reason) => return Err(reason),
         }
     }
+    // Every occurrence named another version (inheritors included).
+    if actions.is_empty() {
+        return Ok(not_found(ws_entries));
+    }
 
     // Apply bottom-up so line indices stay valid; record edits top-down.
     let mut new_lines: Vec<String> = lines.iter().map(|s| s.to_string()).collect();
@@ -1606,7 +2247,7 @@ fn plan_cargo_toml(
         match action {
             CargoTomlAction::ReplaceLine { new_text, .. } => {
                 edits.push(FileEdit {
-                    path: "Cargo.toml".into(),
+                    path: path.into(),
                     kind: "redirect_cargo_toml_dep".into(),
                     action: "rewritten".into(),
                     key: Some(crate_name.into()),
@@ -1616,7 +2257,7 @@ fn plan_cargo_toml(
             }
             CargoTomlAction::InsertAfterHeader { inserted, .. } => {
                 edits.push(FileEdit {
-                    path: "Cargo.toml".into(),
+                    path: path.into(),
                     kind: "redirect_cargo_toml_dep".into(),
                     action: "rewritten".into(),
                     key: Some(crate_name.into()),
@@ -1643,9 +2284,17 @@ fn plan_cargo_toml(
         content: new_lines.join("\n"),
         edits,
         changed,
+        found: true,
+        workspace: ws_entries,
+        excluded,
     })
 }
 
+/// The Cargo.lock edit kind for dependents' full-id references: `original`
+/// / `new` are the quoted `"<name> <version> (<source>)"` ids, keyed
+/// `<name>@<version>`, and the inverse replaces EVERY occurrence of `new`.
+pub(crate) const CARGO_LOCK_REFERENCE_KIND: &str = "redirect_cargo_lock_reference";
+
 static CARGO_LOCK_SOURCE_LINE_RE: LazyLock<Regex> = LazyLock::new(|| {
     Regex::new(r#"(?m)^source = "([^"]*)"$"#).expect("static lock source-line regex is valid")
 });
@@ -1673,8 +2322,9 @@ static CARGO_LOCK_AFTER_SOURCE_RE: LazyLock<Regex> = LazyLock::new(|| {
 /// Full-id references are rewritten in any format (v2+ spells them that way
 /// when a name + version is ambiguous). Each changed fragment is its own
 /// `redirect_cargo_lock_entry` edit (unique text, so the fragment revert is
-/// unambiguous): the entry, the `[metadata]` line, and each dependent's
-/// whole `[[package]]` block.
+/// unambiguous) — the entry and the `[metadata]` line — and the dependents'
+/// references are one `redirect_cargo_lock_reference` edit holding the
+/// quoted full id, reverted at every occurrence.
 fn plan_cargo_lock(
     content: &str,
     crate_name: &str,
@@ -1778,22 +2428,48 @@ fn plan_cargo_lock(
             edits.push(edit(&line, &pinned));
         }
     }
-    // Dependents' full-id references to the OLD source.
+    // Dependents' full-id references to the OLD source, recorded as ONE
+    // `redirect_cargo_lock_reference` edit holding just the quoted id —
+    // never a dependent's whole block: a block referencing two patched
+    // packages (the root of a v1 lock) would hold two overlapping block
+    // edits, and reverting the first-applied one alone found neither of its
+    // fragments. The id names this name + version + source exactly, so its
+    // inverse puts back EVERY occurrence, independently of any other
+    // package's edits and in any removal order.
     if let Some(old) = old_source.filter(|old| old != index_url) {
         let from = format!("\"{crate_name} {version} ({old})\"");
         let to = format!("\"{crate_name} {version} ({index_url})\"");
+        let mut repointed_any = false;
+        // The oldest v1 locks keep the ROOT package in a standalone `[root]`
+        // table instead of the `[[package]]` array, with its own full-id
+        // `dependencies`. It precedes the array, so the block walk below
+        // never reaches it and the lock would keep naming a package it no
+        // longer contains (`--locked` fails; an unlocked build silently
+        // re-resolves).
+        if let Some((start, end)) = lock_root_table(&new_content) {
+            if new_content[start..end].contains(&from) {
+                let repointed = new_content[start..end].replace(&from, &to);
+                new_content.replace_range(start..end, &repointed);
+                repointed_any = true;
+            }
+        }
         let mut cursor = 0;
         while let Some((start, end)) = next_lock_block(&new_content, cursor) {
-            let block = new_content[start..end].to_string();
-            if block.contains(&from) {
-                let repointed = block.replace(&from, &to);
+            if new_content[start..end].contains(&from) {
+                let repointed = new_content[start..end].replace(&from, &to);
                 new_content.replace_range(start..end, &repointed);
-                edits.push(edit(&block, &repointed));
+                repointed_any = true;
                 cursor = start + repointed.len();
             } else {
                 cursor = end;
             }
         }
+        if repointed_any {
+            edits.push(FileEdit {
+                kind: CARGO_LOCK_REFERENCE_KIND.into(),
+                ..edit(&from, &to)
+            });
+        }
     }
     // Already redirected (re-run): every fragment is at the target values; a
     // recorded edit would have original == new and grow the ledger forever.
@@ -1806,6 +2482,19 @@ fn plan_cargo_lock(
     }
 }
 
+/// The v1 `[root]` table's span, when the lock has one: cargo before the
+/// `[root]` removal recorded the root package there rather than in the
+/// `[[package]]` array, and its `dependencies` spell full package ids the
+/// same way. Bounded by [`lock_block_end`], like a package block.
+fn lock_root_table(content: &str) -> Option<(usize, usize)> {
+    const HEADER: &str = "[root]\n";
+    let at = content
+        .match_indices(HEADER)
+        .map(|(at, _)| at)
+        .find(|&at| at == 0 || content.as_bytes()[at - 1] == b'\n')?;
+    Some((at, lock_block_end(content, at + HEADER.len())))
+}
+
 /// The next `[[package]]` block starting at or after `from`, as
 /// [`lock_block_end`] bounds it.
 fn next_lock_block(content: &str, from: usize) -> Option<(usize, usize)> {
@@ -1922,6 +2611,10 @@ fn plan_cargo_config(
         ""
     };
     let prefix = if config.is_empty() { "" } else { "\n" };
+    // The newline a config without a final one needed rides in the recorded
+    // fragment, so the revert (which also drops the one blank separator
+    // before the fragment) restores the config's exact bytes.
+    let recorded = format!("{sep}{block}");
     Some(CargoConfigPlan {
         content: format!("{config}{sep}{prefix}{block}"),
         edit: FileEdit {
@@ -1930,7 +2623,7 @@ fn plan_cargo_config(
             action: "added".into(),
             key: Some(reg.to_string()),
             original: None,
-            new: Some(Value::String(block)),
+            new: Some(Value::String(recorded)),
         },
     })
 }
@@ -8072,15 +8765,129 @@ mod tests {
         assert_eq!(cargo_socket_registry_pin(&renamed_other, "serde"), None);
     }
 
-    fn cargo_lock_with(name: &str, version: &str) -> String {
-        format!(
-            "# This file is automatically @generated by Cargo.\n\
-             version = 3\n\
-             \n\
-             [[package]]\n\
-             name = \"{name}\"\n\
-             version = \"{version}\"\n\
-             source = \"registry+https://github.com/rust-lang/crates.io-index\"\n\
+    /// NO Cargo.lock: the transitive-dependents refusal reads the resolved
+    /// graph, and without one nothing says whether another dependency also
+    /// pulls in the patched crate — a pin reaches only the declarations it
+    /// sits on, so that consumer would compile the unpatched crates.io copy
+    /// while the scan reported the crate redirected and VEX attested it.
+    /// Every OTHER declared dependency is therefore blocking; a path
+    /// dependency on a manifest this run pins is not (its own declarations
+    /// are pinned too), and neither is a `workspace = true` inheritor of the
+    /// root table this run scans.
+    #[test]
+    fn cargo_lockless_other_dependencies_are_refused() {
+        let head = "[package]\nname = \"app\"\nversion = \"0.1.0\"\n\n";
+        let refused = |files: BTreeMap<String, String>| {
+            let r = rewrite_registry_redirect(&files, &[cargo_sparse_override()]);
+            assert!(r.files.is_empty(), "nothing rewritten: {:?}", r.files);
+            assert!(r.edits.is_empty(), "{:?}", r.edits);
+            assert!(r.confirmed_cargo_uuids.is_empty(), "never confirmed");
+            assert_eq!(
+                warning_codes(&r),
+                vec!["redirect_cargo_lockless_dependents"]
+            );
+            r.warnings[0].detail.clone()
+        };
+        let one = |toml: &str| {
+            let mut files = BTreeMap::new();
+            files.insert("Cargo.toml".to_string(), toml.to_string());
+            files
+        };
+
+        // A registry dependency beside the patched crate.
+        let detail = refused(one(&format!(
+            "{head}[dependencies]\nserde = \"1.0.190\"\ntokio = \"1\"\n"
+        )));
+        assert!(detail.contains("tokio"), "{detail}");
+        assert!(detail.contains("cargo generate-lockfile"), "{detail}");
+        assert!(detail.contains("--mode vendored"), "{detail}");
+        // A dev-dependency counts (it is linked into the test build too).
+        refused(one(&format!(
+            "{head}[dependencies]\nserde = \"1.0.190\"\n\n\
+             [dev-dependencies]\ntokio = \"1\"\n"
+        )));
+        // A path dependency this run cannot pin (outside the project).
+        let detail = refused(one(&format!(
+            "{head}[dependencies]\nserde = \"1.0.190\"\n\
+             shared = {{ path = \"../shared\" }}\n"
+        )));
+        assert!(detail.contains("shared"), "{detail}");
+        // A member's own other dependency blocks as well.
+        let mut files = one(&format!(
+            "[workspace]\nmembers = [\"b\"]\n\n{head}\
+             [dependencies]\nserde = \"1.0.190\"\n"
+        ));
+        files.insert(
+            "b/Cargo.toml".to_string(),
+            "[package]\nname = \"b\"\nversion = \"0.1.0\"\n\n\
+             [dependencies]\nrand = \"0.8\"\n"
+                .to_string(),
+        );
+        let detail = refused(files);
+        assert!(detail.contains("rand (in b/Cargo.toml)"), "{detail}");
+
+        // A member manifest this run did NOT read — dropped by member
+        // discovery (a symbolic link, a path outside the project) or hidden
+        // behind a glob it cannot expand — may declare the crate itself or
+        // pull it in, and nothing here can tell.
+        let detail = refused(one(
+            "[workspace]\nmembers = [\"b\"]\n\n[package]\nname = \"app\"\n\
+             version = \"0.1.0\"\n\n[dependencies]\nserde = \"1.0.190\"\n",
+        ));
+        assert!(detail.contains("the workspace member `b`"), "{detail}");
+        let detail = refused(one(
+            "[workspace]\nmembers = [\"crates/*\"]\n\n[package]\nname = \"app\"\n\
+             version = \"0.1.0\"\n\n[dependencies]\nserde = \"1.0.190\"\n",
+        ));
+        assert!(
+            detail.contains("the workspace members pattern `crates/*`"),
+            "{detail}"
+        );
+    }
+
+    /// The lockless shapes that stay redirectable: the patched crate alone,
+    /// the same crate declared again by a member this run pins, and a path
+    /// dependency on that member (whose own declarations are pinned too).
+    #[test]
+    fn cargo_lockless_self_contained_workspace_still_redirects() {
+        let mut files = BTreeMap::new();
+        files.insert(
+            "Cargo.toml".to_string(),
+            "[workspace]\nmembers = [\"b\"]\n\n\
+             [package]\nname = \"app\"\nversion = \"0.1.0\"\n\n\
+             [dependencies]\nserde = \"1.0.190\"\nb = { path = \"b\" }\n"
+                .to_string(),
+        );
+        files.insert(
+            "b/Cargo.toml".to_string(),
+            "[package]\nname = \"b\"\nversion = \"0.1.0\"\n\n\
+             [dependencies]\nserde = \"1.0.190\"\n"
+                .to_string(),
+        );
+        let r = rewrite_registry_redirect(&files, &[cargo_sparse_override()]);
+        assert!(r.warnings.is_empty(), "{:?}", r.warnings);
+        assert!(r.confirmed_cargo_uuids.contains(CARGO_UUID));
+        for key in ["Cargo.toml", "b/Cargo.toml"] {
+            assert!(
+                r.files
+                    .get(key)
+                    .is_some_and(|t| t.contains(&format!("registry = \"{}\"", cargo_reg()))),
+                "{key} must be pinned: {:?}",
+                r.files.get(key)
+            );
+        }
+        assert!(!r.files.contains_key("Cargo.lock"));
+    }
+
+    fn cargo_lock_with(name: &str, version: &str) -> String {
+        format!(
+            "# This file is automatically @generated by Cargo.\n\
+             version = 3\n\
+             \n\
+             [[package]]\n\
+             name = \"{name}\"\n\
+             version = \"{version}\"\n\
+             source = \"registry+https://github.com/rust-lang/crates.io-index\"\n\
              checksum = \"91f70896d6720bc714a4a57d22fc91f1db634680e65c8efe13323f1fa38d53f5\"\n"
         )
     }
@@ -8664,6 +9471,422 @@ mod tests {
         assert!(r.confirmed_cargo_uuids.is_empty());
     }
 
+    /// A second patched version of the crate, uuid distinct from
+    /// [`CARGO_UUID`].
+    const CARGO_UUID_2: &str = "3c5d7e9f-2a4b-4c6d-8e0f-1a3b5c7d9e1f";
+
+    fn cfg_if_override(version: &str, uuid: &str) -> DepOverride {
+        let mut dep = cargo_sparse_override();
+        dep.name = "cfg-if".into();
+        dep.version = version.into();
+        dep.patch_uuid = uuid.into();
+        let ov = dep.registry_override.as_mut().expect("fixture override");
+        ov.index_url = format!("sparse+https://patch.test/cargo/{uuid}/index/");
+        ov.identifiers.name = "cfg-if".into();
+        ov.identifiers.version = version.into();
+        dep
+    }
+
+    /// Both cfg-if versions locked from crates.io (the `multi-version` shape).
+    fn cfg_if_multi_files(manifest_deps: &str) -> BTreeMap<String, String> {
+        let block = |v: &str| {
+            format!(
+                "[[package]]\nname = \"cfg-if\"\nversion = \"{v}\"\n\
+                 source = \"registry+https://github.com/rust-lang/crates.io-index\"\n\
+                 checksum = \"{}\"\n",
+                "1".repeat(64)
+            )
+        };
+        let mut files = BTreeMap::new();
+        files.insert(
+            "Cargo.toml".to_string(),
+            format!("[package]\nname = \"app\"\nversion = \"0.1.0\"\n\n{manifest_deps}"),
+        );
+        files.insert(
+            "Cargo.lock".to_string(),
+            format!("version = 3\n\n{}\n{}", block("0.1.10"), block("1.0.4")),
+        );
+        files
+    }
+
+    const CFG_IF_MULTI_DEPS: &str = "[dependencies]\ncfg-if = \"1.0.4\"\n\
+         cfg-if-legacy = { package = \"cfg-if\", version = \"0.1.10\" }\n";
+
+    /// Bug B: the manifest pin matched the crate NAME only, so every
+    /// same-named declaration — `cfg-if-legacy = { package = "cfg-if",
+    /// version = "0.1.10" }` too — was pinned to the one patched version's
+    /// registry, where `^0.1.10` cannot resolve. Each declaration is pinned
+    /// only by the patch its version requirement selects.
+    #[test]
+    fn cargo_multi_version_pins_only_the_declaration_the_version_selects() {
+        let files = cfg_if_multi_files(CFG_IF_MULTI_DEPS);
+        let reg1 = format!("socket-patch-{CARGO_UUID}");
+        let reg2 = format!("socket-patch-{CARGO_UUID_2}");
+
+        let r = rewrite_registry_redirect(&files, &[cfg_if_override("1.0.4", CARGO_UUID)]);
+        let toml = r.files.get("Cargo.toml").expect("manifest pinned");
+        assert!(
+            toml.contains(&format!(
+                "cfg-if = {{ version = \"1.0.4\", registry = \"{reg1}\" }}\n"
+            )),
+            "{toml}"
+        );
+        assert!(
+            toml.contains("cfg-if-legacy = { package = \"cfg-if\", version = \"0.1.10\" }\n"),
+            "the 0.1.10 declaration is not the patched version's: {toml}"
+        );
+        assert!(r.warnings.is_empty(), "{:?}", r.warnings);
+
+        let r = rewrite_registry_redirect(&files, &[cfg_if_override("0.1.10", CARGO_UUID_2)]);
+        let toml = r.files.get("Cargo.toml").expect("manifest pinned");
+        assert!(toml.contains("cfg-if = \"1.0.4\"\n"), "{toml}");
+        assert!(
+            toml.contains(&format!(
+                "cfg-if-legacy = {{ package = \"cfg-if\", version = \"0.1.10\", registry = \"{reg2}\" }}"
+            )),
+            "{toml}"
+        );
+        let lock = r.files.get("Cargo.lock").expect("lock repointed");
+        assert!(
+            lock.contains(&format!(
+                "version = \"0.1.10\"\nsource = \"sparse+https://patch.test/cargo/{CARGO_UUID_2}/index/\""
+            )) && lock.contains(
+                "version = \"1.0.4\"\nsource = \"registry+https://github.com/rust-lang/crates.io-index\""
+            ),
+            "only the 0.1.10 entry moves: {lock}"
+        );
+
+        let r = rewrite_registry_redirect(
+            &files,
+            &[
+                cfg_if_override("1.0.4", CARGO_UUID),
+                cfg_if_override("0.1.10", CARGO_UUID_2),
+            ],
+        );
+        let toml = r.files.get("Cargo.toml").expect("manifest pinned");
+        assert!(
+            toml.contains(&format!("version = \"1.0.4\", registry = \"{reg1}\""))
+                && toml.contains(&format!("version = \"0.1.10\", registry = \"{reg2}\"")),
+            "{toml}"
+        );
+        assert_eq!(r.confirmed_cargo_uuids.len(), 2);
+    }
+
+    /// A requirement that also matches another locked version cannot be
+    /// attributed to the patched one — refuse the dep, write nothing.
+    #[test]
+    fn cargo_requirement_matching_several_locked_versions_refuses() {
+        let files = cfg_if_multi_files(
+            "[dependencies]\ncfg-if = \">=0.1\"\n\
+             cfg-if-legacy = { package = \"cfg-if\", version = \"0.1.10\" }\n",
+        );
+        let r = rewrite_registry_redirect(&files, &[cfg_if_override("1.0.4", CARGO_UUID)]);
+        assert!(r.files.is_empty() && r.edits.is_empty(), "{:?}", r.files);
+        assert_eq!(
+            warning_codes(&r),
+            vec!["redirect_cargo_toml_dep_unrewritable"]
+        );
+        assert!(r.confirmed_cargo_uuids.is_empty());
+    }
+
+    /// A declaration whose requirement excludes the patched version is not
+    /// the patched crate, and a pin there cannot reach the locked one: the
+    /// requirement-coverage refusal (the TS twin's code), nothing written.
+    #[test]
+    fn cargo_requirement_excluding_the_patched_version_is_unrewritable() {
+        let mut files = BTreeMap::new();
+        files.insert(
+            "Cargo.toml".to_string(),
+            "[package]\nname = \"app\"\nversion = \"0.1.0\"\n\n[dependencies]\nserde = \"2\"\n"
+                .to_string(),
+        );
+        let r = rewrite_registry_redirect(&files, &[cargo_sparse_override()]);
+        assert!(r.files.is_empty(), "{:?}", r.files);
+        assert_eq!(
+            warning_codes(&r),
+            vec!["redirect_cargo_toml_dep_unrewritable"]
+        );
+        assert!(
+            r.warnings[0].detail.contains("\"2\" in Cargo.toml"),
+            "{:?}",
+            r.warnings
+        );
+        assert!(r.confirmed_cargo_uuids.is_empty());
+    }
+
+    /// A `workspace = true` inheritor of the entry that names ANOTHER
+    /// version is not this dep (and does not refuse it).
+    #[test]
+    fn cargo_workspace_inheritor_of_another_version_is_skipped() {
+        let files = cfg_if_multi_files(
+            "[workspace.dependencies]\ncfg-if = \"1.0.4\"\n\
+             cfg-if-legacy = { package = \"cfg-if\", version = \"0.1.10\" }\n\n\
+             [dependencies]\ncfg-if = { workspace = true }\n\
+             cfg-if-legacy = { workspace = true }\n",
+        );
+        let r = rewrite_registry_redirect(&files, &[cfg_if_override("0.1.10", CARGO_UUID_2)]);
+        let toml = r.files.get("Cargo.toml").expect("workspace entry pinned");
+        assert!(
+            toml.contains(&format!(
+                "cfg-if-legacy = {{ package = \"cfg-if\", version = \"0.1.10\", registry = \"socket-patch-{CARGO_UUID_2}\" }}"
+            )) && toml.contains("[workspace.dependencies]\ncfg-if = \"1.0.4\"\n"),
+            "{toml}"
+        );
+        assert!(r.warnings.is_empty(), "{:?}", r.warnings);
+        assert!(r.confirmed_cargo_uuids.contains(CARGO_UUID_2));
+    }
+
+    /// A project the name-only matcher already damaged (the 0.1.10
+    /// declaration pinned to the 1.0.4 patch's registry) is repaired: the
+    /// 0.1.10 patch supersedes its own declaration's socket pin, and the
+    /// 1.0.4 patch leaves it alone.
+    #[test]
+    fn cargo_mispinned_other_version_declaration_is_repaired() {
+        let reg1 = format!("socket-patch-{CARGO_UUID}");
+        let reg2 = format!("socket-patch-{CARGO_UUID_2}");
+        let files = cfg_if_multi_files(&format!(
+            "[dependencies]\ncfg-if = {{ version = \"1.0.4\", registry = \"{reg1}\" }}\n\
+             cfg-if-legacy = {{ package = \"cfg-if\", version = \"0.1.10\", registry = \"{reg1}\" }}\n"
+        ));
+        let r = rewrite_registry_redirect(
+            &files,
+            &[
+                cfg_if_override("1.0.4", CARGO_UUID),
+                cfg_if_override("0.1.10", CARGO_UUID_2),
+            ],
+        );
+        let toml = r.files.get("Cargo.toml").expect("legacy pin superseded");
+        assert!(
+            toml.contains(&format!("version = \"1.0.4\", registry = \"{reg1}\""))
+                && toml.contains(&format!("version = \"0.1.10\", registry = \"{reg2}\"")),
+            "{toml}"
+        );
+        assert!(r.warnings.is_empty(), "{:?}", r.warnings);
+    }
+
+    /// A virtual workspace: the root pins `[workspace.dependencies]`, member
+    /// `a` inherits, member `b` declares serde itself.
+    fn cargo_workspace_files(b_manifest: &str) -> BTreeMap<String, String> {
+        let mut files = cargo_files(
+            "[workspace]\nmembers = [\"a\", \"b\"]\n\n\
+             [workspace.dependencies]\nserde = \"1.0.190\"\n",
+        );
+        files.insert(
+            "a/Cargo.toml".to_string(),
+            "[package]\nname = \"a\"\nversion = \"0.1.0\"\n\n[dependencies]\n\
+             serde.workspace = true\n"
+                .to_string(),
+        );
+        files.insert("b/Cargo.toml".to_string(), b_manifest.to_string());
+        files
+    }
+
+    /// Bug F: only the root's `[workspace.dependencies]` was pinned; member
+    /// `b`'s own `serde = "1.0.190"` stayed on crates.io, so `--locked`
+    /// failed against the repointed lock while the dep was reported
+    /// redirected. Every member manifest the caller supplies is planned in
+    /// the same transaction; inheritors are satisfied by the root's pin.
+    #[test]
+    fn cargo_workspace_member_direct_declaration_is_pinned() {
+        let files = cargo_workspace_files(
+            "[package]\nname = \"b\"\nversion = \"0.1.0\"\n\n[dependencies]\nserde = \"1.0.190\"\n",
+        );
+        let r = rewrite_registry_redirect(&files, &[cargo_sparse_override()]);
+        let pin = format!(
+            "serde = {{ version = \"1.0.190\", registry = \"{}\" }}",
+            cargo_reg()
+        );
+        assert!(r.files["Cargo.toml"].contains(&pin), "{:?}", r.files);
+        assert!(r.files["b/Cargo.toml"].contains(&pin), "{:?}", r.files);
+        assert!(
+            !r.files.contains_key("a/Cargo.toml"),
+            "the inheriting member needs no edit"
+        );
+        assert!(r
+            .edits
+            .iter()
+            .any(|e| e.path == "b/Cargo.toml" && e.kind == "redirect_cargo_toml_dep"));
+        assert!(r.warnings.is_empty(), "{:?}", r.warnings);
+        assert!(r.confirmed_cargo_uuids.contains(CARGO_UUID));
+    }
+
+    /// A member that cannot be pinned (a path dependency here) refuses the
+    /// WHOLE dep: the root stays untouched too.
+    #[test]
+    fn cargo_workspace_member_refusal_refuses_every_manifest() {
+        let files = cargo_workspace_files(
+            "[package]\nname = \"b\"\nversion = \"0.1.0\"\n\n[dependencies]\n\
+             serde = { path = \"../serde\" }\n",
+        );
+        let r = rewrite_registry_redirect(&files, &[cargo_sparse_override()]);
+        assert!(r.files.is_empty() && r.edits.is_empty(), "{:?}", r.files);
+        assert_eq!(
+            warning_codes(&r),
+            vec!["redirect_cargo_toml_dep_unrewritable"]
+        );
+        assert!(
+            r.warnings[0].detail.contains("b/Cargo.toml"),
+            "{:?}",
+            r.warnings
+        );
+    }
+
+    /// Only a member declares the crate (the root has no workspace entry):
+    /// that member is pinned, and a member inheriting an entry the root
+    /// does not have refuses.
+    #[test]
+    fn cargo_member_only_declaration_and_unsatisfied_inheritor() {
+        let mut files = cargo_files("[workspace]\nmembers = [\"b\"]\n");
+        files.insert(
+            "b/Cargo.toml".to_string(),
+            "[package]\nname = \"b\"\nversion = \"0.1.0\"\n\n[dependencies]\nserde = \"1\"\n"
+                .to_string(),
+        );
+        let r = rewrite_registry_redirect(&files, &[cargo_sparse_override()]);
+        assert_eq!(
+            r.files.keys().map(String::as_str).collect::<Vec<_>>(),
+            vec![".cargo/config.toml", "Cargo.lock", "b/Cargo.toml"]
+        );
+        files.insert(
+            "b/Cargo.toml".to_string(),
+            "[package]\nname = \"b\"\nversion = \"0.1.0\"\n\n[dependencies]\n\
+             serde = { workspace = true }\n"
+                .to_string(),
+        );
+        let r = rewrite_registry_redirect(&files, &[cargo_sparse_override()]);
+        assert!(r.files.is_empty(), "{:?}", r.files);
+        assert_eq!(
+            warning_codes(&r),
+            vec!["redirect_cargo_toml_dep_unrewritable"]
+        );
+    }
+
+    /// Manifest keys outside a plain repo-relative `<dir>/Cargo.toml` are
+    /// never treated as members.
+    #[test]
+    fn cargo_member_manifest_keys() {
+        for ok in ["a/Cargo.toml", "crates/x-y/Cargo.toml"] {
+            assert!(is_cargo_member_manifest_key(ok), "{ok}");
+        }
+        for bad in [
+            "Cargo.toml",
+            "/abs/Cargo.toml",
+            "../up/Cargo.toml",
+            "a/../b/Cargo.toml",
+            "./a/Cargo.toml",
+            ".socket/vendor/cargo/x/Cargo.toml",
+            "target/generated/Cargo.toml",
+            "crates/a/target/gen/Cargo.toml",
+            "a//Cargo.toml",
+            "a/Cargo.toml.orig",
+        ] {
+            assert!(!is_cargo_member_manifest_key(bad), "{bad}");
+        }
+    }
+
+    /// Bug K: CRLF manifests and locks (Windows checkouts) were refused —
+    /// every planner matched LF text only. A CRLF-only file is now planned
+    /// as LF and written back CRLF, recorded fragments included, and a
+    /// re-run over the output is a silent no-op.
+    #[test]
+    fn cargo_crlf_files_are_rewritten_with_crlf_kept() {
+        let lf = cargo_files(
+            "[package]\nname = \"app\"\nversion = \"0.1.0\"\n\n[dependencies]\nserde = \"1.0.190\"\n",
+        );
+        let crlf: BTreeMap<String, String> = lf
+            .iter()
+            .map(|(k, v)| (k.clone(), v.replace('\n', "\r\n")))
+            .collect();
+        let want = rewrite_registry_redirect(&lf, &[cargo_sparse_override()]);
+        let got = rewrite_registry_redirect(&crlf, &[cargo_sparse_override()]);
+        assert!(got.warnings.is_empty(), "{:?}", got.warnings);
+        assert!(got.confirmed_cargo_uuids.contains(CARGO_UUID));
+        for key in ["Cargo.toml", "Cargo.lock"] {
+            assert_eq!(
+                got.files[key],
+                want.files[key].replace('\n', "\r\n"),
+                "{key}"
+            );
+        }
+        assert_eq!(
+            got.files[".cargo/config.toml"], want.files[".cargo/config.toml"],
+            "a created config stays LF"
+        );
+        let lock_edit = got
+            .edits
+            .iter()
+            .find(|e| e.kind == "redirect_cargo_lock_entry")
+            .unwrap();
+        let (Some(Value::String(orig)), Some(Value::String(new))) =
+            (&lock_edit.original, &lock_edit.new)
+        else {
+            panic!("lock edit fragments");
+        };
+        assert!(crlf["Cargo.lock"].contains(orig.as_str()));
+        assert!(got.files["Cargo.lock"].contains(new.as_str()));
+
+        let mut again = crlf.clone();
+        again.extend(got.files.clone());
+        let rerun = rewrite_registry_redirect(&again, &[cargo_sparse_override()]);
+        assert!(
+            rerun.files.is_empty() && rerun.edits.is_empty() && rerun.warnings.is_empty(),
+            "{:?} {:?}",
+            rerun.files.keys(),
+            rerun.warnings
+        );
+    }
+
+    /// Mixed line endings are not normalized: the LF grammar still refuses
+    /// what it cannot match, writing nothing.
+    #[test]
+    fn cargo_mixed_line_endings_still_refuse() {
+        let mut files = cargo_files(
+            "[package]\r\nname = \"app\"\nversion = \"0.1.0\"\n\n[dependencies]\r\nserde = \"1.0.190\"\r\n",
+        );
+        files.insert(
+            "Cargo.lock".into(),
+            files["Cargo.lock"].replace('\n', "\r\n"),
+        );
+        let r = rewrite_registry_redirect(&files, &[cargo_sparse_override()]);
+        assert!(r.files.is_empty() && r.edits.is_empty(), "{:?}", r.files);
+        assert_eq!(
+            warning_codes(&r),
+            vec!["redirect_cargo_toml_dep_unrewritable"]
+        );
+    }
+
+    /// Bug J (kept a refusal): a crate only reached transitively cannot be
+    /// pinned by a manifest `registry` key. Nothing is written or
+    /// confirmed, and the warning says it is transitive-only, unpatched, and
+    /// which mode can patch it.
+    #[test]
+    fn cargo_transitive_only_crate_is_refused_loudly() {
+        let mut files = cargo_files(
+            "[package]\nname = \"app\"\nversion = \"0.1.0\"\n\n[dependencies]\nother = \"1\"\n",
+        );
+        let r = rewrite_registry_redirect(&files, &[cargo_sparse_override()]);
+        assert!(r.files.is_empty() && r.edits.is_empty(), "{:?}", r.files);
+        assert!(r.confirmed_cargo_uuids.is_empty());
+        assert_eq!(warning_codes(&r), vec!["redirect_cargo_toml_dep_not_found"]);
+        let detail = &r.warnings[0].detail;
+        assert!(
+            detail.contains("transitive-only")
+                && detail.contains("NOT redirected")
+                && detail.contains("--mode vendored"),
+            "{detail}"
+        );
+        // Not in the lock either: the plain not-declared wording.
+        files.remove("Cargo.lock");
+        let r = rewrite_registry_redirect(&files, &[cargo_sparse_override()]);
+        assert!(
+            r.warnings[0]
+                .detail
+                .starts_with("no [dependencies] entry for serde"),
+            "{:?}",
+            r.warnings
+        );
+    }
+
     /// A cargo dep whose override kind is not `cargo-sparse` warns (the TS
     /// twin's behavior) instead of vanishing silently.
     #[test]
@@ -13584,8 +14807,7 @@ packages:
         let lock = format!(
             "[[package]]\nname = \"app\"\nversion = \"0.1.0\"\ndependencies = [\n \
              \"log 0.4.20 ({CRATES_IO})\",\n \"serde 1.0.190 ({CRATES_IO})\",\n]\n\n\
-             [[package]]\nname = \"log\"\nversion = \"0.4.20\"\nsource = \"{CRATES_IO}\"\n\
-             dependencies = [\n \"serde 1.0.190 ({CRATES_IO})\",\n]\n\n\
+             [[package]]\nname = \"log\"\nversion = \"0.4.20\"\nsource = \"{CRATES_IO}\"\n\n\
              [[package]]\nname = \"serde\"\nversion = \"1.0.190\"\nsource = \"{CRATES_IO}\"\n\n\
              [metadata]\n\"checksum log 0.4.20 ({CRATES_IO})\" = \"{a}\"\n\
              \"checksum serde 1.0.190 ({CRATES_IO})\" = \"{b}\"\n",
@@ -13601,8 +14823,7 @@ packages:
         let want = format!(
             "[[package]]\nname = \"app\"\nversion = \"0.1.0\"\ndependencies = [\n \
              \"log 0.4.20 ({CRATES_IO})\",\n \"serde 1.0.190 ({idx})\",\n]\n\n\
-             [[package]]\nname = \"log\"\nversion = \"0.4.20\"\nsource = \"{CRATES_IO}\"\n\
-             dependencies = [\n \"serde 1.0.190 ({idx})\",\n]\n\n\
+             [[package]]\nname = \"log\"\nversion = \"0.4.20\"\nsource = \"{CRATES_IO}\"\n\n\
              [[package]]\nname = \"serde\"\nversion = \"1.0.190\"\nsource = \"{idx}\"\n\n\
              [metadata]\n\"checksum log 0.4.20 ({CRATES_IO})\" = \"{a}\"\n\
              \"checksum serde 1.0.190 ({idx})\" = \"{cksum}\"\n",
@@ -13611,15 +14832,19 @@ packages:
         assert_eq!(out, &want, "v1 lock stays v1, fully repointed");
         assert!(r.confirmed_cargo_uuids.contains(CARGO_UUID));
 
