What to learn from project deletions on PyPI?

That’s a different question. Non stable URLs doesn’t mean the file was deleted. It could just be at a new location (this has happened once in PyPI history, but it’s more important for alternative repositories that have different constraints.

If you want to prevent leftpad that’s better solved by preventing deletion from PyPI completely, or some other mechanism. Alternatively we could update the spec to mandate stable URLs even past deletion if we really wanted to.

I’m just pointing out that the repository api spec does not currently have the requirements you’d need to support a lock file by explicit file URL without relying on PyPI specific implementation details.