chtypes 2.0.0.dev3__tar.gz → 2.0.0.dev4__tar.gz

{chtypes-2.0.0.dev3 → chtypes-2.0.0.dev4}/CHANGELOG.md

@@ -8,8 +8,17 @@ The four bindings in this repository are released together and give one answer,
 
 ### Added
 
+- The server's filter-declined settings (ABI v2; moves the dev fingerprint): `SchemaServer.filter_declined_settings`, a tuple of `DeclinedSetting` (`name`, `tier`), decoded from `schema_description`'s new required `server.filter_declined_settings`, with the new `DeclinedTier` vocabulary (`PREDICATE`, `PREDICATE_UNFLIPPED`, `RESULT_CONTENT`, and its unknown(n)). `compile_filter` on a schema whose server lists any is the library's `CHS_DECLINED`, an `UnsupportedError` carrying its message; a filter's own settings other than `session_timezone` are no longer declined at compile, and a declined one is named at evaluation instead.
+- The v2 spec states that a filter verdict counts only when the evaluation's outcome is `ok`: over a body a server would not accept, every verdict is `d`.
+- The v2 spec publishes the WHERE-affecting settings lists (`spec/abi-v2/where-settings/`) with the consumer rule.
+- The v2 spec publishes the filter decline-reasons catalog (`spec/abi-v2/declines/`).
+- A `410 Gone` is a retired repository, and permanent (#571). Any request the fetch layer makes (a tag, an alias, a digest, a blob, `tags/list`, the referrers API or its fallback tag, after a redirect too) that answers `410` is now the new code `CHTYPES_SOURCE_RETIRED` (exit status 10), never retried and never sent to the next base, nor from the dev channel's alias to its tag. It was `CHTYPES_SOURCE_UNREACHABLE` (exit 3) with the registry's message dropped, and Go, Python and Rust moved on to the next base, so a mirror's 404 could hide the retirement. The error names the URL that answered and carries the registry's own message, with control and bidirectional-formatting characters removed and cut to 256 code points: Go `CodeSourceRetired` (`errors.Is(err, ErrSourceRetired)`), Python and TypeScript `SourceRetiredError`, Rust `Error::SourceRetired`. The rule is `docs/guides/fetch-v1.md` section 2, "A retired repository", and the `retired-410-*` and `list-tags-retired-410` conformance cases and one shared message table (`tests/fixtures/retired-message/cases.json`) hold all four bindings to it.
 - A 2.0.0-dev SDK prefers the newest build of its own fingerprint (#511). A version request resolves `<tag>--fp-<fingerprint>` first, the alias the staging dev registry serves beside every dev tag, with the binding's own generated ABI fingerprint, and the tag itself only when every base answers the alias 404; any other failure of the alias request is that failure, with no fallback, and an alias whose index lacks the platform is `CHTYPES_ARTIFACT_UNPUBLISHED`. The dev channel's cache lookups (the installed-build lookup a registry open makes first, the offline answer, and the monotonic rule of a fetch) now see only records whose signed `abi_fingerprint` is the SDK's own, so a newer build of another fingerprint, installed by another dev SDK in the shared cache, is never returned or kept over this one's own, and is never removed or rewritten. So a dev build of a newer fingerprint no longer strands an older dev SDK until its consumers upgrade. Trust is unchanged (the signed predicate and the load checks decide), a listing never shows an alias, nothing records one, `list` and `where` are unchanged, and there is no option: both steps are the dev channel's alone, and the v1 contract and every production channel never take them. The rule is `docs/guides/fetch-v1.md` section 3, and the `dev-alias-*`, `resolve-installed-dev-alias-*` and `list-tags-dev-alias` conformance cases hold all four bindings to it.
 
+### Fixed
+
+- A 2.0.0-dev SDK whose fingerprint no published build carries yet now fails closed with a precise message (#578). When every base answers its own alias 404 and the tag names a build signed for another fingerprint, `fetch` is `CHTYPES_ARTIFACT_UNPUBLISHED` (exit status 4): `no published build for this SDK's fingerprint <own fp>; newest published on this channel is <fp> (build <id>)`. It used to install that build, or report it already installed, and the lookup at open then answered `CHTYPES_ARTIFACT_MISSING` with advice to run `fetch`: a loop with no pointer to the cause. Nothing is downloaded or installed and the cache is unchanged. An alias that answers, a tag at the SDK's own fingerprint and the v1 contract are unchanged. All four bindings run the same fetch conformance cases, `fp-ahead-*`, and the rule is `docs/guides/fetch-v1.md` section 3.
+
 ## [1.1.0] — 2026-10-06
 
