Preserve HF PTQ checkpoint sidecar files [NV BUG 6491822] - #2060

Actionable comments posted: 2

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@examples/hf_ptq/example_utils.py`:
- Around line 64-77: Add "*.gguf" to _CHECKPOINT_WEIGHT_FILE_PATTERNS so
snapshot_download() and copy_custom_model_files() exclude GGUF weights, then
extend tests/examples/hf_ptq/test_example_utils.py with a model.gguf fixture and
assert it is absent from the quantized export using pytest.
- Around line 965-970: Update _should_copy_checkpoint_sidecar and the associated
copy flow to validate symlink targets before shutil.copy2: resolve the target
and reject links escaping the approved checkpoint roots, while permitting
Hugging Face cache snapshot-to-blob symlinks. Preserve existing exclusions for
export-owned files and checkpoint weight/index files, and add a regression test
covering an out-of-tree sidecar symlink.

Bot review (bedrock-claude-opus-5) — DM the bot to share feedback.

The direction (blanket-copy non-weight sidecars instead of a brittle whitelist) is right and the new test pins the local-dir happy path. A few things to address before merge:

1. Duplicated logic — the repo already has exactly this helper: modelopt/torch/export/plugins/hf_checkpoint_utils.py::copy_non_safetensor_files_from_ckpt (that is the Megatron-Core behavior the PR body cites, and its docstring already documents the "modelopt owns config.json / generation_config.json / hf_quant_config.json / preprocessor_config.json" convention). examples/hf_ptq already imports freely from modelopt.torch.export, so consider reusing/extending it (e.g. add an exclude/extra-patterns arg) rather than adding a second, slightly different implementation that will drift from it.

2. _resolve_model_path now downloads far more than before — swapping allow_patterns=["*.py", "*.json"] for ignore_patterns=<weight patterns> turns a few-KB metadata fetch into "download everything that isn't a recognized weight file". *.gguf (and *.npz, *.pkl, *.tar*, *.zip, media assets) are not in the ignore list, so an HF-ID source can now pull multi-GB artifacts at export time. Please either extend the pattern list or keep an allow-list for the download path while broadening only the local copy path.

3. trust_remote_code no longer gates copying executable *.py — the removed docstring explicitly justified that gating; now modeling*.py/configuration_*.py/tokenization_*.py are copied into the export even for native (non-remote-code) loads, and the argument only affects path resolution. That may well be intentional, but it's a behavior/security-posture change that isn't mentioned in the PR body or covered by a test.

4. Stale quantization metadata can now leak — hf_ptq.py explicitly supports already-quantized sources (pack-quantized/compressed-tensors, MXFP4). Those checkpoints ship files like recipe.yaml / quantize_config.json / quant_config.json, which will now be copied verbatim next to a freshly written NVFP4/FP8 hf_quant_config.json and can confuse deployment stacks. Worth adding to _EXPORT_OWNED_CHECKPOINT_FILES (and deciding explicitly whether generation_config.json/preprocessor_config.json should be source-wins or export-wins, since the Megatron helper treats them as modelopt-owned).

5. Test coverage is limited to the local-directory happy path: no coverage for the snapshot_download ignore-pattern change, for subdirectory skipping, or for the trust_remote_code=True/False parity that just changed.

Actionable comments posted: 2

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@modelopt/torch/export/plugins/hf_checkpoint_utils.py`:
- Around line 319-325: Update the sidecar-copy loop around the os.path.isfile
and shutil.copy2 calls to reject symbolic-link sources before copying, using
os.path.islink(sp) (or an equivalent trusted-root validation) so only regular
files from the snapshot are exported. Preserve the existing exclusions and copy
behavior for valid non-symlink sidecars, and add a regression test covering a
symlinked sidecar.

In `@tests/examples/hf_ptq/test_example_utils.py`:
- Around line 122-131: Remove the duplicate
test_copy_custom_model_files_preserves_python_sidecars_with_trust_remote_code
test because the local source path bypasses trust_remote_code behavior and
duplicates existing coverage. If retaining coverage, replace it with a test that
exercises a remotely resolved model path where trust_remote_code changes the
operation.

Claude review — 3 IMPORTANT, 3 SUGGESTION

Scope: full review (trigger comment carried no scoping instructions). All 4 changed files reviewed: modelopt/torch/export/plugins/hf_checkpoint_utils.py, examples/hf_ptq/example_utils.py, examples/hf_ptq/hf_ptq.py, tests/examples/hf_ptq/test_example_utils.py.

