S4: delete the unfiltered arrival check; keep the row differential #245

Re-scoped 2026-08-12. The first draft said "replace arrived with an obligation check". That was wrong and an expert review caught it: it would have moved a safety property onto another repository's labelling discipline. This story is now a deletion.

Part of #241, Gate 1 — blocks PR #240. Registers C-90, corrects C-86.

Problem

test_nothing_this_repo_reads_has_changed_since_the_pin has two halves. changed is filtered to the names this package reads. arrived is not:

arrived = sorted(
    set(_rows(current, _TABLES_WE_DEPEND_ON)) - set(_rows(pinned, _TABLES_WE_DEPEND_ON))
)

Measured on views-appwrite origin/main: 25 rows across those tables, 8 of which this package never reads — keys and callers belonging to other repositories. views-appwrite issuing one more key for an unrelated repo turns both partner parametrizations red here and blocks a merge to main, which is the release to FAO.

That is the failure class C-86 records and that PR #239 was written to remove. The same test's docstring, seven lines above, says: "Silent through: prose edits, [meta] bumps, and rows belonging to anyone else." The prose describes the check that was designed; the code implements a wider one.

Its self-defence is also false. The message claims "[contract.*] arrived exactly this way, and nothing else here would have seen it." [contract] was a new top-level table, so test_every_table_in_the_registry_is_classified_here would have caught it. The partition already covers the case arrived cites as its reason to exist.

Work

1. Delete arrived and its assertion. Nothing replaces it.
2. Keep changed exactly as it is. It is the only mechanism anywhere that detects a rotation — a value moving while its name and class stay the same — and it depends on nothing anyone says about themselves, only on bytes at two commits.
3. Make the docstring true: state that a new coordinate we do not read is silent, and why.

Why changed must survive — verified

views_postprocessing/unfao/appwrite_env.py:88 is missing = [name for name in names if not os.getenv(name)]. Runtime validation checks presence and non-emptiness only. It cannot see a coordinate whose name is unchanged and whose value moved. So "we could just rely on assert_env_declared" is false for exactly the case that matters: a rotated bucket id means every delivery goes somewhere else, silently.

Stopping rule — this is the point of the story

Write this into the test file, above the check:

The drift check fires on exactly one condition: a row this package names in _EXPECTED_NAMES differs between the pinned edition and the sibling's main.

Any proposal to add a condition must name the delivery failure it prevents, and show that failure is not already prevented by assert_env_declared at runtime. If it is, the condition is refused.

Acceptance criteria

• Adding a row to [secret] or [target] that this package does not read is silent. Mutation-proven against a synthetic registry.
• Rotating a value this package reads still fails. Re-proven.
• The docstring and the code agree, and the stopping rule is in the file.
• wc -l tests/test_env_declaration.py is lower than before this story.
• C-86's "Partial mitigation" paragraph corrected — it currently overstates what shipped.

Deliberately not done here

Adopting [edition].obliges_consumers (views-appwrite#76, shipped as registry v1.6.0). It is a good mechanism and it is an addition. changed is self-verifying; the obligation flag depends on upstream labelling an edition correctly. Never substitute courtesy for safety. Deferred, trigger: the drift check fires again on something we do not care about.

Re-pinning to v1.6.0. Hygiene with no safety consequence now that changed exists. Do it when something else takes you into those files.

Labels

story, implementation