@@ -1618,7 +1618,7 @@ command's integration tests check its output.
 | `vendor_bun_workspace_unsupported` | `failed` | vendor / scan / get `--mode vendored` (bun): the text lock holds `workspace:` packages and its `lockfileVersion` is below 2 — Bun 1.2–1.3 resolve a workspace member's local-tarball path relative to the member; a committed version-2 lock is the proof every consumer runs Bun ≥ 1.4 (deliberate over-approximation: root-only declared packages would install on version 1 too). Detail names the version integer and a version-specific remedy: delete `bun.lock` and re-lock with Bun ≥ 1.4 (an in-place `bun install` keeps the existing version) — then, for a version-1 lock, "or use `--mode hosted`, which accepts version-1 workspace locks"; for a version-0 lock, "or delete `bun.lock`, re-lock with Bun ≥ 1.2 (which writes lockfileVersion 1) and use `--mode hosted`" (hosted refuses version-0 workspace locks, so a bare hosted pointer would send the user into a second refusal). Refused before any write — in the pre-download preflight on `get`/`scan` (see `vendor_bun_lockb_invalid` for the placements); in the shared preflight that `vendor` and the vendor step run BEFORE a hosted → vendored takeover's revert (a hosted-redirected purl stays hosted-wired, ledger and lock untouched; `vendor --dry-run` previews the same `failed` code); and in the engine when the run would write a NEW local tuple. Exempt: purls the vendor ledger wires at the selected uuid, purls whose every `bun.lock` instance is already a `.socket/vendor/npm/` tuple (any uuid), in-sync re-runs and `repair` redownloads. |
 | `vendor_lockfile_missing` / `vendor_lockfile_version_unsupported` (bun preflight placement) | `failed` | scan / get `--mode vendored` (bun): the pre-download preflight found `bun.lock` unreadable / at a `lockfileVersion` other than 0, 1 or 2 (a newer version: update socket-patch; no integer: re-lock with Bun ≥ 1.2 — the same text as hosted's `redirect_bun_lock_unsupported`) or outside bun's single-line `packages` grammar. Same placements as `vendor_bun_lockb_invalid`; nothing fetched, no patch record. An unreadable `.socket/vendor/state.json` met by the same preflight is `vendor_state_unreadable` (see that row), never one of these. |
 | `bun_lockb_invalid` | scan `warnings[]` (run-level) | scan (every mode): the native binary inventory could not parse or read `bun.lockb`; detail names the format or filesystem error. Also printed as `Warning: …` on stderr. Exit and status remain unchanged. The warning is retained on empty and non-empty scans; valid binary locks are inventoried normally without a runtime or install. |
-| (Bun / pnpm-takeover / PyPI refusal codes) | `skipped` (dry-run preview, `details.mode: "vendored"`) | scan `--mode vendored --dry-run` / get `--mode vendored --dry-run`: the wet run's Bun preflight would refuse this npm purl (`errorCode` one of the four Bun lock codes above, or `vendor_state_unreadable` for an unreadable vendor ledger), or the pnpm backend would refuse the takeover of its hosted pin (`errorCode` that backend's lock-text code, #853), or the PyPI vendored backend's wiring guards would refuse this PyPI purl (`errorCode` that backend's code, #891); `reason` carries the detail. Exit 0 / `status: "success"`, nothing written. (v5.0: replaces the `would_refuse` preview action.) |
+| (Bun / pnpm-takeover / lock-text / PyPI refusal codes) | `skipped` (dry-run preview, `details.mode: "vendored"`) | scan `--mode vendored --dry-run` / get `--mode vendored --dry-run`: the wet run's Bun preflight would refuse this npm purl (`errorCode` one of the four Bun lock codes above, or `vendor_state_unreadable` for an unreadable vendor ledger), or the pnpm backend would refuse the takeover of its hosted pin (`errorCode` that backend's lock-text code, #853), or the npm package-lock / pnpm / yarn / cargo backend would refuse this purl on its lock text alone (`errorCode` that backend's code, such as `vendor_lock_entry_not_rewritable` or `vendor_workspace_member`; the download phase's "Lock-text refusals before the download" scope, #1976), or the PyPI vendored backend's wiring guards would refuse this PyPI purl (`errorCode` that backend's code, #891); `reason` carries the detail. Exit 0 / `status: "success"`, nothing written. (v5.0: replaces the `would_refuse` preview action.) |
