[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Fixes #513

Summary

vendor no longer reports a Maven patch as applied when the reactor plan
wires nothing. It refuses with vendor_jvm_shape_unsupported /
reason: nothing_wired, lists the reasons that left the reactor unwired
(e.g. property_unresolved, conflicting_literal_version), and writes
nothing.

Root cause

#1787 stopped the vendored Maven reactor planner from pinning a root over a
${prop} version it can't resolve with certainty, and made vex withhold
attestation. But when that leaves nothing wired, no pom of the reactor
names the suffixed version. That happens in #513 case 1 with no sibling
module at the literal base, and on the conflicting_literal_version path.
vendor still wrote the tree, the repository and maven.config, exited 0
and counted the patch as applied. vendor --check then said "no longer
wired". This was the part #1787 left open (see its Refs #513).

Change

• maven_reactor::refuse_unwired: overlays the plan's writes on the
  checkout and refuses when wired_checked would be false. The refusal
  names only the degraded reasons that leave a declaration or root alone.
• maven_repo::vendor_maven_jvm calls it for reactor and mixed roots,
  both on the real run and on the probe run (a patch with no files), so a
  preview and a real run agree. Dry runs plan first, so they refuse too.
• Mixed roots refuse the same way. That matches "both halves or neither"
  in jvm::plan_with_external and vendor --check, which already needs
  the Maven half wired on a mixed root.
• Behavior note: a re-run whose re-plan would drop every pin (for example,
  external management unreadable offline) now refuses and leaves the
  existing pin alone. Before, it removed the pin and still reported success.

Tests

Issue	Test	Without fix	With fix
#513 (undefined ${prop}, no sibling)	vendor_jvm_cli::maven_reactor_uncertain_property_version_withholds_vex	fails: vendor exits 0 (assert_refused)	pass
#513 (conflicting_literal_version, no sibling)	same test, second case	fails	pass
helper	maven_reactor::tests::a_plan_that_wires_nothing_is_refused, a_wired_plan_is_not_refused	n/a (new fn)	pass

Commands run locally:

• cargo fmt --all -- --check, cargo clippy --workspace --all-features -- -D warnings: clean
• cargo test -p socket-patch-core --all-features: 6925 pass. 4 fail, all in files this PR doesn't touch (copy_tree, vlt_heal, pypi_poetry, pypi_requirements). They are permission-injection tests, and the container runs as root, which ignores the chmod they rely on.
• cargo test -p socket-patch-cli --all-features --lib --bins: pass. --test vendor_jvm_cli: 52/52.
• --test e2e_vendor_jvm_build -- --ignored maven_reactor (Maven 3.9.x): 2/2. --test e2e_vendor_maven_build -- --ignored: pass.
• A full cargo test --workspace ran out of container disk while linking every integration binary, so CI covers the remaining suites.
• /code-review high ran. Fixed: the reasons list leaked unrelated warnings, the probe path was uncovered, and the vex assertion was weak. Not changed, by design: refusing on mixed roots (see above), and the extra reactor discover per vendor run (one parse of the checkout's poms, cheap next to the download).

No npm/pypi/gem wrapper changes needed (Rust-only behavior).

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 2e242f3. Configure here.}