mostlyright-data 0.9.0__py3-none-any.whl

mostlyright/data_harness/acquisition/http.py

@@ -0,0 +1,2773 @@
+"""Pinned-peer HTTPS retrieval with redirect and resource bounds."""
+
+from __future__ import annotations
+
+import contextlib
+import errno
+import hashlib
+import http.client
+import json
+import os
+import re
+import socket
+import ssl
+import stat
+import threading
+import time
+from collections.abc import Callable, Iterator, Mapping
+from dataclasses import dataclass, replace
+from pathlib import Path, PurePosixPath
+from typing import Protocol
+from urllib.parse import urljoin, urlsplit
+
+try:
+    import fcntl
+except ImportError:  # pragma: no cover - sealing already needs dir_fd links, which Windows lacks
+    fcntl = None  # type: ignore[assignment]
+
+from mostlyright.data_harness.acquisition.retention_admission import (
+    configured_retention_evidence_root,
+    require_snapshot_admission,
+)
+from mostlyright.data_harness.acquisition.url_policy import (
+    AcquisitionSecurityError,
+    EgressPolicy,
+    Resolver,
+    ValidatedTarget,
+    require_approved_peer,
+    validate_public_https_url,
+)
+from mostlyright.data_harness.canonical import canonical_sha256, sha256_bytes
+from mostlyright.data_harness.formats import (
+    DIRECT_FETCH_MEDIA_TYPES,
+    SNAPSHOT_SUFFIXES,
+)
+from mostlyright.data_harness.readers.registry import TOOLBOX, ReaderRegistry
+
+MAX_HEADER_COUNT = 128
+MAX_HEADER_BYTES = 32_768
+REDIRECT_STATUSES = frozenset({301, 302, 303, 307, 308})
+_REDIRECT_HEADER = "location"
+_ALLOWED_RESPONSE_ENCODINGS = frozenset({"", "identity"})
+DATAGOV_V4_HOST = "api.gsa.gov"
+DATAGOV_V4_PATH = "/technology/datagov/v4/search"
+DATAGOV_V4_AUTHENTICATION_KIND = "api_data_gov_x_api_key_file"
+MAX_DATAGOV_KEY_BYTES = 4_096
+MAX_DATAGOV_RATE_SECONDS = 86_400
+
+# The default media-type allowlist, derived from the format table rather than restated as a
+# literal.  This is a live enforcement site, not documentation: a response whose content
+# type is outside it is refused as ``MEDIA_TYPE``, and the outgoing ``Accept`` header is
+# built from it.  Restating the union here meant a format added to ``formats.py`` was
+# admitted by the recipe, the parser, the sandbox policy and the deletion sweep while every
+# HTTPS fetch of it was refused and it was never even requested -- and the anti-duplication
+# gate could not see the drift, because these are media types rather than format names.
+# Sorted so the header is deterministic; a coordinator may still narrow the tuple.
+#
+# Derived from the direct-fetch map rather than the sealing table: a source with no Reader pin
+# also admits the weak label a publisher sends when it declines to describe its file, and
+# ``formats.DIRECT_FETCH_MEDIA_TYPES`` is where that is decided and reasoned about.  A pinned
+# fetch does not read this tuple at all -- ``reader_retrieval_limits`` below replaces it with
+# the pinned family's own declaration.
+#
+# Deduplicated, because one label may name more than one format: ``text/plain`` is the weak
+# label for csv, json and ndjson alike.  Without the set the union repeats it once per format,
+# and this tuple builds the outgoing ``Accept`` header as well as gating the response.
+_TABLE_MEDIA_TYPES: tuple[str, ...] = tuple(
+    sorted(
+        {media_type for accepted in DIRECT_FETCH_MEDIA_TYPES.values() for media_type in accepted}
+    )
+)
+
+# The metadata channel: media types a per-fetch narrowing may name even when the parent retriever's
+# own allowlist does not carry them.
+#
+# ``allowed_media_types`` defaults to the *payload* format table, which is a closed vocabulary of
+# encodings a Reader can open. A catalogue's structure message is not a payload and never will be
+# in that table -- an SDMX 2.1 dataflow message describes dataflows, and nothing downstream parses
+# it as data. Without this channel the two contracts contradict each other: a coordinator building
+# a retriever with ``RetrievalLimits()`` defaults could not narrow to the SDMX harvester's declared
+# type at all, so ``narrowed`` refused the fetch before a request was made, and the only way out
+# was for the coordinator to widen its *payload* allowlist for every other fetch -- the opposite of
+# what this seam exists for.
+#
+# Two properties keep this from being a hole. It is a closed vocabulary declared here, in the
+# transport, so a caller cannot name an arbitrary type through it -- ``text/html`` is not a member,
+# which is what keeps the bot-wall refusal intact. And membership is decided by one rule: a member
+# describes a *catalogue's own description of itself*, never bytes any Reader opens. A type that
+# fails that rule belongs in ``formats.py`` or nowhere.
+METADATA_MEDIA_TYPES: tuple[str, ...] = ("application/vnd.sdmx.structure+xml",)
+
+# Spellings of a media type that mean the media type beside them, canonicalised by
+# ``_media_type`` the moment a ``Content-Type`` header is read.  ``binary/octet-stream`` is
+# S3's own default for an object it was told nothing about, and it is what the NOAA GFS
+# mirror this boundary exists for answers with -- for the sidecar and for the object both.
+# It is not a second admitted type: it is the same "the server declined to say anything"
+# signal under another name, and reading it as one keeps a real source from being refused
+# for a spelling while leaving every allowlist in this package written once.
+#
+# Anything not in this table passes through untouched.  A table of equivalences is not a
+# widening: no type is admitted here that an allowlist does not already admit under its
+# canonical name, and the structural checks behind the sandbox boundary remain the only
+# thing that decides whether bytes are the bytes that were ordered.
+MEDIA_TYPE_ALIASES: dict[str, str] = {"binary/octet-stream": "application/octet-stream"}
+
+# The two media types a slice fetch meets: ``application/octet-stream`` for the object's
+# bytes and ``text/plain`` for the ``.idx`` sidecar that says where in the object to look.
+#
+# They are deliberately not in ``formats.py``.  That table is one closed vocabulary read by
+# the recipe, the parser, the sandbox policy and the deletion sweep; adding a media type
+# there admits it for every format at every one of those layers, and neither of these is a
+# format -- no parser accepts them and no plan may name them.  ``allowed_media_types`` is
+# already a per-``RetrievalLimits`` field and narrowing it is an explicitly preserved right,
+# so the slice-fetch caller passes this tuple for its own calls and no other call is widened.
+#
+# ``application/octet-stream`` is a weak signal and is treated as one: it says only that a
+# server declined to say anything.  It is not evidence that these are the ordered bytes.  The
+# control for that is the structural check on the slice itself, behind the sandbox boundary;
+# this tuple only keeps a response from being refused for the one honest thing it said.
+#
+# The pair is named in halves because a call narrows to the half it is fetching.  The sidecar
+# half admits ``text/plain`` and the byte-stream spelling both, because a real object store
+# answers the ``.idx`` as an opaque byte stream: the NOAA GFS S3 mirror this boundary was built
+# against answers ``binary/octet-stream`` for the sidecar and for the object alike, verified
+# against the live source on 2026-08-08.  Admitting only ``text/plain`` there refused the
+# sidecar before a single slice could be planned, and the survey half reported the very same
+# response as present -- so look-then-lock locked a run the fetch could never take a byte of.
+# The union below is derived from the halves rather than restated, so narrowing per call cannot
+# drift from the pair this boundary admits.
+#
+# Sorted, like the tuple above, so the outgoing ``Accept`` header is deterministic.
+SIDECAR_MEDIA_TYPES: tuple[str, ...] = ("application/octet-stream", "text/plain")
+SLICE_OBJECT_MEDIA_TYPES: tuple[str, ...] = ("application/octet-stream",)
+SLICE_FETCH_MEDIA_TYPES: tuple[str, ...] = tuple(
+    sorted(set(SIDECAR_MEDIA_TYPES + SLICE_OBJECT_MEDIA_TYPES))
+)
+
+# Byte offsets stay inside the exactly-representable integer range, because a range rides the
+# sealed hop evidence and must survive every reader of that evidence unchanged.  The span
+# ceiling matches the ceiling ``max_response_bytes`` is itself bounded by: no single ordered
+# slice may be larger than the largest response this boundary would ever accept.
+MAX_BYTE_RANGE_OFFSET = (1 << 53) - 1
+MAX_BYTE_RANGE_LENGTH = 1 << 34
+
+# The largest range plan one acquisition may order.  A slice fetch is many small requests
+# against one object, so an unbounded plan is a denial-of-service lever on both this process
+# and the source; 64 covers the 10-to-50 slice acquisitions this boundary exists for.
+MAX_RANGE_PLAN = 64
+
+NOT_FOUND_STATUS = 404
+PARTIAL_CONTENT_STATUS = 206
+# The typed refusal code that means "this address is not published".  Named here rather than
+# left as a literal at the raise site because the availability survey decides absence by
+# comparing against this exact value: a consumer that restated the spelling would keep
+# compiling and quietly stop recognising absence the day this one changed, and the failure
+# would look like a source that is permanently broken rather than like a mismatch.
