@@ -0,0 +1,45 @@
+[agent] 2026-11-01: pip / requirements.txt bug-hunt run
+
+**Tested:** main `cbbbdb9` (1 commit since `5ca5623`: #1796, the #1794 fix), latest release v5.0.1. Linux only: real pip 26.2.2 / CPython 3.12 and pip 20.3.4 / CPython 3.8 (uv venvs). Harness: mock2.py from entry 20261029T021000Z, unchanged. The patched wheels were rebuilt from the real PyPI wheels (append `SAFE = True`, recompute RECORD).
+
+**Probe branches:** none (branch deletion is still blocked, see backlog 3).
+
+## Re-triage
+
+- #1794 (closed by #1796): **verified fixed.** `six[foo]==1.16.0` + `certifi` + `pip lock` pylock, hosted first. The `vendor` eject and `scan --mode vendored` both refuse `pypi_extras_unsupported` (exit 1), keep both hosted pins, and a fresh `pip install -r` installs patched. Comment: https://github.com/SocketDev/socket-patch/issues/1794#issuecomment-6563096769
+- #1851 / #1873: PR #1853 is still open, and there's no fix for #1873. Not re-run.
+
+## Cells (Linux, pip 26.2.2 / py3.12 unless noted)
+
+| Cell | Result |
+| --- | --- |
+| `--no-binary six` global line + `six==X`, hosted / vendored | pass (wheel URL / path installs patched; `vendor --check` 0) |
+| `--only-binary :all:` first line, hosted / vendored | pass |
+| `--index-url https://pypi.org/simple` first line, hosted / vendored | pass |
+| `-e ./app` (pyproject depends on six) + `six==X` pin, hosted / vendored | pass |
+| `-e ./app` with six only transitive, vendored | pass (`(transitive)` line, fresh install patched) |
+| Same, hosted, no venv | `No requirements.txt entry` warning, exit 0 (known #638 class) |
+| Duplicate `six==X` lines split by `sys_platform` markers, hosted / vendored | pass (both lines rewritten, markers kept; rollback / `vendor --revert` byte-identical) |
+| `six==1.15.0 ; py<3.9` + `six==1.16.0 ; py>=3.9`, hosted / vendored | pass (only the 1.16.0 line rewritten; reverts byte-identical) |
+| Hosted `rollback`, then plain `pip install -r` (26.2.2 / py3.12, 20.3.4 / py3.8) | **fail → #1953**: `Requirement already satisfied`, patched build kept, generic "until the next package-manager install" note; `pip freeze` re-emits the patch-server URL |
+| Vendored `vendor --revert` / `rollback`, then `pip install -r` (both pip versions) | **fail → #1953**: patched kept, no advisory on `vendor --revert`; `pip freeze` names the deleted `.socket/vendor` wheel, so installing the frozen file fails |
+
+## Issues
+
+- Filed: #1953 https://github.com/SocketDev/socket-patch/issues/1953
+- Commented: #1794 (verified fixed).
+- Closed: none (#1794 was already closed by the maintainer).
+
+## False positives ruled out
+
+- The first #1794 re-run, with both pylock packages patched, hit the documented sole-sibling restore refusal. With an unpatched `certifi` sibling, the real path passes.
+- Hosted over a warm venv stays upstream after `pip install -r`: this is known and warned (`redirect_pypi_stale_install`), so it isn't part of #1953.
+- `setup` and the `.pth` hook: v5 has no `setup` command, so that focus area is obsolete for this CLI.
+
+## Next
+
+1. #1953: re-verify once fixed; also try `pip install -r pylock.toml` after a pylock unwind (PEP 751 lane, same likely keep).
+2. #1873 / #1851: re-verify once fixed (PR #1853).
+3. `--require-hashes` + `-e` mix (pip refuses editables under hash mode) vs hosted rewrite messages.
+4. 1i: a Windows backslash vendored path vs the residual probe (needs a probe branch).
+5. A Windows / macOS probe, once branch deletion works.
@@ -1,6 +1,6 @@
 [agent] Progress ledger for the scheduled pip / requirements.txt bug-hunt routine (label pm:pip).
 