The direction is right, and consolidating onto the existing copy_non_safetensor_files_from_ckpt helper (rather than adding a second implementation) addresses the duplication flagged in the prior round. Blanket-copy-minus-exclusions is a genuinely better contract than the old whitelist. Three things to resolve before merge.

Most impactful findings

1. The HF-model-ID path still uses an extension allowlist (example_utils.py:62-69) — IMPORTANT

The local-dir path now copies everything that is not a weight/export-owned file. The HF-ID path is still bounded by what snapshot_download fetched: *.json, *.md, *.model, *.py, *.tiktoken, *.txt. So the two paths disagree about what a sidecar is, and the same class of bug this PR fixes survives on the HF-ID path for anything outside that list — most notably chat_template.jinja (transformers >= 4.51 saves chat templates as a standalone .jinja; many current hub repos ship one) and extensionless LICENSE/NOTICE, which the shared helper own docstring names as a file it exists to preserve. The new test asserts accuracy_chart.png is copied — true for a local dir, impossible on the HF-ID path, so that assertion reads as broader coverage than it gives.

2. generation_config.json is dropped outright on the TRT-LLM export path (example_utils.py:70-79) — IMPORTANT

_HF_PTQ_EXPORT_OWNED_FILES excludes it unconditionally, but only one of the two callers writes one:

• Unified HF (hf_ptq.py:935): save_pretrained writes it, so the exclusion is correct.
• TRT-LLM (hf_ptq.py:884): export_tensorrt_llm_checkpoint writes only config.json and (auto-quant) quant_cfg.json — no generation_config anywhere in model_config_export.py/tensorrt_llm_utils.py. It used to be copied here via the old "*.json" code pattern under --trust_remote_code. Now it is neither copied nor written, so the export loses the source sampling defaults.

Contrast unified_export_megatron.py:319-330, which calls the same helper with no exclude_files and then explicitly re-saves GenerationConfig.from_pretrained(...) — it guarantees the file exists before superseding the source. The TRT-LLM path does neither. (config.json exclusion is correct there: the TRT-LLM schema is unrelated and copying over it would corrupt the export.)

3. New public constant without __all__ (hf_checkpoint_utils.py:34-57) — IMPORTANT

HF_CHECKPOINT_WEIGHT_FILE_PATTERNS is public in a module star-exported via plugins/__init__.py, and the module has no __all__ — contrary to CONTRIBUTING.md "Define the public API with __all__". Pre-existing gap, but this is the first intentionally-public symbol added here, which makes it load-bearing: it becomes an API surface with a compat obligation, and the star-import also re-exports fnmatch/json/os/shutil/torch/etc. Add an __all__, or make the constant private if it is only for examples/hf_ptq.

Suggestions (non-blocking)

• hf_checkpoint_utils.py:317-326 — the hardcoded .safetensors check is redundant on the new path but is still the only guard for the Megatron caller, where it misses index files not named exactly model.safetensors.index.json. Also, dropping the old per-file try/except means one unreadable file (dangling HF-cache blob symlink) now aborts the entire sidecar copy after weights are written.
• hf_ptq.py:884 — the TRT-LLM copy is not behind if args.dist_state.is_main: (the unified-HF one at line 935 is). Pre-existing, but this PR widens the race window by copying more/larger files.
• test_example_utils.py:122-131 — test_..._with_trust_remote_code cannot observe the flag: _resolve_model_path returns at its first branch for a local dir, so trust_remote_code is never read. It duplicates the previous test. This matters because the trust_remote_code gate on executable *.py is exactly what this PR changes — modeling*.py/configuration_*.py are now copied for native loads too, and a test named after the flag gives false confidence that parity was checked.

Also worth noting: the docstring at example_utils.py:967-971 says source processor files win, while the shared helper docstring (hf_checkpoint_utils.py:298-299) lists preprocessor_config.json as modelopt-owned. Those now contradict for readers of the shared helper.

Risk

Moderate. Confined to the hf_ptq example plus one backward-compatible signature extension (new keyword-only args; the Megatron caller is unaffected). No mode registration, modelopt_state schema, or quantization-math changes. Findings 1 and 2 are silent-data-loss-shaped — the export completes and reports success over an incomplete directory — which is why they are worth fixing rather than deferring.

I did not run the new tests (the sandbox blocked the pytest invocation), so the assertions are reviewed by reading only.

Bot review (bedrock-claude-opus-5) — DM the bot to share feedback.