 ### Added

{chtypes-2.0.0.dev3 → chtypes-2.0.0.dev4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: chtypes
-Version: 2.0.0.dev3
+Version: 2.0.0.dev4
 Summary: Python binding for the chtypes artifacts: ClickHouse's own type system, per version, behind the frozen chs_* C ABI
 Project-URL: Homepage, https://github.com/wave-rf/chtypes
 Project-URL: Repository, https://github.com/wave-rf/chtypes
@@ -22,6 +22,8 @@ Description-Content-Type: text/markdown
 > **2.0.0-dev: UNSTABLE, staging only, not for production.** This is the ABI v2 development binding (public issue #511). It speaks ABI v2's unstable description, pins its dev fingerprint and refuses a library with any other ("update your dev SDK"). It fetches only from the staging dev channel (`https://registry-staging.wavehouse.dev/chtypes/v2-dev`) and trusts only the staging key; `CHTYPES_ARTIFACTS_URL`, `CHTYPES_TRUSTED_KEYS` and `CHTYPES_ALLOW_UNSIGNED`, and the `bases`, `trusted_keys` and `allow_unsigned` fetch options, are ignored, each with one warning; `--lock`, `--frozen` and `--update`, and the `frozen`, `lock_path`, `lock_write` and `update` options, are refused, because a dev build is replaceable and a superseded one expires after 14 days. Its cache is `${XDG_CACHE_HOME:-~/.cache}/chtypes/v2-dev`, or `<CHTYPES_CACHE>/v2-dev` under an explicit cache, which no 1.x SDK reads. A dev SDK prefers the newest build of its own fingerprint: it resolves `<tag>--fp-<its fingerprint>` first and the tag only when no such build exists, and its cache lookups ignore another dev SDK's builds in a shared cache, so a newer dev fingerprint never strands it (§3 of [`docs/guides/fetch-v1.md`](../docs/guides/fetch-v1.md)). Every vocabulary keeps a value it does not list as its `unknown(n)` member (`Outcome("x")`, whose `known` is `False`) instead of failing the document. The rules are r1 to r6 of [`docs/reference/abi-v2.md`](../docs/reference/abi-v2.md). For production, use the 1.x package: `pip install "chtypes<2"`.
 >
 > An explicit cache directory gets the `v2-dev` subroot whether it comes from `CHTYPES_CACHE` or from `FetchOptions(cache_dir=...)`: the layout is under `<cache_dir>/v2-dev`, never in the directory itself, so code that inspects or pre-populates a cache looks there; `chtypes.cache_root` and `chtypes.search_dirs` return the resolved paths. `CHTYPES_OFFLINE=1` is the environment twin of `FetchOptions(offline=True)` and `--offline`: the cache only, no request.
+>
+> <!-- remove-at-v2-lock -->v2-dev builds before the one that carries this contract (its release notice names it) can answer `ok` with `t` verdicts after a refused row. On those builds, when a body or block holds more than one row, treat every verdict as `d` if `errors` is non-empty.<!-- /remove-at-v2-lock -->
 
 **If this row were inserted into this table on this ClickHouse version, what would happen?** chtypes answers with ClickHouse's own code: the real C++ type machinery, vendored per release into a native library behind the frozen `chs_*` C ABI and reached here through stdlib `ctypes`. Nothing semantic is reimplemented, so _"what does ClickHouse do with `256` into a `UInt8`?"_ is answered by ClickHouse rather than by a model of it. One peer binding among `{go, python, ts, rust}` — no language is privileged, and all four give one answer.
 

{chtypes-2.0.0.dev3 → chtypes-2.0.0.dev4}/README.md

@@ -3,6 +3,8 @@
 > **2.0.0-dev: UNSTABLE, staging only, not for production.** This is the ABI v2 development binding (public issue #511). It speaks ABI v2's unstable description, pins its dev fingerprint and refuses a library with any other ("update your dev SDK"). It fetches only from the staging dev channel (`https://registry-staging.wavehouse.dev/chtypes/v2-dev`) and trusts only the staging key; `CHTYPES_ARTIFACTS_URL`, `CHTYPES_TRUSTED_KEYS` and `CHTYPES_ALLOW_UNSIGNED`, and the `bases`, `trusted_keys` and `allow_unsigned` fetch options, are ignored, each with one warning; `--lock`, `--frozen` and `--update`, and the `frozen`, `lock_path`, `lock_write` and `update` options, are refused, because a dev build is replaceable and a superseded one expires after 14 days. Its cache is `${XDG_CACHE_HOME:-~/.cache}/chtypes/v2-dev`, or `<CHTYPES_CACHE>/v2-dev` under an explicit cache, which no 1.x SDK reads. A dev SDK prefers the newest build of its own fingerprint: it resolves `<tag>--fp-<its fingerprint>` first and the tag only when no such build exists, and its cache lookups ignore another dev SDK's builds in a shared cache, so a newer dev fingerprint never strands it (§3 of [`docs/guides/fetch-v1.md`](../docs/guides/fetch-v1.md)). Every vocabulary keeps a value it does not list as its `unknown(n)` member (`Outcome("x")`, whose `known` is `False`) instead of failing the document. The rules are r1 to r6 of [`docs/reference/abi-v2.md`](../docs/reference/abi-v2.md). For production, use the 1.x package: `pip install "chtypes<2"`.
 >
 > An explicit cache directory gets the `v2-dev` subroot whether it comes from `CHTYPES_CACHE` or from `FetchOptions(cache_dir=...)`: the layout is under `<cache_dir>/v2-dev`, never in the directory itself, so code that inspects or pre-populates a cache looks there; `chtypes.cache_root` and `chtypes.search_dirs` return the resolved paths. `CHTYPES_OFFLINE=1` is the environment twin of `FetchOptions(offline=True)` and `--offline`: the cache only, no request.
+>
+> <!-- remove-at-v2-lock -->v2-dev builds before the one that carries this contract (its release notice names it) can answer `ok` with `t` verdicts after a refused row. On those builds, when a body or block holds more than one row, treat every verdict as `d` if `errors` is non-empty.<!-- /remove-at-v2-lock -->
 
