From 153825050276f96af1b638f4c2c3a4278dbf6e70 Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Wed, 4 Nov 2026 11:08:04 -0600
Subject: [PATCH 1/4] Read the governing go.work in Go discovery

Go discovery read only a go.work at the project root and only members
inside the root. With GOWORK unset it ignored an ancestor go.work and read
the root go.mod in module mode, so in a member of a parent workspace it
could attest a go.mod replace that the workspace overrides, doesn't `use`,
or makes inert by version selection. Hosted and vendored modes resolve the
workspace go itself would use and refuse to write such a replace.

On disk, discovery now loads the governing workspace with the same
go_workspace::load_with loader hosted mode uses: GOWORK (environment, then
the go env -w file), else the nearest go.work at or above the root, with
`use` members anywhere. Out-of-root members' requires and replaces now
count toward selection and conflicts. In-root members are still re-read
through the view, so recognition and parse diagnostics stay the same.

A wired Socket replace that this workspace keeps from the build, at
exactly the points where hosted mode's host_conflict check refuses, stays a
ref (list, rollback and remove still find it) but is marked unattested
with the new UnattestedKind::GoWorkspaceOverride. The same applies to a
replace in the root go.work while GOWORK makes go build another one.
vex_sources reports these under the existing `go_workspace_override`
reason, the one vex's own go.mod gate already uses. A replace that
workspace selection makes inert is still diagnosed, as in module mode.
A GOWORK that go rejects still withholds every ref as patched_ref_invalid.

In memory there is no directory to search from and no environment the
project builds under. The root go.work and its in-root members are the
workspace there, as the in-memory hosted engine reads them, and the same
conflict gate applies. GOWORK keeps its old effect in memory and GOFLAGS
is not read.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/socket-patch-cli/CLI_CONTRACT.md       |   8 +-
 crates/socket-patch-cli/src/commands/vex.rs   |   8 +-
 .../src/commands/vex_sources.rs               |  11 +
 .../src/vex/discover/golang.rs                | 579 +++++++++++++++---
 .../socket-patch-core/src/vex/discover/mod.rs |   6 +
 docs/ecosystems.md                            |   9 +-
 6 files changed, 524 insertions(+), 97 deletions(-)

diff --git a/crates/socket-patch-cli/CLI_CONTRACT.md b/crates/socket-patch-cli/CLI_CONTRACT.md
index a3ed909d6..785d8cfe4 100644
--- a/crates/socket-patch-cli/CLI_CONTRACT.md
+++ b/crates/socket-patch-cli/CLI_CONTRACT.md
@@ -533,7 +533,7 @@ Discovery is read-only, never touches the network, and never fails the run: a ma
 | bun | `bun.lock`; `bun.lockb` only when there is no `bun.lock` (bun reads exactly one) | URL tuple / binary remote-tarball resolution; version from the URL leaf. A user URL or `file:` tarball tuple / record whose `<name>-<ver>.tgz` leaf names the same `name@version` is installed from its own spec, so every ref for that `name@version` is dropped | `.socket/vendor/npm/<uuid>/<name>-<ver>.tgz` tuple / local-tarball resolution | `sha512-…`, required. A 2-tuple that Bun < 1.3.10 re-saved without its digest is still a reference, but it attests only from an installed tree. |
 | vlt | `vlt-lock.json` (lockfileVersion absent, `0` or `1`; a BOM-prefixed, unparseable, non-object or other-version lock is not read: diagnosed, no ref). `vlt.json` (read only for its `modifiers`) and `node_modules/.vlt-lock.json` are never wiring. | a registry node (any segment) whose slot [3] is a `/patch/npm/…` URL on the patch host with the leaf `<bare>-<ver>.tgz` of its DepID's `name@version`, whose embedded `<name>/<ver>` path (when present) is that `name@version`, and slot [1] == name; version from the DepID | a `file` node `.socket/vendor/npm/<uuid>/<name>-<ver>/node_modules/<name>` (or a user-installed `<name>-<ver>.tgz`) with slot [1] == name; version from the path. A same-`name@version` registry node, or a diagnosed Socket-shaped one, beside it is diagnosed, no ref. | slot [2] `sha512-…`, required (a hosted node without one is no reference). A same-`name@version` node on another registry, or a diagnosed Socket-shaped one, keeps the reference but withholds the lockfile basis: only an installed tree whose every store copy verifies attests. So does a lock some vlt release discards, the conditions of `redirect_vlt_lockfile_version_missing`, `redirect_vlt_old_lockfile_ignored` and `redirect_vlt_scalar_registry_ignored` (which in-run `--vex` withholds too): every hosted reference in it keeps no pin, and one `patched_ref_unattributable` names them. |
 | cargo | `Cargo.lock`, `Cargo.toml`, `.cargo/config` (else `.cargo/config.toml`) | `Cargo.lock` `source = "sparse+…/<uuid>/index/"`, confirmed by `Cargo.toml`: a crate the root manifest declares must pin `registry = "socket-patch-<uuid>"`. A reverted pin is diagnosed, no ref. Another `[[package]]` of the same `name@version` from a non-Socket source (crates.io, git), which cargo locks beside the pin for a dependent added later and builds unpatched (#679), withholds the ref (`patched_ref_unattributable`, never attested) while `rollback` / `remove` still unwind it. | `[patch.<source>] <key> = { path = ".socket/vendor/cargo/<uuid>/<name>-<ver>" }` — primarily the root `Cargo.toml` (v5 `vendor`; key-agnostic: `<name>` is `package` when renamed, else the key, so `<name>-socket-<uuid8>` keys count), also the project config (pre-v5 wiring), live only while the lock holds a sourceless entry for it that is not in `[[patch.unused]]`; a manifest entry cargo ignores — the project config redefines its key with another path, or a `[patch."https://github.com/rust-lang/crates.io-index"]` table replaces `[patch.crates-io]` — is diagnosed (`patched_ref_invalid`), no ref | `checksum` (v1: `[metadata]`), required |
-| golang | `go.mod`, `go.work`, `go.sum`, `go.work.sum` | `replace M v => patch.socket.dev/gopatch/<uuid> <sver>` | `replace M v => ./.socket/vendor/golang/<uuid>/M@v` | the socket module's `/go.mod` go.sum line, required. The zip line (`h1:` of the module tree) is the locked integrity when present; `go mod tidy` prunes it when no package of the module is loaded and the build stays green, so the `/go.mod` line alone still attests from the lockfile, unless the main modules' `require`s or go.sum show the build selects another version (MVS keeps the `/go.mod` line of versions it only reads): then the replace is inert. With a `go.work` the main modules are its `use` members and the build selects by MVS over their module graph: each member's `require`s and the `go.mod` of every dependency go loads (read from its replacement directory or the module cache when the root is on disk). go keeps no member's `go.mod` tidy in workspace mode, so a member's dependency can raise the module past every `require`. A pin, zip line or not, whose replaced version a member's or a dependency's `require` raises is inert, as is one of a module that is itself a `use` member (go builds it from that directory). Sum-file zip lines are no evidence of the selection (go only appends to `go.work.sum`), and a `/go.mod`-only pin is never the lockfile basis in a workspace (`integrity_required = true`). Any mode writes the replace of a module a workspace shares into the root `go.work` (source `go.work`); a `go.work` root without a `go.mod` also reads each in-root member's `go.mod` replaces (source `<member>/go.mod`). The sum files are the ones go reads: the root `go.sum`, or with a `go.work`, `go.work.sum` and each in-root `use` member's `go.sum` (the root's only when `.` is a member); under `GOWORK=off`, `go.work` and its replaces are ignored; a `GOWORK` naming any file other than the root's `go.work` (or a relative path, which go rejects) leaves the workspace unread: each Go ref is reported as `patched_ref_invalid` instead, as it is when `GOFLAGS` sets a `-modfile` other than the root `go.mod`. A conflicting hash or a malformed `h1:` for the socket module+version, or a line of other than three tokens anywhere in a sum file, is no pin. A replace that `require` no longer selects (`require M v'`) is inert: diagnosed, no ref. |
+| golang | `go.mod`, `go.work`, `go.sum`, `go.work.sum` | `replace M v => patch.socket.dev/gopatch/<uuid> <sver>` | `replace M v => ./.socket/vendor/golang/<uuid>/M@v` | the socket module's `/go.mod` go.sum line, required. The zip line (`h1:` of the module tree) is the locked integrity when present; `go mod tidy` prunes it when no package of the module is loaded and the build stays green, so the `/go.mod` line alone still attests from the lockfile, unless the main modules' `require`s or go.sum show the build selects another version (MVS keeps the `/go.mod` line of versions it only reads): then the replace is inert. With a `go.work` the main modules are its `use` members and the build selects by MVS over their module graph: each member's `require`s and the `go.mod` of every dependency go loads (read from its replacement directory or the module cache when the root is on disk). go keeps no member's `go.mod` tidy in workspace mode, so a member's dependency can raise the module past every `require`. A pin, zip line or not, whose replaced version a member's or a dependency's `require` raises is inert, as is one of a module that is itself a `use` member (go builds it from that directory). Sum-file zip lines are no evidence of the selection (go only appends to `go.work.sum`), and a `/go.mod`-only pin is never the lockfile basis in a workspace (`integrity_required = true`). Any mode writes the replace of a module a workspace shares into the root `go.work` (source `go.work`); a `go.work` root without a `go.mod` also reads each in-root member's `go.mod` replaces (source `<member>/go.mod`). On disk the workspace is the one go resolves, read as hosted and vendored modes read it: `GOWORK`, else the nearest `go.work` at or above the project, with `use` members anywhere (in memory: the root `go.work` and its in-root members). The sum files are the ones go reads inside the project: the root `go.sum`, or with a `go.work`, `go.work.sum` (when it is the root's) and each in-root `use` member's `go.sum` (the root's only when `.` is a member); under `GOWORK=off`, `go.work` and its replaces are ignored. A Socket replace that workspace keeps from the build, exactly where hosted and vendored modes refuse to write one (its `go.work` is an ancestor's or another file `GOWORK` names, so the root `go.work` is never read; it overrides the replace; it doesn't `use` the module; another member replaces the same `module@version` elsewhere), stays a reference but is unattested (`go_workspace_override`). A `GOWORK` go rejects (a relative path, a file it cannot read or parse) reports each Go ref as `patched_ref_invalid` instead, as does a `GOFLAGS` `-modfile` other than the root `go.mod`. A conflicting hash or a malformed `h1:` for the socket module+version, or a line of other than three tokens anywhere in a sum file, is no pin. A replace that `require` no longer selects (`require M v'`) is inert: diagnosed, no ref. |
 | pypi | `uv.lock` (confirmed by `pyproject.toml` `[tool.uv.sources]` when present), PEP 723 `<script>.py.lock`, `pylock.toml` / `pylock.<name>.toml`, `poetry.lock`, `pdm.lock`, `Pipfile.lock`, `requirements.txt` + its in-root `-r` includes, PEP 508 direct references in `pyproject.toml` / `hatch.toml` | Socket-host artifact url | `.socket/vendor/pypi/<uuid>/<wheel>` naming the entry's own dist | sha256, required |
 | gem | `Gemfile.lock` and `gems.locked` (the `Gemfile` / `gems.rb` only to cross-check a merged multi-remote `GEM` section) | a `GEM` section whose remote ends `patch-registry/gem/<token>/<uuid>` | `PATH` remote `.socket/vendor/gem/<uuid>/<name>-<ver>` | `CHECKSUMS` sha256, required only when the lock has a `CHECKSUMS` section (bundler ≥ 2.6) |
 | composer | `composer.lock` (`packages` + `packages-dev`) | `dist.url` on the patch host | `dist: {type: "path", url: ".socket/vendor/composer/<uuid>/…", reference: "<uuid>"}` | `dist.shasum`, required |
@@ -547,7 +547,7 @@ Recognition rules that hold for every ecosystem:
 * **Patch hosts.** A hosted reference counts only on `https://patch.socket.dev` or the `--patch-server-url` / `SOCKET_PATCH_SERVER_URL` origin, with no userinfo. The uuid is the URL's LAST canonical-uuid path segment, because grant tokens may themselves be uuid-shaped. The Go module prefix is fixed. `socket-patch-<uuid>` registry / repository / source names count only through a pin. For a URL on any other host, see **Patch hosts** above.
 * **Pins, not definitions.** A registry, index or source *definition* alone (cargo `[registries]`, nuget `<add>`, pom `<repository>`, uv index tables, `.npmrc`) never makes a reference, because it survives a reverted pin. Sections the package manager ignores are not read: npm's v2 `dependencies` mirror, a `.cargo/config.toml` shadowed by `.cargo/config`. A Socket pin inside a maven `<profile>` is diagnosed, never a reference.
 * **Contested locks.** When one lock wires a package to a patch and another lock resolves the same `name@version` from a non-Socket source, the build's bytes depend on which package manager runs. The reference is then dropped with a `patched_ref_unattributable` diagnostic naming both files. This applies across npm / pnpm / yarn / bun and across uv / pylock / poetry / pdm / Pipfile.lock / requirements. PEP 723 script locks neither contest nor are contested. The root `requirements.txt` and its in-root `-r` includes count as one lock here: pip reads them as one requirement set, where a direct reference wins over a compatible `==` pin of the same version in another file of the set (#1086). A PyPI version matches under PEP 440 equality, so a requirements line pinned in any spelling that can only install the wired release (`==1.2.3.0`, `==v1.2.3`, `===1.2.3`) contests it like `==1.2.3` does; a range or wildcard (`~=1.2.3`, `==1.2.*`) does not (#1602). A **bundled** npm copy (`inBundle: true`, or v1 `bundled: true`, beneath a dependency that bundles it; the root project's own bundles install from the lock, #1618) of the same `name@version` contests the reference too, in the same lock, in the other npm lock of a shrinkwrap/package-lock pair, or in any other lock. npm unpacks it from the parent package's tarball, so no rewire reaches it and it stays unpatched. Bun and vlt unpack bundled copies the same way (#469, #471). pnpm unpacks bundled copies too, but its lock cannot tie one to a reference (see **Unattested references** below). For Bun, that is a `bun.lock` entry whose meta is `{ "bundled": true }`, or a `bun.lockb` record that a dependency edge with the `bundled` behavior bit reaches, including one Bun shares with a regular install. Such an entry is never a reference, and it contests the reference the same way. For vlt, the lock records no node for a bundled copy, so the copy is found in the installed store: a real package directory inside a store package's own `node_modules`. yarn classic's `yarn.lock` records nothing about bundled copies either (#758), so for a lock with a Socket wiring they are found in the installed `node_modules`: each package a parent's `bundleDependencies` / `bundledDependencies` names inside the parent's own `node_modules`, the dependencies of those beside them, and everything nested under them. Such a copy contests the reference in `yarn.lock` (the diagnostic names the parent's lock entry and the copy's directory); a lock-only `vex` with no `node_modules` can't see it. Hosted and vendored scans skip these copies with `redirect_bun_bundled_instance_skipped` / `redirect_vlt_bundled_instance_skipped` / `vendor_bundled_instance_skipped`, and a yarn classic hosted scan names one with `redirect_copy_unpatched`. When a bundled copy is the only instance, vendoring refuses with `vendor_lock_entry_not_rewritable`. A reference withheld only because such an unreachable copy installs beside it (a bundled npm / Bun / vlt copy, an npm copy beneath a `hasShrinkwrap` package (#753) or one npm installs from a git / url / `file:` spec, or a yarn classic git or `file:` directory block of the same `name@version`) is still the rewriter's own wiring of exactly one package version: it is never attested, but `rollback`, `remove`, `list` and the hosted → vendored takeover treat it as an ordinary hosted pin and restore its upstream registry entry (#828), rather than refusing it with `hosted_wiring_contested`. Another entry of the **same** npm, Bun or yarn lock that resolves the wired `name@version` from a non-Socket source (for example a workspace member added after the rewire, then `npm install` / `bun install` / `yarn install`; for yarn berry, a registry locator such as `left-pad@npm:1.3.0` beside the hosted `…::__archiveUrl=` one) contests the reference too (#588). The package manager installs both entries, and that copy stays unpatched. Re-running `scan` / `vendor` rewires every copy.
-* **Unattested references.** Some evidence shows a build may run a copy no wiring reaches, but cannot be tied to the reference's exact `name@version` or cannot say the build runs it. The reference then stays a reference: `list`, `rollback` and `remove` find it, and the ledgers' liveness gates (`vendor --check`, `scan`) keep treating the wiring as live, because re-running `scan` / `vendor` could never clear the evidence. Only `vex` omits it, as a run warning and as the `failed[].reason`. Four cases besides Gradle's (`vex_gradle_lock_above_base`): **pnpm bundled copies** (`vex_pnpm_bundled_copy`): a `packages:` entry's `bundledDependencies:` names the copies pnpm unpacks from that package's own tarball, but pnpm never locks them, so the bundled version is not in the lock. A pnpm reference whose package name a `bundledDependencies` list in the same lock names is omitted whatever its version (a missed attestation when the bundled copy is another version, never a false one), and `bundledDependencies: true` (or a value that cannot be read) omits every reference of that lock. It reaches no other lock. **deno.lock** (`vex_deno_lock_copy`): `deno install` installs a `package.json` project's npm dependencies from `deno.lock` and never reads `package-lock.json` / `pnpm-lock.yaml` / `yarn.lock`, so an npm-family reference whose `name@version` the `deno.lock` npm section also locks is omitted (#406). Whether Deno or another package manager populates `node_modules` (`nodeModulesDir: "manual"` allows either) is not in the files, so this holds whatever `nodeModulesDir` says. **Maven reactor roots** (`vex_maven_reactor_root`): a hosted pin in a root `pom.xml` that declares `<modules>` / `<subprojects>`, or whose subprojects Maven 4 discovers (see the hosted Maven rewriter), is omitted, because a module's own literal `<version>` overrides a root pin and module poms are not read (#261); hosted scan refuses such roots (`redirect_maven_multimodule_unsupported`), so this only covers pins an older release wrote. **Maven classifier copies** (`vex_maven_classifier_unpatched`): a `<classifier>` dependency of a hosted-pinned GA is its own coordinate; the classifier-less pin does not retarget it and the grant serves only the main jar, so Maven fetches it from the next repository. When a live, non-profile classifier copy other than `sources` / `javadoc` (`tests`, a native or JDK-specific build) resolves any version other than the suffixed pin — its own literal `<version>`, a `<dependencyManagement>` entry with the same classifier, or no version in the root pom — the pin is omitted. `sources` / `javadoc` copies never run on a classpath and do not withhold the statement; hosted scan only warns about them (`redirect_maven_classifier_unsupported`) and skips the dep when an executable copy names the patched release.
+* **Unattested references.** Some evidence shows a build may run a copy no wiring reaches, but cannot be tied to the reference's exact `name@version` or cannot say the build runs it. The reference then stays a reference: `list`, `rollback` and `remove` find it, and the ledgers' liveness gates (`vendor --check`, `scan`) keep treating the wiring as live, because re-running `scan` / `vendor` could never clear the evidence. Only `vex` omits it, as a run warning and as the `failed[].reason`. Five cases besides Gradle's (`vex_gradle_lock_above_base`): **pnpm bundled copies** (`vex_pnpm_bundled_copy`): a `packages:` entry's `bundledDependencies:` names the copies pnpm unpacks from that package's own tarball, but pnpm never locks them, so the bundled version is not in the lock. A pnpm reference whose package name a `bundledDependencies` list in the same lock names is omitted whatever its version (a missed attestation when the bundled copy is another version, never a false one), and `bundledDependencies: true` (or a value that cannot be read) omits every reference of that lock. It reaches no other lock. **deno.lock** (`vex_deno_lock_copy`): `deno install` installs a `package.json` project's npm dependencies from `deno.lock` and never reads `package-lock.json` / `pnpm-lock.yaml` / `yarn.lock`, so an npm-family reference whose `name@version` the `deno.lock` npm section also locks is omitted (#406). Whether Deno or another package manager populates `node_modules` (`nodeModulesDir: "manual"` allows either) is not in the files, so this holds whatever `nodeModulesDir` says. **Maven reactor roots** (`vex_maven_reactor_root`): a hosted pin in a root `pom.xml` that declares `<modules>` / `<subprojects>`, or whose subprojects Maven 4 discovers (see the hosted Maven rewriter), is omitted, because a module's own literal `<version>` overrides a root pin and module poms are not read (#261); hosted scan refuses such roots (`redirect_maven_multimodule_unsupported`), so this only covers pins an older release wrote. **Maven classifier copies** (`vex_maven_classifier_unpatched`): a `<classifier>` dependency of a hosted-pinned GA is its own coordinate; the classifier-less pin does not retarget it and the grant serves only the main jar, so Maven fetches it from the next repository. When a live, non-profile classifier copy other than `sources` / `javadoc` (`tests`, a native or JDK-specific build) resolves any version other than the suffixed pin — its own literal `<version>`, a `<dependencyManagement>` entry with the same classifier, or no version in the root pom — the pin is omitted. `sources` / `javadoc` copies never run on a classpath and do not withhold the statement; hosted scan only warns about them (`redirect_maven_classifier_unsupported`) and skips the dep when an executable copy names the patched release. **Go workspaces** (`go_workspace_override`): a hosted or vendored Go `replace` that the workspace go resolves (an ancestor's `go.work`, one `GOWORK` names, members outside the project included) overrides, ignores or rejects, by the same check hosted and vendored modes run before writing one (`redirect_golang_workspace_conflict`, `vendor_go_workspace_conflict`), is omitted under the reason `vex`'s own go.mod gate reports. So is a replace in the root `go.work` while go builds another one.
 * **Shrinkwrap without a twin (#899).** npm >= 12 never reads `npm-shrinkwrap.json`: on a project whose only npm lock is the shrinkwrap it resolves the tree from the registry and writes a fresh `package-lock.json`, so a Socket reference there reaches npm <= 11 only. The reference is still discovered, so `list`, `rollback` and `remove` manage it, but `vex` omits the patch (`vex_npm_shrinkwrap_only`, as a run warning and as the `failed[].reason`). A `package-lock.json` beside it (wired the same way) makes it attestable again. Hosted and vendored runs still rewire the shrinkwrap and warn `redirect_npm_shrinkwrap_only` / `vendor_npm_shrinkwrap_only`.
 * **Lockless pins.** With no lock to name a version, a `Cargo.toml` pin (every declaration on `socket-patch-<uuid>`, that registry defined on the patch host for the same uuid) or an exclusive nuget exact-id mapping is never a reference on its own, so v5.0 does not attest it (nor does `list` show it, or `rollback` / `remove` restore it — restore those files from version control). Only a pre-v5 redirect-ledger record naming a version the pin admits keeps it live. The same holds for a gem wired only in the `Gemfile` (the pre-bundler-2.6 mixed state, lock not converged).
 
