While validating #12329, repeated pacquet install --lockfile-only runs on the vlt benchmark babylon fixture (87 importers) produced lockfiles that flap between runs of the same binary (reproduced on current main before that PR's changes):

• [email protected]([email protected])([email protected])([email protected])([email protected]) vs
• [email protected]([email protected])([email protected])

i.e. whether ws's optional peers (bufferutil, utf-8-validate) propagate into webpack-dev-server's peer suffix varies run to run (~60 diff lines, sometimes both snapshot variants coexist). The resolved package-version set is identical across runs — only the peer-suffix shape differs.

Repro:

git clone --depth 1 https://github.com/vltpkg/benchmarks.git
cd benchmarks/fixtures/babylon
# warm the cache once, then:
for i in 1 2 3; do rm -f pnpm-lock.yaml; pacquet install --lockfile-only; cp pnpm-lock.yaml run$i.yaml; done
diff run1.yaml run2.yaml

Likely in the optional-peer area of resolve_peers (a known divergence area; the supports-color optional-peer gap is documented in the lockfile byte-parity notes). Beyond determinism itself, this makes lockfile-parity testing against pnpm noisy.

Written by an agent (Claude Code, claude-fable-5).