-Last run: 2026-10-30 ~08:00 UTC (fifty-sixth run), main `5ca5623` (unchanged since run 55), latest release v5.0.1. No new issues. Passed: agent / hosted / vendored (+ fresh install, `vex`) on CPython 3.14.6, 3.14.6t (free-threaded) and 3.15.0b4 with pip 26.1.2; `${VAR}` shapes `--hash=sha256:${H}`, `; ${MARK}` marker and `six @ ${URL}` (hosted / vendored, no pylock; the pylock contest gap is #1873); `--hash sha256:X` (space form) hosted / vendored; the backlog-1q two-package dotted-name (`Zope_Event`) CRLF takeover, root and `-r` include. Probe branches are still blocked. Open: #1873, #1851 (PR #1853), #1794 (PR #1796), #977 (needs-human), #638 (+ #836 enhancement).
+Last run: 2026-11-01 (fifty-seventh run), main `cbbbdb9` (#1796 fixed #1794, verified), latest release v5.0.1. Filed #1953 (plain `pip install -r` keeps the patched build after a hosted rollback / vendored revert; no pip reinstall advisory). Passed: `--no-binary` / `--only-binary` / `--index-url` option lines, `-e ./app` editable + pin / transitive, duplicate pins split by markers, a split-version marker pair (hosted / vendored, reverts byte-identical). Probe branches are still blocked. Open: #1953, #1873, #1851 (PR #1853), #977 (needs-human), #638 (+ #836 enhancement).
 ## Coverage matrix
 
 | OS | pip / Python | agent (.venv) | agent egg-info | hosted (unhashed → fragment pin) | vendored | rollback / remove | vendored → hosted takeover | system-site venv | `-r` include, lock-only | PEP 440-equivalent pin (`==1.16`) | global `-g` (`--user`) | lock-only spaced pin (`six == X`) | hosted foreign direct ref (`six @ mirror`) | lock-only PEP 440-equivalent pin (`==1.16`) | no root requirements.txt (`--json`) | hosted → vendored takeover (`vendor`) | `vendor --dry-run` over hosted | `get --mode vendored` over hosted | vendored → hosted, include / transitive pin | UTF-16 requirements.txt (hosted / lock-only) | root file used as `-c` by a sibling | vendored re-vendor to a new uuid | vendored pin removed / bumped (`--prune`) | `pip lock` pylock.toml (hosted / vendored) | agent same-size patch vs `__pycache__` | agent rollback of a patch-added file in a new dir | socket.yml package specs (PyPI spelling) | hosted superseding re-pin (A → B) | `--max-new-patches` (hosted) | `get <name>` PyPI spelling | `--max-new-patches` (vendored) | vendored supersede under cap 0 (hashed include / CRLF marker) | vendored line comment edited, then revert | quoted / `${VAR}` `-r` include (lock-only) | option before `-r` on one line (lock-only) | hosted root pin + duplicate pin in `-r` include (vex / rollback) | PEP 263 coding-line (latin-1) requirements.txt, lock-only | `apply --check` (agent, #1029) | vendored `scan --prune` liveness (#1050) | hosted / vendored file regenerated by `pip freeze` | hashed hosted root + hashed `-r` include (`--require-hashes`) | dangling `\` continuation at EOF (lock-only) | lock-only bare-CR / FF / NEL / U+2028 line breaks | `list` (hosted / marker split / include) | requirements spelling contests Pipfile.lock wiring (vex) | out-of-root `-r` include + pylock (vendored) | requirements-line edge shapes (hosted / vendored) |
@@ -59,12 +59,14 @@ Run 50 (Linux, pip 26.2.2 / CPython 3.11, lock-only + pylock): hosted → vendor
 
 ## Backlog
 
+1v. #1953: re-verify once fixed (hosted `rollback`, vendored `vendor --revert` / `rollback`, then plain `pip install -r` must be advised a `--force-reinstall`). Also check `pip install -r pylock.toml` after a pylock unwind. Run 57 passed: option lines (`--no-binary`, `--only-binary`, `--index-url`), `-e ./app` + pin, marker-split duplicate pins, split-version marker pair.
+
 1u. #1873: re-verify once fixed (vendored + pylock `vendor --check` must fail and `vex` must omit six; the no-pylock path should then accept the pin or name the variable, not say `pypi_requirement_not_pinned`; lock-only discovery should list six). Run 56 (no pylock): `--hash=sha256:${H}` and `; ${MARK}` pass hosted / vendored (variable kept verbatim, fresh install patched, revert byte-identical); `six @ ${URL}` is refused (hosted `not uniquely pin`, vendored `not pinned`), fail-closed. Every requirement-line `${VAR}` beside a pylock is #1873's root cause, so don't re-file those shapes.
 