-        // Four fragment edits (entry, metadata line, two dependents), each
-        // unique in the rewritten file, and reverting them newest-first (the
-        // replay order) restores the original byte-for-byte.
+        // Three fragment edits (entry, metadata line, the dependent's
+        // reference), each unique in the rewritten file, and reverting them
+        // newest-first (the replay order) restores the original
+        // byte-for-byte.
         let edits: Vec<&FileEdit> = r
             .edits
             .iter()
-            .filter(|e| e.kind == "redirect_cargo_lock_entry")
+            .filter(|e| {
+                e.kind == "redirect_cargo_lock_entry" || e.kind == CARGO_LOCK_REFERENCE_KIND
+            })
             .collect();
-        assert_eq!(edits.len(), 4, "{edits:#?}");
+        assert_eq!(edits.len(), 3, "{edits:#?}");
+        assert_eq!(edits[2].kind, CARGO_LOCK_REFERENCE_KIND, "{edits:#?}");
         let mut reverted = out.clone();
         for e in edits.iter().rev() {
             assert_eq!(e.key.as_deref(), Some("serde@1.0.190"));
@@ -13642,15 +14867,211 @@ packages:
         );
         let again = rewrite_registry_redirect(&files, &[cargo_sparse_override()]);
         assert!(
-            !again
-                .edits
-                .iter()
-                .any(|e| e.kind == "redirect_cargo_lock_entry"),
+            !again.edits.iter().any(|e| e.path == "Cargo.lock"),
             "{:?}",
             again.edits
         );
     }
 
+    /// The OLDEST v1 locks (cargo before the `[root]` removal) record the
+    /// root package in a standalone `[root]` table — not in the
+    /// `[[package]]` array — and its `dependencies` spell full package ids
+    /// the same way. REGRESSION: the reference walk searched `[[package]]`
+    /// blocks only, so `[root]` kept naming the crates.io id of a package
+    /// the repointed lock no longer contained: `cargo build --locked` fails
+    /// and an unlocked build silently discards the lock, while the scan
+    /// reports the crate redirected. The vendored twin has handled this
+    /// table since `dependency_tables_mut`.
+    #[test]
+    fn cargo_lock_v1_root_table_references_are_repointed() {
+        const CRATES_IO: &str = "registry+https://github.com/rust-lang/crates.io-index";
+        let manifest = "[package]\nname = \"app\"\nversion = \"0.1.0\"\n\n\
+                        [dependencies]\nserde = \"1.0.190\"\nlog = \"0.4\"\n";
+        let cksum = "e".repeat(64);
+        let lock = format!(
+            "[root]\nname = \"app\"\nversion = \"0.1.0\"\ndependencies = [\n \
+             \"log 0.4.20 ({CRATES_IO})\",\n \"serde 1.0.190 ({CRATES_IO})\",\n]\n\n\
+             [[package]]\nname = \"log\"\nversion = \"0.4.20\"\nsource = \"{CRATES_IO}\"\n\n\
+             [[package]]\nname = \"serde\"\nversion = \"1.0.190\"\nsource = \"{CRATES_IO}\"\n\n\
+             [metadata]\n\"checksum log 0.4.20 ({CRATES_IO})\" = \"{a}\"\n\
+             \"checksum serde 1.0.190 ({CRATES_IO})\" = \"{b}\"\n",
+            a = "a".repeat(64),
+            b = "b".repeat(64),
+        );
+        let mut files = BTreeMap::new();
+        files.insert("Cargo.toml".to_string(), manifest.to_string());
+        files.insert("Cargo.lock".to_string(), lock.clone());
+        let r = rewrite_registry_redirect(&files, &[cargo_sparse_override()]);
+        let out = r.files.get("Cargo.lock").expect("lock rewritten");
+        let idx = cargo_index_url();
+        let want = format!(
+            "[root]\nname = \"app\"\nversion = \"0.1.0\"\ndependencies = [\n \
+             \"log 0.4.20 ({CRATES_IO})\",\n \"serde 1.0.190 ({idx})\",\n]\n\n\
+             [[package]]\nname = \"log\"\nversion = \"0.4.20\"\nsource = \"{CRATES_IO}\"\n\n\
+             [[package]]\nname = \"serde\"\nversion = \"1.0.190\"\nsource = \"{idx}\"\n\n\
+             [metadata]\n\"checksum log 0.4.20 ({CRATES_IO})\" = \"{a}\"\n\
+             \"checksum serde 1.0.190 ({idx})\" = \"{cksum}\"\n",
+            a = "a".repeat(64),
+        );
+        assert_eq!(out, &want, "the [root] table is repointed with the rest");
+        assert!(r.warnings.is_empty(), "{:?}", r.warnings);
+        assert!(r.confirmed_cargo_uuids.contains(CARGO_UUID));
+
+        // The reference edit's inverse puts back EVERY occurrence, so the
+        // recorded fragments restore the lock byte for byte whether the id
+        // sat in `[root]`, in a package block, or in both.
+        let mut reverted = out.clone();
+        for e in r
+            .edits
+            .iter()
+            .filter(|e| {
+                e.kind == "redirect_cargo_lock_entry" || e.kind == CARGO_LOCK_REFERENCE_KIND
+            })
+            .rev()
+        {
+            let new = e.new.as_ref().and_then(Value::as_str).unwrap();
+            let orig = e.original.as_ref().and_then(Value::as_str).unwrap();
+            reverted = if e.kind == CARGO_LOCK_REFERENCE_KIND {
+                reverted.replace(new, orig)
+            } else {
+                reverted.replacen(new, orig, 1)
+            };
+        }
+        assert_eq!(reverted, lock);
+    }
+
+    /// Both places at once: a `[root]` table AND a package block reference
+    /// the patched crate by full id, and one reference edit repoints both.
+    #[test]
+    fn cargo_lock_v1_root_and_package_references_share_one_edit() {
+        const CRATES_IO: &str = "registry+https://github.com/rust-lang/crates.io-index";
+        let manifest = "[package]\nname = \"app\"\nversion = \"0.1.0\"\n\n\
+                        [dependencies]\nserde = \"1.0.190\"\n";
+        let lock = format!(
+            "[root]\nname = \"app\"\nversion = \"0.1.0\"\ndependencies = [\n \
+             \"serde 1.0.190 ({CRATES_IO})\",\n]\n\n\
+             [[package]]\nname = \"helper\"\nversion = \"0.1.0\"\ndependencies = [\n \
+             \"serde 1.0.190 ({CRATES_IO})\",\n]\n\n\
+             [[package]]\nname = \"serde\"\nversion = \"1.0.190\"\nsource = \"{CRATES_IO}\"\n\n\
+             [metadata]\n\"checksum serde 1.0.190 ({CRATES_IO})\" = \"{b}\"\n",
+            b = "b".repeat(64),
+        );
+        let mut files = BTreeMap::new();
+        files.insert("Cargo.toml".to_string(), manifest.to_string());
+        files.insert("Cargo.lock".to_string(), lock.clone());
+        let r = rewrite_registry_redirect(&files, &[cargo_sparse_override()]);
+        // `helper` is a source-less path package that no manifest pins, so
+        // the dependents refusal owns this shape: nothing is rewritten.
+        assert_eq!(
+            warning_codes(&r),
+            vec!["redirect_cargo_transitive_dependents"]
+        );
+        assert!(r.files.is_empty(), "{:?}", r.files);
+    }
+
+    /// A lock of `app` (source-less, declares serde + `extra`) where `extra`
+    /// resolves from `extra_source` and depends on serde via `edge`.
+    fn cargo_shared_dependency_files(
+        extra: &str,
+        extra_source: Option<&str>,
+        edge: &str,
+    ) -> BTreeMap<String, String> {
+        const CRATES_IO: &str = "registry+https://github.com/rust-lang/crates.io-index";
+        let source = extra_source.map_or(String::new(), |s| format!("source = \"{s}\"\n"));
+        let mut files = BTreeMap::new();
+        files.insert(
+            "Cargo.toml".to_string(),
+            format!(
+                "[package]\nname = \"app\"\nversion = \"0.1.0\"\n\n[dependencies]\n\
+                 serde = \"1.0.190\"\n{extra} = {{ path = \"../{extra}\" }}\n"
+            ),
+        );
+        files.insert(
+            "Cargo.lock".to_string(),
+            format!(
+                "version = 3\n\n[[package]]\nname = \"app\"\nversion = \"0.1.0\"\n\
+                 dependencies = [\n \"{extra}\",\n \"serde\",\n]\n\n\
+                 [[package]]\nname = \"{extra}\"\nversion = \"0.2.0\"\n{source}\
+                 dependencies = [\n \"{edge}\",\n]\n\n\
+                 [[package]]\nname = \"serde\"\nversion = \"1.0.190\"\nsource = \"{CRATES_IO}\"\n\
+                 checksum = \"{}\"\n",
+                "1".repeat(64)
+            ),
+        );
+        files
+    }
+
+    /// A crate that is BOTH a direct dependency and a dependency of another
+    /// crate (cfg-if, libc, serde…) cannot be hosted-redirected: the pin
+    /// reaches only the root's declaration, the other crate keeps resolving
+    /// it from crates.io, so the repointed lock fails `--locked` and the
+    /// unpatched copy is compiled. REGRESSION: it was pinned, repointed and
+    /// confirmed (reported redirected, attested by VEX).
+    #[test]
+    fn cargo_crate_another_lock_package_depends_on_is_refused() {
+        const CRATES_IO: &str = "registry+https://github.com/rust-lang/crates.io-index";
+        let git = "git+https://example.test/extra#0123456789abcdef";
+        for (source, edge, kind) in [
+            (Some(CRATES_IO), "serde".to_string(), "registry"),
+            (Some(CRATES_IO), "serde 1.0.190".to_string(), "registry"),
+            (
+                Some(CRATES_IO),
+                format!("serde 1.0.190 ({CRATES_IO})"),
+                "registry",
+            ),
+            (Some(git), "serde".to_string(), "git"),
+            // A source-less path package whose manifest was never supplied
+            // (outside the project root, or behind a symlink).
+            (None, "serde".to_string(), "a path package"),
+        ] {
+            let files = cargo_shared_dependency_files("extra", source, &edge);
+            let r = rewrite_registry_redirect(&files, &[cargo_sparse_override()]);
+            assert!(r.files.is_empty(), "{edge}: {:?}", r.files.keys());
+            assert!(r.edits.is_empty(), "{edge}: {:?}", r.edits);
+            assert!(r.confirmed_cargo_uuids.is_empty(), "{edge}");
+            let [w] = r.warnings.as_slice() else {
+                panic!("{edge}: one warning: {:?}", r.warnings);
+            };
+            assert_eq!(w.code, "redirect_cargo_transitive_dependents", "{edge}");
+            assert!(
+                w.detail.contains(&format!("extra 0.2.0 ({kind}")),
+                "{edge}: {}",
+                w.detail
+            );
+            assert!(w.detail.contains("--mode vendored"), "{}", w.detail);
+        }
+    }
+
+    /// The dependent check is edge-exact: another VERSION of the crate is
+    /// not ours, and a source-less dependent whose manifest is planned (and
+    /// pinned) resolves through the pin.
+    #[test]
+    fn cargo_dependents_that_the_pin_reaches_or_another_version_do_not_refuse() {
+        let files = cargo_shared_dependency_files(
+            "extra",
+            Some("registry+https://github.com/rust-lang/crates.io-index"),
+            "serde 1.0.100",
+        );
+        let r = rewrite_registry_redirect(&files, &[cargo_sparse_override()]);
+        assert!(r.warnings.is_empty(), "{:?}", r.warnings);
+        assert!(r.confirmed_cargo_uuids.contains(CARGO_UUID));
+
+        let mut files = cargo_shared_dependency_files("extra", None, "serde");
+        files.insert(
+            "extra/Cargo.toml".to_string(),
+            "[package]\nname = \"extra\"\nversion = \"0.2.0\"\n\n[dependencies]\nserde = \"1\"\n"
+                .to_string(),
+        );
+        let r = rewrite_registry_redirect(&files, &[cargo_sparse_override()]);
+        assert!(r.warnings.is_empty(), "{:?}", r.warnings);
+        assert!(r.confirmed_cargo_uuids.contains(CARGO_UUID));
+        assert!(
+            r.files["extra/Cargo.toml"].contains(&format!("registry = \"{}\"", cargo_reg())),
+            "{:?}",
+            r.files
+        );
+    }
+
     /// A checksum-less entry whose `source` line ends the block (the
     /// trailing newline sits outside the block region) still gets its pin.
     #[test]
diff --git a/crates/socket-patch-core/src/patch/redirect/replay.rs b/crates/socket-patch-core/src/patch/redirect/replay.rs
index 9c603b16..324aa583 100644
--- a/crates/socket-patch-core/src/patch/redirect/replay.rs
+++ b/crates/socket-patch-core/src/patch/redirect/replay.rs
@@ -54,6 +54,10 @@ enum Inverse {
     /// writers record an `original` that is a substring of `new` (the
     /// Cargo.toml insert variant, the maven version suffix).
     ReplaceFragment,
+    /// Like [`Inverse::ReplaceFragment`], but `new` legitimately occurs
+    /// several times and stands for every occurrence (a cargo v1 lock's
+    /// full-id dependency reference, named by several dependents).
+    ReplaceEveryFragment,
     PipenvEntry,
     HatchDocument,
     /// action `added` with only `new` recorded: the redirect inserted the
@@ -68,6 +72,11 @@ enum Inverse {
     /// go.sum lines the redirect added (`new`, `\n`-joined): each is removed
     /// as a whole line, whatever the file's line endings.
     RemoveAddedLines,
+    /// The appended cargo `[registries.…]` block (`redirect_cargo_registry`,
+    /// action `added`): removed together with exactly the one blank
+    /// separator the rewriter put before it — see
+    /// [`remove_appended_cargo_block`].
+    RemoveAppendedCargoBlock,
     /// Cleanup of PRIOR socket wiring performed during a redirect refresh
     /// (`redirect_golang_stale_*`). The removal already moved the file
     /// toward pristine; restoring it would re-create socket wiring, so
@@ -106,10 +115,11 @@ fn classify(kind: &str, action: &str) -> (&'static str, Inverse) {
         "redirect_cargo_toml_dep" | "redirect_cargo_lock_entry" => {
             ("cargo", Inverse::ReplaceFragment)
         }
+        super::CARGO_LOCK_REFERENCE_KIND => ("cargo", Inverse::ReplaceEveryFragment),
         "redirect_cargo_registry" => (
             "cargo",
             if action == "added" {
-                Inverse::RemoveAddedFragment
+                Inverse::RemoveAppendedCargoBlock
             } else {
                 Inverse::ReplaceFragment
             },
@@ -250,7 +260,18 @@ fn safe_rel_path(path: &str) -> bool {
 /// fragment + newline) is byte-AMBIGUOUS to invert — `"m\n\n" + "F\n"`
 /// and `"m\n" + "\nF\n"` produce identical files — so the tidy form (the
 /// one `go mod tidy` itself emits) is chosen.
-fn remove_fragment_once(content: &str, fragment: &str) -> String {
+pub(super) fn remove_fragment_once(content: &str, fragment: &str) -> String {
+    // A CRLF file (its fragments recorded CRLF too) is inverted as LF and
+    // written back CRLF, so the separator bookkeeping below sees real line
+    // breaks instead of stranding a `\r` line.
+    let crlf = content.matches("\r\n").count();
+    if crlf > 0 && crlf == content.matches('\n').count() && content.contains(fragment) {
+        return remove_fragment_once(
+            &content.replace("\r\n", "\n"),
+            &fragment.replace("\r\n", "\n"),
+        )
+        .replace('\n', "\r\n");
+    }
     let Some(pos) = content.find(fragment) else {
         return content.to_string();
     };
@@ -289,6 +310,104 @@ fn remove_fragment_once(content: &str, fragment: &str) -> String {
     format!("{}{}", &content[..start], &content[end..])
 }
 
