Audit only the Go modules an undo unwired

Review follow-up. The audit no longer runs inside the shared revert
step, so a forward `vendor` run that reconciles a dropped entry
does not warn mid-run and again at the end. The undo commands
(`vendor --revert`, `rollback`, `remove`) now call it explicitly,
and it reports only issues for the Go modules they unwired, never
unrelated issues under the wrong package. This also drops the
rollback dedup that was only needed for that case.

`vendor --check` runs the audit once. The docs now name
`vendor --revert` and `remove` among the commands that warn.

Assisted-by: Claude Code:claude-opus-5-5

Author: claude

crates/socket-patch-cli/src/commands/remove.rs

@@ -1295,9 +1295,15 @@ async fn revert_vendored_matches(
     let mut leg = RemoveVendorLeg::default();
     // Stops at the first hard failure: remove aborts there, leaving the
     // remaining matches (and the manifest) untouched.
-    let reverted = VendoredBackend::new(&args.common, None)
-        .revert(keys, state, opts, true)
-        .await;
+    let backend = VendoredBackend::new(&args.common, None);
+    let reverted = backend.revert(keys, state, opts, true).await;
+    for (key, w) in backend.go_undo_warnings(&reverted).await {
+        if loud {
+            eprintln!("Warning: {}", w.detail);
+        }
+        leg.skipped
+            .push(PatchEvent::new(PatchAction::Skipped, key).with_reason(w.code, w.detail));
+    }
     for RevertedEntry {
         key,
         warnings,

crates/socket-patch-cli/src/commands/rollback.rs

@@ -989,9 +989,14 @@ async fn run_vendored_leg(
         keep_artifact: preserve,
     };
     let loud = !common.json && !common.silent;
-    let reverted = VendoredBackend::new(common, None)
-        .revert(keys, state, opts, false)
-        .await;
+    let backend = VendoredBackend::new(common, None);
+    let reverted = backend.revert(keys, state, opts, false).await;
+    for (_, w) in backend.go_undo_warnings(&reverted).await {
+        if loud {
+            eprintln!("Warning: {}", w.detail);
+        }
+        out.warnings.push((w.code.to_string(), w.detail));
+    }
     for RevertedEntry {
         key,
         warnings,
@@ -2253,18 +2258,11 @@ pub async fn run(args: RollbackArgs) -> i32 {
                 .chain(hosted_leg.warnings.iter())
                 .cloned()
                 .collect();
-            // Both Go legs audit the same go.mod and vendor/modules.txt
-            // (#1777): an issue the agent leg already reported is not
-            // repeated for the vendored one.
             vendored_leg
                 .warnings
                 .iter()
                 .chain(hosted_leg.warnings.iter())
-                .for_each(|w| {
-                    if !run_warnings.contains(w) {
-                        run_warnings.push(w.clone());
-                    }
-                });
+                .for_each(|(code, detail)| run_warnings.push((code.clone(), detail.clone())));
             // A restored package whose ownership could not be put back, or
             // whose stale bytecode could not be removed (the engine reports
             // it on `error` with `success: true`), is restored but worth a

crates/socket-patch-cli/src/commands/vendor.rs

@@ -1241,7 +1241,8 @@ async fn run_check(args: &VendorArgs) -> i32 {
     } else {
         None
     };
-    let go_sync_issues = tokio::sync::OnceCell::new();
+    let go_sync_issues =
+        socket_patch_core::vendor::go_consumer_sync::audit(root, &HashMap::new()).await;
     for (key, entry) in entries {
         let record = entry.record.as_ref().or_else(|| manifest.patches.get(key));
         let mut failure = match record {
@@ -1280,11 +1281,6 @@ async fn run_check(args: &VendorArgs) -> i32 {
         if failure.is_none() && entry.ecosystem == "golang" {
             if let Some((module, _)) = socket_patch_core::utils::purl::parse_golang_purl(key) {
                 let issues: Vec<String> = go_sync_issues
-                    .get_or_init(|| async {
-                        socket_patch_core::vendor::go_consumer_sync::audit(root, &HashMap::new())
-                            .await
-                    })
-                    .await
                     .iter()
                     .filter(|issue| issue.module() == module)
                     .map(ToString::to_string)
@@ -1374,10 +1370,6 @@ async fn run_check(args: &VendorArgs) -> i32 {
         .map(|(module, _)| module.into_owned())
         .collect();
     let stale_records: Vec<(String, String)> = go_sync_issues
-        .get_or_init(|| async {
-            socket_patch_core::vendor::go_consumer_sync::audit(root, &HashMap::new()).await
-        })
-        .await
         .iter()
         .filter(|issue| {
             matches!(
@@ -4480,14 +4472,18 @@ async fn run_revert(args: &VendorArgs, env: &mut Envelope) -> i32 {
     // (rollback's vendored leg, both of remove's paths, the manifest
     // reconcile): dispatch → drift-keep → per-entry ledger save. Only the
     // event vocabulary and the human lines are this command's.
-    let reverted = VendoredBackend::new(common, None)
+    let backend = VendoredBackend::new(common, None);
+    let reverted = backend
         .revert(
             &recorded,
             &mut state,
             RevertOpts::new(common.dry_run),
             false,
         )
         .await;
+    for (purl, w) in backend.go_undo_warnings(&reverted).await {
+        record_warning(env, &purl, &w, common);
+    }
     for RevertedEntry {
         key: purl,
         flavor,