 **If this row were inserted into this table on this ClickHouse version, what would happen?** chtypes answers with ClickHouse's own code: the real C++ type machinery, vendored per release into a native library behind the frozen `chs_*` C ABI and reached here through stdlib `ctypes`. Nothing semantic is reimplemented, so _"what does ClickHouse do with `256` into a `UInt8`?"_ is answered by ClickHouse rather than by a model of it. One peer binding among `{go, python, ts, rust}` — no language is privileged, and all four give one answer.
 

{chtypes-2.0.0.dev3 → chtypes-2.0.0.dev4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "chtypes"
-version = "2.0.0.dev3"
+version = "2.0.0.dev4"
 description = "Python binding for the chtypes artifacts: ClickHouse's own type system, per version, behind the frozen chs_* C ABI"
 readme = "README.md"
 license = "Apache-2.0"

{chtypes-2.0.0.dev3 → chtypes-2.0.0.dev4}/src/chtypes/__init__.py

@@ -48,6 +48,7 @@ from importlib.metadata import version as _package_version
 
 from ._abi2._vocab import (
     EXPORT_NONE,
+    DeclinedTier,
     DefaultKind,
     DiscoverQueryParam,
     DocFlags,
@@ -72,6 +73,7 @@ from .errors import (
     CODE_CACHE_UNUSABLE,
     CODE_SOURCE_FORBIDDEN,
     CODE_SOURCE_INCOMPATIBLE,
+    CODE_SOURCE_RETIRED,
     CODE_SOURCE_UNAUTHORIZED,
     CODE_SOURCE_UNREACHABLE,
     ArtifactCorruptError,
@@ -88,6 +90,7 @@ from .errors import (
     SchemaError,
     SourceForbiddenError,
     SourceIncompatibleError,
+    SourceRetiredError,
     SourceUnauthorizedError,
     SourceUnreachableError,
     UnsupportedError,
@@ -102,6 +105,7 @@ from .results import (
     Capabilities,
     Column,
     Computed,
+    DeclinedSetting,
     DiscoveredColumn,
     Discovery,
     EngineCell,
@@ -130,6 +134,7 @@ __all__ = [
     "CODE_CACHE_UNUSABLE",
     "CODE_SOURCE_FORBIDDEN",
     "CODE_SOURCE_INCOMPATIBLE",
+    "CODE_SOURCE_RETIRED",
     "CODE_SOURCE_UNAUTHORIZED",
     "CODE_SOURCE_UNREACHABLE",
     "EXPORT_NONE",
@@ -151,6 +156,8 @@ __all__ = [
     "ChtypesError",
     "Column",
     "Computed",
+    "DeclinedSetting",
+    "DeclinedTier",
     "DefaultKind",
     "DiscoverQueryParam",
     "DiscoveredColumn",
@@ -186,6 +193,7 @@ __all__ = [
     "Source",
     "SourceForbiddenError",
     "SourceIncompatibleError",
+    "SourceRetiredError",
     "SourceUnauthorizedError",
     "SourceUnreachableError",
     "Span",

{chtypes-2.0.0.dev3 → chtypes-2.0.0.dev4}/src/chtypes/_abi2/_decls.py

@@ -1,4 +1,4 @@
-# GENERATED by scripts/abi-v1/gen.py --major 2 from spec/abi-v2/abi.json (CHS_ABI_FINGERPRINT sha256:4129dccc3f4e698dedb0e99cae413f5240085f633c5a1244e2c55bf7a7bb6c3a) — DO NOT EDIT  # noqa: E501
+# GENERATED by scripts/abi-v1/gen.py --major 2 from spec/abi-v2/abi.json (CHS_ABI_FINGERPRINT sha256:28c7445ce6b5c6d0ae33177fd60eb7b3b5654a966c842b8d812aea622824dc72) — DO NOT EDIT  # noqa: E501
 """The Python binding's generated ABI v2 layer: ctypes signatures, the handle
 classes, the two-phase resolve functions and invoke_by_name(), the test-only
 dispatcher the conformance suite drives from tests/fixtures/abi-v2/cases.json.
@@ -19,7 +19,7 @@ from dataclasses import dataclass, field
 from . import _errmap
 
 CHS_ABI_VERSION = 2
-CHS_ABI_FINGERPRINT = "sha256:4129dccc3f4e698dedb0e99cae413f5240085f633c5a1244e2c55bf7a7bb6c3a"
+CHS_ABI_FINGERPRINT = "sha256:28c7445ce6b5c6d0ae33177fd60eb7b3b5654a966c842b8d812aea622824dc72"
 
