A 404 is the easy half. Scoring a package that actually exists is where we got it wrong.