Re-review of the sidecar-preservation change. Good progress since the last round — most of the critical feedback is now addressed:

Resolved

• Duplicated logic: copy_custom_model_files now delegates to modelopt/torch/export/plugins/hf_checkpoint_utils.py::copy_non_safetensor_files_from_ckpt with new keyword-only exclude_files/exclude_patterns args. The Megatron caller (unified_export_megatron.py) passes neither, so its behavior is unchanged — signature extension is backward compatible.
• Over-download on the HF-ID path: snapshot_download is back on an allow-list (_HF_SIDECAR_DOWNLOAD_ALLOW_PATTERNS) and is pinned by test_resolve_model_path_snapshot_download_stays_allowlisted.
• Stale quant metadata: recipe.yaml/yml, quantize_config.json, quant_config.json, quantization_config.json are in _HF_PTQ_EXPORT_OWNED_FILES and asserted absent in the new test.
• GGUF / other bulk artifacts: covered by HF_CHECKPOINT_WEIGHT_FILE_PATTERNS and asserted in the test, which also pins subdirectory skipping.

Still unresolved from the previous round

1. generation_config.json is excluded unconditionally, but only the unified-HF caller writes one. On the TRT-LLM path export_tensorrt_llm_checkpoint writes only config.json (+ quant_cfg.json) — I confirmed there is no generation_config write in model_config_export.py — so that file used to be copied (via the old *.json pattern under --trust_remote_code) and is now neither copied nor written. Silent loss of the source sampling defaults.
2. The trust_remote_code behavior change (executable modeling*.py/configuration_*.py now copied for native loads too) is still not mentioned in the PR body, and test_copy_custom_model_files_preserves_python_sidecars_with_trust_remote_code cannot observe the flag (local dir → _resolve_model_path returns at its first branch), so it duplicates the previous test under a misleading name. Two prior reviewers flagged this.
3. The HF-ID allow-list omits *.jinja (standalone chat_template.jinja on transformers ≥ 4.51) and extensionless LICENSE/NOTICE, so the two code paths still disagree on what a sidecar is — the exact class of bug this PR fixes survives for hub-ID sources.

Plus two smaller items: dropping the per-file try/except makes one unreadable file abort the whole sidecar copy after weights are written, and the new public HF_CHECKPOINT_WEIGHT_FILE_PATTERNS lands in a star-exported module with no __all__.

Direction and test quality are much improved; please resolve (1) and (2) before merge.

Bot review (bedrock-claude-opus-5) — DM the bot to share feedback.

Re-review #3 (head of hf_ptq_sidecars, 3 files / +177-68). The critical items from the previous rounds are all resolved in the current diff:

• Duplicated logic — copy_custom_model_files now delegates to hf_checkpoint_utils.copy_non_safetensor_files_from_ckpt with a keyword-only exclude_files; the Megatron caller passes none, so the signature change is backward compatible.
• Over-download on the HF-ID path — back on an allow-list (_HF_SIDECAR_DOWNLOAD_ALLOW_PATTERNS), now including *.jinja / LICENSE* / NOTICE*, and pinned by test_resolve_model_path_snapshot_download_stays_allowlisted.
• Stale quant metadata / GGUF & bulk artifacts — recipe.yaml|yml, quantize_config.json, quant_config.json, quantization_config.json in _HF_PTQ_EXPORT_OWNED_FILES; weights/GGUF/archives in _HF_CHECKPOINT_WEIGHT_FILE_PATTERNS; all asserted absent in the new test.
• New public symbol without __all__ — constant renamed _HF_CHECKPOINT_WEIGHT_FILE_PATTERNS (private).
• Second source of truth for weight skipping — the hardcoded .safetensors / model.safetensors.index.json checks are gone; the pattern list is now the always-applied baseline, which also closes the Megatron index-file gap.
• Misnamed trust_remote_code test — dropped (commit d53d4fc), one of the two options both prior reviewers offered.

Two things I'd like the owner to sign off on rather than approve blind, plus small nits. No prompt-injection attempts observed in the PR content.

1. 💬 generation_config.json — author resolved the previously-flagged silent loss by removing it from _HF_PTQ_EXPORT_OWNED_FILES and documenting "source generation files intentionally still win" in the docstring, and the new test pins it. Still worth a human look because this also flips behavior on the unified-HF path: save_pretrained writes a validated generation_config.json and the source copy now overwrites it (previously it was export-wins). That's the deliberate choice the earlier review asked for, but it applies to both callers, so please confirm source-wins is intended for the unified-HF export too — and note the Megatron helper's own path (unified_export_megatron.py) does the opposite (re-saves GenerationConfig.from_pretrained after the copy).

