Say what a kept Python layer may not share with a new install (closes #133)

A kept layer holds nothing a new install would refuse, since pip and
pipenv checked every package against its hash. A package built from
source uses build tools pip downloads without a hash check, and system
packages may be newer in a new install, so those two can differ. The
TODO.md entry says the same.

Model: opus-5-5

TODO.md

@@ -30,13 +30,14 @@ fmt-check, and commit.
   dependencies by hash, and the packages from the lockfile, and no Python, since
   the tests use the base image's. `--deploy` installs only what the lockfile
   names, checks every package against its hashes, and fails when the lockfile is
-  out of date with `Pipfile`. A kept layer holds the same hashed packages a new
-  install would, but its system packages may be older. The packages are kept as
-  a layer, not a cache mount, for the reason Go's modules are. The tests still
-  run after `ARG CACHEBUST`, and every other stage still installs its Python
-  packages after it. `REPO_POLICIES.md` gains a short Python `test` phase
-  example, and both checklists and the README state the rule the same way.
-  rfscan picks this up on its next re-vendor.
+  out of date with `Pipfile`. A kept layer holds nothing a new install would
+  refuse, except that a package built from source and the system packages may
+  differ from a new install. The packages are kept as a layer, not a cache
+  mount, for the reason Go's modules are. The tests still run after
+  `ARG CACHEBUST`, and every other stage still installs its Python packages
+  after it. `REPO_POLICIES.md` gains a short Python `test` phase example, and
+  both checklists and the README state the rule the same way. rfscan picks this
+  up on its next re-vendor.
 - 2026-10-21: The canonical `.golangci.yml` now accepts a local `replace` of
   `github.com/grafana/sobek` in a repository's root `go.mod` (issue 134), for
   homoicon, which keeps a local copy of sobek on sneak's decision in

prompts/REPO_POLICIES.md

@@ -389,14 +389,16 @@ style conventions are in separate documents:
       the development packages. `--deploy` installs only what `Pipfile.lock`
       names, checks every package against the lockfile's hashes, and fails when
       the lockfile is out of date with `Pipfile`.
-    - A kept layer holds the same pipenv, the same dependencies of pipenv and
-      the same lockfile packages that a new install would, because each was
-      checked against its hash. The packages `virtualenv` puts into the
-      virtualenv that pipenv creates are the same too: the `virtualenv` package,
-      one of pipenv's dependencies, copies them from wheels it ships, and its
-      hash covers those wheels. Any system packages the step installed are not
-      pinned by hash: the layer keeps the versions the package manager gave when
-      the layer was built, and a new install may get newer ones.
+    - A kept layer holds nothing a new install would refuse: pip checked pipenv
+      and its dependencies, and pipenv checked the lockfile's packages, against
+      their hashes. The packages `virtualenv` puts into the virtualenv that
+      pipenv creates come from wheels the `virtualenv` package ships, which its
+      hash covers. Two things in the layer are not fixed by a hash. A package
+      with no ready-built wheel for the image is built from source, with build
+      tools pip downloads without a hash check, so a kept layer's build of it
+      may differ from a new one. And system packages keep the versions the
+      package manager gave when the layer was built; a new install may get newer
+      ones.
     - The packages are kept in a layer rather than a cache mount for the reason
       Go's modules are: a cache mount is shared by every build on the host, and
       nothing checks its files again.