 # The description's stability: "unstable" while this generation is being
 # designed, so CHS_ABI_FINGERPRINT moves with every change, and "locked" after

{chtypes-2.0.0.dev3 → chtypes-2.0.0.dev4}/src/chtypes/_abi2/_errmap.py

@@ -1,4 +1,4 @@
-# GENERATED by scripts/abi-v1/gen.py --major 2 from spec/abi-v2/abi.json (CHS_ABI_FINGERPRINT sha256:4129dccc3f4e698dedb0e99cae413f5240085f633c5a1244e2c55bf7a7bb6c3a) — DO NOT EDIT  # noqa: E501
+# GENERATED by scripts/abi-v1/gen.py --major 2 from spec/abi-v2/abi.json (CHS_ABI_FINGERPRINT sha256:28c7445ce6b5c6d0ae33177fd60eb7b3b5654a966c842b8d812aea622824dc72) — DO NOT EDIT  # noqa: E501
 """spec/abi-v2/sdk.json's error-mapping tables, as references to the
 public classes (python/src/chtypes/errors.py, re-exported by
 python/src/chtypes/_abi2/_errors.py). Only the MAPPING is generated: the

{chtypes-2.0.0.dev3 → chtypes-2.0.0.dev4}/src/chtypes/_abi2/_vocab.py

@@ -1,10 +1,10 @@
-# GENERATED by scripts/abi-v1/gen.py --major 2 from spec/abi-v2/abi.json (CHS_ABI_FINGERPRINT sha256:4129dccc3f4e698dedb0e99cae413f5240085f633c5a1244e2c55bf7a7bb6c3a) — DO NOT EDIT  # noqa: E501
+# GENERATED by scripts/abi-v1/gen.py --major 2 from spec/abi-v2/abi.json (CHS_ABI_FINGERPRINT sha256:28c7445ce6b5c6d0ae33177fd60eb7b3b5654a966c842b8d812aea622824dc72) — DO NOT EDIT  # noqa: E501
 """The Python binding's generated vocabularies, from spec/abi-v2/abi.json: the C
 enums (`Format`, `Status`), the document vocabularies (`Outcome`, `FilterOutcome`,
-`Verdict`, `DefaultKind`, `MergeReason`, `Reason`, `Source`, `DiscoverQueryParam`) with the
-facts the description attaches to each value (`Format.ch_name`, `Reason` lossy,
-`Source` is_stored, `Verdict.answered`), and the `DocFlags` groups. No other file in
-this package keeps a copy of any of it.
+`Verdict`, `DefaultKind`, `MergeReason`, `DeclinedTier`, `Reason`, `Source`,
+`DiscoverQueryParam`) with the facts the description attaches to each value
+(`Format.ch_name`, `Reason` lossy, `Source` is_stored, `Verdict.answered`), and the
+`DocFlags` groups. No other file in this package keeps a copy of any of it.
 
 Rule r3 (spec/abi-v2/docs.md): every vocabulary has an unknown(n) member, and a
 value the description does not list reads as it, carrying the raw value, for that
@@ -249,6 +249,31 @@ class MergeReason(StrEnum):
         return cls(text)
 
 
+class DeclinedTier(StrEnum):
+    """The WHERE-settings tier of a setting a server profile sets and this build's
+    filters do not honor in a WHERE, as a `DeclinedSetting` reports it."""
+
+    PREDICATE = "predicate"
+    PREDICATE_UNFLIPPED = "predicate-unflipped"
+    RESULT_CONTENT = "result-content"
+
+    @classmethod
+    def _missing_(cls, value: object) -> DeclinedTier | None:
+        return _unknown_str(cls, value)
+
+    @property
+    def known(self) -> bool:
+        """Whether the description lists this value: False for exactly the unknown(n)
+        member an unlisted value reads as (rule r3)."""
+        return type(self)._value2member_map_.get(self._value_) is self
+
+    @classmethod
+    def of(cls, text: str) -> DeclinedTier:
+        """Map a document's spelling. One the description does not list is kept as
+        this vocabulary's unknown(n) member, carrying it (rule r3)."""
+        return cls(text)
+
+
 class DiscoverQueryParam(StrEnum):
     """A query parameter of the SQL `discover_query` returns, which the caller binds
     when it runs the query."""
@@ -415,6 +440,7 @@ DESCRIBED_VOCABULARIES: Final[dict[str, type]] = {
     "filter_verdict": Verdict,
     "discover_query_param": DiscoverQueryParam,
     "default_kind": DefaultKind,
+    "declined_tier": DeclinedTier,
 }
 
 

{chtypes-2.0.0.dev3 → chtypes-2.0.0.dev4}/src/chtypes/_decode.py

@@ -28,7 +28,16 @@ import json
 from collections.abc import Callable, Mapping
 from typing import Any
 
