@@ -36,6 +36,17 @@ fn module_lines(module: &str, version: &str, zip_h1: &str, gomod_h1: &str) -> [S
     ]
 }
 
+/// True when `line` is a `go.sum` line (zip or `/go.mod` form) for exactly
+/// `module@version`: `"{module} {version} "` or `"{module} {version}/go.mod "`
+/// starts it. The trailing space or `/go.mod` keeps `v1.0.0` from matching a
+/// longer version such as `v1.0.0-socketpatch.1`.
+fn is_version_line(line: &str, module: &str, version: &str) -> bool {
+    line.strip_prefix(module)
+        .and_then(|rest| rest.strip_prefix(' '))
+        .and_then(|rest| rest.strip_prefix(version))
+        .is_some_and(|rest| rest.starts_with(' ') || rest.starts_with("/go.mod "))
+}
+
 /// Upsert the two `go.sum` lines for `module@version`. Any existing lines for
 /// exactly that module+version (either suffix form) are replaced; everything
 /// else — including stale lines for the *replaced* original module, which go
@@ -310,7 +321,22 @@ impl GoSumEditor {
         };
     }
 
-    /// [`upsert_module_lines`] in place; `true` when it changed the content.
+    /// The current content's lines, as `str::lines` splits them.
+    fn current_lines(&self) -> impl Iterator<Item = &str> {
+        let (text, lines) = match &self.state {
+            GoSumState::Text(text) => (Some(text.lines()), None),
+            GoSumState::Lines { lines, .. } => (None, Some(lines.iter().map(String::as_str))),
+        };
+        text.into_iter().flatten().chain(lines.into_iter().flatten())
+    }
+
+    /// Upsert the two `go.sum` lines for `module@version`. Any existing lines
+    /// for exactly that module+version (either suffix form) are replaced;
+    /// everything else — including stale lines for the *replaced* original
+    /// module, which go tolerates and `go mod tidy` prunes — is preserved
+    /// verbatim. The content may be empty (a project whose `go.sum` does not
+    /// exist yet). `true` when it changed the content, `false` when the file
+    /// already carries exactly these lines.
     pub(crate) fn upsert_module_lines(
         &mut self,
         module: &str,
@@ -319,34 +345,32 @@ impl GoSumEditor {
         gomod_h1: &str,
     ) -> bool {
         let want = module_lines(module, version, zip_h1, gomod_h1);
-        let zip_key = format!("{module} {version} ");
-        let gomod_key = format!("{module} {version}/go.mod ");
-        let is_key = |l: &str| l.starts_with(&zip_key) || l.starts_with(&gomod_key);
-        let applied = {
-            let mut want_seen = [0usize; 2];
-            let mut stale_key_line = false;
-            let mut scan = |l: &str| {
-                if l == want[0] {
-                    want_seen[0] += 1;
-                } else if l == want[1] {
-                    want_seen[1] += 1;
-                } else if is_key(l) {
-                    stale_key_line = true;
-                }
-            };
-            match &self.state {
-                GoSumState::Text(text) => text.lines().for_each(&mut scan),
-                GoSumState::Lines { lines, .. } => {
-                    lines.iter().map(String::as_str).for_each(&mut scan)
-                }
+        let is_key = |l: &str| is_version_line(l, module, version);
+        // "Already applied" means the key-matching lines are exactly the two
+        // wanted ones — a bare match count is not enough: a stale same-key
+        // line with a different hash (a union-merged go.sum straddling a
+        // republish) is a hard go `SECURITY ERROR`, and a duplicated zip line
+        // can stand in for a missing /go.mod line. Both still need the
+        // rewrite below.
+        let mut want_seen = [0usize; 2];
+        let mut stale_key_line = false;
+        for l in self.current_lines() {
+            if l == want[0] {
+                want_seen[0] += 1;
+            } else if l == want[1] {
+                want_seen[1] += 1;
+            } else if is_key(l) {
+                stale_key_line = true;
             }
-            want_seen == [1, 1] && !stale_key_line
-        };
-        if applied {
+        }
+        if want_seen == [1, 1] && !stale_key_line {
             return false;
         }
         let (mut lines, eol) = self.take_lines();
         lines.retain(|l| !is_key(l));
+        // Insert both lines at their sorted position (stable against an
+        // unsorted user file: first line strictly greater wins; ties cannot
+        // occur — the exact-key duplicates were just removed).
         let mut out: Vec<String> = Vec::with_capacity(lines.len() + 2);
         let mut pending = want.into_iter().peekable();
         for line in lines {
@@ -364,37 +388,33 @@ impl GoSumEditor {
         true
     }
 
-    /// [`has_module_version`] over the current content.
+    /// True when the content carries a line (zip or `/go.mod` form) for
+    /// exactly `module@version` — go records one for every module version
+    /// its build graph loads.
     pub(crate) fn has_module_version(&self, module: &str, version: &str) -> bool {
-        let zip_key = format!("{module} {version} ");
-        let gomod_key = format!("{module} {version}/go.mod ");
-        let is_key = |l: &str| l.starts_with(&zip_key) || l.starts_with(&gomod_key);
-        match &self.state {
-            GoSumState::Text(text) => text.lines().any(is_key),
-            GoSumState::Lines { lines, .. } => lines.iter().any(|l| is_key(l)),
-        }
+        self.current_lines()
+            .any(|l| is_version_line(l, module, version))
     }
 
-    /// [`remove_exact_module_version_lines`] in place: the removed lines, or
-    /// `None` when nothing matched.
+    /// Remove the lines for exactly `module@version` (both the zip and
+    /// `/go.mod` forms). Used to prune the REPLACED original's lines: once a
+    /// version-pinned `replace` covers the resolved version, go never fetches
+    /// (or verifies) the original at all, and `go mod tidy` prunes exactly
+    /// these lines — writing that state up front keeps the first day-2 tidy
+    /// a byte-level no-op. Returns the removed lines, or `None` when nothing
+    /// matched.
     pub(crate) fn remove_exact_module_version_lines(
         &mut self,
         module: &str,
         version: &str,
     ) -> Option<Vec<String>> {
-        let zip_key = format!("{module} {version} ");
-        let gomod_key = format!("{module} {version}/go.mod ");
-        let is_key = |l: &str| l.starts_with(&zip_key) || l.starts_with(&gomod_key);
-        let any = match &self.state {
-            GoSumState::Text(text) => text.lines().any(is_key),
-            GoSumState::Lines { lines, .. } => lines.iter().any(|l| is_key(l)),
-        };
-        if !any {
+        if !self.has_module_version(module, version) {
             return None;
         }
         let (lines, eol) = self.take_lines();
-        let (removed, kept): (Vec<String>, Vec<String>) =
-            lines.into_iter().partition(|l| is_key(l));
+        let (removed, kept): (Vec<String>, Vec<String>) = lines
+            .into_iter()
+            .partition(|l| is_version_line(l, module, version));
         self.commit(kept, eol);
         Some(removed)
     }