Features
- Go h1: module-tree hashes are actually verified
- Cargo and Python version requirements resolve against registry metadata
- prefer_lock_pin refines a manifest requirement from a co-located lock, staying unresolved when ambiguous.
- resolve_declared_reference exposes that refinement before age/reputation gating.
- Cache sweep gained entry-count ceiling, completion-aware marker, hourly retry and write-triggered re-sweep.
Fixes
- Undefined-kind references aren't coalesced, so go.sum metadata hashes and conflicting pins survive discovery.
- Malformed or over-budget Go archives report as explicitly unverified rather than pinned.