I've been digging around in setup hunting for the 'erroneous use of prev versions' bug. It seems to be due to the fact that in processOneDependency in package_version.cc, the first satisfactory version from the versions set is chosen. Since packageversion doesn't expose its trust level, and PackageSpecifications know nothing about trust levels, fixing this requires an architectural descision. But for verification purposes, I reversed the order of iteration, and the problem disappeared from the originally problematic packages, and appeared for those which had previously worked.
Short version: I know where the bug is, I just don't know how best to solve it. Robert, hope this helps. Max.