+/// Every line break in `text` is a CRLF (and there is at least one).
+fn is_all_crlf(text: &str) -> bool {
+    let crlf = text.matches("\r\n").count();
+    crlf > 0 && crlf == text.matches('\n').count()
+}
+
+/// One fragment-edit inverse, tolerant of a line-ending conversion between
+/// the scan and the revert (git `core.autocrlf` rewrites the committed
+/// files but never the JSON-escaped fragments in the ledger).
+#[derive(Debug, PartialEq)]
+pub(super) enum FragmentRevert {
+    /// `new` was found and put back to `original` (the file's own line
+    /// endings kept).
+    Reverted(String),
+    /// `new` is gone but `original` is present: already unwound.
+    AlreadyOriginal,
+    /// Neither fragment is present.
+    Drifted,
+}
+
+/// Replace `new` with `original` in `content` — once, or at `every`
+/// occurrence — matching regardless of CRLF/LF: an all-CRLF file is
+/// matched as LF and written back CRLF; any other file is matched with the
+/// recorded fragments, then with their LF forms. `new` is looked for
+/// before `original` (an `original` may be a substring of `new`).
+pub(super) fn revert_fragment_eol(
+    content: &str,
+    new: &str,
+    original: &str,
+    every: bool,
+) -> FragmentRevert {
+    if is_all_crlf(content) {
+        return match revert_fragment_eol(
+            &content.replace("\r\n", "\n"),
+            &new.replace("\r\n", "\n"),
+            &original.replace("\r\n", "\n"),
+            every,
+        ) {
+            FragmentRevert::Reverted(lf) => FragmentRevert::Reverted(lf.replace('\n', "\r\n")),
+            other => other,
+        };
+    }
+    let (lf_new, lf_original) = (new.replace("\r\n", "\n"), original.replace("\r\n", "\n"));
+    for (n, o) in [(new, original), (lf_new.as_str(), lf_original.as_str())] {
+        if content.contains(n) {
+            return FragmentRevert::Reverted(if every {
+                content.replace(n, o)
+            } else {
+                content.replacen(n, o, 1)
+            });
+        }
+    }
+    if content.contains(original) || content.contains(&lf_original) {
+        FragmentRevert::AlreadyOriginal
+    } else {
+        FragmentRevert::Drifted
+    }
+}
+
+/// Whether `content` holds `fragment`, ignoring CRLF/LF differences.
+pub(super) fn contains_eol(content: &str, fragment: &str) -> bool {
+    content.contains(fragment)
+        || content
+            .replace("\r\n", "\n")
+            .contains(&fragment.replace("\r\n", "\n"))
+}
+
+/// Invert the cargo rewriter's append of a `[registries.…]` block: it wrote
+/// `config + "\n" + block` (just `block` into an empty config) and records
+/// `block` — or `"\n" + block` when the config lacked a final newline (the
+/// extra newline it had to add first). Removing the recorded fragment plus
+/// the one newline before it therefore restores the config's exact bytes:
+/// a missing final newline or trailing blank lines included, and anything
+/// the user appended after the block kept. An all-CRLF file is inverted as
+/// LF and written back CRLF; a fragment recorded with the other line
+/// endings (a checkout converted them) still matches. `None` when the
+/// fragment is not in the file.
+pub(super) fn remove_appended_cargo_block(content: &str, fragment: &str) -> Option<String> {
+    if is_all_crlf(content) {
+        return remove_appended_cargo_block(
+            &content.replace("\r\n", "\n"),
+            &fragment.replace("\r\n", "\n"),
+        )
+        .map(|lf| lf.replace('\n', "\r\n"));
+    }
+    let lf_fragment = fragment.replace("\r\n", "\n");
+    let (pos, len) = match content.find(fragment) {
+        Some(pos) => (pos, fragment.len()),
+        None => (content.find(&lf_fragment)?, lf_fragment.len()),
+    };
+    let before = &content[..pos];
+    let before = before
+        .strip_suffix("\r\n")
+        .or_else(|| before.strip_suffix('\n'))
+        .unwrap_or(before);
+    Some(format!("{before}{}", &content[pos + len..]))
+}
+
 /// The string payloads of an edit, or `None` when a payload is missing or
 /// not a string (a shape the inverse table said must be there).
 fn str_payload(v: &Option<Value>) -> Option<&str> {
@@ -316,6 +435,19 @@ pub async fn revert_remaining_redirect_edits(
         groups.entry(group).or_default().push(idx);
     }
 
+    // Where a cargo `[registries.…]` block can still be referenced from:
+    // the root manifest and lock, plus every manifest the ledger pinned.
+    let mut cargo_probes: Vec<String> = vec!["Cargo.toml".to_string(), "Cargo.lock".to_string()];
+    for edit in state
+        .edits
+        .iter()
+        .filter(|e| e.kind == "redirect_cargo_toml_dep")
+    {
+        if !cargo_probes.contains(&edit.path) {
+            cargo_probes.push(edit.path.clone());
+        }
+    }
+
     let mut drop_indices: BTreeSet<usize> = BTreeSet::new();
     let mut refused_groups: BTreeSet<&'static str> = BTreeSet::new();
     let mut pending_warnings: Vec<(String, String)> = Vec::new();
@@ -439,7 +571,9 @@ pub async fn revert_remaining_redirect_edits(
                         }
                     }
                 }
-                Inverse::ReplaceFragment | Inverse::HatchDocument => {
+                Inverse::ReplaceFragment
+                | Inverse::ReplaceEveryFragment
+                | Inverse::HatchDocument => {
                     let (Some(original), Some(new)) =
                         (str_payload(&edit.original), str_payload(&edit.new))
                     else {
@@ -505,6 +639,71 @@ pub async fn revert_remaining_redirect_edits(
                     };
                     // `new` before `original`: original may be a substring
                     // of new (Cargo.toml insert, maven version suffix).
+                    // cargo: matched regardless of a CRLF/LF conversion since
+                    // the scan (a checkout's `core.autocrlf` rewrites the
+                    // files, never the ledger's escaped fragments).
+                    if *group == "cargo" {
+                        let every = inverse == Inverse::ReplaceEveryFragment;
+                        let lf = |t: &str| t.replace("\r\n", "\n");
+                        // ONE scan legitimately records identical cargo
+                        // edits (a manifest declaring the crate with the
+                        // same line in two sections), and each one unwinds
+                        // one occurrence — what `revert_cargo_redirect_purl`
+                        // does over this same ledger. So the file may hold
+                        // as many occurrences as there are identical edits
+                        // left to spend on them; only a surplus is
+                        // ambiguous.
+                        let twins = indices
+                            .iter()
+                            .filter(|&&i| {
+                                let other = &state.edits[i];
+                                !group_drops.contains(&i)
+                                    && other.path == edit.path
+                                    && other.kind == edit.kind
+                                    && other.action == edit.action
+                                    && other.key == edit.key
+                                    && other.original == edit.original
+                                    && other.new == edit.new
+                            })
+                            .count()
+                            .max(1);
+                        if !every && lf(&content).matches(&lf(new)).count() > twins {
+                            refuse(
+                                format!(
+                                    "{}: the redirected fragment appears more than once — \
+                                     ambiguous, refusing to guess",
+                                    edit.path
+                                ),
+                                &mut outcome,
+                            );
+                            refused_groups.insert(group);
+                            continue 'group;
+                        }
+                        match revert_fragment_eol(&content, new, original, every) {
+                            FragmentRevert::Reverted(restored) => {
+                                staged.insert(edit.path.clone(), Some(restored));
+                                group_drops.insert(idx);
+                            }
+                            // Same substring guard as below.
+                            FragmentRevert::AlreadyOriginal if !lf(new).contains(&lf(original)) => {
+                                group_drops.insert(idx);
+                            }
+                            _ => {
+                                refuse(
+                                    format!(
+                                        "{}: content matches neither the redirected nor the \
+                                         original fragment for {} — the file drifted; re-run \
+                                         `scan --mode hosted` to normalize",
+                                        edit.path, edit.kind
+                                    ),
+                                    &mut outcome,
+                                );
+                                refused_groups.insert(group);
+                                continue 'group;
+                            }
+                        }
+                        continue;
+                    }
                     if content.contains(new) {
                         if content.matches(new).count() > 1 {
                             refuse(
@@ -571,6 +770,58 @@ pub async fn revert_remaining_redirect_edits(
                         }
                     }
                 }
+                Inverse::RemoveAppendedCargoBlock => {
+                    let Some(new) = str_payload(&edit.new) else {
+                        refuse(
+                            format!("{} edit is missing its recorded fragment", edit.kind),
+                            &mut outcome,
+                        );
+                        refused_groups.insert(group);
+                        continue 'group;
+                    };
+                    // A block something still references (a hand-pinned dep)
+                    // stays: removing it would leave that pin naming an
+                    // undefined registry. The reverse walk has already
+                    // unwound this ledger's own references.
+                    let reg = edit.key.as_deref().unwrap_or_default();
+                    let index = new.split('"').nth(1).unwrap_or_default();
+                    let mut referenced = false;
+                    for probe in &cargo_probes {
+                        if let Ok(Some(text)) = staged_read(&staged, project_root, probe).await {
+                            if (!reg.is_empty() && text.contains(reg))
+                                || (!index.is_empty() && text.contains(index))
+                            {
+                                referenced = true;
+                                break;
+                            }
+                        }
+                    }
+                    if referenced {
+                        group_drops.insert(idx);
+                        continue;
+                    }
+                    match staged_read(&staged, project_root, &edit.path).await {
+                        Ok(Some(content)) => {
+                            // Absent fragment == already clean. A config the
+                            // rewrite created ends empty and goes with it.
+                            if let Some(restored) = remove_appended_cargo_block(&content, new) {
+                                staged.insert(
+                                    edit.path.clone(),
+                                    (!restored.is_empty()).then_some(restored),
+                                );
+                            }
+                            group_drops.insert(idx);
+                        }
+                        Ok(None) => {
+                            group_drops.insert(idx);
+                        }
+                        Err(e) => {
+                            refuse(e, &mut outcome);
+                            refused_groups.insert(group);
+                            continue 'group;
+                        }
+                    }
+                }
                 Inverse::RemoveAddedFragment => {
                     let Some(new) = str_payload(&edit.new) else {
                         refuse(
@@ -1618,6 +1869,52 @@ mod tests {
         assert_eq!(state.edits.len(), 1, "the edit must survive for a retry");
     }
 
+    /// ONE scan records one cargo edit per OCCURRENCE, so a manifest that
+    /// declares the crate with the same line in two sections leaves two
+    /// IDENTICAL edits in the ledger. The whole-ledger replay — the
+    /// records-empty path a degraded (record-fetch-failed) run leaves
+    /// behind — must spend one edit per occurrence, exactly as the per-purl
+    /// `revert_cargo_redirect_purl` does over the same ledger. An
+    /// occurrence no edit accounts for is still ambiguous and refuses.
+    #[tokio::test]
+    async fn identical_cargo_edits_each_unwind_one_occurrence() {
+        let plain = "cfg-if = \"1\"";
+        let pinned = "cfg-if = { version = \"1\", registry = \"socket-patch-u\" }";
+        let two = |line: &str| format!("[dependencies]\n{line}\n\n[dev-dependencies]\n{line}\n");
+        let dir = TempDir::new().unwrap();
+        write(dir.path(), "Cargo.toml", &two(pinned)).await;
+        let cargo_edit = || {
+            edit(
+                "Cargo.toml",
+                "redirect_cargo_toml_dep",
+                "rewritten",
+                Some(plain),
+                Some(pinned),
+            )
+        };
+        let mut state = state_with(vec![cargo_edit(), cargo_edit()], &[]);
+        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
+        assert!(out.fully_reverted(), "{:?}", out.refusals);
+        assert_eq!(read(dir.path(), "Cargo.toml").await, two(plain));
+        assert!(state.edits.is_empty(), "{:?}", state.edits);
+
+        // A THIRD occurrence with only two edits to spend: nothing says
+        // which one the ledger owns, so the group refuses byte-untouched.
+        let dir = TempDir::new().unwrap();
+        let surplus = format!("{}\n[build-dependencies]\n{pinned}\n", two(pinned));
+        write(dir.path(), "Cargo.toml", &surplus).await;
+        let mut state = state_with(vec![cargo_edit(), cargo_edit()], &[]);
+        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
+        assert_eq!(out.refusals.len(), 1, "{out:?}");
+        assert!(
+            out.refusals[0].reason.contains("more than once"),
+            "{:?}",
+            out.refusals[0]
+        );
+        assert_eq!(read(dir.path(), "Cargo.toml").await, surplus);
+        assert_eq!(state.edits.len(), 2);
+    }
+
     #[tokio::test]
     async fn gem_section_move_record_fails_closed() {
         // redirect_gemfile_lock_gem_source records only the bare URLs of a
@@ -2838,6 +3135,57 @@ mod tests {
 
     // ---------- remove_fragment_once unit pins ----------
 
+    #[test]
+    fn remove_fragment_once_keeps_crlf_separators_straight() {
+        assert_eq!(
+            remove_fragment_once("[net]\r\nretry = 2\r\n\r\nF\r\nG\r\n", "F\r\nG\r\n"),
+            "[net]\r\nretry = 2\r\n"
+        );
+        assert_eq!(
+            remove_fragment_once("a\r\n\r\nF\r\n\r\nb\r\n", "F\r\n"),
+            "a\r\n\r\nb\r\n"
+        );
+    }
+
+    #[test]
+    fn remove_appended_cargo_block_inverts_exactly_what_was_appended() {
+        let block = "[registries.r]\nindex = \"i\"\n";
+        for (written, fragment, want) in [
+            // Empty config: the block alone (a created file ends empty).
+            (block.to_string(), block.to_string(), ""),
+            // One separator after a config ending in newline(s).
+            (format!("a\n\n{block}"), block.to_string(), "a\n"),
+            (format!("a\n\n\n{block}"), block.to_string(), "a\n\n"),
+            // No final newline: the added newline rides in the fragment.
+            (format!("a\n\n{block}"), format!("\n{block}"), "a"),
+            // The user appended after the block: kept.
+            (
+                format!("a\n\n{block}b = 1\n"),
+                block.to_string(),
+                "a\nb = 1\n",
+            ),
+            // CRLF file, and a CRLF-recorded fragment against an LF file.
+            (
+                format!("a\r\n\r\n{}", block.replace('\n', "\r\n")),
+                block.replace('\n', "\r\n"),
+                "a\r\n",
+            ),
+            (format!("a\n\n{block}"), block.replace('\n', "\r\n"), "a\n"),
+            (
+                format!("a\r\n\r\n{}", block.replace('\n', "\r\n")),
+                block.to_string(),
+                "a\r\n",
+            ),
+        ] {
+            assert_eq!(
+                remove_appended_cargo_block(&written, &fragment).as_deref(),
+                Some(want),
+                "{written:?}"
+            );
+        }
+        assert_eq!(remove_appended_cargo_block("a\n", block), None);
+    }
+
     #[test]
     fn remove_fragment_once_absent_fragment_is_identity() {
         // Defensive edge: callers check contains() first, so the not-found
diff --git a/crates/socket-patch-core/src/patch/redirect/takeover.rs b/crates/socket-patch-core/src/patch/redirect/takeover.rs
index 6c7d6dd4..5280cf91 100644
--- a/crates/socket-patch-core/src/patch/redirect/takeover.rs
+++ b/crates/socket-patch-core/src/patch/redirect/takeover.rs
@@ -58,6 +58,7 @@ use crate::vendor::go_mod_edit::{
     is_hosted_module_path, parse_replace_entries, HOSTED_GO_MODULE_PREFIX,
 };
 
+use super::replay::FragmentRevert;
 use super::staged::{flush_staged, read_rel, staged_read, Staged, StagedBytes};
 use super::state::RedirectState;
 use super::FileEdit;
@@ -148,6 +149,59 @@ static SOCKET_REGISTRY_UUID: LazyLock<Regex> = LazyLock::new(|| {
         .expect("static registry-uuid regex is valid")
 });
 
+/// The `socket-patch-<uuid>` registry uuids a recorded fragment names.
+fn registry_uuids(fragment: Option<&Value>) -> impl Iterator<Item = String> + '_ {
+    fragment
+        .and_then(Value::as_str)
+        .into_iter()
+        .flat_map(|s| SOCKET_REGISTRY_UUID.captures_iter(s))
+        .map(|c| c[1].to_string())
+}
+
+/// A Cargo.lock edit (keyed `<name>@<version>`): the entry / `[metadata]`
+/// fragments, or the dependents' full-id reference.
+fn is_cargo_lock_edit(e: &FileEdit) -> bool {
+    e.kind == "redirect_cargo_lock_entry" || e.kind == super::CARGO_LOCK_REFERENCE_KIND
+}
+
+/// Every patch uuid `name@version` was redirected at: its record's, plus
+/// each managed registry whose index URL one of its (version-keyed)
+/// Cargo.lock edits names — the older links of a re-redirect chain.
+fn cargo_lineage(state: &RedirectState, name: &str, version: &str, uuid: &str) -> HashSet<String> {
+    let lock_key = format!("{name}@{version}");
+    let lock_fragments: Vec<&str> = state
+        .edits
+        .iter()
+        .filter(|e| is_cargo_lock_edit(e) && e.key.as_deref() == Some(lock_key.as_str()))
+        .flat_map(|e| [e.original.as_ref(), e.new.as_ref()])
+        .flatten()
+        .filter_map(Value::as_str)
+        .collect();
+    let mut lineage: HashSet<String> = HashSet::from([uuid.to_string()]);
+    for e in state
+        .edits
+        .iter()
+        .filter(|e| e.kind == "redirect_cargo_registry")
+    {
+        let Some(u) = e
+            .key
+            .as_deref()
+            .and_then(|k| k.strip_prefix("socket-patch-"))
+        else {
+            continue;
+        };
+        let index = e
+            .new
+            .as_ref()
+            .and_then(Value::as_str)
+            .and_then(|block| block.split('"').nth(1));
+        if index.is_some_and(|index| lock_fragments.iter().any(|f| f.contains(index))) {
+            lineage.insert(u.to_string());
+        }
+    }
+    lineage
+}
+
 /// Revert every hosted-redirect edit the ledger records for `purl` (a cargo
 /// package), then drop that purl's record and edits from `state`. The caller
 /// persists the mutated ledger (see `persist_redirect_state`).
@@ -172,21 +226,58 @@ pub async fn revert_cargo_redirect_purl(
     let (name, version) = (name.into_owned(), version.into_owned());
     let lock_key = format!("{name}@{version}");
 
+    // Manifest edits are keyed by crate NAME (the shared golden ledger
+    // shape), so when another version of the crate is redirected too, its
+    // pins carry the same key. Attribute each such edit to the version its
+    // declaration's requirement selects — the planner's own rule, and the
+    // only one that also holds for ledgers an older, name-only CLI wrote
+    // (a declaration of one version pinned to, then re-pinned from, the
+    // other version's registry). An edit whose line carries no readable
+    // requirement (a table-form header / registry line) falls back to the
+    // registry it pins: skipped when that is a sibling lineage's. Without a
+    // sibling the claim stays name-wide, as before.
+    let siblings: Vec<(String, HashSet<String>)> = state
+        .records
+        .iter()
+        .filter(|(key, _)| **key != record_key)
+        .filter_map(|(key, rec)| {
+            let (n, v) = parse_cargo_purl(strip_purl_qualifiers(key))?;
+            (n == name && v != version)
+                .then(|| (v.to_string(), cargo_lineage(state, &n, &v, &rec.uuid)))
+        })
+        .collect();
+    let sibling_versions: Vec<String> = siblings.iter().map(|(v, _)| v.clone()).collect();
+    let sibling_uuids: HashSet<String> = siblings.into_iter().flat_map(|(_, u)| u).collect();
+    let is_my_manifest_edit = |e: &FileEdit| {
+        if sibling_versions.is_empty() {
+            return true;
+        }
+        let req = cargo_declared_req(e.original.as_ref());
+        match super::cargo_req_selects(req.as_deref(), &version, &sibling_versions) {
+            super::CargoReqMatch::Ours if req.is_some() => true,
+            super::CargoReqMatch::NotOurs => false,
+            _ => !registry_uuids(e.new.as_ref()).any(|u| sibling_uuids.contains(&u)),
+        }
+    };
     let is_wiring_edit = |e: &FileEdit| {
-        (e.kind == "redirect_cargo_toml_dep" && e.key.as_deref() == Some(name.as_str()))
-            || (e.kind == "redirect_cargo_lock_entry"
-                && e.key.as_deref() == Some(lock_key.as_str()))
+        (e.kind == "redirect_cargo_toml_dep"
+            && e.key.as_deref() == Some(name.as_str())
+            && is_my_manifest_edit(e))
+            || (is_cargo_lock_edit(e) && e.key.as_deref() == Some(lock_key.as_str()))
     };
     // Registry blocks tie to this purl via the `socket-patch-<uuid>` names in
     // its record + wiring edits (a patch uuid is per purl, so this cannot
-    // claim another package's block).
+    // claim another package's block) — never a sibling version's, which a
+    // re-pinned legacy declaration also names.
     let mut uuids: HashSet<String> = HashSet::new();
     uuids.insert(state.records[&record_key].uuid.clone());
     for e in state.edits.iter().filter(|e| is_wiring_edit(e)) {
         for v in [&e.original, &e.new] {
             if let Some(s) = v.as_ref().and_then(Value::as_str) {
                 for c in SOCKET_REGISTRY_UUID.captures_iter(s) {
-                    uuids.insert(c[1].to_string());
+                    if !sibling_uuids.contains(&c[1]) {
+                        uuids.insert(c[1].to_string());
+                    }
                 }
             }
         }
@@ -207,8 +298,34 @@ pub async fn revert_cargo_redirect_purl(
         .map(|(i, _)| i)
         .collect();
 
