Document uv export co-wiring in the contract

The pypi_multiple_lockfiles row now says an exact pin in a uv export
requirements.txt is wired with uv.lock, as one beside Pipfile.lock is,
and the #1120 CLI test keeps covering the UTF-16 exports that the
requirements wiring still refuses.

Refs #1368

Assisted-by: Claude Code:claude-opus-5-5

Author: claude

crates/socket-patch-cli/CLI_CONTRACT.md

@@ -1418,7 +1418,7 @@ Every `--json` invocation emits a single JSON object that follows the **unified
 | `redirect_unconfirmed`    | `skipped` (`details.mode: "hosted"`) | hosted `scan` / `get` (v5.0, additive): the patch was granted but no lockfile entry pinning it could be rewritten. The status and exit code are unchanged for now, pending the open hosted exit-policy decision (#704); `--silent` hides the human line. |
 | `lockfile_unreadable` / `lockfile_unparseable` / `patched_ref_invalid` / `patched_ref_unattributable` | run-level `warnings[]` | vex (every form): lockfile-discovery diagnostics — see "Manifest-less VEX (lockfile discovery)". Never flip the exit on their own. |
 | `vex_npm_shrinkwrap_only` | run warning and `failed[].reason` | vex (every form, #899): the patch is wired only in a root `npm-shrinkwrap.json` with no `package-lock.json` twin, which npm >= 12 never reads; no statement until the twin exists. `list` / `rollback` / `remove` still manage the wiring. |
-| `vendor_multiple_lockfiles` / `pypi_multiple_lockfiles` | `skipped` (warning) | vendor: a sibling lockfile of another package manager (for PyPI, also a root `requirements.txt` that pins the package beside the wired tool lock) will still install UNPATCHED bytes; names the wired winner + the ignored locks. Beside `Pipfile.lock`, an exact registry pin of the package in `requirements.txt` or an in-root `-r` include (`pipenv requirements` output) is wired with the lock instead and never named here (#612): both files then refer to the committed wheel, the ledger entry records both, every revert restores both, and a re-run over a project whose `Pipfile.lock` is already wired (a vendor from before, or an export made since) wires the export too (`pypi_requirements_sibling_wired`). A pin the requirements wiring cannot rewrite (a range, extras, an include outside the root) stays a loser. |
+| `vendor_multiple_lockfiles` / `pypi_multiple_lockfiles` | `skipped` (warning) | vendor: a sibling lockfile of another package manager (for PyPI, also a root `requirements.txt` that pins the package beside the wired tool lock) will still install UNPATCHED bytes; names the wired winner + the ignored locks. Beside `Pipfile.lock` or `uv.lock`, an exact registry pin of the package in `requirements.txt` or an in-root `-r` include (`pipenv requirements` or `uv export` output) is wired with the lock instead and never named here (#612, #1368): both files then refer to the committed wheel, the ledger entry records both, every revert restores both, a superseding patch re-wires both, and a re-run over a project whose lock is already wired (a vendor from before, or an export made since) wires the export too (`pypi_requirements_sibling_wired`). A pin the requirements wiring cannot rewrite (a range, extras, an include outside the root) stays a loser. |
 | `vendor_npm_shrinkwrap_only` | `skipped` (warning) | vendor / scan / get `--mode vendored` (npm, #899): the package was wired into `npm-shrinkwrap.json`, the only npm lock (also on an in-sync re-run). npm >= 12 never reads the shrinkwrap and installs the unpatched registry bytes; rename the lock to `package-lock.json` (or commit a copy under that name) and re-run. |
 | `vendor_workspace_member_skipped` | `skipped` (warning) | vendor / scan / get `--mode vendored` (npm, #688): a lock entry with the package's `name@version` is the project's own source (a workspace member or a `file:` directory), so it is left alone while the lock's registry copies are vendored; patch that source directly if it needs the fix. When it is the only instance, vendoring refuses instead. |
 | `vendor_npm_allow_file` | `skipped` (warning, printed as `Warning (vendor_npm_allow_file)`) | vendor / scan / get `--mode vendored` (package-lock, #969): the effective npm `allow-file` setting (env > project `.npmrc` > user > global > builtin) is not `all`, so npm >= 11.14 refuses the vendored `file:` tarball (EALLOWFILE) on install. The setting is respected, never rewritten; the detail names where it comes from and the remedy (`allow-file=all`). `vendor --check` fails the entry for the same reason. |

crates/socket-patch-cli/tests/mode_migration_pypi.rs

@@ -1625,15 +1625,71 @@ async fn vendor_check_fails_after_hatch_dependency_reset() {
     assert_check_catches_relock(&root, files);
 }
 