+HTTP_NOT_FOUND = "HTTP_NOT_FOUND"
+_MULTIPART_BYTERANGES = "multipart/byteranges"
+# ``bytes <first>-<last>/<complete>``: exactly one space after the unit, decimal integers in
+# canonical form, and either a complete length or ``*`` for an unknown one.  Every other shape
+# a server might send -- another unit, a list of spans, extra whitespace, a ``*`` span, a
+# request-form ``bytes=`` -- is refused rather than interpreted, because a span that is read
+# loosely cannot be compared exactly against the span that was ordered.  Leading zeros are
+# refused so one delivered span has one header spelling in the sealed evidence, and the digit
+# bound keeps a header from carrying an offset no object could have.
+_DECIMAL = r"(?:0|[1-9][0-9]{0,15})"
+_CONTENT_RANGE = re.compile(rf"bytes ({_DECIMAL})-({_DECIMAL})/({_DECIMAL}|\*)")
+# The same spelling on its own, for ``Content-Length``.  Built from ``_DECIMAL`` rather than
+# written out again, so one edit moves both and the two headers cannot drift apart.
+_DECIMAL_ONLY = re.compile(_DECIMAL)
+
+
+@dataclass(frozen=True)
+class DatagovRateObservation:
+    """Validated, secret-free API-gateway rate metadata for one v4 response."""
+
+    limit: int
+    remaining: int
+    retry_after_seconds: int | None
+    reset_epoch_seconds: int | None
+
+    def __post_init__(self) -> None:
+        if type(self.limit) is not int or not 1 <= self.limit <= 1_000_000_000:
+            raise AcquisitionSecurityError("DATAGOV_RATE", "rate limit is invalid")
+        if type(self.remaining) is not int or not 0 <= self.remaining <= self.limit:
+            raise AcquisitionSecurityError("DATAGOV_RATE", "rate remaining is invalid")
+        if self.retry_after_seconds is not None and (
+            type(self.retry_after_seconds) is not int
+            or not 0 <= self.retry_after_seconds <= MAX_DATAGOV_RATE_SECONDS
+        ):
+            raise AcquisitionSecurityError("DATAGOV_RATE", "Retry-After is invalid")
+        if self.reset_epoch_seconds is not None and (
+            type(self.reset_epoch_seconds) is not int
+            or not 0 <= self.reset_epoch_seconds <= (1 << 53) - 1
+        ):
+            raise AcquisitionSecurityError("DATAGOV_RATE", "rate reset is invalid")
+
+    def to_dict(self) -> dict[str, int | None]:
+        return {
+            "limit": self.limit,
+            "remaining": self.remaining,
+            "retry_after_seconds": self.retry_after_seconds,
+            "reset_epoch_seconds": self.reset_epoch_seconds,
+        }
+
+
+@dataclass(frozen=True, repr=False)
+class DatagovV4Authorization:
+    """One in-memory Data.gov key whose only rendering is the exact v4 header."""
+
+    _key: str
+    authentication_kind: str = DATAGOV_V4_AUTHENTICATION_KIND
+
+    def __post_init__(self) -> None:
+        if self.authentication_kind != DATAGOV_V4_AUTHENTICATION_KIND:
+            raise AcquisitionSecurityError(
+                "DATAGOV_AUTHORIZATION", "unsupported Data.gov authentication kind"
+            )
+        if not isinstance(self._key, str) or not self._key:
+            raise AcquisitionSecurityError("DATAGOV_AUTHORIZATION", "Data.gov key is empty")
+
+    @classmethod
+    def from_key_file(cls, path: Path) -> DatagovV4Authorization:
+        """Read one key through a retained no-follow parent chain and stable descriptor."""
+
+        raw_path = os.fspath(path)
+        if not raw_path or "\x00" in raw_path:
+            raise AcquisitionSecurityError("DATAGOV_KEY_FILE", "key file path is invalid")
+        absolute = Path(os.path.abspath(raw_path))
+        if absolute.name in {"", ".", ".."}:
+            raise AcquisitionSecurityError("DATAGOV_KEY_FILE", "key file path is invalid")
+        directory_flags = os.O_RDONLY | getattr(os, "O_DIRECTORY", 0) | getattr(os, "O_NOFOLLOW", 0)
+        owned: list[int] = []
+        descriptor = -1
+        try:
+            parent = os.open("/", directory_flags)
+            owned.append(parent)
+            for component in absolute.parts[1:-1]:
+                parent = os.open(component, directory_flags, dir_fd=parent)
+                owned.append(parent)
+            flags = (
+                os.O_RDONLY
+                | getattr(os, "O_NOFOLLOW", 0)
+                | getattr(os, "O_CLOEXEC", 0)
+                | getattr(os, "O_NONBLOCK", 0)
+            )
+            descriptor = os.open(absolute.name, flags, dir_fd=parent)
+            before = os.fstat(descriptor)
+            _require_datagov_key_stat(before)
+            raw = _read_datagov_key(descriptor, expected_size=before.st_size)
+            after = os.fstat(descriptor)
+            if _stable_file_signature(before) != _stable_file_signature(after):
+                raise AcquisitionSecurityError(
+                    "DATAGOV_KEY_RACE", "key file changed during its bounded read"
+                )
+        except AcquisitionSecurityError:
+            raise
+        except OSError:
+            raise AcquisitionSecurityError(
+                "DATAGOV_KEY_FILE", "key file must be a retained no-follow regular file"
+            ) from None
+        finally:
+            if descriptor >= 0:
+                os.close(descriptor)
+            for opened in reversed(owned):
+                os.close(opened)
+        try:
+            key = raw.decode("ascii", errors="strict")
+        except UnicodeDecodeError:
+            raise AcquisitionSecurityError(
+                "DATAGOV_KEY_FILE", "key file must contain one ASCII line"
+            ) from None
+        if key.endswith("\n"):
+            key = key[:-1]
+        if (
+            not key
+            or "\n" in key
+            or "\r" in key
+            or any(not 0x21 <= ord(char) <= 0x7E for char in key)
+        ):
+            raise AcquisitionSecurityError(
+                "DATAGOV_KEY_FILE", "key file must contain one nonempty printable ASCII line"
+            )
+        return cls(key)
+
+    def __repr__(self) -> str:
+        return (
+            "DatagovV4Authorization("
+            f"authentication_kind={self.authentication_kind!r}, key=<redacted>)"
+        )
+
+    def header_for(self, url: str) -> tuple[str, str]:
+        parsed = urlsplit(url)
+        if (
+            parsed.scheme != "https"
+            or parsed.hostname != DATAGOV_V4_HOST
+            or parsed.port not in {None, 443}
+            or parsed.username is not None
+            or parsed.password is not None
+            or parsed.path != DATAGOV_V4_PATH
+            or parsed.fragment
+        ):
+            raise AcquisitionSecurityError(
+                "DATAGOV_AUTHORIZATION",
+                "Data.gov authorization is scoped to the exact v4 search endpoint",
+            )
+        return "X-Api-Key", self._key
+
+    def reject_echoed_response(self, payload: bytes) -> None:
+        """Reject raw or JSON-equivalent key echoes while the key remains ephemeral."""
+
+        key_bytes = self._key.encode("ascii", errors="strict")
+        if key_bytes in payload:
+            raise AcquisitionSecurityError(
+                "DATAGOV_SECRET_ECHO",
+                "Data.gov response echoed authorization text and was not retained",
+            )
+        try:
+            document = json.loads(
+                payload.decode("utf-8", errors="strict"),
+                object_pairs_hook=_DatagovEchoObject,
+                parse_constant=lambda _value: (_ for _ in ()).throw(ValueError()),
+            )
+        except (UnicodeDecodeError, json.JSONDecodeError, RecursionError, ValueError):
+            raise AcquisitionSecurityError(
+                "DATAGOV_RESPONSE_UNSCANNABLE",
+                "Data.gov response could not be fully inspected before retention",
+            ) from None
+        pending = [document]
+        visited = 0
+        while pending:
+            value = pending.pop()
+            visited += 1
+            if visited > 1_000_000:
+                raise AcquisitionSecurityError(
+                    "DATAGOV_RESPONSE_STRUCTURE",
+                    "Data.gov response exceeds the decoded traversal bound",
+                )
+            if isinstance(value, str):
+                if self._key in value:
+                    raise AcquisitionSecurityError(
+                        "DATAGOV_SECRET_ECHO",
+                        "Data.gov response echoed authorization text and was not retained",
+                    )
+            elif isinstance(value, _DatagovEchoObject):
+                for key, member in value:
+                    pending.append(key)
+                    pending.append(member)
+            elif isinstance(value, list):
+                pending.extend(value)
+
+    def reject_echoed_headers(self, headers: tuple[tuple[str, str], ...]) -> None:
+        """Reject the key in any response-header name or value before hashing or parsing."""
+
+        for name, value in headers:
+            if self._key in name or self._key in value:
+                raise AcquisitionSecurityError(
+                    "DATAGOV_SECRET_ECHO",
+                    "Data.gov response echoed authorization text and was not retained",
+                )
+
+
+class _DatagovEchoObject(list[tuple[str, object]]):
+    """JSON object retaining duplicate keys for authorization echo inspection."""