 | `cargo_wiring_migrated` | `skipped` (advisory note) | vendor / scan / get `--mode vendored` / repair (v5.0): a pre-v5 `.cargo/config.toml` / `.cargo/config` vendored `[patch.crates-io]` entry was moved into the workspace-root `Cargo.toml` (dry run: "would move"); the ledger entry is rewritten to name `Cargo.toml` (lock originals kept). A vendor re-run that migrates reports the package `applied`, not `already_vendored`. |
 | `cargo_legacy_wiring_kept` | vendor: `failed`; repair: `skipped` (warning) | vendor / scan / get `--mode vendored` (v5.0): the pre-v5 config entry could not be removed after the manifest took the wiring — the run is unwound (manifest, lock and copy as before) and the package fails, since a kept entry would double-wire the crate and, on a uuid bump, point at a copy the stale sweep deletes; the code prefixes the error detail. repair: the move was refused (e.g. an unparseable `Cargo.toml`, a user entry for the crate, or an unremovable legacy entry — the manifest edit is unwound); left in place. |
 | `cargo_version_tagged` | `skipped` (advisory note) | vendor / scan / get `--mode vendored` / repair (v5.0): a vendored copy and its detached Cargo.lock entry were (re)tagged `<version>+socket.<uuid>` — a copy vendored before tagged versions, or a lock entry tagged for another uuid while the wiring points at this copy (dry run: "would tag"). A vendor re-run that tags reports the package `applied`. |
 
@@ -769,8 +769,9 @@ impl VendorRefusals<'_> {
 pub(crate) type LockRefusals = HashMap<String, (&'static str, String)>;
 
 /// The lock-text refusals of the vendored download phase (see
-/// [`socket_patch_core::vendor::lock_text_refusals`]: the pnpm / yarn
-/// classic / yarn berry gates and cargo's locked-version gate), over the
+/// [`socket_patch_core::vendor::lock_text_refusals`]: the npm
+/// package-lock / pnpm / yarn classic / yarn berry gates and cargo's
+/// locked-version gate, through [`unclaimed_lock_text_refusals`]), over the
 /// patches the phase would otherwise fetch a view for — past the Bun
 /// refusal and the ledger's idempotency skip, which take precedence in the
 /// fetch loop. A purl the lockfiles pin hosted is left to the vendor loop:
@@ -808,23 +809,15 @@ pub(crate) async fn lock_text_refusals_for(
                 .is_none()
         })
         .collect();
-    let candidates: Vec<(&str, &str)> = fetchable
-        .iter()
-        .filter(|sr| !claimed.contains(&PurlKey::new(&sr.purl)))
-        .map(|sr| (sr.purl.as_str(), sr.uuid.as_str()))
-        .collect();
-    let refused = socket_patch_core::vendor::lock_text_refusals(cwd, &candidates).await;
-    let options = params.crawler_options();
-    let mut refusals =
-        crate::commands::vendor::lock_refusals_reaching_backend(
-            cwd,
-            refused,
-            &ledger.entries,
-            |purls| async move {
-                crate::commands::vendor::installed_purls(&options, &purls, prior).await
-            },
-        )
-        .await;
+    let mut refusals = unclaimed_lock_text_refusals(
+        cwd,
+        &fetchable,
+        &claimed,
+        ledger,
+        params.crawler_options(),
+        prior,
+    )
+    .await;
     // A hosted gem the takeover will refuse (#775) is refused here too, so
     // its view is never fetched for a package the run cannot vendor. The
     // download phase only runs online (`--offline` refuses `get` and `scan`
@@ -845,6 +838,46 @@ pub(crate) async fn lock_text_refusals_for(
     refusals
 }
 
+/// The lock-text half of [`lock_text_refusals_for`], shared with the
+/// vendored dry-run preview and rollout plan (`scan/vendor_flow.rs`) so the
+/// dry run and the wet run refuse exactly the same purls (#1976): the
+/// purls of `selected` the vendor backend refuses on the project's lock
+/// text alone ([`socket_patch_core::vendor::lock_text_refusals`]), leaving
+/// out a purl the lockfiles pin hosted (`claimed`: its takeover restores
+/// the upstream entry first), one the ledger's idempotency skip settles
+/// ([`detached_ledger_record`]), and one the vendor loop would never hand
+/// to its backend ([`crate::commands::vendor::lock_refusals_reaching_backend`];
+/// `options` and `prior` drive its installed-copy lookup).
