@@ -540,16 +540,16 @@ crates/socket-patch-core/src/utils/toml_edit_ext.rs	42	audit-core	c07af61 2026-1
 crates/socket-patch-core/src/utils/uri.rs	49	audit-core	c07af61 2026-10-29	-	clean; yarn_berry_lock.rs helper_grammar L4903-4911 re-asserts this file's test byte for byte: drop there
 crates/socket-patch-core/src/utils/uv_workspace.rs	214	audit-core	c07af61 2026-10-29	-	cut module-doc history L5-16 (#1138 story); both callers (governing_root.rs:101, vendor/pypi.rs:283) call governing_uv_workspace then member_detail: fold into one fn returning the refusal detail; sync is_file inside async callers
 crates/socket-patch-core/src/utils/workspace_globs.rs	1445	audit-core	c07af61 2026-10-29	-	delete segment_glob_matches (= ExtglobMatcher::segment_uncached without memo), route npm_crawler.rs:975 through ExtglobMatcher::default() (A02); move cfg(test) workspaces_include into test mod; inline expand_braces; add WorkspacesDialect::PNPM (A17); hoist rel/pats closures copied in 7 tests; ~15 #nnnn/Bugbot refs
-crates/socket-patch-core/src/api/blob_fetcher.rs	1191	audit-core	-	-	
-crates/socket-patch-core/src/api/client.rs	6356	audit-core	-	-	
-crates/socket-patch-core/src/api/date.rs	528	audit-core	-	-	
-crates/socket-patch-core/src/api/mod.rs	7	audit-core	-	-	
-crates/socket-patch-core/src/api/ranking.rs	986	audit-core	-	-	
-crates/socket-patch-core/src/api/retry.rs	561	audit-core	-	-	
-crates/socket-patch-core/src/api/types.rs	663	audit-core	-	-	
-crates/socket-patch-core/src/api/vendor_prefetch.rs	1705	audit-core	-	-	
-crates/socket-patch-core/src/crawlers/cargo_crawler.rs	1593	audit-core	-	-	
-crates/socket-patch-core/src/crawlers/cargo_crawler/oracle.rs	79	audit-core	-	-	
+crates/socket-patch-core/src/api/blob_fetcher.rs	1191	audit-core	5ca5623 2026-10-30	-	drop dead on_progress param + OnProgress (all prod callers pass None); inline format_fetch_result_for (no ext caller); BlobFetchResult.success = error.is_none(); counters derivable from results; concise_fetch_error re-parses the client's own error text; store_verified_blob vs stream_cache_entry_atomic drifted (dir cleanup, mismatch text); presence probes use metadata (cf T22); ~5 dup format tests
+crates/socket-patch-core/src/api/client.rs	6356	audit-core	5ca5623 2026-10-30	-	delete dead get_api_client_from_env + its env-mutating test; drop history comment + alias get_severity_order L10-13; org_slug/uses_public_proxy dup route(); fetch_binary kind has one value: fold binary_url/fetch_binary into fetch_blob; one route->path helper (patches_path/binary_url/vendor_package_url); OrganizationInfo unused required fields; 9 misplaced tests (is_hex x5, severity, uuid); A27
+crates/socket-patch-core/src/api/date.rs	528	audit-core	5ca5623 2026-10-30	-	fake assert in parsed_order_is_chronological_in_both_formats: `secs > prev_2822` checks its own loop counter (keep the assert_eqs); module moves with vex::time and formats/cargo/floor's days_from_civil into one utils::time (A26); ~4 comment lines
+crates/socket-patch-core/src/api/mod.rs	7	audit-core	5ca5623 2026-10-30	-	clean
+crates/socket-patch-core/src/api/ranking.rs	986	audit-core	5ca5623 2026-10-30	-	delete identity fn merged_coverage + tautology test merged_coverage_is_the_advisory_count (inline into rank_key); delete same_patch_dates_across_different_packages_do_not_interact (RankKey has no purl: can't fail); ~4 dup rung tests (severity_outranks_recency, recency_breaks_severity_ties, ...); `max_severity_order(p.vulnerabilities..)` repeated in policy/mod.rs L437, rollout/stage.rs L228
+crates/socket-patch-core/src/api/retry.rs	561	audit-core	5ca5623 2026-10-30	-	API_CONNECT_TIMEOUT/API_READ_TIMEOUT are pub only for a const==literal tautology (tests/api_timeout_e2e.rs L326-329); is_retryable_status/is_retryable_transport/parse_retry_after -> pub(crate); module doc L9-28 restates ApiRetryPolicy field docs (~15 lines); second policy lives in client.rs (A27)
+crates/socket-patch-core/src/api/types.rs	663	audit-core	5ca5623 2026-10-30	-	~10 of 20 serde tests redundant: serialize-side .contains checks (4x camel_case, no_rename, field_names) and 3 roundtrips duplicate the payload-deserialize tests; published_at_is_per_patch_not_per_package asserts its own fixture literals; OrganizationInfo id/name/image/plan unread (plan required: a payload without it fails org resolution); types import patch::redirect (A28)
+crates/socket-patch-core/src/api/vendor_prefetch.rs	1705	audit-core	5ca5623 2026-10-30	-	move to vendor/ (imports vendor::prestage/registry_fetch/lock_inventory; A28); ride_along re-implements fetch_verified_archive's sha512+h1 gate (vendor/service_fetch.rs L154-167): share one verify fn; `cache.lock().ok()?` swallows poison; trim ~30 module-doc lines (depscan anecdote, narration); tests clean (serial-differential)
+crates/socket-patch-core/src/crawlers/cargo_crawler.rs	1593	audit-core	5ca5623 2026-10-30	-	unit struct CargoCrawler + new()/unused Default -> free fns; verify_crate_at_path (async) dups read_crate_cargo_toml (sync); CrawledPackage literal x3; drop cargo_home forwarder; find_by_purls never errs (drop Result); fold_parent_dirs is A19; 7 package_name_version tests dup formats/cargo/manifest.rs; banners/restating comments ~20 lines; A29
+crates/socket-patch-core/src/crawlers/cargo_crawler/oracle.rs	79	audit-core	5ca5623 2026-10-30	-	pre-migration copy kept as equivalence oracle; reads via tokio::fs::read_to_string (follows FIFOs/links) unlike prod, so not verbatim; delete with its 2 randomized tests once A29 decides oracles
 crates/socket-patch-core/src/crawlers/composer_crawler.rs	2573	audit-core	-	-	
 crates/socket-patch-core/src/crawlers/composer_crawler/oracle.rs	137	audit-core	-	-	
 crates/socket-patch-core/src/crawlers/coursier_cache.rs	712	audit-core	-	-	
 
