locked packages got upgraded anyway

[Benjamin Connelly]

We have a few ports we compile with different compile time options than 
the FreeBSD binary repo, so we keep them locked. Last night when doing 
some patching, we saw those locked packages get updated anyhow. For 
example, pkg said all of these things on one system:

Installed packages to be UPGRADED:
         pkg: 1.5.6 -> 1.6.1

dovecot2-2.2.18 is locked and may not be modified

Installed packages LOCKED:
   Package dovecot2-2.2.18 is locked and may not be upgraded to version 
2.2.19

(dovecot was not listed in the "Installed packages to be UPGRADED:" 
section, but then it was fetched)

Fetching dovecot2-2.2.19.txz: 100%    3 MiB   2.9MB/s    00:01

Installed packages LOCKED:
   Package dovecot2-2.2.18 is locked and may not be upgraded to version 
2.2.19

(it still did not after fetching appear on the list of packages to be 
upgraded, but)

[17/71] Upgrading dovecot2 from 2.2.18 to 2.2.19...
[17/71] Extracting dovecot2-2.2.19: 100%

dovecot-pigeonhole was always on the list of packages to be upgraded, 
and it depends on dovecot2.

Is this a bug, or did we learn a bad habit that's no longer workable, to 
lock the ports we build with different compile time options to keep 'pkg 
upgrade' from touching them.

Benjamin