+    // Every manifest the ledger ever pinned (workspace members included),
+    // plus the lock: where a registry block can still be referenced from.
+    let mut probes: Vec<String> = vec!["Cargo.toml".to_string(), "Cargo.lock".to_string()];
+    for e in state
+        .edits
+        .iter()
+        .filter(|e| e.kind == "redirect_cargo_toml_dep")
+    {
+        if !probes.contains(&e.path) {
+            probes.push(e.path.clone());
+        }
+    }
+
     let mut out = RedirectRevert::default();
     let mut staged: Staged = Staged::new();
+    // A block kept because it is still referenced normally leaves the
+    // ledger (it now belongs to whatever hand pin references it). The
+    // exception is a block another, still-recorded wiring edit pins to (an
+    // older CLI's cross-version pin): that edit stays in the ledger so the
+    // removal that retires the last such pin also removes the block.
+    let still_pinned: HashSet<String> = state
+        .edits
+        .iter()
+        .enumerate()
+        .filter(|(i, e)| e.kind == "redirect_cargo_toml_dep" && !mine.contains(i))
+        .flat_map(|(_, e)| registry_uuids(e.new.as_ref()).collect::<Vec<_>>())
+        .collect();
+    let mut kept: HashSet<usize> = HashSet::new();
     // Newest-first: the hosted flow appends edits, so reverse index order
     // unwinds re-redirect chains correctly (each step's `original` is the
     // previous step's `new`), and the registry-block removals — recorded
@@ -216,7 +333,9 @@ pub async fn revert_cargo_redirect_purl(
     for &i in mine.iter().rev() {
         let edit = &state.edits[i];
         match edit.kind.as_str() {
-            "redirect_cargo_toml_dep" | "redirect_cargo_lock_entry" => {
+            "redirect_cargo_toml_dep"
+            | "redirect_cargo_lock_entry"
+            | super::CARGO_LOCK_REFERENCE_KIND => {
                 let (Some(new), Some(orig)) = (
                     edit.new.as_ref().and_then(Value::as_str),
                     edit.original.as_ref().and_then(Value::as_str),
@@ -234,21 +353,28 @@ pub async fn revert_cargo_redirect_purl(
                         edit.path
                     ));
                 };
-                if content.contains(new) {
-                    let reverted = content.replacen(new, orig, 1);
-                    staged.insert(edit.path.clone(), Some(reverted));
-                    out.reverted_files.push(edit.path.clone());
-                } else if content.contains(orig) {
+                // A full-id reference edit stands for every dependent's
+                // occurrence of that exact id. Matching ignores a CRLF/LF
+                // conversion since the scan (a Windows checkout's CRLF
+                // fragments against an LF checkout, and vice versa).
+                let every = edit.kind == super::CARGO_LOCK_REFERENCE_KIND;
+                match super::replay::revert_fragment_eol(&content, new, orig, every) {
+                    FragmentRevert::Reverted(reverted) => {
+                        staged.insert(edit.path.clone(), Some(reverted));
+                        out.reverted_files.push(edit.path.clone());
+                    }
                     // Already at (or unwound to) the pre-redirect fragment.
-                } else {
-                    return Err(format!(
-                        "the {} entry for {name}@{version} has drifted from the \
-                         recorded hosted redirect (neither the redirected nor the \
-                         original fragment is present); refusing to touch it — \
-                         re-run `scan --mode hosted` to normalize the redirect, \
-                         or restore the crates.io wiring manually, then re-run",
-                        edit.path
-                    ));
+                    FragmentRevert::AlreadyOriginal => {}
+                    FragmentRevert::Drifted => {
+                        return Err(format!(
+                            "the {} entry for {name}@{version} has drifted from the \
+                             recorded hosted redirect (neither the redirected nor the \
+                             original fragment is present); refusing to touch it — \
+                             re-run `scan --mode hosted` to normalize the redirect, \
+                             or restore the crates.io wiring manually, then re-run",
+                            edit.path
+                        ));
+                    }
                 }
             }
             "redirect_cargo_registry" => {
@@ -258,7 +384,7 @@ pub async fn revert_cargo_redirect_purl(
                 let Some(content) = staged_read(&staged, project_root, &edit.path).await? else {
                     continue; // config already gone
                 };
-                if !content.contains(block) {
+                if !super::replay::contains_eol(&content, block) {
                     continue; // block already removed
                 }
                 // Keep the block while anything still references its registry
@@ -271,7 +397,7 @@ pub async fn revert_cargo_redirect_purl(
                     .map(str::to_string)
                     .unwrap_or_default();
                 let mut referenced = false;
-                for probe in ["Cargo.toml", "Cargo.lock"] {
+                for probe in &probes {
                     if let Some(text) = staged_read(&staged, project_root, probe).await? {
                         if (!reg.is_empty() && text.contains(reg))
                             || (!index.is_empty() && text.contains(&index))
@@ -282,6 +408,12 @@ pub async fn revert_cargo_redirect_purl(
                     }
                 }
                 if referenced {
+                    if reg
+                        .strip_prefix("socket-patch-")
+                        .is_some_and(|u| still_pinned.contains(u))
+                    {
+                        kept.insert(i);
+                    }
                     continue;
                 }
                 // A REGENERATED block (`action: "rewritten"` — the rewriter
@@ -289,22 +421,27 @@ pub async fn revert_cargo_redirect_purl(
                 // it as `original`) restores that pre-existing region instead
                 // of deleting it: the original bytes are the user's.
                 if let Some(orig) = edit.original.as_ref().and_then(Value::as_str) {
-                    let reverted = content.replacen(block, orig, 1);
-                    staged.insert(edit.path.clone(), Some(reverted));
-                    out.reverted_files.push(edit.path.clone());
+                    if let FragmentRevert::Reverted(reverted) =
+                        super::replay::revert_fragment_eol(&content, block, orig, false)
+                    {
+                        staged.insert(edit.path.clone(), Some(reverted));
+                        out.reverted_files.push(edit.path.clone());
+                    }
                     continue;
                 }
-                let mut trimmed = content.replacen(block, "", 1);
-                // Collapse the blank separator the rewrite inserted.
-                while trimmed.contains("\n\n\n") {
-                    trimmed = trimmed.replace("\n\n\n", "\n\n");
-                }
-                let trimmed = trimmed.trim_start_matches('\n').to_string();
-                if trimmed.trim().is_empty() {
-                    staged.insert(edit.path.clone(), None);
-                } else {
-                    staged.insert(edit.path.clone(), Some(trimmed));
-                }
+                // The block leaves with exactly the blank separator the
+                // rewrite put before it, so the user's config comes back
+                // byte-for-byte — its trailing newlines (or missing final
+                // newline) included. A config the rewrite created ends
+                // empty and is deleted.
+                let Some(restored) = super::replay::remove_appended_cargo_block(&content, block)
+                else {
+                    continue;
+                };
+                staged.insert(
+                    edit.path.clone(),
+                    (!restored.is_empty()).then_some(restored),
+                );
                 out.reverted_files.push(edit.path.clone());
             }
             _ => {}
@@ -322,6 +459,7 @@ pub async fn revert_cargo_redirect_purl(
         flush_staged(project_root, &staged, &StagedBytes::new()).await?;
     }
 
+    let mine: Vec<usize> = mine.into_iter().filter(|i| !kept.contains(i)).collect();
     drop_claimed(state, mine, &record_key);
     Ok(out)
 }
@@ -437,6 +575,29 @@ pub async fn revert_golang_redirect_purl(
     })
 }
 
+/// The version requirement a recorded Cargo.toml declaration line carries:
+/// the `version = "…"` of an inline table, or the value of a plain
+/// `name = "…"` entry. `None` for a table-form header or `registry` line.
+fn cargo_declared_req(fragment: Option<&Value>) -> Option<String> {
+    static PLAIN_ENTRY: LazyLock<Regex> = LazyLock::new(|| {
+        Regex::new(r#"^\s*(?:"[^"]+"|'[^']+'|[A-Za-z0-9_-]+)\s*=\s*"([^"]+)""#)
+            .expect("static plain-entry regex is valid")
+    });
+    static INLINE_VERSION: LazyLock<Regex> = LazyLock::new(|| {
+        Regex::new(r#"\bversion\s*=\s*"([^"]*)""#).expect("static inline-version regex is valid")
+    });
+    let line = fragment.and_then(Value::as_str)?;
+    if line.contains('\n') || line.trim_start().starts_with('[') {
+        return None;
+    }
+    let req = if line.contains('{') {
+        INLINE_VERSION.captures(line)?[1].to_string()
+    } else {
+        PLAIN_ENTRY.captures(line)?[1].to_string()
+    };
+    semver::VersionReq::parse(req.trim()).is_ok().then_some(req)
+}
+
 /// The npm-family text-fragment edit kinds CLAIMED BY KEY: `original`/`new`
 /// hold the whole lock fragment as a string, the edit's `key` embeds
 /// `<name>@<version>`, and the revert is a `replacen(new, original)`.
@@ -1229,6 +1390,605 @@ mod tests {
         (tmp, state)
     }
 
+    /// Bug I: two redirected versions of one crate share the manifest edit
+    /// key (the crate name). Removing one version must revert ONLY its own
+    /// declaration + lock entry + registry block — claiming the sibling's
+    /// manifest edit reverted the other pin while its lock entry stayed
+    /// hosted (a broken build), and dropped the sibling's registry edit, so
+    /// the second removal left the created `.cargo/config.toml` behind.
+    #[tokio::test]
+    async fn multi_version_removes_each_version_independently() {
+        const UUID_OLD: &str = "3c5d7e9f-2a4b-4c6d-8e0f-1a3b5c7d9e1f";
+        const PURL_OLD: &str = "pkg:cargo/cfg-if@0.1.10";
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path();
+        let toml = "[package]\nname = \"app\"\nversion = \"0.1.0\"\n\n[dependencies]\n\
+                    cfg-if = \"1.0\"\ncfg-if-legacy = { package = \"cfg-if\", version = \"0.1.10\" }\n";
+        let lock = format!(
+            "version = 4\n\n[[package]]\nname = \"cfg-if\"\nversion = \"0.1.10\"\n\
+             source = \"{CRATES_IO}\"\nchecksum = \"{}\"\n\n{}\n",
+            "8".repeat(64),
+            pristine_lock_block()
+        );
+        let dep = |version: &str, uuid: &str| -> crate::patch::redirect::DepOverride {
+            serde_json::from_value(serde_json::json!({
+                "ecosystem": "cargo", "name": "cfg-if", "version": version, "token": "tok",
+                "patchUuid": uuid,
+                "artifactUrl": format!("http://127.0.0.1:5555/cfg-if-{version}.crate"),
+                "registryOverride": {
+                    "kind": "cargo-sparse",
+                    "indexUrl": format!("sparse+http://127.0.0.1:5555/{uuid}/index/"),
+                    "identifiers": {
+                        "name": "cfg-if", "version": version,
+                        "cargoCksumSha256": "a".repeat(64),
+                    },
+                },
+                "integrity": { "sha256": "a".repeat(64) },
+            }))
+            .unwrap()
+        };
+        let mut files: BTreeMap<String, String> = BTreeMap::new();
+        files.insert("Cargo.toml".into(), toml.to_string());
+        files.insert("Cargo.lock".into(), lock.clone());
+        let rewrite = crate::patch::redirect::rewrite_registry_redirect(
+            &files,
+            &[dep("1.0.4", UUID), dep("0.1.10", UUID_OLD)],
+        );
+        assert_eq!(
+            rewrite.confirmed_cargo_uuids.len(),
+            2,
+            "{:?}",
+            rewrite.warnings
+        );
+        tokio::fs::write(root.join("Cargo.toml"), toml)
+            .await
+            .unwrap();
+        tokio::fs::write(root.join("Cargo.lock"), &lock)
+            .await
+            .unwrap();
+        for (rel, content) in &rewrite.files {
+            let path = root.join(rel);
+            tokio::fs::create_dir_all(path.parent().unwrap())
+                .await
+                .unwrap();
+            tokio::fs::write(&path, content).await.unwrap();
+        }
+        let mut state = RedirectState::new();
+        state.edits = rewrite.edits;
+        state.records.insert(PURL.to_string(), record());
+        let mut old = record();
+        old.uuid = UUID_OLD.to_string();
+        state.records.insert(PURL_OLD.to_string(), old);
+
+        revert_cargo_redirect_purl(root, &mut state, PURL, false)
+            .await
+            .expect("1.0.4 reverts");
+        let t = tokio::fs::read_to_string(root.join("Cargo.toml"))
+            .await
+            .unwrap();
+        assert!(
+            t.contains("cfg-if = \"1.0\"\n")
+                && t.contains(&format!("registry = \"socket-patch-{UUID_OLD}\"")),
+            "only the 1.0.4 pin is reverted: {t}"
+        );
+        let l = tokio::fs::read_to_string(root.join("Cargo.lock"))
+            .await
+            .unwrap();
+        assert!(
+            l.contains(&format!("sparse+http://127.0.0.1:5555/{UUID_OLD}/index/")),
+            "{l}"
+        );
+        let cfg = tokio::fs::read_to_string(root.join(".cargo/config.toml"))
+            .await
+            .unwrap();
+        assert!(
+            !cfg.contains(&format!("socket-patch-{UUID}]")) && cfg.contains(UUID_OLD),
+            "{cfg}"
+        );
+
+        revert_cargo_redirect_purl(root, &mut state, PURL_OLD, false)
+            .await
+            .expect("0.1.10 reverts");
+        assert_eq!(
+            tokio::fs::read_to_string(root.join("Cargo.toml"))
+                .await
+                .unwrap(),
+            toml
+        );
+        assert_eq!(
+            tokio::fs::read_to_string(root.join("Cargo.lock"))
+                .await
+                .unwrap(),
+            lock
+        );
+        assert!(
+            !root.join(".cargo/config.toml").exists(),
+            "the created config goes with the last block"
+        );
+        assert!(
+            state.edits.is_empty() && state.records.is_empty(),
+            "{:?}",
+            state.edits
+        );
+    }
+
+    /// A hosted override for `name@version` at patch `uuid`.
+    fn cargo_dep(name: &str, version: &str, uuid: &str) -> crate::patch::redirect::DepOverride {
+        serde_json::from_value(serde_json::json!({
+            "ecosystem": "cargo", "name": name, "version": version, "token": "tok",
+            "patchUuid": uuid,
+            "artifactUrl": format!("http://127.0.0.1:5555/{name}-{version}.crate"),
+            "registryOverride": {
+                "kind": "cargo-sparse",
+                "indexUrl": format!("sparse+http://127.0.0.1:5555/{uuid}/index/"),
+                "identifiers": {
+                    "name": name, "version": version,
+                    "cargoCksumSha256": "a".repeat(64),
+                },
+            },
+            "integrity": { "sha256": "a".repeat(64) },
+        }))
+        .unwrap()
+    }
+
+    /// Redirect `deps` (applied in order) over a pristine project with the
+    /// real rewriter, write the output to a tempdir, and return the ledger
+    /// with one record per purl.
+    async fn redirect_on_disk(
+        toml: &str,
+        lock: &str,
+        deps: &[(&str, &str, &str)],
+    ) -> (tempfile::TempDir, RedirectState) {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path();
+        let mut files: BTreeMap<String, String> = BTreeMap::new();
+        files.insert("Cargo.toml".into(), toml.to_string());
+        files.insert("Cargo.lock".into(), lock.to_string());
+        let overrides: Vec<_> = deps
+            .iter()
+            .map(|(name, version, uuid)| cargo_dep(name, version, uuid))
+            .collect();
+        let rewrite = crate::patch::redirect::rewrite_registry_redirect(&files, &overrides);
+        assert_eq!(
+            rewrite.confirmed_cargo_uuids.len(),
+            deps.len(),
+            "{:?}",
+            rewrite.warnings
+        );
+        for (rel, content) in files.iter().chain(rewrite.files.iter()) {
+            let path = root.join(rel);
+            tokio::fs::create_dir_all(path.parent().unwrap())
+                .await
+                .unwrap();
+            tokio::fs::write(&path, content).await.unwrap();
+        }
+        let mut state = RedirectState::new();
+        state.edits = rewrite.edits;
+        for (name, version, uuid) in deps {
+            let mut rec = record();
+            rec.uuid = uuid.to_string();
+            state
+                .records
+                .insert(format!("pkg:cargo/{name}@{version}"), rec);
+        }
+        (tmp, state)
+    }
+
+    /// Redirect `deps`, then remove the purls in EVERY order: each order
+    /// must succeed and restore the manifest and lock byte-for-byte, with no
+    /// config and no ledger left.
+    async fn assert_removes_in_every_order(toml: &str, lock: &str, deps: &[(&str, &str, &str)]) {
+        let purls: Vec<String> = deps
+            .iter()
+            .map(|(name, version, _)| format!("pkg:cargo/{name}@{version}"))
+            .collect();
+        for order in [purls.clone(), purls.iter().rev().cloned().collect()] {
+            let (tmp, mut state) = redirect_on_disk(toml, lock, deps).await;
+            let root = tmp.path();
+            for purl in &order {
+                revert_cargo_redirect_purl(root, &mut state, purl, false)
+                    .await
+                    .unwrap_or_else(|e| panic!("remove {purl} (order {order:?}): {e}"));
+            }
+            assert_eq!(
+                tokio::fs::read_to_string(root.join("Cargo.toml"))
+                    .await
+                    .unwrap(),
+                toml,
+                "{order:?}"
+            );
+            assert_eq!(
+                tokio::fs::read_to_string(root.join("Cargo.lock"))
+                    .await
+                    .unwrap(),
+                lock,
+                "{order:?}"
+            );
+            assert!(!root.join(".cargo/config.toml").exists(), "{order:?}");
+            assert!(
+                state.edits.is_empty() && state.records.is_empty(),
+                "{order:?}: {:?}",
+                state.edits
+            );
+        }
+    }
+
+    /// A v1 lock names every dependency by its full id, so the root block
+    /// references BOTH patched cfg-if versions. REGRESSION: each dependent
+    /// block was one whole-block edit, the second version's edit recorded
+    /// the first one's output as its `original`, and removing the
+    /// first-applied version alone found neither fragment — `remove`
+    /// refused as drifted unless purls went in exact reverse apply order.
+    #[tokio::test]
+    async fn v1_lock_multi_version_removes_in_any_order() {
+        const UUID_OLD: &str = "3c5d7e9f-2a4b-4c6d-8e0f-1a3b5c7d9e1f";
+        let toml = "[package]\nname = \"app\"\nversion = \"0.1.0\"\n\n[dependencies]\n\
+                    cfg-if = \"1.0\"\ncfg-if-legacy = { package = \"cfg-if\", version = \"0.1.10\" }\n";
+        let lock = format!(
+            "[[package]]\nname = \"app\"\nversion = \"0.1.0\"\ndependencies = [\n \
+             \"cfg-if 0.1.10 ({CRATES_IO})\",\n \"cfg-if 1.0.4 ({CRATES_IO})\",\n]\n\n\
+             [[package]]\nname = \"cfg-if\"\nversion = \"0.1.10\"\nsource = \"{CRATES_IO}\"\n\n\
+             [[package]]\nname = \"cfg-if\"\nversion = \"1.0.4\"\nsource = \"{CRATES_IO}\"\n\n\
+             [metadata]\n\"checksum cfg-if 0.1.10 ({CRATES_IO})\" = \"{}\"\n\
+             \"checksum cfg-if 1.0.4 ({CRATES_IO})\" = \"{}\"\n",
+            "8".repeat(64),
+            "9".repeat(64)
+        );
+        assert_removes_in_every_order(
+            toml,
+            &lock,
+            &[("cfg-if", "1.0.4", UUID), ("cfg-if", "0.1.10", UUID_OLD)],
+        )
+        .await;
+    }
+
+    const UUID_LEGACY: &str = "3c5d7e9f-2a4b-4c6d-8e0f-1a3b5c7d9e1f";
+
+    /// The two-declaration cfg-if project (1.0.4 as `cfg-if`, 0.1.10 as a
+    /// renamed `cfg-if-legacy`) and its crates.io lock.
+    fn multi_version_project() -> (String, String) {
+        let toml = "[package]\nname = \"app\"\nversion = \"0.1.0\"\n\n[dependencies]\n\
+                    cfg-if = \"1.0\"\ncfg-if-legacy = { package = \"cfg-if\", version = \"0.1.10\" }\n";
+        let lock = format!(
+            "version = 4\n\n[[package]]\nname = \"cfg-if\"\nversion = \"0.1.10\"\n\
+             source = \"{CRATES_IO}\"\nchecksum = \"{}\"\n\n{}\n",
+            "8".repeat(64),
+            pristine_lock_block()
+        );
+        (toml.to_string(), lock)
+    }
+
+    /// Remove `order` from `state` over `root`, then require the pristine
+    /// project back with no config and an empty ledger.
+    async fn remove_all_and_expect_pristine(
+        root: &Path,
+        mut state: RedirectState,
+        order: &[&str],
+        toml: &str,
+        lock: &str,
+    ) {
+        for purl in order {
+            revert_cargo_redirect_purl(root, &mut state, purl, false)
+                .await
+                .unwrap_or_else(|e| panic!("remove {purl} (order {order:?}): {e}"));
+        }
+        assert_eq!(
+            tokio::fs::read_to_string(root.join("Cargo.toml"))
+                .await
+                .unwrap(),
+            toml,
+            "{order:?}"
+        );
+        assert_eq!(
+            tokio::fs::read_to_string(root.join("Cargo.lock"))
+                .await
+                .unwrap(),
+            lock,
+            "{order:?}"
+        );
+        assert!(!root.join(".cargo/config.toml").exists(), "{order:?}");
+        assert!(
+            state.edits.is_empty() && state.records.is_empty(),
+            "{order:?}: {:?}",
+            state.edits
+        );
+    }
+
+    /// A ledger an older CLI wrote with its name-only manifest matcher for
+    /// both cfg-if versions: each run pinned BOTH declarations to its own
+    /// registry, so the file ends with both on the 0.1.10 registry and the
+    /// ledger holds plain→1.0.4 then 1.0.4→0.1.10 edits for both lines.
+    /// REGRESSION: removing 1.0.4 first claimed the plain→1.0.4 edit of the
+    /// 0.1.10 declaration but not its 1.0.4→0.1.10 successor, found neither
+    /// fragment and refused as drifted; removing 0.1.10 first dropped the
+    /// still-referenced 0.1.10 registry edit and left the config behind.
+    #[tokio::test]
+    async fn legacy_name_only_multi_version_ledger_removes_in_any_order() {
+        let (toml, lock) = multi_version_project();
+        let reg = |uuid: &str| format!("socket-patch-{uuid}");
+        let index = |uuid: &str| format!("sparse+http://127.0.0.1:5555/{uuid}/index/");
+        let line1 = |r: Option<&str>| match r {
+            None => "cfg-if = \"1.0\"".to_string(),
+            Some(r) => format!("cfg-if = {{ version = \"1.0\", registry = \"{r}\" }}"),
+        };
+        let line2 = |r: Option<&str>| {
+            match r {
+            None => "cfg-if-legacy = { package = \"cfg-if\", version = \"0.1.10\" }".to_string(),
+            Some(r) => format!(
+                "cfg-if-legacy = {{ package = \"cfg-if\", version = \"0.1.10\", registry = \"{r}\" }}"
+            ),
+        }
+        };
+        let block = |version: &str, source: &str, cksum: &str| {
+            format!(
+                "[[package]]\nname = \"cfg-if\"\nversion = \"{version}\"\nsource = \"{source}\"\n\
+                 checksum = \"{cksum}\""
+            )
+        };
+        let (a, b) = (reg(UUID), reg(UUID_LEGACY));
+        let edit =
+            |path: &str, kind: &str, key: &str, orig: Option<String>, new: String| FileEdit {
+                path: path.to_string(),
+                kind: kind.to_string(),
+                action: if orig.is_some() { "rewritten" } else { "added" }.to_string(),
+                key: Some(key.to_string()),
+                original: orig.map(Value::String),
+                new: Some(Value::String(new)),
+            };
+        let registry = |uuid: &str| {
+            edit(
+                ".cargo/config.toml",
+                "redirect_cargo_registry",
+                &reg(uuid),
+                None,
+                format!("[registries.{}]\nindex = \"{}\"\n", reg(uuid), index(uuid)),
+            )
+        };
+        let lock_edit = |version: &str, uuid: &str, crates_cksum: &str| {
+            edit(
+                "Cargo.lock",
+                "redirect_cargo_lock_entry",
+                &format!("cfg-if@{version}"),
+                Some(block(version, CRATES_IO, crates_cksum)),
+                block(version, &index(uuid), &"a".repeat(64)),
+            )
+        };
+        let toml_edit = |orig: String, new: String| {
+            edit(
+                "Cargo.toml",
+                "redirect_cargo_toml_dep",
+                "cfg-if",
+                Some(orig),
+                new,
+            )
+        };
+        let edits = vec![
+            registry(UUID),
+            toml_edit(line1(None), line1(Some(&a))),
+            toml_edit(line2(None), line2(Some(&a))),
+            lock_edit("1.0.4", UUID, &"9".repeat(64)),
+            registry(UUID_LEGACY),
+            toml_edit(line1(Some(&a)), line1(Some(&b))),
+            toml_edit(line2(Some(&a)), line2(Some(&b))),
+            lock_edit("0.1.10", UUID_LEGACY, &"8".repeat(64)),
+        ];
+        let live_toml = toml
+            .replace(&line1(None), &line1(Some(&b)))
+            .replace(&line2(None), &line2(Some(&b)));
+        let live_lock = lock
+            .replace(
+                &block("1.0.4", CRATES_IO, &"9".repeat(64)),
+                &block("1.0.4", &index(UUID), &"a".repeat(64)),
+            )
+            .replace(
+                &block("0.1.10", CRATES_IO, &"8".repeat(64)),
+                &block("0.1.10", &index(UUID_LEGACY), &"a".repeat(64)),
+            );
+        let live_config = format!(
+            "{}\n{}",
+            edits[0].new.as_ref().and_then(Value::as_str).unwrap(),
+            edits[4].new.as_ref().and_then(Value::as_str).unwrap()
+        );
+        for order in [
+            ["pkg:cargo/cfg-if@1.0.4", "pkg:cargo/cfg-if@0.1.10"],
+            ["pkg:cargo/cfg-if@0.1.10", "pkg:cargo/cfg-if@1.0.4"],
+        ] {
+            let tmp = tempfile::tempdir().unwrap();
+            let root = tmp.path();
+            tokio::fs::create_dir_all(root.join(".cargo"))
+                .await
+                .unwrap();
+            tokio::fs::write(root.join("Cargo.toml"), &live_toml)
+                .await
+                .unwrap();
+            tokio::fs::write(root.join("Cargo.lock"), &live_lock)
+                .await
+                .unwrap();
+            tokio::fs::write(root.join(".cargo/config.toml"), &live_config)
+                .await
+                .unwrap();
+            let mut state = RedirectState::new();
+            state.edits = edits.clone();
+            state.records.insert(PURL.to_string(), record());
+            let mut old = record();
+            old.uuid = UUID_LEGACY.to_string();
+            state
+                .records
+                .insert("pkg:cargo/cfg-if@0.1.10".to_string(), old);
+            remove_all_and_expect_pristine(root, state, &order, &toml, &lock).await;
+        }
+    }
+
+    /// An older CLI redirected only 1.0.4 and its name-only matcher also
+    /// pinned the 0.1.10 declaration to 1.0.4's registry; the current
+    /// planner then repaired it (superseding that pin with 0.1.10's own
+    /// registry) while redirecting 0.1.10. REGRESSION: removing 1.0.4
+    /// claimed the old mis-pin edit, whose fragments were both gone, and
+    /// refused as drifted.
+    #[tokio::test]
+    async fn repaired_legacy_mispin_removes_in_any_order() {
+        let (toml, lock) = multi_version_project();
+        let legacy = "cfg-if-legacy = { package = \"cfg-if\", version = \"0.1.10\" }";
+        let mispinned = format!(
+            "cfg-if-legacy = {{ package = \"cfg-if\", version = \"0.1.10\", registry = \"socket-patch-{UUID}\" }}"
+        );
+        // The old CLI's run: 1.0.4 only, plus its mis-pin of the legacy line.
+        let mut files: BTreeMap<String, String> = BTreeMap::new();
+        files.insert("Cargo.toml".into(), toml.clone());
+        files.insert("Cargo.lock".into(), lock.clone());
+        let old_run = crate::patch::redirect::rewrite_registry_redirect(
+            &files,
+            &[cargo_dep("cfg-if", "1.0.4", UUID)],
+        );
+        let mut edits = old_run.edits.clone();
+        let at = edits
+            .iter()
+            .position(|e| e.kind == "redirect_cargo_toml_dep")
+            .unwrap();
+        let mut mispin = edits[at].clone();
+        mispin.original = Some(Value::String(legacy.to_string()));
+        mispin.new = Some(Value::String(mispinned.clone()));
+        edits.insert(at + 1, mispin);
+        let mut live = files.clone();
+        live.extend(old_run.files.clone());
+        let t = live["Cargo.toml"].replace(legacy, &mispinned);
+        live.insert("Cargo.toml".into(), t);
+        // The current CLI's run with both patches repairs the mis-pin.
+        let new_run = crate::patch::redirect::rewrite_registry_redirect(
+            &live,
+            &[
+                cargo_dep("cfg-if", "1.0.4", UUID),
+                cargo_dep("cfg-if", "0.1.10", UUID_LEGACY),
+            ],
+        );
+        assert!(new_run.warnings.is_empty(), "{:?}", new_run.warnings);
+        edits.extend(new_run.edits.clone());
+        live.extend(new_run.files.clone());
+        for order in [
+            ["pkg:cargo/cfg-if@1.0.4", "pkg:cargo/cfg-if@0.1.10"],
+            ["pkg:cargo/cfg-if@0.1.10", "pkg:cargo/cfg-if@1.0.4"],
+        ] {
+            let tmp = tempfile::tempdir().unwrap();
+            let root = tmp.path();
+            for (rel, content) in &live {
+                let path = root.join(rel);
+                tokio::fs::create_dir_all(path.parent().unwrap())
+                    .await
+                    .unwrap();
+                tokio::fs::write(&path, content).await.unwrap();
+            }
+            let mut state = RedirectState::new();
+            state.edits = edits.clone();
+            state.records.insert(PURL.to_string(), record());
+            let mut old = record();
+            old.uuid = UUID_LEGACY.to_string();
+            state
+                .records
+                .insert("pkg:cargo/cfg-if@0.1.10".to_string(), old);
+            remove_all_and_expect_pristine(root, state, &order, &toml, &lock).await;
+        }
+    }
+
+    /// The whole-ledger replay (rollback) inverts a v1 full-id reference
+    /// named by several dependents at every occurrence.
+    #[tokio::test]
+    async fn v1_lock_reference_named_by_several_dependents_replays_clean() {
+        let toml = "[workspace]\nmembers = [\"a\", \"b\"]\n\n\
+                    [workspace.dependencies]\ncfg-if = \"1.0\"\n";
+        let member = |name: &str| {
+            format!(
+                "[package]\nname = \"{name}\"\nversion = \"0.1.0\"\n\n\
+                 [dependencies]\ncfg-if = {{ workspace = true }}\n"
+            )
+        };
+        let lock = format!(
+            "[[package]]\nname = \"a\"\nversion = \"0.1.0\"\ndependencies = [\n \
+             \"cfg-if 1.0.4 ({CRATES_IO})\",\n]\n\n\
+             [[package]]\nname = \"b\"\nversion = \"0.1.0\"\ndependencies = [\n \
+             \"cfg-if 1.0.4 ({CRATES_IO})\",\n]\n\n\
+             [[package]]\nname = \"cfg-if\"\nversion = \"1.0.4\"\nsource = \"{CRATES_IO}\"\n\n\
+             [metadata]\n\"checksum cfg-if 1.0.4 ({CRATES_IO})\" = \"{}\"\n",
+            "9".repeat(64)
+        );
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path();
+        let mut files: BTreeMap<String, String> = BTreeMap::new();
+        files.insert("Cargo.toml".into(), toml.to_string());
+        files.insert("Cargo.lock".into(), lock.clone());
+        files.insert("a/Cargo.toml".into(), member("a"));
+        files.insert("b/Cargo.toml".into(), member("b"));
+        let rewrite = crate::patch::redirect::rewrite_registry_redirect(
+            &files,
+            &[cargo_dep("cfg-if", "1.0.4", UUID)],
+        );
+        assert_eq!(
+            rewrite.confirmed_cargo_uuids.len(),
+            1,
+            "{:?}",
+            rewrite.warnings
+        );
+        let references: Vec<&FileEdit> = rewrite
+            .edits
+            .iter()
+            .filter(|e| e.kind == super::super::CARGO_LOCK_REFERENCE_KIND)
+            .collect();
+        assert_eq!(
+            references.len(),
+            1,
+            "one edit per full id: {:?}",
+            rewrite.edits
+        );
+        for (rel, content) in files.iter().chain(rewrite.files.iter()) {
+            let path = root.join(rel);
+            tokio::fs::create_dir_all(path.parent().unwrap())
+                .await
+                .unwrap();
+            tokio::fs::write(&path, content).await.unwrap();
+        }
+        let mut state = RedirectState::new();
+        state.edits = rewrite.edits;
+        state.records.insert(PURL.to_string(), record());
+        let outcome =
+            crate::patch::redirect::revert_remaining_redirect_edits(root, &mut state, false).await;
+        assert!(outcome.fully_reverted(), "{:?}", outcome.refusals);
+        assert_eq!(
+            tokio::fs::read_to_string(root.join("Cargo.lock"))
+                .await
+                .unwrap(),
+            lock
+        );
+        assert_eq!(
+            tokio::fs::read_to_string(root.join("Cargo.toml"))
+                .await
+                .unwrap(),
+            toml
+        );
+    }
+
+    /// Two different patched crates with one shared v1 dependent block.
+    #[tokio::test]
+    async fn v1_lock_two_crates_sharing_a_dependent_remove_in_any_order() {
+        const UUID_ITOA: &str = "4d6e8f0a-3b5c-4d7e-9f1a-2b4c6d8e0f2a";
+        let toml = "[package]\nname = \"app\"\nversion = \"0.1.0\"\n\n[dependencies]\n\
+                    cfg-if = \"1.0\"\nitoa = \"1.0.11\"\n";
+        let lock = format!(
+            "[[package]]\nname = \"app\"\nversion = \"0.1.0\"\ndependencies = [\n \
+             \"cfg-if 1.0.4 ({CRATES_IO})\",\n \"itoa 1.0.11 ({CRATES_IO})\",\n]\n\n\
+             [[package]]\nname = \"cfg-if\"\nversion = \"1.0.4\"\nsource = \"{CRATES_IO}\"\n\n\
+             [[package]]\nname = \"itoa\"\nversion = \"1.0.11\"\nsource = \"{CRATES_IO}\"\n\n\
+             [metadata]\n\"checksum cfg-if 1.0.4 ({CRATES_IO})\" = \"{}\"\n\
+             \"checksum itoa 1.0.11 ({CRATES_IO})\" = \"{}\"\n",
+            "8".repeat(64),
+            "9".repeat(64)
+        );
+        assert_removes_in_every_order(
+            toml,
+            &lock,
+            &[("cfg-if", "1.0.4", UUID), ("itoa", "1.0.11", UUID_ITOA)],
+        )
+        .await;
+    }
+
     #[tokio::test]
     async fn reverts_toml_lock_and_registry_block_and_drops_ledger_entries() {
         let (tmp, mut state) = redirected_fixture().await;
@@ -3802,6 +4562,219 @@ mod tests {
         assert!(state.edits.is_empty(), "edits dropped");
     }
 