@@ -47,6 +47,7 @@ _Filled in as the audit progresses. Each bullet carries its register token._
   - The cargo build-cache cleaner and cargo disagree on which `.cargo/config` file wins {{A01}}.
   - The cargo workspace glob has no character classes {{A02}}.
   - Both bugs were shown by running the code.
+  - The API client retries under two policies that disagree: a `Retry-After: 60` ends a JSON call but is retried after 4 s by the vendor path {{A27}}.
 - **`utils/` is a mix of ecosystem-specific code and true utilities.** Some of it imports `vendor::*` {{A08}}.
 - **Shared helpers exist but are bypassed or dead.** A purl split is written ~12× {{A14}}, uuid shape 4× {{A15}}, and the shared poetry-writer and credential-strip helpers have no caller while copies serve production {{A18,A20}}.
 - **CLI commands carry second copies of shared engines.** `get <uuid>` re-implements the agent download engine {{T01}}, five callers glue the Bun and vlt preflights by hand {{T05}}, and remove and rollback render vendored reverts in two drifted loops {{T16}}. The copies have drifted in user-visible text and JSON {{T02,T04}}.
 
@@ -1,6 +1,6 @@
 ## Part 2
 
-_Last checked against main @ c8e26f6 on 2026-10-29 by audit-cli-tests._
+_Last checked against main @ 5ca5623 on 2026-10-30 by audit-core._
 
  Common mechanisms:For each cross-cutting concern: the **canonical mechanism** (the one way the code should do it, with a permalink to its home), the **deviations** found (file, what it does instead, its register token), and a count. Concerns: error types and context; error codes and exit codes; swallowed errors and panics in non-test code; stdout/stderr and the `ui` layer; the JSON envelope; human text, color and progress; logging; env and config reading; paths and containment; file I/O (atomic writes, BOM/CRLF); HTTP clients, timeouts and retries; process spawning and deadlines; concurrency.
 
