From d0d8f6a4397bf35220c20cddad2a44e5c7336cd8 Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Fri, 9 Oct 2026 12:42:51 -0400
Subject: [PATCH 1/2] WIP: Fix hosted cargo contested lock in vex and restore
 (#679, #863)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

From b532b71177ff6307ba443835ac54446e00764c5e Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Fri, 9 Oct 2026 13:36:45 -0400
Subject: [PATCH 2/2] Fix cargo locks that also hold a crates.io twin

After a hosted cargo scan pins cfg-if 1.0.4, a dependency added later
can lock its own crates.io cfg-if 1.0.4 beside the Socket one. Cargo
cannot unify the two sources, so the build compiles the unpatched copy
too.

- vex: the hosted ref is withheld (patched_ref_unattributable, naming
  the crates.io entry) instead of attested not_affected. It stays a
  shadowed ref, so rollback, remove and list still unwind it (#679).
- remove / rollback: the upstream restore merges the Socket block into
  the existing crates.io block. It drops the block (and a v1 lock's
  [metadata] line) and respells dependents' references the way cargo
  writes them. Before, it left two identical blocks that cargo refused
  to parse while the command reported success (#863). No index lookup
  is needed, so this also works offline.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 crates/socket-patch-cli/CLI_CONTRACT.md       |   4 +-
 .../tests/e2e_redirect_cargo_shapes.rs        | 188 ++++++++++++
 .../src/patch/redirect/upstream/cargo.rs      | 268 +++++++++++++++++-
 .../src/vex/discover/cargo.rs                 | 111 ++++++++
 4 files changed, 568 insertions(+), 3 deletions(-)

diff --git a/crates/socket-patch-cli/CLI_CONTRACT.md b/crates/socket-patch-cli/CLI_CONTRACT.md
index bb4592f4b..b27bccced 100644
--- a/crates/socket-patch-cli/CLI_CONTRACT.md
+++ b/crates/socket-patch-cli/CLI_CONTRACT.md
@@ -378,7 +378,7 @@ Discovery is read-only, never touches the network, and never fails the run: a ma
 | yarn | `yarn.lock` (classic and berry) | classic `resolved`; berry entry keyed and resolved `<name>@<url>` + root `package.json` `resolutions` `"<name>@npm:<range>": "<url>"` (older releases: `resolution: …::__archiveUrl=<url>`) | classic `resolved "file:./.socket/vendor/npm/…#<sha1>"`; berry `file:` entry **plus** a root `package.json` `resolutions` mapping onto the same artifact (without it the entry is orphaned: diagnosed, no ref) | classic `integrity` / `#sha1`, berry `checksum`, required |
 | bun | `bun.lock`; `bun.lockb` only when there is no `bun.lock` (bun reads exactly one) | URL tuple / binary remote-tarball resolution; version from the URL leaf. A user URL or `file:` tarball tuple / record whose `<name>-<ver>.tgz` leaf names the same `name@version` is installed from its own spec, so every ref for that `name@version` is dropped | `.socket/vendor/npm/<uuid>/<name>-<ver>.tgz` tuple / local-tarball resolution | `sha512-…`, required. A 2-tuple that Bun < 1.3.10 re-saved without its digest is still a reference, but it attests only from an installed tree. |
 | vlt | `vlt-lock.json` (lockfileVersion absent, `0` or `1`; a BOM-prefixed, unparseable, non-object or other-version lock is not read: diagnosed, no ref). `vlt.json` (read only for its `modifiers`) and `node_modules/.vlt-lock.json` are never wiring. | a registry node (any segment) whose slot [3] is a `/patch/npm/…` URL on the patch host with the leaf `<bare>-<ver>.tgz` of its DepID's `name@version`, whose embedded `<name>/<ver>` path (when present) is that `name@version`, and slot [1] == name; version from the DepID | a `file` node `.socket/vendor/npm/<uuid>/<name>-<ver>/node_modules/<name>` (or a user-installed `<name>-<ver>.tgz`) with slot [1] == name; version from the path. A same-`name@version` registry node, or a diagnosed Socket-shaped one, beside it is diagnosed, no ref. | slot [2] `sha512-…`, required (a hosted node without one is no reference). A same-`name@version` node on another registry, or a diagnosed Socket-shaped one, keeps the reference but withholds the lockfile basis: only an installed tree whose every store copy verifies attests. So does a lock some vlt release discards, the conditions of `redirect_vlt_lockfile_version_missing`, `redirect_vlt_old_lockfile_ignored` and `redirect_vlt_scalar_registry_ignored` (which in-run `--vex` withholds too): every hosted reference in it keeps no pin, and one `patched_ref_unattributable` names them. |
-| cargo | `Cargo.lock`, `Cargo.toml`, `.cargo/config` (else `.cargo/config.toml`) | `Cargo.lock` `source = "sparse+…/<uuid>/index/"`, confirmed by `Cargo.toml`: a crate the root manifest declares must pin `registry = "socket-patch-<uuid>"`. A reverted pin is diagnosed, no ref. | `[patch.<source>] <key> = { path = ".socket/vendor/cargo/<uuid>/<name>-<ver>" }` — primarily the root `Cargo.toml` (v5 `vendor`; key-agnostic: `<name>` is `package` when renamed, else the key, so `<name>-socket-<uuid8>` keys count), also the project config (pre-v5 wiring), live only while the lock holds a sourceless entry for it that is not in `[[patch.unused]]`; a manifest entry cargo ignores — the project config redefines its key with another path, or a `[patch."https://github.com/rust-lang/crates.io-index"]` table replaces `[patch.crates-io]` — is diagnosed (`patched_ref_invalid`), no ref | `checksum` (v1: `[metadata]`), required |
+| cargo | `Cargo.lock`, `Cargo.toml`, `.cargo/config` (else `.cargo/config.toml`) | `Cargo.lock` `source = "sparse+…/<uuid>/index/"`, confirmed by `Cargo.toml`: a crate the root manifest declares must pin `registry = "socket-patch-<uuid>"`. A reverted pin is diagnosed, no ref. Another `[[package]]` of the same `name@version` from a non-Socket source (crates.io, git), which cargo locks beside the pin for a dependent added later and builds unpatched (#679), withholds the ref (`patched_ref_unattributable`, never attested) while `rollback` / `remove` still unwind it. | `[patch.<source>] <key> = { path = ".socket/vendor/cargo/<uuid>/<name>-<ver>" }` — primarily the root `Cargo.toml` (v5 `vendor`; key-agnostic: `<name>` is `package` when renamed, else the key, so `<name>-socket-<uuid8>` keys count), also the project config (pre-v5 wiring), live only while the lock holds a sourceless entry for it that is not in `[[patch.unused]]`; a manifest entry cargo ignores — the project config redefines its key with another path, or a `[patch."https://github.com/rust-lang/crates.io-index"]` table replaces `[patch.crates-io]` — is diagnosed (`patched_ref_invalid`), no ref | `checksum` (v1: `[metadata]`), required |
