Fix nightly old-uv orphan-unwind failure in uv e2e

[Mikola Lysenko (mikolalysenko)]

Problem

The nightly CI run on main failed today (run 38518420487). The suite failed in 4 of the 12 e2e-full (ubuntu-latest, e2e_redirect_uv_build, <uv>) legs: uv 0.2.37, 0.3.5, 0.4.30, 0.5.3. The 0.5.6 through 0.12.17 legs passed. Yesterday's nightly at 15c2c83 was green. Each failing leg failed in the same test and at the same assertion:

hosted_uv_transitive_override_manifestless_vex panicked at tests/vex_e2e_common/uv.rs:1986:
uv 0.5.3 hosted transitive [orphan-unwind]: uv.lock still wires six:
[manifest]
overrides = [{ name = "six", specifier = "==1.17.0" }]

The orphan-unwind step came in with #1453 (#1445), which landed after yesterday's nightly. The suite runs --ignored, so these old-uv legs only run nightly, and #1453's PR checks never ran them.

Root cause

uv before 0.5.6 records the override-dependencies pin that the hosted rewrite adds as a bare { name, specifier = "==<version>" } in [manifest] overrides, without folding in the [tool.uv.sources] url. restore_requirement_array only dropped a rewrite-owned overrides record when it carried the hosted url, so retiring an orphaned pin removed the pyproject lines but left the lock record behind. This is a product bug as well as a red nightly: on old uv, rollback leaves a lock that no longer matches pyproject.toml.

Fix

In [manifest] overrides, when the metadata holds the rewrite's marked pin for the package (transitive_override), also drop a url-less, marker-less record whose specifier is exactly ==<version>. A user's own unmarked pin still keeps its record (#411). That case is covered by the new unit test bare_manifest_override_of_the_rewrite_is_dropped.

Proof

• Reproduced locally with uv 0.5.3 (cargo test -p socket-patch-cli --test e2e_redirect_uv_build -- --ignored): same panic.
• After the fix, the full ignored suite passes 9/9 on uv 0.2.37, 0.5.3 and 0.11.32.
• cargo test -p socket-patch-core --lib upstream::uv passes 25/25. --test hosted_inventory passes 21/21. socket-patch-cli --test in_process_rollback_hosted passes 41/41.
• cargo clippy -p socket-patch-core --all-targets -- -D warnings reports the same 33 test-code lints with and without this change. All of them are already on main, and none is in the new code.

No tests were removed or moved.

🤖 Generated with Claude Code

https://claude.ai/code/session_012v7idpMckM6PU5mBKBBmmg

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 55902cd. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Labeled Ready for review by the burn-down agent.

• Head: 55902cd6f7505c4ca609bd26610ebb525512e58b
• CI: 54/54 check runs completed, all success or skipped (ci-ok green); no main-wide failures
• Bugbot: reviewed this head, no findings
• Mergeable: clean; one approval already on this head (Tanmay182003)
• Reviewer focus: the new bare-override drop in restore_requirement_array (crates/socket-patch-core/src/patch/redirect/upstream/uv.rs). It only fires when the metadata holds the rewrite's marked transitive_override pin, so a user's own unmarked ==<version> pin keeps its lock record (Hosted uv rollback and remove delete a user-authored override-dependencies = ["<pkg>==<ver>"] pin that hosted mode never added #411).

---

Generated by Claude Code