+    /// Bug H: removing the block the redirect APPENDED to an existing
+    /// config (the legacy `.cargo/config` here) restores the user's bytes —
+    /// it left a trailing blank line (`[net]\nretry = 2\n\n`) — and never
+    /// touches blank runs of the user's own elsewhere in the file.
+    #[tokio::test]
+    async fn appended_registry_block_revert_restores_the_config_bytes() {
+        let cases = [
+            "[net]\nretry = 2\n",
+            "[net]\n\n\n\nretry = 2\n",
+            "# a comment\n\n[http]\ntimeout = 5\n",
+            "[net]\r\nretry = 2\r\n",
+            // No final newline, trailing blank lines, whitespace only.
+            "[net]\nretry = 2",
+            "[net]\r\nretry = 2",
+            "[net]\nretry = 2\n\n",
+            "[net]\r\nretry = 2\r\n\r\n",
+            "\n",
+        ];
+        // Both unwind paths: `remove <purl>` and the whole-ledger replay.
+        for (user_cfg, replay) in cases.iter().flat_map(|cfg| [(*cfg, false), (*cfg, true)]) {
+            let tmp = tempfile::tempdir().unwrap();
+            let root = tmp.path();
+            let lock = format!("version = 4\n\n{}\n", pristine_lock_block());
+            let mut files: BTreeMap<String, String> = BTreeMap::new();
+            files.insert("Cargo.toml".into(), pristine_toml());
+            files.insert("Cargo.lock".into(), lock.clone());
+            files.insert(".cargo/config".into(), user_cfg.to_string());
+            let dep: crate::patch::redirect::DepOverride =
+                serde_json::from_value(serde_json::json!({
+                    "ecosystem": "cargo", "name": "cfg-if", "version": "1.0.4",
+                    "token": "tok", "patchUuid": UUID,
+                    "artifactUrl": "http://127.0.0.1:5555/cfg-if-1.0.4.crate",
+                    "registryOverride": {
+                        "kind": "cargo-sparse", "indexUrl": INDEX,
+                        "identifiers": {
+                            "name": "cfg-if", "version": "1.0.4",
+                            "cargoCksumSha256": "a".repeat(64),
+                        },
+                    },
+                    "integrity": { "sha256": "a".repeat(64) },
+                }))
+                .unwrap();
+            let rewrite = crate::patch::redirect::rewrite_registry_redirect(&files, &[dep]);
+            tokio::fs::create_dir_all(root.join(".cargo"))
+                .await
+                .unwrap();
+            for (rel, content) in files.iter().chain(rewrite.files.iter()) {
+                tokio::fs::write(root.join(rel), content).await.unwrap();
+            }
+            let mut state = RedirectState::new();
+            state.edits = rewrite.edits;
+            state.records.insert(PURL.to_string(), record());
+
+            if replay {
+                let outcome = crate::patch::redirect::revert_remaining_redirect_edits(
+                    root, &mut state, false,
+                )
+                .await;
+                assert!(outcome.fully_reverted(), "{:?}", outcome.refusals);
+            } else {
+                revert_cargo_redirect_purl(root, &mut state, PURL, false)
+                    .await
+                    .expect("revert succeeds");
+            }
+            assert_eq!(
+                tokio::fs::read_to_string(root.join(".cargo/config"))
+                    .await
+                    .unwrap(),
+                user_cfg,
+                "replay: {replay}"
+            );
+            assert_eq!(
+                tokio::fs::read_to_string(root.join("Cargo.toml"))
+                    .await
+                    .unwrap(),
+                pristine_toml()
+            );
+            assert_eq!(
+                tokio::fs::read_to_string(root.join("Cargo.lock"))
+                    .await
+                    .unwrap(),
+                lock
+            );
+        }
+    }
+
+    /// Bug K: a CRLF project (manifest, lock and legacy config) is
+    /// redirected with CRLF kept and `remove` restores every byte.
+    #[tokio::test]
+    async fn crlf_project_reverts_byte_for_byte() {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path();
+        let crlf = |s: &str| s.replace('\n', "\r\n");
+        let mut files: BTreeMap<String, String> = BTreeMap::new();
+        files.insert("Cargo.toml".into(), crlf(&pristine_toml()));
+        files.insert(
+            "Cargo.lock".into(),
+            crlf(&format!("version = 4\n\n{}\n", pristine_lock_block())),
+        );
+        files.insert(".cargo/config".into(), crlf("[net]\nretry = 2\n"));
+        let dep: crate::patch::redirect::DepOverride = serde_json::from_value(serde_json::json!({
+            "ecosystem": "cargo", "name": "cfg-if", "version": "1.0.4",
+            "token": "tok", "patchUuid": UUID,
+            "artifactUrl": "http://127.0.0.1:5555/cfg-if-1.0.4.crate",
+            "registryOverride": {
+                "kind": "cargo-sparse", "indexUrl": INDEX,
+                "identifiers": {
+                    "name": "cfg-if", "version": "1.0.4",
+                    "cargoCksumSha256": "a".repeat(64),
+                },
+            },
+            "integrity": { "sha256": "a".repeat(64) },
+        }))
+        .unwrap();
+        let rewrite = crate::patch::redirect::rewrite_registry_redirect(&files, &[dep]);
+        assert_eq!(rewrite.files.len(), 3, "{:?}", rewrite.warnings);
+        tokio::fs::create_dir_all(root.join(".cargo"))
+            .await
+            .unwrap();
+        for (rel, content) in files.iter().chain(rewrite.files.iter()) {
+            tokio::fs::write(root.join(rel), content).await.unwrap();
+        }
+        let mut state = RedirectState::new();
+        state.edits = rewrite.edits;
+        state.records.insert(PURL.to_string(), record());
+        revert_cargo_redirect_purl(root, &mut state, PURL, false)
+            .await
+            .expect("revert succeeds");
+        for (rel, content) in &files {
+            assert_eq!(
+                &tokio::fs::read_to_string(root.join(rel)).await.unwrap(),
+                content,
+                "{rel}"
+            );
+        }
+    }
+
+    /// A ledger recorded on one side of a line-ending conversion reverts
+    /// files checked out on the other: a Windows scan (CRLF fragments,
+    /// JSON-escaped, so git never converts them) removed on an LF checkout,
+    /// and an LF scan removed on a CRLF (`core.autocrlf`) checkout — through
+    /// `remove` and through the whole-ledger replay. REGRESSION: both
+    /// refused as "drifted" (neither fragment found byte-for-byte).
+    #[tokio::test]
+    async fn revert_survives_a_checkout_line_ending_conversion() {
+        let crlf = |s: &str| s.replace('\n', "\r\n");
+        let lf = |s: &str| s.replace("\r\n", "\n");
+        let pristine: Vec<(&str, String)> = vec![
+            ("Cargo.toml", pristine_toml()),
+            (
+                "Cargo.lock",
+                format!("version = 4\n\n{}\n", pristine_lock_block()),
+            ),
+            (".cargo/config", "[net]\nretry = 2\n".to_string()),
+        ];
+        for (scan_crlf, replay) in [(true, false), (false, false), (true, true), (false, true)] {
+            let tmp = tempfile::tempdir().unwrap();
+            let root = tmp.path();
+            let scanned = |s: &str| if scan_crlf { crlf(s) } else { s.to_string() };
+            let checked_out = |s: &str| if scan_crlf { lf(s) } else { crlf(s) };
+            let files: BTreeMap<String, String> = pristine
+                .iter()
+                .map(|(rel, text)| (rel.to_string(), scanned(text)))
+                .collect();
+            let rewrite = crate::patch::redirect::rewrite_registry_redirect(
+                &files,
+                &[cargo_dep("cfg-if", "1.0.4", UUID)],
+            );
+            assert_eq!(rewrite.files.len(), 3, "{:?}", rewrite.warnings);
+            tokio::fs::create_dir_all(root.join(".cargo"))
+                .await
+                .unwrap();
+            for (rel, content) in files.iter().chain(rewrite.files.iter()) {
+                tokio::fs::write(root.join(rel), checked_out(content))
+                    .await
+                    .unwrap();
+            }
+            // The ledger round-trips through its JSON file unchanged.
+            let mut state: RedirectState = serde_json::from_str(
+                &serde_json::to_string(&{
+                    let mut state = RedirectState::new();
+                    state.edits = rewrite.edits.clone();
+                    state.records.insert(PURL.to_string(), record());
+                    state
+                })
+                .unwrap(),
+            )
+            .unwrap();
+            if replay {
+                let outcome = crate::patch::redirect::revert_remaining_redirect_edits(
+                    root, &mut state, false,
+                )
+                .await;
+                assert!(
+                    outcome.fully_reverted(),
+                    "scan crlf {scan_crlf}: {:?}",
+                    outcome.refusals
+                );
+            } else {
+                revert_cargo_redirect_purl(root, &mut state, PURL, false)
+                    .await
+                    .unwrap_or_else(|e| panic!("scan crlf {scan_crlf}: {e}"));
+            }
+            for (rel, text) in &pristine {
+                assert_eq!(
+                    tokio::fs::read_to_string(root.join(rel)).await.unwrap(),
+                    checked_out(text),
+                    "{rel} (scan crlf {scan_crlf}, replay {replay})"
+                );
+            }
+        }
+    }
+
     /// The socket block was already hand-removed (the config now holds only
     /// user content): skip it, byte-untouched, and still succeed.
     #[tokio::test]
@@ -3838,6 +4811,40 @@ mod tests {
         assert!(state.edits.is_empty(), "edits dropped");
     }
 