 | golang | `go.mod`, `go.work`, `go.sum`, `go.work.sum` | `replace M v => patch.socket.dev/gopatch/<uuid> <sver>` | `replace M v => ./.socket/vendor/golang/<uuid>/M@v` | both go.sum lines, required. A replace that `require` no longer selects (`require M v'`) is inert: diagnosed, no ref. |
 | pypi | `uv.lock` (confirmed by `pyproject.toml` `[tool.uv.sources]` when present), PEP 723 `<script>.py.lock`, `pylock.toml` / `pylock.<name>.toml`, `poetry.lock`, `pdm.lock`, `Pipfile.lock`, `requirements.txt` + its in-root `-r` includes, PEP 508 direct references in `pyproject.toml` / `hatch.toml` | Socket-host artifact url | `.socket/vendor/pypi/<uuid>/<wheel>` naming the entry's own dist | sha256, required |
 | gem | `Gemfile.lock` and `gems.locked` (the `Gemfile` / `gems.rb` only to cross-check a merged multi-remote `GEM` section) | a `GEM` section whose remote ends `patch-registry/gem/<token>/<uuid>` | `PATH` remote `.socket/vendor/gem/<uuid>/<name>-<ver>` | `CHECKSUMS` sha256, required only when the lock has a `CHECKSUMS` section (bundler ≥ 2.6) |
@@ -961,7 +961,7 @@ v5.0 replaces v4's per-purl reverts and whole-ledger reverse replay (`revert_rem
 * **What a restore does.** Every file wiring the pin is rewritten back to the DEFAULT UPSTREAM registry entry for `name@version`, re-resolving whatever the entry pins (tarball URL, integrity, checksum, hashes) from the public registry; only the hosted entries change and every other byte stays the file's own. A pin is **all-or-nothing**: refused in one of its files, it is restored in none of them, so no pin is left half hosted. Nothing reaches disk until every pin has resolved, and `--dry-run` resolves exactly like a wet run — registry lookups included — and skips only the write. Per format:
   * **npm family** — `package-lock.json` / `npm-shrinkwrap.json`, `yarn.lock` (classic and berry), `pnpm-lock.yaml` / `shrinkwrap.yaml`, `bun.lock`: resolution + integrity (+ shasum where recorded) from the npm registry's version document (`SOCKET_NPM_REGISTRY`); a yarn berry lock whose `.yarnrc.yml` names another `npmRegistryServer` reads that registry's document instead, so a mirror's off-path `dist.tarball` keeps its `::__archiveUrl=` binding, and a pnpm lock whose sibling settings name a registry reads that registry's document — `.npmrc` `registry` (or, for a scoped name, `@scope:registry`); on pnpm 10 a pnpm-workspace.yaml `registries` map instead when present; on pnpm 11+ (or an unknown major) pnpm-workspace.yaml `registries."@scope"` / `registry` / `registries.default` too, ahead of the matching `.npmrc` key — so a mirror's `tarball:` comes back as pnpm recorded it and a URL conventional under that registry stays derived (falling back to the default registry, with `upstream_registry_fallback`, when the mirror can't be read; a value holding an unexpanded `${VAR}` is read as unset). Whether a restored pnpm entry gets its `tarball:` back follows `lockfileIncludeTarballUrl` as the pnpm that wrote the lock read it (#902), from the strongest evidence available: (1) the lock's own unpinned registry resolutions (a bare one proves it off; a URL pnpm could have derived proves it on; pnpm 11+'s env lockfile document does not count); else (2) the settings file the installed pnpm major reads (`node_modules/.modules.yaml` `packageManager`, else package.json `packageManager`; a pre-9 lock or shrinkwrap means pnpm <= 8): `.npmrc` `lockfile-include-tarball-url` on pnpm <= 9, pnpm-workspace.yaml `lockfileIncludeTarballUrl` on pnpm >= 11 (also assumed for a lock carrying an env lockfile document), the workspace file then `.npmrc` on pnpm 10; else (3) pnpm 10's reading. A Rush lock (`common/config/rush/pnpm-lock.yaml` or a subspace lock, with `rush.json` at the Rush root) takes its pnpm major from rush.json `pnpmVersion` instead of tier 2's install record and package.json pin. A 9.0 lock may come from pnpm 9, 10 or 11+, so when tier 3's reading differs from pnpm 9's (`.npmrc` only) or pnpm >= 11's (pnpm-workspace.yaml only) — e.g. `.npmrc` on with the workspace file silent, or the workspace file setting it with `.npmrc` silent or disagreeing — the restore follows pnpm 10 but warns `upstream_pnpm_tarball_setting_guessed` (once per lock, naming the entries); a URL pnpm records anyway (not derivable from the registry) never warns. A `bun.lock` 4-tuple's registry slot is rebuilt the way Bun writes it (#992): `""` for a package from registry.npmjs.org, otherwise the full tarball URL — Bun 1.1.39–1.3.6 read `""` as npmjs whatever the project configures. The registry is the one Bun resolves the package against: a scope's `.npmrc` `@scope:registry` or `bunfig.toml` `[install.scopes]` entry, else `BUN_CONFIG_REGISTRY` / `NPM_CONFIG_REGISTRY`, the `.npmrc` `registry`, then `bunfig.toml` `[install] registry`; its version document's `dist.tarball` fills the slot, and when it can't be read (`upstream_registry_fallback`) the default registry's conventional URL is re-based on it. The `bun.lockb` takeover restore records the same URL. Side settings: a project `.npmrc` that is exactly `allow-remote=all\n` is deleted once no root npm lock entry is hosted, otherwise a remaining top-level `allow-remote=all` warns `npm_allow_remote_left`; a `pnpm-workspace.yaml` that is exactly the scaffold hosted mode creates is deleted once `pnpm-lock.yaml` is no longer hosted, otherwise a remaining `trustLockfile: true` warns `pnpm_trust_lockfile_left`. **`bun.lockb` (binary)**: `rollback` and `remove` refuse it (the checkout remedy). The hosted → vendored takeover and the eject DO restore it, since the vendor ledger then records the rebuilt record as its pre-vendor original: the native codec turns each hosted remote-tarball record back into Bun's npm registry record for `name@version` (the registry's `dist.tarball` + `dist.integrity`, the package metadata hash re-derived, the hosted URL string dropped from the string pool). The hosted rewrite keeps the registry record's inactive bytes (padding, semver) in the tarball record, so a lock it wrote comes back byte for byte — early writers' uninitialized padding included; a record without them (an older socket-patch or a Bun re-save) is rebuilt the way Bun writes one, and refused for a prerelease/build version. A lock the hosted rewrite had to normalize is marked in the root package's resolution value bytes (which no Bun reader reads): a binary format 1 lock it promoted to format 2 is demoted back to its exact format-1 bytes (verified by promoting it again, otherwise refused), and a lock whose workspace dependency behaviors it normalized is refused with the `git checkout -- bun.lockb` remedy.
