@@ -0,0 +1,22 @@
+[agent] 2026-10-29: architecture refactor (structural)
+
+`main` @ `c07af61`. The previous run was a sweep, so this run was structural. A01 [#1832](https://github.com/SocketDev/socket-patch/issues/1832) and A02 [#1833](https://github.com/SocketDev/socket-patch/issues/1833) both score 7. A02 is blocked: the open #1829 touches `workspace_globs.rs` and `npm_crawler.rs`. So I took A01. There was no maintainer steering.
+
+**PR:** [#1849](https://github.com/SocketDev/socket-patch/pull/1849), ready for review, with CI and Bugbot pending.
+
+### What changed
+- `cargo_build_cache::ConfigDirs::read` now takes its files from `source_replacement::config_layer_paths`, and I deleted its own walk and file pick. When both files exist, the cleaner now reads `.cargo/config` over `config.toml`, as cargo 1.93 does (checked with real cargo).
+- `/code-review high` found that `build_dirs_with` walked the ancestors of the cwd as given. With the default `--cwd .`, from a workspace member, it found **no** build dir. It now walks `std::path::absolute(cwd)`.
+- The file probe consults `group_commit::exists`, so it agrees with the capture-aware read.
+- **Tests: 2 added, each shown red→green.** My first version of the relative-cwd test could not fail, because a relative path with components still walks upward. I replaced it with a chdir under `#[serial]`.
+- **Net lines:** production about −7, tests +56.
+
+### Merges recorded
+None. #1842 is still open.
+
+### Lessons
+- See the Notes in the register: absolutize `--cwd` before any upward walk, and test that with `"."` after a chdir.
+- `vendor/cargo_config.rs` keeps a third `.cargo/config` pick. I left it for that file's sweep.
+
+### Next
+A sweep: `commands/bun_preflight.rs` onward.
@@ -3,7 +3,7 @@ _Last updated 2026-10-29T18:49Z · main @ c07af61 · owner: audit-core_
 
 | ID | P | Problem | Issues | Status |
 |---|---|---|---|---|
-| A01 | 1 | Cargo config chain is read twice. `cargo_build_cache::ConfigDirs::read` prefers `config.toml`, while `source_replacement::config_layer_paths` and cargo prefer `config`, so the build-cache cleaner invalidates the wrong target dir (executed). | #1832 | filed #1832 |
+| A01 | 1 | Cargo config chain is read twice. `cargo_build_cache::ConfigDirs::read` prefers `config.toml`, while `source_replacement::config_layer_paths` and cargo prefer `config`, so the build-cache cleaner invalidates the wrong target dir (executed). | #1832 | in PR #1849 |
 | A02 | 1 | `cargo_workspace::wildcard_match` has no `[...]` classes, so `members = ["crates/[ab]*"]` expands to nothing (executed). It is one of three segment glob matchers, with `workspace_globs::segment_glob_matches` (= `ExtglobMatcher::segment_uncached` minus the memo) and `hatch_workspace::fnmatch`. A fourth walk, `npm_crawler::expand_workspace_pattern_sync` (L940), has no brace expansion (bun workspaces; unexecuted). | #1833 | filed #1833 |
 | A03 | 2 | GOMODCACHE/GOPATH default is written twice (`go_crawler::get_gomodcache`, `go_installed_tools` L176-186), and the copies drifted on empty GOPATH entries and the home fallback. | #1834 | filed #1834 |
 | A04 | 2 | Callers re-derive `utils::line_endings`: `vendor/common.rs:198` copies `terminator`, and `python_lock::preserve_line_endings` and `lock_fragments` L434 hand-roll CRLF detection that ignores bare `\r`. There are three more `eol_eq` copies (`hosted/engine.rs:2900`, `vendor/jvm/scala_cli.rs:76`, `vendor/nuget_feed.rs:1004`). | #814, #815 | filed #814; new sites added to the tracker's scope |
 
@@ -1,25 +1,28 @@
 ### Refactor routine
-_Last updated 2026-10-29T17:15Z · main @ c07af61_
+_Last updated 2026-10-29T19:40Z · main @ c07af61_
 