+    /// The whole-ledger replay keeps a hand-pinned block too (it removed
+    /// it unconditionally, leaving the hand pin naming an undefined
+    /// registry), while still unwinding the wiring it owns.
+    #[tokio::test]
+    async fn replay_keeps_a_registry_block_still_referenced() {
+        let (tmp, mut state) = redirected_fixture().await;
+        let root = tmp.path();
+        let reg = format!("socket-patch-{UUID}");
+        let pinned_line = format!("other = {{ version = \"1.0\", registry = \"{reg}\" }}\n");
+        let wired_toml = tokio::fs::read_to_string(root.join("Cargo.toml"))
+            .await
+            .unwrap();
+        tokio::fs::write(
+            root.join("Cargo.toml"),
+            format!("{wired_toml}{pinned_line}"),
+        )
+        .await
+        .unwrap();
+        let outcome =
+            crate::patch::redirect::revert_remaining_redirect_edits(root, &mut state, false).await;
+        assert!(outcome.fully_reverted(), "{:?}", outcome.refusals);
+        let cfg = tokio::fs::read_to_string(root.join(".cargo/config.toml"))
+            .await
+            .unwrap();
+        assert!(cfg.contains(&reg), "block kept while referenced: {cfg}");
+        assert_eq!(
+            tokio::fs::read_to_string(root.join("Cargo.toml"))
+                .await
+                .unwrap(),
+            format!("{}{pinned_line}", pristine_toml())
+        );
+        assert!(state.edits.is_empty(), "{:?}", state.edits);
+    }
+
     /// A user hand-pinned a SECOND dep to the socket registry: the block is
     /// kept while anything still references it (the documented defensive
     /// keep), and the takeover still reverts the wiring it owns.
diff --git a/crates/socket-patch-core/src/utils/cargo_workspace.rs b/crates/socket-patch-core/src/utils/cargo_workspace.rs
new file mode 100644
index 00000000..5f30771a
--- /dev/null
+++ b/crates/socket-patch-core/src/utils/cargo_workspace.rs
@@ -0,0 +1,432 @@
+//! The manifests of a cargo workspace beside its root `Cargo.toml`: every
+//! `[workspace] members` glob (minus `exclude`) plus every path dependency
+//! reachable from them, as repo-relative `<dir>/Cargo.toml` keys.
+//!
+//! The hosted cargo rewriter pins a patched crate in EVERY manifest that
+//! declares it — a member's own `cfg-if = "1"` resolves exactly like the
+//! root's, so leaving it unpinned makes the repointed Cargo.lock entry
+//! unsatisfiable. Only manifests inside the project root, reached without
+//! crossing a symbolic link, are returned: a file outside the root is not
+//! the project's to rewrite, and a link may lead outside it (the writer
+//! would follow it). Cargo still reads those manifests; the rewriter's
+//! Cargo.lock dependents check refuses a crate one of them depends on.
+
+use std::collections::BTreeSet;
+use std::path::{Component, Path, PathBuf};
+
+use toml_edit::{DocumentMut, Item, Table};
+
+/// Upper bound on discovered manifests — a runaway glob (or a hostile tree)
+/// must not turn one scan into an unbounded walk.
+const MAX_MANIFESTS: usize = 4096;
+
+/// Repo-relative `<dir>/Cargo.toml` keys of the workspace members and
+/// in-root path dependencies of the project at `root`, sorted. Empty when
+/// `root/Cargo.toml` is absent or unparseable.
+pub fn member_manifests(root: &Path) -> Vec<String> {
+    let Some(doc) = read_manifest(&root.join("Cargo.toml")) else {
+        return Vec::new();
+    };
+    let mut dirs: BTreeSet<String> = BTreeSet::new();
+    let mut queue: Vec<(String, DocumentMut)> = Vec::new();
+
+    if let Some(ws) = doc.get("workspace").and_then(Item::as_table_like) {
+        let patterns = |key: &str| -> Vec<String> {
+            ws.get(key)
+                .and_then(Item::as_array)
+                .map(|a| {
+                    a.iter()
+                        .filter_map(|v| v.as_str().map(str::to_string))
+                        .collect()
+                })
+                .unwrap_or_default()
+        };
+        let excluded: BTreeSet<String> = patterns("exclude")
+            .iter()
+            .flat_map(|p| expand_glob(root, p))
+            .collect();
+        for pattern in patterns("members") {
+            for dir in expand_glob(root, &pattern) {
+                if !excluded.contains(&dir) {
+                    enqueue(root, dir, &mut dirs, &mut queue);
+                }
+            }
+        }
+    }
+    for dep_dir in path_dependencies(&doc) {
+        if let Some(dir) = normalize_rel("", &dep_dir) {
+            enqueue(root, dir, &mut dirs, &mut queue);
+        }
+    }
+    while let Some((dir, doc)) = queue.pop() {
+        for dep_dir in path_dependencies(&doc) {
+            if let Some(dep) = normalize_rel(&dir, &dep_dir) {
+                enqueue(root, dep, &mut dirs, &mut queue);
+            }
+        }
+    }
+    dirs.into_iter()
+        .map(|dir| format!("{dir}/Cargo.toml"))
+        .collect()
+}
+
+fn read_manifest(path: &Path) -> Option<DocumentMut> {
+    if !std::fs::symlink_metadata(path).is_ok_and(|m| m.is_file()) {
+        return None;
+    }
+    std::fs::read_to_string(path).ok()?.parse().ok()
+}
+
+/// A directory that is not itself a symbolic link.
+fn is_real_dir(path: &Path) -> bool {
+    std::fs::symlink_metadata(path).is_ok_and(|m| m.is_dir())
+}
+
+/// Every component of repo-relative `dir` is a real directory under
+/// `root` — none is a symbolic link (which may lead outside the root).
+fn is_real_dir_path(root: &Path, dir: &str) -> bool {
+    let mut at = root.to_path_buf();
+    dir.split('/').all(|seg| {
+        at.push(seg);
+        is_real_dir(&at)
+    })
+}
+
+fn enqueue(
+    root: &Path,
+    dir: String,
+    dirs: &mut BTreeSet<String>,
+    queue: &mut Vec<(String, DocumentMut)>,
+) {
+    // `target` is cargo's build directory at every level: the glob walk
+    // already skips it, and a literal `members = ["target/gen"]` or a path
+    // dependency into it names a manifest the next `cargo clean` deletes —
+    // pinning it would record a hosted edit whose file can vanish, blocking
+    // the rollback of every other cargo edit.
+    if dir.is_empty()
+        || dirs.len() >= MAX_MANIFESTS
+        || dirs.contains(&dir)
+        || dir.split('/').any(|seg| seg == "target")
+        || !is_real_dir_path(root, &dir)
+    {
+        return;
+    }
+    let Some(doc) = read_manifest(&root.join(&dir).join("Cargo.toml")) else {
+        return;
+    };
+    dirs.insert(dir.clone());
+    queue.push((dir, doc));
+}
+
+/// Every `path = "…"` of a dependency declaration: the dependency tables
+/// (plain and per-target), `[workspace.dependencies]` and `[patch.*]`.
+fn path_dependencies(doc: &DocumentMut) -> Vec<String> {
+    fn dep_paths(table: Option<&Item>, out: &mut Vec<String>) {
+        let Some(table) = table.and_then(Item::as_table_like) else {
+            return;
+        };
+        for (_, entry) in table.iter() {
+            let path = match entry {
+                Item::Table(t) => t.get("path").and_then(Item::as_str),
+                Item::Value(v) => v
+                    .as_inline_table()
+                    .and_then(|t| t.get("path"))
+                    .and_then(|p| p.as_str()),
+                _ => None,
+            };
+            if let Some(path) = path {
+                out.push(path.to_string());
+            }
+        }
+    }
+    fn dep_tables(table: &Table, out: &mut Vec<String>) {
+        for kind in ["dependencies", "dev-dependencies", "build-dependencies"] {
+            dep_paths(table.get(kind), out);
+        }
+    }
+    let mut out = Vec::new();
+    dep_tables(doc.as_table(), &mut out);
+    if let Some(targets) = doc.get("target").and_then(Item::as_table) {
+        for (_, target) in targets.iter() {
+            if let Some(target) = target.as_table() {
+                dep_tables(target, &mut out);
+            }
+        }
+    }
+    if let Some(ws) = doc.get("workspace").and_then(Item::as_table) {
+        dep_paths(ws.get("dependencies"), &mut out);
+    }
+    if let Some(patch) = doc.get("patch").and_then(Item::as_table) {
+        for (_, source) in patch.iter() {
+            dep_paths(Some(source), &mut out);
+        }
+    }
+    out
+}
+
+/// `base/rel` lexically normalized to a repo-relative slash path; `None`
+/// when it is absolute or climbs out of the root.
+pub(crate) fn normalize_rel(base: &str, rel: &str) -> Option<String> {
+    let rel = rel.replace('\\', "/");
+    if rel.starts_with('/') || Path::new(&rel).is_absolute() {
+        return None;
+    }
+    let mut parts: Vec<String> = base
+        .split('/')
+        .filter(|s| !s.is_empty())
+        .map(str::to_string)
+        .collect();
+    for component in Path::new(&rel).components() {
+        match component {
+            Component::Normal(seg) => parts.push(seg.to_str()?.to_string()),
+            Component::CurDir => {}
+            Component::ParentDir => {
+                parts.pop()?;
+            }
+            Component::RootDir | Component::Prefix(_) => return None,
+        }
+    }
+    Some(parts.join("/"))
+}
+
+/// Expand a cargo `members` / `exclude` glob (`*`, `?`, `**`) to the
+/// repo-relative directories it names.
+fn expand_glob(root: &Path, pattern: &str) -> Vec<String> {
+    let Some(normalized) = normalize_rel("", pattern.trim_end_matches('/')) else {
+        return Vec::new();
+    };
+    let segments: Vec<&str> = normalized.split('/').filter(|s| !s.is_empty()).collect();
+    let mut out = Vec::new();
+    expand_from(root, PathBuf::new(), &segments, &mut out);
+    out.sort();
+    out.dedup();
+    out
+}
+
+fn expand_from(root: &Path, at: PathBuf, rest: &[&str], out: &mut Vec<String>) {
+    if out.len() >= MAX_MANIFESTS {
+        return;
+    }
+    let Some((seg, tail)) = rest.split_first() else {
+        out.push(at.to_string_lossy().replace('\\', "/"));
+        return;
+    };
+    if !seg.contains(['*', '?']) {
+        let next = at.join(seg);
+        if is_real_dir(&root.join(&next)) {
+            expand_from(root, next, tail, out);
+        }
+        return;
+    }
+    let Ok(entries) = std::fs::read_dir(root.join(&at)) else {
+        return;
+    };
+    let mut children: Vec<String> = entries
+        .filter_map(Result::ok)
+        .filter(|e| e.file_type().is_ok_and(|t| t.is_dir()))
+        .filter_map(|e| e.file_name().to_str().map(str::to_string))
+        .filter(|name| !name.starts_with('.') && name != "target")
+        .collect();
+    children.sort();
+    if *seg == "**" {
+        expand_from(root, at.clone(), tail, out);
+        for child in children {
+            expand_from(root, at.join(child), rest, out);
+        }
+        return;
+    }
+    for child in children {
+        if wildcard_match(seg.as_bytes(), child.as_bytes()) {
+            expand_from(root, at.join(child), tail, out);
+        }
+    }
+}
+
+fn wildcard_match(pattern: &[u8], name: &[u8]) -> bool {
+    match (pattern.first(), name.first()) {
+        (None, None) => true,
+        (Some(b'*'), _) => {
+            wildcard_match(&pattern[1..], name)
+                || (!name.is_empty() && wildcard_match(pattern, &name[1..]))
+        }
+        (Some(b'?'), Some(_)) => wildcard_match(&pattern[1..], &name[1..]),
+        (Some(p), Some(n)) if p == n => wildcard_match(&pattern[1..], &name[1..]),
+        _ => false,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn write(root: &Path, rel: &str, content: &str) {
+        let path = root.join(rel);
+        std::fs::create_dir_all(path.parent().unwrap()).unwrap();
+        std::fs::write(path, content).unwrap();
+    }
+
+    fn pkg(name: &str) -> String {
+        format!("[package]\nname = \"{name}\"\nversion = \"0.1.0\"\n")
+    }
+
+    #[test]
+    fn members_globs_excludes_and_path_dependencies() {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path();
+        write(
+            root,
+            "Cargo.toml",
+            "[workspace]\nmembers = [\"app\", \"crates/*\"]\nexclude = [\"crates/skip\"]\n",
+        );
+        write(
+            root,
+            "app/Cargo.toml",
+            &format!(
+                "{}[dependencies]\nhelper = {{ path = \"../libs/helper\" }}\n",
+                pkg("app")
+            ),
+        );
+        write(root, "crates/a/Cargo.toml", &pkg("a"));
+        write(root, "crates/skip/Cargo.toml", &pkg("skip"));
+        write(root, "crates/no-manifest/README", "");
+        write(
+            root,
+            "libs/helper/Cargo.toml",
+            &format!(
+                "{}[target.'cfg(unix)'.dependencies]\nleaf = {{ path = \"../leaf\" }}\n\
+                 outside = {{ path = \"../../../elsewhere\" }}\n",
+                pkg("helper")
+            ),
+        );
+        write(root, "libs/leaf/Cargo.toml", &pkg("leaf"));
+        assert_eq!(
+            member_manifests(root),
+            vec![
+                "app/Cargo.toml",
+                "crates/a/Cargo.toml",
+                "libs/helper/Cargo.toml",
+                "libs/leaf/Cargo.toml",
+            ]
+        );
+    }
+
+    #[test]
+    fn a_package_without_workspace_still_reaches_its_path_dependencies() {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path();
+        write(
+            root,
+            "Cargo.toml",
+            &format!("{}[dependencies.inner]\npath = \"inner\"\n", pkg("root")),
+        );
+        write(root, "inner/Cargo.toml", &pkg("inner"));
+        assert_eq!(member_manifests(root), vec!["inner/Cargo.toml"]);
+    }
+
+    #[test]
+    fn recursive_globs_and_missing_root() {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path();
+        assert!(member_manifests(root).is_empty());
+        write(root, "Cargo.toml", "[workspace]\nmembers = [\"**/m?\"]\n");
+        write(root, "x/y/m1/Cargo.toml", &pkg("m1"));
+        write(root, "m2/Cargo.toml", &pkg("m2"));
+        write(root, "target/m3/Cargo.toml", &pkg("m3"));
+        assert_eq!(
+            member_manifests(root),
+            vec!["m2/Cargo.toml", "x/y/m1/Cargo.toml"]
+        );
+    }
+
+    /// Members and path dependencies behind a symbolic link — whether the
+    /// link is a literal member, matched by a glob, a path dependency, an
+    /// intermediate directory or the manifest itself — are never returned:
+    /// the writer would follow the link, possibly out of the project.
+    #[cfg(unix)]
+    #[test]
+    fn symlinked_members_and_path_dependencies_are_not_returned() {
+        use std::os::unix::fs::symlink;
+        let tmp = tempfile::tempdir().unwrap();
+        let outside = tmp.path().join("outside");
+        write(&outside, "shared/Cargo.toml", &pkg("shared"));
+        write(&outside, "lone/Cargo.toml", &pkg("lone"));
+        let root = tmp.path().join("proj");
+        write(
+            &root,
+            "Cargo.toml",
+            &format!(
+                "[workspace]\nmembers = [\"crates/*\", \"linked\", \"nested/inner\"]\n\n\
+                 {}[dependencies]\nvia = {{ path = \"via\" }}\nreal = {{ path = \"real\" }}\n",
+                pkg("root")
+            ),
+        );
+        std::fs::create_dir_all(root.join("crates")).unwrap();
+        symlink(outside.join("shared"), root.join("crates/one")).unwrap();
+        write(&root, "crates/two/Cargo.toml", &pkg("two"));
+        symlink(outside.join("shared"), root.join("linked")).unwrap();
+        symlink(&outside, root.join("nested")).unwrap();
+        std::fs::create_dir_all(outside.join("inner")).unwrap();
+        std::fs::write(outside.join("inner/Cargo.toml"), pkg("inner")).unwrap();
+        symlink(outside.join("lone"), root.join("via")).unwrap();
+        std::fs::create_dir_all(root.join("real")).unwrap();
+        symlink(
+            outside.join("lone/Cargo.toml"),
+            root.join("real/Cargo.toml"),
+        )
+        .unwrap();
+        assert_eq!(member_manifests(&root), vec!["crates/two/Cargo.toml"]);
+    }
+
+    #[test]
+    fn members_and_path_dependencies_outside_the_root_are_not_returned() {
+        let tmp = tempfile::tempdir().unwrap();
+        write(tmp.path(), "lib/Cargo.toml", &pkg("lib"));
+        write(tmp.path(), "shared/Cargo.toml", &pkg("shared"));
+        let root = tmp.path().join("app");
+        write(
+            &root,
+            "Cargo.toml",
+            &format!(
+                "[workspace]\nmembers = [\"../shared\"]\n\n{}[dependencies]\n\
+                 lib = {{ path = \"../lib\" }}\n",
+                pkg("app")
+            ),
+        );
+        assert!(member_manifests(&root).is_empty());
+    }
+
+    /// Cargo's build directory is never a member, whichever way it is
+    /// named: the glob walk skips it, and so do a literal `members` entry
+    /// and a path dependency pointing into it. `cargo clean` deletes those
+    /// manifests, and a recorded hosted edit for a file that no longer
+    /// exists blocks the rollback of every other cargo edit.
+    #[test]
+    fn build_directory_manifests_are_never_members() {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path();
+        write(
+            root,
+            "Cargo.toml",
+            &format!(
+                "[workspace]\nmembers = [\"crates/*\", \"target/generated\"]\n\n\
+                 {}[dependencies]\ngen2 = {{ path = \"target/gen2\" }}\n\
+                 nested = {{ path = \"crates/a/target/gen3\" }}\n",
+                pkg("root")
+            ),
+        );
+        write(root, "crates/a/Cargo.toml", &pkg("a"));
+        write(root, "crates/a/target/gen3/Cargo.toml", &pkg("gen3"));
+        write(root, "target/generated/Cargo.toml", &pkg("generated"));
+        write(root, "target/gen2/Cargo.toml", &pkg("gen2"));
+        assert_eq!(member_manifests(root), vec!["crates/a/Cargo.toml"]);
+    }
+
+    #[test]
+    fn wildcard_matching() {
+        assert!(wildcard_match(b"a*c", b"abbc"));
+        assert!(wildcard_match(b"*", b""));
+        assert!(wildcard_match(b"a?c", b"abc"));
+        assert!(!wildcard_match(b"a?c", b"ac"));
+        assert!(!wildcard_match(b"a*d", b"abc"));
+    }
+}
diff --git a/crates/socket-patch-core/src/utils/mod.rs b/crates/socket-patch-core/src/utils/mod.rs
index 840cdbf2..9c57a536 100644
--- a/crates/socket-patch-core/src/utils/mod.rs
+++ b/crates/socket-patch-core/src/utils/mod.rs
@@ -1,3 +1,4 @@
+pub mod cargo_workspace;
 pub(crate) mod digest;
 pub mod env_compat;
 pub mod fs;
diff --git a/crates/socket-patch-core/src/vendor/cargo.rs b/crates/socket-patch-core/src/vendor/cargo.rs
index bb783c5b..3a8143dd 100644
--- a/crates/socket-patch-core/src/vendor/cargo.rs
+++ b/crates/socket-patch-core/src/vendor/cargo.rs
@@ -232,8 +232,9 @@ pub async fn vendored_entry_in_use(entry: &VendorEntry, project_root: &Path) ->
 }
 
 /// A LIVE hosted-redirect wiring for `name`+`version`: the lock resolves it
-/// from a Socket hosted patch registry, or Cargo.toml pins it to a
-/// `socket-patch-<uuid>` registry (the shapes `scan --mode hosted` writes).
+/// from a Socket hosted patch registry, or a manifest — the root or any
+/// workspace member — pins it to a `socket-patch-<uuid>` registry in any
+/// declaration shape (the shapes `scan --mode hosted` writes).
 /// Registry indexes are matched against the config-declared
 /// `[registries.socket-patch-*]` URLs, not a hardcoded host, so test
 /// registries are recognised too. `Some(description)` when residue is found.
@@ -250,11 +251,23 @@ async fn hosted_redirect_residue(project_root: &Path, name: &str, version: &str)
             ));
         }
     }
-    // Guarded read (`open_regular_file`: O_NONBLOCK + regular-file check) —
-    // a FIFO planted as `Cargo.toml` would otherwise wedge every wet vendor
-    // run in an open(2) that waits for a writer; an unreadable manifest has
-    // no readable residue, matching the read_to_string Err arm this guards.
-    if let Ok(toml) = read_regular_to_string(&project_root.join("Cargo.toml")).await {
+    // The root manifest AND every workspace-member manifest: the hosted
+    // rewriter pins the crate in each one that declares it, so a member's
+    // surviving pin is residue just as much as the root's.
+    let root = project_root.to_path_buf();
+    let members =
+        tokio::task::spawn_blocking(move || crate::utils::cargo_workspace::member_manifests(&root))
+            .await
+            .unwrap_or_default();
+    for rel in std::iter::once("Cargo.toml".to_string()).chain(members) {
+        // Guarded read (`open_regular_file`: O_NONBLOCK + regular-file
+        // check) — a FIFO planted as `Cargo.toml` would otherwise wedge
+        // every wet vendor run in an open(2) that waits for a writer; an
+        // unreadable manifest has no readable residue, matching the
+        // read_to_string Err arm this guards.
+        let Ok(toml) = read_regular_to_string(&project_root.join(&rel)).await else {
+            continue;
+        };
         // The rewriter's own reader, not a single-line regex: the hosted pin
         // is just as often a standalone `registry = …` line under a
         // `[dependencies.<crate>]` header, or sits under a renamed key
@@ -263,7 +276,7 @@ async fn hosted_redirect_residue(project_root: &Path, name: &str, version: &str)
         // the half-reverted state this guard exists for.
         if let Some(reg) = crate::patch::redirect::cargo_socket_registry_pin(&toml, name) {
             return Some(format!(
-                "Cargo.toml pins `{name}` to the socket-patch hosted registry `{reg}`"
+                "{rel} pins `{name}` to the socket-patch hosted registry `{reg}`"
             ));
         }
     }
@@ -3971,6 +3984,51 @@ mod tests {
         }
     }
 
