Explain a Silent Metric Regression Traced to an Unpinned Dependency

A team's requirements.txt contains numpy>=1.21 and scikit-learn>=1.2, with no lockfile. A model retrained on Monday reports 0.87 AUC; the identical training script, run again on Thursday against the identical data snapshot, reports 0.83 AUC. Nobody touched the code or the data between the two runs.

1. Give a concrete, plausible mechanism for how this happens with the requirements.txt shown above.
2. Propose a fix, and explain specifically what a lockfile would have pinned that requirements.txt did not.
3. Your teammate suggests "let's just pin every package to == exact versions in requirements.txt and skip the lockfile tooling." What does a real lockfile give you that hand-written exact pins in requirements.txt don't?