Delete the vendored and hosted-vlt helpers left without a production caller by the v5 consolidation #782

[agent] Filed by the scheduled architecture audit routine (ecosystems and formats). Register: discussion #560 register.

Kind: refactor. Source: new finding, register E58. The vlt part is the review's "delete the dead vlt ledger helpers" (Part 3.6 and Part 3 recommendation 7, register E34).

Problem

A sweep of every pub/pub(crate) item in formats/, patch/redirect/, hosted/, vendor/, crawlers/ and vex/ for references outside #[cfg(test)] code, across the whole workspace including socket-patch-node, found these on 045d7ec. Most lost their last caller when #277 (the v5 consolidation) deleted the redirect-ledger merge and the deferred-download path.

No reference anywhere, not even a test:

• VendorEntry::committed_artifact_intact (20 lines). Its only caller was the CLI's ledger_covers, deleted by v5 prerelease: scan → vex → vendor workflow, hosted by default #277.
• go_sum_edit::remove_lines (16 lines). Delete go_sum_edit's oracle-only free functions and move the go.sum codec to formats #631 lists it among the functions to move to formats/golang/sum.rs; it should be deleted instead.
• redirect::vlt::edit_dep_id and lock_node_ids.`` Their only caller was scan/hosted.rs's `rebase_vlt_edits`, which v5 prerelease: scan → vex → vendor workflow, hosted by default #277 deleted along with the ledger merge (v5 never writes the redirect ledger; `save_redirect_state` has no production caller either).

Used only by their own unit tests:

• redirect::vlt::carried_pin_original and its test a_superseding_edit_keeps_the_pristine_slots_of_a_carried_pin. Same history as above.
• redirect::vlt_heal::ledger_targets and its four tests. Its callers in rollback.rs and vendor.rs were replaced by lock_targets in v5 prerelease: scan → vex → vendor workflow, hosted by default #277. Once it goes, vlt::carried_pin_ids / carried_pin_lines (only ledger_targets calls them) and same_slots become dead as well.

Test helpers compiled into production builds (their only callers are inside #[cfg(test)] modules):

• UpstreamClient::seed_rubygems_sha256`` (caller: upstream/gem.rs tests);
• cargo_tag::copy_manifest_tag (caller: vendor/cargo.rs tests);
• jvm::apply::read_project_file (caller: a jvm/gradle.rs test).

Symptoms and impact

No user-visible bug. The cost is ~150–180 production lines that look live, are pub, and are kept compiling and tested. carried_pin_original and ledger_targets in particular read as if hosted vlt still merges and heals from the redirect ledger, which misleads anyone working on hosted rollback (E33/E45).

Proposed change

1. Delete committed_artifact_intact, go_sum_edit::remove_lines, vlt::edit_dep_id, vlt::lock_node_ids, vlt::carried_pin_original, vlt_heal::ledger_targets, and the helpers that become unused (carried_pin_ids, carried_pin_lines, same_slots, and claims_key if nothing else is left calling it), together with their tests.
2. Gate seed_rubygems_sha256, copy_manifest_tag and read_project_file with #[cfg(test)], or move them into the test modules that use them.
3. Correct the doc comments that still describe the deleted paths (vlt_heal module doc, LedgerTarget::record).

Size and scope

About −170 production and −150 test lines in vendor/state.rs, vendor/go_sum_edit.rs, patch/redirect/vlt.rs, patch/redirect/vlt_heal.rs, patch/redirect/upstream/client.rs, vendor/cargo_tag.rs and vendor/jvm/apply.rs. It's mechanical, with no behavior change. Out of scope:

• the legacy redirect-ledger readers (redirect_record_live, hosted_wiring_in_files; E41);
• save_redirect_state and the ledger's group-commit entry (audit-core's legacy-ledger rows);
• the #[cfg(test)] oracles in registry_fetch.rs and reuse.rs (E35).

Acceptance criteria

• None of the deleted names appear under crates/.
• cargo build -p socket-patch-cli --release has no new dead_code warnings. cargo test -p socket-patch-core, the vlt suites (e2e_redirect_vlt_build, e2e_vlt, mode_migration_vlt, in_process_rollback_hosted) and cargo clippy --all-targets stay green.
• The vlt_heal tests that exercised ledger_targets are deleted or retargeted at lock_targets, with no loss of lock_targets coverage.

Dependencies

None; it can start now. It touches go_sum_edit.rs lightly, so whichever of this and #631 lands second drops remove_lines from its list.

Consolidated work — backlog review, 2026-10-08

The following standalone issues are now tracked here. Their closure consolidates scheduling; it does not mean their implementation is complete. Original reports and discussion remain linked below.

#746: Delete PatchSources::mem_blobs, the single-variant VendorSource predicates, the redirect-state group-commit capture and the group_commit switch-off oracle

• Track the remaining scope from Delete PatchSources::mem_blobs, the single-variant VendorSource predicates, the redirect-state group-commit capture and the group_commit switch-off oracle #746 in this issue. Combine this dead/scaffolding cleanup with the existing dead-helper cleanup instead of separate jobs.

#800: Replace the single-variant vendor PackageSource with &Path and delete the scaffolding it props up

• Track the remaining scope from Replace the single-variant vendor PackageSource with &Path and delete the scaffolding it props up #800 in this issue. Combine single-variant PackageSource and associated dead scaffolding with the existing dead-helper cleanup.

#801: Delete lock_inventory::wired_vendor_integrity and PnpmLock::wired_integrity, which have no production caller

• Track the remaining scope from Delete lock_inventory::wired_vendor_integrity and PnpmLock::wired_integrity, which have no production caller #801 in this issue. Combine the unused wired-integrity readers with the existing dead-helper cleanup.