The whole check: one fetch, then arithmetic.
injected so a test drives it without network, and so a caller can supply a cache-wrapped fetch. Packagist's p2 payloads are immutable per version, which is what makes one cached fetch the right shape.
The whole check: one fetch, then arithmetic.