 1q. done 2026-10-30 run 56: two-package dotted-name (`Zope_Event==5.0` + `SIX==1.16.0  # keep`, CRLF) vendored → hosted takeover in the root file passes (fresh install patched, rollback pip-equivalent, `vendor --revert` byte-identical, `remove Zope_Event` restores the original spelling); in a CRLF `-r` include both are loudly kept vendored (`redirect_requirements_takeover_unreachable`, documented). Earlier: done 2026-10-29 run 52 for the `-c` constraints file and `requirements-dev.txt` sibling under `rollback` (fail-safe residual keep, re-run finishes). Still open: the two-package dotted-name CRLF `-r` include takeover. Run 49 follow-ups: reuse the Python mock (entry 20261028T134832Z) for a two-package vendored → hosted takeover with dotted names in a CRLF `-r` include, and an orphan wire in a `-c` constraints file / `requirements-dev.txt` sibling under `rollback` (unscoped refusal).
 1s. #1851 (PR #1853): re-verify once merged. Absolute-path `-r /abs/base.txt` done on run 55: fails on main, PR #1853 refuses and contests it. uv.lock / Pipfile.lock / poetry.lock siblings are covered by #1853's own tests, so no handover is needed. Earlier note: re-verify once fixed (vendored and the hosted → `vendor` eject; `vex` against a venv installed from requirements.txt must not attest six). Also check the same out-of-root include beside a uv.lock / Pipfile.lock sibling (hand over to uv / pipenv if it reproduces there), and an absolute-path `-r /abs/base.txt` include.
 1t. Low-value refusal wording, not filed: vendored `six[]==X` (empty extras, pip reads it as no extras) is refused `pypi_extras_unsupported`, and a pinned `six==X --config-settings=a=b` is refused as `pypi_requirement_not_pinned` ("not pinned to ==X"), which is misleading but deliberate in `scan_pins` (other per-requirement options would be dropped). Hosted keeps both and installs patched. Raise with the maintainer only if a real user hits it.
-1r. #1794: re-verify once fixed (eject and `scan --mode vendored`; also `--dry-run` previews); still reproduces on `ecd4924`. Other `sibling_pin_wirable`-rejected shapes: a symlinked root requirements.txt is refused up front by hosted (`redirect_symlinked_file_unsupported`, nothing written), so the eject can't reach it (run 51); a transitive-only package (not in requirements.txt) is left with the documented `installs driven by requirements.txt retain their existing sources` warning on both hosted and eject (pass). Still open: an include outside the root, a pin whose package also has a vendor line for another version. New 2026-10-29: #891 fixed by #1813. With real pip, `scan --mode vendored --dry-run` previews `pypi_requirement_not_pinned` (unpinned, `-c`-only pin, range, direct URL) and `pypi_extras_unsupported` as `skipped` with the same code as the wet run; a symlinked `pylock.dev.toml` gives `vendor_would_refuse_symlinked_file` (documented: warning only, exit 0).
+1r. done 2026-11-01 run 57: #1794 verified fixed by #1796 (eject / `scan --mode vendored` refuse extras, hosted pins kept). Earlier: #1794: re-verify once fixed (eject and `scan --mode vendored`; also `--dry-run` previews); still reproduces on `ecd4924`. Other `sibling_pin_wirable`-rejected shapes: a symlinked root requirements.txt is refused up front by hosted (`redirect_symlinked_file_unsupported`, nothing written), so the eject can't reach it (run 51); a transitive-only package (not in requirements.txt) is left with the documented `installs driven by requirements.txt retain their existing sources` warning on both hosted and eject (pass). Still open: an include outside the root, a pin whose package also has a vendor line for another version. New 2026-10-29: #891 fixed by #1813. With real pip, `scan --mode vendored --dry-run` previews `pypi_requirement_not_pinned` (unpinned, `-c`-only pin, range, direct URL) and `pypi_extras_unsupported` as `skipped` with the same code as the wet run; a symlinked `pylock.dev.toml` gives `vendor_would_refuse_symlinked_file` (documented: warning only, exit 0).
 1o. done 2026-10-28 run 50: #1758 verified fixed; the `-r` include and `pylock.<name>.toml` cells pass. (The two-package eject refusal / rollback over requirements.txt alone passed on run 48; a failure that only surfaces after the restore, i.e. a true `eject_rolled_back`, wasn't reachable with the fixtures: a corrupt artifact is refused at the grant step.)
 1p. Re-verify the maintainer-closed fixes with real pip (closed 2026-10-22 to 10-27): #1104, #819. (Done 2026-10-29 run 51: #1623 two-package `pip lock` revert byte-identical, comments above restored keys kept, `remove` of the first-vendored package clean; #1602 `===` contests, `==X.0` / `==vX` / `==1.16` / `SIX == X` are wired as siblings; #1587 `wheels/…`, `wheels//…`, `wheels/./…`, `wheels\…`, `file:wheels/…` all contest.) (#740 verified on the eject path on run 48; #1567's mixed-EOL case passes on the eject path; the plain vendored planner over a mixed file is still to re-check.)