[smpy][create-host] standalone create-host pins simple_module_* at >=1.0,<2.0 — unsatisfiable on PyPI (same class as #126), so 'uv sync' fails #206

What

A standalone smpy create-host <name> scaffolds a host whose pyproject.toml pins the framework packages with the forward-looking range >=1.0,<2.0:

# framework/cli/simple_module_cli/templates/host/pyproject.toml.tpl:7-10
"simple_module_core>=1.0,<2.0",
"simple_module_db>=1.0,<2.0",
"simple_module_hosting>=1.0,<2.0",
"simple_module_settings>=1.0,<2.0",

The framework is still published at 0.0.x (current release 0.0.18), so no published distribution satisfies >=1.0,<2.0 and the very first uv sync in the generated host fails to resolve.

Repro

smpy create-host myhost
cd myhost
uv sync          # -> resolution error: no version of simple_module_core matches >=1.0,<2.0

Why this slips through

This is the same defect class as the already-closed #126 / #127 (sm new sample module pinned >=1.0,<2.0 / ==0.0.x mismatch) and the still-open #195 (create-module ranges) — but in the create-host code path, which the earlier fixes never covered:

• smpy new (workspace) rewrites host deps to an exact ==<resolved version> via app_project._rewrite_pyproject, and pins the sample module via create_module(..., framework_version=resolve_framework_version()). ✅ works.
• smpy create-module was wired to pin_framework_deps(...). ✅ works.
• smpy create-host (cli.py:59 → _create_host(target, name=name, modules=selected)) passes no framework_version and never calls pin_framework_deps / _rewrite_pyproject, so the host pyproject.toml ships the raw template ranges unchanged. ❌ broken.

Note: create_host(framework_version=...) exists, but it only substitutes {{FRAMEWORK_VERSION}} into the npm client_app/package.json (where "*" is a valid npm wildcard). It does not touch the Python pyproject.toml host deps, which are hardcoded >=1.0,<2.0.

Suggested fix

Make create-host pin its Python framework deps the same way create-module / new do:

• In cli.py, pass framework_version=resolve_framework_version() to _create_host, and
• have create_host run pin_framework_deps(host_pyproject, version) over the rendered host pyproject.toml (or template the host deps with {{FRAMEWORK_VERSION}} like the workspace template does).

Also worth hardening: create_workspace / create_host default framework_version="*", and the workspace template line simple_module_test=={{FRAMEWORK_VERSION}} would render the invalid PEP 508 specifier simple_module_test==* if that default is ever used (the new path always passes a real version today, so it's latent). Consider rejecting "*" for the Python-pin paths or deriving the default from resolve_framework_version().

Acceptance

• smpy create-host myhost && cd myhost && uv sync resolves cleanly against the current 0.0.x release.
• A scaffolding test asserts the generated host pyproject.toml pins simple_module_* to the installed framework version (mirroring the existing create-module test), so this can't regress per-path again.