See one example
The catalog found two version labels that later pointed at different bytes. For fairwinds-stable/goldilocks@10.3.0, the retained package starts 9498a6f49cde; the republished package starts 3e51ce8032b0.
The catalog keeps the reviewed package and records the newer bytes separately. It does not silently replace the package behind earlier evidence.
Check the record
Open the upstream change record. It links the retained publication receipt and the witness for the republished package.
Do this next
Choose the supply-drift question and check the current digest against the retained record.