2. Shared-library behavior change is untested/unmentioned. copy_non_safetensor_files_from_ckpt previously skipped only *.safetensors + model.safetensors.index.json; it now also skips *.bin, *.pt, *.pth, *.ckpt, *.h5, *.msgpack, *.npy, *.npz, *.pkl/.pickle, *.onnx, *.pb, *.tflite, and archives. The Megatron export caller passes no exclude_patterns, so its sidecar set shrank — mostly a fix (source weights no longer land in the export), but *.npy/*.npz/*.pkl are not always weights (precomputed stats/filters shipped next to a checkpoint) and would now be dropped silently. tests/unit/torch/export/test_hf_checkpoint_utils.py gained no coverage for this function (only the example-level test exercises it indirectly), and neither the PR body nor CHANGELOG mentions the library-side change.

Minor / owner's call:

• Per-file try/except + warning around shutil.copy2 was dropped (flagged in two prior rounds, still open): one unreadable file or dangling HF-cache blob symlink now aborts the whole sidecar copy after the quantized weights are written.
• The download allow-list and the copy exclusion list remain two independent sources of truth for "what is a sidecar"; nothing ties them together in a test, so they can drift again.
• The new test no longer covers subdirectory skipping (an earlier round's review noted it as pinned); worth re-adding one source/original/… fixture assertion since nested sidecars are silently skipped by design.
• The trust_remote_code copy-parity change (executable modeling*.py / configuration_*.py now copied for native loads too) is documented in the new docstring but still not called out in the PR body, and the checkbox list in the description is left unfilled (Changelog / tests / BC).
• CodeRabbit's symlink-dereference findings look inapplicable here: HF cache snapshots are symlink-to-blob trees, so rejecting symlink sources would break the cache path, and shutil.copy2 was already used before this PR. Fine to skip, but say so explicitly if you want the bot comments resolved.

Bot review (bedrock-claude-opus-5) — DM the bot to share feedback.

Re-review #4 (head of hf_ptq_sidecars, 5 files / +234-72). Most of the previously-flagged items are now resolved — but this revision introduces a new critical regression in the shared library helper, and the accompanying new unit test appears to assert behavior the implementation no longer has (i.e. it should fail in CI).

Blocking (new in this revision)

• copy_non_safetensor_files_from_ckpt no longer skips anything by default: this diff deletes the entry.endswith(".safetensors") or entry == "model.safetensors.index.json" guard and replaces it only with caller-supplied exclude_files/exclude_patterns. The weight-pattern list moved out of the library into examples/hf_ptq (_HF_PTQ_WEIGHT_FILE_PATTERNS), so the other caller — unified_export_megatron.py:GPTModelExporter.save_pretrained, which passes no exclusions — will now copy the source BF16 *.safetensors shards and model.safetensors.index.json into the Megatron export directory, right before save_safetensors_by_layer_index writes its own shards/index. That both blows up export size and can leave stale source shards + a stale index next to the quantized ones (differing shard counts → broken/incorrect checkpoint on load). An earlier review round suggested making the pattern list the always-applied baseline with exclude_patterns purely additive; that is the fix here (or restore the hardcoded skip). The function name and docstring ("Copy every non-safetensors file…") are also now inaccurate.
• tests/unit/torch/export/test_hf_checkpoint_utils.py::test_copy_non_safetensor_files_from_ckpt_supports_additional_exclusions asserts not (default_dst / "model.safetensors").exists() for a default (no-exclusion) call — with the current implementation model.safetensors is copied, so this test should fail. Please confirm CI ran; the assertion encodes the behavior the library ought to have, which reinforces the point above.

Resolved since re-review #3

• generation_config.json is now per-caller: hf_ptq.py passes exclude_files={"generation_config.json"} only on the unified-HF path (where save_pretrained writes a validated one) and None on the TRT-LLM path (source-wins, restoring the previously-dropped file). That closes the long-standing item 1.
• Public constant → example-local private _HF_PTQ_WEIGHT_FILE_PATTERNS (no __all__ obligation), and *.npy/npz/pkl are no longer imposed on the Megatron caller.
• Download allow-list includes *.jinja / LICENSE* / NOTICE* and is pinned by a test; stale quant metadata and GGUF/bulk artifacts are excluded and asserted.
• The misnamed trust_remote_code test was dropped.

