fix: lock leftover auto-backend surfaces to fail-closed Rust

[cursor]

Scope

Prefer this PR over #945 and #833. Do not merge those in parallel.

#945 locked README Install, CLAUDE.md, commercial Supported Product Surface, and PRD/TRD/ADR-0002 auto sentences. A purchaser could still be told that auto falls back to NumPy in the same README CLI section, fast-mlsirm fit --help, public FitConfig comments, and commercial Operational Notes. The #945 tests locked exact phrases and never imported resolve_backend.

This successor keeps the #833/#945 runtime-contract TOML lock and closes those leftover buyer-facing surfaces. The auto fail-closed error now names the next action without reflecting local paths or ABI details.

What a purchaser should do

1. Install a wheel or editable build that compiles fast_mlsirm._core.
2. Keep FitConfig(backend="auto") or fast-mlsirm fit --backend auto for production; both fail closed if the Rust core is missing.
3. Pass backend="numpy" or --backend numpy only when you want the explicit reference/parity path.

Machine-readable contract (unchanged)

[runtime_contract]
requires_python = ">=3.12"
auto_backend = "rust_required"
numpy_role = "reference_parity_only"

Verification

Contract tests now import resolve_backend, scan README/CLI/FitConfig/commercial surfaces for the leftover stale claims, and assert fit --help plus the auto error name the next action.

Advances #621. No formula, estimator, or dependency changes.

  

[cursor]

Verdict

COMMENT only. Do not merge #946 while these leftover purchaser surfaces still treat Rust as optional or treat NumPy as a valid auto outcome. Do not self-approve.

#946 correctly locked README install/CLI copy, fit --help, FitConfig comments, commercial Operational Notes, and the fail-closed auto error. That slice is sound. The same purchaser walk can still be told the opposite contract in four places that this head does not lock:

1. docs/buyer_demo_storyboard.md still says NumPy is the reference backend and Rust/PyO3 is optional acceleration.
2. README repository layout still calls crates/fast-mlsirm-py the optional Rust backend.
3. scripts/release_acceptance.py still accepts numpy as a recorded fit --backend auto owner.
4. scripts/sales_readiness.py --check-import help still says it imports an optional Rust core.

A buyer running the demo or acceptance packet can therefore still conclude that production auto may be NumPy.

Next action

Prefer the successor on cursor/bc-9ea40d9c-829d-4fd3-8383-f346575fc77f-51c7 (495f9565) over this head. That commit fails the four surfaces closed and locks them in tests/test_claude_runtime_contract.py plus behavioral release-acceptance tests. Local evidence on that tip: 52 passed for tests/test_claude_runtime_contract.py tests/test_backend.py tests/test_config.py tests/test_release_acceptance_subprocess_deadlines.py.

Do not merge #945 in parallel. Do not open a fifth competing runtime-contract PR once the successor is the landing vehicle. Control-hardening PRs stay independent.

Hosted exact-head CI/security/package/coverage on the successor is still required before Ready. This review is not an approval.

  

_{Sent by Cursor Automation: Fix Issues}

[seonghobae]

Superseded by #951. The #951 head 495f956509645d05e8d5e84b3a4cfc50d28af697 is a strict descendant of this exact head cf670a3557293d8776fdc7c9dc6677d55c23dc35 (ahead 1, behind 0) and incorporates the current review finding for the four remaining buyer/release surfaces plus regressions. Closing this predecessor unmerged avoids parallel runtime-contract landing vehicles; exact-head hosted evidence is being recomputed on #951.