@@ -0,0 +1,39 @@
+[agent] 2026-10-16: Yarn Berry (2+) bug-hunt run
+
+**Tested:** main `657fce2` (release 5.0.1 is still the latest tag). Since run 44 (`2c82c77`), main adds #1586 (fixes #1579), #1575, #1577 and #1582 (non-berry), plus CI test moves. I tested yarn 4.0.2 and 4.18.1 from `@yarnpkg/cli-dist` on Node 22, Linux, with the node-modules linker.
+
+**Harness (run 45):** rebuilt the run-44 way: `bin/y`, a `bin/corepack` shim, `h/mock.py <pk> 8790` (one left-pad patch; the `10c0` checksum was bootstrapped with a real `resolutions: file:` install, and the real sha512 is in the `tarball` artifact), `h/lib.sh` (`sp`, `fresh`), `h/base.sh DIR portal|link|file YV`, and `h/cell.sh BASE OUT STATE hosted|vendored`, which makes a lock-only copy with the target manifest in STATE and runs a hosted or vendored `scan --vex`, then a lock-only `vex`.
+
+**Probes:** none (the stale probe branches still need deleting by hand).
+
+### Re-triage
+- #1579 (closed by #1586): verified fixed on 4.0.2 and 4.18.1. A `.gitkeep`-only portal, a nameless manifest and a version-less manifest each warn `redirect_copy_unpatched` (exit 1), and lock-only `vex` exits 2. Vendored nameless fails closed.
+- #783: still fails (vendored adds a bare `left-pad` pin beside `pkg-a/left-pad`, then fresh `--immutable` fails YN0028). No new information, so no comment.
+
+### Cells (Linux, main `657fce2`)
+| Cell | Result |
+| --- | --- |
+| Repo berry e2e suites (redirect, vendor, pnpm linker, workspaces; 4.18.1) | pass (37 + 44 + 40 + 39) |
+| #1579 shapes, hosted + vendored + `vex` | pass (fixed) |
+| **`portal:`/`link:` copy whose manifest has `"name": ""`, `"../x"` or `" left-pad"`, with version 1.3.0** (hosted 4.0.2 + 4.18.1; vendored lock-only 4.18.1) | **fail #1598**: exit 0 `success`; in-run, lock-only and post-install VEX attest; `node_modules/lp2` installs unpatched (2 real installs) |
+| **`file:` dir copy with `"name": ""`** (4.18.1, real install from the start ×2) | **fail #1598** |
+| **`portal:` copy with `"version": ""`** (4.0.2, 4.18.1) | **fail #1598** (same class) |
+| `portal:` copy with a valid other name (`other-pkg`) | ignored, by design |
+| #1490 neighbours: workspaces `packages/{a,b}`, `+(a\|b)`, `@(a)`, `!(z)`, `[[:lower:]]`, `a{,}`, `?`; `get <uuid>` from the member | pass (`redirect_workspace_lockfile_elsewhere`, exit 1, nothing written) |
+| `compressionLevel: "${CL:-0}"` (quoted and unquoted), `enableGlobalCache: "${EGC:-false}"`; hosted + vendored + fresh immutable | pass (the run-31 false refusal is gone) |
+| Nested independent berry project `tools/x` that the root also links with `portal:./tools/x` | hosted pins the root copy with no warning; `tools/x/node_modules/left-pad` shadows it at runtime. This is the #1534 design, so it's a known non-bug |
+
+### Filed / commented / closed
+- Filed #1598: https://github.com/SocketDev/socket-patch/issues/1598 (follow-up to #1579). `CopyRef::identity` (`formats/yarn/copy.rs:84-86`) and `manifest_name` (`formats/yarn/source.rs:131`) accept `""` and invalid npm names as identities.
+- Nothing closed (#1579 was already closed by #1586).
+
+### Ruled out
+- The nested `portal:./tools/x` shadow (the #1534 design rewires only the root's locks).
+- `compressionLevel: "${CL:-mixed}"`: yarn 4.18.1 itself fails the fixture install, so it's not testable.
+
+### Next
+1. #1598: re-verify when fixed (all the shapes above; hosted, vendored, `vex`; 4.0.2/4.18.1). Check yarn classic's shared `manifest_name` path or hand it over.
+2. Re-verify #783, #962 and #859 when fixes land.
+3. Interpolated `npmScopes`/`pnpmStoreFolder` values (#1100/#1017 class).
+4. #1241 replayed-journal rollback re-check on current main.
+5. macOS/Windows probes once the stale branches are deleted.