+
+
+def _require_datagov_key_stat(info: os.stat_result) -> None:
+    if (
+        not stat.S_ISREG(info.st_mode)
+        or info.st_uid != os.geteuid()
+        or info.st_nlink != 1
+        or stat.S_IMODE(info.st_mode) & 0o077
+        or not stat.S_IMODE(info.st_mode) & stat.S_IRUSR
+        or not 1 <= info.st_size <= MAX_DATAGOV_KEY_BYTES
+    ):
+        raise AcquisitionSecurityError(
+            "DATAGOV_KEY_FILE",
+            "key file must be owner-readable, owner-owned, private, bounded, and single-link",
+        )
+
+
+def _read_datagov_key(descriptor: int, *, expected_size: int) -> bytes:
+    chunks: list[bytes] = []
+    observed = 0
+    while observed <= MAX_DATAGOV_KEY_BYTES:
+        chunk = os.read(descriptor, min(512, MAX_DATAGOV_KEY_BYTES + 1 - observed))
+        if not chunk:
+            break
+        observed += len(chunk)
+        chunks.append(chunk)
+    if observed != expected_size or observed > MAX_DATAGOV_KEY_BYTES:
+        raise AcquisitionSecurityError("DATAGOV_KEY_RACE", "key file size changed during read")
+    return b"".join(chunks)
+
+
+def _stable_file_signature(info: os.stat_result) -> tuple[int, ...]:
+    return (
+        info.st_dev,
+        info.st_ino,
+        info.st_uid,
+        info.st_gid,
+        info.st_mode,
+        info.st_nlink,
+        info.st_size,
+        info.st_mtime_ns,
+        info.st_ctime_ns,
+    )
+
+
+@dataclass(frozen=True)
+class ByteRange:
+    """One closed byte span, inclusive on both ends, exactly as RFC 9110 numbers them.
+
+    There is deliberately no open-ended (``bytes=N-``) or suffix (``bytes=-N``) form.  With
+    either of those, "the span that was ordered" is not a fact the client holds before the
+    response arrives, so the delivery check could not compare what came back against what was
+    asked for -- which is the entire purpose of ordering a slice.
+    """
+
+    first_byte: int
+    last_byte: int
+
+    def __post_init__(self) -> None:
+        for name, value in (("first_byte", self.first_byte), ("last_byte", self.last_byte)):
+            if type(value) is not int:
+                raise AcquisitionSecurityError("BYTE_RANGE", f"{name} must be an integer")
+            if not 0 <= value <= MAX_BYTE_RANGE_OFFSET:
+                raise AcquisitionSecurityError(
+                    "BYTE_RANGE",
+                    f"{name} must be in [0, {MAX_BYTE_RANGE_OFFSET}]",
+                )
+        if self.last_byte < self.first_byte:
+            raise AcquisitionSecurityError(
+                "BYTE_RANGE",
+                "byte range must end at or after it begins",
+            )
+        if self.last_byte - self.first_byte + 1 > MAX_BYTE_RANGE_LENGTH:
+            raise AcquisitionSecurityError(
+                "BYTE_RANGE",
+                f"byte range length must not exceed {MAX_BYTE_RANGE_LENGTH}",
+            )
+
+    @property
+    def length(self) -> int:
+        return self.last_byte - self.first_byte + 1
+
+    @property
+    def header_value(self) -> str:
+        return f"bytes={self.first_byte}-{self.last_byte}"
+
+
+# The span a presence probe orders: the first byte and no more.  A probe that read further
+# would be an acquisition nobody ordered, and the whole point of the look half is that it
+# costs the source next to nothing.  Held here rather than at the call site so no caller can
+# widen it.
+_PRESENCE_PROBE_RANGE = ByteRange(first_byte=0, last_byte=0)
+
+
+@dataclass(frozen=True)
+class RetrievalLimits:
+    max_response_bytes: int = 16 * 1024 * 1024
+    max_aggregate_response_bytes: int = 1 << 34
+    max_redirects: int = 5
+    max_requests: int = 6
+    # How many ranged requests one acquisition may plan.  This is deliberately a separate
+    # budget from ``max_requests``: raising that one to 50 so a 50-slice acquisition could
+    # afford its requests would also loosen the ``max_requests >= max_redirects + 1``
+    # relation below, which is a redirect control and has nothing to do with slices.  The
+    # redirect budget therefore stays exactly where it is.
+    max_ranges: int = MAX_RANGE_PLAN
+    connect_timeout_seconds: float = 10.0
+    read_timeout_seconds: float = 30.0
+    total_timeout_seconds: float = 45.0
+    max_concurrency: int = 4
+    min_interval_seconds: float = 0.0
+    allowed_media_types: tuple[str, ...] = _TABLE_MEDIA_TYPES
+    user_agent: str = "MostlyRightDataHarness/1.0"
+
+    def __post_init__(self) -> None:
+        if type(self.max_response_bytes) is not int or not 1 <= self.max_response_bytes <= 1 << 34:
+            raise AcquisitionSecurityError(
+                "RESPONSE_LIMIT",
+                "max_response_bytes must be a positive bounded integer",
+            )
+        if (
+            type(self.max_aggregate_response_bytes) is not int
+            or not 1 <= self.max_aggregate_response_bytes <= 1 << 40
+        ):
+            raise AcquisitionSecurityError(
+                "AGGREGATE_RESPONSE_LIMIT",
+                "max_aggregate_response_bytes must be a positive bounded integer",
+            )
+        if type(self.max_redirects) is not int or not 0 <= self.max_redirects <= 10:
+            raise AcquisitionSecurityError(
+                "REDIRECT_LIMIT",
+                "max_redirects must be an integer in [0, 10]",
+            )
+        if type(self.max_requests) is not int or not 1 <= self.max_requests <= 16:
+            raise AcquisitionSecurityError(
+                "REQUEST_LIMIT",
+                "max_requests must be an integer in [1, 16]",
+            )
+        if self.max_requests < self.max_redirects + 1:
+            raise AcquisitionSecurityError(
+                "REQUEST_LIMIT",
+                "max_requests must allow the configured redirect chain",
+            )
+        if type(self.max_ranges) is not int or not 1 <= self.max_ranges <= MAX_RANGE_PLAN:
+            raise AcquisitionSecurityError(
+                "RANGE_LIMIT",
+                f"max_ranges must be an integer in [1, {MAX_RANGE_PLAN}]",
+            )
+        for name, value, maximum in (
+            ("connect_timeout_seconds", self.connect_timeout_seconds, 60.0),
+            ("read_timeout_seconds", self.read_timeout_seconds, 300.0),
+            ("total_timeout_seconds", self.total_timeout_seconds, 600.0),
+        ):
+            if type(value) not in {int, float} or not 0 < value <= maximum:
+                raise AcquisitionSecurityError(
+                    "TIMEOUT",
+                    f"{name} must be in (0, {maximum}]",
+                )
+        if type(self.max_concurrency) is not int or not 1 <= self.max_concurrency <= 64:
+            raise AcquisitionSecurityError(
+                "CONCURRENCY_LIMIT",
+                "max_concurrency must be an integer in [1, 64]",
+            )
+        if (
+            type(self.min_interval_seconds) not in {int, float}
+            or not 0 <= self.min_interval_seconds <= 3_600
+        ):
+            raise AcquisitionSecurityError(
+                "RATE_LIMIT",
+                "min_interval_seconds must be in [0, 3600]",
+            )
+        if not self.allowed_media_types or len(set(self.allowed_media_types)) != len(
+            self.allowed_media_types
+        ):
+            raise AcquisitionSecurityError(
+                "MEDIA_ALLOWLIST",
+                "allowed media types must be non-empty and unique",
+            )
+        # An allowlist is compared against what ``_media_type`` returns, and that is always
+        # the canonical spelling.  An alias written here would therefore match nothing and
+        # refuse every response it was added to admit -- a silent hole rather than a loud
+        # one -- so it is refused at construction, where the caller can still be told.
+        aliased = [
+            media_type
+            for media_type in self.allowed_media_types
+            if media_type in MEDIA_TYPE_ALIASES
+        ]
+        if aliased:
+            raise AcquisitionSecurityError(
+                "MEDIA_ALLOWLIST",
+                f"{aliased[0]!r} is an alias of {MEDIA_TYPE_ALIASES[aliased[0]]!r}; "
+                f"allowlist the canonical spelling, which admits both",
+            )
+        if not self.user_agent or "\r" in self.user_agent or "\n" in self.user_agent:
+            raise AcquisitionSecurityError("USER_AGENT", "user agent is invalid")
+
+
+def reader_retrieval_limits(
+    limits: RetrievalLimits,
+    *,
+    family_id: str,
+    family_version: str,
+    registry: ReaderRegistry | None = None,
+) -> RetrievalLimits:
+    """The limits a fetch for a Reader-pinned source runs under.
+
+    The table-derived default above is right for a direct fetch and wrong for a pinned one: a
+    zipped source arrives as an archive media type that no wire format claims, so the fetch
+    would be refused before the Reader could ever see it.  The admitted set for a pinned fetch
+    is therefore the pinned family's own ``accepted_media_types``.
+
+    Taken from the family rather than added to ``FORMAT_MEDIA_TYPES``, for two reasons that
+    point the same way.  The format table answers "what encoding may be sealed", and a fetched
+    container is never sealed.  And widening that table would widen the allowlist for every
+    *unpinned* fetch as well, which is the opposite of what is wanted -- a direct fetch must go
+    on admitting exactly what it admits today.
