---
name: lock-delta-needs-edge-diff
description: "An identical Cargo.lock package SET does not mean the delta is one package — dependency EDGES move silently, and two resolutions disagreeing means toolchain drift."
metadata: 
  node_type: memory
  type: feedback
  originSessionId: af766430-dd07-403e-a7c4-f96fda10be91
  modified: 2026-08-03T01:06:11.823Z
---

releases#125's dep-pin lane was handed over as "Cargo.lock re-locks that one package
(132 unchanged)". Counting it found NINE changed `[[package]]` blocks: the pinned crate's
source line plus EIGHT dependents whose `windows-sys` edge moved 0.61.2 → 0.59.0 (errno,
nu-ansi-term, rustix, rustls-platform-verifier, seize, tempfile, terminal_size,
winapi-util). doyle's own scratch resolution of the same stanza against the same manifest
state printed `Locking 1 package / 132 unchanged` with no windows-sys movement — so the
churn was builder-side procedure or toolchain drift, not inherent to the patch.

**Why:** the package-set check is the reassuring one and it is not sufficient. Here the set
was IDENTICAL — 542 entries both sides, nothing added or removed, and every windows-sys
version already present at base — while eight crates quietly changed which Windows API
crate they compile against. Set-identical reads as "no supply-chain change" and hides an
edge rewrite that a Windows golden leg would then be the first to exercise.

**How to apply:**
- Diff a lock two ways: package SET (added/removed) *and* per-block dependency EDGES.
  Report the edge movers by name.
- Measure blast radius BEFORE raising it, so the report is a question, not an alarm.
- Two runs of the same resolution disagreeing = drift on one side; the fix is a targeted
  `cargo update -p <crate> --precise`, not accepting the churn.
- Hold the run, don't spend the window: [[golden-respin-test]] — golden buys its evidence
  ONCE, so a head about to be re-locked must not be gated first.
- A pin to a personal fork gets its rev verified at the source: commit exists, its parents
  are the claimed cherry-picks, and the crate version still satisfies the downstream
  exact-pin. See [[v0520-published]] for the verify-not-report posture generally.

**Resolution (same day, doyle-ruled):** the discriminating CONTROL is running the same
`cargo update -p <crate>` with the patch stanza REMOVED — todlando's printed
`Locking 0 packages` yet still rewrote all 8 edges, proving the churn box-deterministic and
patch-independent (his cargo/rustc 1.93.0; CI's toolchain unprintable from run logs — golden
gains a version-print step, riding #129). Ship path when the resolver insists on churn: a
HAND-EDITED lock — base lock with only the pinned crate's block swapped to the git source —
accepted iff `cargo check --workspace --locked` passes (cargo wants no re-resolution; a lock
satisfying every requirement is honored by ANY toolchain version). The prior battery does NOT
transfer across the edge change — full regate at the new sha. Procedure rule + guard both live
on releases#129.