Merge pull request #191 from PyAutoLabs/claude/matern-tfp-smoke-install-ozb8as

fix(hygiene): correct the `extras` remedy — pin the package, not the extra

Author: Jammy2211

agents/conductors/hygiene/_hygiene_extras.py

@@ -315,10 +315,13 @@ def main() -> int:
             f"absent in mode=smoke"
         )
     print(
-        f"\nAdd each to the smoke install step in {WORKFLOW}, mirroring the "
-        "`autofit[optional]` line already there — prefer installing the declaring\n"
-        "library's [optional] extra over pinning the single package, so a future\n"
-        "addition to that extra is covered too.\n\n"
+        f"\nAdd each to the smoke install step in {WORKFLOW}.\n\n"
+        "PIN THE PACKAGE, don't add the declaring library's [optional] extra: this\n"
+        "leg installs PUBLISHED wheels, so a library extra resolves the RELEASED\n"
+        "metadata, which lags the source pyproject this scan reads. A stale pin in\n"
+        "that extra can silently downgrade a package the step pinned deliberately\n"
+        "(autoarray 2026.7.29.2[optional] pinning nufftax<0.5.0 did exactly that).\n"
+        "This scan is what covers future additions — that is why it exists.\n\n"
         "Do NOT skip-guard or park the failing script: it passes mode=release, so "
         "the script is correct and the install set is the defect. Route to /bug."
     )

skills/hygiene/hygiene.md

@@ -41,8 +41,10 @@ Shared routing context: `PyAutoBrain/skills/COMMANDS.md`.
    sibling repo) before re-pointing it. Route `optdeps` findings to `/refactor`
    too (add the skip guard), but route `extras` findings to `/bug`: a script
    that fails only in `mode=smoke` and **passes `mode=release`** is correct, so
-   the defect is the CI install set — add the missing install (prefer the
-   declaring library's whole `[optional]` extra). Never "fix" such a script by
+   the defect is the CI install set — add the missing install, pinning the
+   package itself rather than the declaring library's whole `[optional]` extra
+   (that leg installs published wheels, whose extras lag the source pyproject
+   and can silently downgrade a deliberate pin). Never "fix" such a script by
    skip-guarding or parking it; both silently delete coverage that release
    validation still depends on.
    Source changes ship via `ship_library` / `ship_workspace`.