@@ -675,7 +675,8 @@ are patched by `socket-patch apply` like every other ecosystem:
   `use` order); hosted mode warns `redirect_golang_workspace_conflict` and confirms
   nothing. One already written fails `apply --check` / `vendor --check` and warns
   `go_workspace_replace_ineffective`, and `vex` omits the patch with `go_workspace_override` (#393,
-  #458, #531). Run in the directory holding the `go.work`, `apply` and `vendor` write the `replace` of a
+  #458, #531); a hosted or vendored replace stays a discovered (unattested) reference, so `list`,
+  `rollback` and `remove` still find it. Run in the directory holding the `go.work`, `apply` and `vendor` write the `replace` of a
   module the workspace shares (no root `go.mod`, or the root module is a `use` member and another
   member lists it or `go.work` already holds the Socket replace) into `go.work`, its target relative
   to that directory, and refuse one a go.work `replace` of the module or a member's own `replace`
@@ -2677,6 +2678,7 @@ match it, withholds the statement:
 | `vex_pnpm_bundled_copy` | run warning and `failed[].reason` | An npm pin is wired, but its pnpm lock names a package whose `bundledDependencies` may ship an unpatched copy of it (the lock does not record that copy's version); no statement while that package bundles it. `vendor --check` and `scan` still treat the wiring as live. |
 | `vex_deno_lock_copy` | run warning and `failed[].reason` | An npm pin is wired, but `deno.lock` locks the same `name@version`, which `deno install` installs without the wiring; no statement while it does. `vendor --check` and `scan` still treat the wiring as live. |
 | `vex_maven_reactor_root` | run warning and `failed[].reason` | A hosted Maven pin sits in a root `pom.xml` that declares `<modules>` / `<subprojects>` (a profile's included), where a module's own literal `<version>` overrides it; only the root pom is read, so no statement (#261). `list`, `rollback` and `remove` still find the pin. |
+| `go_workspace_override` | run warning and `failed[].reason` | A hosted or vendored Go `replace` is wired, but the workspace go resolves (an ancestor's `go.work`, one `GOWORK` names, members outside the project included) overrides, ignores or rejects it, or go builds another `go.work` than the root's that holds it; no statement while it does. `list`, `rollback` and `remove` still find the replace. |
 | `vex_maven_classifier_unpatched` | run warning and `failed[].reason` | A hosted Maven pin's GA also has a live executable `<classifier>` copy (not `sources` / `javadoc`) at a version other than the pin, which the classifier-less pin does not retarget and the grant does not serve; no statement while it does. `list`, `rollback` and `remove` still find the pin. |
 | `vex_gradle_derived_cache_unchecked` | run warning | The derived-cache walk was cut short (a very large transforms cache); the statement is still emitted, the copies the walk did reach were checked. |
 
diff --git a/crates/socket-patch-cli/src/commands/vex.rs b/crates/socket-patch-cli/src/commands/vex.rs
index 65acda5d0..84cd69f50 100644
--- a/crates/socket-patch-cli/src/commands/vex.rs
+++ b/crates/socket-patch-cli/src/commands/vex.rs
@@ -31,8 +31,8 @@ use socket_patch_core::vex::{
 
 use crate::args::{apply_env_toggles, parse_bool_flag, GlobalArgs};
 use crate::commands::vex_sources::{
-    self, Plan, RunApiClient, Sources, RECORD_MISMATCH, RECORD_UNAVAILABLE, REDIRECT_UNWIRED,
-    VENDOR_UNWIRED, WIRING_CONFLICT,
+    self, Plan, RunApiClient, Sources, GO_WORKSPACE_OVERRIDE, RECORD_MISMATCH, RECORD_UNAVAILABLE,
+    REDIRECT_UNWIRED, VENDOR_UNWIRED, WIRING_CONFLICT,
 };
 use crate::ecosystem_dispatch::{find_manifest_package_copies_reusing, JvmScope};
 use crate::json_envelope::{Command, Envelope, EnvelopeError, PatchAction, PatchEvent, RunWarning};
@@ -1953,10 +1953,6 @@ fn join_and(items: &[&str]) -> String {
     }
 }
 
-/// Omission tag for a Go patch whose go.mod replace the `go.work` in effect
-/// overrides, ignores or rejects (#393, #458, #531).
-const GO_WORKSPACE_OVERRIDE: &str = "go_workspace_override";
-
 /// Omission tag for a global Go patch while a tool built from the unpatched
 /// module with `go install` remains (#422).
 const GO_INSTALLED_TOOL_STALE: &str = socket_patch_core::utils::go_installed_tools::STALE_WARNING;
diff --git a/crates/socket-patch-cli/src/commands/vex_sources.rs b/crates/socket-patch-cli/src/commands/vex_sources.rs
index 25e49273e..480bbf0da 100644
--- a/crates/socket-patch-cli/src/commands/vex_sources.rs
+++ b/crates/socket-patch-cli/src/commands/vex_sources.rs
@@ -232,6 +232,12 @@ const NOTE_MAVEN_REACTOR_ROOT: &str = "vex_maven_reactor_root";
 /// classifier copy at another version, which the pin does not reach
 /// (`vex::Unattested`).
 const NOTE_MAVEN_CLASSIFIER_UNPATCHED: &str = "vex_maven_classifier_unpatched";
+/// Omission tag for a Go patch whose replace the `go.work` in effect
+/// overrides, ignores or rejects (#393, #458, #531): the reason of `vex`'s
+/// own go.mod gate, and the note of a discovered hosted or vendored ref the
+/// governing workspace keeps from the build (`vex::Unattested`,
+/// `UnattestedKind::GoWorkspaceOverride`).
+pub(crate) const GO_WORKSPACE_OVERRIDE: &str = "go_workspace_override";
 
 /// The omission tag of an [`Unattested`](socket_patch_core::vex::Unattested)
 /// ref, and the remedy its note ends with.
@@ -268,6 +274,11 @@ fn unattested_note(kind: UnattestedKind) -> (&'static str, &'static str) {
             "not attested while that classifier copy resolves an unpatched version; the \
              wiring itself is intact, so re-running `scan` does not change this",
         ),
+        UnattestedKind::GoWorkspaceOverride => (
+            GO_WORKSPACE_OVERRIDE,
+            "not attested while the Go workspace in effect keeps it from the build; the wiring \
+             itself is intact, so re-running `scan` / `vendor` does not change this",
+        ),
     }
 }
 
diff --git a/crates/socket-patch-core/src/vex/discover/golang.rs b/crates/socket-patch-core/src/vex/discover/golang.rs
index a44a3dbc6..da6dd30c3 100644
--- a/crates/socket-patch-core/src/vex/discover/golang.rs
+++ b/crates/socket-patch-core/src/vex/discover/golang.rs
@@ -61,13 +61,13 @@
 //!   sum file (go rejects the whole file) — is not a pin:
 //!   `integrity_required = true`, no `locked_integrity`. Hashes of other
 //!   algorithms are ignored, as go ignores them. The sum files are the
-//!   ones go verifies against: the root `go.sum`, or with a `go.work`,
-//!   `go.work.sum` and each in-root `use` member's `go.sum` (the root's
-//!   only when `.` is a member). Under `GOWORK=off` go ignores `go.work`,
-//!   so discovery reads neither it nor its sum files. A `GOWORK` naming
-//!   another file than the root's `go.work`, or a relative one (which go
-//!   rejects), leaves the workspace unreadable here: every Go ref becomes
-//!   a diagnostic.
+//!   ones go verifies against inside the project: the root `go.sum`, or
+//!   with a `go.work`, `go.work.sum` (when the `go.work` is the root's)
+//!   and each in-root `use` member's `go.sum` (the root's only when `.`
+//!   is a member). Under `GOWORK=off` go ignores `go.work`, so discovery
+//!   reads neither it nor its sum files. A `GOWORK` go rejects (a
+//!   relative path, a file it cannot read or parse) leaves no build:
+//!   every Go ref becomes a diagnostic.
 //!   NB for the CLI's installed-tree basis: under a hosted replace the
 //!   module cache's `M@v` (if any, e.g. from before the redirect) is
 //!   pristine BY CONSTRUCTION — the build consumes
@@ -99,12 +99,30 @@
 //!   refs are emitted with `source_file = "go.work"`, and hosted pins looked
 //!   up in the sum files above. Versions are checked against the root
 //!   `go.mod`'s `require` in module mode, and in workspace mode against the
-//!   highest version any read member requires. go.work replaces override
-//!   go.mod replaces in Go, but rule 10 leaves cross-file precedence to the
-//!   CLI's `wiring_conflict` gate. In-root members' go.mod files are read
-//!   for their `require`s and their go.sum for pins; their replaces only
-//!   when the root has no go.mod of its own (a go.work root), each emitted
-//!   with its own `source_file` (`<member>/go.mod`).
+//!   highest version any read member requires. Two Socket replaces of one
+//!   module in go.work and a go.mod are left to the CLI's
+//!   `wiring_conflict` gate (rule 10). In-root members' go.mod files are
+//!   read for their `require`s and their go.sum for pins; their replaces
+//!   only when the root has no go.mod of its own (a go.work root), each
+//!   emitted with its own `source_file` (`<member>/go.mod`).
+//! * **Which workspace governs (G1).** On disk it is the one go resolves,
+//!   read by the loader hosted and vendored modes use
+//!   ([`go_workspace::load_with`]): `GOWORK` (from the environment, then
+//!   the `go env -w` file), else the nearest `go.work` at or above the
+//!   root, with `use` members anywhere, so an out-of-root member's
+//!   `require` or replace counts too. In memory (no directory to search
+//!   from, no environment the project builds under) it is the root
+//!   `go.work` and its in-root members, as the in-memory hosted engine
+//!   reads them. A wired Socket replace that workspace keeps from the
+//!   build exactly where the writers refuse to write one
+//!   ([`go_workspace::Loaded::host_conflict`]: it overrides the replace,
+//!   doesn't `use` the module, or another member replaces the same
+//!   `module@version` elsewhere), or one in the root `go.work` while go
+//!   builds another `go.work`, stays a ref, so list, rollback and remove
+//!   find it, but is marked [`UnattestedKind::GoWorkspaceOverride`]: the
+//!   writers refuse to rewrite it there, so re-running them can never
+//!   clear it. A replace the workspace's version selection makes inert is
+//!   diagnosed, never a ref, as in module mode.
 //! * **Hand-edit tolerance**: a UTF-8 BOM, CRLF line ends, tab-separated
 //!   tokens, `replace(` without a space, `// comments`, and Go string
 //!   literals (`"github.com/foo/bar"`, `` `…` ``) around escape- and
@@ -120,7 +138,7 @@ use std::path::Path;
 
 use super::{
     golang_purl, vendor_ref, vendored_leaf_purl, DiscoverCtx, Discovery, PatchedRef,
-    DIAG_LOCKFILE_UNPARSEABLE, DIAG_REF_INVALID, DIAG_REF_UNATTRIBUTABLE,
+    UnattestedKind, DIAG_LOCKFILE_UNPARSEABLE, DIAG_REF_INVALID, DIAG_REF_UNATTRIBUTABLE,
 };
 use crate::patch::path_safety::is_safe_single_segment;
 use crate::utils::go_env::{go_env, goflags_modfile, GoflagsModfile};
@@ -130,7 +148,7 @@ use crate::vendor::go_mod_edit::{
     ReplaceOwner, HOSTED_GO_MODULE_PREFIX,
 };
 use crate::vendor::go_sum_edit::{go_semver_cmp, go_sum_lines, is_h1_dirhash};
-use crate::vendor::go_workspace::{self, in_root_dir, same_dir_key, GoWork, GoWorkspace, Member};
+use crate::vendor::go_workspace::{self, in_root_dir, same_dir_key, GoWorkspace, Loaded, Member};
 use crate::vendor::lock_inventory::LockIntegrity;
 
 const GO_MOD: &str = "go.mod";
@@ -188,43 +206,61 @@ async fn extract_goenv(
 }
 
 /// [`extract`] for an explicit `GOWORK` value.
+///
+/// On disk the workspace is the one go resolves, read by the loader the
+/// hosted engine and the vendored backend use ([`go_workspace::load_with`]):
+/// `GOWORK`, else the nearest `go.work` at or above the root, with members
+/// anywhere. In memory there is no directory to search from or environment
+/// the project builds under, so the root `go.work` and its in-root members
+/// are the workspace, as the in-memory hosted engine reads them; `GOWORK`
+/// keeps the effect it always had there (`off` reads no `go.work`, any
+/// other explicit file withholds every ref), and `GOFLAGS` is not read.
 async fn extract_gowork(ctx: &DiscoverCtx<'_>, out: &mut Discovery, gowork: Option<&str>) {
-    match gowork {
-        Some("off") => extract_with(ctx, out, false).await,
-        None | Some("") | Some("auto") => extract_with(ctx, out, true).await,
-        Some(gowork) => match unread_workspace(ctx, gowork) {
-            None => extract_with(ctx, out, true).await,
-            Some(why) => withhold(ctx, out, &why).await,
-        },
+    let Some(root) = ctx.disk_root_reading(std::iter::empty::<&Path>()) else {
+        return match gowork {
+            Some("off") => extract_with(ctx, out, Governing::Module).await,
+            None | Some("") | Some("auto") => extract_with(ctx, out, Governing::Root).await,
+            Some(gowork) => {
+                let why = format!(
+                    "GOWORK={gowork} names a workspace other than this project's {GO_WORK}, \
+                     which discovery cannot read in memory"
+                );
+                withhold(ctx, out, &why).await
+            }
+        };
+    };
+    // The files go_workspace::resolve_with probes; the loader's own reads
+    // of a workspace are declared where it is read.
+    let mut touched: Vec<std::path::PathBuf> =
+        root.ancestors().map(|dir| dir.join(GO_WORK)).collect();
+    touched.extend(
+        gowork
+            .filter(|g| Path::new(g).is_absolute())
+            .map(Into::into),
+    );
+    ctx.disk_root_reading(&touched);
+    match go_workspace::load_with(root, gowork).await {
+        Loaded::None => extract_with(ctx, out, Governing::Module).await,
+        Loaded::Invalid(why) => withhold(ctx, out, &why).await,
+        Loaded::Workspace(ws) => extract_with(ctx, out, Governing::Loaded(root, ws)).await,
     }
 }
 