+    /// A pin that survives only in a WORKSPACE MEMBER's manifest is residue
+    /// too: the hosted rewriter pins every member that declares the crate,
+    /// so a root-only probe misses exactly the projects it was extended to
+    /// cover.
+    #[tokio::test]
+    async fn test_refuses_live_hosted_redirect_pinned_in_a_member() {
+        let (dir, blobs, pristine, record) = fixture().await;
+        let root = dir.path();
+        tokio::fs::write(
+            root.join("Cargo.toml"),
+            "[workspace]\nmembers = [\"b\"]\n\n\
+             [package]\nname = \"app\"\nversion = \"0.1.0\"\n",
+        )
+        .await
+        .unwrap();
+        tokio::fs::create_dir_all(root.join("b")).await.unwrap();
+        tokio::fs::write(
+            root.join("b/Cargo.toml"),
+            format!(
+                "[package]\nname = \"b\"\nversion = \"0.1.0\"\n\n\
+                 [dependencies.cfg-if]\nversion = \"1\"\n\
+                 registry = \"socket-patch-{UUID}\"\n"
+            ),
+        )
+        .await
+        .unwrap();
+        tokio::fs::create_dir_all(root.join(".cargo"))
+            .await
+            .unwrap();
+        tokio::fs::write(
+            root.join(".cargo/config.toml"),
+            format!(
+                "[registries.socket-patch-{UUID}]\nindex = \"sparse+http://127.0.0.1:5555/index/\"\n"
+            ),
+        )
+        .await
+        .unwrap();
+        let detail = expect_refused(
+            run_vendor(PURL, root, &blobs, &pristine, &record, false).await,
+            "hosted_redirect_live",
+        );
+        assert!(detail.contains("b/Cargo.toml"), "{detail}");
+        assert!(!root.join(format!(".socket/vendor/cargo/{UUID}")).exists());
+    }
+
     /// A dependency pinned to a registry that is NOT ours, and an unpinned
     /// one, are not hosted residue: vendoring proceeds.
     #[tokio::test]
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/crlf/expected-edits.json b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/crlf/expected-edits.json
new file mode 100644
index 00000000..7679392d
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/crlf/expected-edits.json
@@ -0,0 +1,25 @@
+[
+  {
+    "path": ".cargo/config",
+    "kind": "redirect_cargo_registry",
+    "action": "added",
+    "key": "socket-patch-55555555-5555-5555-5555-555555555555",
+    "new": "[registries.socket-patch-55555555-5555-5555-5555-555555555555]\r\nindex = \"sparse+https://patch.socket.dev/patch-registry/cargo/11111111-1111-1111-1111-111111111111/55555555-5555-5555-5555-555555555555/index/\"\r\n"
+  },
+  {
+    "path": "Cargo.toml",
+    "kind": "redirect_cargo_toml_dep",
+    "action": "rewritten",
+    "key": "serde",
+    "original": "serde = \"1.0.190\"",
+    "new": "serde = { version = \"1.0.190\", registry = \"socket-patch-55555555-5555-5555-5555-555555555555\" }"
+  },
+  {
+    "path": "Cargo.lock",
+    "kind": "redirect_cargo_lock_entry",
+    "action": "rewritten",
+    "key": "serde@1.0.190",
+    "original": "[[package]]\r\nname = \"serde\"\r\nversion = \"1.0.190\"\r\nsource = \"registry+https://github.com/rust-lang/crates.io-index\"\r\nchecksum = \"91d3c334ca1ee894a2c6f6ad7bf058a4d9a3b30e9e0d5a9d1f3e8f0c2c9c0000\"",
+    "new": "[[package]]\r\nname = \"serde\"\r\nversion = \"1.0.190\"\r\nsource = \"sparse+https://patch.socket.dev/patch-registry/cargo/11111111-1111-1111-1111-111111111111/55555555-5555-5555-5555-555555555555/index/\"\r\nchecksum = \"deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef\""
+  }
+]
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/crlf/expected-warnings.json b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/crlf/expected-warnings.json
new file mode 100644
index 00000000..fe51488c
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/crlf/expected-warnings.json
@@ -0,0 +1 @@
+[]
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/crlf/expected/.cargo/config b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/crlf/expected/.cargo/config
new file mode 100644
index 00000000..51cf6dc4
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/crlf/expected/.cargo/config
@@ -0,0 +1,5 @@
+[net]
+retry = 2
+
+[registries.socket-patch-55555555-5555-5555-5555-555555555555]
+index = "sparse+https://patch.socket.dev/patch-registry/cargo/11111111-1111-1111-1111-111111111111/55555555-5555-5555-5555-555555555555/index/"
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/crlf/expected/Cargo.lock b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/crlf/expected/Cargo.lock
new file mode 100644
index 00000000..e77698b0
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/crlf/expected/Cargo.lock
@@ -0,0 +1,16 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "myapp"
+version = "0.1.0"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.190"
+source = "sparse+https://patch.socket.dev/patch-registry/cargo/11111111-1111-1111-1111-111111111111/55555555-5555-5555-5555-555555555555/index/"
+checksum = "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef"
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/crlf/expected/Cargo.toml b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/crlf/expected/Cargo.toml
new file mode 100644
index 00000000..bcb9a444
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/crlf/expected/Cargo.toml
@@ -0,0 +1,8 @@
+[package]
+name = "myapp"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+serde = { version = "1.0.190", registry = "socket-patch-55555555-5555-5555-5555-555555555555" }
+anyhow = { version = "1.0", features = ["backtrace"] }
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/crlf/input/.cargo/config b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/crlf/input/.cargo/config
new file mode 100644
index 00000000..206b4886
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/crlf/input/.cargo/config
@@ -0,0 +1,2 @@
+[net]
+retry = 2
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/crlf/input/Cargo.lock b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/crlf/input/Cargo.lock
new file mode 100644
index 00000000..7b725829
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/crlf/input/Cargo.lock
@@ -0,0 +1,16 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "myapp"
+version = "0.1.0"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.190"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91d3c334ca1ee894a2c6f6ad7bf058a4d9a3b30e9e0d5a9d1f3e8f0c2c9c0000"
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/crlf/input/Cargo.toml b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/crlf/input/Cargo.toml
new file mode 100644
index 00000000..af0b8b13
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/crlf/input/Cargo.toml
@@ -0,0 +1,8 @@
+[package]
+name = "myapp"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+serde = "1.0.190"
+anyhow = { version = "1.0", features = ["backtrace"] }
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/crlf/overrides.json b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/crlf/overrides.json
new file mode 100644
index 00000000..5fc4f53a
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/crlf/overrides.json
@@ -0,0 +1,22 @@
+[
+  {
+    "ecosystem": "cargo",
+    "name": "serde",
+    "version": "1.0.190",
+    "token": "11111111-1111-1111-1111-111111111111",
+    "patchUuid": "55555555-5555-5555-5555-555555555555",
+    "artifactUrl": "https://patch.socket.dev/patch/cargo/serde/1.0.190/11111111-1111-1111-1111-111111111111/55555555-5555-5555-5555-555555555555/serde-1.0.190.crate",
+    "registryOverride": {
+      "kind": "cargo-sparse",
+      "indexUrl": "sparse+https://patch.socket.dev/patch-registry/cargo/11111111-1111-1111-1111-111111111111/55555555-5555-5555-5555-555555555555/index/",
+      "identifiers": {
+        "name": "serde",
+        "version": "1.0.190",
+        "cargoCksumSha256": "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef"
+      }
+    },
+    "integrity": {
+      "sha256": "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef"
+    }
+  }
+]
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/lockless-dependents/expected-edits.json b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/lockless-dependents/expected-edits.json
new file mode 100644
index 00000000..fe51488c
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/lockless-dependents/expected-edits.json
@@ -0,0 +1 @@
+[]
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/lockless-dependents/expected-warnings.json b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/lockless-dependents/expected-warnings.json
new file mode 100644
index 00000000..5e643ea8
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/lockless-dependents/expected-warnings.json
@@ -0,0 +1,3 @@
+[
+  "redirect_cargo_lockless_dependents"
+]
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/lockless-dependents/input/Cargo.toml b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/lockless-dependents/input/Cargo.toml
new file mode 100644
index 00000000..adaf565e
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/lockless-dependents/input/Cargo.toml
@@ -0,0 +1,8 @@
+[package]
+name = "myapp"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+serde = "1.0.190"
+serde_json = "1.0.108"
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/lockless-dependents/overrides.json b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/lockless-dependents/overrides.json
new file mode 100644
index 00000000..5fc4f53a
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/lockless-dependents/overrides.json
@@ -0,0 +1,22 @@
+[
+  {
+    "ecosystem": "cargo",
+    "name": "serde",
+    "version": "1.0.190",
+    "token": "11111111-1111-1111-1111-111111111111",
+    "patchUuid": "55555555-5555-5555-5555-555555555555",
+    "artifactUrl": "https://patch.socket.dev/patch/cargo/serde/1.0.190/11111111-1111-1111-1111-111111111111/55555555-5555-5555-5555-555555555555/serde-1.0.190.crate",
+    "registryOverride": {
+      "kind": "cargo-sparse",
+      "indexUrl": "sparse+https://patch.socket.dev/patch-registry/cargo/11111111-1111-1111-1111-111111111111/55555555-5555-5555-5555-555555555555/index/",
+      "identifiers": {
+        "name": "serde",
+        "version": "1.0.190",
+        "cargoCksumSha256": "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef"
+      }
+    },
+    "integrity": {
+      "sha256": "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef"
+    }
+  }
+]
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/multi-version/expected-edits.json b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/multi-version/expected-edits.json
new file mode 100644
index 00000000..4abcfd73
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/multi-version/expected-edits.json
@@ -0,0 +1,48 @@
+[
+  {
+    "path": ".cargo/config.toml",
+    "kind": "redirect_cargo_registry",
+    "action": "added",
+    "key": "socket-patch-55555555-5555-5555-5555-555555555555",
+    "new": "[registries.socket-patch-55555555-5555-5555-5555-555555555555]\nindex = \"sparse+https://patch.socket.dev/patch-registry/cargo/11111111-1111-1111-1111-111111111111/55555555-5555-5555-5555-555555555555/index/\"\n"
+  },
+  {
+    "path": "Cargo.toml",
+    "kind": "redirect_cargo_toml_dep",
+    "action": "rewritten",
+    "key": "cfg-if",
+    "original": "cfg-if = \"1.0.4\"",
+    "new": "cfg-if = { version = \"1.0.4\", registry = \"socket-patch-55555555-5555-5555-5555-555555555555\" }"
+  },
+  {
+    "path": "Cargo.lock",
+    "kind": "redirect_cargo_lock_entry",
+    "action": "rewritten",
+    "key": "cfg-if@1.0.4",
+    "original": "[[package]]\nname = \"cfg-if\"\nversion = \"1.0.4\"\nsource = \"registry+https://github.com/rust-lang/crates.io-index\"\nchecksum = \"9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801\"",
+    "new": "[[package]]\nname = \"cfg-if\"\nversion = \"1.0.4\"\nsource = \"sparse+https://patch.socket.dev/patch-registry/cargo/11111111-1111-1111-1111-111111111111/55555555-5555-5555-5555-555555555555/index/\"\nchecksum = \"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\""
+  },
+  {
+    "path": ".cargo/config.toml",
+    "kind": "redirect_cargo_registry",
+    "action": "added",
+    "key": "socket-patch-66666666-6666-6666-6666-666666666666",
+    "new": "[registries.socket-patch-66666666-6666-6666-6666-666666666666]\nindex = \"sparse+https://patch.socket.dev/patch-registry/cargo/22222222-2222-2222-2222-222222222222/66666666-6666-6666-6666-666666666666/index/\"\n"
+  },
+  {
+    "path": "Cargo.toml",
+    "kind": "redirect_cargo_toml_dep",
+    "action": "rewritten",
+    "key": "cfg-if",
+    "original": "cfg-if-legacy = { package = \"cfg-if\", version = \"0.1.10\" }",
+    "new": "cfg-if-legacy = { package = \"cfg-if\", version = \"0.1.10\", registry = \"socket-patch-66666666-6666-6666-6666-666666666666\" }"
+  },
+  {
+    "path": "Cargo.lock",
+    "kind": "redirect_cargo_lock_entry",
+    "action": "rewritten",
+    "key": "cfg-if@0.1.10",
+    "original": "[[package]]\nname = \"cfg-if\"\nversion = \"0.1.10\"\nsource = \"registry+https://github.com/rust-lang/crates.io-index\"\nchecksum = \"4785bdd1c96b2a846b2bd7cc02e86b6b3dbf14e7e53446c4f54c92a361040822\"",
+    "new": "[[package]]\nname = \"cfg-if\"\nversion = \"0.1.10\"\nsource = \"sparse+https://patch.socket.dev/patch-registry/cargo/22222222-2222-2222-2222-222222222222/66666666-6666-6666-6666-666666666666/index/\"\nchecksum = \"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb\""
+  }
+]
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/multi-version/expected-warnings.json b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/multi-version/expected-warnings.json
new file mode 100644
index 00000000..fe51488c
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/multi-version/expected-warnings.json
@@ -0,0 +1 @@
+[]
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/multi-version/expected/.cargo/config.toml b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/multi-version/expected/.cargo/config.toml
new file mode 100644
index 00000000..1ef2fc0c
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/multi-version/expected/.cargo/config.toml
@@ -0,0 +1,5 @@
+[registries.socket-patch-55555555-5555-5555-5555-555555555555]
+index = "sparse+https://patch.socket.dev/patch-registry/cargo/11111111-1111-1111-1111-111111111111/55555555-5555-5555-5555-555555555555/index/"
+
+[registries.socket-patch-66666666-6666-6666-6666-666666666666]
+index = "sparse+https://patch.socket.dev/patch-registry/cargo/22222222-2222-2222-2222-222222222222/66666666-6666-6666-6666-666666666666/index/"
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/multi-version/expected/Cargo.lock b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/multi-version/expected/Cargo.lock
new file mode 100644
index 00000000..306a322d
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/multi-version/expected/Cargo.lock
@@ -0,0 +1,23 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "cfg-if"
+version = "0.1.10"
+source = "sparse+https://patch.socket.dev/patch-registry/cargo/22222222-2222-2222-2222-222222222222/66666666-6666-6666-6666-666666666666/index/"
+checksum = "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "sparse+https://patch.socket.dev/patch-registry/cargo/11111111-1111-1111-1111-111111111111/55555555-5555-5555-5555-555555555555/index/"
+checksum = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+
+[[package]]
+name = "myapp"
+version = "0.1.0"
+dependencies = [
+ "cfg-if 0.1.10",
+ "cfg-if 1.0.4",
+]
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/multi-version/expected/Cargo.toml b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/multi-version/expected/Cargo.toml
new file mode 100644
index 00000000..cd0456b4
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/multi-version/expected/Cargo.toml
@@ -0,0 +1,8 @@
+[package]
+name = "myapp"
+version = "0.1.0"
+edition = "2018"
+
+[dependencies]
+cfg-if = { version = "1.0.4", registry = "socket-patch-55555555-5555-5555-5555-555555555555" }
+cfg-if-legacy = { package = "cfg-if", version = "0.1.10", registry = "socket-patch-66666666-6666-6666-6666-666666666666" }
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/multi-version/input/Cargo.lock b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/multi-version/input/Cargo.lock
new file mode 100644
index 00000000..cfcf0991
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/multi-version/input/Cargo.lock
@@ -0,0 +1,23 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "cfg-if"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4785bdd1c96b2a846b2bd7cc02e86b6b3dbf14e7e53446c4f54c92a361040822"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "myapp"
+version = "0.1.0"
+dependencies = [
+ "cfg-if 0.1.10",
+ "cfg-if 1.0.4",
+]
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/multi-version/input/Cargo.toml b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/multi-version/input/Cargo.toml
new file mode 100644
index 00000000..a2f02505
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/multi-version/input/Cargo.toml
@@ -0,0 +1,8 @@
+[package]
+name = "myapp"
+version = "0.1.0"
+edition = "2018"
+
+[dependencies]
+cfg-if = "1.0.4"
+cfg-if-legacy = { package = "cfg-if", version = "0.1.10" }
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/multi-version/overrides.json b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/multi-version/overrides.json
new file mode 100644
index 00000000..e24a3142
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/multi-version/overrides.json
@@ -0,0 +1,42 @@
+[
+  {
+    "ecosystem": "cargo",
+    "name": "cfg-if",
+    "version": "1.0.4",
+    "token": "11111111-1111-1111-1111-111111111111",
+    "patchUuid": "55555555-5555-5555-5555-555555555555",
+    "artifactUrl": "https://patch.socket.dev/patch/cargo/cfg-if/1.0.4/11111111-1111-1111-1111-111111111111/55555555-5555-5555-5555-555555555555/cfg-if-1.0.4.crate",
+    "registryOverride": {
+      "kind": "cargo-sparse",
+      "indexUrl": "sparse+https://patch.socket.dev/patch-registry/cargo/11111111-1111-1111-1111-111111111111/55555555-5555-5555-5555-555555555555/index/",
+      "identifiers": {
+        "name": "cfg-if",
+        "version": "1.0.4",
+        "cargoCksumSha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+      }
+    },
+    "integrity": {
+      "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+    }
+  },
+  {
+    "ecosystem": "cargo",
+    "name": "cfg-if",
+    "version": "0.1.10",
+    "token": "22222222-2222-2222-2222-222222222222",
+    "patchUuid": "66666666-6666-6666-6666-666666666666",
+    "artifactUrl": "https://patch.socket.dev/patch/cargo/cfg-if/0.1.10/22222222-2222-2222-2222-222222222222/66666666-6666-6666-6666-666666666666/cfg-if-0.1.10.crate",
+    "registryOverride": {
+      "kind": "cargo-sparse",
+      "indexUrl": "sparse+https://patch.socket.dev/patch-registry/cargo/22222222-2222-2222-2222-222222222222/66666666-6666-6666-6666-666666666666/index/",
+      "identifiers": {
+        "name": "cfg-if",
+        "version": "0.1.10",
+        "cargoCksumSha256": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+      }
+    },
+    "integrity": {
+      "sha256": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+    }
+  }
+]
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/path-dependency/expected-edits.json b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/path-dependency/expected-edits.json
new file mode 100644
index 00000000..fe51488c
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/path-dependency/expected-edits.json
@@ -0,0 +1 @@
+[]
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/path-dependency/expected-warnings.json b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/path-dependency/expected-warnings.json
new file mode 100644
index 00000000..5259ffdc
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/path-dependency/expected-warnings.json
@@ -0,0 +1,3 @@
+[
+  "redirect_cargo_toml_dep_unrewritable"
+]
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/path-dependency/input/Cargo.lock b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/path-dependency/input/Cargo.lock
new file mode 100644
index 00000000..2c0622f2
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/path-dependency/input/Cargo.lock
@@ -0,0 +1,14 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "myapp"
+version = "0.1.0"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.190"
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/path-dependency/input/Cargo.toml b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/path-dependency/input/Cargo.toml
new file mode 100644
index 00000000..cf1d2a6b
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/path-dependency/input/Cargo.toml
@@ -0,0 +1,7 @@
+[package]
+name = "myapp"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+serde = { path = "third_party/serde", version = "1.0.190" }
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/path-dependency/overrides.json b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/path-dependency/overrides.json
new file mode 100644
index 00000000..5fc4f53a
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/path-dependency/overrides.json
@@ -0,0 +1,22 @@
+[
+  {
+    "ecosystem": "cargo",
+    "name": "serde",
+    "version": "1.0.190",
+    "token": "11111111-1111-1111-1111-111111111111",
+    "patchUuid": "55555555-5555-5555-5555-555555555555",
+    "artifactUrl": "https://patch.socket.dev/patch/cargo/serde/1.0.190/11111111-1111-1111-1111-111111111111/55555555-5555-5555-5555-555555555555/serde-1.0.190.crate",
+    "registryOverride": {
+      "kind": "cargo-sparse",
+      "indexUrl": "sparse+https://patch.socket.dev/patch-registry/cargo/11111111-1111-1111-1111-111111111111/55555555-5555-5555-5555-555555555555/index/",
+      "identifiers": {
+        "name": "serde",
+        "version": "1.0.190",
+        "cargoCksumSha256": "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef"
+      }
+    },
+    "integrity": {
+      "sha256": "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef"
+    }
+  }
+]
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/requirement-excludes-patched-version/expected-edits.json b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/requirement-excludes-patched-version/expected-edits.json
new file mode 100644
index 00000000..fe51488c
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/requirement-excludes-patched-version/expected-edits.json
@@ -0,0 +1 @@
+[]
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/requirement-excludes-patched-version/expected-warnings.json b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/requirement-excludes-patched-version/expected-warnings.json
new file mode 100644
index 00000000..5259ffdc
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/requirement-excludes-patched-version/expected-warnings.json
@@ -0,0 +1,3 @@
+[
+  "redirect_cargo_toml_dep_unrewritable"
+]
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/requirement-excludes-patched-version/input/Cargo.lock b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/requirement-excludes-patched-version/input/Cargo.lock
new file mode 100644
index 00000000..bf6fa585
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/requirement-excludes-patched-version/input/Cargo.lock
@@ -0,0 +1,16 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "myapp"
+version = "0.1.0"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.190"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91d3c334ca1ee894a2c6f6ad7bf058a4d9a3b30e9e0d5a9d1f3e8f0c2c9c0000"
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/requirement-excludes-patched-version/input/Cargo.toml b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/requirement-excludes-patched-version/input/Cargo.toml
new file mode 100644
index 00000000..88553e52
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/requirement-excludes-patched-version/input/Cargo.toml
@@ -0,0 +1,7 @@
+[package]
+name = "myapp"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+serde = "=1.0.180"
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/requirement-excludes-patched-version/overrides.json b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/requirement-excludes-patched-version/overrides.json
new file mode 100644
index 00000000..5fc4f53a
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/requirement-excludes-patched-version/overrides.json
@@ -0,0 +1,22 @@
+[
+  {
+    "ecosystem": "cargo",
+    "name": "serde",
+    "version": "1.0.190",
+    "token": "11111111-1111-1111-1111-111111111111",
+    "patchUuid": "55555555-5555-5555-5555-555555555555",
+    "artifactUrl": "https://patch.socket.dev/patch/cargo/serde/1.0.190/11111111-1111-1111-1111-111111111111/55555555-5555-5555-5555-555555555555/serde-1.0.190.crate",
+    "registryOverride": {
+      "kind": "cargo-sparse",
+      "indexUrl": "sparse+https://patch.socket.dev/patch-registry/cargo/11111111-1111-1111-1111-111111111111/55555555-5555-5555-5555-555555555555/index/",
+      "identifiers": {
+        "name": "serde",
+        "version": "1.0.190",
+        "cargoCksumSha256": "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef"
+      }
+    },
+    "integrity": {
+      "sha256": "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef"
+    }
+  }
+]
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/shared-dependency/expected-edits.json b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/shared-dependency/expected-edits.json
new file mode 100644
index 00000000..fe51488c
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/shared-dependency/expected-edits.json
@@ -0,0 +1 @@
+[]
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/shared-dependency/expected-warnings.json b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/shared-dependency/expected-warnings.json
new file mode 100644
index 00000000..97c5d3b0
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/shared-dependency/expected-warnings.json
@@ -0,0 +1,3 @@
+[
+  "redirect_cargo_transitive_dependents"
+]
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/shared-dependency/input/Cargo.lock b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/shared-dependency/input/Cargo.lock
new file mode 100644
index 00000000..182db3ae
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/shared-dependency/input/Cargo.lock
@@ -0,0 +1,26 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "myapp"
+version = "0.1.0"
+dependencies = [
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.190"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91d3c334ca1ee894a2c6f6ad7bf058a4d9a3b30e9e0d5a9d1f3e8f0c2c9c0000"
+
+[[package]]
+name = "serde_json"
+version = "1.0.108"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d1c7e3eac408d115102c4c24ad393e0821bb3a5df4d506a80f85f7a742a526b"
+dependencies = [
+ "serde",
+]
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/shared-dependency/input/Cargo.toml b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/shared-dependency/input/Cargo.toml
new file mode 100644
index 00000000..adaf565e
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/shared-dependency/input/Cargo.toml
@@ -0,0 +1,8 @@
+[package]
+name = "myapp"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+serde = "1.0.190"
+serde_json = "1.0.108"
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/shared-dependency/overrides.json b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/shared-dependency/overrides.json
new file mode 100644
index 00000000..5fc4f53a
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/shared-dependency/overrides.json
@@ -0,0 +1,22 @@
+[
+  {
+    "ecosystem": "cargo",
+    "name": "serde",
+    "version": "1.0.190",
+    "token": "11111111-1111-1111-1111-111111111111",
+    "patchUuid": "55555555-5555-5555-5555-555555555555",
+    "artifactUrl": "https://patch.socket.dev/patch/cargo/serde/1.0.190/11111111-1111-1111-1111-111111111111/55555555-5555-5555-5555-555555555555/serde-1.0.190.crate",
+    "registryOverride": {
+      "kind": "cargo-sparse",
+      "indexUrl": "sparse+https://patch.socket.dev/patch-registry/cargo/11111111-1111-1111-1111-111111111111/55555555-5555-5555-5555-555555555555/index/",