+pub(crate) async fn unclaimed_lock_text_refusals(
+    cwd: &Path,
+    selected: &[&PatchSearchResult],
+    claimed: &std::collections::HashSet<PurlKey>,
+    ledger: &VendorState,
+    options: CrawlerOptions,
+    prior: Option<&crate::ecosystem_dispatch::NpmCrawlSnapshot>,
+) -> LockRefusals {
+    let candidates: Vec<(&str, &str)> = selected
+        .iter()
+        .filter(|sr| !claimed.contains(&PurlKey::new(&sr.purl)))
+        .filter(|sr| {
+            detached_ledger_record(RecordStore::Ledger(&ledger.entries), &sr.purl, &sr.uuid)
+                .is_none()
+        })
+        .map(|sr| (sr.purl.as_str(), sr.uuid.as_str()))
+        .collect();
+    if candidates.is_empty() {
+        return LockRefusals::new();
+    }
+    let refused = socket_patch_core::vendor::lock_text_refusals(cwd, &candidates).await;
+    crate::commands::vendor::lock_refusals_reaching_backend(
+        cwd,
+        refused,
+        &ledger.entries,
+        |purls| async move { crate::commands::vendor::installed_purls(&options, &purls, prior).await },
+    )
+    .await
+}
+
 /// The purl keys the project's lockfiles pin hosted (a patch-server
 /// tarball, Socket's own or one of `origins`): the purls whose vendored
 /// run is a hosted → vendored takeover.
 
@@ -186,8 +186,10 @@ impl VendorPreview {
 /// not predicted), and a would-refuse never flips the run's status or exit
 /// code. The preflights (the only disk access besides the ledger; the PyPI
 /// one may also probe `pipenv --version` and list Hatch environments, as
-/// the wet run's guards do) run only when the selection holds an npm or
-/// PyPI purl.
+/// the wet run's guards do; the lock-text gates read the lock, the
+/// manifest and, for a refused package the lock does not resolve to a
+/// registry source, the installed tree) run only when the selection holds
+/// an npm, PyPI or cargo purl.
 /// `takeover_refusals` adds the hosted→vendored takeover refusals the
 /// caller resolved (the gem gates of
 /// [`crate::commands::vendor::gem_takeover_preview_refusals`]), keyed by
@@ -209,7 +211,8 @@ pub(crate) async fn preview_vendor(
     let npm_lock_refusal = npm_lock_refusal(cwd, selected).await;
     let state = state.unwrap_or_default();
     let pnpm_refusals = hosted_pnpm_refusals(cwd, selected, origins, &state).await;
-    let lock_text_refusals = lock_text_refusals(cwd, selected, origins, &state).await;
+    let lock_text_refusals =
+        lock_text_refusals(cwd, selected, origins, &state, npm_lock_refusal.is_some()).await;
     let pypi_refusals = pypi_refusals(cwd, selected, origins, takeover_refusals).await;
     let refuse = |code: &str, detail: &str| PreviewVerdict::WouldRefuse {
         code: code.to_string(),
@@ -369,7 +372,8 @@ pub(super) async fn preflight_refused_purls(
     let origins = crate::commands::hosted_unwind::patch_server_origins(common);
     let state = state.unwrap_or_default();
     let pnpm_refusals = hosted_pnpm_refusals(cwd, selected, &origins, &state).await;
-    let lock_text_refusals = lock_text_refusals(cwd, selected, &origins, &state).await;
+    let lock_text_refusals =
+        lock_text_refusals(cwd, selected, &origins, &state, npm_lock_refusal.is_some()).await;
     let gem_refusals = crate::commands::vendor::gem_takeover_preview_refusals(
         common,
         selected.iter().map(|p| p.purl.as_str()),
@@ -406,54 +410,41 @@ async fn npm_lock_refusal(
 /// The purls of `selected` the vendor backend refuses on the project's
 /// lock and manifest text alone, with the backend's `(code, detail)`: the
 /// npm package-lock, pnpm, yarn classic and yarn berry per-entry gates and
-/// cargo's locked-version gate
-/// ([`socket_patch_core::vendor::lock_text_refusals`]). These are the
-/// refusals the wet run's download phase raises before it fetches a view
-/// ([`crate::commands::agent_download::lock_text_refusals_for`]), so the
-/// preview and the rollout plan must name them too (#1976): an npm package
-/// installed from a URL or git spec, or a workspace member, otherwise
-/// previews as vendorable and takes a `--max-new-patches` slot on every
-/// run. As in the download phase, a purl the lockfiles pin hosted is left
-/// to its takeover (which restores the upstream entry first, see
-/// [`hosted_pnpm_refusals`]), a purl the ledger already holds at this uuid
-/// is not asked, and only a package the vendor loop would hand to its
-/// backend is kept ([`crate::commands::vendor::lock_refusals_reaching_backend`]).