-/// Why the `go.work` an explicit `GOWORK` names is not the root's, which
-/// is the only one discovery reads (`None`: it is).
-fn unread_workspace(ctx: &DiscoverCtx<'_>, gowork: &str) -> Option<String> {
-    let root = ctx.disk_root();
-    let why = match go_workspace::resolve_with(root.unwrap_or(Path::new("")), Some(gowork)) {
-        GoWork::Invalid(why) => why,
-        GoWork::File(file) => {
-            let own = root.map(|r| r.join(GO_WORK)).filter(|own| own.is_file());
-            if own.is_some_and(|own| same_dir_key(&own) == same_dir_key(&file)) {
-                return None;
-            }
-            format!(
-                "GOWORK={gowork} names a workspace other than this directory's {GO_WORK}, \
-                 which discovery cannot read"
-            )
-        }
-        GoWork::None => return None,
-    };
-    Some(why)
+/// The workspace that decides what the build reads.
+enum Governing<'a> {
+    /// Module mode: `GOWORK=off`, or no `go.work` at or above the root.
+    Module,
+    /// The root's own `go.work`, if any, read through the view (in memory).
+    Root,
+    /// The workspace go resolves for the project at this disk root.
+    Loaded(&'a Path, GoWorkspace),
 }
 
-/// Discovery under a workspace it cannot read: what it would find reported
-/// as unattested, never as refs.
+/// Discovery under a workspace go refuses or that discovery cannot read:
+/// what it would find reported as diagnostics, never as refs.
 async fn withhold(ctx: &DiscoverCtx<'_>, out: &mut Discovery, why: &str) {
     let mut found = Discovery::default();
-    extract_with(ctx, &mut found, true).await;
+    extract_with(ctx, &mut found, Governing::Root).await;
     out.diagnostics.append(&mut found.diagnostics);
     for r in found.refs {
         let file = r.source_file.to_string_lossy().into_owned();
@@ -236,22 +272,30 @@ async fn withhold(ctx: &DiscoverCtx<'_>, out: &mut Discovery, why: &str) {
     }
 }
 
-/// [`extract`], with `workspaces` false under `GOWORK=off`: go then ignores
+/// [`extract`] under the `governing` workspace. In module mode go ignores
 /// `go.work`, its replaces and its sum files.
-async fn extract_with(ctx: &DiscoverCtx<'_>, out: &mut Discovery, workspaces: bool) {
+async fn extract_with(ctx: &DiscoverCtx<'_>, out: &mut Discovery, governing: Governing<'_>) {
     let go_mod = match ctx.read_text(GO_MOD, out).await {
         Some(text) => parse_go_file(GO_MOD, &text, out),
         None => None,
     };
-    let go_work = if workspaces {
-        ctx.read_text(GO_WORK, out).await
-    } else {
-        None
+    // The root's go.work is read whenever a workspace governs: its
+    // replaces are the build's when it is that workspace, and Socket
+    // wiring left unread otherwise ([`Workspace::bypass`]).
+    let go_work = match governing {
+        Governing::Module => None,
+        Governing::Root | Governing::Loaded(..) => ctx.read_text(GO_WORK, out).await,
     };
     let go_work = go_work.and_then(|text| parse_go_file(GO_WORK, &text, out));
-    let workspace = match go_work.as_deref() {
-        Some(work) => Some(read_workspace(ctx, out, go_mod.as_deref(), work).await),
-        None => None,
+    let workspace = match governing {
+        Governing::Module => None,
+        Governing::Root => match go_work.as_deref() {
+            Some(work) => Some(read_workspace(ctx, out, go_mod.as_deref(), work).await),
+            None => None,
+        },
+        Governing::Loaded(root, model) => {
+            Some(read_loaded_workspace(ctx, out, go_mod.as_deref(), root, model).await)
+        }
     };
 
     // The go.mod files whose replaces apply: the root's, or (a go.work root
@@ -307,7 +351,7 @@ async fn extract_with(ctx: &DiscoverCtx<'_>, out: &mut Discovery, workspaces: bo
         sums = SumPins::read(ctx, out, &sum_files).await;
     }
     for (file, entries) in &files {
-        extract_file(out, file, entries, &graph, &sums);
+        extract_file(out, file, entries, &graph, &sums, workspace.as_ref());
     }
 }
 
@@ -385,16 +429,71 @@ impl<'a> Graph<'a> {
 
 /// The `go.work` in effect, as discovery reads it.
 struct Workspace {
-    /// Members outside the root, or whose go.mod is unreadable, carry no
-    /// go.mod, which leaves every selection unknown.
+    /// Members whose go.mod is unreadable (or, in memory, outside the
+    /// root) carry no go.mod, which leaves every selection unknown.
     model: GoWorkspace,
     /// `(root-relative dir, index into model.members)` of in-root members.
     in_root: Vec<(String, usize)>,
-    /// The sum files go verifies against in workspace mode: `go.work.sum`
-    /// and each member's `go.sum` (the root's only when `.` is a member).
+    /// The sum files go verifies against in workspace mode that lie in the
+    /// project: `go.work.sum` (when go.work is the root's) and each in-root
+    /// member's `go.sum` (the root's only when `.` is a member).
     sum_files: Vec<String>,
+    /// The project root the model's paths are matched against (empty in
+    /// memory, where the model's paths are root-relative).
+    root: std::path::PathBuf,
+    /// Whether the model is the root's own `go.work`.
+    rooted: bool,
 }
 
+impl Workspace {
+    /// Why the Socket replace `entry` of `module@version` in the
+    /// root-relative `file` does not reach the build of this workspace
+    /// although it is wired (`None`: it does): go reads another `go.work`
+    /// than the root's, or the workspace overrides, ignores or rejects the
+    /// replace as the hosted and vendored writers' own check
+    /// ([`go_workspace::Loaded::host_conflict`]) says before they write one.
+    fn bypass(&self, file: &str, entry: &ReplaceEntry, version: &str) -> Option<String> {
+        let module = entry.module.as_str();
+        if file == GO_WORK {
+            if !self.rooted {
+                return Some(format!(
+                    "go builds the workspace of {}, never this directory's {GO_WORK}, so its \
+                     replace of {module} {version} has no effect",
+                    go_workspace::display_path(&self.root, &self.model.work_file)
+                ));
+            }
+            return self
+                .model
+                .work_conflict(&self.root, module, version, entry)
+                .map(|c| {
+                    format!(
+                        "the {GO_WORK} replace of {module} {version} {}",
+                        c.consequence(module, version)
+                    )
+                });
+        }
+        let dir = file
+            .strip_suffix(GO_MOD)
+            .unwrap_or_default()
+            .trim_end_matches('/');
+        let project = if dir.is_empty() {
+            self.root.clone()
+        } else {
+            self.root.join(dir)
+        };
+        self.model
+            .conflict(&project, module, version, entry)
+            .map(|c| {
+                format!(
+                    "the {file} replace of {module} {version} {}",
+                    c.consequence(module, version)
+                )
+            })
+    }
+}
+
+/// The root's own `go.work` (`go_work`) and its in-root members, read
+/// through the view: the workspace in memory, and what [`withhold`] reports.
 async fn read_workspace(
     ctx: &DiscoverCtx<'_>,
     out: &mut Discovery,
@@ -413,17 +512,7 @@ async fn read_workspace(
             });
             continue;
         };
-        let text = if dir.is_empty() {
-            go_mod.map(str::to_string)
-        } else {
-            let rel = member_file(&dir, GO_MOD);
-            match ctx.read_text(&rel, out).await {
-                Some(text) => parse_go_file(&rel, &text, out),
-                None => None,
-            }
-        };
-        let sum = member_file(&dir, GO_SUM);
-        let go_sum = ctx.read_text(&sum, out).await;
+        let (text, go_sum, sum) = read_member(ctx, out, go_mod, &dir).await;
         if !sum_files.contains(&sum) {
             sum_files.push(sum);
         }
@@ -435,29 +524,92 @@ async fn read_workspace(
         });
     }
     let work_sum = ctx.read_text(GO_WORK_SUM, out).await;
-    let mut model = GoWorkspace {
+    let model = GoWorkspace {
         work_file: GO_WORK.into(),
         work: go_work.to_string(),
         work_sum,
         members,
         graph: None,
     };
-    if let Some(root) = ctx.disk_root() {
-        let mut on_disk = model.clone();
-        on_disk.work_file = root.join(GO_WORK);
-        for member in &mut on_disk.members {
-            member.dir = root.join(&member.dir);
+    Workspace {
+        model,
+        in_root,
+        sum_files,
+        root: std::path::PathBuf::new(),
+        rooted: true,
+    }
+}
+
+/// The workspace go resolves for the project at `root` on disk
+/// ([`go_workspace::load_with`]), with every member wherever it lies. The
+/// in-root members' go.mod and go.sum are re-read through the view, so
+/// their Socket identities are recognized and a go.mod go cannot parse is
+/// diagnosed; the others keep what the loader read. The module graph is
+/// read from the module cache, as the hosted engine reads it.
+async fn read_loaded_workspace(
+    ctx: &DiscoverCtx<'_>,
+    out: &mut Discovery,
+    go_mod: Option<&str>,
+    root: &Path,
+    mut model: GoWorkspace,
+) -> Workspace {
+    let rooted = model.rooted_at(root);
+    let base = same_dir_key(root);
+    let mut in_root = Vec::new();
+    let mut sum_files = Vec::new();
+    if rooted {
+        sum_files.push(GO_WORK_SUM.to_string());
+    }
+    for (index, member) in model.members.iter_mut().enumerate() {
+        let Ok(rel) = same_dir_key(&member.dir)
+            .strip_prefix(&base)
+            .map(|rel| rel.to_string_lossy().replace('\\', "/"))
+        else {
+            continue;
+        };
+        let (text, go_sum, sum) = read_member(ctx, out, go_mod, &rel).await;
+        member.go_mod = text;
+        member.go_sum = go_sum;
+        if !sum_files.contains(&sum) {
+            sum_files.push(sum);
         }
-        on_disk.read_graph().await;
-        model.graph = on_disk.graph;
+        in_root.push((rel, index));
     }
+    // The loader read go.work, go.work.sum and every member outside the
+    // view, and the module graph reads the module cache.
+    let _ = ctx.disk_root();
+    model.read_graph().await;
     Workspace {
         model,
         in_root,
         sum_files,
+        root: root.to_path_buf(),
+        rooted,
     }
 }
 
+/// An in-root member's go.mod (the root's own `go_mod` for `""`), its
+/// go.sum, and the go.sum's root-relative path.
+async fn read_member(
+    ctx: &DiscoverCtx<'_>,
+    out: &mut Discovery,
+    go_mod: Option<&str>,
+    dir: &str,
+) -> (Option<String>, Option<String>, String) {
+    let text = if dir.is_empty() {
+        go_mod.map(str::to_string)
+    } else {
+        let rel = member_file(dir, GO_MOD);
+        match ctx.read_text(&rel, out).await {
+            Some(text) => parse_go_file(&rel, &text, out),
+            None => None,
+        }
+    };
+    let sum = member_file(dir, GO_SUM);
+    let go_sum = ctx.read_text(&sum, out).await;
+    (text, go_sum, sum)
+}
+
 /// Normalize a go.mod-grammar file (BOM, simple string literals) and check
 /// its block structure; `None` (with a diagnostic) when go could not parse
 /// it at all.
@@ -481,8 +633,24 @@ fn extract_file(
     entries: &[ReplaceEntry],
     graph: &Graph<'_>,
     sums: &SumPins,
+    workspace: Option<&Workspace>,
 ) {
     let required = &graph.required;
+    // A wired replace the workspace keeps from the build stays a ref (so
+    // list, rollback and remove find it) but is never attested.
+    let bypass = |out: &mut Discovery, purl: &str, uuid: &str, entry: &ReplaceEntry| {
+        let req = required.get(&entry.module).map(String::as_str);
+        let version = entry.version.as_deref().or(req).unwrap_or_default();
+        if let Some(detail) = workspace.and_then(|ws| ws.bypass(file, entry, version)) {
+            out.unattested(
+                purl,
+                uuid,
+                file,
+                detail,
+                UnattestedKind::GoWorkspaceOverride,
+            );
+        }
+    };
     // Versioned directives of ANY owner: they shadow a version-less replace
     // of the same module at that version.
     let versioned: HashSet<(&str, &str)> = entries
@@ -574,6 +742,7 @@ fn extract_file(
                     SumPin::Unpinned => (None, true),
                 };
                 let url = format!("{rhs}@{rhs_version}");
+                bypass(out, &purl, &uuid, entry);
                 out.push(PatchedRef::hosted(
                     purl,
                     uuid,
@@ -619,6 +788,7 @@ fn extract_file(
                     );
                     continue;
                 }
+                bypass(out, &purl, &vref.uuid, entry);
                 out.push(PatchedRef::vendored(purl, &vref, file, None));
             }
             // Socket-shaped but not something we write (another tree's copy,
@@ -859,12 +1029,12 @@ mod tests {
         "module example.com/app\n\ngo 1.21\n\nrequire github.com/foo/bar v1.4.2\n";
 
     async fn run(p: &Project) -> Discovery {
-        p.run(|c, o| Box::pin(super::extract_with(c, o, true)))
+        p.run(|c, o| Box::pin(super::extract_gowork(c, o, None)))
             .await
     }
 
     async fn gowork_off(p: &Project) -> Discovery {
-        p.run(|c, o| Box::pin(super::extract_with(c, o, false)))
+        p.run(|c, o| Box::pin(super::extract_gowork(c, o, Some("off"))))
             .await
     }
 
@@ -1920,11 +2090,11 @@ mod tests {
         assert_refs(&gowork_off(&p).await, &[]);
     }
 