   * **vlt** — `vlt-lock.json`: slot [2] from the registry's `dist.integrity`, slot [3] per the lock's own convention (see the vlt hosted-mode contract); every hosted instance of the pin together.
-  * **cargo** — `Cargo.lock` back on crates.io (source + the sparse index's checksum, `SOCKET_CRATES_INDEX`); every `Cargo.toml` declaration loses its `registry = "socket-patch-<uuid>"` pin (the shorthand the rewriter produced collapses back); every `[registries.socket-patch-<uuid>]` block no manifest or lock still references leaves the project cargo config — including a superseded patch generation's block an earlier re-pin left behind (#864). A declaration it cannot unpin refuses.
+  * **cargo** — `Cargo.lock` back on crates.io (source + the sparse index's checksum, `SOCKET_CRATES_INDEX`). When the lock already holds a crates.io block for the same `name@version` (a later dependent locked its own copy, #679), the Socket block merges into it instead: it is dropped (with a v1 lock's `[metadata]` line), and dependents' references take the spelling cargo writes, so no duplicate block is left that cargo cannot parse (#863), and no index lookup is needed; every `Cargo.toml` declaration loses its `registry = "socket-patch-<uuid>"` pin (the shorthand the rewriter produced collapses back); every `[registries.socket-patch-<uuid>]` block no manifest or lock still references leaves the project cargo config — including a superseded patch generation's block an earlier re-pin left behind (#864). A declaration it cannot unpin refuses.
   * **golang** — the hosted `replace` and the socket module's go.sum lines go; the upstream module's two go.sum lines come back, hashed from the module proxy (`SOCKET_GOPROXY`, else `GOPROXY` / `GONOPROXY` / `GOPRIVATE` as go reads them) and cross-checked against the checksum database (`SOCKET_GOSUMDB_URL`, else `sum.golang.org` unless `GOSUMDB=off` / `GONOSUMDB` / `GOPRIVATE` say go would not ask it). A `replace` the user had before the hosted run is not recorded anywhere, so the restore lands on the plain upstream module.
   * **pypi** — `Pipfile.lock`, `requirements.txt` (+ in-root `-r` includes), Hatch PEP 508 direct references (`pyproject.toml` / `hatch.toml`), `poetry.lock`, `pdm.lock`, `uv.lock`, PEP 723 script locks and PEP 751 `pylock*.toml` (+ the paired `pyproject.toml` / script metadata): hashes re-derived from PyPI's JSON API (`SOCKET_PYPI_JSON_API`). A restored `requirements.txt` line gets `--hash` options only when the file is in pip's hash-checking mode. The mode is read off the file's other requirement lines (an `-e` / `--editable` line means unhashed). When every requirement is a hosted pin, it is read off the hosted line itself (`--hash` vs a `#sha256=` url fragment) (#410). Refused: a `pdm.lock` without `cross_platform`, or a uv / script / pylock lock, whose release has a wheel that is not pure Python 3 (which files the lock keeps is not re-derivable); a uv lock whose options filter files (`exclude-newer`, `no-binary`, `no-build`), or whose other registry packages name no registry, several, or one other than PyPI's simple index; a pylock whose other registry packages show neither an `index` nor (as `uv pip compile` writes them) only PyPI files with none, which restores the entry without an `index` too; uv 0.2 `[[distribution]]` locks. Restored artifact fields keep the spelling the lock's other entries show, including the `upload_time` that uv 0.6.15–0.6.17 write. A restored pylock entry's `upload-time`s are whole seconds, as uv writes them, unless the lock's other entries show fractions. Its artifacts come back in the TOML spelling the other entries use: uv's inline `wheels = [{ … }]`, or the standard tables `pip lock` writes (`[[packages.wheels]]` with a `[packages.wheels.hashes]` sub-table, `[packages.sdist]`). A `pip lock` file (`created-by = "pip"`) records only the artifact pip selected, so the entry is restored with only the release's wheel (its sdist when it has none), and a release with several wheels is refused. A transitive `override-dependencies` entry hosted mode added is removed (`upstream_uv_override_removed`).
   * **gem** — `Gemfile.lock` / `gems.locked` + `Gemfile` / `gems.rb`: the spec moves back into the upstream `GEM` section (or the Socket remote leaves a merged section), the `source "<patch registry>" do … end` block is undone, the `CHECKSUMS` entry is re-pinned from the rubygems.org compact index (`SOCKET_RUBYGEMS_URL`) and the `DEPENDENCIES` pin loses its `!`. The declaration's original constraint is not recorded, so it comes back as the exact pin `gem "<name>", "<version>"`. A transitive gem (one the manifest never declared) gets an appended block with a blank line before it; the restore removes that block, its blank line and the `DEPENDENCIES` entry, so the pair comes back byte for byte. An appended block with no blank line before it (written by a release before this one) can't be told apart from an in-place rewrite, so it still comes back as the exact pin. Refused: an ambiguous upstream section, an upstream remote other than rubygems.org. The manifest pair can't make a committed bundler cache upstream: a `<name>-<version>.gem` left in Bundler's cache dir that isn't the upstream archive is named by `upstream_gem_stale_cache`, never deleted.
diff --git a/crates/socket-patch-cli/tests/e2e_redirect_cargo_shapes.rs b/crates/socket-patch-cli/tests/e2e_redirect_cargo_shapes.rs
index 809eff910..307ffa9e2 100644
--- a/crates/socket-patch-cli/tests/e2e_redirect_cargo_shapes.rs
+++ b/crates/socket-patch-cli/tests/e2e_redirect_cargo_shapes.rs
@@ -109,6 +109,11 @@ struct Shape {
     /// A shape hosted mode must REFUSE: the rewriter warning code every
     /// patch is skipped with. The scan must leave every file untouched.
     refused: Option<&'static str>,
+    /// A dependency line the fresh checkout adds AFTER the scan, which
+    /// locks its own crates.io copy of the (single) patched crate version
+    /// beside the Socket one (#679, #863): VEX must then attest nothing, and
+    /// `remove` must merge the Socket block into the crates.io one.