+
+    Narrowing to the one family rather than to ``registry.accepted_media_types()`` is
+    deliberate: the union is the Toolbox's outer bound, and a source pinned to a zip Reader has
+    no business admitting a spreadsheet.  Every other bound on ``limits`` is carried through
+    untouched, so a coordinator's own narrowing still holds.
+
+    A family the closed table does not hold is refused here, by name, before any connection is
+    attempted.
+
+    ``registry`` defaults to ``None`` and is resolved to the shipped Toolbox at call time
+    rather than being bound as a default argument at import time, so which table answers is a
+    property of the running process and not of import order.
+    """
+
+    family = (registry if registry is not None else TOOLBOX).resolve(family_id, family_version)
+    return replace(limits, allowed_media_types=tuple(family.accepted_media_types))
+
+
+def require_range_plan_within_budget(planned_ranges: int, *, max_ranges: int) -> None:
+    """Refuse a range plan that orders more slices than the acquisition's budget allows.
+
+    ``retrieve`` fetches one range per call, so the budget belongs to whoever plans a range
+    set rather than to a single request.  The bound lives here, beside the limits it comes
+    from, so the range planner and the sandbox operation that calls it do not each restate it.
+    """
+
+    if type(max_ranges) is not int or not 1 <= max_ranges <= MAX_RANGE_PLAN:
+        raise AcquisitionSecurityError(
+            "RANGE_LIMIT",
+            f"range budget must be an integer in [1, {MAX_RANGE_PLAN}]",
+        )
+    if type(planned_ranges) is not int or planned_ranges < 1:
+        raise AcquisitionSecurityError(
+            "RANGE_LIMIT",
+            "a range plan must order at least one range",
+        )
+    if planned_ranges > max_ranges:
+        raise AcquisitionSecurityError(
+            "RANGE_LIMIT",
+            f"range plan of {planned_ranges} exceeds the budget of {max_ranges}",
+        )
+
+
+@dataclass(frozen=True)
+class TransportResponse:
+    status: int
+    headers: tuple[tuple[str, str], ...]
+    body: bytes
+    connected_peer: str
+    tls_verified: bool
+    hostname_verified: bool
+
+    def header(self, name: str) -> str | None:
+        wanted = name.lower()
+        values = [value for key, value in self.headers if key.lower() == wanted]
+        if len(values) > 1 and wanted in {
+            _REDIRECT_HEADER,
+            "content-length",
+            "content-type",
+            "content-range",
+            "retry-after",
+            "x-ratelimit-limit",
+            "x-ratelimit-remaining",
+            "x-ratelimit-reset",
+            # ``content-encoding`` belongs here for the same reason the other four do, and was
+            # missing.  Returning the first of two would let a source send ``identity`` then
+            # ``gzip``: the encoding check reads the first and passes while the bytes are the
+            # second, and every offset in a range plan stops meaning anything.  Nothing in
+            # this build decompresses, so the practical reach was small -- but "small because
+            # of something elsewhere" is not the property this set exists to give.
+            "content-encoding",
+        }:
+            raise AcquisitionSecurityError(
+                "RESPONSE_HEADER_DUPLICATE",
+                f"response repeated security-sensitive header {wanted}",
+            )
+        return values[0] if values else None
+
+
+class PinnedTransport(Protocol):
+    def request(
+        self,
+        target: ValidatedTarget,
+        *,
+        approved_ip: str,
+        headers: Mapping[str, str],
+        limits: RetrievalLimits,
+        byte_range: ByteRange | None = None,
+    ) -> TransportResponse:
+        """Connect only to approved_ip while verifying target.hostname in TLS.
+
+        A slice is ordered through the typed ``byte_range`` parameter rather than through a
+        caller-supplied header mapping.  A general ``extra_headers`` argument would put a
+        header-injection surface at the most security-sensitive seam in this package; a
+        ``ByteRange`` validates itself and renders to exactly one header value that no caller
+        can influence character by character.
+        """
+
+
+class TransportFailureError(AcquisitionSecurityError):
+    """Retryable transport failure with exact response-body bytes already consumed."""
+
+    def __init__(self, detail: str, *, response_body_size_bytes: int) -> None:
+        if (
+            type(response_body_size_bytes) is not int
+            or not 0 <= response_body_size_bytes <= (1 << 34) + 1
+        ):
+            raise AcquisitionSecurityError(
+                "TRANSPORT_FAILURE",
+                "transport failure byte evidence is outside the admitted range",
+            )
+        self.response_body_size_bytes = response_body_size_bytes
+        super().__init__("TRANSPORT_FAILURE", detail)
+
+
+@dataclass(frozen=True)
+class PeerAttempt:
+    """Canonical evidence for one address from a resolver-approved peer set."""
+
+    approved_ip: str
+    outcome: str
+    failure_code: str | None
+    response_body_size_bytes: int = 0
+
+    def __post_init__(self) -> None:
+        if (
+            type(self.response_body_size_bytes) is not int
+            or not 0 <= self.response_body_size_bytes <= (1 << 34) + 1
+        ):
+            raise AcquisitionSecurityError(
+                "TRANSPORT_EVIDENCE",
+                "peer-attempt response-body bytes are outside the admitted range",
+            )
+
+    def to_dict(self) -> dict[str, object]:
+        return {
+            "approved_ip": self.approved_ip,
+            "outcome": self.outcome,
+            "failure_code": self.failure_code,
+            "response_body_size_bytes": self.response_body_size_bytes,
+        }
+
+
+class PeerAttemptError(AcquisitionSecurityError):
+    """A typed retrieval refusal carrying redacted, ordered peer-attempt evidence.
+
+    ``hops`` is the exact sealed-evidence hop list the refused retrieval had already
+    measured when it refused -- every completed hop, including the one whose response was
+    consumed in full and then refused (a 200 answering a ranged probe, for instance).  It
+    rides the refusal so a caller that legitimately continues after one (the ranged bulk
+    fetch falling back to its single-shot path) can seal what the refused attempt consumed
+    instead of letting those response bytes vanish from the evidence.  It is the same
+    ``RetrievalHop`` type ``RetrievedBytes`` seals; nothing new is measured here.
+    """
+
+    def __init__(
+        self,
+        code: str,
+        detail: str,
+        peer_attempts: tuple[PeerAttempt, ...],
+        *,
+        hops: tuple[RetrievalHop, ...] = (),
+    ) -> None:
+        if any(not isinstance(attempt, PeerAttempt) for attempt in peer_attempts):
+            raise AcquisitionSecurityError(
+                "TRANSPORT_EVIDENCE",
+                "peer-attempt evidence contains an invalid entry",
+            )
+        if any(not isinstance(hop, RetrievalHop) for hop in hops):
+            raise AcquisitionSecurityError(
+                "TRANSPORT_EVIDENCE",
+                "peer-attempt hop evidence contains an invalid entry",
+            )
+        self.peer_attempts = peer_attempts
+        self.hops = hops
+        self.total_response_body_size_bytes = sum(
+            attempt.response_body_size_bytes for attempt in peer_attempts
+        )
+        super().__init__(code, detail)
+
+
+class DatagovResponseRefused(AcquisitionSecurityError):
+    """Authenticated response refused before any secret-derived digest was constructed."""
+
+    def __init__(self, code: str, detail: str, *, status: int, network_bytes: int) -> None:
+        self.status = status
+        self.network_bytes = network_bytes
+        super().__init__(code, detail)
+
+
+@dataclass(frozen=True)
+class RetrievalHop:
+    url: str
+    resolution_digest: str
+    connected_peer: str
+    status: int
+    response_headers_digest: str
+    response_body_size_bytes: int
+    response_body_sha256: str
+    requested_range: str | None = None
+    observed_content_range: str | None = None
+    etag: str | None = None
+    last_modified: str | None = None
+    peer_attempts: tuple[PeerAttempt, ...] = ()
+
+    def to_dict(self) -> dict[str, object]:
+        # Both range keys are always present, ``None`` when the hop ordered no slice, so a hop
+        # has exactly one shape rather than two and the digest below covers the same fields on
+        # every acquisition.
+        return {
+            "url": self.url,
+            "resolution_digest": self.resolution_digest,
+            "connected_peer": self.connected_peer,
+            "status": self.status,
+            "response_headers_digest": self.response_headers_digest,
+            "response_body_size_bytes": self.response_body_size_bytes,
+            "response_body_sha256": self.response_body_sha256,
+            "requested_range": self.requested_range,
+            "observed_content_range": self.observed_content_range,
+            "etag": self.etag,
+            "last_modified": self.last_modified,
+            "peer_attempts": [attempt.to_dict() for attempt in self.peer_attempts],
+        }
+
+
+@dataclass(frozen=True)
+class ProbeTransport:
+    """The sanitized transport facts one whole-document retrieval proves about its response.
+
+    A cadence observation records the response status and the two validator headers, because a
+    publisher that answers 200 with an unchanged ``ETag`` is stating something about its own
+    editions.  Neither validator leaves the confinement as text.  Both are untrusted publisher
+    bytes of the publisher's own choosing, and the observation contract stores them hashed for
+    exactly that reason, so they are hashed here -- inside the Clean room, beside the response
+    they came from -- and only the digest crosses the boundary.  The status is an integer from a
+    closed range and carries nothing a publisher composed.
+
+    This is the terminal response of the exchange.  Redirect hops keep their own evidence in the
+    transport hop list; what an observation states about the publisher is what the address it
+    settled on answered.
