From 1959e2a6b68b2c5d97f7346491d1a681ade0a6b2 Mon Sep 17 00:00:00 2001
From: teknium1 <127238744+teknium1@users.noreply.github.com>
Date: Sun, 26 Jul 2026 17:56:00 -0700
Subject: [PATCH] =?UTF-8?q?test(deps):=20class=20invariant=20=E2=80=94=20e?=
 =?UTF-8?q?very=20shared=20LAZY=5FDEPS=20exact=20pin=20must=20match=20uv.l?=
 =?UTF-8?q?ock?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Generalizes the huggingface-hub lockstep test (#72320) to the whole
LAZY_DEPS surface: any package exact-pinned in LAZY_DEPS that the core
lock also resolves must pin the SAME version, so hermes update's lazy
refresh can never churn or downgrade a shared package out from under
its other consumers (#60783 class, #31817 class).

Together with the anchor-based activation gate (previous commit,
salvaged from #27878 by @paralegalia), this closes both halves of
#44404: features no longer false-activate from shared transitives, and
even a feature that legitimately activates cannot move a shared package
away from the locked version.
---
 contributors/emails/viteballoons@gmail.com |  1 +
 tests/test_project_metadata.py             | 64 ++++++++++++++++++++--
 2 files changed, 60 insertions(+), 5 deletions(-)
 create mode 100644 contributors/emails/viteballoons@gmail.com

diff --git a/contributors/emails/viteballoons@gmail.com b/contributors/emails/viteballoons@gmail.com
new file mode 100644
index 000000000000..ed5b634285fa
--- /dev/null
+++ b/contributors/emails/viteballoons@gmail.com
@@ -0,0 +1 @@
+paralegalia
diff --git a/tests/test_project_metadata.py b/tests/test_project_metadata.py
index beb523f15b8d..0b2257426299 100644
--- a/tests/test_project_metadata.py
+++ b/tests/test_project_metadata.py
@@ -227,16 +227,70 @@ def test_nemo_relay_extra_uses_supported_official_distribution_range():
 
 def _uv_lock_version(package: str) -> str:
     """Resolved version of ``package`` in uv.lock, or fail loudly."""
+    versions = _uv_lock_versions(package)
+    assert versions, f"{package} not found in uv.lock"
+    assert len(versions) == 1, f"{package} resolves to multiple versions in uv.lock: {versions}"
+    return next(iter(versions))
+
+
+def _uv_lock_versions(package: str) -> set[str]:
+    """All resolved versions of ``package`` in uv.lock (normally 0 or 1)."""
     import re
 
     lock_path = Path(__file__).resolve().parents[1] / "uv.lock"
     lock = lock_path.read_text(encoding="utf-8")
-    m = re.search(
-        rf'\[\[package\]\]\nname = "{re.escape(package)}"\nversion = "([^"]+)"',
-        lock,
+    return {
+        m.group(1)
+        for m in re.finditer(
+            rf'\[\[package\]\]\nname = "{re.escape(package)}"\nversion = "([^"]+)"',
+            lock,
+        )
+    }
+
+
+def test_every_lazy_deps_exact_pin_matches_uv_lock():
+    """Class invariant for #60783/#60685: one version per package, everywhere.
+
+    Any package that is BOTH exact-pinned in ``tools/lazy_deps.py`` AND
+    resolved in the committed uv.lock is a *shared* package: the core
+    install ships the locked version, and the ``hermes update`` lazy-refresh
+    pass re-asserts the LAZY_DEPS pin whenever the package is present
+    (``active_features()``). If the two disagree, every update churns the
+    package — and when the lazy pin is older, it force-DOWNGRADES a version
+    another consumer needs (huggingface-hub==1.2.3 vs transformers'
+    >=1.5.0 broke Hindsight local embeddings; stale aiohttp pins reopened
+    patched CVEs in #31817). Contract: for every such package, pin ==
+    locked version. When bumping a pin, regenerate the lock in the same
+    commit (`uv lock --upgrade-package <name>`), and vice versa.
+    """
+    from tools.lazy_deps import LAZY_DEPS
+
+    drift = {}
+    seen = set()
+    for feature, specs in LAZY_DEPS.items():
+        for package, pin in _exact_pins(specs).items():
+            if (package, pin) in seen:
+                continue
+            seen.add((package, pin))
+            locked = _uv_lock_versions(package)
+            if not locked:
+                # Lazy-only package never resolved by the core lock — no
+                # shared-version hazard.
+                continue
+            if pin not in locked:
+                drift.setdefault(package, {})[feature] = {
+                    "lazy_pin": pin,
+                    "uv_lock": sorted(locked),
+                }
+
+    assert not drift, (
+        "LAZY_DEPS exact pins must match the uv.lock resolved version for "
+        "every package the core lock also ships — otherwise `hermes update` "
+        "churns/downgrades the shared package out from under its other "
+        "consumers (#60783, #31817). Bump the pin AND run "
+        "`uv lock --upgrade-package <name>` in the same commit. Drift: "
+        f"{drift}"
     )
-    assert m, f"{package} not found in uv.lock"
-    return m.group(1)
 
 
 def test_huggingface_hub_lazy_pin_matches_uv_lock():