+    contest: Option<&'static str>,
 }
 
 fn run_socket(cwd: &Path, args: &[&str], cargo_home: &Path) -> (i32, String, String) {
@@ -617,6 +622,11 @@ async fn run_shape(shape: Shape) -> Option<()> {
         stderr(&build)
     );
 
+    if let Some(dep) = shape.contest {
+        contest_after_scan(&shape, dep, &fresh, &fresh_home, &uri);
+        return Some(());
+    }
+
     // Post-install VEX over the fresh checkout: every patch is attested,
     // hash-verified against the extracted (patched) registry sources.
     let doc_path = fresh.join("doc.vex.json");
@@ -749,6 +759,153 @@ async fn run_shape(shape: Shape) -> Option<()> {
     Some(())
 }
 
+/// The cfg-if blocks of `dir`'s lock: `(version, source)`.
+fn locked_blocks(dir: &Path, name: &str) -> Vec<(String, Option<String>)> {
+    let lock = std::fs::read_to_string(dir.join("Cargo.lock")).unwrap();
+    cargo_e2e_matrix::parse_lock(&lock)
+        .into_iter()
+        .filter(|p| p.name == name)
+        .map(|p| (p.version, p.source))
+        .collect()
+}
+
+/// #679 / #863: `dep` added to the hosted fresh checkout locks a crates.io
+/// copy of the patched crate version beside the Socket one. VEX must not
+/// attest the crate (the build compiles the unpatched copy too), and
+/// `remove` must leave the single crates.io block cargo itself writes, so
+/// `cargo build --locked` still parses and accepts the lock.
+fn contest_after_scan(shape: &Shape, dep: &str, fresh: &Path, home: &Path, uri: &str) {
+    let [patch] = shape.patches.as_slice() else {
+        panic!("{}: a contest shape has one patch", shape.tag);
+    };
+    let toml_path = fresh.join("Cargo.toml");
+    let toml = std::fs::read_to_string(&toml_path).unwrap();
+    std::fs::write(
+        &toml_path,
+        toml.replace("[dependencies]\n", &format!("[dependencies]\n{dep}\n")),
+    )
+    .unwrap();
+    let build = cargo(fresh, &["build", "-q"], home);
+    assert!(build.status.success(), "{}: {}", shape.tag, stderr(&build));
+    let crates_io = "registry+https://github.com/rust-lang/crates.io-index";
+    let twin = |dir: &Path| {
+        locked_blocks(dir, patch.name)
+            .iter()
+            .any(|(v, s)| v == patch.version && s.as_deref() == Some(crates_io))
+    };
+    if !twin(fresh) {
+        // crates.io resolved a newer release: lock the patched version, the
+        // case where the patch is for the newest release.
+        let other = locked_blocks(fresh, patch.name)
+            .into_iter()
+            .find(|(_, s)| s.as_deref() == Some(crates_io))
+            .map(|(v, _)| v)
+            .expect("the added dependency locks a crates.io copy");
+        let spec = format!("{crates_io}#{}@{other}", patch.name);
+        let update = cargo(
+            fresh,
+            &["update", "-p", &spec, "--precise", patch.version],
+            home,
+        );
+        assert!(
+            update.status.success(),
+            "{}: {}",
+            shape.tag,
+            stderr(&update)
+        );
+    }
+    let build = cargo(fresh, &["build", "-q", "--locked"], home);
+    assert!(build.status.success(), "{}: {}", shape.tag, stderr(&build));
+    let blocks = locked_blocks(fresh, patch.name)
+        .into_iter()
+        .filter(|(v, _)| v == patch.version)
+        .count();
+    assert_eq!(blocks, 2, "{}: the contested lock", shape.tag);
+
+    // VEX: the crate is not attested.
+    let doc_path = fresh.join("doc.vex.json");
+    let fresh_s = fresh.to_str().unwrap().to_string();
+    let (code, stdout, err) = run_socket(
+        fresh,
+        &[
+            "vex",
+            "--output",
+            doc_path.to_str().unwrap(),
+            "--product",
+            "pkg:cargo/consumer@0.1.0",
+            "--patch-server-url",
+            uri,
+            "--api-url",
+            uri,
+            "--org",
+            ORG,
+            "--api-token",
+            "fake",
+            "--cwd",
+            &fresh_s,
+        ],
+        home,
+    );
+    let doc = std::fs::read_to_string(&doc_path).unwrap_or_default();
+    assert!(
+        !doc.contains(&patch.purl()),
+        "{}: a contested crate must not be attested (exit {code}):\n{doc}\n{stdout}\n{err}",
+        shape.tag
+    );
+    assert!(
+        format!("{stdout}{err}").contains("that copy stays UNPATCHED"),
+        "{}: the contest is diagnosed:\n{stdout}\n{err}",
+        shape.tag
+    );
+
+    // remove: one crates.io block, and the lock cargo itself writes.
+    let purl = patch.purl();
+    let (code, stdout, err) = run_socket_env(
+        fresh,
+        &[
+            "remove",
+            &purl,
+            "--cwd",
+            &fresh_s,
+            "--json",
+            "--yes",
+            "--no-telemetry",
+        ],
+        home,
+        &[("SOCKET_PATCH_SERVER_URL", uri)],
+    );
+    assert_eq!(
+        code, 0,
+        "{}: remove\nstdout:\n{stdout}\nstderr:\n{err}",
+        shape.tag
+    );
+    let blocks: Vec<_> = locked_blocks(fresh, patch.name)
+        .into_iter()
+        .filter(|(v, _)| v == patch.version)
+        .collect();
+    assert_eq!(
+        blocks,
+        [(patch.version.to_string(), Some(crates_io.to_string()))],
+        "{}: remove merges into the crates.io block",
+        shape.tag
+    );
+    assert!(
+        !std::fs::read_to_string(&toml_path)
+            .unwrap()
+            .contains("socket-patch-"),
+        "{}: the Cargo.toml pin is gone",
+        shape.tag
+    );
+    std::fs::write(fresh.join("src/main.rs"), "fn main() {}\n").unwrap();
+    let build = cargo(fresh, &["build", "-q", "--locked", "--offline"], home);
+    assert!(
+        build.status.success(),
+        "{}: the restored lock builds unchanged under --locked:\n{}",
+        shape.tag,
+        stderr(&build)
+    );
+}
+
 /// Pin each patched version: a caret requirement locks the newest
 /// compatible release, which moves as crates.io publishes.