@@ -22,3 +22,5 @@ _Last checked against main @ c8e26f6 on 2026-10-29 by audit-cli-tests._
 - **Terminal-safe text** (proposed canonical: core `policy::strip_unsafe`, keeping `\n`/`\t`). `list::sanitize` and `StatusPrinter::println` keep bidi and zero-width characters. {{T23}}
 - **Shell-quoted remedies** (canonical: `ui::shell_word`). `scan/discovery.rs` keeps a POSIX-only copy. {{T18}}
 - **Telemetry auth**: repair copies core's token chain (`api_token_available`) to avoid building a client, while remove builds one eagerly (an org lookup and a proxy notice before any local work). Local notes; related to C10/#793.
+- **HTTP retries** (proposed canonical: one retry helper in `api/retry.rs` driven by one policy). `api/client.rs` runs two policies that disagree on statuses, counts, jitter and an over-cap `Retry-After` (executed: JSON gives up, vendor retries after 4 s), through four hand-written loops; blob GETs and the upstream registry client (#1650) retry nothing. {{A27}}
+- **Debug output** (canonical: `api::client::debug_log` → `[socket-patch debug]` on stderr, deferrable per task). `vendor/pypi.rs` reuses its deferral; other modules print through `env_compat::debug_message` directly. Not yet surveyed beyond `api/`.
@@ -1,6 +1,6 @@
 ## Part 3
 
-_Last checked against main @ c8e26f6 on 2026-10-29 by audit-cli-tests._
+_Last checked against main @ 5ca5623 on 2026-10-30 by audit-core._
 
  Duplicated business logic:One bullet per rule that has more than one implementation: the copies (permalinks), whether they have drifted, the register token, and the target home. Rules carried over from the first thread stay in the carried registers until reconciled.
 
@@ -35,3 +35,7 @@ _Last checked against main @ c8e26f6 on 2026-10-29 by audit-cli-tests._
 - **uuid-only `PatchRecord`:** core `ledgers::uuid_only_record` beside 3 literals (list.rs L81, commands/mod.rs L388, core vendor/mod.rs L943). Local notes.
 - **`--global`/`--global-prefix` flag text:** `commands::global_scope_flag` vs `ui::global_scope_arg`, drifted when both are set. Local note on `commands/mod.rs`.
 - **purl shape rule:** CLI `scan/discovery::crawled_from_purl` and core `hosted::memory::discover::supplement_purl` (identical today; the core test asserts literals, not the CLI function). Part of {{A14}}.
+- **Civil-date math:** `days_from_civil` in `api/date.rs` and `formats/cargo/floor.rs`, the inverse in `vex/time.rs` (which claims to be the only copy). Same values today. {{A26}}
+- **Serve-URL GET and retry loops:** `download_vendor_archive_once` vs `download_artifact_capped_once` (drifted cap-breach variant and status text); 4 retry loops under 2 policies. {{A27}}
+- **Service-archive integrity gate:** `vendor_prefetch::ride_along` re-implements `service_fetch::fetch_verified_archive`'s sha512 + `h1:` checks. Local note.
+- **Worst-severity label picker:** a fourth copy in core `client.rs::convert_search_result_to_batch_info` (handed to audit-cli-tests for {{T10}}).
@@ -1,6 +1,6 @@
 ## Part 4
 
-_Last checked against main @ c8e26f6 on 2026-10-29 by audit-cli-tests._
+_Last checked against main @ 5ca5623 on 2026-10-30 by audit-core._
 
  Structure, abstraction and placement:Needless layers (one-impl traits, forwarding modules, invariant-free newtypes), tiny-function clusters, unclear control flow (mode flags, giant functions, accumulate-then-decide), and misplaced code (with its destination). Per-directory tallies of single-caller functions, wrappers and deletable comment lines go here as the audit covers each directory.
 
@@ -37,3 +37,9 @@ _Last checked against main @ c8e26f6 on 2026-10-29 by audit-cli-tests._
 - **Giant functions (cont.):** `rollback::run` (~1,210 lines), `rollback::rollback_patches_inner` (~830), `remove::run` (~920). C11/#843 covers `run_scan` only.
 - **`rollback.rs` is `remove`'s helper library:** remove imports 12 items from it (text helpers such as `join_clauses`/`as_question` belong in `ui`; hosted ones such as `retire_legacy_redirect_ledger` in `hosted_unwind`). Local notes.
 - **`scan/discovery.rs` is a grab-bag:** discovery, update detection, severity helpers and hosted/vendored nested-project policy (`nested_project_skips`, which belongs in `scan/hosted.rs`). Local note; C11.
+- **`api/` is not a leaf layer:** `vendor_prefetch` belongs in `vendor/`, the pypi wheel gate sits in `client.rs`, and `api::types` imports `patch::redirect`. {{A28}}
+- **Tally for `api/` (8 files, 12.0K lines) and `crawlers/cargo_crawler*` (1.7K):**
+  - about 20 single-caller functions worth inlining (`fetch_binary`/`binary_url`, `format_fetch_result_for`, the `download_vendor_archive*` chain, `verify_crate_at_path`);
+  - about 12 trivial wrappers (identity `ranking::merged_coverage`, `org_slug`/`uses_public_proxy` over `route()`, `CargoCrawler::cargo_home`);
+  - dead code: `get_api_client_from_env` (no caller), `blob_fetcher`'s `on_progress` parameter (every caller passes `None`), `CargoCrawler`'s `Default`;
+  - about 140 deletable comment lines (mostly `vendor_prefetch`'s 110-line module doc and `client.rs` history notes).
@@ -1,6 +1,6 @@
 ## Part 5
 