+    """
+
+    http_status_code: int
+    etag_digest: str | None
+    last_modified_digest: str | None
+
+    def __post_init__(self) -> None:
+        if type(self.http_status_code) is not int or not 100 <= self.http_status_code <= 599:
+            raise AcquisitionSecurityError(
+                "PROBE_TRANSPORT",
+                "probe transport status is not a real HTTP status code",
+            )
+        for name, value in (
+            ("etag_digest", self.etag_digest),
+            ("last_modified_digest", self.last_modified_digest),
+        ):
+            if value is not None and (
+                not isinstance(value, str) or re.fullmatch(r"[0-9a-f]{64}", value) is None
+            ):
+                raise AcquisitionSecurityError(
+                    "PROBE_TRANSPORT",
+                    f"probe transport {name} is not a lowercase SHA-256 digest",
+                )
+
+    @classmethod
+    def from_terminal_hop(cls, hop: RetrievalHop) -> ProbeTransport:
+        """Seal the terminal hop's status and hashed validators."""
+
+        return cls(
+            http_status_code=hop.status,
+            etag_digest=None if hop.etag is None else sha256_bytes(hop.etag.encode("utf-8")),
+            last_modified_digest=(
+                None
+                if hop.last_modified is None
+                else sha256_bytes(hop.last_modified.encode("utf-8"))
+            ),
+        )
+
+    def to_dict(self) -> dict[str, object]:
+        return {
+            "http_status_code": self.http_status_code,
+            "etag_digest": self.etag_digest,
+            "last_modified_digest": self.last_modified_digest,
+        }
+
+
+@dataclass(frozen=True)
+class RetrievedBytes:
+    source_url: str
+    final_url: str
+    media_type: str
+    content: bytes
+    content_sha256: str
+    hops: tuple[RetrievalHop, ...]
+    transport_evidence_digest: str
+    complete_size_bytes: int | None = None
+    rate_observation: DatagovRateObservation | None = None
+
+    @property
+    def total_response_body_size_bytes(self) -> int:
+        """Every response-body byte consumed in the exact transport hop evidence.
+
+        ``len(content)`` is only the terminal response. Redirect response bodies consumed the
+        same transport budget, as do partial bodies from failed peer attempts, so both belong
+        in cumulative acquisition accounting. Deriving the total from the authenticated hop
+        tuple avoids a second summary fact that could disagree with its underlying evidence.
+        """
+
+        return sum(
+            hop.response_body_size_bytes
+            + sum(
+                attempt.response_body_size_bytes
+                for attempt in hop.peer_attempts[:-1]
+                if attempt.outcome == "transport_failure"
+            )
+            for hop in self.hops
+        )
+
+    def __post_init__(self) -> None:
+        if sha256_bytes(self.content) != self.content_sha256:
+            raise AcquisitionSecurityError(
+                "CONTENT_DIGEST",
+                "retrieved content digest does not match exact bytes",
+            )
+        expected = canonical_sha256([hop.to_dict() for hop in self.hops])
+        if expected != self.transport_evidence_digest:
+            raise AcquisitionSecurityError(
+                "TRANSPORT_EVIDENCE_DIGEST",
+                "transport evidence digest does not match the exact hop list",
+            )
+        if self.complete_size_bytes is not None and (
+            type(self.complete_size_bytes) is not int
+            or self.complete_size_bytes < len(self.content)
+            or self.complete_size_bytes > MAX_BYTE_RANGE_OFFSET + 1
+        ):
+            raise AcquisitionSecurityError(
+                "CONTENT_RANGE",
+                "complete object size is outside the admitted range",
+            )
+        if self.rate_observation is not None and not isinstance(
+            self.rate_observation, DatagovRateObservation
+        ):
+            raise AcquisitionSecurityError(
+                "DATAGOV_RATE", "rate observation must use the strict contract"
+            )
+
+
+def probe_transport_for(retrieved: RetrievedBytes) -> ProbeTransport:
+    """Seal what the terminal response of one retrieval stated.
+
+    Taken from the retained hop evidence rather than from a summary field, so what an
+    observation says the publisher answered is the same response the transport digest covers.
+    """
+
+    if not retrieved.hops:
+        raise AcquisitionSecurityError(
+            "PROBE_TRANSPORT",
+            "a retrieval with no hop evidence has no terminal response",
+        )
+    return ProbeTransport.from_terminal_hop(retrieved.hops[-1])
+
+
+class AcquisitionLimiter:
+    """Bounded concurrency, plus a per-host minimum interval that is waited out."""
+
+    def __init__(
+        self,
+        *,
+        max_concurrency: int,
+        min_interval_seconds: float,
+        clock: Callable[[], float] = time.monotonic,
+        sleep: Callable[[float], None] = time.sleep,
+    ) -> None:
+        # The interval is validated here as well as on ``RetrievalLimits``, because a limiter
+        # may be constructed directly and the interval is now slept on rather than raised on:
+        # an unbounded or non-numeric interval would be a hang inside our own worker rather
+        # than a refusal a caller sees.  ``NaN`` fails this comparison and is refused with it.
+        if type(min_interval_seconds) not in {int, float} or not 0 <= min_interval_seconds <= 3_600:
+            raise AcquisitionSecurityError(
+                "RATE_LIMIT",
+                "min_interval_seconds must be in [0, 3600]",
+            )
+        self._semaphore = threading.BoundedSemaphore(max_concurrency)
+        self._min_interval_seconds = float(min_interval_seconds)
+        self._clock = clock
+        self._sleep = sleep
+        self._lock = threading.Lock()
+        self._last_request: dict[str, float] = {}
+
+    @property
+    def clock(self) -> Callable[[], float]:
+        """The clock every deadline handed to :meth:`acquire` must be an instant on."""
+
+        return self._clock
+
+    @contextlib.contextmanager
+    def acquire(self, hostname: str, *, deadline: float) -> Iterator[None]:
+        """Hold a concurrency slot, waiting out this host's minimum interval first.
+
+        Two limits, two dispositions, deliberately.  An exhausted concurrency semaphore
+        fails fast: more work is in flight than this process admitted, which is a bug on our
+        side, and waiting would hide it.  The per-host interval waits: it is politeness
+        towards a source that is behaving exactly as documented, and raising there turns a
+        healthy source into a failed run.
+
+        ``deadline`` is an absolute instant on this limiter's own clock -- the retrieval
+        passes its start plus the ``total_timeout_seconds`` it already measures itself
+        against.  The bound is not optional: ``min_interval_seconds`` is admitted up to an
+        hour and a slice acquisition may order 64 ranges, so an unbounded wait is a
+        multi-hour hang in our own worker.  A wait that would cross the deadline is refused
+        up front as ``TOTAL_TIMEOUT`` rather than slept past and regretted afterwards.
+        """
+
+        if type(deadline) not in {int, float} or deadline != deadline:  # NaN is not a bound
+            raise AcquisitionSecurityError(
+                "TOTAL_TIMEOUT",
+                "a wait must be bounded by a deadline on the retrieval's own clock",
+            )
+        if not self._semaphore.acquire(blocking=False):
+            raise AcquisitionSecurityError(
+                "CONCURRENCY_LIMIT",
+                "acquisition concurrency limit is exhausted",
+            )
+        try:
+            now = float(self._clock())
+            with self._lock:
+                last = self._last_request.get(hostname)
+                scheduled = now if last is None else max(now, last + self._min_interval_seconds)
+                if scheduled > float(deadline):
+                    raise AcquisitionSecurityError(
+                        "TOTAL_TIMEOUT",
+                        "the wait this source requires would outlive the retrieval's budget",
+                    )
+                # Reserve the instant the request will actually be made, before the lock is
+                # released: a second caller for the same host then queues behind this one
+                # instead of racing it.  The refusal above reserves nothing, so a retrieval
+                # that gives up does not push the host's next slot further out.  The lock is
+                # never held across the wait, which would stall every other host.
+                self._last_request[hostname] = scheduled
+            if scheduled > now:
+                self._sleep(scheduled - now)
+            yield
+        finally:
+            self._semaphore.release()
+
+
+class PinnedHttpsRetriever:
+    """Redirect-aware retriever; every hop gets a new DNS and connection epoch."""
+
+    def __init__(
+        self,
+        *,
+        resolver: Resolver,
+        egress_policy: EgressPolicy,
+        transport: PinnedTransport,
+        limits: RetrievalLimits,
+        limiter: AcquisitionLimiter | None = None,
+        clock: Callable[[], float] = time.monotonic,
+        sleep: Callable[[float], None] = time.sleep,
+    ) -> None:
+        # A deadline is an instant rather than a duration, so a limiter reading a different
+        # clock would compare it against a number from another timeline: the wait bound would
+        # either fire immediately on every call or never fire at all.  A shared limiter is
+        # still allowed -- it must simply share this retrieval's clock, which the default
+        # monotonic pairing does.
+        if limiter is not None and limiter.clock is not clock:
+            raise AcquisitionSecurityError(
+                "LIMITER_CLOCK",
+                "an injected limiter must observe the retrieval's own clock",
+            )
+        self._resolver = resolver
+        self._egress_policy = egress_policy
+        self._transport = transport
+        self._limits = limits
+        self._limiter = limiter or AcquisitionLimiter(
+            max_concurrency=limits.max_concurrency,
+            min_interval_seconds=limits.min_interval_seconds,
+            clock=clock,
+            sleep=sleep,
+        )
+        self._clock = clock
+
+    @property
+    def limits(self) -> RetrievalLimits:
+        """The caps this retriever actually enforces. Read-only: a caller narrows, never mutates."""