+/// cargo's locked-version gate. These are the refusals the wet run's
+/// download phase raises before it fetches a view, read through the same
+/// [`crate::commands::agent_download::unclaimed_lock_text_refusals`] (same
+/// hosted-pin, ledger and reaches-the-backend scope), so the preview and
+/// the rollout plan name them too (#1976): an npm package installed from a
+/// URL or git spec, or a workspace member, otherwise previews as vendorable
+/// and takes a `--max-new-patches` slot on every run. npm purls are not
+/// asked when `npm_lock_refused` (the project-level package-lock refusal
+/// already refuses every one of them).
 async fn lock_text_refusals(
     cwd: &Path,
     selected: &[PatchSearchResult],
     origins: &[String],
     state: &VendorState,
+    npm_lock_refused: bool,
 ) -> HashMap<String, (&'static str, String)> {
-    let gated =
-        |p: &&PatchSearchResult| p.purl.starts_with("pkg:npm/") || p.purl.starts_with("pkg:cargo/");
-    if !selected.iter().any(|p| gated(&p)) {
-        return HashMap::new();
-    }
-    let claimed =
-        crate::commands::agent_download::hosted_claimed_purls(cwd, origins.to_vec()).await;
-    let candidates: Vec<(&str, &str)> = selected
+    let gated: Vec<&PatchSearchResult> = selected
         .iter()
-        .filter(gated)
-        .filter(|p| !claimed.contains(&PurlKey::new(&p.purl)))
-        .filter(|p| lookup_entry(&state.entries, &p.purl).is_none_or(|e| e.uuid != p.uuid))
-        .map(|p| (p.purl.as_str(), p.uuid.as_str()))
+        .filter(|p| {
+            (p.purl.starts_with("pkg:npm/") && !npm_lock_refused)
+                || p.purl.starts_with("pkg:cargo/")
+        })
         .collect();
-    if candidates.is_empty() {
+    if gated.is_empty() {
         return HashMap::new();
     }
-    let refused = socket_patch_core::vendor::lock_text_refusals(cwd, &candidates).await;
+    let claimed =
+        crate::commands::agent_download::hosted_claimed_purls(cwd, origins.to_vec()).await;
     let options = socket_patch_core::crawlers::CrawlerOptions {
         cwd: cwd.to_path_buf(),
         global: false,
         global_prefix: None,
     };
-    crate::commands::vendor::lock_refusals_reaching_backend(
-        cwd,
-        refused,
-        &state.entries,
-        |purls| async move {
-            crate::commands::vendor::installed_purls(&options, &purls, None).await
-        },
+    crate::commands::agent_download::unclaimed_lock_text_refusals(
+        cwd, &gated, &claimed, state, options, None,
     )
     .await
 }
@@ -2305,6 +2296,37 @@ mod npm_lock_entry_refusal_tests {
         }
     }
 
+    /// The ledger's scope is the download phase's: only a detached entry
+    /// carrying its record settles a purl, so a same-uuid entry `vendor`
+    /// wrote (not detached) is still asked, and the preview agrees with the
+    /// wet run's refusal instead of saying `already_vendored`.
+    #[tokio::test]
+    async fn preview_asks_a_same_uuid_entry_the_wet_run_still_gates() {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path();
+        let code = project(root, "url");
+        write(
+            &root.join(".socket/vendor/state.json"),
+            &serde_json::json!({
+                "version": 1,
+                "entries": { LEFT_PAD: {
+                    "ecosystem": "npm", "basePurl": LEFT_PAD, "uuid": UUID,
+                    "artifact": { "path": format!(".socket/vendor/npm/{UUID}/left-pad-1.3.0.tgz") },
+                    "wiring": [],
+                }}
+            })
+            .to_string(),
+        );
+        let state = load_state(root).await.expect("the seeded ledger parses");
+        let entry = lookup_entry(&state.entries, LEFT_PAD).expect("seeded entry");
+        assert!(entry.uuid == UUID && !entry.detached);
+        let preview = preview_vendor(root, &[sel(LEFT_PAD)], &[], &HashMap::new()).await;
+        match &preview.rows[0].verdict {
+            PreviewVerdict::WouldRefuse { code: got, .. } => assert_eq!(got, code),
+            other => panic!("left-pad must preview would_refuse, got {other:?}"),
+        }
+    }
+
     /// The rollout planning pass: the refused left-pad holds no
     /// `--max-new-patches` slot, so the vendorable is-number gets it.
     #[tokio::test]