 fn pin_patched_versions(proj: &Path, home: &Path, patches: &[Patch]) {
@@ -814,6 +971,7 @@ async fn cargo_hosted_multi_version_pins_each_declaration_and_removes_cleanly()
         crlf: false,
         lockless: false,
         refused: None,
+        contest: None,
     };
     let _ = run_shape(shape).await;
 }
@@ -837,6 +995,7 @@ async fn cargo_hosted_legacy_config_is_restored_byte_for_byte() {
         crlf: false,
         lockless: false,
         refused: None,
+        contest: None,
     };
     let _ = run_shape(shape).await;
 }
@@ -875,6 +1034,7 @@ async fn cargo_hosted_config_trailing_bytes_are_restored() {
             crlf: false,
             lockless: false,
             refused: None,
+            contest: None,
         };
         if run_shape(shape).await.is_none() {
             return;
@@ -908,6 +1068,7 @@ async fn cargo_hosted_same_line_in_two_sections_removes_cleanly() {
         crlf: false,
         lockless: false,
         refused: None,
+        contest: None,
     };
     let _ = run_shape(shape).await;
 }
@@ -947,6 +1108,7 @@ async fn cargo_hosted_workspace_member_declaration_is_pinned() {
         crlf: false,
         lockless: false,
         refused: None,
+        contest: None,
     };
     let _ = run_shape(shape).await;
 }
@@ -969,6 +1131,7 @@ async fn cargo_hosted_crlf_project_keeps_its_line_endings() {
         crlf: true,
         lockless: false,
         refused: None,
+        contest: None,
     };
     let _ = run_shape(shape).await;
 }
@@ -994,6 +1157,7 @@ async fn cargo_hosted_refuses_a_crate_another_crate_depends_on() {
         crlf: false,
         lockless: false,
         refused: Some("redirect_cargo_transitive_dependents"),
+        contest: None,
     };
     let _ = run_shape(shape).await;
 }
@@ -1020,6 +1184,30 @@ async fn cargo_hosted_refuses_a_lockless_project_with_other_dependencies() {
         crlf: false,
         lockless: true,
         refused: Some("redirect_cargo_lockless_dependents"),
+        contest: None,
+    };
+    let _ = run_shape(shape).await;
+}
+
+/// #679 / #863: a dependency added after the hosted scan locks its own
+/// crates.io copy of the patched cfg-if 1.0.4.
+#[tokio::test(flavor = "multi_thread")]
+async fn cargo_hosted_contested_by_a_later_crates_io_copy() {
+    let shape = Shape {
+        tag: "contested-later-dependent",
+        files: vec![
+            ("Cargo.toml", consumer_manifest("cfg-if = \"1.0.4\"\n")),
+            ("src/main.rs", "fn main() {}\n".to_string()),
+        ],
+        patches: vec![CFG_IF_1],
+        oracle: vec![(
+            "src/main.rs",
+            "fn main() { println!(\"{}\", cfg_if::socket_patched()); }\n".to_string(),
+        )],
+        crlf: false,
+        lockless: false,
+        refused: None,
+        contest: Some("crc32fast = \"=1.5.0\""),
     };
     let _ = run_shape(shape).await;
 }
diff --git a/crates/socket-patch-core/src/patch/redirect/upstream/cargo.rs b/crates/socket-patch-core/src/patch/redirect/upstream/cargo.rs
index 2e9c01a90..5fbafc1ac 100644
--- a/crates/socket-patch-core/src/patch/redirect/upstream/cargo.rs
+++ b/crates/socket-patch-core/src/patch/redirect/upstream/cargo.rs
@@ -88,7 +88,20 @@ pub(crate) async fn restore(
                 source: source.clone(),
             });
         }
-        let lookups = hits.iter().map(|h| async move {
+        // A hit whose name@version crates.io ALSO locks (a dependency added
+        // after the pin resolved its own crates.io copy, which cargo cannot
+        // unify with the Socket one, #679) merges into that block: splicing
+        // crates.io's source into the Socket block would leave two
+        // identical blocks, which cargo refuses to parse (#863). The twin
+        // already carries the checksum, so no registry lookup is needed.
+        let twin_of = |h: &LockHit| {
+            model.packages().iter().any(|p| {
+                p.name == h.name
+                    && p.version == h.version
+                    && p.source.as_deref() == Some(CRATES_IO_SOURCE)
+            })
+        };
+        let lookups = hits.iter().filter(|h| !twin_of(h)).map(|h| async move {
             (
                 h.uuid.clone(),
                 ctx.client.cargo_cksum(&h.name, &h.version).await,
@@ -101,7 +114,12 @@ pub(crate) async fn restore(
                 .collect();
         let mut changed = false;
         let mut restored: Vec<(&LockHit, String)> = Vec::new();
+        let mut merged: Vec<&LockHit> = Vec::new();
         for hit in &hits {
+            if twin_of(hit) {
+                merged.push(hit);
+                continue;
+            }
             let cksum = match cksums.get(&hit.uuid) {
                 Some(Ok(c)) => c.clone(),
                 Some(Err(why)) => {
@@ -115,6 +133,9 @@ pub(crate) async fn restore(
             }
             restored.push((hit, cksum));
         }
+        // A pin refused on another hit (it wires two versions) is restored
+        // nowhere.
+        merged.retain(|h| !result.refused.contains_key(&h.uuid));
         // The entries' own source + checksum values, spliced at the parse's
         // spans (every hit is a distinct block: its source names its uuid).
         let spans = model
@@ -130,6 +151,30 @@ pub(crate) async fn restore(
                 splices.push((checksum.clone(), format!("\"{cksum}\"")));
             }
         }
+        for hit in &merged {
+            // The whole block, up to the next table header (its blank
+            // separator line included); a last block also drops the blank
+            // line before it.
+            let start = spans.packages[hit.index].header;
+            let range = match spans.headers.iter().copied().find(|&h| h > start) {
+                Some(next) => start..next,
+                None => {
+                    let kept = lock[..start].trim_end_matches('\n').len() + 1;
+                    kept.min(start)..lock.len()
+                }
+            };
+            splices.push((range, String::new()));
+            // A v1 lock's `[metadata]` checksum line for the Socket id.