+
+        return self._limits
+
+    def narrowed(self, limits: RetrievalLimits) -> PinnedHttpsRetriever:
+        """A retriever over the same transport whose transport-shape caps are ``limits``.
+
+        A caller that declares tighter caps for one fetch -- a harvester saying it accepts only
+        ``application/json`` under a 2 MiB cap, a health probe saying only a 1 MiB citation target
+        -- has to be able to make those caps the ones the transport enforces. Passing them
+        alongside a retriever that was built with looser ones leaves them inert, which is worse
+        than not declaring them: the declaration reads as a control and enforces nothing.
+
+        Only the five transport-shape caps are taken from ``limits``: ``max_response_bytes``,
+        ``max_redirects``, ``max_requests``, ``max_ranges`` and ``allowed_media_types``. Timeouts,
+        concurrency, rate interval and user agent stay this retriever's, because those are the
+        coordinator's operational policy and not a per-fetch shape. The four numeric caps may not
+        be widened, so this can only tighten what the coordinator configured, never escape it.
+
+        The allowlist term is the one place the rule is not plain subset, and the superset it is
+        checked against is stated rather than implied: this retriever's own types **plus**
+        :data:`METADATA_MEDIA_TYPES`. ``allowed_media_types`` defaults to the payload format table,
+        which by construction can never carry a catalogue's structure message -- so a plain subset
+        rule made the SDMX harvester's declared type unnarrowable from a default-configured
+        retriever and refused every SDMX fetch and every non-JSON citation probe before a request
+        was made. The metadata vocabulary is closed and lives in this module, so this admits exactly
+        the types the transport itself names and nothing a caller supplies: ``text/html`` is still a
+        widening, which is what keeps the bot-wall refusal a refusal.
+
+        The rate limiter is shared rather than rebuilt, so a narrowed retriever does not get a
+        second concurrency budget for the same host.
+        """
+
+        if not isinstance(limits, RetrievalLimits):
+            raise AcquisitionSecurityError(
+                "RETRIEVAL_LIMITS",
+                "limits must be a RetrievalLimits",
+            )
+        widened = []
+        for name in (
+            "max_response_bytes",
+            "max_aggregate_response_bytes",
+            "max_redirects",
+            "max_requests",
+            "max_ranges",
+        ):
+            if getattr(limits, name) > getattr(self._limits, name):
+                widened.append(name)
+        narrowable = set(self._limits.allowed_media_types) | set(METADATA_MEDIA_TYPES)
+        if not set(limits.allowed_media_types) <= narrowable:
+            widened.append("allowed_media_types")
+        if widened:
+            raise AcquisitionSecurityError(
+                "RETRIEVAL_LIMITS",
+                f"narrowing may not widen {sorted(widened)}",
+            )
+        if limits == self._limits:
+            return self
+        effective = RetrievalLimits(
+            max_response_bytes=limits.max_response_bytes,
+            max_aggregate_response_bytes=limits.max_aggregate_response_bytes,
+            max_redirects=limits.max_redirects,
+            max_requests=limits.max_requests,
+            max_ranges=limits.max_ranges,
+            connect_timeout_seconds=self._limits.connect_timeout_seconds,
+            read_timeout_seconds=self._limits.read_timeout_seconds,
+            total_timeout_seconds=self._limits.total_timeout_seconds,
+            max_concurrency=self._limits.max_concurrency,
+            min_interval_seconds=self._limits.min_interval_seconds,
+            allowed_media_types=limits.allowed_media_types,
+            user_agent=self._limits.user_agent,
+        )
+        return PinnedHttpsRetriever(
+            resolver=self._resolver,
+            egress_policy=self._egress_policy,
+            transport=self._transport,
+            limits=effective,
+            limiter=self._limiter,
+            clock=self._clock,
+        )
+
+    def retrieve(self, url: str, *, byte_range: ByteRange | None = None) -> RetrievedBytes:
+        if byte_range is not None and not isinstance(byte_range, ByteRange):
+            raise AcquisitionSecurityError(
+                "BYTE_RANGE",
+                "a slice is ordered only through a validated byte range",
+            )
+        return self._fetch(
+            url,
+            byte_range=byte_range,
+            presence_probe=False,
+            datagov_authorization=None,
+        )
+
+    def retrieve_datagov_v4(
+        self,
+        url: str,
+        authorization: DatagovV4Authorization,
+        *,
+        on_response_observed: (
+            Callable[[int, int, DatagovRateObservation | None], None] | None
+        ) = None,
+    ) -> RetrievedBytes:
+        """Retrieve only the exact authenticated v4 endpoint with zero redirects."""
+
+        if not isinstance(authorization, DatagovV4Authorization):
+            raise AcquisitionSecurityError(
+                "DATAGOV_AUTHORIZATION", "strict Data.gov authorization is required"
+            )
+        authorization.header_for(url)
+        return self._fetch(
+            url,
+            byte_range=None,
+            presence_probe=False,
+            datagov_authorization=authorization,
+            datagov_response_observed=on_response_observed,
+        )
+
+    def probe_presence(self, url: str) -> bool:
+        """Ask one address whether it is published, keep nothing, and answer yes or no.
+
+        This is the look half of look-then-lock.  It orders exactly one byte, discards the
+        response, and returns presence.  Nothing is parsed, nothing is sealed, no digest is
+        taken and no media type is reported: the only thing that leaves this call is a
+        boolean.
+
+        Absence is read from the typed ``HTTP_NOT_FOUND`` code and from nothing else.  A
+        string match on the message would silently start reporting "not published yet" the
+        first time an unrelated message was reworded to contain the same words, and that is
+        the failure mode that turns a broken source into a permanently quiet one: the dataset
+        stops updating, every run reports a clean no-new-run, and nobody is told.  Every other
+        refusal -- a server error, a TLS failure, a peer outside the pin, a source that
+        ignored the range -- propagates, because a broken source must stay loud.
+
+        Presence probes admit any media type. GRIB objects commonly return
+        ``application/octet-stream``, which the normal retrieval allowlist rejects. Only this
+        method can request the exemption; data retrieval still uses ``retrieve``.
+        """
+
+        try:
+            self._fetch(
+                url,
+                byte_range=_PRESENCE_PROBE_RANGE,
+                presence_probe=True,
+                datagov_authorization=None,
+            )
+        except AcquisitionSecurityError as exc:
+            if exc.code != HTTP_NOT_FOUND:
+                raise
+            return False
+        return True
+
+    def retrieve_presence_evidence(self, url: str) -> RetrievedBytes:
+        """Probe one byte while retaining the exact measured response evidence.
+
+        Range/Reader composition seals this evidence and accounts every response body.  The
+        ordinary survey intentionally returns only booleans, so it continues to use
+        :meth:`probe_presence`; this method exists for an acquisition that has already locked
+        the candidate and therefore must retain, rather than discard, what it measured.
+        """
+
+        return self._fetch(
+            url,
+            byte_range=_PRESENCE_PROBE_RANGE,
+            presence_probe=True,
+            datagov_authorization=None,
+        )
+
+    def _fetch(
+        self,
+        url: str,
+        *,
+        byte_range: ByteRange | None,
+        presence_probe: bool,
+        datagov_authorization: DatagovV4Authorization | None,
+        datagov_response_observed: (
+            Callable[[int, int, DatagovRateObservation | None], None] | None
+        ) = None,
+    ) -> RetrievedBytes:
+        started = float(self._clock())
+        current_url = url
+        hops: list[RetrievalHop] = []
+        aggregate_response_bytes = 0
+        requests = 0
+        deadline = started + self._limits.total_timeout_seconds
+        redirect_budget = 0 if datagov_authorization is not None else self._limits.max_redirects
+        for redirect_count in range(redirect_budget + 1):
+            self._check_total_timeout(started)
+            target = validate_public_https_url(
+                current_url,
+                resolver=self._resolver,
+                egress_policy=self._egress_policy,
+            )
+            headers = {
+                # A presence probe asks for anything, because it admits anything: sending the
+                # acquisition allowlist would invite a 406 for a run that is published and
+                # fine, which is the same false failure the admission exemption removes.
+                "Accept": "*/*" if presence_probe else _accept_header(self._limits),
+                "Accept-Encoding": "identity",
+                "Connection": "close",
+                "Host": urlsplit(target.normalized_url).netloc,
+                "User-Agent": self._limits.user_agent,
+            }
+            if datagov_authorization is not None:
+                name, value = datagov_authorization.header_for(target.normalized_url)
+                headers[name] = value
+            peer_attempts: list[PeerAttempt] = []
+            response: TransportResponse | None = None
+            for approved_ip in target.approved_ips:
+                if requests >= self._limits.max_requests:
+                    raise PeerAttemptError(
+                        "REQUEST_LIMIT",
+                        "retrieval exceeded its request budget",
+                        tuple(peer_attempts),
+                        hops=tuple(hops),
+                    )
+                requests += 1
+                remaining_aggregate_bytes = (
+                    self._limits.max_aggregate_response_bytes - aggregate_response_bytes
+                )
+                try:
+                    attempt_limits = self._remaining_attempt_limits(
+                        deadline,
+                        remaining_aggregate_bytes=remaining_aggregate_bytes,
+                    )
+                except AcquisitionSecurityError as exc:
+                    raise PeerAttemptError(
+                        exc.code,
+                        exc.detail,
+                        tuple(peer_attempts),
+                        hops=tuple(hops),
+                    ) from None
+                try:
+                    # One budget, one clock: every peer and limiter wait is bounded by the
+                    # same absolute instant. A fallback never starts a second DNS epoch.
