This check only works if the runtime requirement resides in the same ring. The fun case being kernel-syms which is required by virtual box (ring-2), but must remain in ring-1 to ensure matching build revision with other kernel packages.
list --supersede PACKAGES...
select --move