+            let key =
+                crate::formats::cargo::metadata_checksum_key(&hit.name, &hit.version, &hit.source);
+            if let Some((_, line)) = spans.metadata.iter().find(|(k, _)| *k == key) {
+                let end = match lock[line.end..].find('\n') {
+                    Some(n) => line.end + n + 1,
+                    None => lock.len(),
+                };
+                splices.push((line.start..end, String::new()));
+            }
+        }
         splices.sort_by_key(|(r, _)| std::cmp::Reverse(r.start));
         for (range, with) in splices {
             lock.replace_range(range, &with);
@@ -155,6 +200,13 @@ pub(crate) async fn restore(
             result.handled.insert(hit.uuid.clone());
             changed = true;
         }
+        if !merged.is_empty() {
+            lock = merged_references(&lock, &model, &merged);
+            for hit in &merged {
+                result.handled.insert(hit.uuid.clone());
+            }
+            changed = true;
+        }
         if changed {
             view.write(
                 "Cargo.lock",
@@ -378,6 +430,46 @@ fn remove_appended_cargo_block(content: &str, fragment: &str) -> Option<String>
     Some(format!("{before}{}", &content[pos + len..]))
 }
 
+/// Respell the dependents' references to each merged hit's crate the way
+/// cargo writes them once the Socket block is gone (`lock`: the text with
+/// the merged blocks removed; `model`: the lock before). A v1 lock spells
+/// every reference as the full package id, now the crates.io one. Later
+/// formats use the shortest unambiguous form: the bare name when the lock
+/// holds one block of that crate, `"<name> <version>"` when it holds one of
+/// that version, else the full crates.io id.
+fn merged_references(lock: &str, model: &CargoLock, merged: &[&LockHit]) -> String {
+    let v1 = !lock
+        .lines()
+        .take_while(|l| !l.starts_with('['))
+        .any(|l| l.starts_with("version"))
+        && lock.lines().any(|l| l.trim_end() == "[metadata]");
+    let mut out = lock.to_string();
+    for hit in merged {
+        let full = format!("\"{} {} ({CRATES_IO_SOURCE})\"", hit.name, hit.version);
+        let spelled = if v1 {
+            full.clone()
+        } else {
+            let left: Vec<_> = model
+                .packages()
+                .iter()
+                .enumerate()
+                .filter(|(i, p)| p.name == hit.name && !merged.iter().any(|m| m.index == *i))
+                .map(|(_, p)| p)
+                .collect();
+            if left.len() == 1 {
+                format!("\"{}\"", hit.name)
+            } else if left.iter().filter(|p| p.version == hit.version).count() == 1 {
+                format!("\"{} {}\"", hit.name, hit.version)
+            } else {
+                full.clone()
+            }
+        };
+        let socket = format!("\"{} {} ({})\"", hit.name, hit.version, hit.source);
+        out = out.replace(&socket, &spelled).replace(&full, &spelled);
+    }
+    out
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -494,4 +586,178 @@ mod tests {
             Some(block(C).as_str())
         );
     }
+
+    const CRATES_IO_CKSUM: &str =
+        "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801";
+    const SOCKET_CKSUM: &str = "cb5ea0124d6d4ab3fa7c9a2c4e20e8f0e2e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0";
+
+    fn socket_source(uuid: &str) -> String {
+        format!("sparse+https://patch.socket.dev/patch-registry/cargo/tok/{uuid}/index/")
+    }
+
+    /// Restore cfg-if's hosted pin `B` over `lock` (offline); the outcome
+    /// and the lock after.
+    async fn restore_lock(lock: &str) -> (super::super::RestoreOutcome, String) {
+        let tmp = tempfile::tempdir().unwrap();
+        std::fs::write(
+            tmp.path().join("Cargo.toml"),
+            manifest("crc32fast = \"=1.5.0\"\n"),
+        )
+        .unwrap();
+        std::fs::write(tmp.path().join("Cargo.lock"), lock).unwrap();
+        std::fs::create_dir_all(tmp.path().join(".cargo")).unwrap();
+        std::fs::write(tmp.path().join(".cargo/config.toml"), block(B)).unwrap();
+        let pins = [super::super::HostedPin {
+            purl: "pkg:cargo/cfg-if@1.0.4".into(),
+            uuid: B.into(),
+            files: vec![
+                "Cargo.lock".into(),
+                "Cargo.toml".into(),
+                ".cargo/config.toml".into(),
+            ],
+        }];
+        let opts = super::super::RestoreOptions {
+            offline: true,
+            ..Default::default()
+        };
+        let outcome = super::super::restore_upstream(tmp.path(), &pins, &opts).await;
+        let after = std::fs::read_to_string(tmp.path().join("Cargo.lock")).unwrap();
+        (outcome, after)
+    }
+
+    /// The lock cargo writes once a later dependency (crc32fast) locks a
+    /// crates.io copy of the hosted-pinned cfg-if 1.0.4 (#679): two blocks
+    /// for one name@version, so every reference is a full package id.
+    /// `extra_cfg_if` also locks cfg-if 0.1.10.
+    fn contested_lock(extra_cfg_if: bool) -> String {
+        let socket = socket_source(B);
+        let old = if extra_cfg_if {
+            "[[package]]\nname = \"cfg-if\"\nversion = \"0.1.10\"\n\
+             source = \"registry+https://github.com/rust-lang/crates.io-index\"\n\
+             checksum = \"4785bdd1c96b2a846b2bd7cc02e86b6b3dbf14e7e53446c4f54c92a361040822\"\n\n"
+        } else {
+            ""
+        };
+        let old_dep = if extra_cfg_if {
+            " \"cfg-if 0.1.10\",\n"
+        } else {
+            ""
+        };
+        format!(
+            "# This file is automatically @generated by Cargo.\n\
+             # It is not intended for manual editing.\nversion = 4\n\n\
+             [[package]]\nname = \"app\"\nversion = \"0.1.0\"\ndependencies = [\n{old_dep} \
+             \"cfg-if 1.0.4 ({socket})\",\n \"crc32fast\",\n]\n\n\
+             {old}\
+             [[package]]\nname = \"cfg-if\"\nversion = \"1.0.4\"\n\
+             source = \"registry+https://github.com/rust-lang/crates.io-index\"\n\
+             checksum = \"{CRATES_IO_CKSUM}\"\n\n\
+             [[package]]\nname = \"cfg-if\"\nversion = \"1.0.4\"\n\
+             source = \"{socket}\"\nchecksum = \"{SOCKET_CKSUM}\"\n\n\
+             [[package]]\nname = \"crc32fast\"\nversion = \"1.5.0\"\n\
+             source = \"registry+https://github.com/rust-lang/crates.io-index\"\n\
+             checksum = \"9d7fe8a1a6b8f4a28b3b6e2b0f7a1d1fa2f1e1d8c1c6b2a4d3e9f6a1b5c7d8e9\"\n\
+             dependencies = [\n \"cfg-if 1.0.4 (registry+https://github.com/rust-lang/crates.io-index)\",\n]\n"
+        )
+    }
+
+    /// #863: restoring a hosted pin whose name@version crates.io ALSO locks
+    /// merges the Socket block into the existing crates.io one (no
+    /// duplicate block, which cargo refuses to parse) and spells every
+    /// reference the way cargo does for an unambiguous crate — the lock
+    /// `cargo generate-lockfile` would write. No registry lookup is needed:
+    /// the crates.io block already carries the checksum, so it works
+    /// offline.
