It appears for local packages, if autoinstall was once set to FALSE, setting it TRUE later has no effect. It may be that lockbox is depending on the fact that if autoinstall is TRUE the file will be missing. This appears to be related to #97 and #99 and in general lockbox giving versions primacy over refs or other considerations (like autoinstall).