 #### In flight
 | PR | Kind | Scope | State |
 |---|---|---|---|
-| [#1842](https://github.com/SocketDev/socket-patch/pull/1842) | sweep | `cli/src/args.rs` (+ the Deno guard moved into `lib.rs`) | ready; CI and Bugbot pending |
+| [#1842](https://github.com/SocketDev/socket-patch/pull/1842) | sweep | `cli/src/args.rs` (+ the Deno guard moved into `lib.rs`) | ready |
+| [#1849](https://github.com/SocketDev/socket-patch/pull/1849) | structural | A01 [#1832](https://github.com/SocketDev/socket-patch/issues/1832): `utils/cargo_build_cache.rs` | ready; CI and Bugbot pending |
 
 #### Merged
 _None._
 
 #### Queue
 Structural candidates, scored `3·B + 2·U + 2·D + 2·C − risk`:
-1. A01 [#1832](https://github.com/SocketDev/socket-patch/issues/1832), cargo config chain read twice (bug): B1 D1 C1, risk L. **7**
-2. A02 [#1833](https://github.com/SocketDev/socket-patch/issues/1833), three segment glob matchers (bug): B1 D1 C1, risk L. **7**
-3. T01, `get <uuid>` re-implements `download_and_apply_patches_into`: D2.2 C2, risk M. **~6.4** (blocked while #1698 touches `get.rs` / `agent_download.rs`)
-4. A03 [#1834](https://github.com/SocketDev/socket-patch/issues/1834), GOMODCACHE rule twice: D1 C1, risk L. **4**
-5. T03 [#1837](https://github.com/SocketDev/socket-patch/issues/1837), hand-written env var lists: D1 C1, risk L. **4**
+1. A02 [#1833](https://github.com/SocketDev/socket-patch/issues/1833), three segment glob matchers (bug): B1 D1 C1, risk L. **7** (blocked while #1829 touches `workspace_globs.rs` / `npm_crawler.rs`)
+2. T01 [#1835](https://github.com/SocketDev/socket-patch/issues/1835), `get <uuid>` re-implements `download_and_apply_patches_into`: D2.2 C2, risk M. **~6.4** (blocked while #1698 touches `get.rs` / `agent_download.rs`)
+3. A03 [#1834](https://github.com/SocketDev/socket-patch/issues/1834), GOMODCACHE rule twice: D1 C1, risk L. **4**
+4. T03 [#1837](https://github.com/SocketDev/socket-patch/issues/1837), hand-written env var lists: D1 C1, risk L. **4**
+5. A05 [#1844](https://github.com/SocketDev/socket-patch/issues/1844), `lock_fragments` pairing loops ×3: D1 C1, risk M. **~2**
 
-The next run is structural (the previous run was a sweep). Next sweep files, in order: `commands/bun_preflight.rs`, `commands/composer_hints.rs`, `commands/context.rs`, `commands/fetch_stage.rs`. Skip `agent_download.rs`, `apply.rs` and `get.rs` while #1698 is open.
+The next run is a sweep (this run was structural). Next sweep files, in order: `commands/bun_preflight.rs`, `commands/composer_hints.rs`, `commands/context.rs`, `commands/fetch_stage.rs`. Skip `agent_download.rs`, `apply.rs` and `get.rs` while #1698 is open.
 
 #### Notes
 - The PRs of the first thread (`arch-refactor/<issue>-*`) are listed in `review/2026-10-v1/register/90-refactor.md`.
 - The `args.rs` note "drop api_client_overrides empty filter" was wrong: core `build_proxy_fallback_client` uses `overrides.proxy_url` unfiltered, so the CLI filter is load-bearing. Check every "redundant filter" note against all consumers of the value.
 - Field doc comments on clap structs are `--help` output. Trimming them changes output bytes, so sweeps leave them alone.
+- `--cwd` defaults to `.`, and `Path::new(".").ancestors()` stops at `.`. Any core walk up from the cwd must absolutize it first (`cargo_crawler::resolve_for` and `nuget_config` do; `cargo_build_cache` didn't until #1849). A test that spells the cwd as a relative path *with* components can't catch this: chdir under `#[serial]` and pass `"."`.
+- `vendor/cargo_config.rs` (~L165-L190) keeps a third, async copy of the `.cargo/config` pick, with canonical dedup. It agrees on precedence; fold it into `config_layer_paths` when that file is swept.