crates/socket-patch-cli/src/commands/vendored_backend/mod.rs

@@ -142,18 +142,13 @@ impl<'a> VendoredBackend<'a> {
         stop_on_failure: bool,
     ) -> Vec<RevertedEntry> {
         let mut out = Vec::with_capacity(keys.len());
-        let mut unwired_go = Vec::new();
         for key in keys {
             // Captured before a clean revert drops the entry.
             let flavor = state.entries.get(key).and_then(|e| e.flavor.clone());
             let gem = state
                 .entries
                 .get(key)
                 .map(|e| (e.ecosystem.clone(), e.base_purl.clone()));
-            let golang = state
-                .entries
-                .get(key)
-                .is_some_and(|e| e.ecosystem == "golang");
             let mut result = revert_vendor_entry(&self.common.cwd, key, state, opts).await;
             let hard_failure = matches!(
                 result.step,
@@ -192,9 +187,6 @@ impl<'a> VendoredBackend<'a> {
                     .await;
                 }
             }
-            if golang && unwired && !matches!(result.step, VendorRevertStep::WouldRevert) {
-                unwired_go.push(out.len());
-            }
             out.push(RevertedEntry {
                 key: key.clone(),
                 flavor,
@@ -205,36 +197,50 @@ impl<'a> VendoredBackend<'a> {
                 break;
             }
         }
-        self.push_go_consumer_warnings(&unwired_go, &mut out).await;
         out
     }
 
-    /// Dropping a vendored `replace` leaves a committed vendor/modules.txt
-    /// (or go.mod requirements) still describing it, which breaks every
-    /// default build until `go mod vendor` runs (#343, #1777). Audit once
-    /// after the loop and attach each issue to the unwired Go entry of its
-    /// module (the first one when none matches), so every reverting
-    /// command reports it.
-    async fn push_go_consumer_warnings(&self, unwired_go: &[usize], out: &mut [RevertedEntry]) {
-        let Some(&first) = unwired_go.first() else {
-            return;
-        };
-        let issues =
-            socket_patch_core::vendor::go_consumer_sync::audit(&self.common.cwd, &HashMap::new())
-                .await;
-        for issue in issues {
-            let owner = unwired_go
-                .iter()
-                .copied()
-                .find(|&i| {
-                    socket_patch_core::utils::purl::parse_golang_purl(&out[i].key)
-                        .is_some_and(|(module, _)| module == issue.module())
-                })
-                .unwrap_or(first);
-            out[owner]
-                .warnings
-                .push(VendorWarning::new(issue.code(), issue.to_string()));
+    /// Dropping a vendored Go `replace` leaves a committed
+    /// vendor/modules.txt still recording it, which breaks every default
+    /// build until `go mod vendor` runs (#343, #1777). The undo commands
+    /// call this after [`Self::revert`]: it audits the Go consumer state
+    /// once and returns the issues of the Go modules `reverted` unwired,
+    /// each keyed by the ledger key of its entry. Not part of `revert`
+    /// itself, whose forward-run caller (the manifest reconcile) audits
+    /// once at the end of the run instead.
+    pub(crate) async fn go_undo_warnings(
+        &self,
+        reverted: &[RevertedEntry],
+    ) -> Vec<(String, VendorWarning)> {
+        let unwired: Vec<(&str, String)> = reverted
+            .iter()
+            .filter(|e| {
+                matches!(
+                    e.step,
+                    VendorRevertStep::Reverted
+                        | VendorRevertStep::Preserved
+                        | VendorRevertStep::LedgerWriteFailed(_)
+                )
+            })
+            .filter_map(|e| {
+                socket_patch_core::utils::purl::parse_golang_purl(&e.key)
+                    .map(|(module, _)| (e.key.as_str(), module.into_owned()))
+            })
+            .collect();
+        if unwired.is_empty() {
+            return Vec::new();
         }
+        socket_patch_core::vendor::go_consumer_sync::audit(&self.common.cwd, &HashMap::new())
+            .await
+            .into_iter()
+            .filter_map(|issue| {
+                let (key, _) = unwired.iter().find(|(_, m)| m == issue.module())?;
+                Some((
+                    key.to_string(),
+                    VendorWarning::new(issue.code(), issue.to_string()),
+                ))
+            })
+            .collect()
     }
 }
 

crates/socket-patch-cli/tests/e2e_vendor_golang_build.rs

@@ -1167,7 +1167,7 @@ fn vendored_undo_needs_go_mod_vendor(label: &str, undo: &[&str], workspace: bool
         // still reports as unledgered; only the modules.txt drift is gone.)
         let (_code, so, se) = run_socket(&consumer, &["vendor", "--check", "--cwd", cs], &modcache);
         assert!(
-            !se.contains("go_vendor_modules_txt_out_of_sync"),
+            !se.contains("go_vendor_modules_txt_out_of_sync") && !so.contains("modules.txt"),
             "[{label}] in sync after {named}:\n{so}\n{se}"
         );
     }

docs/ecosystems.md

@@ -1475,8 +1475,9 @@ for it until `rollback -g`.
 
 Two files the go command derives from `go.mod` can disagree with a new or removed
 socket `replace`, and go then refuses to build. socket-patch does not regenerate
-them (that needs the go toolchain and the whole module graph); `apply`, `vendor`,
-`rollback` and `scan --mode hosted` warn with the command that does, and
+them (that needs the go toolchain and the whole module graph); `apply`, `vendor`
+(including `vendor --revert`), `rollback`, `remove` and `scan --mode hosted` warn
+with the command that does, and
 `apply --check` / `vendor --check` report the disagreement as drift until it is run:
 
 | Warning code | When | Fix |