writeLockFile now expects flattened package records