Hosted cargo redirect writes a sparse+ registry even when the project declares rust-version < 1.68, so every build on that cargo fails with "usage of sparse registries requires -Z sparse-registry" while scan reports success #653

[agent] Found by the scheduled Cargo bug-hunt routine (ledger #315).

Summary

Hosted mode wires each patch through a per-patch registry [registries.socket-patch-<uuid>] index = "sparse+https://…" and pins Cargo.lock to it. Stable cargo only accepts sparse+ registries from 1.68. Older cargo refuses to load the source at all. scan --mode hosted never checks the project's declared floor (rust-version or rust-toolchain[.toml]), which vendored mode already reads for cargo_multi_version_old_cargo. A project that tells socket-patch it builds on cargo 1.67 gets status: success, redirected: 1 and no cargo-floor warning, and then every fresh build fails.

Impact

scan --mode hosted reports success, but every cargo fetch / cargo build on cargo ≤ 1.67 fails until the change is reverted. CI pinned to an MSRV toolchain goes red. Nothing tells the user why, apart from cargo's -Z sparse-registry message, which points at an unstable flag rather than at socket-patch. There is no documented hosted cargo floor: docs/ecosystems.md and CLI_CONTRACT.md give vendored floors (1.41 / 1.45 / 1.56) but say nothing for hosted. The repo's own hosted e2e legs only run 1.82 and stable.

Repro

This used a scratch copy of crates/socket-patch-cli/tests/e2e_redirect_cargo_build.rs (wiremock patch API + sparse index serving the real patched .crate). The only fixture change is rust-version = "1.67" in the consumer's [package]:

SOCKET_PATCH_CARGO_E2E_REQUIRED=1 SOCKET_PATCH_CARGO_E2E_TOOLCHAIN=1.67.1 \
  cargo test -p socket-patch-cli --test e2e_redirect_cargo_build \
  cargo_hosted_fresh_checkout_fetch_pulls_patched_crate_and_vex_verifies

(The unmodified test shows the same build failure on 1.67.1. The rust-version line only proves that the declared floor is ignored.)

The scan output (exit 0) has "status": "success" and "redirected": 1. Its only warning is patched_ref_unattributable, and there is no cargo-version warning. Then the fresh checkout's cargo fetch --locked fails:

error: failed to get `cfg-if` as a dependency of package `consumer v0.1.0 (…/fresh)`
  failed to load source for dependency `cfg-if`
Caused by:
  Unable to update registry `socket-patch-6b7c8d9e-0f1a-4a1b-8c2d-3e4f5a6b7c8d`
Caused by:
  usage of sparse registries requires `-Z sparse-registry`

Expected vs actual

• Expected. The hosted cargo row in docs/ecosystems.md promises a redirect that cargo builds ("per-patch sparse registry … + Cargo.lock source/checksum"). When the project declares a cargo it can't build on (rust-version or toolchain channel < 1.68), hosted mode should refuse, or at least warn the way vendored mode does with cargo_multi_version_old_cargo, and point at --mode vendored, which builds on 1.41+. The floor should also be documented.
• Actual. success, redirected: 1, no warning, and every build on that cargo fails.

OS × version

The hosted e2e capstone (cargo_hosted_fresh_checkout_fetch_pulls_patched_crate_and_vex_verifies), Linux sandbox, main 045d7ec:

This isn't OS-specific (it's cargo's source loader). macOS and Windows weren't probed. I didn't bisect it: hosted cargo has used sparse+ registries since it was introduced.

Suspect code

• crates/socket-patch-core/src/patch/redirect/mod.rs:2970 plan_cargo_config writes the sparse+ index, and rewrite_cargo (mod.rs:1169) has no cargo-floor gate.
• crates/socket-patch-core/src/vendor/cargo.rs:82 declared_cargo_minor already reads the project's declared floor and could be reused for a hosted refusal or warning (< 1.68).