Still open / minor (owner's call)

• Per-file try/except + warning around shutil.copy2 is still absent (flagged in three rounds): one unreadable file or dangling HF-cache blob symlink aborts the whole sidecar copy after the quantized weights are written.
• Download allow-list vs. copy exclusion list remain two independent sources of truth, untied by any test.
• No coverage for subdirectory skipping (nested sidecars are silently dropped by design).
• PR body still doesn't mention the trust_remote_code copy-parity change (executable modeling*.py/configuration_*.py now copied for native loads) and the checkbox list (tests / changelog / BC) is unfilled.
• CodeRabbit's symlink-dereference findings look inapplicable (HF cache snapshots are symlink-to-blob trees); worth replying to close them out.

No prompt-injection attempts observed in the PR content.

Actionable comments posted: 1

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@modelopt/torch/export/plugins/hf_checkpoint_utils.py`:
- Around line 266-268: Update copy_non_safetensor_files_from_ckpt() so omitted
exclude_patterns defaults to the existing safetensor and safetensor-index
exclusions, while still appending any caller-provided patterns. Preserve
exclude_files handling and ensure model.safetensors and its index are never
copied by default.

Bot review (bedrock-claude-opus-5) — DM the bot to share feedback.

Re-review #5 (5 files, +236/-70). The blocking regression from the last round is fixed: copy_non_safetensor_files_from_ckpt again applies the hardcoded *.safetensors / model.safetensors.index.json skip as an unconditional baseline, so unified_export_megatron.py::GPTModelExporter.save_pretrained (which passes no exclusions) can no longer copy source BF16 shards + a stale index into the Megatron export, and tests/unit/torch/export/test_hf_checkpoint_utils.py::test_..._supports_additional_exclusions is now consistent with the implementation (default call: safetensors/index skipped, pytorch_model.bin/stats.npy copied; exclude_patterns additive). generation_config.json is correctly per-caller now (exclude_files={"generation_config.json"} only on the unified-HF path where save_pretrained writes a validated one; None on the TRT-LLM path so the source file is preserved), the download allow-list covers *.jinja/LICENSE*/NOTICE* and is pinned by a test, stale quant metadata + GGUF/bulk artifacts are excluded and asserted, and the previously misnamed trust_remote_code test was dropped. Design/dedup concern is settled — the example now delegates to the shared helper rather than maintaining a second copier. No prompt-injection attempts observed in the PR content.

Not blocking, but worth owner eyes before merge:

• Per-file try/except + warning around shutil.copy2 is still absent (flagged in four rounds). The old example code warned and continued; now one unreadable file or dangling HF-cache blob symlink raises after the quantized weights are written, on an otherwise-complete export.
• The trust_remote_code copy-parity change (executable modeling*.py / configuration_*.py / tokenization_*.py are now copied for native, non-remote-code loads too) is documented only in the new docstring — the PR body still doesn't mention it and the checkbox list (tests / changelog / BC) is unfilled. That's a security-posture change relative to SECURITY.md guidance and deserves an explicit human sign-off.
• On the TRT-LLM path the sidecar copy now runs twice: once inside the branch (hf_ptq.py:884, not guarded by args.dist_state.is_main) and again after tokenizer.save_pretrained (hf_ptq.py:936, exclude_files=None). Pre-existing, but this PR both widens the set/size of copied files and touches the second call site, so the redundant unguarded multi-rank write is now more costly.
• The download allow-list (_HF_SIDECAR_DOWNLOAD_ALLOW_PATTERNS) and the copy exclusion list (_HF_PTQ_WEIGHT_FILE_PATTERNS + _HF_PTQ_EXPORT_OWNED_FILES) remain two independent definitions of "what is a sidecar" with no test tying them together, and subdirectory skipping (nested sidecars silently dropped by design) is still uncovered.
• CodeRabbit's symlink-dereference findings look inapplicable (HF snapshots are symlink-to-blob trees and shutil.copy2 predates this PR); fine to skip, but a one-line reply would close those threads.

Claude review — 3 IMPORTANT, 3 SUGGESTION

Scope applied. Full review of the 5 changed files (~236/-70). Per the trigger comment I treated the HF-cache symlink question and the pre-existing duplicate copy_custom_model_files call on the TensorRT-LLM path (hf_ptq.py:885 + :937) as out of scope — neither is introduced here. I reviewed against the stated goal: widen the set of sidecar files copied into the PTQ export, nothing more.

