[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Summary

This sweeps the next audited, unswept rows of coverage/files.tsv that no open PR touches: core constants.rs and utils/{cargo_home,composer_version,concurrent,containment,digest,durability,env_compat,failpoint}.rs. It applies the audit-core notes for each row, plus the other local cleanups found on a re-read. See the living document's structure part (discussion #1830).

No structural candidate was free this run: every one scoring 6 or more has its files in an open PR (#1886, #1864, #1698, #1891, #1829, #1863). That is why this run is a sweep.

Changes

• constants.rs
  • Deleted the tautological user_agent_reports_real_crate_version (it rebuilt the concat! it checked) and manifest_path_is_under_dot_socket (literal == literal).
  • The URL test keeps its https, no-trailing-slash and distinct-hosts asserts. The exact URLs are pinned by the CLI's e2e and API-client tests.
  • The test module moved to the end of the file, and the history comment on USER_AGENT is gone.
• cargo_home.rs: cut the module doc's story and the bare #1135 refs (−7 lines).
• composer_version.rs
  • composer_versions_equivalent now compares composer_version_key, the key PurlKey already uses. composer_version_identity_key, the \u{1}-sentinel key, had no other caller and is deleted.
  • The two pairwise tests are merged into key_equality_is_equivalence_over_every_vector_pair. It checks equivalence against an independently written spec (accepted pairs normalize alike, rejected pairs have equal v-stripped text, mixed pairs never match), and also checks the invariant that makes one key sound.
  • In purl_key.rs, the now-vacuous "no \u{1} in the key" assert and a stale doc phrase are removed.
• concurrent.rs
  • MAX_API_CONCURRENCY equalled API_CONCURRENCY, so one constant is kept.
  • API_CONCURRENCY, API_CONCURRENCY_FLOOR, REQUESTS_PER_SLOT and REGISTRY_CONCURRENCY are private, and PROXY_API_CONCURRENCY is pub(crate) (the API client reads it).
  • adaptive_concurrency's floor and ceiling parameters only ever took one value, so it is inlined. api_concurrency_for_under now reads the env override once, and a const assert keeps the floor at or below the ceiling, because clamp panics otherwise.
  • The per-window test asserts literal caps instead of recomputing them with the code under test. The adaptive_concurrency unit test went with the function.
• containment.rs
  • linked_level_refusal is private.
  • nearest_socket_dir moved to socket_dir.rs, its only user, and socket_project_root (one caller) is inlined there. The test moved with it as nearest_socket_dir_is_the_innermost_dot_socket_ancestor, which adds the nested-.socket case.
  • Trimmed the stale is_link doc.
• digest.rs: dropped the banner and the stale #706 pending note.
• durability.rs
  • Both barriers share sync_or_restore, so the take/sync/restore sequence is written once.
  • sync_all_blocking is private.
  • Pending::moved loses a dead if let.
  • About 6 comment lines of history phrasing ("as it always did", "now") are gone.
  • sync_skips_vanished_files_and_syncs_the_rest only asserted Ok, so it is renamed sync_skips_vanished_files.
• env_compat.rs: SOCKET_DEBUG and SOCKET_OFFLINE share one private env_flag, and the offline doc is trimmed.
• failpoint.rs: hit matches the point once, then pauses or exits.

Red→green evidence

Each mutation below makes its test fail; the test passes on this branch.

• REQUESTS_PER_SLOT = 3 → per_window_cap_adapts_only_where_nothing_else_decides fails. Before this PR the test recomputed the expected cap with the same constant, so it passed.
• composer_versions_equivalent comparing raw composer_version_normalize → key_equality_is_equivalence_over_every_vector_pair fails, along with 2 others.
• nearest_socket_dir picking the outermost .socket → nearest_socket_dir_is_the_innermost_dot_socket_ancestor fails.

Size

git diff --stat: 11 files, +163 / −291. That is about −52 production and −76 test lines, with the moved test module in constants.rs counted as neither.

Behavior change

None in the CLI's output, JSON or exit codes.

• composer_versions_equivalent now uses the sentinel-free key. It agrees with the old sentinel key wherever every accepted key is itself accepted, bare and behind a v. The test pins that invariant over the whole shared vector file, and /code-review probed about 90 more edge spellings without finding a counterexample. PurlKey already relied on it.
• Public API of socket-patch-core: these items were pub with no caller outside the crate and are now private or removed, for the release agent:
  • concurrent::{API_CONCURRENCY, API_CONCURRENCY_FLOOR, REQUESTS_PER_SLOT, REGISTRY_CONCURRENCY, PROXY_API_CONCURRENCY};
  • composer_version::composer_version_identity_key;
  • containment::{linked_level_refusal, nearest_socket_dir, socket_project_root}.