+      "identifiers": {
+        "name": "serde",
+        "version": "1.0.190",
+        "cargoCksumSha256": "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef"
+      }
+    },
+    "integrity": {
+      "sha256": "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef"
+    }
+  }
+]
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-dependents-git/expected-edits.json b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-dependents-git/expected-edits.json
new file mode 100644
index 00000000..fe51488c
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-dependents-git/expected-edits.json
@@ -0,0 +1 @@
+[]
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-dependents-git/expected-warnings.json b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-dependents-git/expected-warnings.json
new file mode 100644
index 00000000..97c5d3b0
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-dependents-git/expected-warnings.json
@@ -0,0 +1,3 @@
+[
+  "redirect_cargo_transitive_dependents"
+]
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-dependents-git/input/Cargo.lock b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-dependents-git/input/Cargo.lock
new file mode 100644
index 00000000..621622b6
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-dependents-git/input/Cargo.lock
@@ -0,0 +1,25 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "myapp"
+version = "0.1.0"
+dependencies = [
+ "serde",
+ "serde-helper",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.190"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91d3c334ca1ee894a2c6f6ad7bf058a4d9a3b30e9e0d5a9d1f3e8f0c2c9c0000"
+
+[[package]]
+name = "serde-helper"
+version = "0.3.1"
+source = "git+https://github.com/example/serde-helper#0123456789abcdef0123456789abcdef01234567"
+dependencies = [
+ "serde",
+]
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-dependents-git/input/Cargo.toml b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-dependents-git/input/Cargo.toml
new file mode 100644
index 00000000..b5bc2c4b
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-dependents-git/input/Cargo.toml
@@ -0,0 +1,8 @@
+[package]
+name = "myapp"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+serde = "1.0.190"
+serde-helper = { git = "https://github.com/example/serde-helper" }
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-dependents-git/overrides.json b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-dependents-git/overrides.json
new file mode 100644
index 00000000..5fc4f53a
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-dependents-git/overrides.json
@@ -0,0 +1,22 @@
+[
+  {
+    "ecosystem": "cargo",
+    "name": "serde",
+    "version": "1.0.190",
+    "token": "11111111-1111-1111-1111-111111111111",
+    "patchUuid": "55555555-5555-5555-5555-555555555555",
+    "artifactUrl": "https://patch.socket.dev/patch/cargo/serde/1.0.190/11111111-1111-1111-1111-111111111111/55555555-5555-5555-5555-555555555555/serde-1.0.190.crate",
+    "registryOverride": {
+      "kind": "cargo-sparse",
+      "indexUrl": "sparse+https://patch.socket.dev/patch-registry/cargo/11111111-1111-1111-1111-111111111111/55555555-5555-5555-5555-555555555555/index/",
+      "identifiers": {
+        "name": "serde",
+        "version": "1.0.190",
+        "cargoCksumSha256": "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef"
+      }
+    },
+    "integrity": {
+      "sha256": "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef"
+    }
+  }
+]
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-refusal/expected-edits.json b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-refusal/expected-edits.json
new file mode 100644
index 00000000..fe51488c
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-refusal/expected-edits.json
@@ -0,0 +1 @@
+[]
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-refusal/expected-warnings.json b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-refusal/expected-warnings.json
new file mode 100644
index 00000000..acfb99e8
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-refusal/expected-warnings.json
@@ -0,0 +1,3 @@
+[
+  "redirect_cargo_toml_dep_not_found"
+]
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-refusal/input/Cargo.lock b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-refusal/input/Cargo.lock
new file mode 100644
index 00000000..157d89ad
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-refusal/input/Cargo.lock
@@ -0,0 +1,25 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "myapp"
+version = "0.1.0"
+dependencies = [
+ "serde_json",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.190"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91d3c334ca1ee894a2c6f6ad7bf058a4d9a3b30e9e0d5a9d1f3e8f0c2c9c0000"
+
+[[package]]
+name = "serde_json"
+version = "1.0.108"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d1c7e3eac408d115102c4c24ad393e0821bb3a5df4d506a80f85f7a742a526b"
+dependencies = [
+ "serde",
+]
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-refusal/input/Cargo.toml b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-refusal/input/Cargo.toml
new file mode 100644
index 00000000..df66812e
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-refusal/input/Cargo.toml
@@ -0,0 +1,7 @@
+[package]
+name = "myapp"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+serde_json = "1.0.108"
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-refusal/overrides.json b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-refusal/overrides.json
new file mode 100644
index 00000000..5fc4f53a
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/transitive-refusal/overrides.json
@@ -0,0 +1,22 @@
+[
+  {
+    "ecosystem": "cargo",
+    "name": "serde",
+    "version": "1.0.190",
+    "token": "11111111-1111-1111-1111-111111111111",
+    "patchUuid": "55555555-5555-5555-5555-555555555555",
+    "artifactUrl": "https://patch.socket.dev/patch/cargo/serde/1.0.190/11111111-1111-1111-1111-111111111111/55555555-5555-5555-5555-555555555555/serde-1.0.190.crate",
+    "registryOverride": {
+      "kind": "cargo-sparse",
+      "indexUrl": "sparse+https://patch.socket.dev/patch-registry/cargo/11111111-1111-1111-1111-111111111111/55555555-5555-5555-5555-555555555555/index/",
+      "identifiers": {
+        "name": "serde",
+        "version": "1.0.190",
+        "cargoCksumSha256": "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef"
+      }
+    },
+    "integrity": {
+      "sha256": "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef"
+    }
+  }
+]
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/expected-edits.json b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/expected-edits.json
new file mode 100644
index 00000000..b6f367d7
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/expected-edits.json
@@ -0,0 +1,33 @@
+[
+  {
+    "path": ".cargo/config.toml",
+    "kind": "redirect_cargo_registry",
+    "action": "added",
+    "key": "socket-patch-55555555-5555-5555-5555-555555555555",
+    "new": "[registries.socket-patch-55555555-5555-5555-5555-555555555555]\nindex = \"sparse+https://patch.socket.dev/patch-registry/cargo/11111111-1111-1111-1111-111111111111/55555555-5555-5555-5555-555555555555/index/\"\n"
+  },
+  {
+    "path": "Cargo.toml",
+    "kind": "redirect_cargo_toml_dep",
+    "action": "rewritten",
+    "key": "serde",
+    "original": "serde = \"1.0.190\"",
+    "new": "serde = { version = \"1.0.190\", registry = \"socket-patch-55555555-5555-5555-5555-555555555555\" }"
+  },
+  {
+    "path": "b/Cargo.toml",
+    "kind": "redirect_cargo_toml_dep",
+    "action": "rewritten",
+    "key": "serde",
+    "original": "serde = \"1.0.190\"",
+    "new": "serde = { version = \"1.0.190\", registry = \"socket-patch-55555555-5555-5555-5555-555555555555\" }"
+  },
+  {
+    "path": "Cargo.lock",
+    "kind": "redirect_cargo_lock_entry",
+    "action": "rewritten",
+    "key": "serde@1.0.190",
+    "original": "[[package]]\nname = \"serde\"\nversion = \"1.0.190\"\nsource = \"registry+https://github.com/rust-lang/crates.io-index\"\nchecksum = \"91d3c334ca1ee894a2c6f6ad7bf058a4d9a3b30e9e0d5a9d1f3e8f0c2c9c0000\"",
+    "new": "[[package]]\nname = \"serde\"\nversion = \"1.0.190\"\nsource = \"sparse+https://patch.socket.dev/patch-registry/cargo/11111111-1111-1111-1111-111111111111/55555555-5555-5555-5555-555555555555/index/\"\nchecksum = \"deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef\""
+  }
+]
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/expected-warnings.json b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/expected-warnings.json
new file mode 100644
index 00000000..fe51488c
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/expected-warnings.json
@@ -0,0 +1 @@
+[]
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/expected/.cargo/config.toml b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/expected/.cargo/config.toml
new file mode 100644
index 00000000..743fa5dc
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/expected/.cargo/config.toml
@@ -0,0 +1,2 @@
+[registries.socket-patch-55555555-5555-5555-5555-555555555555]
+index = "sparse+https://patch.socket.dev/patch-registry/cargo/11111111-1111-1111-1111-111111111111/55555555-5555-5555-5555-555555555555/index/"
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/expected/Cargo.lock b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/expected/Cargo.lock
new file mode 100644
index 00000000..1532947c
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/expected/Cargo.lock
@@ -0,0 +1,23 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "a"
+version = "0.1.0"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "b"
+version = "0.1.0"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.190"
+source = "sparse+https://patch.socket.dev/patch-registry/cargo/11111111-1111-1111-1111-111111111111/55555555-5555-5555-5555-555555555555/index/"
+checksum = "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef"
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/expected/Cargo.toml b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/expected/Cargo.toml
new file mode 100644
index 00000000..a4faf226
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/expected/Cargo.toml
@@ -0,0 +1,5 @@
+[workspace]
+members = ["a", "b"]
+
+[workspace.dependencies]
+serde = { version = "1.0.190", registry = "socket-patch-55555555-5555-5555-5555-555555555555" }
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/expected/b/Cargo.toml b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/expected/b/Cargo.toml
new file mode 100644
index 00000000..c90450fa
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/expected/b/Cargo.toml
@@ -0,0 +1,7 @@
+[package]
+name = "b"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+serde = { version = "1.0.190", registry = "socket-patch-55555555-5555-5555-5555-555555555555" }
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/input/Cargo.lock b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/input/Cargo.lock
new file mode 100644
index 00000000..fa5ee8fd
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/input/Cargo.lock
@@ -0,0 +1,23 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "a"
+version = "0.1.0"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "b"
+version = "0.1.0"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.190"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91d3c334ca1ee894a2c6f6ad7bf058a4d9a3b30e9e0d5a9d1f3e8f0c2c9c0000"
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/input/Cargo.toml b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/input/Cargo.toml
new file mode 100644
index 00000000..2cfb1173
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/input/Cargo.toml
@@ -0,0 +1,5 @@
+[workspace]
+members = ["a", "b"]
+
+[workspace.dependencies]
+serde = "1.0.190"
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/input/a/Cargo.toml b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/input/a/Cargo.toml
new file mode 100644
index 00000000..0dee9c7e
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/input/a/Cargo.toml
@@ -0,0 +1,7 @@
+[package]
+name = "a"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+serde.workspace = true
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/input/b/Cargo.toml b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/input/b/Cargo.toml
new file mode 100644
index 00000000..9aedd9ed
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/input/b/Cargo.toml
@@ -0,0 +1,7 @@
+[package]
+name = "b"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+serde = "1.0.190"
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/overrides.json b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/overrides.json
new file mode 100644
index 00000000..5fc4f53a
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/cargo/cargo/workspace-member/overrides.json
@@ -0,0 +1,22 @@
+[
+  {
+    "ecosystem": "cargo",
+    "name": "serde",
+    "version": "1.0.190",
+    "token": "11111111-1111-1111-1111-111111111111",
+    "patchUuid": "55555555-5555-5555-5555-555555555555",
+    "artifactUrl": "https://patch.socket.dev/patch/cargo/serde/1.0.190/11111111-1111-1111-1111-111111111111/55555555-5555-5555-5555-555555555555/serde-1.0.190.crate",
+    "registryOverride": {
+      "kind": "cargo-sparse",
+      "indexUrl": "sparse+https://patch.socket.dev/patch-registry/cargo/11111111-1111-1111-1111-111111111111/55555555-5555-5555-5555-555555555555/index/",
+      "identifiers": {
+        "name": "serde",
+        "version": "1.0.190",
+        "cargoCksumSha256": "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef"
+      }
+    },
+    "integrity": {
+      "sha256": "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef"
+    }
+  }
+]
diff --git a/crates/socket-patch-core/tests/fixtures/vex-discover-golden/redirect-cargo.json b/crates/socket-patch-core/tests/fixtures/vex-discover-golden/redirect-cargo.json
index 9f82f122..3acf08ca 100644
--- a/crates/socket-patch-core/tests/fixtures/vex-discover-golden/redirect-cargo.json
+++ b/crates/socket-patch-core/tests/fixtures/vex-discover-golden/redirect-cargo.json
@@ -120,6 +120,168 @@
       }
     ]
   },
+  "redirect/cargo/cargo/crlf/expected": {
+    "refs": [
+      {
+        "purl": "pkg:cargo/serde@1.0.190",
+        "uuid": "55555555-5555-5555-5555-555555555555",
+        "mode": "hosted",
+        "source_file": "Cargo.lock",
+        "artifact_rel": null,
+        "locked_integrity": "Sha256Hex(\"deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef\")",
+        "integrity_required": true,
+        "url": "sparse+https://patch.socket.dev/patch-registry/cargo/11111111-1111-1111-1111-111111111111/55555555-5555-5555-5555-555555555555/index/",
+        "lockfile_basis_ok": true
+      }
+    ],
+    "diagnostics": [],
+    "recognized": [
+      {
+        "uuid": "11111111-1111-1111-1111-111111111111",
+        "mode": "hosted",
+        "file": ".cargo/config"
+      },
+      {
+        "uuid": "11111111-1111-1111-1111-111111111111",
+        "mode": "hosted",
+        "file": "Cargo.lock"
+      },
+      {
+        "uuid": "55555555-5555-5555-5555-555555555555",
+        "mode": "hosted",
+        "file": ".cargo/config"
+      },
+      {
+        "uuid": "55555555-5555-5555-5555-555555555555",
+        "mode": "hosted",
+        "file": "Cargo.lock"
+      }
+    ],
+    "unlocked_pins": [],
+    "elsewhere": [],
+    "live_claims": [
+      {
+        "mode": "hosted",
+        "uuid": "55555555-5555-5555-5555-555555555555",
+        "purl": "pkg:cargo/serde@1.0.190"
+      }
+    ]
+  },
+  "redirect/cargo/cargo/crlf/input": {
+    "refs": [],
+    "diagnostics": [],
+    "recognized": [],
+    "unlocked_pins": [],
+    "elsewhere": [],
+    "live_claims": []
+  },
+  "redirect/cargo/cargo/lockless-dependents/input": {
+    "refs": [],
+    "diagnostics": [],
+    "recognized": [],
+    "unlocked_pins": [],
+    "elsewhere": [],
+    "live_claims": []
+  },
+  "redirect/cargo/cargo/multi-version/expected": {
+    "refs": [
+      {
+        "purl": "pkg:cargo/cfg-if@0.1.10",
+        "uuid": "66666666-6666-6666-6666-666666666666",
+        "mode": "hosted",
+        "source_file": "Cargo.lock",
+        "artifact_rel": null,
+        "locked_integrity": "Sha256Hex(\"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb\")",
+        "integrity_required": true,
+        "url": "sparse+https://patch.socket.dev/patch-registry/cargo/22222222-2222-2222-2222-222222222222/66666666-6666-6666-6666-666666666666/index/",
+        "lockfile_basis_ok": true
+      },
+      {
+        "purl": "pkg:cargo/cfg-if@1.0.4",
+        "uuid": "55555555-5555-5555-5555-555555555555",
+        "mode": "hosted",
+        "source_file": "Cargo.lock",
+        "artifact_rel": null,
+        "locked_integrity": "Sha256Hex(\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\")",
+        "integrity_required": true,
+        "url": "sparse+https://patch.socket.dev/patch-registry/cargo/11111111-1111-1111-1111-111111111111/55555555-5555-5555-5555-555555555555/index/",
+        "lockfile_basis_ok": true
+      }
+    ],
+    "diagnostics": [],
+    "recognized": [
+      {
+        "uuid": "11111111-1111-1111-1111-111111111111",
+        "mode": "hosted",
+        "file": ".cargo/config.toml"
+      },
+      {
+        "uuid": "11111111-1111-1111-1111-111111111111",
+        "mode": "hosted",
+        "file": "Cargo.lock"
+      },
+      {
+        "uuid": "22222222-2222-2222-2222-222222222222",
+        "mode": "hosted",
+        "file": ".cargo/config.toml"
+      },
+      {
+        "uuid": "22222222-2222-2222-2222-222222222222",
+        "mode": "hosted",
+        "file": "Cargo.lock"
+      },
+      {
+        "uuid": "55555555-5555-5555-5555-555555555555",
+        "mode": "hosted",
+        "file": ".cargo/config.toml"
+      },
+      {
+        "uuid": "55555555-5555-5555-5555-555555555555",
+        "mode": "hosted",
+        "file": "Cargo.lock"
+      },
+      {
+        "uuid": "66666666-6666-6666-6666-666666666666",
+        "mode": "hosted",
+        "file": ".cargo/config.toml"
+      },
+      {
+        "uuid": "66666666-6666-6666-6666-666666666666",
+        "mode": "hosted",
+        "file": "Cargo.lock"
+      }
+    ],
+    "unlocked_pins": [],
+    "elsewhere": [],
+    "live_claims": [
+      {
+        "mode": "hosted",
+        "uuid": "55555555-5555-5555-5555-555555555555",
+        "purl": "pkg:cargo/cfg-if@1.0.4"
+      },
+      {
+        "mode": "hosted",
+        "uuid": "66666666-6666-6666-6666-666666666666",
+        "purl": "pkg:cargo/cfg-if@0.1.10"
+      }
+    ]
+  },
+  "redirect/cargo/cargo/multi-version/input": {
+    "refs": [],
+    "diagnostics": [],
+    "recognized": [],
+    "unlocked_pins": [],
+    "elsewhere": [],
+    "live_claims": []
+  },
+  "redirect/cargo/cargo/path-dependency/input": {
+    "refs": [],
+    "diagnostics": [],
+    "recognized": [],
+    "unlocked_pins": [],
+    "elsewhere": [],
+    "live_claims": []
+  },
   "redirect/cargo/cargo/renamed/expected": {
     "refs": [
       {
@@ -175,6 +337,14 @@
     "elsewhere": [],
     "live_claims": []
   },
+  "redirect/cargo/cargo/requirement-excludes-patched-version/input": {
+    "refs": [],
+    "diagnostics": [],
+    "recognized": [],
+    "unlocked_pins": [],
+    "elsewhere": [],
+    "live_claims": []
+  },
   "redirect/cargo/cargo/rerun/input": {
     "refs": [
       {
@@ -222,6 +392,14 @@
       }
     ]
   },
+  "redirect/cargo/cargo/shared-dependency/input": {
+    "refs": [],
+    "diagnostics": [],
+    "recognized": [],
+    "unlocked_pins": [],
+    "elsewhere": [],
+    "live_claims": []
+  },
   "redirect/cargo/cargo/supersede/expected": {
     "refs": [
       {
@@ -376,6 +554,22 @@
     "elsewhere": [],
     "live_claims": []
   },
+  "redirect/cargo/cargo/transitive-dependents-git/input": {
+    "refs": [],
+    "diagnostics": [],
+    "recognized": [],
+    "unlocked_pins": [],
+    "elsewhere": [],
+    "live_claims": []
+  },
+  "redirect/cargo/cargo/transitive-refusal/input": {
+    "refs": [],
+    "diagnostics": [],
+    "recognized": [],
+    "unlocked_pins": [],
+    "elsewhere": [],
+    "live_claims": []
+  },
   "redirect/cargo/cargo/two-sections/expected": {
     "refs": [
       {
@@ -430,5 +624,60 @@
     "unlocked_pins": [],
     "elsewhere": [],
     "live_claims": []
+  },
+  "redirect/cargo/cargo/workspace-member/expected": {
+    "refs": [
+      {
+        "purl": "pkg:cargo/serde@1.0.190",
+        "uuid": "55555555-5555-5555-5555-555555555555",
+        "mode": "hosted",
+        "source_file": "Cargo.lock",
+        "artifact_rel": null,
+        "locked_integrity": "Sha256Hex(\"deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef\")",
+        "integrity_required": true,
+        "url": "sparse+https://patch.socket.dev/patch-registry/cargo/11111111-1111-1111-1111-111111111111/55555555-5555-5555-5555-555555555555/index/",
+        "lockfile_basis_ok": true
+      }
+    ],
+    "diagnostics": [],
+    "recognized": [
+      {
+        "uuid": "11111111-1111-1111-1111-111111111111",
+        "mode": "hosted",
+        "file": ".cargo/config.toml"
+      },
+      {
+        "uuid": "11111111-1111-1111-1111-111111111111",
+        "mode": "hosted",
+        "file": "Cargo.lock"
+      },
+      {
+        "uuid": "55555555-5555-5555-5555-555555555555",
+        "mode": "hosted",
+        "file": ".cargo/config.toml"
+      },
+      {
+        "uuid": "55555555-5555-5555-5555-555555555555",
+        "mode": "hosted",
+        "file": "Cargo.lock"
+      }
+    ],
+    "unlocked_pins": [],
+    "elsewhere": [],
+    "live_claims": [
+      {
+        "mode": "hosted",
+        "uuid": "55555555-5555-5555-5555-555555555555",
+        "purl": "pkg:cargo/serde@1.0.190"
+      }
+    ]
+  },
+  "redirect/cargo/cargo/workspace-member/input": {
+    "refs": [],
+    "diagnostics": [],
+    "recognized": [],
+    "unlocked_pins": [],
+    "elsewhere": [],
+    "live_claims": []
   }
 }
diff --git a/docs/ecosystems.md b/docs/ecosystems.md
index d070106f..4038cf42 100644
--- a/docs/ecosystems.md
+++ b/docs/ecosystems.md
@@ -16,7 +16,7 @@ The backticked slug in each row is the value `-e`/`--ecosystems` accepts (e.g.
 |-----------|------------------------|------------------------------|--------------------------|
 | npm (`npm`) — pnpm / yarn / berry / bun | ✅ any install layout; `setup` postinstall hook | ✅ six lockfile flavors: package-lock, yarn classic, yarn berry (node-modules linker; PnP refused), pnpm v9, pnpm legacy v5.4/v6.0 (`pnpm 7/8` — frozen installs are path-bound because those majors absolutize `file:` override specifiers; moved checkouts run one `pnpm install --offline --no-frozen-lockfile`, surfaced as `vendor_pnpm_legacy_absolute_specifier`), bun text `bun.lock` lockfileVersion 0/1/2 and native binary `bun.lockb` revisions 1/2/3 (binary locks stay binary; text workspace vendoring requires lockfileVersion 2 — see [Bun compatibility](testing/bun-compatibility.md)). Rush monorepos refused (`vendor_rush_unsupported`) — see [Rush notes](#npm-rush-monorepos) | ✅ package-lock / npm-shrinkwrap, pnpm-lock.yaml and legacy shrinkwrap.yaml (pnpm majors 1–12; block and flow resolutions), yarn classic, yarn berry, bun — pnpm, berry, and bun carry constraints, see [npm hosted-mode notes](#npm-hosted-mode-notes) |
 | PyPI (`pypi`) — uv / poetry / pdm / pipenv / pip | ✅ `.pth` startup hook via `setup` | ✅ uv project/script locks, PEP 751 `pylock.toml` / `pylock.<name>.toml`, poetry, pdm, pipenv (Pipenv 2018 or later — every `Pipfile.lock` category is rewired, lock-only checkouts included; Pipenv 2023+ does not hash-check local wheels — `vendor_integrity_unverified`; a venv still holding the upstream release is reported as `pypi_pipenv_stale_install`; see [Pipenv compatibility](testing/pipenv-compatibility.md)), and requirements.txt. Native uv vendoring requires uv ≥ 0.2.35 (the `[[package]]` lock grammar); hosted mode covers native `uv.lock` from uv 0.1.45 (the first release whose `uv lock` writes one) and requirements from uv 0.0.5; see [uv compatibility](testing/uv-compatibility.md). | ✅ requirements.txt including hash continuations, uv project/script locks, and PEP 751 locks. Version/source ambiguity is refused; see [uv compatibility](testing/uv-compatibility.md). Poetry 1.x and 2.x locks are supported; Poetry 0.x ignores URL sources and is refused. See [Poetry compatibility](testing/poetry-compatibility.md). Pipenv `Pipfile.lock` (pipfile-spec 6 — Pipenv 7 and later; `path` references for 7–11, `file` from 2018; lock-only checkouts and Pipenv's out-of-tree venv are discovered; a warm venv that Pipenv will not reinstall over warns `redirect_pypi_stale_install`; see [Pipenv compatibility](testing/pipenv-compatibility.md)). `pdm.lock` is supported for the lock formats PDM 0.12–1.4 and 2.8.1+ write (`lock_version` 2 / 4.3–4.5.1); the identity-losing 3.1 / 4.0–4.2 formats (PDM 1.8–2.7) are refused. PDM 2.8.0 writes an indistinguishable `4.3` lock but shares that identity-loss bug, so a rewritten 2.8.0 lock crashes `pdm sync` — upgrade to ≥ 2.8.1. See [PDM compatibility](testing/pdm-compatibility.md). |
-| Cargo (`cargo`) | ✅ in-place + `.cargo-checksum.json` rewrite (shared registry-cache caveat — see [Cargo: shared registry cache](#cargo-shared-registry-cache)) | ✅ `[patch.crates-io]` path entry in the root `Cargo.toml` (v5; per-version Socket keys; pre-v5 `.cargo/config*` wiring migrates on re-run) | ✅ per-patch sparse registry (`[registries.socket-patch-<uuid>]` + Cargo.lock source/checksum) |
+| Cargo (`cargo`) | ✅ in-place + `.cargo-checksum.json` rewrite (shared registry-cache caveat — see [Cargo: shared registry cache](#cargo-shared-registry-cache)) | ✅ `[patch.crates-io]` path entry in the root `Cargo.toml` (v5; per-version Socket keys; pre-v5 `.cargo/config*` wiring migrates on re-run) | ✅ per-patch sparse registry (`[registries.socket-patch-<uuid>]` + Cargo.lock source/checksum); direct dependencies only — a crate another dependency also pulls in is refused, use `--mode vendored`; with no `Cargo.lock` the graph is unknown, so only a project whose sole dependency is the patched crate is redirected |
 | RubyGems (`gem`) | ✅ Bundler plugin via `setup` — needs bundler ≥ 2.2 (1.x cannot load `plugin ... path:` directives; `setup` refuses below the floor and `setup --check` red-flags a wired 1.x project) | ✅ Gemfile + Gemfile.lock path pair (`Gemfile` spelling only — a `gems.rb` project cannot vendor yet) | ✅ per-dep `source` block — edits `gems.rb` + `gems.locked` when present (bundler prefers them over `Gemfile`; spellings that diverge beyond Socket's own edits fail closed with `redirect_gem_gemfile_spellings_diverge`); the `CHECKSUMS` pin needs bundler ≥ 2.6 (older locks get a `redirect_gem_no_checksums_section` warning); a stale pre-redirect materialization that `bundle install` would reuse instead of refetching is flagged `redirect_gem_stale_install` with a prescriptive remedy (see CLI_CONTRACT.md's "Gem stale-install guard") |
 | Go (`golang`) | ✅ `go.mod` `replace` → `.socket/go-patches/` — see [Go: directory replaces and go.sum](#go-directory-replaces-and-gosum) | ✅ `replace` → the committed vendor tree | ✅ (free tier) fork-style `replace` → `patch.socket.dev/gopatch/<uuid>` + committed `go.sum` pin; see [golang-hosted.md](design/golang-hosted.md). Paid tier stays ❌ ([golang-hosted-no-go.md](design/golang-hosted-no-go.md)); `redirect_golang_unsupported` names the vendored remedy |
 | Maven (`maven`) | ✅ apply-only (no `setup` hook — reports `no_files`); in-place jar patching leaves the `~/.m2` checksum sidecars stale — prefer vendored / hosted, see [Maven & NuGet caveats](#maven--nuget-caveats) | ✅ committed maven2 `file://` repository. A root pom declaring `<modules>` (multi-module aggregator) is refused (`vendor_maven_multimodule_unsupported`), and a gradle-only project is refused (`vendor_gradle_unsupported`) | ✅ **pom projects only, fail-closed** — the patched jar is pinned at a Socket-only `<version>-socket.<hex8>` suffix; `${property}` versions are refused; Gradle gets a manual `exclusiveContent` snippet — see [Maven & NuGet caveats](#maven--nuget-caveats) |