S2 — Retire delivery/identity.py, and record why it went #150

Epic: #148 · Depends on S1 · Closes C-64, C-25

Background

delivery/identity.py (53 lines) exposes assert_forecast_identity, which checks that a selected forecast document's name/loa match the configured ensemble before download. Its only caller is unfao/managers/unfao.py:260 — inside the legacy _read_forecast_data leg that S1 deletes.

ADR-012 lists it under "Delivery Invariants — Authoritative", so it must not vanish as a side effect of S1. A clone copying delivery/ would otherwise inherit a rule that looks enforced and is not.

The decision — made, not deferred

Retire it. Rationale:

• The contract path selects by run manifest (unfao/wire/source_selection.py) — a commit marker with hash-verified contents. That is strictly stronger than a metadata field match, not a substitute for it.
• An invariant module nothing calls is documentation pretending to be code. delivery/ is the reusable core two clones will copy; carrying an unenforced rule into it is exactly the trap C-64 names.
• Keeping it "in case a future partner needs field-match selection" is speculative. If that partner appears, 53 lines are trivially recoverable from git — WET before DRY applies to resurrection too.

This also closes C-25. That entry's registered mitigation is this function, so on paper C-25 loses its guard. In fact its hazard — "newest category=forecast file wins regardless of producer" — is structurally impossible on the manifest path: selection is by declared run, not by recency. C-25 resolves as superseded by mechanism, not as mitigated.

Work

• Delete views_postprocessing/delivery/identity.py and its export from delivery/__init__.py if present
• Delete or retarget tests/test_identity.py (46 lines)
• ADR-012: dated note on the "Delivery Invariants" row recording that forecast-identity was retired and why — manifest selection supersedes it. This is the standing rule a future contributor could otherwise violate unknowingly (CLAUDE.md → "Recording decisions")
• Register: close C-64 and C-25 with the reasoning above

Acceptance criteria

• No module in delivery/ is unreachable from the live path
• ADR-012 records the retirement with its date and rationale — a reader of the old text can see it from where they stand
• C-25 closed as superseded by manifest selection, not silently dropped
• grep -rn "assert_forecast_identity" views_postprocessing/ tests/ returns nothing

Testing / validation

ruff check . · full suite green (the 5 known pyarrow failures only) · test_register_integrity.py green after the register edit.