-    /// An explicit `GOWORK` other than the root's go.work (another file, or a
-    /// relative path go rejects) leaves the workspace unread: what discovery
-    /// finds is diagnosed, never a ref.
+    /// An explicit `GOWORK` go refuses (a relative path, a file it cannot
+    /// read) leaves no build: what discovery finds is diagnosed, never a
+    /// ref.
     #[tokio::test]
-    async fn gowork_naming_another_workspace_attests_nothing() {
+    async fn gowork_go_refuses_attests_nothing() {
         let m = gopatch(UUID_A);
         let sver = "v1.4.2-socketpatch.1";
         let p = Project::new();
@@ -1964,8 +2134,8 @@ mod tests {
         let missing = outside.path().join("nonexistent").join("go.work");
         for (gowork, why) in [
             ("go.work".to_string(), "not an absolute path"),
-            (missing.to_string_lossy().into_owned(), "other than"),
-            (elsewhere.to_string_lossy().into_owned(), "other than"),
+            (missing.to_string_lossy().into_owned(), "cannot be read"),
+            (elsewhere.to_string_lossy().into_owned(), "cannot be read"),
         ] {
             let out = extract(Some(gowork.clone())).await;
             assert!(out.refs.is_empty(), "{gowork}");
@@ -2157,4 +2327,243 @@ mod tests {
             None
         );
     }
+
+    /// Whether `out` holds exactly the hosted ref of [`PURL`] marked
+    /// unattested as a Go workspace override (`Some(detail fragment)`), or
+    /// that ref attested (`None`).
+    fn assert_overridden(out: &Discovery, overridden: Option<&str>, case: &str) {
+        assert_refs(out, &[(PURL, UUID_A, WiringMode::Hosted)]);
+        assert!(out.diagnostics.is_empty(), "{case}: {:?}", out.diagnostics);
+        match overridden {
+            Some(why) => {
+                assert_eq!(out.unattested.len(), 1, "{case}: {:?}", out.unattested);
+                let u = &out.unattested[0];
+                assert_eq!(u.kind, UnattestedKind::GoWorkspaceOverride, "{case}");
+                assert_eq!((u.purl.as_str(), u.uuid.as_str()), (PURL, UUID_A), "{case}");
+                assert!(u.detail.contains(why), "{case}: {}", u.detail);
+            }
+            None => assert!(out.unattested.is_empty(), "{case}: {:?}", out.unattested),
+        }
+    }
+
+    /// G1: with `GOWORK` unset go builds a module inside an ancestor's
+    /// `go.work` in that workspace, as the hosted and vendored writers
+    /// resolve it. Its replace of the module overrides the root go.mod's,
+    /// a workspace that doesn't `use` the module ignores it, and another
+    /// member's higher `require` makes it inert: none of those is attested.
+    #[tokio::test]
+    async fn ancestor_go_work_governs_the_root_module() {
+        let m = gopatch(UUID_A);
+        let sver = "v1.4.2-socketpatch.1";
+        let svc = |require: &str| format!("module example.com/svc\n\ngo 1.21\n{require}");
+        for (case, work, svc_mod, overridden, inert) in [
+            (
+                "overriding replace",
+                format!("go 1.21\n\nuse ./app\n\nreplace {MODULE} {VERSION} => ./fork\n"),
+                None,
+                Some("has no effect"),
+                false,
+            ),
+            (
+                "module not used",
+                "go 1.21\n\nuse ./svc\n".to_string(),
+                Some(svc("")),
+                Some("does not `use` this module"),
+                false,
+            ),
+            (
+                "member raises the module",
+                "go 1.21\n\nuse (\n\t./app\n\t./svc\n)\n".to_string(),
+                Some(svc(&format!("\nrequire {MODULE} v1.5.0\n"))),
+                None,
+                true,
+            ),
+            (
+                "workspace uses the module",
+                "go 1.21\n\nuse ./app\n".to_string(),
+                None,
+                None,
+                false,
+            ),
+        ] {
+            let p = Project::nested("app");
+            p.write(
+                "go.mod",
+                format!("{BASE_GO_MOD}\nreplace {MODULE} {VERSION} => {m} {sver}\n"),
+            )
+            .write("go.sum", go_sum_for(UUID_A, sver))
+            .write("../go.work", &work);
+            if let Some(text) = &svc_mod {
+                p.write("../svc/go.mod", text);
+            }
+            let out = run(&p).await;
+            if inert {
+                assert_refs(&out, &[]);
+                assert!(
+                    out.diagnostics
+                        .iter()
+                        .any(|d| d.code == DIAG_REF_INVALID && d.detail.contains("v1.5.0")),
+                    "{case}: {:?}",
+                    out.diagnostics
+                );
+            } else {
+                assert_overridden(&out, overridden, case);
+            }
+            // GOWORK=off: module mode, the root go.mod's replace is built.
+            let out = gowork_off(&p).await;
+            assert_overridden(&out, None, case);
+            assert!(out.refs[0].lockfile_basis_ok(), "{case}");
+        }
+    }
+
+    /// G1: a `GOWORK` naming another readable workspace is the one go
+    /// builds: it governs the root module as an ancestor's would, and the
+    /// root's own `go.work` replaces are never read.
+    #[tokio::test]
+    async fn gowork_naming_another_workspace_governs() {
+        let m = gopatch(UUID_A);
+        let sver = "v1.4.2-socketpatch.1";
+        let ours = format!("replace {MODULE} {VERSION} => {m} {sver}\n");
+        async fn extract(p: &Project, gowork: String) -> Discovery {
+            let ctx = p.ctx();
+            let mut out = Discovery::default();
+            super::extract_gowork(&ctx, &mut out, Some(&gowork)).await;
+            out
+        }
+        for (case, work, overridden) in [
+            (
+                "overriding replace",
+                format!("go 1.21\n\nuse ../app\n\nreplace {MODULE} => ./fork\n"),
+                Some("has no effect"),
+            ),
+            (
+                "module not used",
+                "go 1.21\n\nuse ../other\n".to_string(),
+                Some("does not `use` this module"),
+            ),
+            (
+                "uses the module",
+                "go 1.21\n\nuse ../app\n".to_string(),
+                None,
+            ),
+        ] {
+            let p = Project::nested("app");
+            p.write("go.mod", format!("{BASE_GO_MOD}\n{ours}"))
+                .write("go.sum", go_sum_for(UUID_A, sver))
+                .write("../ci/go.work", &work);
+            let gowork = p
+                .root()
+                .join("../ci/go.work")
+                .to_string_lossy()
+                .into_owned();
+            assert_overridden(&extract(&p, gowork).await, overridden, case);
+        }
+
+        // The root's own go.work holds the wiring, but GOWORK sends go
+        // elsewhere: still a ref, never attested.
+        let p = Project::nested("app");
+        p.write("go.mod", BASE_GO_MOD)
+            .write("go.work", format!("go 1.21\n\nuse .\n\n{ours}"))
+            .write("go.work.sum", go_sum_for(UUID_A, sver))
+            .write("../ci/go.work", "go 1.21\n\nuse ../app\n");
+        let gowork = p
+            .root()
+            .join("../ci/go.work")
+            .to_string_lossy()
+            .into_owned();
+        let out = extract(&p, gowork).await;
+        assert_overridden(&out, Some("never this directory's go.work"), "root go.work");
+        assert_eq!(out.refs[0].source_file, std::path::PathBuf::from("go.work"));
+        // Its own go.work named explicitly is the workspace again.
+        let own = p.root().join("go.work").to_string_lossy().into_owned();
+        assert_overridden(&extract(&p, own).await, None, "own go.work");
+    }
+
+    /// G1: a `use` member outside the root is part of the workspace go
+    /// builds: its `require` can raise the module, and its own replace of
+    /// the same `module@version` makes go refuse the workspace.
+    #[tokio::test]
+    async fn workspace_member_outside_the_root_is_read() {
+        let m = gopatch(UUID_A);
+        let sver = "v1.4.2-socketpatch.1";
+        let svc = |extra: &str| format!("module example.com/svc\n\ngo 1.21\n{extra}");
+        for (case, svc_mod, overridden, inert) in [
+            (
+                "member raises the module",
+                svc(&format!("\nrequire {MODULE} v1.5.0\n")),
+                None,
+                true,
+            ),
+            (
+                "member replaces the module elsewhere",
+                svc(&format!(
+                    "\nrequire {MODULE} {VERSION}\n\nreplace {MODULE} {VERSION} => ./fork\n"
+                )),
+                Some("conflicts with"),
+                false,
+            ),
+            (
+                "member requires the same version",
+                svc(&format!("\nrequire {MODULE} {VERSION}\n")),
+                None,
+                false,
+            ),
+        ] {
+            let p = Project::nested("app");
+            p.write(
+                "go.mod",
+                format!("{BASE_GO_MOD}\nreplace {MODULE} {VERSION} => {m} {sver}\n"),
+            )
+            .write("go.sum", go_sum_for(UUID_A, sver))
+            .write("go.work", "go 1.21\n\nuse (\n\t.\n\t../svc\n)\n")
+            .write("../svc/go.mod", &svc_mod);
+            let out = run(&p).await;
+            if inert {
+                assert_refs(&out, &[]);
+                assert!(
+                    out.diagnostics.iter().any(|d| d.code == DIAG_REF_INVALID
+                        && d.detail.contains("is inert")
+                        && d.detail.contains("v1.5.0")),
+                    "{case}: {:?}",
+                    out.diagnostics
+                );
+            } else {
+                assert_overridden(&out, overridden, case);
+            }
+        }
+    }
+
+    /// In memory the root `go.work` and its in-root members are the
+    /// workspace (as the in-memory hosted engine reads them), with the same
+    /// gate: a root module the go.work doesn't `use` is never attested.
+    #[tokio::test]
+    async fn in_memory_root_go_work_governs_the_root_module() {
+        use crate::vendor::lock_inventory::{MemoryProject, ProjectView};
+        let m = gopatch(UUID_A);
+        let sver = "v1.4.2-socketpatch.1";
+        for (case, work, overridden) in [
+            ("module not used", "go 1.21\n\nuse ./svc\n", true),
+            ("module used", "go 1.21\n\nuse (\n\t.\n\t./svc\n)\n", false),
+        ] {
+            let mut project = MemoryProject::new();
+            project.insert_text(
+                "go.mod",
+                format!("{BASE_GO_MOD}\nreplace {MODULE} {VERSION} => {m} {sver}\n"),
+            );
+            project.insert_text("go.sum", go_sum_for(UUID_A, sver));
+            project.insert_text("go.work", work);
+            project.insert_text(
+                "svc/go.mod",
+                format!("module example.com/svc\n\ngo 1.21\n\nrequire {MODULE} {VERSION}\n"),
+            );
+            let ctx = DiscoverCtx::over(ProjectView::Memory(&project), &[]);
+            let mut out = Discovery::default();
+            super::extract_gowork(&ctx, &mut out, None).await;
+            assert_refs(&out, &[(PURL, UUID_A, WiringMode::Hosted)]);
+            assert_eq!(out.unattested.len(), usize::from(overridden), "{case}");
+            if overridden {
+                assert_eq!(out.unattested[0].kind, UnattestedKind::GoWorkspaceOverride);
+            }
+        }
+    }
 }
diff --git a/crates/socket-patch-core/src/vex/discover/mod.rs b/crates/socket-patch-core/src/vex/discover/mod.rs
index 815d4644d..53d002134 100644
--- a/crates/socket-patch-core/src/vex/discover/mod.rs
+++ b/crates/socket-patch-core/src/vex/discover/mod.rs
@@ -606,6 +606,12 @@ pub enum UnattestedKind {
     /// version: the classifier-less pin does not retarget it and the grant
     /// serves only the main jar, so the build runs the public classifier jar.
     MavenClassifierUnpatched,
+    /// A Go `replace` the workspace go resolves keeps from the build: that
+    /// `go.work` (an ancestor's, or one `GOWORK` names) is not the root's,
+    /// overrides the replace, does not `use` its module, or another member
+    /// replaces the same module elsewhere — exactly where the hosted and
+    /// vendored writers refuse to write one.
+    GoWorkspaceOverride,
 }
 
 /// A ref discovery emits (so rollback, remove and list find the wiring,
diff --git a/docs/ecosystems.md b/docs/ecosystems.md
index b03dc6665..233add69c 100644
--- a/docs/ecosystems.md
+++ b/docs/ecosystems.md
@@ -1543,9 +1543,12 @@ Every Go path (`apply`, `vendor`, `scan --mode hosted`, `vex`, `list`,
 otherwise (`GOWORK` unset, empty or `auto`) the nearest `go.work` at or
 above the project. A relative `GOWORK` makes go fail
 (`invalid GOWORK: not an absolute path`), so socket-patch writes nothing for
-it and attests nothing. `vex` reads only the project's own `go.work`: when
-`GOWORK` names any other file, it attests none of the project's Go patches
-and reports each as `patched_ref_invalid`.
+it and attests nothing. `vex` reads the same workspace, members outside the
+project included: a Socket replace that workspace overrides, ignores or
+rejects (the check the writers run before writing one), or one in the
+project's own `go.work` while go builds another, stays listed, so `list`,
+`rollback` and `remove` find it, but is not attested
+(`go_workspace_override`).
 
 `GOFLAGS` is read the same way (the environment, then the `go env -w`
 file). A `-modfile` in it that names any file other than the project's

From 3f452d18f44aedddc0a5ae811d64cc2ca9aab06c Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 5 Nov 2026 18:23:50 +0000
Subject: [PATCH 2/4] Keep Go replaces the workspace ignores even when they
 look inert

Version-selection inertness in replaced_purl, and the hosted selection
checks, ran before Workspace::bypass. A Socket replace that the
governing go.work also refuses (not used, overridden by a go.work
replace, member conflict) was dropped as inert with a diagnostic
instead of being kept as a GoWorkspaceOverride ref, so list, rollback
and remove could not find wiring that re-running scan or vendor would
never clear. Compute the bypass first and skip the inertness checks for
a bypassed replace; it stays a ref and is reported unattested.

Found by Cursor Bugbot on #2011.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .../src/vex/discover/golang.rs                | 83 +++++++++++++++----
 1 file changed, 67 insertions(+), 16 deletions(-)

diff --git a/crates/socket-patch-core/src/vex/discover/golang.rs b/crates/socket-patch-core/src/vex/discover/golang.rs
index da6dd30c3..dcf317486 100644
--- a/crates/socket-patch-core/src/vex/discover/golang.rs
+++ b/crates/socket-patch-core/src/vex/discover/golang.rs
@@ -636,12 +636,18 @@ fn extract_file(
     workspace: Option<&Workspace>,
 ) {
     let required = &graph.required;
-    // A wired replace the workspace keeps from the build stays a ref (so
-    // list, rollback and remove find it) but is never attested.
-    let bypass = |out: &mut Discovery, purl: &str, uuid: &str, entry: &ReplaceEntry| {
+    // Why the workspace keeps a wired replace from the build, if it does.
+    // Such a replace stays a ref (so list, rollback and remove find it) but
+    // is never attested, and it is checked before version-selection
+    // inertness: a replace go never applies here is not "inert" in a way a
+    // re-run of scan or vendor clears, so dropping it would hide wiring.
+    let bypass_of = |entry: &ReplaceEntry| {
         let req = required.get(&entry.module).map(String::as_str);
         let version = entry.version.as_deref().or(req).unwrap_or_default();
-        if let Some(detail) = workspace.and_then(|ws| ws.bypass(file, entry, version)) {
+        workspace.and_then(|ws| ws.bypass(file, entry, version))
+    };
+    let mark_bypassed = |out: &mut Discovery, purl: &str, uuid: &str, bypassed: Option<String>| {
+        if let Some(detail) = bypassed {
             out.unattested(
                 purl,
                 uuid,
@@ -690,7 +696,10 @@ fn extract_file(
                     );
                     continue;
                 };
-                let Some(purl) = replaced_purl(entry, graph, &versioned, file, out) else {
+                let bypassed = bypass_of(entry);
+                let Some(purl) =
+                    replaced_purl(entry, graph, &versioned, file, out, bypassed.is_some())
+                else {
                     continue;
                 };
                 // `replaced_purl` resolved the version from one of the two.
@@ -706,7 +715,7 @@ fn extract_file(
                 // A module go builds only as another module's replacement
                 // is never redirected by its own replace, whatever the sum
                 // files hold: go doesn't chain replaces (#1823).
-                if let Selection::ReplaceTarget(via) = &selected {
+                if let (Selection::ReplaceTarget(via), None) = (&selected, &bypassed) {
                     out.diag(
                         DIAG_REF_INVALID,
                         file,
@@ -720,7 +729,10 @@ fn extract_file(
                     );
                     continue;
                 }
-                if let Some(other) = selected.other_version().filter(|_| !proven) {
+                if let Some(other) = selected
+                    .other_version()
+                    .filter(|_| !proven && bypassed.is_none())
+                {
                     out.diag(
                         DIAG_REF_INVALID,
                         file,
@@ -742,7 +754,7 @@ fn extract_file(
                     SumPin::Unpinned => (None, true),
                 };
                 let url = format!("{rhs}@{rhs_version}");
-                bypass(out, &purl, &uuid, entry);
+                mark_bypassed(out, &purl, &uuid, bypassed);
                 out.push(PatchedRef::hosted(
                     purl,
                     uuid,
@@ -774,7 +786,10 @@ fn extract_file(
                     );
                     continue;
                 };
-                let Some(purl) = replaced_purl(entry, graph, &versioned, file, out) else {
+                let bypassed = bypass_of(entry);
+                let Some(purl) =
+                    replaced_purl(entry, graph, &versioned, file, out, bypassed.is_some())
+                else {
                     continue;
                 };
                 if vendored_leaf_purl("golang", &vref.leaf).as_deref() != Some(purl.as_str()) {
@@ -788,7 +803,7 @@ fn extract_file(
                     );
                     continue;
                 }
-                bypass(out, &purl, &vref.uuid, entry);
+                mark_bypassed(out, &purl, &vref.uuid, bypassed);
                 out.push(PatchedRef::vendored(purl, &vref, file, None));
             }
             // Socket-shaped but not something we write (another tree's copy,
@@ -831,13 +846,16 @@ fn is_foreign_socket_target(entry: &ReplaceEntry) -> bool {
 
