Constant PAYLOAD_DIGEST_FILE 

pub const PAYLOAD_DIGEST_FILE: &str = "payload-digest.v1";

Where the list lives inside the payload.

It cannot appear in its own records — a file cannot contain its own hash — so the release commits to it directly and it commits to everything else.