`torch` resolves to 2.14.0 (PyPI) or 2.13.0+cu129 (download.pytorch.org/whl/cu129) depending on install path (pip install .)

# A: `pip install .` (pyproject/requirements only, PyPI)
pip install --dry-run --report a.json "torch"
#   -> `torch 2.14.0` from PyPI

# B: `uv sync` / `uv pip install .` (pyproject with `[tool.uv.sources]`)
uv lock   # in the repo checkout (honours [tool.uv.sources]); or: uv pip compile --emit-index-annotation -o b.txt req.txt   # req.txt: "torch"
#   -> `torch 2.13.0+cu129` from download.pytorch.org/whl/cu129

### ✔️ Expected Behavior

Every documented install path selects the same file for the package(s) above (same version, same index, same hash), or the documentation states which build is intended.

### ❌ Actual Behavior

- `torch`: 2.14.0 (PyPI) vs 2.13.0+cu129 (download.pytorch.org/whl/cu129).

### Description

The repository documents more than one way to install it, and they do not produce the same environment: following `pip install .` installs `torch 2.14.0` from PyPI, while following `uv sync` / `uv pip install .` installs `torch 2.13.0+cu129` from download.pytorch.org/whl/cu129. A user who reads the README/Dockerfile expects the CUDA/ROCm build named there, but depending on the installer and index order gets a different variant or major version, which is confusing to debug (GPU silently unused, mismatched CUDA libraries) and means the two paths are not tested against the same dependencies. Because the selection is decided by index visibility and installer semantics rather than by the project, it is also an exposure: whichever index publishes a higher version of these names decides what gets installed.

**`torch`**:
- `pip install .` (pyproject/requirements only, PyPI) → `torch 2.14.0` from PyPI
- `uv sync` / `uv pip install .` (pyproject with `[tool.uv.sources]`) → `torch 2.13.0+cu129` from download.pytorch.org/whl/cu129

### Root cause and proposed fix

**Consequences**

- Users following one path get a different PyTorch build (CUDA/ROCm/CPU variant or major version) than users following the other; GPU code may run on CPU or fail to load CUDA libraries.
- The environment produced by one path is not the one exercised in CI, so bug reports are hard to reproduce.
- The two paths install files with different hashes from different indexes; which build (and whose build) ends up in the environment is decided by index order and installer behaviour rather than by the project's declaration, and the two files were not verified against each other here.

**Root cause**

pip applies *version priority* across all indexes it can see (PEP 766): when PyPI is visible next to a `download.pytorch.org` channel, the newer PyPI release wins over the `+cuXXX` build. uv's default `first-index` strategy does the opposite (first index that has the name). The selected build therefore depends on the installer and on whether the channel is passed as `--index-url` or `--extra-index-url`, not on the declaration. `[tool.uv.sources]` is honoured only by uv; every `pip install` command in the docs/Dockerfile ignores it and resolves from the indexes on its own command line.

**Where the repo binds these packages to an index**

- `pyproject.toml`:17 — `torch` → https://download.pytorch.org/whl/cpu (`uv binding -> pytorch-cpu`)
- `pyproject.toml`:17 — `torch` → https://download.pytorch.org/whl/cu126 (`uv binding -> pytorch-cu126`)
- `pyproject.toml`:17 — `torch` → https://download.pytorch.org/whl/cu128 (`uv binding -> pytorch-cu128`)
- `pyproject.toml`:17 — `torch` → https://download.pytorch.org/whl/cu129 (`uv binding -> pytorch-cu129`)
- `docs/ar/install.md`:58 — `torch` → https://download.pytorch.org/whl/nightly/xpu (`pip install --pre torch torchvision torchaudio --index-url https://download.pytorch.org/whl/nightly/`)
- `docs/en/install.md`:58 — `torch` → https://download.pytorch.org/whl/nightly/xpu (`pip install --pre torch torchvision torchaudio --index-url https://download.pytorch.org/whl/nightly/`)
- `docs/es/install.md`:60 — `torch` → https://download.pytorch.org/whl/nightly/xpu (`pip install --pre torch torchvision torchaudio --index-url https://download.pytorch.org/whl/nightly/`)
- `docs/ja/install.md`:58 — `torch` → https://download.pytorch.org/whl/nightly/xpu (`pip install --pre torch torchvision torchaudio --index-url https://download.pytorch.org/whl/nightly/`)

**Proposed fix**

1. Commit a lock (`uv.lock`, or `pip-compile`/`pip lock` output with hashes) and make the README/Dockerfile/CI install from it, so every documented path resolves identical files.

**Selected files**

| case | install path | package | version | index | file | sha256 |
|---|---|---|---|---|---|---|
| 1 | `pip install .` (pyproject/requirements only, PyPI) | `torch` | 2.14.0 | PyPI | [torch-2.14.0-cp311-cp311-manylinux_2_28_x86_64.whl](https://files.pythonhosted.org/packages/8d/be/c0c8a845bf00552960d2f1f6a00b6ac9750fd312f55429c3e8c6c0e3aac4/torch-2.14.0-cp311-cp311-manylinux_2_28_x86_64.whl) | `8d9e232b6376c62f` |
| 1 | `uv sync` / `uv pip install .` (pyproject with `[tool.uv.sources]`) | `torch` | 2.13.0+cu129 | download.pytorch.org/whl/cu129 | [torch-2.13.0+cu129-cp311-cp311-manylinux_2_28_x86_64.whl](https://download-r2.pytorch.org/whl/cu129/torch-2.13.0%2Bcu129-cp311-cp311-manylinux_2_28_x86_64.whl) | `545c1ecc90e0fb13` |

Found by an automated check that resolves the declared dependencies under each documented install path and diffs the selected files. File URLs and sha256 hashes are listed above so the result can be re-checked independently.