"Hash Sum mismatch" during apt install on Raspberry Pi OS: stale index or out-of-sync mirror?

Short answer

You cannot reliably distinguish the two causes from the error text alone — apt reports the same Hash Sum mismatch either way. The practical distinction is behavioral: a stale or partially written local index is fixed permanently by a clean refresh, while a mid-sync mirror keeps failing after a clean refresh and is fixed by switching mirrors or waiting. Clearing /var/lib/apt/lists is not strictly required for a merely old index (apt update overwrites it), but it is the cheapest way to rule out a corrupt partial download, so it is the right first step.

What the error actually means

apt downloads a signed Release/InRelease file that lists the expected hashes of every index file, and those indexes in turn list hashes of each .deb. A mismatch means something apt fetched does not match what the signed metadata promised, so apt aborts rather than risk installing corrupted or tampered content. Do not bypass this with insecure options — the check is doing its job.

Likely causes on a Pi, in order

1. Out-of-sync mirror. Raspberry Pi OS pulls from the raspbian archive plus the separate Raspberry Pi repository (archive.raspberrypi.org / raspi.list), often via a redirector. These sync on their own schedules, so a mirror can briefly serve a new Release file against old index files. This is the most common cause when the error appears suddenly on a system that worked yesterday.
2. Stale or partially written local index. An interrupted apt update or abrupt power loss (common on SD-card Pis) can leave truncated files in /var/lib/apt/lists.
3. Less common: a transparent proxy or captive portal mangling downloads, or SD card corruption — suspect the card if mismatches recur across different mirrors.

Minimal diagnostic sequence

sudo rm -rf /var/lib/apt/lists/*
sudo apt update

• If apt update completes and the install proceeds, it was a local index problem. Done.
• If the same mismatch appears immediately after the clean refresh, the local index was just rebuilt from the mirror — so the mirror itself is inconsistent. Edit the mirror in /etc/apt/sources.list (and /etc/apt/sources.list.d/raspi.list for the Raspberry Pi repo; exact filenames vary between bullseye and bookworm, so check what exists on your system), pick a different official mirror, and rerun apt update. Alternatively, wait an hour and retry — mid-sync mirrors usually converge on their own.
• If mismatches persist across multiple mirrors, check storage health: dmesg for I/O errors and a filesystem check on the card.

Answering the specific sub-questions

Error output vs. index state: comparing timestamps in /var/lib/apt/lists against the repository's Release date tells you the index is old, but as you noted it cannot separate a corrupt partial download from a mid-sync mirror. The clean-refresh test above is the reliable discriminator, not the timestamps.

Raspbian vs. Raspberry Pi repo: the diagnosis is the same, but note which repository the failing file belongs to in the error output — the Raspberry Pi-specific repo is smaller and syncs differently, so only edit the corresponding sources file rather than both.

Is clearing the lists directory ever strictly necessary? For a merely outdated index, no — apt update replaces it. Clearing is only needed to eliminate corrupt partial files, and since you cannot tell those apart from the error alone, doing it once up front is the pragmatic choice.