 /// `pkg:golang/<M>@<v>` for the module a Socket `replace` substitutes, with
 /// the version the build actually applies it at — or `None` (diagnosed)
-/// when the directive is inert or its version is unknowable.
+/// when the directive is inert or its version is unknowable. A replace the
+/// workspace keeps from the build (`bypassed`) is never judged inert: it
+/// stays a ref, at the version it names, so it is reported as unattested.
 fn replaced_purl(
     entry: &ReplaceEntry,
     graph: &Graph<'_>,
     versioned: &HashSet<(&str, &str)>,
     file: &str,
     out: &mut Discovery,
+    bypassed: bool,
 ) -> Option<String> {
     let module = entry.module.as_str();
     let req = graph.required.get(module).map(String::as_str);
@@ -849,7 +867,7 @@ fn replaced_purl(
     let version = match (entry.version.as_deref(), req) {
         // In a workspace a dependency can raise the module above every
         // member's `require`; a pin of the version the graph selects is live.
-        (Some(v), Some(r)) if v != r && !graph.selects(module, v) => {
+        (Some(v), Some(r)) if !bypassed && v != r && !graph.selects(module, v) => {
             out.diag(
                 DIAG_REF_INVALID,
                 file,
@@ -861,7 +879,7 @@ fn replaced_purl(
             return None;
         }
         (Some(v), _) => v,
-        (None, Some(r)) if versioned.contains(&(module, r)) => {
+        (None, Some(r)) if !bypassed && versioned.contains(&(module, r)) => {
             out.diag(
                 DIAG_REF_INVALID,
                 file,
@@ -2307,14 +2325,28 @@ mod tests {
             owner: Some(ReplaceOwner::Hosted),
         };
         let mut out = Discovery::default();
-        let purl = replaced_purl(&entry("v1.5.0"), &graph, &HashSet::new(), GO_WORK, &mut out);
+        let purl = replaced_purl(
+            &entry("v1.5.0"),
+            &graph,
+            &HashSet::new(),
+            GO_WORK,
+            &mut out,
+            false,
+        );
         assert_eq!(
             purl.as_deref(),
             Some("pkg:golang/github.com/foo/bar@v1.5.0")
         );
         assert!(out.diagnostics.is_empty(), "{:?}", out.diagnostics);
         // A version the graph does not select stays inert.
-        let purl = replaced_purl(&entry("v1.6.0"), &graph, &HashSet::new(), GO_WORK, &mut out);
+        let purl = replaced_purl(
+            &entry("v1.6.0"),
+            &graph,
+            &HashSet::new(),
+            GO_WORK,
+            &mut out,
+            false,
+        );
         assert_eq!(purl, None);
         assert_eq!(out.diagnostics.len(), 1, "{:?}", out.diagnostics);
         assert!(out.diagnostics[0].detail.contains("is inert"));
@@ -2323,7 +2355,14 @@ mod tests {
         let graph = Graph::new(None, Some(&ws), None);
         let mut out = Discovery::default();
         assert_eq!(
-            replaced_purl(&entry("v1.5.0"), &graph, &HashSet::new(), GO_WORK, &mut out),
+            replaced_purl(
+                &entry("v1.5.0"),
+                &graph,
+                &HashSet::new(),
+                GO_WORK,
+                &mut out,
+                false
+            ),
             None
         );
     }
@@ -2351,6 +2390,8 @@ mod tests {
     /// resolve it. Its replace of the module overrides the root go.mod's,
     /// a workspace that doesn't `use` the module ignores it, and another
     /// member's higher `require` makes it inert: none of those is attested.
+    /// A replace the workspace ignores stays a ref even when a member
+    /// raises the module too.
     #[tokio::test]
     async fn ancestor_go_work_governs_the_root_module() {
         let m = gopatch(UUID_A);
@@ -2371,6 +2412,16 @@ mod tests {
                 Some("does not `use` this module"),
                 false,
             ),
+            // The workspace ignores the replace AND selects another version:
+            // the bypass, not the version, says why it is unattested, so
+            // the wiring stays a ref instead of being dropped as inert.
+            (
+                "module not used, member raises the module",
+                "go 1.21\n\nuse ./svc\n".to_string(),
+                Some(svc(&format!("\nrequire {MODULE} v1.5.0\n"))),
+                Some("does not `use` this module"),
+                false,
+            ),
             (
                 "member raises the module",
                 "go 1.21\n\nuse (\n\t./app\n\t./svc\n)\n".to_string(),

From 2984629c2f7f0443f58baa5e0c65f8d48eea16c3 Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Thu, 5 Nov 2026 13:37:39 -0600
Subject: [PATCH 3/4] Address code review findings on Go workspace discovery

This fixes the confirmed /code-review high findings on #2011. Each fix
has a test that fails on the previous commit.

- A Go workspace mark now applies to one file only. The new
  UnattestedKind::file_scoped is true only for GoWorkspaceOverride.
  vex_sources drops the bypassed ref from the candidate's basis and
  vetoes the patch only when no live ref of it remains. wiring_conflicts
  ignores bypassed refs. So a root go.work replace that go never reads no
  longer withholds the root go.mod's mirror of it. A leftover member pin
  that Socket's own go.work replace overrides no longer turns into a
  wiring conflict that also withholds the go.work patch, which is what
  vex.rs's WorkHosted exemption intends.
- A replace of a module that is itself a `use` member is diagnosed as
  inert again, both on disk and in memory, hosted and vendored. This
  check now runs before the workspace bypass.
- SumPins now also reads the sum files the loader already read: the
  governing go.work.sum and each out-of-root member's go.sum. They are
  used only when they lie inside the git repository.
- In memory, workspace conflicts are evaluated in
  go_workspace::PathSpace::Memory. Paths are compared lexically against
  the view's files and never against the filesystem or the working
  directory. conflict/work_conflict delegate to the new *_in variants,
  so disk behavior is unchanged.
- The snapshot probe list is now built by one shared helper
  (workspace_probes), spelled the way resolve_with spells it.
- A root go.work that go doesn't read is no longer judged unparseable,
  and its wiring stays an unattested ref.
- The go_workspace_override omission phrase now covers every case.
- read_loaded_workspace uses members_within. The view re-reads only the
  in-root members' go.mod, which recognition and parse diagnostics need.
  The duplicate go.sum and go.work.sum reads are gone.
- Tests that use a nested project now create a .git, so they keep
  working once reads are bounded to the repository root (#2025).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/socket-patch-cli/CLI_CONTRACT.md       |   2 +-
 crates/socket-patch-cli/src/commands/vex.rs   |   5 +-
 .../src/commands/vex_sources.rs               | 140 +++++-
 .../src/vendor/go_workspace.rs                | 163 +++++--
 .../src/vex/discover/golang.rs                | 441 ++++++++++++++----
 .../socket-patch-core/src/vex/discover/mod.rs |  11 +
 6 files changed, 630 insertions(+), 132 deletions(-)

diff --git a/crates/socket-patch-cli/CLI_CONTRACT.md b/crates/socket-patch-cli/CLI_CONTRACT.md
index 785d8cfe4..58f02b836 100644
--- a/crates/socket-patch-cli/CLI_CONTRACT.md
+++ b/crates/socket-patch-cli/CLI_CONTRACT.md
@@ -533,7 +533,7 @@ Discovery is read-only, never touches the network, and never fails the run: a ma
 | bun | `bun.lock`; `bun.lockb` only when there is no `bun.lock` (bun reads exactly one) | URL tuple / binary remote-tarball resolution; version from the URL leaf. A user URL or `file:` tarball tuple / record whose `<name>-<ver>.tgz` leaf names the same `name@version` is installed from its own spec, so every ref for that `name@version` is dropped | `.socket/vendor/npm/<uuid>/<name>-<ver>.tgz` tuple / local-tarball resolution | `sha512-…`, required. A 2-tuple that Bun < 1.3.10 re-saved without its digest is still a reference, but it attests only from an installed tree. |
 | vlt | `vlt-lock.json` (lockfileVersion absent, `0` or `1`; a BOM-prefixed, unparseable, non-object or other-version lock is not read: diagnosed, no ref). `vlt.json` (read only for its `modifiers`) and `node_modules/.vlt-lock.json` are never wiring. | a registry node (any segment) whose slot [3] is a `/patch/npm/…` URL on the patch host with the leaf `<bare>-<ver>.tgz` of its DepID's `name@version`, whose embedded `<name>/<ver>` path (when present) is that `name@version`, and slot [1] == name; version from the DepID | a `file` node `.socket/vendor/npm/<uuid>/<name>-<ver>/node_modules/<name>` (or a user-installed `<name>-<ver>.tgz`) with slot [1] == name; version from the path. A same-`name@version` registry node, or a diagnosed Socket-shaped one, beside it is diagnosed, no ref. | slot [2] `sha512-…`, required (a hosted node without one is no reference). A same-`name@version` node on another registry, or a diagnosed Socket-shaped one, keeps the reference but withholds the lockfile basis: only an installed tree whose every store copy verifies attests. So does a lock some vlt release discards, the conditions of `redirect_vlt_lockfile_version_missing`, `redirect_vlt_old_lockfile_ignored` and `redirect_vlt_scalar_registry_ignored` (which in-run `--vex` withholds too): every hosted reference in it keeps no pin, and one `patched_ref_unattributable` names them. |
 | cargo | `Cargo.lock`, `Cargo.toml`, `.cargo/config` (else `.cargo/config.toml`) | `Cargo.lock` `source = "sparse+…/<uuid>/index/"`, confirmed by `Cargo.toml`: a crate the root manifest declares must pin `registry = "socket-patch-<uuid>"`. A reverted pin is diagnosed, no ref. Another `[[package]]` of the same `name@version` from a non-Socket source (crates.io, git), which cargo locks beside the pin for a dependent added later and builds unpatched (#679), withholds the ref (`patched_ref_unattributable`, never attested) while `rollback` / `remove` still unwind it. | `[patch.<source>] <key> = { path = ".socket/vendor/cargo/<uuid>/<name>-<ver>" }` — primarily the root `Cargo.toml` (v5 `vendor`; key-agnostic: `<name>` is `package` when renamed, else the key, so `<name>-socket-<uuid8>` keys count), also the project config (pre-v5 wiring), live only while the lock holds a sourceless entry for it that is not in `[[patch.unused]]`; a manifest entry cargo ignores — the project config redefines its key with another path, or a `[patch."https://github.com/rust-lang/crates.io-index"]` table replaces `[patch.crates-io]` — is diagnosed (`patched_ref_invalid`), no ref | `checksum` (v1: `[metadata]`), required |
-| golang | `go.mod`, `go.work`, `go.sum`, `go.work.sum` | `replace M v => patch.socket.dev/gopatch/<uuid> <sver>` | `replace M v => ./.socket/vendor/golang/<uuid>/M@v` | the socket module's `/go.mod` go.sum line, required. The zip line (`h1:` of the module tree) is the locked integrity when present; `go mod tidy` prunes it when no package of the module is loaded and the build stays green, so the `/go.mod` line alone still attests from the lockfile, unless the main modules' `require`s or go.sum show the build selects another version (MVS keeps the `/go.mod` line of versions it only reads): then the replace is inert. With a `go.work` the main modules are its `use` members and the build selects by MVS over their module graph: each member's `require`s and the `go.mod` of every dependency go loads (read from its replacement directory or the module cache when the root is on disk). go keeps no member's `go.mod` tidy in workspace mode, so a member's dependency can raise the module past every `require`. A pin, zip line or not, whose replaced version a member's or a dependency's `require` raises is inert, as is one of a module that is itself a `use` member (go builds it from that directory). Sum-file zip lines are no evidence of the selection (go only appends to `go.work.sum`), and a `/go.mod`-only pin is never the lockfile basis in a workspace (`integrity_required = true`). Any mode writes the replace of a module a workspace shares into the root `go.work` (source `go.work`); a `go.work` root without a `go.mod` also reads each in-root member's `go.mod` replaces (source `<member>/go.mod`). On disk the workspace is the one go resolves, read as hosted and vendored modes read it: `GOWORK`, else the nearest `go.work` at or above the project, with `use` members anywhere (in memory: the root `go.work` and its in-root members). The sum files are the ones go reads inside the project: the root `go.sum`, or with a `go.work`, `go.work.sum` (when it is the root's) and each in-root `use` member's `go.sum` (the root's only when `.` is a member); under `GOWORK=off`, `go.work` and its replaces are ignored. A Socket replace that workspace keeps from the build, exactly where hosted and vendored modes refuse to write one (its `go.work` is an ancestor's or another file `GOWORK` names, so the root `go.work` is never read; it overrides the replace; it doesn't `use` the module; another member replaces the same `module@version` elsewhere), stays a reference but is unattested (`go_workspace_override`). A `GOWORK` go rejects (a relative path, a file it cannot read or parse) reports each Go ref as `patched_ref_invalid` instead, as does a `GOFLAGS` `-modfile` other than the root `go.mod`. A conflicting hash or a malformed `h1:` for the socket module+version, or a line of other than three tokens anywhere in a sum file, is no pin. A replace that `require` no longer selects (`require M v'`) is inert: diagnosed, no ref. |
+| golang | `go.mod`, `go.work`, `go.sum`, `go.work.sum` | `replace M v => patch.socket.dev/gopatch/<uuid> <sver>` | `replace M v => ./.socket/vendor/golang/<uuid>/M@v` | the socket module's `/go.mod` go.sum line, required. The zip line (`h1:` of the module tree) is the locked integrity when present; `go mod tidy` prunes it when no package of the module is loaded and the build stays green, so the `/go.mod` line alone still attests from the lockfile, unless the main modules' `require`s or go.sum show the build selects another version (MVS keeps the `/go.mod` line of versions it only reads): then the replace is inert. With a `go.work` the main modules are its `use` members and the build selects by MVS over their module graph: each member's `require`s and the `go.mod` of every dependency go loads (read from its replacement directory or the module cache when the root is on disk). go keeps no member's `go.mod` tidy in workspace mode, so a member's dependency can raise the module past every `require`. A pin, zip line or not, whose replaced version a member's or a dependency's `require` raises is inert, as is one of a module that is itself a `use` member (go builds it from that directory). Sum-file zip lines are no evidence of the selection (go only appends to `go.work.sum`), and a `/go.mod`-only pin is never the lockfile basis in a workspace (`integrity_required = true`). Any mode writes the replace of a module a workspace shares into the root `go.work` (source `go.work`); a `go.work` root without a `go.mod` also reads each in-root member's `go.mod` replaces (source `<member>/go.mod`). On disk the workspace is the one go resolves, read as hosted and vendored modes read it: `GOWORK`, else the nearest `go.work` at or above the project, with `use` members anywhere (in memory: the root `go.work` and its in-root members). The sum files are the ones go reads: the root `go.sum`, or with a `go.work`, its `go.work.sum` and each `use` member's `go.sum` (the root's only when `.` is a member), those outside the project only when inside the repository; under `GOWORK=off`, `go.work` and its replaces are ignored. A Socket replace that workspace keeps from the build, exactly where hosted and vendored modes refuse to write one (its `go.work` is an ancestor's or another file `GOWORK` names, so the root `go.work` is never read; it overrides the replace; it doesn't `use` the module; another member replaces the same `module@version` elsewhere), stays a reference but is unattested (`go_workspace_override`) for that file only: the root `go.mod`'s mirror of a `go.work` replace go never reads still attests. A replace of a module that is itself a `use` member is inert, diagnosed, never a reference. A `GOWORK` go rejects (a relative path, a file it cannot read or parse) reports each Go ref as `patched_ref_invalid` instead, as does a `GOFLAGS` `-modfile` other than the root `go.mod`. A conflicting hash or a malformed `h1:` for the socket module+version, or a line of other than three tokens anywhere in a sum file, is no pin. A replace that `require` no longer selects (`require M v'`) is inert: diagnosed, no ref. |
 | pypi | `uv.lock` (confirmed by `pyproject.toml` `[tool.uv.sources]` when present), PEP 723 `<script>.py.lock`, `pylock.toml` / `pylock.<name>.toml`, `poetry.lock`, `pdm.lock`, `Pipfile.lock`, `requirements.txt` + its in-root `-r` includes, PEP 508 direct references in `pyproject.toml` / `hatch.toml` | Socket-host artifact url | `.socket/vendor/pypi/<uuid>/<wheel>` naming the entry's own dist | sha256, required |
 | gem | `Gemfile.lock` and `gems.locked` (the `Gemfile` / `gems.rb` only to cross-check a merged multi-remote `GEM` section) | a `GEM` section whose remote ends `patch-registry/gem/<token>/<uuid>` | `PATH` remote `.socket/vendor/gem/<uuid>/<name>-<ver>` | `CHECKSUMS` sha256, required only when the lock has a `CHECKSUMS` section (bundler ≥ 2.6) |
 | composer | `composer.lock` (`packages` + `packages-dev`) | `dist.url` on the patch host | `dist: {type: "path", url: ".socket/vendor/composer/<uuid>/…", reference: "<uuid>"}` | `dist.shasum`, required |
diff --git a/crates/socket-patch-cli/src/commands/vex.rs b/crates/socket-patch-cli/src/commands/vex.rs
index 84cd69f50..2ad5e4fa0 100644
--- a/crates/socket-patch-cli/src/commands/vex.rs
+++ b/crates/socket-patch-cli/src/commands/vex.rs
@@ -2121,8 +2121,9 @@ fn omission_phrase(reason: &str) -> &'static str {
              package any more"
         }
         GO_WORKSPACE_OVERRIDE => {
-            "the go.work in effect overrides, ignores or conflicts with its go.mod replace, \
-             so the build does not link the patched module"
+            "the Go workspace in effect keeps its replace from the build (overrides, ignores \
+             or rejects it, or go builds from a go.work other than the one holding it), so \
+             the build does not link the patched module; the run warning names which"
         }
         GO_INSTALLED_TOOL_STALE => {
             "a tool installed with `go install` was built from the unpatched module and keeps \
diff --git a/crates/socket-patch-cli/src/commands/vex_sources.rs b/crates/socket-patch-cli/src/commands/vex_sources.rs
index 480bbf0da..f4f39e204 100644
--- a/crates/socket-patch-cli/src/commands/vex_sources.rs
+++ b/crates/socket-patch-cli/src/commands/vex_sources.rs
@@ -84,7 +84,7 @@ use socket_patch_core::vendor::state::{VendorArtifact, VendorEntry, VendorState}
 use socket_patch_core::vex::discover::{
     vendor_ref, Discovery, LedgerLiveness, PatchedRef, WiringMode,
 };
-use socket_patch_core::vex::{FailedPatch, UnattestedKind};
+use socket_patch_core::vex::{FailedPatch, Unattested, UnattestedKind};
 
 use crate::args::GlobalArgs;
 use crate::ui::plural;
@@ -432,15 +432,29 @@ pub(crate) async fn plan(
     // package-lock.json twin, which npm >= 12 ignores): the ref keeps
     // rollback, remove, list and the ledgers' liveness working, and the
     // patch is omitted.
-    cands.retain(|c| {
+    // A file-scoped mark (a Go replace the workspace keeps from the build)
+    // bypasses only its own file's ref: another file's live ref of the
+    // same patch attests on its own basis, without the bypassed one.
+    cands.retain_mut(|c| {
         let pkg = canonical_base_purl(&c.key);
-        let Some(u) = discovery
+        let marks: Vec<&Unattested> = discovery
             .unattested
             .iter()
-            .find(|u| u.uuid == c.uuid && PurlKey::same(&u.purl, &pkg))
-        else {
+            .filter(|u| u.uuid == c.uuid && PurlKey::same(&u.purl, &pkg))
+            .collect();
+        let Some(&first) = marks.first() else {
             return true;
         };
+        let u = match marks.iter().find(|u| !u.kind.file_scoped()) {
+            Some(u) => *u,
+            None => {
+                c.discovered.retain(|r| !bypassed_ref(&discovery, r));
+                if !c.discovered.is_empty() {
+                    return true;
+                }
+                first
+            }
+        };
         let (code, remedy) = unattested_note(u.kind);
         gated.push(failed(&c.key, code));
         notes.push(PlanNote {
@@ -728,7 +742,12 @@ fn build_candidates(
 /// disagreeing wiring (`<uuid> (<file>), …`) for the note.
 fn wiring_conflicts(discovery: &Discovery) -> BTreeMap<String, String> {
     let mut by_pkg: BTreeMap<&str, BTreeMap<&str, BTreeSet<String>>> = BTreeMap::new();
-    for r in &discovery.refs {
+    // A ref whose file the build never reads wires nothing it installs.
+    for r in discovery
+        .refs
+        .iter()
+        .filter(|r| !bypassed_ref(discovery, r))
+    {
         by_pkg
             .entry(r.purl.as_str())
             .or_default()
@@ -754,6 +773,17 @@ fn wiring_conflicts(discovery: &Discovery) -> BTreeMap<String, String> {
         .collect()
 }
 