+                    with self._limiter.acquire(target.hostname, deadline=deadline):
+                        response = self._transport.request(
+                            target,
+                            approved_ip=approved_ip,
+                            headers=headers,
+                            limits=attempt_limits,
+                            byte_range=byte_range,
+                        )
+                except AcquisitionSecurityError as exc:
+                    if exc.code == "TRANSPORT_FAILURE" and not isinstance(
+                        exc, TransportFailureError
+                    ):
+                        raise PeerAttemptError(
+                            "TRANSPORT_EVIDENCE",
+                            "transport failure omitted exact consumed response-body bytes",
+                            tuple(peer_attempts),
+                            hops=tuple(hops),
+                        ) from None
+                    consumed_body_bytes = (
+                        exc.response_body_size_bytes
+                        if isinstance(exc, TransportFailureError)
+                        else 0
+                    )
+                    aggregate_response_bytes += consumed_body_bytes
+                    failure_code = exc.code
+                    failure_detail = exc.detail
+                    if (
+                        exc.code == "RESPONSE_LIMIT"
+                        and remaining_aggregate_bytes < self._limits.max_response_bytes
+                    ):
+                        failure_code = "AGGREGATE_RESPONSE_LIMIT"
+                        failure_detail = "retrieval exceeded its aggregate response-body budget"
+                    peer_attempts.append(
+                        PeerAttempt(
+                            approved_ip=approved_ip,
+                            outcome="transport_failure",
+                            failure_code=failure_code,
+                            response_body_size_bytes=consumed_body_bytes,
+                        )
+                    )
+                    aggregate_exhausted = (
+                        aggregate_response_bytes >= self._limits.max_aggregate_response_bytes
+                    )
+                    if (
+                        failure_code == "TRANSPORT_FAILURE"
+                        and not aggregate_exhausted
+                        and approved_ip != target.approved_ips[-1]
+                    ):
+                        continue
+                    if failure_code == "TRANSPORT_FAILURE" and aggregate_exhausted:
+                        raise PeerAttemptError(
+                            "AGGREGATE_RESPONSE_LIMIT",
+                            "failed response bodies exhausted the aggregate byte limit",
+                            tuple(peer_attempts),
+                            hops=tuple(hops),
+                        ) from None
+                    detail = (
+                        "all resolver-approved peers failed before an HTTP response"
+                        if failure_code == "TRANSPORT_FAILURE"
+                        else failure_detail
+                    )
+                    raise PeerAttemptError(
+                        failure_code, detail, tuple(peer_attempts), hops=tuple(hops)
+                    ) from None
+                peer_attempts.append(
+                    PeerAttempt(
+                        approved_ip=approved_ip,
+                        outcome="response",
+                        failure_code=None,
+                        response_body_size_bytes=len(response.body),
+                    )
+                )
+                break
+            if response is None:  # pragma: no cover - ValidatedTarget forbids an empty peer set
+                raise PeerAttemptError(
+                    "TRANSPORT_FAILURE",
+                    "all resolver-approved peers failed before an HTTP response",
+                    tuple(peer_attempts),
+                    hops=tuple(hops),
+                )
+            if datagov_response_observed is not None:
+                datagov_response_observed(
+                    response.status,
+                    aggregate_response_bytes + len(response.body),
+                    None,
+                )
+            if (
+                aggregate_response_bytes + len(response.body)
+                > self._limits.max_aggregate_response_bytes
+            ):
+                self._raise_peer_failure(
+                    "AGGREGATE_RESPONSE_LIMIT",
+                    "redirect and final response bodies exceeded the aggregate byte limit",
+                    peer_attempts,
+                    hops,
+                )
+            aggregate_response_bytes += len(response.body)
+            try:
+                self._check_total_timeout(started)
+            except AcquisitionSecurityError as exc:
+                self._raise_peer_failure(exc.code, exc.detail, peer_attempts, hops)
+            if not response.tls_verified or not response.hostname_verified:
+                self._raise_peer_failure(
+                    "TLS_VERIFICATION",
+                    "transport did not prove certificate and hostname verification",
+                    peer_attempts,
+                    hops,
+                )
+            try:
+                peer = require_approved_peer(target, response.connected_peer)
+                normalized_headers = _validate_response_headers(response.headers)
+            except AcquisitionSecurityError as exc:
+                self._raise_peer_failure(exc.code, exc.detail, peer_attempts, hops)
+            if datagov_authorization is not None:
+                try:
+                    datagov_authorization.reject_echoed_headers(normalized_headers)
+                    if response.status in REDIRECT_STATUSES:
+                        self._raise_peer_failure(
+                            "REDIRECT_LIMIT",
+                            "response exceeded the redirect limit",
+                            peer_attempts,
+                            hops,
+                        )
+                    datagov_authorization.reject_echoed_response(response.body)
+                except AcquisitionSecurityError as exc:
+                    raise DatagovResponseRefused(
+                        exc.code,
+                        exc.detail,
+                        status=response.status,
+                        network_bytes=aggregate_response_bytes,
+                    ) from None
+                try:
+                    datagov_rate_observation = _datagov_rate_observation(response)
+                except AcquisitionSecurityError:
+                    raise
+                if datagov_response_observed is not None:
+                    datagov_response_observed(
+                        response.status,
+                        aggregate_response_bytes,
+                        datagov_rate_observation,
+                    )
+            else:
+                datagov_rate_observation = None
+            if len(response.body) > attempt_limits.max_response_bytes:
+                limit_code = (
+                    "AGGREGATE_RESPONSE_LIMIT"
+                    if remaining_aggregate_bytes < self._limits.max_response_bytes
+                    else "RESPONSE_LIMIT"
+                )
+                self._raise_peer_failure(
+                    limit_code,
+                    "response bodies exceeded the active cumulative byte limit",
+                    peer_attempts,
+                    hops,
+                )
+            content_length = self._response_header(response, "content-length", peer_attempts, hops)
+            declared_length: int | None = None
+            if content_length is not None:
+                # The same canonical spelling ``Content-Range`` is held to, and for the same
+                # reason: ``int`` accepts ``+10`` and ``10_000`` and a leading zero, none of
+                # which is a Content-Length, and one declared length should have one spelling
+                # in the sealed evidence.  Nothing downstream trusted the parsed value over
+                # ``len(response.body)``, so this closes an inconsistency rather than a hole --
+                # but the inconsistency is on the surface where exactness is the whole control.
+                if not _DECIMAL_ONLY.fullmatch(content_length):
+                    self._raise_peer_failure(
+                        "CONTENT_LENGTH",
+                        "response content length is invalid",
+                        peer_attempts,
+                        hops,
+                    )
+                declared_length = int(content_length)
+                if declared_length < 0 or declared_length > attempt_limits.max_response_bytes:
+                    self._raise_peer_failure(
+                        "RESPONSE_LIMIT",
+                        "declared response length exceeds the remaining cumulative limit",
+                        peer_attempts,
+                        hops,
+                    )
+                if declared_length != len(response.body):
+                    self._raise_peer_failure(
+                        "CONTENT_LENGTH",
+                        "response bytes do not match declared content length",
+                        peer_attempts,
+                        hops,
+                    )
+            content_encoding = (
+                (self._response_header(response, "content-encoding", peer_attempts, hops) or "")
+                .lower()
+                .strip()
+            )
+            if content_encoding not in _ALLOWED_RESPONSE_ENCODINGS:
+                self._raise_peer_failure(
+                    "CONTENT_ENCODING",
+                    "compressed network responses are disabled at this boundary",
+                    peer_attempts,
+                    hops,
+                )
+            observed_content_range = self._response_header(
+                response, "content-range", peer_attempts, hops
+            )
+            hop = RetrievalHop(
+                url=target.normalized_url,
+                resolution_digest=target.resolution_digest,
+                connected_peer=peer,
+                status=response.status,
+                response_headers_digest=canonical_sha256(normalized_headers),
+                response_body_size_bytes=len(response.body),
+                response_body_sha256=sha256_bytes(response.body),
+                requested_range=byte_range.header_value if byte_range is not None else None,
+                observed_content_range=observed_content_range,
+                etag=self._response_header(response, "etag", peer_attempts, hops),
+                last_modified=self._response_header(response, "last-modified", peer_attempts, hops),
+                peer_attempts=tuple(peer_attempts),
+            )
+            hops.append(hop)
+            # The delivery check.  A slice is delivered only when the server answered 206,
+            # named exactly the span that was ordered, and shipped exactly that many bytes.
+            # It sits here, with the other response-integrity controls (status, declared
+            # length, encoding, media type, peer), because a response must clear all of them
+            # before anything downstream is allowed to treat it as content -- and it runs
+            # before the redirect branch below, because a ranged request is never followed.
+            #
+            # What this check cannot do: the content range can match, the three lengths can
+            # agree, and the bytes can still be the wrong bytes -- a stale cache, a re-issued
+            # object, a mirror that skewed.  HTTP carries no evidence that would detect that,
+            # and nothing here closes that case.  Two controls behind the sandbox boundary
+            # divide what is left, and neither is the other.  ``check_grib_message`` proves
+            # the framing, which is what a window at the wrong offset breaks.