-from ._abi2._vocab import DefaultKind, FilterOutcome, MergeReason, Outcome, Reason, Source, Verdict
+from ._abi2._vocab import (
+    DeclinedTier,
+    DefaultKind,
+    FilterOutcome,
+    MergeReason,
+    Outcome,
+    Reason,
+    Source,
+    Verdict,
+)
 from .errors import ArtifactCorruptError, internal
 from .results import (
     AtMergeEntry,
@@ -37,6 +46,7 @@ from .results import (
     Capabilities,
     Column,
     Computed,
+    DeclinedSetting,
     DiscoveredColumn,
     Discovery,
     EngineCell,
@@ -493,11 +503,22 @@ def _string_map(obj: Mapping[str, Any], key: str, where: str) -> dict[str, str]
     return out
 
 
+def _declined_setting(obj: dict[str, Any], where: str) -> DeclinedSetting:
+    # An unlisted tier is its unknown(n): kept, never a failure (rule r3).
+    return DeclinedSetting(
+        name=_name(obj, "name", where),
+        tier=DeclinedTier.of(_text(obj, "tier", where)),
+    )
+
+
 def _server(obj: dict[str, Any], where: str) -> SchemaServer:
     return SchemaServer(
         timezone=_text(obj, "timezone", where),
         settings=_string_map(obj, "settings", where) or {},
         macros=_string_map(obj, "macros", where),
+        filter_declined_settings=_objects(
+            obj, "filter_declined_settings", where, _declined_setting
+        ),
     )
 
 

{chtypes-2.0.0.dev3 → chtypes-2.0.0.dev4}/src/chtypes/_ocifetch/_channel.py

@@ -52,6 +52,7 @@ from typing import Final, Protocol
 from chtypes._abi2._decls import CHS_ABI_FINGERPRINT
 from chtypes._ocifetch import _constants as C
 from chtypes._ocifetch._dsse import TrustedKey
+from chtypes._ocifetch._errors import ArtifactUnpublishedError
 
 __all__ = [
     "ALIAS_SEPARATOR",
@@ -66,6 +67,7 @@ __all__ = [
     "PinningRefusedError",
     "abi",
     "active",
+    "ahead_of_registry",
     "alias_tag",
     "allow_overrides_for_tests",
     "channel_name",
@@ -274,6 +276,43 @@ def visible(predicate: object, channel: Channel | None = None) -> bool:
     return fingerprint == f"sha256:{channel.own_fingerprint}"
 
 
+def ahead_of_registry(
+    alias_absent: bool, predicate: object, channel: Channel | None = None
+) -> None:
+    """The dev channel's answer for an SDK whose fingerprint no published build
+    carries yet (docs/guides/fetch-v1.md §3; public issue #578): when every base
+    answered its own alias 404 (`alias_absent`) and the build the tag names is
+    signed for another fingerprint (`predicate`, the SIGNED predicate, the field
+    `visible` keys on), raise `ArtifactUnpublishedError`, the code a request no
+    build answers gets, naming both fingerprints. Nothing is installed and an
+    install of that build is never reported, because the lookup this SDK opens
+    through would refuse it. Returns in every other case: the alias answered,
+    the tag's build is this SDK's own, or the contract has no own fingerprint."""
+    channel = channel or active()
+    if not alias_absent or visible(predicate, channel):
+        return
+    raise ArtifactUnpublishedError(f"chtypes: {_ahead_message(channel.own_fingerprint, predicate)}")
+
+
+def _ahead_message(own: str, predicate: object) -> str:
+    """`ahead_of_registry`'s message: "no published build for this SDK's
+    fingerprint <own>; newest published on this channel is <fp> (build <id>)",
+    each fingerprint 64 lowercase hex without its `sha256:` prefix, the
+    parenthesis dropped when the predicate names no build, and "unnamed" for a
+    predicate that names no fingerprint."""
+    fields = predicate if isinstance(predicate, dict) else {}
+    theirs = fields.get("abi_fingerprint")
+    theirs = theirs.removeprefix("sha256:") if isinstance(theirs, str) else ""
+    message = (
+        f"no published build for this SDK's fingerprint {own}; "
+        f"newest published on this channel is {theirs or 'unnamed'}"
+    )
+    build = fields.get("build")
+    if isinstance(build, str) and build:
+        message += f" (build {build})"
+    return message
+
+
 def use_dev_channel_for_tests() -> Callable[[], None]:
     """Make this TEST run speak the dev channel exactly as a user's process does
     (undoing either function above, for a test of the dev channel itself).

