Function enforce_two_tier 

pub fn enforce_two_tier(
    lockfile: &Path,
    program: &str,
    verify_args: &[&str],
    write_args: &[&str],
    cwd: &Path,
    policy: EnforcePolicy,
) -> Result<()>

The one rule every adapter enforces, given the manager’s two spellings of the check.

• lockfile present → verify_args, which resolves the graph against the lockfile and fails rather than writing when the two have drifted apart
• lockfile absent → write_args, because restore needs a lockfile to exist at all and there is nothing there to preserve
• allow_rewrite → write_args either way: the informed opt-in, for the user who would rather have a stale lockfile refreshed than have the prune refused

This used to be the cargo/go rule only. Every other adapter ran its writing sync unconditionally — npm install --package-lock-only, pnpm install --lockfile-only, uv lock and yarn install --mode update-lockfile all rewrite a lockfile Git tracks when it has drifted from the manifest. That is a smaller edit than go mod tidy makes, but it is still an unattended pass modifying a tracked file, and it made allow_manifest_rewrite mean two different things depending on the ecosystem.