Yes, that's covered in the article, e.g. > Input data, especially descriptions of available dependencies, should be specified such that we can reproduce it for

Yes, that's covered in the article, e.g. > Input data, especially descriptions of available dependencies, should be specified such that we can reproduce it for any previous run. This is the problem many legacy systems struggle with: e.g. deferring important details to some HTTP response, with no way to validate its consistency (it’s usually not consistent, due to new versions being included in queries!). This is the main problem with legacy tools, which makes their users resort to lock files. The article is pointing out that these are mistakes, in the hope that developers of new packaging tools will stop copying them. In the mean time, those of us stuck using those tools will need to keep working around their problems using hacks like lock files.