{chtypes-2.0.0.dev3 → chtypes-2.0.0.dev4}/src/chtypes/_ocifetch/_constants.py

@@ -1,6 +1,6 @@
 # Code generated by scripts/fetch-v1/gen-constants.py from
 # spec/fetch-v1/constants.json. DO NOT EDIT.
-# Source sha256: 163dbaa1e5173aa65de7d46f1eac27c02f862e96b5c8160a23fee8cfabd77a2a
+# Source sha256: 4554956faeb154fc324a6120b7b35976222c6bc8ecbce7fd0147502e3073611d
 """The v1 fetch constants, generated: see docs/guides/fetch-v1.md."""
 
 from __future__ import annotations
@@ -83,6 +83,7 @@ RETRY_AFTER_STATUSES: Final[tuple[int, ...]] = (429, 503)
 RETRY_AFTER_OVER_BUDGET: Final[str] = "refuse"
 DIGEST_404_POLICY: Final[str] = "next_base_then_retry_on_last"
 TAG_404_POLICY: Final[str] = "next_base_then_unpublished"
+RETIRED_STATUSES: Final[tuple[int, ...]] = (410,)
 
 CONNECT_TIMEOUT_S: Final[float] = 30.0
 IDLE_READ_TIMEOUT_S: Final[float] = 60.0
@@ -95,6 +96,8 @@ MAX_REFERRERS: Final[int] = 16
 MAX_REDIRECTS: Final[int] = 5
 MAX_UNPACKED_BYTES: Final[int] = 4294967296
 ZSTD_WINDOW_LOG_MAX: Final[int] = 27
+RETIRED_BODY_MAX_BYTES: Final[int] = 65536
+RETIRED_MESSAGE_MAX_CODE_POINTS: Final[int] = 256
 
 CACHE_ROOT_TEMPLATE: Final[str] = "${XDG_CACHE_HOME:-$HOME/.cache}/chtypes/v1"
 SYSTEM_CACHE_DIRS: Final[tuple[str, ...]] = ("/usr/local/share/chtypes/v1", "/opt/chtypes/v1")
@@ -122,4 +125,5 @@ ERROR_EXIT_CODES: Final[dict[str, int]] = {
     "CHTYPES_SOURCE_INCOMPATIBLE": 7,
     "CHTYPES_ARTIFACT_INCOMPATIBLE": 8,
     "CHTYPES_CACHE_UNUSABLE": 9,
+    "CHTYPES_SOURCE_RETIRED": 10,
 }

{chtypes-2.0.0.dev3 → chtypes-2.0.0.dev4}/src/chtypes/_ocifetch/_ensure.py

@@ -38,6 +38,7 @@ from chtypes._ocifetch._errors import (
     ArtifactUntrustedError,
     FetchError,
     SourceForbiddenError,
+    SourceRetiredError,
     SourceUnauthorizedError,
     SourceUnreachableError,
 )
@@ -49,6 +50,7 @@ from chtypes._ocifetch._http import (
     ForbiddenHttpError,
     NotFoundHttpError,
     OversizeHttpError,
+    RetiredHttpError,
     RetryPolicy,
     TransportError,
     UnauthorizedHttpError,
@@ -440,7 +442,7 @@ def _find_verified_signature(
                 bases, ref.digest, policy=policy, retry=retry
             )
             blob_desc = manifest_single_layer(referrer_doc, expected_media_type=C.MEDIA_TYPE_BUNDLE)
-        except ArtifactCorruptError:
+        except (ArtifactCorruptError, RetiredHttpError):
             raise
         except (TransportError, FetchError):
             continue
@@ -458,7 +460,7 @@ def _find_verified_signature(
             with open(bundle_path, "rb") as f:
                 bundle_json = json.loads(f.read())
             verified = verify_bundle(bundle_json, trusted_keys)
-        except ArtifactCorruptError:
+        except (ArtifactCorruptError, RetiredHttpError):
             raise
         except (TransportError, FetchError, json.JSONDecodeError):
             continue
@@ -698,7 +700,7 @@ def _ensure_floating(
     cache_root_path = roots[0]
     scratch_root = _scratch_root(cache_root_path)
 
-    index_doc, index_bytes, index_digest = fetch_manifest_by_tag(
+    index_doc, index_bytes, index_digest, alias_absent = fetch_manifest_by_tag(
         bases,
         request.spelling,
         policy=policy,
@@ -711,6 +713,10 @@ def _ensure_floating(
     existing_dir = unpacked_dir_for(cache_root_path, manifest_hex)
     existing_record = read_verified_record(existing_dir)
     if existing_record is not None and existing_record.platform == platform_key:
+        # An install of another fingerprint's build, reached through the tag
+        # because the registry has none at this SDK's own, is never reported
+        # installed (public issue #578): refused before the cache is touched.
+        _channel.ahead_of_registry(alias_absent, existing_record.predicate)
         # A NEWER build within the request, installed beside it, is still the
         # answer ("monotonic-warning", docs/guides/fetch-v1.md §9).
         newer = _newer_installed(
@@ -801,6 +807,12 @@ def _ensure_floating(
         signed_by = verified.signed_by
 
