When a dependency is patched after installation, the patch contents are part of both…
When a dependency is patched after installation, the patch contents are part of both dependency-cache and compiler-cache identity. Manifest/lockfile hashes alone are insufficient if a cache hit skips postinstall: two changes can have identical dependency versions but different ex…