Fix cache_key collapse of non-pydantic private/__main__ objects - #259

Two different objects could produce the same cache_key, so the cache could return a result computed for a different input. This fixes that.

Cause

The generic fallback in normalize_token (ccflow/utils/tokenize.py) tokenized any object whose type module started with _ or contained ._ by module and qualname alone, discarding the instance state. This was meant to give a stable token to interpreter internals encountered during behavior hashing.

The condition is too broad. "__main__".startswith("_") is True, and private submodules such as pkg._internal contain ._. As a result, any non-pydantic object defined in a notebook, REPL, or private module was reduced to its module and qualname, and distinct values produced identical tokens:

class Add:
    def __init__(self, n): self.n = n
    def __call__(self, x): return x + self.n
Add.__module__ = "pkg._private"

compute_data_token(Add(5)) == compute_data_token(Add(7))  # True

pydantic models, functions, methods, and partials have dedicated handlers and were unaffected; only the fallback path was involved.

Change

Decide based on whether the object can be serialized rather than on its module name. If cloudpickle can serialize the object, its state is folded into the token, and the two Add instances above tokenize distinctly.

The module name is consulted only when serialization fails, to distinguish two cases:

• Behavior-irrelevant interpreter internals, such as _abc._abc_data (surfaced in ABC class closures on Python 3.14 and not picklable), receive a stable name-only token so behavior hashing does not fail.
• Any object in __main__, or any other object that cannot be serialized, raises TypeError rather than returning a colliding key.

A short allowlist keeps pydantic's compiled validators name-only. They are picklable but carry volatile runtime state that should not enter the token.

Because the decision is based on serializability rather than a fixed list of internal modules, it holds across Python 3.11 through 3.14 without further maintenance.

Rationale

I instrumented the original branch and ran the full suite to see what reached it. The only objects were the library's own internal helpers, one of which was a stateful frozen dataclass being name-collapsed in the same way (a latent instance of this bug, now also fixed). The _abc and pydantic-internal cases are specific to Python 3.14. This is why an allowlist is the wrong approach: it would require ongoing maintenance and would not have covered the library's own modules.

Tests and validation

Added TestPrivateModuleNoStateCollapse, covering:

• picklable instances in _secret, pkg._internal, and __main__ tokenize distinctly and deterministically;
• a stateful frozen dataclass in a private module tokenizes distinctly;
• an unpicklable user object in __main__ raises TypeError;
• an unpicklable interpreter-internal object receives a stable name-only token;
• a picklable pydantic-core-style internal is name-only.

The full suite passes on Python 3.11 (1336 passed, 2 skipped), the core normalize_token logic was re-checked on Python 3.12, and ruff passes.