@@ -0,0 +1,46 @@
+[agent] 2026-10-16: pip / requirements.txt bug-hunt run
+
+**Tested:** main `657fce2`; latest release v5.0.1. Main moved 4 commits since `4cc50f4` (yarn portal copies, a gemspec VEX fix, CI test moves); none touch PyPI code.
+
+**Setup:** real pip 20.3.4 (py3.8), 24.0 (py3.11), 25.0.1 (py3.12) and 26.2.1 (py3.13) with real six 1.16.0 from PyPI. The hosted mock is the repo's own `in_process_vendor_pypi_takeover.rs` `mount_api` (patch API, hosted wheel, PyPI JSON), run as a long-lived throwaway `#[ignore]` test. Contest cells used the #1549 harness `vex_pipenv_pip_common::contested_by_a_non_socket_direct_reference` with the real CLI. All throwaway tests were reverted afterwards.
+
+**Probe branches:** none. `git push origin --delete bughunt/pip/20260930-hash-mode` was denied again, so nine old `bughunt/pip/*` branches remain and no new probe was pushed. Linux only.
+
+## Re-triage
+
+No open pm:pip issue was re-run. Nothing PyPI-related merged since the last run. #1587 has an open fix PR, #1599 (not merged).
+
+## Cells (Linux)
+
+| Cell | Result |
+| --- | --- |
+| `list` over a hand-written hosted requirements.txt: plain, `-r` include, hash continuation, UTF-16, `Six`, marker, CRLF, real UTF-8 BOM | pass |
+| `list` with the hosted pin only in a `-c` file, `requirements-dev.txt` or `sub/requirements.txt` (not installed by `pip install -r requirements.txt`) | pass (not listed) |
+| `list` with a commented-out hosted line | `hosted_wiring_contested`, exit 1 (documented; see Known non-bugs) |
+| hosted marker split (1.16.0 / 1.17.0, two uuids): `list`, scoped `remove`, unscoped `rollback` of a hashed continuation file → PyPI hashes; pip 24.0 / 26.2.1 install it | pass |
+| `scan --mode hosted` on a hashed continuation file, pip 25.0.1 / py3.12, fresh venv with `--require-hashes` | pass (patched wheel installed) |
+| `vex` after the hosted install: fresh venv verifies; warm venv is omitted (`hash_mismatch`) | pass |
+| requirements.txt contest of a Pipfile.lock wiring: `==X`, `X == Y`, `Name==X`, `[x]==X`, marker, `(==X)` | pass (contested) |
+| same: `===X`, `==X.0`, `==vX` | **fail → #1602** (vex `not_affected`, exit 0) |
+| same: `~=X`, `==1.2.*`, `>=X,<=X` | not contested (filed only as a design note in #1602) |
+
+## Issues
+
+- Filed #1602: https://github.com/SocketDev/socket-patch/issues/1602
+
+## False positives ruled out
+
+- An apparent "BOM-first-line hosted pin is contested" turned out to be dash's `printf` writing a literal `\xef\xbb\xbf`. Real BOM files list, vex and roll back fine.
+- A commented-out hosted url is contested by the documented rule (CLI_CONTRACT.md `hosted_wiring_contested`: a rejected mention).
+- `vex` with no `--product` on a requirements-only project exits `product_undetected`, which is documented.
+
+## Next
+
+1. #1602: re-verify once fixed, and check the reverse direction (a Pipfile.lock `"===X"` / `"==X.0"` beside a requirements.txt wiring).
+2. #1587 re-verify once PR #1599 merges (plus a name-less `-e ./src/six`).
+3. #1567 follow-ups (a mixed `-r` include, the superseding re-vendor, the hosted → vendored takeover).
+4. A uv.lock (not pylock) added after vendoring requirements.txt.
+5. A Windows / macOS probe once branch deletion works.
+
+---
+_Generated by [Claude Code](https://claude.ai/code)_