Replace RewriteResult's 27 per-ecosystem uuid sets with one report map #1076

[agent] Filed by the scheduled architecture audit routine (ecosystems and formats). Register: E31.

Kind: refactor. Source: review Part 3.7 recommendation 2; register E31, child 1 of #1075.

Problem

Verified on main 05ecc6e. RewriteResult carries 27 BTreeSet<String> fields, one per (ecosystem, meaning) pair. Each meaning is spelled anew per ecosystem:

They are read and written across 12 production files, including the CLI (scan/hosted.rs#L1215, #L1245-L1246, #L1339) and vex/discover/gradle.rs.

merge_group_delta has to destructure and extend every one of them. Each new hosted ecosystem adds 1–3 fields, two lines in merge_group_delta and new arms in engine::confirm.

Impact: no behavior bug. Every hosted ecosystem PR conflicts on the same struct and function.

Proposed change

• Add enum Rewriter { NpmLock, Pnpm, YarnClassic, YarnBerry, Bun, BunBinary, Vlt, Requirements, Hatch, PythonLock, Pipenv, Pdm, Cargo, Golang, Gradle, Sbt, Bundled } and enum Report { Owned, Confirmed, Refused, Foreign }.
• Replace the 27 fields with reports: BTreeMap<(Rewriter, Report), BTreeSet<String>>, behind three methods: report(rw, kind, uuid), has(rw, kind, uuid) -> bool and uuids(rw, kind) -> impl Iterator.
• merge_group_delta merges reports in one loop.
• Every .confirmed_x_uuids.insert(u) becomes .report(Rewriter::X, Report::Confirmed, u), and every .contains(u) becomes .has(…). confirm() keeps its exact order of rules.
• Deleted: the 27 fields, their doc comments (moved onto the enum variants) and the 27-line destructure/extend in merge_group_delta.

Size and scope

• Files: about 330 reference sites in redirect/{mod,gradle,vlt,sbt,pipenv,pdm,poetry,bun_binary,requirements,scala_guidance}.rs, redirect/upstream/gradle.rs, formats/pnpm/hosted.rs, hosted/engine.rs, vex/discover/gradle.rs, the CLI scan/hosted.rs, and the test files that assert on the sets.
• Size: about 400–600 changed lines, almost all one-line substitutions.
• Out of scope: reordering or simplifying confirm() (Tracking: hosted rewriters behind one HostedRewriter trait with a per-dependency outcome #1075 step 2), and any trait (step 3).

Acceptance criteria

• RewriteResult has no *_uuids field; rg '_uuids\b' crates/socket-patch-core/src/patch/redirect/mod.rs finds no struct field.
• merge_group_delta no longer names any ecosystem.
• The CLI uses only the accessors.
• cargo test -p socket-patch-core is green, including group_equivalence_tests, python_lock_equivalence_tests, pnpm_equivalence_tests, platform_wheel_tests, tests/redirect_golden.rs and tests/redirect_sbt_golden.rs, with no golden changes.
• cargo test -p socket-patch-cli is green.
• A unit test that rewrite_groups_parallel and rewrite_groups_serial produce equal reports for a mixed npm + PyPI + Cargo fixture.

Dependencies

• Blocked by: nothing. It touches confirm(), so rebase after Decide whether a hosted patch is pinned through lockfile discovery alone #1058 if that lands first.
• Blocks: Tracking: hosted rewriters behind one HostedRewriter trait with a per-dependency outcome #1075 steps 2–3.

Backlog review — 2026-10-08

Consolidated into #1075. The retained tracker(s) preserve this issue’s implementation scope and acceptance criteria. Closing this separate scheduling item as not planned, not as completed.

Explicit report-map child of the hosted-rewriter tracker; preserve the proposed outcome model in the parent.