pip: run 36 ledger

Author: claude

entries/pip/20261009T142740Z.md

@@ -0,0 +1,42 @@
+[agent] 2026-10-09: pip / requirements.txt bug-hunt run
+
+**Tested:** main `40de3d5`; latest release v4.0.0 (the PyPI wheel, used as the baseline). The pip-relevant change since `e03a666` is #1254 (the #1249 fix). #1245 (the shared vendored revert step) doesn't touch the PyPI backends.
+
+**Setup:** real pip 26.2.1 / py3.13 and 20.3.4 / py3.8 (uv venvs). A logging batch mock on 127.0.0.1 (records the purls requested, answers empty), `SOCKET_PROXY_URL` pointed at it, and an empty `VIRTUAL_ENV`, so discovery was lock-only. pip's own `parse_requirements` and a real `pip install --no-deps -r` were the reference. No probe branches: every cell was OS-independent parsing. The mock was stopped after the run.
+
+## Re-triage
+
+- #1249 (closed by #1254): **verified fixed.** An EOF `six==1.16.0 \` with no newline, a CRLF variant, and a `-r` include ending that way are all discovered. Evidence is on #1249.
+- #604: **still fails** (`six==1.16` → `pkg:pypi/six@1.16`). No new information, so no comment.
+
+## Cells (Linux, lock-only)
+
+| Cell | Result |
+| --- | --- |
+| EOF `six==1.16.0 \` (no newline / CRLF / `-r` include) | pass (#1249 fixed) |
+| `-r dev.txt \` as the last line (include continuation at EOF) | pass |
+| `-e .` / `--editable ./pkg` beside a pin, and a marker continuation | pass |
+| **CR-only file `idna==3.4\rsix==1.16.0\r`** | **fail → #1281** (pip 20.3.4 / 26.2.1 install both; main asks for nothing; v4.0.0 asks for idna only) |
+| **CRLF file with one stray bare CR** | **fail → #1281** (main finds only the first pin) |
+| **form-feed / NEL / U+2028 separators** | **fail → #1281** |
+| `six==1.16.0 \\` (two backslashes) at EOF | divergence: pip strips both, main drops the pin, v4.0.0 finds it. Noted in #1281, not filed separately |
+
+## Issues
+
+- Filed #1281: https://github.com/SocketDev/socket-patch/issues/1281. `utils/requirements.rs:223` uses `content.lines()`, while pip uses `str.splitlines()`.
+- Commented on #1249 (fix verified): https://github.com/SocketDev/socket-patch/issues/1249#issuecomment-6082904302
+
+## False positives ruled out
+
+- None this run. Every fail cell was checked against pip's own parser and a real install on both pip versions, and reproduced twice on main.
+
+## Next
+
+1. Hosted rewriter over a CR-only root with an installed six and a full hosted mock (it has its own `split_inclusive('\n')` splitter), and the vendored planner over it.
+2. Re-verify #1281 once fixed.
+3. Re-verify #1167 (fixed by #1168) with real pip: subdirectory `requirements/lock.txt`, the uv export variant, a root `NOTES.txt` false keep.
+4. #1212 follow-ups: hosted / vex / rollback over an unmodelled-codec file.
+5. #1039 atomic takeover: SIGKILL a vendored → hosted takeover mid-commit.
+
+---
+_Generated by [Claude Code](https://claude.ai/code)_