One scenario where this happens is in jrudolph/sbt-cross-building#13. Here the last actually run update determines what the result of deliver will be. However, since the UpdateReport isn't considered stale even if the cachedDescriptor was changed (externally or by sbt), sbt will skip the update and deliver will happily deliver anything which is found at the cachedDescriptor location.
I could imagine that a fix for this issue would fix more of those scenarios where it is necessary to delete the resolved*.xml in the ivy cache to make something work.
The resolution could be to not only store the cachedDescriptor location but a hashsum over the contents as well in the UpdateReport and check if it is still current in the uptodate method in Defaults.scala.
IMPORTANT This project has moved to https://github.com/sbt/sbt. This issue still exists to avoid dead links, but GitHub limitations prevent the original issue from being correctly preserved here. Please see sbt/sbt#532 for the full issue and to comment.