Filled at each merge from the go.sum the indexer reads (the lead's ruling on I7), read once per consumer per process
even where its hash is unchanged; the builder's floor asks {package} and reads {requirements: [...]}, highest last.
Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig