In that email thread, Jay mentions whether this should be a maintained doc page as opposed to a mostly-frozen blog post. I replied to that point by mentioning that a blog post gets much wider attention as "new content" that can be digested in fifteen minutes. As opposed to a section within a large body of documentation that would likely take a full day's worth of attention to slowly go through.

Just to reiterate, I'm happy to write a draft for this post, or co-author it with someone else. I won't start unless I get the green light though, because ultimately I cannot upload content to the blog myself.

@mvdan thanks for opening this issue, I'm glad I found it. As someone who, until recently, bought into the "go.sum is a lock file" myth, I'd be happy to see an official blog post dispelling it. The section of the Go docs explaining why multiple versions of the same package can be present in go.sum (even if a single version is used) is deeply buried under the MVS section. The "aha!" moment for me came from reading the following:

The build list may be inspected with the command go list -m all. Unlike other dependency management systems, the build list is not saved in a “lock” file. MVS is deterministic, and the build list doesn’t change when new versions of dependencies are released, so MVS is used to compute it at the beginning of every module-aware command