Check gem edits in vendor dry runs instead

Move the #1761 fix to the gem vendored backend: its dry run now
computes the Gemfile and lock edits the wet run would make and returns
the same refusal (for example a declaration inside a `group` block).

Every dry-run caller benefits, not just the eject: a plain
`vendor --dry-run` and the takeover previews over restored text now
report what the wet run would refuse. This replaces the eject-only
gate added in the previous commit, which checked each gem pin against
its own one-pin restore and hid earlier backend refusals.

Assisted-by: Claude Code:claude-opus-5-5

Author: claude

crates/socket-patch-cli/src/commands/vendor.rs

@@ -1850,27 +1850,12 @@ async fn run_eject(args: &VendorArgs, pins: Vec<HostedPin>) -> i32 {
     let installed_sites = vendor::pypi::InstalledSiteListings::default();
     let vendored_at = now_rfc3339();
     let restore_refused: HashSet<String> = refused.iter().map(|(p, _, _)| p.clone()).collect();
-    // The gem backend's dry run does not evaluate its manifest and Gemfile
-    // declaration gates, so ask them directly, as the per-purl takeover
-    // and `scan` / `get --mode vendored` do (#1761).
-    let mut gem_refusals = gem_takeover_refusals_for(
-        &common.cwd,
-        pins.iter().map(|pin| pin.purl.as_str()),
-        &pins,
-        common.offline,
-        origins.clone(),
-    )
-    .await;
     for pin in &pins {
         // A pin the restore already refused keeps its first, accurate
         // reason; previewing it again would add a second failure event.
         if restore_refused.contains(&pin.purl) {
             continue;
         }
-        if let Some((code, detail)) = gem_refusals.remove(&pin.purl) {
-            refused.push((pin.purl.clone(), code, detail));
-            continue;
-        }
         if let Some((code, detail)) = takeover_dry_refusal(
             &plan,
             &pin.purl,

crates/socket-patch-core/src/vendor/gem.rs

@@ -663,6 +663,14 @@ pub async fn vendor_gem<'a>(
     }
 
     if dry_run {
+        // An unwired gem previews the Gemfile and lock edit refusals the wet
+        // run raises (a declaration inside a `group` block, #1761), so a
+        // takeover or eject preview over the restored text refuses too.
+        if !lock_wired {
+            if let Err(outcome) = gem_edits(purl, &prelude) {
+                return *outcome;
+            }
+        }
         if let Err(outcome) =
             super::service_fetch::preview_service(service, record, extract_gem_data).await
         {
@@ -3663,6 +3671,25 @@ mod tests {
         assert!(detail.contains("path:"), "{detail}");
     }
 
+    /// #1761: a dry run raises the same declaration refusal as the wet run,
+    /// so a `vendor` eject preview does not report a refused gem as planned.
+    #[tokio::test]
+    async fn test_dry_run_previews_declaration_refusal() {
+        let grouped =
+            "source \"https://rubygems.org\"\n\ngroup :test do\n  gem \"rack\", \"~> 3.1\"\nend\n";
+        for dry_run in [true, false] {
+            let (_tmp, root, installed, blobs, record) = fixture(grouped, LOCK_DIRECT).await;
+            let (code, detail) =
+                unwrap_refused(run_vendor(&root, &blobs, &installed, &record, dry_run).await);
+            assert_eq!(
+                code, "gemfile_declaration_not_editable",
+                "dry_run={dry_run}"
+            );
+            assert!(detail.contains("indented"), "dry_run={dry_run}: {detail}");
+            assert!(!root.join(".socket").exists(), "dry_run={dry_run}");
+        }
+    }
+
     /// SECURITY: a traversal uuid (tampered manifest) must be refused before
     /// any disk access.
     #[tokio::test]