Fix fail-closed handling for corrupt ledger and discovery errors

Bug 1 (b691b777): Corrupt ledger routes off JVM backend
- jvm_shape: Changed from .ok()? to proper match that fail-closes on
  load_state error, continuing to detect shape even with corrupt ledger
- vendor_maven_jvm: Changed from silently skipping inherit_peer_records
  on error to failing with vendor_ledger_corrupt error message

Bug 2 (30f7f45e): VEX misses live JVM wiring
- maven_reactor::wired: Changed from .is_ok_and() to match that returns
  true (fail-closed) when Reactor::discover fails with unsupported layout
- entry_wired: Check for escaped paths first and return true (fail-closed)
  before checking wiring, matching revert's refusal behavior

All changes implement fail-closed semantics: errors are treated as
'still wired' rather than 'not wired', preventing silent failures and
incorrect GC of live vendored entries.

Author: cursoragent

crates/socket-patch-core/src/vendor/jvm/apply.rs

@@ -619,13 +619,17 @@ pub fn entry_wired(root: &Path, entry: &VendorEntry) -> bool {
         uuid: &entry.uuid,
     };
     let reader = ProjectReader::new(root);
+    // Fail-closed: a path escaping the checkout is not proof the entry is
+    // unwired; treat it as still live (same as revert's refusal).
+    if reader.escaped().is_some() {
+        return true;
+    }
     let read = |rel: &str| reader.read(rel);
-    let wired = if is_gradle(&entry.wiring) {
+    if is_gradle(&entry.wiring) {
         gradle::wired(&read, &c)
     } else {
         maven_reactor::wired(&read, &c)
-    };
-    wired && reader.escaped().is_none()
+    }
 }
 
 /// The vendored jar of the JVM `entry` for `uuid`, project-relative: the

crates/socket-patch-core/src/vendor/jvm/maven_reactor.rs

@@ -352,12 +352,17 @@ pub fn unplan(read: ReadFn<'_>, c: &Coords<'_>, records: &[WiringRecord]) -> Jvm
 /// (outside comments): the liveness proof `vex` needs for this layout.
 pub fn wired(read: ReadFn<'_>, c: &Coords<'_>) -> bool {
     let sv = c.suffixed_version();
-    Reactor::discover(read).is_ok_and(|reactor| {
-        reactor
+    match Reactor::discover(read) {
+        Ok(reactor) => reactor
             .scope
             .iter()
-            .any(|rel| reactor.poms[rel].doc.masked.contains(&sv))
-    })
+            .any(|rel| reactor.poms[rel].doc.masked.contains(&sv)),
+        Err(_) => {
+            // Fail-closed: discovery failure (broken pom, nested .mvn, etc.)
+            // is not proof the entry is unwired; treat it as still live.
+            true
+        }
+    }
 }
 
 /// `<!-- socket-patch <uuid>:` — the start of `c`'s pin comment.

crates/socket-patch-core/src/vendor/maven_repo.rs

@@ -716,9 +716,17 @@ pub async fn revert_maven_opts(
 /// flag), and only for a reactor or a Gradle build.
 async fn jvm_shape(project_root: &Path) -> Option<super::jvm::Shape> {
     if !super::jvm::experimental_enabled() {
-        let state = super::state::load_state(project_root).await.ok()?;
-        if !state.entries.values().any(super::jvm::apply::is_jvm_entry) {
-            return None;
+        match super::state::load_state(project_root).await {
+            Ok(state) => {
+                if !state.entries.values().any(super::jvm::apply::is_jvm_entry) {
+                    return None;
+                }
+            }
+            Err(_) => {
+                // Fail-closed: unreadable or corrupt ledger is never empty.
+                // Continue to detect shape so a corrupt ledger with JVM entries
+                // still routes to the JVM backend.
+            }
         }
     }
     let reader = super::jvm::apply::ProjectReader::new(project_root);
@@ -914,8 +922,19 @@ async fn vendor_maven_jvm(
     };
     // Shared fragments another JVM entry wrote, and the pristine originals
     // of a patch update, come from the ledger (§7.3).
-    if let Ok(state) = super::state::load_state(project_root).await {
-        super::jvm::apply::inherit_peer_records(&mut wiring, state.entries.values());
+    match super::state::load_state(project_root).await {
+        Ok(state) => {
+            super::jvm::apply::inherit_peer_records(&mut wiring, state.entries.values());
+        }
+        Err(e) => {
+            // Fail-closed: unreadable or corrupt ledger is never empty. Without
+            // peer records, a later revert cannot restore shared fragments.
+            return done(
+                failed_result(purl, &jar_path, format!("vendor_ledger_corrupt: {e}")),
+                None,
+                warnings,
+            );
+        }
     }
     let entry = maven_entry(
         build_maven_purl(&group_id, &artifact_id, &version),