[Polichinel]

Closes #182. Part of epic #181. Registers C-74 and files #192.

What

appwrite_env.assert_env_declared now logs at ERROR before raising, per ADR-008:48/51. Two lines.

Why it was missing, which is the interesting part

contract/launch_config.py was written in #149 by deliberately mirroring this module — same shape, same failure style, same dependency-light constraint. It inherited the flaw, the S1 diff review caught it in the new code, and the new module was fixed. The old one was left alone for scope discipline.

So the pair ended up inconsistent in the wrong direction: the module written to match the pattern was the only one that had it.

The test therefore parametrises the ADR-008 obligation over both validators rather than pinning one. Adding a third is one line in _REFUSALS, not a new test.

WET before DRY — explicitly refused

No shared assert_declared helper. They answer different questions (did the launcher assemble the environment vs did it declare the delivery mode) against different sources (os.getenv vs a passed dict). Named trigger to revisit: a third entry-validation module. Recorded in #181 so the next contributor's instinct to extract meets an argument rather than a silence.

The secret

CONNECTION_ENV carries APPWRITE_DATASTORE_API_KEY. Logging a refusal is only safe because missing holds names: membership is decided by os.getenv(name) being falsy and the resolved value is never read. A second test sets a sentinel value and asserts it never reaches a record, so a future "log the environment for debuggability" cannot land quietly.

Mutation-tested

Removing the logger.error line fails 2 of the new tests. A guard that passes on the bug it was written for is decoration.

Review found something bigger — C-74, now #192

Reading tests/test_redaction_guard.py (cited by the new test as "the wider rule") showed it is not enforcing that rule. It pins the þing-01 #135 audit over five module roots; #153 moved the machinery from unfao/ to contract/ and four were never re-pointed:

declared root	exists	scanned
unfao/wire	no	0
delivery	yes	6
unfao/historical.py	no	0
unfao/track_a_source.py	no	0
unfao/frame_extraction.py	no	0

Silent by construction: rglob on a nonexistent directory yields nothing rather than raising, so a missing root and a clean root look identical. 6 files scanned instead of ~16, passing.

Not a leak — the relocated modules were checked directly and are still credential-blind. What is gone is the thing that would notice them ceasing to be.

Two register claims corrected in place: C-57 said the redaction clause was "already mechanically enforced", and Cluster I's fix strategy cites this exact file as the guard pattern working. Both were written in good faith; both were overclaims.

Sixth instance of the stale-claim class in two days. The shape has a name now: a move leaves prose and paths behind, and nothing here asserts that a declared path exists. Handed to S9's ADR question.

Review findings addressed

• F2 (warning) — this diff falsified test_env_declaration.py's own module docstring ("Imports only unfao.appwrite_env"). Fixed. Introducing a stale claim in an epic about stale claims would have been a poor look.
• F3 (suggestion) — assert_env_declared's docstring now declares the log side effect and carries Args:/Raises:, matching launch_config.
• F4 (suggestion) — noted that S1, S3 (S3 — Finish #158's rename, and ban the retired contract name from code #184) and S6 (S6 — Detect coordinate-registry drift against the Appwrite Seam Contract (C-57) #187) all edit this module; S3 must be re-read after this lands rather than applied from its issue text.

Verification

ruff check .                                  # clean
pytest -q                                     # 310 passed, 44 xfailed, 5 known pyarrow (C-72)
git diff --stat origin/main -- tests/fixtures/  # empty — ADR-013 byte-frozen
pytest -q tests/test_register_integrity.py    # 8 passed

Note: the epic's freeze check originally said main, not origin/main. A stale local main reported 10 changed fixture files on a branch that touched none. Corrected in #181/#186/#190/#191 — a verification command that cries wolf gets ignored, which would have defeated the point.

🤖 Generated with Claude Code