All applications should test in two environments. First, the set of packages satisfying stated constraints. Second, against a lockfile consisting of a fixed version for each dep. The first tracks compatibility with the ecosystem, the second verifies the deployable configuration. Valid version sets are manually moved from the first to the second. Upstream failures only break the first.