todo: - relock stuff - default to all apps needing upgrade - more tests? - pkgs?
Only the most complex case is failing, where cross-dependencies would need to be refetched as an update clears an app of its dependencies and a different subtree should override it.
The problem with the current effort is handling of transitive dependency upgrades and possible values.
Test that all the correct locks are set for an upgrade run. Now to actually re-run the install deps and prove it works