fwiw, folks on twitter suggested to me that npm may be moving in something like my "sync-based PDM" direction:

https://twitter.com/rebeccaorg/status/698370989386694657