An exact first-party pin duplicates the package for every consumer that
already holds a later patch. The cohort guard asserts the declaration and
the resolved copy apart, so the range moves while the single-copy check
stays on 0.9.4.