     _check_predicate_matches_request(predicate, platform_key, request.spelling)
+    if found is not None:
+        # An SDK ahead of the registry (public issue #578): the alias for its
+        # own fingerprint answered 404 on every base, and the tag's build is
+        # signed for another. Refused from the signed statement, before the
+        # layer is requested, so nothing is downloaded or installed.
+        _channel.ahead_of_registry(alias_absent, predicate)
     newer = _newer_installed(roots, platform_key, predicate, request.spelling)
     if newer is not None:
         newer_dir, newer_record, warning = newer
@@ -983,6 +995,8 @@ def _translate_transport_error(e: TransportError) -> FetchError:
         return SourceForbiddenError(f"chtypes: {e}")
     if isinstance(e, OversizeHttpError):
         return ArtifactCorruptError(f"chtypes: {e}")
+    if isinstance(e, RetiredHttpError):
+        return SourceRetiredError(f"chtypes: {e}")
     if isinstance(e, UnreachableHttpError):
         return SourceUnreachableError(f"chtypes: {e}", retryable=getattr(e, "retryable", True))
     return SourceUnreachableError(f"chtypes: {e}")
@@ -1368,7 +1382,9 @@ def _fetch_signed_impl(repository: str, ref: str, predicate_type: str, options:
         doc, _raw = fetch_manifest_by_digest(bases, ref, policy=policy, retry=retry)
         manifest_digest = ref
     else:
-        doc, _raw, manifest_digest = fetch_manifest_by_tag(bases, ref, policy=policy, retry=retry)
+        doc, _raw, manifest_digest, _alias_absent = fetch_manifest_by_tag(
+            bases, ref, policy=policy, retry=retry
+        )
 
     layer_desc = manifest_single_layer(doc)
     found = _find_verified_signature(
@@ -1466,6 +1482,8 @@ def _fetch_goldens(
                     retry=retry,
                     max_bytes=C.MAX_UNPACKED_BYTES,
                 )
+            except RetiredHttpError:
+                raise
             except (TransportError, FetchError) as e:
                 first_failure = first_failure or e
                 continue
@@ -1580,6 +1598,8 @@ def _verify_goldens_signature(
         except ArtifactCorruptError as e:
             failure = failure or e
             continue
+        except RetiredHttpError:
+            raise
         except (TransportError, FetchError, json.JSONDecodeError):
             continue
         finally:

{chtypes-2.0.0.dev3 → chtypes-2.0.0.dev4}/src/chtypes/_ocifetch/_errors.py

@@ -5,7 +5,7 @@ Scoped to `chtypes._ocifetch`: the stable, public exception types live in
 imports from or edits. A future switch lane decides how (or whether) these
 become public types; until then every name here is private.
 
-Every exception carries a `.code` string from one of the eleven codes
+Every exception carries a `.code` string from one of the twelve codes
 `spec/fetch-v1/constants.json`'s `errors` map assigns an exit status to
 (the generated `ERROR_EXIT_CODES` table), so a CLI added later needs no
 second mapping — it is the same lookup v0's `__main__.py` does today.
@@ -30,6 +30,7 @@ __all__ = [
     "CODE_CACHE_UNUSABLE",
     "CODE_SOURCE_FORBIDDEN",
     "CODE_SOURCE_INCOMPATIBLE",
+    "CODE_SOURCE_RETIRED",
     "CODE_SOURCE_UNAUTHORIZED",
     "CODE_SOURCE_UNREACHABLE",
     "ArtifactCorruptError",
@@ -41,6 +42,7 @@ __all__ = [
     "FetchError",
     "SourceForbiddenError",
     "SourceIncompatibleError",
+    "SourceRetiredError",
     "SourceUnauthorizedError",
     "SourceUnreachableError",
 ]
@@ -55,6 +57,7 @@ CODE_SOURCE_UNAUTHORIZED = "CHTYPES_SOURCE_UNAUTHORIZED"
 CODE_SOURCE_FORBIDDEN = "CHTYPES_SOURCE_FORBIDDEN"
 CODE_SOURCE_INCOMPATIBLE = "CHTYPES_SOURCE_INCOMPATIBLE"
 CODE_CACHE_UNUSABLE = "CHTYPES_CACHE_UNUSABLE"
+CODE_SOURCE_RETIRED = "CHTYPES_SOURCE_RETIRED"
 
 _CODES_USED_HERE = (
     CODE_ARTIFACT_MISSING,
@@ -67,6 +70,7 @@ _CODES_USED_HERE = (
     CODE_SOURCE_FORBIDDEN,
     CODE_SOURCE_INCOMPATIBLE,
     CODE_CACHE_UNUSABLE,
+    CODE_SOURCE_RETIRED,
 )
 
 # A drift guard, cheaper than a test: every code this module raises must be
@@ -187,3 +191,13 @@ class CacheUnusableError(FetchError):
         self.path = path
         self.reason = reason
         self.os_error = os_error
+
+
+class SourceRetiredError(FetchError):
+    """The source answered 410 Gone: a retired repository, which is permanent,
+    so the request was never retried and never sent to the next base
+    (docs/guides/fetch-v1.md §2, "A retired repository"; public issue #571).
+    The message names the URL that answered and carries the registry's own
+    message, made safe to print."""
+
+    code = CODE_SOURCE_RETIRED

{chtypes-2.0.0.dev3 → chtypes-2.0.0.dev4}/src/chtypes/_ocifetch/_http.py

@@ -29,6 +29,7 @@ from email.utils import parsedate_to_datetime
 from urllib.parse import urljoin, urlsplit, urlunsplit
 
 from chtypes._ocifetch import _constants as C
+from chtypes._ocifetch._retired import retired_text
 
 __all__ = [
     "USER_AGENT",
@@ -38,6 +39,7 @@ __all__ = [
     "HttpResponse",
     "NotFoundHttpError",
     "OversizeHttpError",
+    "RetiredHttpError",
     "RetryPolicy",
     "TransportError",
     "UnauthorizedHttpError",
@@ -120,6 +122,13 @@ class OversizeHttpError(TransportError):
     """A response body exceeded the caller's declared size cap."""
 
