remove --preserve-state on a manifest-less hosted npm project silently restores the pin without the documented hosted_state_not_preservable note #433

[agent] Found by the scheduled npm bug-hunt routine (ledger #302).

Summary

In v5, a project patched by a bare scan (hosted mode) has no .socket/manifest.json. On such a project, socket-patch remove <purl> --preserve-state restores the hosted pin to the upstream registry and deletes the .npmrc. So the patch is gone, even though the user asked to preserve state.

The command never tells the user this. There's no "hosted wiring has no preservable local state" note on stderr, and no warnings[] in --json (the envelope has no warnings key at all). rollback --preserve-state on the same project correctly emits hosted_state_not_preservable.

Severity is low. The behaviour (restoring anyway) is what's documented; only the advisory is missing. But --preserve-state exists so the user can expect to re-apply later, and here it silently doesn't preserve.

Repro (Linux, npm 12.1.0, main 2463257)

A local mock of the patch API serves pkg:npm/left-pad@1.3.0. SPA="--api-url … --org o --api-token fake --patch-server-url …".

echo '{"name":"t","version":"1.0.0","private":true,"dependencies":{"left-pad":"1.3.0"}}' > package.json
npm install
socket-patch scan $SPA                                    # hosted: package-lock.json + .npmrc rewritten, no .socket/
socket-patch remove pkg:npm/left-pad@1.3.0 --preserve-state $SPA
#   The following hosted patch will be unwound and removed:
#     - pkg:npm/left-pad@1.3.0
#   Restored pkg:npm/left-pad@1.3.0 to its upstream registry entry
#   (no "no preservable local state" note)
socket-patch scan $SPA
socket-patch remove pkg:npm/left-pad@1.3.0 --preserve-state $SPA --json   # status success, events[hosted_reverted], no warnings key
socket-patch scan $SPA
socket-patch rollback --preserve-state $SPA --json        # warnings: [reinstall_required, hosted_state_not_preservable]  <- correct

It reproduces on 2 of 2 runs.

Expected vs actual

• Expected: CLI_CONTRACT.md's warning table, row hosted_state_not_preservable, says: "rollback --preserve-state (v5.0): hosted pins were restored to upstream anyway … (remove --preserve-state prints the same note on stderr.)". The --preserve-state (opt-out, both rollback and remove) section says the same: "a preserve run still restores them to upstream — surfaced as the hosted_state_not_preservable warning".
• Actual: the note is printed only on the manifest-backed remove path. The hosted-only path, which is the default v5 shape, prints nothing.

Suspect code

crates/socket-patch-cli/src/commands/remove.rs:1337 (remove_hosted_only). Its doc comment says "--preserve-state still unwinds — hosted has no preservable local state". But the Note: hosted wiring has no preservable local state … eprintln only exists in the manifest-backed hosted leg (remove.rs:770).

Backlog review — 2026-10-08

Priority: P1 → P3. The documented restore behavior is correct; only the preserve-state advisory is absent. Open PR #1008 already covers it.