+    #[tokio::test]
+    async fn restore_merges_into_an_existing_crates_io_twin() {
+        let (outcome, after) = restore_lock(&contested_lock(false)).await;
+        assert_eq!(outcome.restored().count(), 1, "{:?}", outcome.pins);
+        let want = format!(
+            "# This file is automatically @generated by Cargo.\n\
+             # It is not intended for manual editing.\nversion = 4\n\n\
+             [[package]]\nname = \"app\"\nversion = \"0.1.0\"\ndependencies = [\n \
+             \"cfg-if\",\n \"crc32fast\",\n]\n\n\
+             [[package]]\nname = \"cfg-if\"\nversion = \"1.0.4\"\n\
+             source = \"registry+https://github.com/rust-lang/crates.io-index\"\n\
+             checksum = \"{CRATES_IO_CKSUM}\"\n\n\
+             [[package]]\nname = \"crc32fast\"\nversion = \"1.5.0\"\n\
+             source = \"registry+https://github.com/rust-lang/crates.io-index\"\n\
+             checksum = \"9d7fe8a1a6b8f4a28b3b6e2b0f7a1d1fa2f1e1d8c1c6b2a4d3e9f6a1b5c7d8e9\"\n\
+             dependencies = [\n \"cfg-if\",\n]\n"
+        );
+        assert_eq!(after, want);
+        CargoLock::parse(&after).expect("the restored lock parses");
+    }
+
+    /// With another cfg-if version locked too, the merged crate's
+    /// references keep their version (`"cfg-if 1.0.4"`): the name alone is
+    /// still ambiguous.
+    #[tokio::test]
+    async fn restore_merge_keeps_versioned_refs_while_the_name_is_ambiguous() {
+        let (outcome, after) = restore_lock(&contested_lock(true)).await;
+        assert_eq!(outcome.restored().count(), 1, "{:?}", outcome.pins);
+        let model = CargoLock::parse(&after).expect("the restored lock parses");
+        let blocks: Vec<_> = model
+            .packages()
+            .iter()
+            .filter(|p| p.name == "cfg-if")
+            .map(|p| (p.version.as_str(), p.source.as_deref()))
+            .collect();
+        assert_eq!(
+            blocks,
+            [
+                ("0.1.10", Some(CRATES_IO_SOURCE)),
+                ("1.0.4", Some(CRATES_IO_SOURCE))
+            ],
+            "{after}"
+        );
+        assert!(!after.contains("patch.socket.dev"), "{after}");
+        assert!(
+            after.contains(
+                "dependencies = [\n \"cfg-if 0.1.10\",\n \"cfg-if 1.0.4\",\n \"crc32fast\",\n]"
+            ) && after.contains("dependencies = [\n \"cfg-if 1.0.4\",\n]"),
+            "{after}"
+        );
+    }
+
+    /// The v1 format spells every reference as a full id and files the
+    /// checksum in `[metadata]`: the merge keeps one crates.io metadata line
+    /// and full crates.io ids.
+    #[tokio::test]
+    async fn restore_merge_in_a_v1_lock() {
+        let socket = socket_source(B);
+        let lock = format!(
+            "[[package]]\nname = \"app\"\nversion = \"0.1.0\"\ndependencies = [\n \
+             \"cfg-if 1.0.4 ({socket})\",\n \
+             \"crc32fast 1.5.0 (registry+https://github.com/rust-lang/crates.io-index)\",\n]\n\n\
+             [[package]]\nname = \"cfg-if\"\nversion = \"1.0.4\"\n\
+             source = \"registry+https://github.com/rust-lang/crates.io-index\"\n\n\
+             [[package]]\nname = \"cfg-if\"\nversion = \"1.0.4\"\nsource = \"{socket}\"\n\n\
+             [[package]]\nname = \"crc32fast\"\nversion = \"1.5.0\"\n\
+             source = \"registry+https://github.com/rust-lang/crates.io-index\"\n\
+             dependencies = [\n \
+             \"cfg-if 1.0.4 (registry+https://github.com/rust-lang/crates.io-index)\",\n]\n\n\
+             [metadata]\n\
+             \"checksum cfg-if 1.0.4 (registry+https://github.com/rust-lang/crates.io-index)\" = \"{CRATES_IO_CKSUM}\"\n\
+             \"checksum cfg-if 1.0.4 ({socket})\" = \"{SOCKET_CKSUM}\"\n\
+             \"checksum crc32fast 1.5.0 (registry+https://github.com/rust-lang/crates.io-index)\" = \"00\"\n"
+        );
+        let (outcome, after) = restore_lock(&lock).await;
+        assert_eq!(outcome.restored().count(), 1, "{:?}", outcome.pins);
+        let want = format!(
+            "[[package]]\nname = \"app\"\nversion = \"0.1.0\"\ndependencies = [\n \
+             \"cfg-if 1.0.4 (registry+https://github.com/rust-lang/crates.io-index)\",\n \
+             \"crc32fast 1.5.0 (registry+https://github.com/rust-lang/crates.io-index)\",\n]\n\n\
+             [[package]]\nname = \"cfg-if\"\nversion = \"1.0.4\"\n\
+             source = \"registry+https://github.com/rust-lang/crates.io-index\"\n\n\
+             [[package]]\nname = \"crc32fast\"\nversion = \"1.5.0\"\n\
+             source = \"registry+https://github.com/rust-lang/crates.io-index\"\n\
+             dependencies = [\n \
+             \"cfg-if 1.0.4 (registry+https://github.com/rust-lang/crates.io-index)\",\n]\n\n\
+             [metadata]\n\
+             \"checksum cfg-if 1.0.4 (registry+https://github.com/rust-lang/crates.io-index)\" = \"{CRATES_IO_CKSUM}\"\n\
+             \"checksum crc32fast 1.5.0 (registry+https://github.com/rust-lang/crates.io-index)\" = \"00\"\n"
+        );
+        assert_eq!(after, want);
+    }
 }
diff --git a/crates/socket-patch-core/src/vex/discover/cargo.rs b/crates/socket-patch-core/src/vex/discover/cargo.rs
index 9bf6cc1e7..c9c5832b9 100644
--- a/crates/socket-patch-core/src/vex/discover/cargo.rs
+++ b/crates/socket-patch-core/src/vex/discover/cargo.rs
@@ -179,6 +179,7 @@ pub(crate) async fn extract(ctx: &DiscoverCtx<'_>, out: &mut Discovery) {
         .unwrap_or_default();
 
     hosted_from_lock(ctx, &lock, decls.as_ref(), &definitions, out);
+    unpatched_twins(ctx, &lock, out);
     if let (Some(decls), Some(doc)) = (&decls, &manifest) {
         unresolved_manifest_pins(ctx, &lock, decls, doc, &definitions, out);
     }
@@ -532,6 +533,56 @@ fn hosted_from_lock(
     }
 }
 
+/// Record every lock block that resolves a Socket-hosted crate's
+/// `name@version` from another source ([`Discovery::unpatched_copy`]).
