feat(deps): bump views-pipeline-core to 3.0.0 — six register entries close

[Polichinel]

Requested by #172. views-pipeline-core 3.0.0 reached PyPI on 2026-08-03; our <3.0.0 cap excluded it, so this was a decision rather than a maintenance chore.

What closes — each verified in the installed wheel, not the changelog

entry	what closed it
C-73 (Tier 2)	search_files_by_metadata now pages (Query.limit + Query.offset, MAX_METADATA_PAGES). It used to return the newest of the oldest 25 and ship a stale run rather than failing. get_predictions_by_metadata now raises MetadataSearchIncomplete instead of returning [] on a failed search — without that, paging would have traded a false-stale answer for a false-absent one
C-58 (Tier 2)	create_bucket gone; a missing container fails loud before any write instead of silently provisioning new production storage
C-13	install_request_timeout() is called by pipeline-core itself, and the SDK has a single outbound HTTP call site — so uploads, downloads and searches are all bounded by one chokepoint
C-62	geopandas, torch, shapely, pyogrio, seaborn, statsmodels, plotly gone; 155 → 118 packages
C-07	appwrite and pytest declared here instead of free-ridden
C-44	the bump itself

The appwrite extra is not optional despite the name

The partner managers import views_pipeline_core.modules.{appwrite,datastore}, which import the SDK unguarded. Proven by removing the SDK: the manager import raises ImportError: ... requires the optional 'appwrite' extra. Built wheel metadata carries views-pipeline-core[appwrite], so views-models' pip install git+…@main resolves it.

pytest was never declared here and arrived through pipeline-core, which dropped it in 3.0.0. Without the dev group, CI would have failed as "pytest: command not found" — a dependency fault wearing a runner fault's clothes.

New: tests/test_framework_contract.py

Measured with a plugin over the whole run: views_pipeline_core was imported zero times by the suite. Every manager test is a source scan, because the managers need Appwrite env and a views-models path manager to instantiate. So 362 green tests were entirely orthogonal to a major framework release — "the suite passes" was not evidence about this bump at all.

This file asserts the contract instead: overridden hook signatures match the base, no unimplemented abstract methods, the MRO C-40 describes, and every inherited attribute resolves. Three mutations proven — a hook gaining a parameter, the MRO reordered, and an undeclared inherited attribute appearing.

All 13 upstream breaking changes were checked against our surface; none bites. The PredictionFrame leaf-class move was already satisfied — we import it from views_frames, construct positionally, and never read .y_pred.

Three of my own register claims were wrong, and are corrected here

• Cluster M's scope line still read "Full for … C-72 …" three lines below the paragraph correcting exactly that. C-72 does not close: its fix changes delivered wire bytes and needs a coordinated three-repo re-vendor of the ADR-013 §10 fixture.
• C-62 claimed the bump removed most of the Dependabot surface. It did not — 29 of 31 alerts survive at unchanged versions (Pillow now via matplotlib ← pyod, GitPython via wandb). The dependency tree shrank a lot; the vulnerability surface barely moved.
• C-07 said "the residual is pandas alone." Wrong twice: numpy is an undeclared module-scope runtime import in five modules, and pandas is TYPE_CHECKING-only.

New: C-83 (Tier 2) — a misdiagnosis trap on the live FAO path

get_queryset() swallows import errors and returns None; declared_data_format(None) defaults to 'dataframe'; our guard then tells the operator to "Set data_format: 'feature_frame' in the postprocessor's config_queryset" — a file that already says exactly that. A queryset that failed to import is indistinguishable from one declaring the wrong format, and the message lands while someone is fixing a failed run. Reproduced both ways. The fix is ours and is one branch.

Verification

370 passed / 40 xfailed / 0 failed   isolated venv, built from PyPI with the exact resolved set
370 passed / 40 xfailed / 0 failed   conda env, editable sibling
ruff check .  ->  All checks passed!

Wire fixtures still verify byte-for-byte; pyarrow and views-frames pins deliberately untouched. poetry check --lock clean and byte-idempotent.

Also: ruff now runs in CI — a declared linter nobody runs is a claim without a check. README dependency table completed with pyarrow and the dev group.

Register 82/16/66 → 83/17/66.