+/// Whether a file-scoped [`Unattested`] mark ([`UnattestedKind::file_scoped`])
+/// covers `r`: the same patch and package, in the same file.
+fn bypassed_ref(discovery: &Discovery, r: &PatchedRef) -> bool {
+    discovery.unattested.iter().any(|u| {
+        u.kind.file_scoped()
+            && u.uuid == r.uuid
+            && u.file == r.source_file
+            && PurlKey::same(&u.purl, &canonical_base_purl(&r.purl))
+    })
+}
+
 /// Attach every lockfile reference (except those of `conflicts`' packages,
 /// already gated) to the candidate(s) for its package and patch; a package the lockfile wires to a patch no candidate records gets
 /// a new lockfile-only candidate, and a candidate for a wired package whose
@@ -1773,6 +1803,104 @@ mod tests {
         assert!(live.hosted.contains_key(PURL));
     }
 
+    /// A hosted Go ref of `uuid` in `file`, and the Go workspace mark on it.
+    fn go_ref(purl: &str, uuid: &str, file: &str) -> PatchedRef {
+        PatchedRef::hosted(
+            purl.to_string(),
+            uuid.to_string(),
+            file,
+            None,
+            Some(LockIntegrity::GoH1("h1:x".into())),
+            true,
+        )
+    }
+
+    fn go_bypass(purl: &str, uuid: &str, file: &str) -> socket_patch_core::vex::Unattested {
+        socket_patch_core::vex::Unattested {
+            purl: purl.into(),
+            uuid: uuid.into(),
+            file: file.into(),
+            detail: format!("go builds the workspace of ../ci/go.work, never this {file}"),
+            kind: UnattestedKind::GoWorkspaceOverride,
+        }
+    }
+
+    /// Review finding 1: a Go workspace mark bypasses only its own file. A
+    /// root go.work replace go never reads does not withhold the patch the
+    /// root go.mod's mirror of it wires, which attests on its own basis;
+    /// alone, the bypassed ref is omitted with `go_workspace_override`.
+    #[tokio::test]
+    async fn a_go_workspace_mark_withholds_only_its_own_file() {
+        const PURL: &str = "pkg:golang/github.com/foo/bar@v1.4.2";
+        let tmp = tempfile::tempdir().unwrap();
+        let mut redirect = RedirectState::new();
+        redirect.records.insert(PURL.into(), record(U1));
+        let sources = |discovery: Discovery| Sources {
+            manifest: PatchManifest::new(),
+            vendor: VendorState::new(),
+            redirect: Some(redirect.clone()),
+            discovery,
+        };
+        let mut both = discovery(vec![
+            go_ref(PURL, U1, "go.work"),
+            go_ref(PURL, U1, "go.mod"),
+        ]);
+        both.unattested.push(go_bypass(PURL, U1, "go.work"));
+        let live = plan(
+            &common(tmp.path()),
+            sources(both),
+            &[],
+            &RunApiClient::new(),
+        )
+        .await;
+        assert!(live.gated.is_empty(), "{:?}", live.gated);
+        let wiring = &live.hosted[PURL];
+        assert_eq!(wiring.refs.len(), 1, "{:?}", wiring.refs);
+        assert_eq!(wiring.refs[0].source_file, Path::new("go.mod"));
+
+        let mut alone = discovery(vec![go_ref(PURL, U1, "go.work")]);
+        alone.unattested.push(go_bypass(PURL, U1, "go.work"));
+        let gated = plan(
+            &common(tmp.path()),
+            sources(alone),
+            &[],
+            &RunApiClient::new(),
+        )
+        .await;
+        assert!(gated.view.patches.is_empty() && gated.hosted.is_empty());
+        assert_eq!(gated.gated, vec![failed(PURL, GO_WORKSPACE_OVERRIDE)]);
+    }
+
+    /// Review finding 4: Socket's own go.work replace overriding a leftover
+    /// member pin of another patch is what the build links (as `vex`'s
+    /// go.mod gate holds): the overridden pin is withheld, never a wiring
+    /// conflict that also withholds the go.work patch.
+    #[tokio::test]
+    async fn a_bypassed_leftover_pin_is_no_wiring_conflict() {
+        const PURL: &str = "pkg:golang/github.com/foo/bar@v1.4.2";
+        let tmp = tempfile::tempdir().unwrap();
+        let mut redirect = RedirectState::new();
+        redirect.records.insert(PURL.into(), record(U1));
+        let mut found = discovery(vec![
+            go_ref(PURL, U1, "go.work"),
+            go_ref(PURL, U2, "app/go.mod"),
+        ]);
+        found.unattested.push(go_bypass(PURL, U2, "app/go.mod"));
+        let sources = Sources {
+            manifest: PatchManifest::new(),
+            vendor: VendorState::new(),
+            redirect: Some(redirect),
+            discovery: found,
+        };
+        let plan = plan(&common(tmp.path()), sources, &[], &RunApiClient::new()).await;
+        assert_eq!(plan.hosted[PURL].uuid, U1);
+        assert!(
+            !plan.gated.iter().any(|f| f.reason == WIRING_CONFLICT),
+            "{:?}",
+            plan.gated
+        );
+    }
+
     /// Ledger-only records with no wiring anywhere are gated, except the
     /// manifest-owned one, which falls back to agent-mode verification; an
     /// in-run confirmed purl is live by construction.
diff --git a/crates/socket-patch-core/src/vendor/go_workspace.rs b/crates/socket-patch-core/src/vendor/go_workspace.rs
index 2c2218035..08fb3686d 100644
--- a/crates/socket-patch-core/src/vendor/go_workspace.rs
+++ b/crates/socket-patch-core/src/vendor/go_workspace.rs
@@ -540,18 +540,26 @@ impl GoWorkspace {
     /// The member whose directory is `dir`, matched as go matches a module
     /// root against the `use` list.
     pub fn member_at(&self, dir: &Path) -> Option<&Member> {
-        let key = same_dir_key(dir);
-        self.members.iter().find(|m| same_dir_key(&m.dir) == key)
+        self.member_at_in(PathSpace::Disk, dir)
+    }
+
+    fn member_at_in(&self, paths: PathSpace<'_>, dir: &Path) -> Option<&Member> {
+        let key = paths.key(dir);
+        self.members.iter().find(|m| paths.key(&m.dir) == key)
     }
 
     /// The members inside `root`, with their `root`-relative directory
     /// (`""` for `root` itself, forward slashes).
     pub fn members_within(&self, root: &Path) -> Vec<(String, &Member)> {
-        let base = same_dir_key(root);
+        self.members_within_in(PathSpace::Disk, root)
+    }
+
+    fn members_within_in(&self, paths: PathSpace<'_>, root: &Path) -> Vec<(String, &Member)> {
+        let base = paths.key(root);
         self.members
             .iter()
             .filter_map(|m| {
-                let rel = same_dir_key(&m.dir).strip_prefix(&base).ok()?.to_path_buf();
+                let rel = paths.key(&m.dir).strip_prefix(&base).ok()?.to_path_buf();
                 Some((rel.to_string_lossy().replace('\\', "/"), m))
             })
             .collect()
@@ -748,8 +756,13 @@ impl GoWorkspace {
     /// `root` (`ci.work`) is not: go doesn't read `root/go.work` then, so
     /// a replace written there would do nothing (#1810).
     pub fn rooted_at(&self, root: &Path) -> bool {
+        self.rooted_at_in(PathSpace::Disk, root)
+    }
+
+    /// [`GoWorkspace::rooted_at`] in `paths`.
+    pub fn rooted_at_in(&self, paths: PathSpace<'_>, root: &Path) -> bool {
         self.work_file.file_name() == Some(std::ffi::OsStr::new("go.work"))
-            && same_dir_key(self.work_dir()) == same_dir_key(root)
+            && paths.key(self.work_dir()) == paths.key(root)
     }
 
     /// Which file holds the Socket replace of `module` for the project at
@@ -795,14 +808,26 @@ impl GoWorkspace {
         version: &str,
         ours: &ReplaceEntry,
     ) -> Option<WorkspaceConflict> {
-        let display = display_path(project_root, &self.work_file);
+        self.work_conflict_in(PathSpace::Disk, project_root, module, version, ours)
+    }
+
+    /// [`GoWorkspace::work_conflict`] in `paths`.
+    pub fn work_conflict_in(
+        &self,
+        paths: PathSpace<'_>,
+        project_root: &Path,
+        module: &str,
+        version: &str,
+        ours: &ReplaceEntry,
+    ) -> Option<WorkspaceConflict> {
+        let display = paths.display(project_root, &self.work_file);
         if let Some(member) = self.main_module(module) {
             return Some(WorkspaceConflict::MainModule {
                 work_file: display,
-                member: display_path(project_root, &member.dir),
+                member: paths.display(project_root, &member.dir),
             });
         }
-        let our_target = lexical_target(self.work_dir(), ours);
+        let our_target = paths.target(self.work_dir(), ours);
         let applies = |e: &ReplaceEntry| {
             e.module == module
                 && !e.socket_owned()
@@ -811,7 +836,7 @@ impl GoWorkspace {
         if let Some(w) = self
             .replaces()
             .into_iter()
-            .find(|w| applies(w) && lexical_target(self.work_dir(), w) != our_target)
+            .find(|w| applies(w) && paths.target(self.work_dir(), w) != our_target)
         {
             return Some(WorkspaceConflict::WorkReplace {
                 work_file: display,
@@ -826,11 +851,11 @@ impl GoWorkspace {
                 .unwrap_or_default();
             if let Some(other) = replaces
                 .iter()
-                .find(|e| applies(e) && lexical_target(&member.dir, e) != our_target)
+                .find(|e| applies(e) && paths.target(&member.dir, e) != our_target)
             {
                 return Some(WorkspaceConflict::MemberOverridden {
                     work_file: display,
-                    member: display_path(project_root, &member.dir),
+                    member: paths.display(project_root, &member.dir),
                     target: target_display(other),
                 });
             }
@@ -848,19 +873,31 @@ impl GoWorkspace {
         version: &str,
         ours: &ReplaceEntry,
     ) -> Option<WorkspaceConflict> {
-        let display = display_path(project_root, &self.work_file);
+        self.conflict_in(PathSpace::Disk, project_root, module, version, ours)
+    }
+
+    /// [`GoWorkspace::conflict`] in `paths`.
+    pub fn conflict_in(
+        &self,
+        paths: PathSpace<'_>,
+        project_root: &Path,
+        module: &str,
+        version: &str,
+        ours: &ReplaceEntry,
+    ) -> Option<WorkspaceConflict> {
+        let display = paths.display(project_root, &self.work_file);
         if let Some(member) = self.main_module(module) {
             return Some(WorkspaceConflict::MainModule {
                 work_file: display,
-                member: display_path(project_root, &member.dir),
+                member: paths.display(project_root, &member.dir),
             });
         }
-        let own = self.member_at(project_root);
+        let own = self.member_at_in(paths, project_root);
         // With no go.mod there is no file to write, even when the workspace
         // already replaces the module the same way (#1810).
-        if own.is_none() && !project_root.join("go.mod").exists() {
+        if own.is_none() && !paths.exists(&project_root.join("go.mod")) {
             let members: Vec<String> = self
-                .members_within(project_root)
+                .members_within_in(paths, project_root)
                 .into_iter()
                 .map(|(dir, _)| dir)
                 .filter(|dir| !dir.is_empty())
@@ -868,10 +905,11 @@ impl GoWorkspace {
             return Some(WorkspaceConflict::NoModule {
                 work_file: display,
                 members: members.join(", "),
-                own_work: !self.rooted_at(project_root) && project_root.join("go.work").is_file(),
+                own_work: !self.rooted_at_in(paths, project_root)
+                    && paths.is_file(&project_root.join("go.work")),
             });
         }
-        let our_target = lexical_target(own.map_or(project_root, |m| &m.dir), ours);
+        let our_target = paths.target(own.map_or(project_root, |m| &m.dir), ours);
 
         // go reads go.work's replace for this exact version, then its
         // version-less one, before any member's; a go.work replace of
@@ -885,10 +923,10 @@ impl GoWorkspace {
                     .find(|w| w.module == module && w.version.is_none())
             });
         if let Some(w) = effective {
-            return (lexical_target(self.work_dir(), w) != our_target).then(|| {
+            return (paths.target(self.work_dir(), w) != our_target).then(|| {
                 if w.socket_owned() {
                     WorkspaceConflict::WorkHosted {
-                        work_dir: display_path(project_root, self.work_dir()),
+                        work_dir: paths.display(project_root, self.work_dir()),
                         work_file: display,
                         target: target_display(w),
                     }
@@ -904,12 +942,8 @@ impl GoWorkspace {
         if own.is_none() {
             return Some(WorkspaceConflict::NotAMember { work_file: display });
         }
-        let project = same_dir_key(project_root);
-        for member in self
-            .members
-            .iter()
-            .filter(|m| same_dir_key(&m.dir) != project)
-        {
+        let project = paths.key(project_root);
+        for member in self.members.iter().filter(|m| paths.key(&m.dir) != project) {
             let replaces = member
                 .go_mod
                 .as_deref()
@@ -923,14 +957,13 @@ impl GoWorkspace {
                     .iter()
                     .find(|e| e.module == module && e.version.is_none())
             });
-            let Some(other) = applied.filter(|e| lexical_target(&member.dir, e) != our_target)
-            else {
+            let Some(other) = applied.filter(|e| paths.target(&member.dir, e) != our_target) else {
                 continue;
             };
             let (work_file, work_dir, member, target) = (
                 display,
-                display_path(project_root, self.work_dir()),
-                display_path(project_root, &member.dir),
+                paths.display(project_root, self.work_dir()),
+                paths.display(project_root, &member.dir),
                 target_display(other),
             );
             return Some(match exact {
@@ -1143,6 +1176,76 @@ pub fn in_root_dir(dir: &str) -> Option<String> {
     )
 }
 