-_Last checked against main @ c8e26f6 on 2026-10-29 by audit-cli-tests._
+_Last checked against main @ 5ca5623 on 2026-10-30 by audit-core._
 
  Tests:Fake tests (asserting on their own mocks, recomputing expected values with the code under test, unable to fail, claiming more than they check), mock overuse where a tempdir or a real install is cheap, sentence-matching assertions, duplicate tests, and real coverage gaps. Per-directory tallies and the fixes that landed.
 
@@ -44,3 +44,10 @@ _Last checked against main @ c8e26f6 on 2026-10-29 by audit-cli-tests._
   - Duplicates of core tests: discovery's 5 `severity_order` tests (core `ranking.rs`), 4 `candidate_supersedes` and 1 `unsupported_layout_warnings` test of core functions; ~5 remove `remove_matching` tests repeat core `Target` tests.
   - Subset or overclaiming tests: lock_cli ×4, repair ×3, mod.rs ×3 (only `is_err()` or a `.contains` that a sibling message also satisfies).
 - **Coverage gaps:** no test of `remove --preserve-state --dry-run` over a vendored entry {{T16}}; no test that `scan --json` keeps stderr empty on a held lock {{T09}}; no bidi/zero-width test for `list` {{T23}}.
+- **Tally for `api/` and `cargo_crawler*`: about 40 fake, duplicate or misplaced tests.**
+  - Tautologies: `ranking` `merged_coverage_is_the_advisory_count` (identity fn) and `same_patch_dates_across_different_packages_do_not_interact` (the key has no purl); `date` `parsed_order_is_chronological_in_both_formats`'s monotonic assert (its own loop counter); `types` `published_at_is_per_patch_not_per_package` (its own fixture); `tests/api_timeout_e2e.rs` const == literal.
+  - Duplicates: `types` ×10 serde serialize/roundtrip tests; `ranking` ×4 rung tests; `blob_fetcher` ×5 format tests.
+  - Misplaced: `client.rs` tests `is_hex` ×5, `severity_order` ×2, `is_uuid_shaped` ×2; `cargo_crawler` tests `package_name_version` ×7 (covered in `formats/cargo/manifest.rs`).
+  - Env mutation without a guard: `client` `test_get_api_client_from_env_no_token` (and it reads the user's socket-cli config).
+  - Test scaffolding: four xorshift64* RNGs and eight legacy crawler oracles. {{A29}}
+- **Strong:** `vendor_prefetch`'s serial-differential tests and `client`'s wiremock retry tests assert request counts and outcomes, not mocks.
@@ -0,0 +1,14 @@
+[agent] 2026-10-30: handover from audit-core to audit-cli-tests
+
+Found while auditing `crates/socket-patch-core/src/api/` at `5ca5623`.
+
+- **T10, a fourth worst-severity picker.** It is in core: [`api/client.rs` `convert_search_result_to_batch_info` L2591-L2658](https://github.com/SocketDev/socket-patch/blob/5ca5623863eee274851df4a941a86ba36f284dc3/crates/socket-patch-core/src/api/client.rs#L2591-L2658).
+  - It keeps the worst *label* by hand through an alias of `ranking::severity_order` (`get_severity_order`).
+  - Ties go to the first label in GHSA-id order, and an unknown label is never chosen over `None`.
+  - Fold it into whatever helper T10 settles on.
+  - The stale "get.rs `severity_rank`" citation at client.rs L3175-L3179 is in a test that my notes already mark for deletion (it duplicates `ranking.rs`).
+- **`tests/api_timeout_e2e.rs` L326-L329** asserts `API_CONNECT_TIMEOUT == 10 s` and `API_READ_TIMEOUT == 60 s`, each a constant compared with its own literal. The constants are `pub` only for this test.
+- **The `discovery.rs` `severity_order` wrapper** (L576) wraps `ranking::severity_order(Some(s))`. Its 5 tests duplicate `ranking.rs`'s, which is already in your Part 5 tally.
+
+---
+_Generated by [Claude Code](https://claude.ai/code)_