[Polichinel]

What this does

Both platform Appwrite keys were rotated on 2026-10-29. This updates KEY_EXPIRY
to the successors' dates, rewrites the tripwire's warning text to describe the
world that now exists, and closes C-84 and C-110.

ACKNOWLEDGED_UNTIL was never set. The check goes green on the underlying
fact, not on an acknowledgement.

The rotation

was	now	scopes	verified before the old one was stood down
VIEWS Pipeline Core	pipeline-core-writer	6 load-bearing	appwrite_store STORE_ACTIVE (1007 files); unfao_delivery DELIVERING; 3 collections, 1006 documents
UN FAO / faoapi-legacy-shared-RETIRING	faoapi-server	4, all reads	faoapi smoke test ALL PASS, appwrite=True, both legs serving 1,030 cells

C-84 fired on 2026-10-18 exactly as predicted and held main closed for eleven
days with nothing queued behind it. The date did not depend on anyone remembering
it, which was the entire point of building it.

Why the warning text changed

It described a property the keys no longer have. "Neither can carry traffic while
the other is replaced" was true because both were 36-scope keys shared across
every identity on the seam. The successors serve different consumers with
different scopes, so the next rotation is two independent, routine operations.

The message now says to rotate them separately, carries the create-before-delete
procedure, and test_the_tripwire_actually_fires_inside_the_lead_window asserts
that it does. Leaving the old all-at-once warning in place would have taught the
next operator something false.

The finding this PR exists to preserve

Scope sets derived from source were wrong twice — once by the pipeline-core
seat tracing every SDK call site, once independently from this seat. Appwrite has
split the scope vocabulary into documentsdb.*, tables.*/rows.* and
vectorsdb.*, and what actually authorises appwrite==19.2.0 is the three scopes
the console tags Deprecated. The server named them itself:

401 general_unauthorized_scope  missing scopes (["collections.read"])
401 general_unauthorized_scope  missing scopes (["documents.read"])

views-faoapi's own guard had already written the rule — "That is Appwrite's
contract, not ours, and no local test can establish it — only a live round trip
can" — and their C-282 was the first instance of this exact error.

Create-before-delete made the rediscovery free. The old key carried production
throughout; the cost of being wrong was one console edit.

ADRs requested at views-pipeline-core#572 and views-faoapi#543, because a
scope table recorded without why source analysis cannot produce it will be wrong
again at the next SDK bump.

Also recorded

Shortening LEAD_DAYS from 30 to 7 was attempted during the incident to quiet the
alarm. Measured, it does not clear the check — it reddens
test_the_lead_window_is_not_quietly_shrunk and the firing-path probe instead, so
buying a shorter window costs deleting the two guards that keep the tripwire honest
for the next rotation. The guard did exactly the job its own message describes. The
obvious shortcut is closed, deliberately, and C-110 now says so.

Decisions taken here rather than asked about

• Dates are declared, not read back. Each key was created with a one-year
  expiry, so the date is known; the times are approximate (creation order, an
  hour apart) and the comment says so explicitly. At a 30-day window an hour is
  immaterial, and claiming a console reading we did not take is the failure that
  comment exists to prevent.
• Entry names follow the console, not the old registry labels, so the next
  reader can find them.
• C-110 closed as "resolved by a different remedy than proposed." It asked for
  a runbook in docs/operations/; what exists instead is the rewritten failure
  message. That is arguably the better home — you meet it as a red check, not by
  opening a document — but it is not what the entry proposed, and the entry says so
  rather than claiming the plan was followed.

Residual, deliberately not chased

• files.write / documents.write on pipeline-core-writer are unproven —
  verifying them means writing to the production store. The old key remains
  available until a real producer run exercises them.
• Whether the FAO have adopted faoapi-caller-fao, or still hold only the retired
  shared key, is unconfirmed and tracked at views-faoapi#543.

Tests

526 passed, 3 skipped, 41 xfailed locally. The one local failure is
test_the_installed_runtime_dependencies_match_the_lockfile, which correctly
reports that this run used a borrowed 3.11 conda env rather than the repo's locked
environment — CI uses the locked one.

The register's own integrity guards caught three real mistakes in the first draft
of this change (entries renamed but left under Open Concerns, header counts
stale, and a foreign C-282 reference not namespaced to views-faoapi). All fixed;
test_register_integrity.py is green.

🤖 Generated with Claude Code

https://claude.ai/code/session_01ANY1CCy9Xo7zjMY4XJ69v9