Sync main: views-pipeline-core 3.0.0 — six register entries close

[Polichinel]

Brings main current with the views-pipeline-core 3.0.0 bump (#216), requested by #172.

⚠ Merging deploys

views-models/postprocessors/un_fao/run.sh installs this repo with pip install git+…@main. The next FAO run picks this up, and this one changes the framework underneath the delivery. Pinning that launcher to a tag remains the fix; it is a two-repo change and not made here.

What closes — each verified in the installed wheel, not the changelog

entry	what closed it
C-73 (Tier 2)	search_files_by_metadata now pages. It used to return the newest of the oldest 25 and ship a stale run rather than failing
C-58 (Tier 2)	create_bucket gone; a missing container fails loud before any write instead of silently provisioning new production storage
C-13	install_request_timeout() is called by pipeline-core itself, bounding every outbound call at a single chokepoint
C-62	geopandas, torch, shapely, pyogrio, seaborn, statsmodels, plotly gone; 155 → 118 packages
C-07	appwrite and pytest declared here instead of free-ridden
C-44	the bump itself

The framework was previously untested — that is now fixed

Measured with a plugin over the whole run: views_pipeline_core was imported zero times by the suite. Every manager test is a source scan. So a green suite said nothing whatsoever about a major framework release.

tests/test_framework_contract.py (new, 8 tests) asserts the contract: overridden hook signatures match the base, no unimplemented abstract methods, the MRO register C-40 describes, and every inherited attribute resolves. Three mutations proven.

All 13 upstream breaking changes were checked against our surface; none bites.

Two CI failures worth recording

Both were mine, and both are the same shape — verified in my environment, asserted generally:

1. ruff check . was green locally and red in CI by 815 findings. My ruff was 0.14.13; CI resolved 0.16.1, which widened its default rule set. Inheriting a moving default is ADR-003's forbidden inference applied to tooling. The rule set is now declared (select = ["E4","E7","E9","F"]) and verified against both versions.
2. Then ruff linted views-crafdapi, the sibling CI checks out into the workspace — 745 findings in someone else's repository. That is the third tool here to walk the sibling checkout; the coordinate-value and partner-contact scans both did, and the latter would have turned main red with a message asserting a file was "in this public repository" when it was not.

Corrections to my own register claims, made in the same PR

• Cluster M's scope line still said "Full for … C-72 …" three lines below the paragraph correcting exactly that. C-72 does not close — its fix changes delivered wire bytes.
• C-62 claimed the bump removed most of the Dependabot surface. It did not: 29 of 31 alerts survive at unchanged versions (Pillow via matplotlib ← pyod, GitPython via wandb). The tree shrank; the vulnerability surface barely moved.
• C-07 said "the residual is pandas alone." Wrong twice: numpy is an undeclared module-scope runtime import, and pandas is TYPE_CHECKING-only.

New: C-83 (Tier 2)

get_queryset() swallows import errors and returns None; declared_data_format(None) defaults to 'dataframe'; our guard then tells the operator to set data_format: 'feature_frame' in a file that already says so. A queryset that failed to import is indistinguishable from one declaring the wrong format — on the live FAO path, while someone is fixing a failed run. Reproduced both ways.

Verification

410 collected
370 passed / 40 xfailed / 0 failed   isolated venv from PyPI, exact resolved set
370 passed / 40 xfailed / 0 failed   conda env, editable sibling
356 passed / 16 skipped / 38 xfailed CI (green, including the new lint step)

Wire fixtures verify byte-for-byte; pyarrow and views-frames pins deliberately untouched. Register 83 / 17 open / 66 resolved.