the installer was older than the machine it built

An installation image is a snapshot of a system taken at a moment nobody records, and the machine that downloads it inherits that moment. The first thing the bootstrap does here is move the installed package set forward to current, which is necessary and is also where the trouble starts: the snapshot's own base is now older than everything layered on top of it. Two services came up dead against the base library the image had shipped with, and they died in a way that looked like a configuration mistake rather than an ordering one.

The tension is that both things you want are true at once. You want the machine on current software, and you want it to be the machine you tested. Moving everything forward satisfies the first and quietly breaks the second; moving nothing forward builds a fleet that ages on the day it is created.

The decision was to upgrade everything except the kernel, and to hold the kernel deliberately rather than by luck. The reasoning behind that one-line fix is the note: the exception is not a preference, it is a boundary the image cannot cross on its own, and the rest of the upgrade has to be sequenced around it. The cost is that the bootstrap now carries an ordering dependency that has to be understood by whoever touches it next.

What it proves is that images have expiry dates, and that reproducibility begins by admitting it.