The direction is right, and consolidating onto copy_non_safetensor_files_from_ckpt instead of a second parallel implementation addresses the main structural feedback from the earlier round. The exclusion sets are well chosen and the exclude_files/exclude_patterns additions are keyword-only, so the Megatron caller at unified_export_megatron.py:319 is unaffected. Findings below are about the edges of the widening, not the approach.

IMPORTANT

1. The widening doesn't reach HF-Hub-ID sources (example_utils.py:944) — the most impactful finding. When --pyt_ckpt_path is a Hub ID, _resolve_model_path falls through to snapshot_download(allow_patterns=_HF_SIDECAR_DOWNLOAD_ALLOW_PATTERNS), and anything outside that list is never on disk for the copy step to preserve. So the brittle whitelist this PR removes from the copy path is still in force on the download path: *.yaml/*.yml, *.jinja2, Mistral-family tokenizer.model.v3/.v7 (*.model doesn't match under fnmatch), and README image assets are all still dropped for Hub-ID sources while being copied fine for local dirs. _HF_PTQ_WEIGHT_FILE_PATTERNS is already comprehensive enough to use as ignore_patterns here, which collapses the two lists into one policy and removes the drift risk.

2. Loss of per-file error tolerance (example_utils.py:1030-1035) — the old loop wrapped each shutil.copy2 in try/except and warned; the shared helper does not. Because this is the last step of export_quantized, after the quantized weights are already written, a single unreadable sidecar now turns a completed PTQ run into a traceback. Reachable triggers: shutil.SameFileError when export path == source path (previously warned and continued, now a hard crash), copystat PermissionError on bind-mounted/NFS destinations, and mode-600 files in a shared HF_HOME. Widening the copy set multiplies the exposure.

3. Possible duplicate chat template in the export (hf_ptq.py:936-942) — tokenizer_config.json was previously copied only under trust_remote_code; it is now copied unconditionally and overwrites what tokenizer.save_pretrained() wrote. For a transformers-4.x-era source loaded under transformers 5.x, save_pretrained splits the template into chat_template.jinja and strips it from tokenizer_config.json — then the source copy puts the embedded chat_template back, leaving both. Transformers treats a template defined in both places as a conflict rather than a benign duplicate, so this is either a hard ValueError on AutoTokenizer.from_pretrained (breaking vLLM/SGLang serving of the export) or a version-dependent silent precedence pick; worth verifying against the transformers version this example targets. Not covered by the new tests. Suggested fix: also exclude tokenizer_config.json when the export wrote a chat_template.jinja.

SUGGESTION

• _HF_PTQ_EXPORT_OWNED_FILES mixes overwrite-protection (config.json, hf_quant_config.json — ModelOpt writes these) with outright dropping (recipe.yaml, quantize_config.json — ModelOpt never writes these). Splitting the set makes the intent legible and surfaces that the generic recipe.yaml name is silently discarded.
• The trust_remote_code docstring no longer says that *.py copying is no longer gated by it — a security-posture change the old docstring stated explicitly.
• copy_non_safetensor_files_from_ckpt's new docstring documents only the hf_ptq ordering (write-then-copy-with-exclusions); the Megatron caller uses the opposite ordering (copy-then-overwrite) and that contract was deleted. Also worth stating "top-level regular files only," which is load-bearing now that exclusion patterns are the only thing keeping source weights out.

Verified as correct

• *.safetensors.index.json / *.bin.index.json patterns correctly generalize the helper's hardcoded exact-name model.safetensors.index.json check.
• Excluding generation_config.json on the unified path is a real fix, not a regression: export_hf_checkpoint runs _sanitize_generation_config_for_save (forces do_sample=True when top_k/top_p are set, unified_export_hf.py:1424-1434) before save_pretrained, and under trust_remote_code the source file previously clobbered that sanitized output. Keeping exclude_files=None for the TensorRT-LLM path is right — export_tensorrt_llm_checkpoint doesn't write one.
• preprocessor_config.json remains source-wins for VLMs, matching pre-PR behavior and the AutoProcessor.save_pretrained ordering at hf_ptq.py:851.
• Iterable was already imported in example_utils.py; no lazy-import or plugin-gating regressions (hf_checkpoint_utils stays behind import_plugin).

Risk: moderate. No CRITICAL issues — the algorithm and export metadata handling are sound, and the state/mode surface is untouched. The residual risk is concentrated in finding 3 (potentially unloadable tokenizer for a common source layout) and finding 2 (late-stage crash discarding a completed quantization run). Finding 1 means the PR's stated goal is only half-delivered for Hub-ID sources.