+/// Where the paths of a [`GoWorkspace`] live, for the checks that compare
+/// them ([`GoWorkspace::conflict_in`], [`GoWorkspace::work_conflict_in`]).
+#[derive(Debug, Clone, Copy)]
+pub enum PathSpace<'a> {
+    /// On disk: matched as go matches them (absolute,
+    /// symlinks resolved), files probed on the filesystem.
+    Disk,
+    /// An in-memory project: every path is relative to the project root
+    /// and compared lexically, and `files` (root-relative, normalized) are
+    /// the files that exist. Neither the filesystem nor the process's
+    /// working directory is consulted, so the answer is the same on every
+    /// host.
+    Memory { files: &'a BTreeSet<PathBuf> },
+}
+
+impl PathSpace<'_> {
+    /// The key two spellings of one directory share.
+    fn key(self, dir: &Path) -> PathBuf {
+        match self {
+            PathSpace::Disk => same_dir_key(dir),
+            PathSpace::Memory { .. } => {
+                crate::utils::relpath::normalize_lexically_keeping_escapes(dir)
+            }
+        }
+    }
+
+    fn exists(self, path: &Path) -> bool {
+        match self {
+            PathSpace::Disk => path.exists(),
+            PathSpace::Memory { files } => files.contains(&self.key(path)),
+        }
+    }
+
+    fn is_file(self, path: &Path) -> bool {
+        match self {
+            PathSpace::Disk => path.is_file(),
+            PathSpace::Memory { files } => files.contains(&self.key(path)),
+        }
+    }
+
+    /// [`display_path`].
+    pub(crate) fn display(self, project_root: &Path, path: &Path) -> String {
+        match self {
+            PathSpace::Disk => display_path(project_root, path),
+            PathSpace::Memory { .. } => {
+                let path = self.key(path);
+                match path.strip_prefix(self.key(project_root)) {
+                    Ok(rel) if !rel.as_os_str().is_empty() => {
+                        rel.to_string_lossy().replace('\\', "/")
+                    }
+                    Ok(_) => ".".to_string(),
+                    Err(_) => path.to_string_lossy().replace('\\', "/"),
+                }
+            }
+        }
+    }
+
+    /// [`lexical_target`].
+    fn target(self, go_mod_dir: &Path, entry: &ReplaceEntry) -> String {
+        match (self, &entry.path) {
+            (PathSpace::Disk, _) => lexical_target(go_mod_dir, entry),
+            (PathSpace::Memory { .. }, Some(path)) => self
+                .key(&go_mod_dir.join(path.replace('\\', "/")))
+                .to_string_lossy()
+                .into_owned(),
+            (PathSpace::Memory { .. }, None) => target_display(entry),
+        }
+    }
+}
+
 /// A directory as go matches a module root against the workspace's `use`
 /// list: absolute, with symlinks resolved when it exists. A path that only
 /// exists once folded (`./x/../app` with no `x`, which go's `filepath.Join`
diff --git a/crates/socket-patch-core/src/vex/discover/golang.rs b/crates/socket-patch-core/src/vex/discover/golang.rs
index dcf317486..5943eaf5d 100644
--- a/crates/socket-patch-core/src/vex/discover/golang.rs
+++ b/crates/socket-patch-core/src/vex/discover/golang.rs
@@ -61,10 +61,10 @@
 //!   sum file (go rejects the whole file) — is not a pin:
 //!   `integrity_required = true`, no `locked_integrity`. Hashes of other
 //!   algorithms are ignored, as go ignores them. The sum files are the
-//!   ones go verifies against inside the project: the root `go.sum`, or
-//!   with a `go.work`, `go.work.sum` (when the `go.work` is the root's)
-//!   and each in-root `use` member's `go.sum` (the root's only when `.`
-//!   is a member). Under `GOWORK=off` go ignores `go.work`, so discovery
+//!   ones go verifies against: the root `go.sum`, or with a `go.work`,
+//!   its `go.work.sum` and each `use` member's `go.sum` (the root's only
+//!   when `.` is a member), those outside the project counted only when
+//!   they lie inside the repository. Under `GOWORK=off` go ignores `go.work`, so discovery
 //!   reads neither it nor its sum files. A `GOWORK` go rejects (a
 //!   relative path, a file it cannot read or parse) leaves no build:
 //!   every Go ref becomes a diagnostic.
@@ -121,8 +121,14 @@
 //!   builds another `go.work`, stays a ref, so list, rollback and remove
 //!   find it, but is marked [`UnattestedKind::GoWorkspaceOverride`]: the
 //!   writers refuse to rewrite it there, so re-running them can never
-//!   clear it. A replace the workspace's version selection makes inert is
-//!   diagnosed, never a ref, as in module mode.
+//!   clear it. The mark covers that file only: another file's live
+//!   replace of the same patch (the root go.mod's mirror) still attests.
+//!   A replace of a module that is itself a `use` member is inert (go
+//!   builds that directory) and diagnosed, never a ref, before any
+//!   conflict is asked. Otherwise a bypassed replace is never judged by
+//!   version selection; one that is not bypassed and that selection makes
+//!   inert is diagnosed, as in module mode. In memory every path is
+//!   compared lexically ([`PathSpace::Memory`]): nothing touches the disk.
 //! * **Hand-edit tolerance**: a UTF-8 BOM, CRLF line ends, tab-separated
 //!   tokens, `replace(` without a space, `// comments`, and Go string
 //!   literals (`"github.com/foo/bar"`, `` `…` ``) around escape- and
@@ -134,7 +140,7 @@
 //!   and is not read.
 
 use std::collections::{BTreeSet, HashMap, HashSet};
-use std::path::Path;
+use std::path::{Path, PathBuf};
 
 use super::{
     golang_purl, vendor_ref, vendored_leaf_purl, DiscoverCtx, Discovery, PatchedRef,
@@ -148,7 +154,9 @@ use crate::vendor::go_mod_edit::{
     ReplaceOwner, HOSTED_GO_MODULE_PREFIX,
 };
 use crate::vendor::go_sum_edit::{go_semver_cmp, go_sum_lines, is_h1_dirhash};
-use crate::vendor::go_workspace::{self, in_root_dir, same_dir_key, GoWorkspace, Loaded, Member};
+use crate::vendor::go_workspace::{
+    self, in_root_dir, same_dir_key, GoWorkspace, Loaded, Member, PathSpace,
+};
 use crate::vendor::lock_inventory::LockIntegrity;
 
 const GO_MOD: &str = "go.mod";
@@ -184,13 +192,7 @@ async fn extract_goenv(
         Some(flag) => ctx
             .disk_root_reading(std::iter::empty::<&Path>())
             .and_then(|root| {
-                let mut touched: Vec<std::path::PathBuf> =
-                    root.ancestors().map(|dir| dir.join(GO_WORK)).collect();
-                touched.extend(
-                    gowork
-                        .filter(|g| Path::new(g).is_absolute())
-                        .map(Into::into),
-                );
+                let mut touched = workspace_probes(root, gowork);
                 touched.push(GO_MOD.into());
                 if let GoflagsModfile::File(file) = flag {
                     touched.push(file.into());
@@ -229,16 +231,8 @@ async fn extract_gowork(ctx: &DiscoverCtx<'_>, out: &mut Discovery, gowork: Opti
             }
         };
     };
-    // The files go_workspace::resolve_with probes; the loader's own reads
-    // of a workspace are declared where it is read.
-    let mut touched: Vec<std::path::PathBuf> =
-        root.ancestors().map(|dir| dir.join(GO_WORK)).collect();
-    touched.extend(
-        gowork
-            .filter(|g| Path::new(g).is_absolute())
-            .map(Into::into),
-    );
-    ctx.disk_root_reading(&touched);
+    // The loader's own reads of a workspace are declared where it is read.
+    ctx.disk_root_reading(workspace_probes(root, gowork));
     match go_workspace::load_with(root, gowork).await {
         Loaded::None => extract_with(ctx, out, Governing::Module).await,
         Loaded::Invalid(why) => withhold(ctx, out, &why).await,
@@ -246,11 +240,29 @@ async fn extract_gowork(ctx: &DiscoverCtx<'_>, out: &mut Discovery, gowork: Opti
     }
 }
 
+/// The files [`go_workspace::resolve_with`] probes for the project at
+/// `root`, spelled as it spells them (`current_dir().join(root)`, so a
+/// relative root's real ancestors too): a `go.work` in it and in each
+/// ancestor, and an absolute `GOWORK` file. Declared to a tracked snapshot,
+/// which only stats them, so a `go.work` appearing anywhere go would find
+/// one invalidates it.
+fn workspace_probes(root: &Path, gowork: Option<&str>) -> Vec<PathBuf> {
+    let base = std::env::current_dir().unwrap_or_default().join(root);
+    let mut probes: Vec<PathBuf> = base.ancestors().map(|dir| dir.join(GO_WORK)).collect();
+    probes.extend(
+        gowork
+            .filter(|g| Path::new(g).is_absolute())
+            .map(PathBuf::from),
+    );
+    probes
+}
+
 /// The workspace that decides what the build reads.
 enum Governing<'a> {
     /// Module mode: `GOWORK=off`, or no `go.work` at or above the root.
     Module,
-    /// The root's own `go.work`, if any, read through the view (in memory).
+    /// The root's own `go.work`, if any, read through the view and compared
+    /// lexically: the workspace in memory, and what [`withhold`] reports.
     Root,
     /// The workspace go resolves for the project at this disk root.
     Loaded(&'a Path, GoWorkspace),
@@ -279,22 +291,34 @@ async fn extract_with(ctx: &DiscoverCtx<'_>, out: &mut Discovery, governing: Gov
         Some(text) => parse_go_file(GO_MOD, &text, out),
         None => None,
     };
-    // The root's go.work is read whenever a workspace governs: its
-    // replaces are the build's when it is that workspace, and Socket
-    // wiring left unread otherwise ([`Workspace::bypass`]).
-    let go_work = match governing {
-        Governing::Module => None,
-        Governing::Root | Governing::Loaded(..) => ctx.read_text(GO_WORK, out).await,
-    };
-    let go_work = go_work.and_then(|text| parse_go_file(GO_WORK, &text, out));
-    let workspace = match governing {
-        Governing::Module => None,
-        Governing::Root => match go_work.as_deref() {
-            Some(work) => Some(read_workspace(ctx, out, go_mod.as_deref(), work).await),
-            None => None,
-        },
+    // The root's go.work is read through the view whenever a workspace
+    // governs, so its Socket identities are recognized: its replaces are
+    // the build's when it is that workspace, and wiring go never reads
+    // otherwise ([`Workspace::bypass`]).
+    let (go_work, workspace) = match governing {
+        Governing::Module => (None, None),
+        Governing::Root => {
+            let text = ctx.read_text(GO_WORK, out).await;
+            let go_work = text.and_then(|text| parse_go_file(GO_WORK, &text, out));
+            let workspace = match go_work.as_deref() {
+                Some(work) => Some(read_workspace(ctx, out, go_mod.as_deref(), work).await),
+                None => None,
+            };
+            (go_work, workspace)
+        }
         Governing::Loaded(root, model) => {
-            Some(read_loaded_workspace(ctx, out, go_mod.as_deref(), root, model).await)
+            let rooted = model.rooted_at(root);
+            let text = ctx.read_text(GO_WORK, out).await;
+            // A go.work go doesn't read is never parsed by it either: its
+            // replaces are only kept listable, without judging its blocks.
+            let go_work = match text {
+                Some(text) if rooted => parse_go_file(GO_WORK, &text, out),
+                Some(text) => Some(normalize_for_read(&text)),
+                None => None,
+            };
+            let workspace =
+                read_loaded_workspace(ctx, out, go_mod.as_deref(), root, model, rooted).await;
+            (go_work, Some(workspace))
         }
     };
 
@@ -349,6 +373,9 @@ async fn extract_with(ctx: &DiscoverCtx<'_>, out: &mut Discovery, governing: Gov
             None => vec![GO_SUM.to_string()],
         };
         sums = SumPins::read(ctx, out, &sum_files).await;
+        for (text, selects) in workspace.iter().flat_map(|ws| &ws.outside_sums) {
+            sums.add(text, *selects);
+        }
     }
     for (file, entries) in &files {
         extract_file(out, file, entries, &graph, &sums, workspace.as_ref());
@@ -435,36 +462,62 @@ struct Workspace {
     /// `(root-relative dir, index into model.members)` of in-root members.
     in_root: Vec<(String, usize)>,
     /// The sum files go verifies against in workspace mode that lie in the
-    /// project: `go.work.sum` (when go.work is the root's) and each in-root
-    /// member's `go.sum` (the root's only when `.` is a member).
+    /// project, read through the view: `go.work.sum` (when go.work is the
+    /// root's) and each in-root member's `go.sum` (the root's only when `.`
+    /// is a member).
     sum_files: Vec<String>,
+    /// The other sum files go verifies against, as the loader read them:
+    /// the governing `go.work.sum` and out-of-root members' `go.sum`, when
+    /// they lie inside the repository. `(text, whether its zip lines show
+    /// the selection)`.
+    outside_sums: Vec<(String, bool)>,
     /// The project root the model's paths are matched against (empty in
     /// memory, where the model's paths are root-relative).
-    root: std::path::PathBuf,
+    root: PathBuf,
     /// Whether the model is the root's own `go.work`.
     rooted: bool,
+    /// In memory (and under [`withhold`]): the root-relative files that
+    /// exist, for a purely lexical [`PathSpace::Memory`]; `None` on disk.
+    files: Option<BTreeSet<PathBuf>>,
 }
 
 impl Workspace {
+    fn paths(&self) -> PathSpace<'_> {
+        match &self.files {
+            Some(files) => PathSpace::Memory { files },
+            None => PathSpace::Disk,
+        }
+    }
+
+    /// The directory of the `use` member that IS `module`, as displayed:
+    /// go builds it from there and ignores every replace of it, so such a
+    /// replace is inert whatever else the workspace says.
+    fn main_module_dir(&self, module: &str) -> Option<String> {
+        let member = self.model.main_module(module)?;
+        Some(self.paths().display(self.model.work_dir(), &member.dir))
+    }
+
     /// Why the Socket replace `entry` of `module@version` in the
     /// root-relative `file` does not reach the build of this workspace
     /// although it is wired (`None`: it does): go reads another `go.work`
     /// than the root's, or the workspace overrides, ignores or rejects the
     /// replace as the hosted and vendored writers' own check
     /// ([`go_workspace::Loaded::host_conflict`]) says before they write one.
+    /// A module that is itself a member is [`Workspace::main_module_dir`]'s.
     fn bypass(&self, file: &str, entry: &ReplaceEntry, version: &str) -> Option<String> {
         let module = entry.module.as_str();
+        let paths = self.paths();
         if file == GO_WORK {
             if !self.rooted {
                 return Some(format!(
                     "go builds the workspace of {}, never this directory's {GO_WORK}, so its \
                      replace of {module} {version} has no effect",
-                    go_workspace::display_path(&self.root, &self.model.work_file)
+                    paths.display(&self.root, &self.model.work_file)
                 ));
             }
             return self
                 .model
-                .work_conflict(&self.root, module, version, entry)
+                .work_conflict_in(paths, &self.root, module, version, entry)
                 .map(|c| {
                     format!(
                         "the {GO_WORK} replace of {module} {version} {}",
@@ -482,7 +535,7 @@ impl Workspace {
             self.root.join(dir)
         };
         self.model
-            .conflict(&project, module, version, entry)
+            .conflict_in(paths, &project, module, version, entry)
             .map(|c| {
                 format!(
                     "the {file} replace of {module} {version} {}",
@@ -493,7 +546,8 @@ impl Workspace {
 }
 
 /// The root's own `go.work` (`go_work`) and its in-root members, read
-/// through the view: the workspace in memory, and what [`withhold`] reports.
+/// through the view and matched lexically: the workspace in memory, and
+/// what [`withhold`] reports.
 async fn read_workspace(
     ctx: &DiscoverCtx<'_>,
     out: &mut Discovery,
@@ -503,6 +557,10 @@ async fn read_workspace(
     let mut members = Vec::new();
     let mut in_root = Vec::new();
     let mut sum_files = vec![GO_WORK_SUM.to_string()];
+    let mut files: BTreeSet<PathBuf> = [GO_WORK.into()].into_iter().collect();
+    if go_mod.is_some() {
+        files.insert(GO_MOD.into());
+    }
     for raw in go_mod_edit::parse_use_dirs(go_work) {
         let Some(dir) = in_root_dir(&raw) else {
             members.push(Member {
@@ -512,7 +570,11 @@ async fn read_workspace(
             });
             continue;
         };
-        let (text, go_sum, sum) = read_member(ctx, out, go_mod, &dir).await;
+        let text = read_member(ctx, out, go_mod, &dir).await;
+        if text.is_some() {
+            files.insert(member_file(&dir, GO_MOD).into());
+        }
+        let sum = member_file(&dir, GO_SUM);
         if !sum_files.contains(&sum) {
             sum_files.push(sum);
         }
@@ -520,14 +582,13 @@ async fn read_workspace(
         members.push(Member {
             dir: dir.into(),
             go_mod: text,
-            go_sum,
+            go_sum: None,
         });
     }
-    let work_sum = ctx.read_text(GO_WORK_SUM, out).await;
     let model = GoWorkspace {
         work_file: GO_WORK.into(),
         work: go_work.to_string(),
-        work_sum,
+        work_sum: None,
         members,
         graph: None,
     };
@@ -535,79 +596,95 @@ async fn read_workspace(
         model,
         in_root,
         sum_files,
-        root: std::path::PathBuf::new(),
+        outside_sums: Vec::new(),
+        root: PathBuf::new(),
         rooted: true,
+        files: Some(files),
     }
 }
 