+/// Cargo never unifies packages of different sources, so a dependency that
+/// locks its own crates.io (or git) copy beside the hosted pin, typically
+/// one added after the scan (#679), compiles that copy unpatched. The hosted
+/// ref is then withheld from attestation, though rollback / remove still
+/// unwind it. A re-scan cannot rewire the other copy (the rewriter refuses
+/// a crate a transitive dependent resolves from crates.io,
+/// `redirect_cargo_transitive_dependents`), so it is a shadow, not a
+/// rewirable ref.
+fn unpatched_twins(ctx: &DiscoverCtx<'_>, lock: &Lock, out: &mut Discovery) {
+    let packages = lock.packages();
+    let hosted: Vec<&LockedPackage> = packages
+        .iter()
+        .filter(|p| {
+            p.source
+                .as_deref()
+                .is_some_and(|s| source_uuid(ctx, s).is_some())
+        })
+        .collect();
+    if hosted.is_empty() {
+        return;
+    }
+    for pkg in packages {
+        let Some(source) = pkg.source.as_deref() else {
+            // A sourceless block is a workspace member, a path dependency or
+            // a vendored copy (tagged, so another version): not this crate.
+            continue;
+        };
+        if source_uuid(ctx, source).is_some()
+            || !hosted
+                .iter()
+                .any(|h| h.name == pkg.name && h.version == pkg.version)
+        {
+            continue;
+        }
+        out.unpatched_copy(
+            CARGO_LOCK,
+            simple_purl("cargo", &pkg.name, &pkg.version),
+            &format!("{} {} ({source})", pkg.name, pkg.version),
+            &format!(
+                "resolves the same crate version from another source, which cargo builds \
+                 beside the Socket copy for the dependents that lock it (`cargo tree -i \
+                 {}@{}` lists them)",
+                pkg.name, pkg.version
+            ),
+        );
+    }
+}
+
 /// Diagnose `Cargo.toml` Socket-registry pins no lock entry turns into a ref
 /// (no exact version to attest), and malformed `socket-patch-*` names.
 ///
@@ -940,6 +991,66 @@ mod tests {
 
     // ── hosted: shapes ───────────────────────────────────────────────
 
+    /// #679: a dependency added after the hosted pin resolves its own
+    /// crates.io copy of the same cfg-if 1.0.4 (cargo cannot unify the two
+    /// sources), so the build compiles the unpatched copy too. The ref is
+    /// withheld from attestation, diagnosed, and kept as `shadowed` so
+    /// rollback / remove still unwind the pin.
+    #[tokio::test]
+    async fn crates_io_twin_of_the_hosted_crate_withholds_the_ref() {
+        for other in [
+            CRATES_IO.to_string(),
+            "git+https://github.com/rust-lang/cfg-if?rev=1#abc".to_string(),
+        ] {
+            let p = Project::new();
+            p.write("Cargo.toml", manifest(&pinned("cfg-if", "1.0.4", UUID_A)));
+            p.write(
+                "Cargo.lock",
+                lock(&[
+                    ("cfg-if", "1.0.4", Some(&other), Some(CKSUM)),
+                    ("cfg-if", "1.0.4", Some(&index(UUID_A)), Some(CKSUM)),
+                    ("crc32fast", "1.5.0", Some(CRATES_IO), Some(CKSUM)),
+                ]),
+            );
+            p.write(".cargo/config.toml", registry_block(UUID_A));
+            let out = run(&p).await;
+            assert_refs(&out, &[]);
+            assert_eq!(
+                out.shadowed
+                    .iter()
+                    .map(|r| (r.purl.as_str(), r.uuid.as_str()))
+                    .collect::<Vec<_>>(),
+                [("pkg:cargo/cfg-if@1.0.4", UUID_A)],
+                "{other}"
+            );
+            assert!(
+                out.diagnostics
+                    .iter()
+                    .any(|d| d.code == DIAG_REF_UNATTRIBUTABLE
+                        && d.detail.contains("cfg-if")
+                        && d.detail.contains("UNPATCHED")),
+                "{other}: {:#?}",
+                out.diagnostics
+            );
+        }
+        // Another VERSION from crates.io is a different package: no effect.
+        let p = Project::new();
+        p.write("Cargo.toml", manifest(&pinned("cfg-if", "1.0.4", UUID_A)));
+        p.write(
+            "Cargo.lock",
+            lock(&[
+                ("cfg-if", "0.1.10", Some(CRATES_IO), Some(CKSUM)),
+                ("cfg-if", "1.0.4", Some(&index(UUID_A)), Some(CKSUM)),
+            ]),
+        );
+        let out = run(&p).await;
+        assert_refs(
+            &out,
+            &[("pkg:cargo/cfg-if@1.0.4", UUID_A, WiringMode::Hosted)],
+        );
+        assert!(out.shadowed.is_empty());
+    }
+
     #[tokio::test]
     async fn workspace_and_target_tables_carry_the_pin() {
         let p = Project::new();