Not done (left for their own PRs)

• The CargoCrawler::cargo_home forwarder: cargo_crawler.rs is in Build: share one test RNG across randomized tests (#1868) #1882.
• digest's vendor/jvm copies: in Fix Maven 4 implicit subprojects missed outside vendored (#1809) #1886.
• The async fs::is_symlink wrapper: fs.rs is in Build: share one test env guard in core (#1889) #1891.
• Moving debug_log to utils/debug.rs: a cross-file move.
• DEFAULT_PATCH_MANIFEST_PATH from SOCKET_DIR: concat! takes only literals.
• failpoint's @n parse fallback: changing it is a behavior change.

Verification

• cargo clippy --workspace --all-features -- -D warnings is clean.
• cargo test -p socket-patch-core --lib: 6991 pass, 4 fail. All 4 fail the same way on main under the root sandbox:
  • copy_tree::relax_loop_must_not_traverse_symlinked_root
  • vlt_heal::an_unremovable_hidden_lock_keeps_every_store_entry
  • pypi_poetry::wire_write_failure_maps_error_and_leaves_lock_untouched
  • pypi_requirements::wire_failure_rolls_back_already_written_files
• CLI suites vendor_crash_safety_e2e, vendor_group_commit_e2e, e2e_safety_lock and vendor_eject all pass. They exercise the failpoints and durability barrier.
• CI: all 82 checks pass on 14f61b9. Bugbot found no issues.
• /code-review high ran. Fixed: the clamp guard, the barrier check-then-take race, and private intra-doc links. Kept with reasons: the public-API narrowing, composer's single key, and the dropped literal URL pins (both stated above).

Risk

Low. The changes are local to core utils, and the durability barrier semantics are unchanged (take, sync, restore on failure).

https://claude.ai/code/session_011f9aeNfHxWVP55pKiwaNk4

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 14f61b9. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Burn-down agent: labeled Ready for review at head 14f61b9.

• CI: 32/32 executed checks green (50 skipped by path filters), mergeable, no conflicts.
• Bugbot: reviewed 14f61b9, no findings; no open review threads.
• Reviewer focus: the trimmed concurrency cap constant in utils/concurrent.rs and the clamp/barrier changes from the last review round.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Final review brief

What it does: A local cleanup sweep of core constants.rs and eight utils/ modules. It makes unused-outside-crate items private, merges duplicate constants and helpers (MAX_API_CONCURRENCY, adaptive_concurrency, the barrier sync/restore, env_flag), drops tautological tests and history comments, and drops the sentinel composer identity key in favour of the key PurlKey already uses.

Risk: low. Every code change is behavior-preserving on inspection. The only semantic touchpoint is composer_versions_equivalent, which is now pinned against an independent spec over the whole shared vector file. Several pub items of socket-patch-core are removed or made private (listed in the description, none had external callers).

Look here

• composer_version.rs:254 and :323: equivalence now uses composer_version_key, and the test checks it against the spec
• concurrent.rs:132: override, then adaptive clamp. The const assert at :37 guards clamp's panic
• durability.rs:188: sync_or_restore, shared by both barriers
• socket_dir.rs:109: nearest_socket_dir moved here from containment.rs, and socket_project_root inlined at :139

Verified

• Read the full diff and checked each refactor for equivalence:
  • api_concurrency_for_under: the old path through api_concurrency_under(false,false) returned the override as-is, which matches the new path.
  • Pending::moved: starts_with matches exactly when strip_prefix succeeds.
  • failpoint::hit: the control flow is the same.
  • barrier: same restore-on-error, and same JoinError handling.
• Ran the concurrent, composer_version, socket_dir, durability, failpoint, env_compat, purl_key and constants lib tests locally: 73 passed, 0 failed.
• CI: 32/32 executed checks green (50 skipped by path filters). Bugbot: success. CHANGELOG.md untouched. No unresolved threads.

Changes I made: none.

Open questions: none. The public-API removals are listed in the description for the release agent.

Auto-merge is armed, so approving sends it straight to the merge queue.

---

Generated by Claude Code