Resolve selected lazy modules by exact native cache identity

Authored-By: Codex (GPT-6) <noreply@openai.com>

tools/private-modules/main_test.go

@@ -164,3 +164,17 @@ func TestCanonicalModuleArtifactPathBinding(t *testing.T) {
 		}
 	}
 }
+
+func TestLazyGraphModuleCacheIdentity(t *testing.T) {
+	cache := t.TempDir()
+	path, version := "code.fritzlab.net/fixture/module", "v0.1.0"
+	stem, err := cacheStem(cache, path, version, "")
+	if err != nil || stem != path+"/@v/"+version {
+		t.Fatalf("selected lazy module rejected: %q %v", stem, err)
+	}
+	for _, metadata := range []string{filepath.Join(cache, "foreign/@v/v0.1.0.mod"), filepath.Join(cache, "../escaped.mod"), filepath.Join(cache, path, "@v/v0.2.0.mod")} {
+		if _, err := cacheStem(cache, path, version, metadata); err == nil {
+			t.Fatal("contradictory cache identity accepted")
+		}
+	}
+}