test(deps): class invariant — every shared LAZY_DEPS exact pin must match uv.lock

Generalizes the huggingface-hub lockstep test (#72320) to the whole
LAZY_DEPS surface: any package exact-pinned in LAZY_DEPS that the core
lock also resolves must pin the SAME version, so hermes update's lazy
refresh can never churn or downgrade a shared package out from under
its other consumers (#60783 class, #31817 class).

Together with the anchor-based activation gate (previous commit,
salvaged from #27878 by @paralegalia), this closes both halves of
#44404: features no longer false-activate from shared transitives, and
even a feature that legitimately activates cannot move a shared package
away from the locked version.

contributors/emails/viteballoons@gmail.com

@@ -0,0 +1 @@
+paralegalia

tests/test_project_metadata.py

@@ -227,16 +227,70 @@ def test_nemo_relay_extra_uses_supported_official_distribution_range():
 
 def _uv_lock_version(package: str) -> str:
     """Resolved version of ``package`` in uv.lock, or fail loudly."""
+    versions = _uv_lock_versions(package)
+    assert versions, f"{package} not found in uv.lock"
+    assert len(versions) == 1, f"{package} resolves to multiple versions in uv.lock: {versions}"
+    return next(iter(versions))
+
+
+def _uv_lock_versions(package: str) -> set[str]:
+    """All resolved versions of ``package`` in uv.lock (normally 0 or 1)."""
     import re
 
     lock_path = Path(__file__).resolve().parents[1] / "uv.lock"
     lock = lock_path.read_text(encoding="utf-8")
-    m = re.search(
-        rf'\[\[package\]\]\nname = "{re.escape(package)}"\nversion = "([^"]+)"',
-        lock,
+    return {
+        m.group(1)
+        for m in re.finditer(
+            rf'\[\[package\]\]\nname = "{re.escape(package)}"\nversion = "([^"]+)"',
+            lock,
+        )
+    }
+
+
+def test_every_lazy_deps_exact_pin_matches_uv_lock():
+    """Class invariant for #60783/#60685: one version per package, everywhere.
+
+    Any package that is BOTH exact-pinned in ``tools/lazy_deps.py`` AND
+    resolved in the committed uv.lock is a *shared* package: the core
+    install ships the locked version, and the ``hermes update`` lazy-refresh
+    pass re-asserts the LAZY_DEPS pin whenever the package is present
+    (``active_features()``). If the two disagree, every update churns the
+    package — and when the lazy pin is older, it force-DOWNGRADES a version
+    another consumer needs (huggingface-hub==1.2.3 vs transformers'
+    >=1.5.0 broke Hindsight local embeddings; stale aiohttp pins reopened
+    patched CVEs in #31817). Contract: for every such package, pin ==
+    locked version. When bumping a pin, regenerate the lock in the same
+    commit (`uv lock --upgrade-package <name>`), and vice versa.
+    """
+    from tools.lazy_deps import LAZY_DEPS
+
+    drift = {}
+    seen = set()
+    for feature, specs in LAZY_DEPS.items():
+        for package, pin in _exact_pins(specs).items():
+            if (package, pin) in seen:
+                continue
+            seen.add((package, pin))
+            locked = _uv_lock_versions(package)
+            if not locked:
+                # Lazy-only package never resolved by the core lock — no
+                # shared-version hazard.
+                continue
+            if pin not in locked:
+                drift.setdefault(package, {})[feature] = {
+                    "lazy_pin": pin,
+                    "uv_lock": sorted(locked),
+                }
+
+    assert not drift, (
+        "LAZY_DEPS exact pins must match the uv.lock resolved version for "
+        "every package the core lock also ships — otherwise `hermes update` "
+        "churns/downgrades the shared package out from under its other "
+        "consumers (#60783, #31817). Bump the pin AND run "
+        "`uv lock --upgrade-package <name>` in the same commit. Drift: "
+        f"{drift}"
     )
-    assert m, f"{package} not found in uv.lock"
-    return m.group(1)
 
 
 def test_huggingface_hub_lazy_pin_matches_uv_lock():