 /// The workspace go resolves for the project at `root` on disk
-/// ([`go_workspace::load_with`]), with every member wherever it lies. The
-/// in-root members' go.mod and go.sum are re-read through the view, so
-/// their Socket identities are recognized and a go.mod go cannot parse is
-/// diagnosed; the others keep what the loader read. The module graph is
-/// read from the module cache, as the hosted engine reads it.
+/// ([`go_workspace::load_with`]), with every member wherever it lies.
+///
+/// The loader already read go.work, go.work.sum and every member's go.mod
+/// and go.sum; of those, only the in-root members' go.mod is read again,
+/// through the view: its Socket identities must be recognized (rule 11)
+/// and a go.mod go cannot parse diagnosed, and a member's replaces become
+/// refs when the root has no go.mod. The project's sum files are read
+/// once, by [`SumPins::read`], for the same reason; the rest of the
+/// loader's sum texts are used as read. The module graph is read from the
+/// module cache, as the hosted engine reads it.
 async fn read_loaded_workspace(
     ctx: &DiscoverCtx<'_>,
     out: &mut Discovery,
     go_mod: Option<&str>,
     root: &Path,
     mut model: GoWorkspace,
+    rooted: bool,
 ) -> Workspace {
-    let rooted = model.rooted_at(root);
-    let base = same_dir_key(root);
-    let mut in_root = Vec::new();
+    let in_root: Vec<(String, usize)> = model
+        .members_within(root)
+        .into_iter()
+        .filter_map(|(rel, member)| {
+            let index = model.members.iter().position(|m| std::ptr::eq(m, member))?;
+            Some((rel, index))
+        })
+        .collect();
     let mut sum_files = Vec::new();
     if rooted {
         sum_files.push(GO_WORK_SUM.to_string());
     }
-    for (index, member) in model.members.iter_mut().enumerate() {
-        let Ok(rel) = same_dir_key(&member.dir)
-            .strip_prefix(&base)
-            .map(|rel| rel.to_string_lossy().replace('\\', "/"))
-        else {
-            continue;
-        };
-        let (text, go_sum, sum) = read_member(ctx, out, go_mod, &rel).await;
-        member.go_mod = text;
-        member.go_sum = go_sum;
+    for (rel, index) in &in_root {
+        model.members[*index].go_mod = read_member(ctx, out, go_mod, rel).await;
+        let sum = member_file(rel, GO_SUM);
         if !sum_files.contains(&sum) {
             sum_files.push(sum);
         }
-        in_root.push((rel, index));
     }
-    // The loader read go.work, go.work.sum and every member outside the
-    // view, and the module graph reads the module cache.
+    // Sum files outside the project but inside the repository: the
+    // governing go.work.sum when the go.work is not the root's, and each
+    // out-of-root member's go.sum. Nothing outside the repository counts.
+    let repo = crate::utils::repo_root::find_git_repo(root).map_or_else(|| root.into(), |r| r.root);
+    let repo = same_dir_key(&repo);
+    let inside = |path: &Path| same_dir_key(path).starts_with(&repo);
+    let mut outside_sums = Vec::new();
+    if !rooted && inside(model.work_dir()) {
+        outside_sums.extend(model.work_sum.clone().map(|text| (text, false)));
+    }
+    for (index, member) in model.members.iter().enumerate() {
+        if in_root.iter().all(|(_, i)| *i != index) && inside(&member.dir) {
+            outside_sums.extend(member.go_sum.clone().map(|text| (text, true)));
+        }
+    }
+    // The loader read outside the view, and the module graph reads the
+    // module cache.
     let _ = ctx.disk_root();
     model.read_graph().await;
     Workspace {
         model,
         in_root,
         sum_files,
+        outside_sums,
         root: root.to_path_buf(),
         rooted,
+        files: None,
     }
 }
 
-/// An in-root member's go.mod (the root's own `go_mod` for `""`), its
-/// go.sum, and the go.sum's root-relative path.
+/// An in-root member's go.mod (the root's own `go_mod` for `""`), read
+/// through the view.
 async fn read_member(
     ctx: &DiscoverCtx<'_>,
     out: &mut Discovery,
     go_mod: Option<&str>,
     dir: &str,
-) -> (Option<String>, Option<String>, String) {
-    let text = if dir.is_empty() {
-        go_mod.map(str::to_string)
-    } else {
-        let rel = member_file(dir, GO_MOD);
-        match ctx.read_text(&rel, out).await {
-            Some(text) => parse_go_file(&rel, &text, out),
-            None => None,
-        }
-    };
-    let sum = member_file(dir, GO_SUM);
-    let go_sum = ctx.read_text(&sum, out).await;
-    (text, go_sum, sum)
+) -> Option<String> {
+    if dir.is_empty() {
+        return go_mod.map(str::to_string);
+    }
+    let rel = member_file(dir, GO_MOD);
+    let text = ctx.read_text(&rel, out).await?;
+    parse_go_file(&rel, &text, out)
 }
 
 /// Normalize a go.mod-grammar file (BOM, simple string literals) and check
@@ -646,6 +723,27 @@ fn extract_file(
         let version = entry.version.as_deref().or(req).unwrap_or_default();
         workspace.and_then(|ws| ws.bypass(file, entry, version))
     };
+    // A module that is itself a `use` member is built from its directory:
+    // every replace of it is inert, which says more than any workspace
+    // conflict (go.work names it first too), so it is diagnosed, never a
+    // ref, before the bypass is asked.
+    let main_module_inert = |out: &mut Discovery, entry: &ReplaceEntry| {
+        let Some(dir) = workspace.and_then(|ws| ws.main_module_dir(&entry.module)) else {
+            return false;
+        };
+        let req = required.get(&entry.module).map(String::as_str);
+        let version = entry.version.as_deref().or(req).unwrap_or_default();
+        out.diag(
+            DIAG_REF_INVALID,
+            file,
+            format!(
+                "{file}: replace {} {version} is inert: the build selects (the workspace \
+                 module in {dir}), so it uses the unpatched module",
+                entry.module
+            ),
+        );
+        true
+    };
     let mark_bypassed = |out: &mut Discovery, purl: &str, uuid: &str, bypassed: Option<String>| {
         if let Some(detail) = bypassed {
             out.unattested(
@@ -696,6 +794,9 @@ fn extract_file(
                     );
                     continue;
                 };
+                if main_module_inert(out, entry) {
+                    continue;
+                }
                 let bypassed = bypass_of(entry);
                 let Some(purl) =
                     replaced_purl(entry, graph, &versioned, file, out, bypassed.is_some())
@@ -786,6 +887,9 @@ fn extract_file(
                     );
                     continue;
                 };
+                if main_module_inert(out, entry) {
+                    continue;
+                }
                 let bypassed = bypass_of(entry);
                 let Some(purl) =
                     replaced_purl(entry, graph, &versioned, file, out, bypassed.is_some())
@@ -2437,7 +2541,7 @@ mod tests {
                 false,
             ),
         ] {
-            let p = Project::nested("app");
+            let p = project_in_repo();
             p.write(
                 "go.mod",
                 format!("{BASE_GO_MOD}\nreplace {MODULE} {VERSION} => {m} {sver}\n"),
@@ -2498,7 +2602,7 @@ mod tests {
                 None,
             ),
         ] {
-            let p = Project::nested("app");
+            let p = project_in_repo();
             p.write("go.mod", format!("{BASE_GO_MOD}\n{ours}"))
                 .write("go.sum", go_sum_for(UUID_A, sver))
                 .write("../ci/go.work", &work);
@@ -2512,7 +2616,7 @@ mod tests {
 
         // The root's own go.work holds the wiring, but GOWORK sends go
         // elsewhere: still a ref, never attested.
-        let p = Project::nested("app");
+        let p = project_in_repo();
         p.write("go.mod", BASE_GO_MOD)
             .write("go.work", format!("go 1.21\n\nuse .\n\n{ours}"))
             .write("go.work.sum", go_sum_for(UUID_A, sver))
@@ -2560,7 +2664,7 @@ mod tests {
                 false,
             ),
         ] {
-            let p = Project::nested("app");
+            let p = project_in_repo();
             p.write(
                 "go.mod",
                 format!("{BASE_GO_MOD}\nreplace {MODULE} {VERSION} => {m} {sver}\n"),
@@ -2617,4 +2721,155 @@ mod tests {
             }
         }
     }
+
+    /// A project at `app/` inside a git checkout at its parent, so files
+    /// beside it (`../go.work`, `../svc`) lie inside the repository.
+    fn project_in_repo() -> Project {
+        let p = Project::nested("app");
+        p.write("../.git/HEAD", "ref: refs/heads/main\n");
+        p
+    }
+
+    /// Review finding 2: a replace of a module that is itself a `use`
+    /// member is inert (go builds it from that directory), on disk and in
+    /// memory, hosted and vendored: diagnosed, never a ref, even though the
+    /// writers' conflict check also names it.
+    #[tokio::test]
+    async fn replace_of_a_workspace_module_is_inert() {
+        use crate::vendor::lock_inventory::{MemoryProject, ProjectView};
+        let m = gopatch(UUID_A);
+        let sver = "v1.4.2-socketpatch.1";
+        let bar = format!("module {MODULE}\n\ngo 1.21\n");
+        let work = "go 1.21\n\nuse (\n\t.\n\t./bar\n)\n";
+        for replace in [
+            format!("replace {MODULE} {VERSION} => {m} {sver}\n"),
+            format!("replace {MODULE} {VERSION} => ./{}\n", vendored_rel(UUID_A)),
+        ] {
+            let go_mod = format!("{BASE_GO_MOD}\n{replace}");
+            let inert = |out: &Discovery| {
+                assert_refs(out, &[]);
+                assert!(out.unattested.is_empty(), "{:?}", out.unattested);
+                assert!(
+                    out.diagnostics.iter().any(|d| d.code == DIAG_REF_INVALID
+                        && d.detail.contains("is inert")
+                        && d.detail.contains("workspace module in bar")),
+                    "{replace}: {:?}",
+                    out.diagnostics
+                );
+            };
+            let p = Project::new();
+            p.write("go.mod", &go_mod)
+                .write("go.sum", go_sum_for(UUID_A, sver))
+                .write("go.work", work)
+                .write("bar/go.mod", &bar);
+            inert(&run(&p).await);
+
+            let mut project = MemoryProject::new();
+            project.insert_text("go.mod", go_mod.clone());
+            project.insert_text("go.sum", go_sum_for(UUID_A, sver));
+            project.insert_text("go.work", work);
+            project.insert_text("bar/go.mod", bar.clone());
+            let ctx = DiscoverCtx::over(ProjectView::Memory(&project), &[]);
+            let mut out = Discovery::default();
+            super::extract_gowork(&ctx, &mut out, None).await;
+            inert(&out);
+        }
+    }
+
+    /// Review finding 3: go verifies against the governing workspace's
+    /// `go.work.sum` and every member's `go.sum`, wherever they lie in the
+    /// repository: a sum file go rejects there leaves no pin, even with a
+    /// zip pin in the project's own go.sum.
+    #[tokio::test]
+    async fn sum_files_outside_the_project_still_decide_the_pin() {
+        let m = gopatch(UUID_A);
+        let sver = "v1.4.2-socketpatch.1";
+        let broken = "github.com/x/y v1.0.0\n";
+        for (case, work, sum_file) in [
+            (
+                "ancestor go.work.sum",
+                "go 1.21\n\nuse ./app\n",
+                "../go.work.sum",
+            ),
+            (
+                "out-of-root member go.sum",
+                "go 1.21\n\nuse (\n\t./app\n\t./svc\n)\n",
+                "../svc/go.sum",
+            ),
+        ] {
+            let p = project_in_repo();
+            p.write(
+                "go.mod",
+                format!("{BASE_GO_MOD}\nreplace {MODULE} {VERSION} => {m} {sver}\n"),
+            )
+            .write("go.sum", go_sum_for(UUID_A, sver))
+            .write("../go.work", work)
+            .write("../svc/go.mod", "module example.com/svc\n\ngo 1.21\n");
+            let out = run(&p).await;
+            assert_overridden(&out, None, case);
+            assert!(out.refs[0].locked_integrity.is_some(), "{case}");
+            p.write(sum_file, broken);
+            let out = run(&p).await;
+            assert_overridden(&out, None, case);
+            assert_eq!(out.refs[0].locked_integrity, None, "{case}");
+            assert!(!out.refs[0].lockfile_basis_ok(), "{case}");
+        }
+    }
+
+    /// Review finding 5: in memory the workspace check never consults the
+    /// filesystem or the working directory: the root module that a root
+    /// go.work doesn't `use` is a module the workspace ignores (it has a
+    /// go.mod in the view), whatever the process's working directory holds.
+    #[tokio::test]
+    async fn in_memory_workspace_check_reads_only_the_view() {
+        use crate::vendor::lock_inventory::{MemoryProject, ProjectView};
+        let m = gopatch(UUID_A);
+        let sver = "v1.4.2-socketpatch.1";
+        let mut project = MemoryProject::new();
+        project.insert_text(
+            "go.mod",
+            format!("{BASE_GO_MOD}\nreplace {MODULE} {VERSION} => {m} {sver}\n"),
+        );
+        project.insert_text("go.sum", go_sum_for(UUID_A, sver));
+        project.insert_text("go.work", "go 1.21\n\nuse ./svc\n");
+        project.insert_text("svc/go.mod", "module example.com/svc\n\ngo 1.21\n");
+        let ctx = DiscoverCtx::over(ProjectView::Memory(&project), &[]);
+        let mut out = Discovery::default();
+        super::extract_gowork(&ctx, &mut out, None).await;
+        assert_overridden(&out, Some("does not `use` this module"), "memory");
+        let detail = &out.unattested[0].detail;
+        // Displayed root-relative, never as a path on this host.
+        assert!(
+            detail.contains("go.work does not `use` this module"),
+            "{detail}"
+        );
+        let cwd = std::env::current_dir().unwrap();
+        assert!(!detail.contains(&*cwd.to_string_lossy()), "{detail}");
+    }
+
+    /// Review finding 7: a root go.work that go never reads (GOWORK names
+    /// another) is never judged by go either: malformed, it is no
+    /// `lockfile_unparseable`, and its Socket wiring stays a ref, unattested.
+    #[tokio::test]
+    async fn unread_root_go_work_is_not_diagnosed_unparseable() {
+        let m = gopatch(UUID_A);
+        let sver = "v1.4.2-socketpatch.1";
+        let p = project_in_repo();
+        p.write("go.mod", BASE_GO_MOD)
+            .write(
+                "go.work",
+                format!("go 1.21\n\nuse .\n\nreplace (\n\t{MODULE} {VERSION} => {m} {sver}\n"),
+            )
+            .write("../ci/go.work", "go 1.21\n\nuse ../app\n");
+        let gowork = p
+            .root()
+            .join("../ci/go.work")
+            .to_string_lossy()
+            .into_owned();
+        let ctx = p.ctx();
+        let mut out = Discovery::default();
+        super::extract_gowork(&ctx, &mut out, Some(&gowork)).await;
+        assert_overridden(&out, Some("never this directory's go.work"), "malformed");
+        assert_eq!(out.refs[0].source_file, std::path::PathBuf::from("go.work"));
+    }
 }
diff --git a/crates/socket-patch-core/src/vex/discover/mod.rs b/crates/socket-patch-core/src/vex/discover/mod.rs
index 53d002134..86b302dfd 100644
--- a/crates/socket-patch-core/src/vex/discover/mod.rs
+++ b/crates/socket-patch-core/src/vex/discover/mod.rs
@@ -614,6 +614,17 @@ pub enum UnattestedKind {
     GoWorkspaceOverride,
 }
 
+impl UnattestedKind {
+    /// Whether the mark bypasses only the wiring in its own file: another
+    /// file's live ref of the same patch still reaches the build (a root
+    /// go.mod mirroring a go.work replace go never reads). Every other
+    /// kind shows a copy the build may run unpatched, which withholds the
+    /// patch however many files wire it.
+    pub fn file_scoped(self) -> bool {
+        matches!(self, UnattestedKind::GoWorkspaceOverride)
+    }
+}
+
 /// A ref discovery emits (so rollback, remove and list find the wiring,
 /// and the ledgers' liveness gates still see it wired) that must not be
 /// attested: the files show a build that may run a copy the pin does not

From 15292108876809e11a851ab7134759ffd9f00dac Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 5 Nov 2026 22:18:52 +0000
Subject: [PATCH 4/4] Keep a root go.mod pin of another patch a Go wiring
 conflict

2984629 dropped every workspace-bypassed ref from wiring_conflicts, so a
leftover member pin that Socket's go.work replace overrides would not
withhold the go.work patch. That also caught the root go.mod. A
GOWORK=off build from the root reads the root go.mod, so a different
patch there still disagrees with go.work about what the build links.
The behavior is the same reasoning ReplaceHost::mirrors_root_go_mod
uses. e2e_vex_lockfile golang_go_mod_and_go_work_disagreeing_attest_neither
went red in coverage (2): it got go_workspace_override plus
go_version_not_selected skips, not one wiring_conflict skip.

Count bypassed refs in the root go.mod as wiring again. Member go.mod
pins are still exempt, as a_bypassed_leftover_pin_is_no_wiring_conflict
requires.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 crates/socket-patch-cli/src/commands/vex_sources.rs | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/crates/socket-patch-cli/src/commands/vex_sources.rs b/crates/socket-patch-cli/src/commands/vex_sources.rs
index f4f39e204..10c6d274b 100644
--- a/crates/socket-patch-cli/src/commands/vex_sources.rs
+++ b/crates/socket-patch-cli/src/commands/vex_sources.rs
@@ -743,10 +743,13 @@ fn build_candidates(
 fn wiring_conflicts(discovery: &Discovery) -> BTreeMap<String, String> {
     let mut by_pkg: BTreeMap<&str, BTreeMap<&str, BTreeSet<String>>> = BTreeMap::new();
     // A ref whose file the build never reads wires nothing it installs.
+    // The root go.mod is the exception: a `GOWORK=off` build from the root
+    // reads it (cf. `ReplaceHost::mirrors_root_go_mod`), so a different
+    // patch there still disagrees with the go.work that overrides it.
     for r in discovery
         .refs
         .iter()
-        .filter(|r| !bypassed_ref(discovery, r))
+        .filter(|r| r.source_file == std::path::Path::new("go.mod") || !bypassed_ref(discovery, r))
     {
         by_pkg
             .entry(r.purl.as_str())