Fix hosted uv unwind deleting user override pins (#411)

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Fixes #411

Summary

A hosted rollback / remove (and the hosted → vendored takeover, which runs the same upstream restore) of a uv project deleted the user's own [tool.uv] override-dependencies = ["six==1.16.0"] pin, the lock's [manifest] overrides record of it and the emptied [tool.uv] table, then warned upstream_uv_override_removed as if hosted mode had added it. The next uv lock --upgrade moved six past the release the user had pinned.

Root cause

v5 hosted mode keeps no ledger, so pushed_override in patch/redirect/upstream/uv.rs decided ownership by spelling alone: any <name>==<version> override of a transitive dependency counted as the one the rewrite adds. The hosted rewrite (utils/python_script.rs rewrite_sources) reuses a user's identical override rather than adding one, so after the scan the two cases were byte-identical.

Fix

• The hosted rewrite now writes the override entry it adds on its own line under a comment, # socket-patch hosted: pins a patched transitive dependency; rollback removes it (HOSTED_OVERRIDE_MARK). That comment is the ownership evidence. A new array is laid out multi-line. When the array already exists, only the new element is added, and removing it brings back the original bytes. Only the hosted (ArtifactSource::Url) lane is marked. Vendored script wiring is unchanged, because its ledger records the originals.
• pushed_override matches only a marked entry. A user's unmarked pin is kept, restore_metadata reports no removal (so no upstream_uv_override_removed), and the lock's [manifest] overrides entry gets its specifier back from the declaration instead of being dropped.
• CLI_CONTRACT.md (hosted unwind coverage, warning table) and docs/testing/uv-compatibility.md describe the marker.

Note: v5 is unreleased, so no released build wrote unmarked hosted overrides. Under this rule, an unmarked entry left by a pre-release main build is kept (fail-safe). The lock and pyproject stay consistent.

Tests (red → green)

Issue	Test	Before fix	After
#411 pyproject + PEP 723 script	upstream::uv::tests::restore_keeps_a_user_authored_override_of_the_patched_release (hosted rewrite → restore round-trips a user override byte-for-byte, in three array spellings and a script)	FAILED	ok
#411 uv.lock [manifest] overrides	upstream::uv::declaration_tests::manifest_override_of_a_user_pin_is_restored_not_dropped	FAILED	ok
guard: hosted-added override still removed	upstream::uv::tests::restore_removes_the_override_the_rewrite_added (new array, existing single-line and multi-line user arrays, script)	–	ok

Red was verified by reverting only the ownership check in pushed_override. Updated: four python_script rendering tests that pin the hosted output, and the python_lock_rewrite golden (re-blessed; only output digests of cases that add an override changed).

Commands run

• cargo test -p socket-patch-core --lib: 6112 passed
• SOCKET_PATCH_UV_E2E_REQUIRED=1 cargo test -p socket-patch-cli --test e2e_redirect_uv_build -- --ignored hosted_uv_transitive_override_manifestless_vex hosted_uv_script_lock_manifestless_vex (real uv 0.11.19): both ok. The fresh install is patched, a plain uv sync keeps the lock, and the transitive revert restores the upstream registry entry.
• cargo fmt --all -- --check (my files clean; upstream/mod.rs diff is pre-existing on main) and cargo clippy --workspace --all-features -- -D warnings: clean

🤖 Generated with Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 6eefaf2. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Ready for review at 084a093e1c1b.

• CI: required checks ci-ok and clippy green; 6 check suites succeeded. 1 superseded workflow run(s) show as cancelled; the required gates passed on this head.
• Mergeable against main, no CHANGELOG.md change.
• Bugbot reviewed this head; no unresolved review threads.

Labeled Ready for review by the burn-down agent. Slack announcement pending (connector unavailable this run).

---

Generated by Claude Code