 
+class RetiredHttpError(TransportError):
+    """A retired repository (`RETIRED_STATUSES`, a 410; docs/guides/fetch-v1.md
+    §2): permanent, so never retried and never a reason to try the next base.
+    Its text names the URL that answered and carries the registry's message,
+    made safe to print (`_retired.retired_message`)."""
+
+
 class Clock:
     """The real wall clock. Tests inject a fake with the same interface so
     retry cases run instantly and sleeps are asserted exactly."""
@@ -228,7 +237,16 @@ def _single_request(
             )
     except urllib.error.HTTPError as e:
         try:
-            body = _read_capped(e, max_bytes) if e.code not in _REDIRECT_CODES else b""
+            if e.code in C.RETIRED_STATUSES:
+                # Only the registry's message is wanted from a retired
+                # repository's answer: at most RETIRED_BODY_MAX_BYTES of it,
+                # and a body that fails part way is no body.
+                try:
+                    body = e.read(C.RETIRED_BODY_MAX_BYTES)
+                except (OSError, ValueError, AttributeError):
+                    body = b""
+            else:
+                body = _read_capped(e, max_bytes) if e.code not in _REDIRECT_CODES else b""
         finally:
             e.close()
         return HttpResponse(status=e.code, headers=dict(e.headers or {}), body=body, url=url)
@@ -380,6 +398,11 @@ def _http_get_once(
             headers.pop("Authorization", None)
             continue
 
+        if resp.status in C.RETIRED_STATUSES:
+            # A retired repository: permanent, never retried, and the
+            # exception ends fetch_from_bases's loop over bases.
+            raise RetiredHttpError(retired_text(current_url, resp.status, resp.body))
+
         if resp.status == 401:
             if not tried_anon_flow and not policy.token:
                 challenge = resp.headers.get("WWW-Authenticate") or resp.headers.get(
@@ -523,6 +546,10 @@ def fetch_from_bases(
     404, some unreachable — the outcome follows the LAST base tried, since
     bases are an explicit preference order and the last one is the final
     word a caller configured.
+
+    In every mode a retired repository (`RetiredHttpError`, a 410) ends the
+    loop on the base that answered it: it is permanent, never a reason to try
+    the next base, and in `alias` mode never a reason to fall back to the tag.
     """
     if not bases:
         raise UnreachableHttpError("no base URLs configured")

{chtypes-2.0.0.dev3 → chtypes-2.0.0.dev4}/src/chtypes/_ocifetch/_oci.py

@@ -249,15 +249,19 @@ def fetch_manifest_by_tag(
     retry: RetryPolicy,
     max_bytes: int = C.MANIFEST_MAX_BYTES,
     alias: str | None = None,
-) -> tuple[dict, bytes, str]:
-    """GET manifests/<tag>; returns (doc, raw_bytes, resolved_digest).
+) -> tuple[dict, bytes, str, bool]:
+    """GET manifests/<tag>; returns (doc, raw_bytes, resolved_digest, alias_absent).
 
     With `alias` (the dev channel's `<tag>--fp-<fingerprint>`, from
     `_channel.alias_tag`), GET manifests/<alias> first, and the tag only when
     every base answered the alias 404 (docs/guides/fetch-v1.md §3); any other
     failure of the alias request is raised as it is. What is returned is then
-    trusted exactly as the tag's own answer would be."""
+    trusted exactly as the tag's own answer would be. `alias_absent` reports
+    that fallback: the alias was asked for and every base answered it 404, so
+    the registry has no build at this SDK's fingerprint, and the build the tag
+    names is checked against it (`_channel.ahead_of_registry`)."""
     accept = (C.MEDIA_TYPE_INDEX, C.MEDIA_TYPE_MANIFEST)
+    alias_absent = False
     if alias is not None:
         try:
             doc, resp = get_json(
@@ -270,9 +274,9 @@ def fetch_manifest_by_tag(
                 retry=retry,
             )
         except AliasNotFoundError:
-            pass
+            alias_absent = True
         else:
-            return doc, resp.body, f"sha256:{hashlib.sha256(resp.body).hexdigest()}"
+            return doc, resp.body, f"sha256:{hashlib.sha256(resp.body).hexdigest()}", False
     doc, resp = get_json(
         bases,
         f"/manifests/{tag}",
@@ -283,7 +287,7 @@ def fetch_manifest_by_tag(
         retry=retry,
     )
     digest = f"sha256:{hashlib.sha256(resp.body).hexdigest()}"
-    return doc, resp.body, digest
+    return doc, resp.body, digest, alias_absent
 
 
 def fetch_blob_to_path(