feat(delivery): S1 — one delivery path; refuse an incomplete launch config

[Polichinel]

Closes #149 · Closes #145 · Epic #148 · Register C-63 closed, C-29 resolved

What this is

Not new work — a removal that was four days overdue. The frame-native contract path replaced the pandas path and won (run-0, 2026-07-27, FAO served since). The replaced path was kept behind a config fork "until run 0 proves the contract path live" (C-40) and never removed. D-11 warned exactly this: "If it lingers, three-way duplication becomes the permanent shape."

The defect it closes

Two independent config axes gave four delivery modes; production used one. Omitting either key silently selected the retired half — .get() returning None because a launcher never mentioned the key is indistinguishable from a deliberate False. That is the inference ADR-003 forbids, in the repository that authored it.

	before	after
unfao/managers/unfao.py	636 lines	406
config forks	14	0, plus one refusal
pandas / PGMDataset in the manager	yes	gone

Deleted

The legacy _read_forecast_data body · _read_historical_data's pandas leg · _append_metadata · _delivery_description · _clip_observed_history · the legacy _save body (whose AppwriteConfig duplicated _unfao_appwrite_config verbatim) · LEGACY_FORECAST_FILTERS.

_prod_forecasts_datastore also loses its name_scoped parameter — it existed solely for the caller that no longer exists (ISP).

Added

unfao/launch_config.py — the launch declarations, asserted not inferred. Sibling of appwrite_env (that validates the environment, this the delivery mode), same fail-loud shape, dependency-light. A launcher omitting a key is refused by name and told there is no fallback — so nobody "fixes" it by setting False.

#145 closes with it. The silent uploads were in the legacy _save; the surviving path uploads only through _ContractStorePort, which already raises on a failed result — the guard written after run-0 stranded an invisible orphan (PR #132).

Tests

test_selection_guard.py rewritten to pin the retirement, not a golden string for deleted code. The guarantee moved rather than lapsed: the retired filter values now live in ADR-013's post-adoption record where they stay checkable, and a new test asserts §11.4's Hop-B clause still binds — retiring our reader must not be read as relaxing the consumer's obligation.

test_append_metadata.py deleted — it characterised a deleted method and its own docstring said "keep in lockstep with _append_metadata". The enricher behaviour it exercised is covered by test_enrichment.py.

test_launch_config.py added. Docstring maps in test_input_integrity_e2e.py corrected to the post-#149 tree.

Review findings, addressed in-commit

/review-diff returned HOLD. Fixed before pushing:

1. launch_config raised without logging — ADR-008:48 requires both. New code violating a standing ADR in the exact dimension the story is about. Fixed, with tests asserting the log, not just the raise.
2. _transform annotated -> list while returning None.
3. The declaration check ran after _initialize_data_loader() — a refused config paid for loader construction. Reordered.

Registered C-71 rather than widening scope: appwrite_env has the identical ADR-008 gap (pre-existing, #134). launch_config was written to mirror it and inherited the flaw; fixing only the new one leaves the pair inconsistent, which is worth tracking explicitly.

Contract preservation

No file under wire/, delivery/ or fixtures/ appears in this diff — the ADR-013 byte-parity surface is untouched by construction, not merely by test result.

ruff clean · 303 passed, 41 xfailed · the 5 failures are the known local pyarrow 23.0.1-vs-pinned-16.1.0 byte-parity tests; CI authoritative.

🤖 Generated with Claude Code