build(deps): the frames extra admits views-frames 2.x (>=1.10.2,<3), measured on both majors (#91)

[Polichinel]

#91 · Epic #66 follow-up. The frames extra admits views-frames 2.x: >=1.10.2,<3, was <2. Ships as 2.1.0 (MINOR) in a release PR after this one.

Why

views-frames 2.0.0 has been published since 2026-08-18; our cap excluded it from every environment that requests the extra. Reported by views-pipeline-core's 3.3.0 range review.

The report's premise was wrong, and this PR says so. #91 claimed our cap was the only thing holding reporting environments on 1.x. Verified by grep on 2026-09-19: views-reporting declares its own direct views-frames>=1.10.2,<2.0.0 on every branch and at v0.3.3. Widening our extra admits nothing there until they widen theirs. The change is still right, since our cap should not exist, and every note now states only this repo's contract.

Measured before widening

Check	Result
Full suite on views-frames 1.10.2 (existing env)	green
Full suite on views-frames 1.11.0 (review, fresh env)	green
Full suite on views-frames 2.0.0 (fresh venv)	green, 999 with this PR's tests
MetricFrame saved under 1.10.2 → loaded under 2.0.0, and the reverse	identical rows, metrics, values; timestamp stays int

Safe because the package's only runtime import from views-frames is the FrameMetadata dataclass; the tests' second dependency, assert_frame_envelope, has an unchanged body across the majors.

Guards

• TestViewsFramesRange (in the extras-guard module, which never import-skips): declared range as a SpecifierSet under either pyproject layout; the CI floor step derives the floor from pyproject, carries no version literal, and runs the whole suite; the one-name import surface by AST, aliased and dotted imports included.
• TestViewsFramesSurface: FrameMetadata's behaviour on the installed major (six keyword fields, to_dict omitting None, from_dict ignoring the keys load() passes through, int timestamp preserved) and the installed version inside the declared range.
• CI: the verify step prints the resolved views-frames and asserts it is not the floor major; a new step runs pytest tests/ on the floor read from pyproject, with no trailing reinstall.

Review findings addressed (15 of 15 from /code-review max, 1 from /review-diff)

False premise (above) · behavioural test did not exercise what load() relies on · AST guard blind to import views_frames as vf · CIC named one surface while documenting two · CI could silently test 1.x on both legs · C-38 trigger fired only on narrowing (widened; ADR-022 §7 gains a stale-cap checklist line) · C-41 stale range · floor coupling scanned comments and one of two literals (floor now derived, no literal) · hand-picked floor subset (whole suite) · major in (1, 2) (SpecifierSet) · poetry-only dict equality (either layout) · static pins behind the import-skip (moved) · dead trailing reinstall (removed) · stale "994" count (dropped) · register date · (review-diff) floor literal in three places.

C-37 evidence

Seen red: held text on the edited workflow before regeneration; range widened to <4; a second name imported from views_frames, via from, via alias attribute, via dotted submodule import; a version literal in the floor step; a subset in place of the whole suite; a mismatched CI floor. Must-pass variants confirmed: reordered specifier, PEP 621 layout.

Independent guard audit (/falsify guard, clean-context subagent): 45 mutations over 8 guards; nothing decorative; survivors on four guards, all closed and re-verified red: the specifier helper read the poetry table before a PEP 621 table (now PEP 621 first, matching _extras_table and poetry); an environment marker on the entry passed (now rejected); FrameMetadata.to_dict dropping falsy values passed (now seed=0/timestamp=0 round-trip); getattr(views_frames, "X") and _vf = views_frames; _vf.X escaped the AST guard (now tracked); the floor-step check accepted FLOOR=1.10.2 with an echo, a derivation from the numpy key, -k, || true (now exact commands and a keyed derivation). The CI derivation reads both layouts and strips whitespace. Residual: import machinery on views_frames is caught by the package-wide purity guard, not by this one.

Gate

999 passed on views-frames 1.10.2 and on 2.0.0 · ruff clean · validate_docs.sh passed.

🤖 Generated with Claude Code