+/// #1368: a `uv export` requirements.txt beside `uv.lock` is an install
+/// source of its own (Docker / plain pip). `vendor` wires its exact pin to
+/// the same committed wheel as uv.lock, `vendor --check` passes with no
+/// contest, a re-run is settled, and `vendor --revert` restores all three
+/// files byte for byte.
+#[tokio::test]
+async fn uv_requirements_export_is_wired_with_the_lock() {
+    let export = "six==1.16.0 \\\n    --hash=sha256:WHEEL_SHA\n".replace("WHEEL_SHA", WHEEL_SHA);
+    let (_tmp, root) = project();
+    let files = stage_uv(&root);
+    std::fs::write(root.join("requirements.txt"), &export).unwrap();
+    let originals: Vec<(&str, Vec<u8>)> = files
+        .iter()
+        .chain(&["requirements.txt"])
+        .map(|f| (*f, std::fs::read(root.join(f)).unwrap()))
+        .collect();
+    stage_manifest(&root);
+    let needle = format!(".socket/vendor/pypi/{UUID}/");
+
+    let (code, env) = run_cli(&root, &["vendor"], &[]);
+    assert_eq!(code, 0, "{env:#}");
+    for file in ["uv.lock", "requirements.txt"] {
+        assert!(
+            std::fs::read_to_string(root.join(file))
+                .unwrap()
+                .contains(&needle),
+            "{file} is wired: {env:#}"
+        );
+    }
+    assert!(
+        !env.to_string().contains("pypi_multiple_lockfiles"),
+        "the export is wired, not an unpatched loser: {env:#}"
+    );
+
+    let (code, env) = run_cli(&root, &["vendor", "--check"], &[]);
+    assert_eq!(code, 0, "both install sources are wired: {env:#}");
+
+    // Re-running is settled: nothing rewritten.
+    let wired = std::fs::read(root.join("requirements.txt")).unwrap();
+    let (code, env) = run_cli(&root, &["vendor"], &[]);
+    assert_eq!(code, 0, "{env:#}");
+    assert_eq!(std::fs::read(root.join("requirements.txt")).unwrap(), wired);
+
+    let (code, env) = run_cli(&root, &["vendor", "--revert"], &[]);
+    assert_eq!(code, 0, "{env:#}");
+    for (file, bytes) in &originals {
+        assert_eq!(
+            &std::fs::read(root.join(file)).unwrap(),
+            bytes,
+            "{file} is restored"
+        );
+    }
+    assert!(!root.join(format!(".socket/vendor/pypi/{UUID}")).exists());
+}
+
 /// #1120: a `requirements.txt` exported beside `uv.lock` pins the
-/// package from PyPI, so the uv-only wiring leaves installs from it
-/// unpatched. `uv export > requirements.txt` in Windows PowerShell 5.1
-/// writes it as UTF-16 with a byte-order mark, which pip and uv read like
-/// its UTF-8 twin, so `vendor` must name it (`pypi_multiple_lockfiles`)
-/// and `vendor --check` must fail on the contested wiring in every
-/// encoding, not pass as if the file were absent.
+/// package from PyPI. `uv export > requirements.txt` in Windows
+/// PowerShell 5.1 writes it as UTF-16 with a byte-order mark, which pip
+/// and uv read like its UTF-8 twin but the requirements wiring refuses to
+/// rewrite, so the uv-only wiring leaves installs from it unpatched:
+/// `vendor` must name it (`pypi_multiple_lockfiles`) and `vendor --check`
+/// must fail on the contested wiring, not pass as if the file were absent.
+/// (Its UTF-8 twin is wired with the lock, #1368.)
 #[tokio::test]
-async fn uv_requirements_export_contests_the_wiring_in_any_encoding() {
+async fn uv_requirements_export_contests_the_wiring_in_utf16() {
     let text = "six==1.16.0\r\n";
     let le: Vec<u8> = [0xFF, 0xFE]
         .into_iter()
@@ -1643,11 +1699,7 @@ async fn uv_requirements_export_contests_the_wiring_in_any_encoding() {
         .into_iter()
         .chain(text.encode_utf16().flat_map(u16::to_be_bytes))
         .collect();
-    for (case, bytes) in [
-        ("utf-8", text.as_bytes().to_vec()),
-        ("utf-16 le", le),
-        ("utf-16 be", be),
-    ] {
+    for (case, bytes) in [("utf-16 le", le), ("utf-16 be", be)] {
         let (_tmp, root) = project();
         stage_uv(&root);
         std::fs::write(root.join("requirements.txt"), &bytes).unwrap();