+            # ``check_grib_reference_time`` proves the delivered message came from the model
+            # run the order named, which is what a re-issued object or a lagging mirror
+            # breaks; it runs only when the order named a run.  A different object of the
+            # *same* run is covered by none of the three, and ``acquisition.ranges`` says so
+            # where those two are defined.
+            complete_size_bytes: int | None = None
+            if byte_range is not None:
+                if response.status in REDIRECT_STATUSES:
+                    self._raise_peer_failure(
+                        "REDIRECT_ON_RANGE",
+                        "a ranged request is never followed through a redirect",
+                        peer_attempts,
+                        hops,
+                    )
+                if 200 <= response.status <= 299 and response.status != PARTIAL_CONTENT_STATUS:
+                    self._raise_peer_failure(
+                        "RANGE_IGNORED",
+                        f"source answered a ranged request with status {response.status}",
+                        peer_attempts,
+                        hops,
+                    )
+                if response.status == PARTIAL_CONTENT_STATUS:
+                    content_type = self._response_header(
+                        response, "content-type", peer_attempts, hops
+                    )
+                    try:
+                        parsed_media_type = _media_type(content_type)
+                    except AcquisitionSecurityError as exc:
+                        self._raise_peer_failure(exc.code, exc.detail, peer_attempts, hops)
+                    if parsed_media_type == _MULTIPART_BYTERANGES:
+                        self._raise_peer_failure(
+                            "MULTIPART_RANGE",
+                            "multipart byte-range responses are refused at this boundary",
+                            peer_attempts,
+                            hops,
+                        )
+                    try:
+                        first_byte, last_byte, complete_size_bytes = _parse_content_range(
+                            observed_content_range
+                        )
+                    except AcquisitionSecurityError as exc:
+                        self._raise_peer_failure(exc.code, exc.detail, peer_attempts, hops)
+                    if first_byte != byte_range.first_byte or last_byte != byte_range.last_byte:
+                        self._raise_peer_failure(
+                            "RANGE_MISMATCH",
+                            "response content range is not the range that was ordered",
+                            peer_attempts,
+                            hops,
+                        )
+                    delivered_length = last_byte - first_byte + 1
+                    # Three lengths must agree: the span the server named, the length it
+                    # declared, and the bytes that arrived.  The declared-versus-body leg is
+                    # already enforced above; it is restated against the span here so the
+                    # whole agreement is stated in one place rather than inferred across two.
+                    if delivered_length != len(response.body) or (
+                        declared_length is not None and declared_length != delivered_length
+                    ):
+                        self._raise_peer_failure(
+                            "RANGE_LENGTH",
+                            "response bytes do not match the content range they claim",
+                            peer_attempts,
+                            hops,
+                        )
+            elif response.status == PARTIAL_CONTENT_STATUS:
+                self._raise_peer_failure(
+                    "UNSOLICITED_RANGE",
+                    "source returned partial content for a request that ordered no range",
+                    peer_attempts,
+                    hops,
+                )
+            if response.status in REDIRECT_STATUSES:
+                location = self._response_header(response, _REDIRECT_HEADER, peer_attempts, hops)
+                if not location:
+                    self._raise_peer_failure(
+                        "REDIRECT_LOCATION",
+                        "redirect response has no location",
+                        peer_attempts,
+                        hops,
+                    )
+                if redirect_count >= redirect_budget:
+                    self._raise_peer_failure(
+                        "REDIRECT_LIMIT",
+                        "response exceeded the redirect limit",
+                        peer_attempts,
+                        hops,
+                    )
+                current_url = urljoin(target.normalized_url, location)
+                continue
+            # A 404 gets its own code.  This is not a softening -- the retrieval still fails
+            # closed here -- but an availability survey has to tell "this cycle is not
+            # published yet" from "this source is broken", and it must do that from a typed
+            # code rather than by matching an error message.  Every other status stays
+            # generic.
+            datagov_non_success = datagov_authorization is not None and response.status in {
+                403,
+                429,
+            }
+            if response.status == NOT_FOUND_STATUS:
+                self._raise_peer_failure(
+                    HTTP_NOT_FOUND,
+                    f"source returned HTTP status {response.status}",
+                    peer_attempts,
+                    hops,
+                )
+            if not 200 <= response.status <= 299 and not datagov_non_success:
+                self._raise_peer_failure(
+                    "HTTP_STATUS",
+                    f"source returned HTTP status {response.status}",
+                    peer_attempts,
+                    hops,
+                )
+            content_type = self._response_header(response, "content-type", peer_attempts, hops)
+            try:
+                media_type = _media_type(content_type)
+            except AcquisitionSecurityError as exc:
+                self._raise_peer_failure(exc.code, exc.detail, peer_attempts, hops)
+            # Exempted for a presence probe only, and only because a probe keeps nothing: see
+            # ``probe_presence``.  Every acquiring call reaches here through ``retrieve``,
+            # where ``presence_probe`` is a literal ``False`` rather than an argument.
+            if not presence_probe and media_type not in self._limits.allowed_media_types:
+                self._raise_peer_failure(
+                    "MEDIA_TYPE",
+                    f"response media type {media_type!r} is not allowlisted",
+                    peer_attempts,
+                    hops,
+                )
+            evidence_digest = canonical_sha256([item.to_dict() for item in hops])
+            return RetrievedBytes(
+                source_url=url,
+                final_url=target.normalized_url,
+                media_type=media_type,
+                content=response.body,
+                content_sha256=sha256_bytes(response.body),
+                hops=tuple(hops),
+                transport_evidence_digest=evidence_digest,
+                complete_size_bytes=complete_size_bytes,
+                rate_observation=datagov_rate_observation,
+            )
+        raise AcquisitionSecurityError("REDIRECT_LIMIT", "redirect loop did not terminate")
+
+    def _check_total_timeout(self, started: float) -> None:
+        if float(self._clock()) - started > self._limits.total_timeout_seconds:
+            raise AcquisitionSecurityError(
+                "TOTAL_TIMEOUT",
+                "retrieval exceeded its total time budget",
+            )
+
+    def _remaining_attempt_limits(
+        self,
+        deadline: float,
+        *,
+        remaining_aggregate_bytes: int,
+    ) -> RetrievalLimits:
+        remaining = deadline - float(self._clock())
+        if remaining <= 0:
+            raise AcquisitionSecurityError(
+                "TOTAL_TIMEOUT",
+                "retrieval exceeded its total time budget",
+            )
+        if remaining_aggregate_bytes <= 0:
+            raise AcquisitionSecurityError(
+                "AGGREGATE_RESPONSE_LIMIT",
+                "retrieval exhausted its aggregate response-body budget",
+            )
+        return replace(
+            self._limits,
+            max_response_bytes=min(self._limits.max_response_bytes, remaining_aggregate_bytes),
+            max_aggregate_response_bytes=remaining_aggregate_bytes,
+            connect_timeout_seconds=min(self._limits.connect_timeout_seconds, remaining),
+            read_timeout_seconds=min(self._limits.read_timeout_seconds, remaining),
+            total_timeout_seconds=remaining,
+        )
+
+    @staticmethod
+    def _raise_peer_failure(
+        code: str,
+        detail: str,
+        peer_attempts: list[PeerAttempt],
+        hops: list[RetrievalHop],
+    ) -> None:
+        latest = peer_attempts[-1]
+        peer_attempts[-1] = PeerAttempt(
+            approved_ip=latest.approved_ip,
+            outcome="response_failure",
+            failure_code=code,
+            response_body_size_bytes=latest.response_body_size_bytes,
+        )
+        raise PeerAttemptError(code, detail, tuple(peer_attempts), hops=tuple(hops))
+
+    def _response_header(
+        self,
+        response: TransportResponse,
+        name: str,
+        peer_attempts: list[PeerAttempt],
+        hops: list[RetrievalHop],
+    ) -> str | None:
+        try:
+            return response.header(name)
+        except AcquisitionSecurityError as exc:
+            self._raise_peer_failure(exc.code, exc.detail, peer_attempts, hops)
+
+
+class _PinnedHTTPSConnection(http.client.HTTPSConnection):
+    """One non-pooled connection to a validated IP with hostname TLS verification."""
+
+    def __init__(
+        self,
+        *,
+        hostname: str,
+        approved_ip: str,
+        port: int,
+        timeout: float,
+        context: ssl.SSLContext,
+    ) -> None:
+        super().__init__(host=hostname, port=port, timeout=timeout, context=context)
+        self._approved_ip = approved_ip
+        self.connected_peer: str | None = None
+
+    def connect(self) -> None:
+        raw_socket = socket.create_connection(
+            (self._approved_ip, self.port),
+            timeout=self.timeout,
+        )
+        try:
+            peer = raw_socket.getpeername()[0]
+            self.connected_peer = require_approved_peer(
+                ValidatedTarget(
+                    original_url=f"https://{self.host}/",
+                    normalized_url=f"https://{self.host}/",
+                    hostname=self.host,
+                    port=self.port,
+                    approved_ips=(self._approved_ip,),
+                    resolution_digest=canonical_sha256(
+                        {
+                            "hostname": self.host,
+                            "port": self.port,
+                            "approved_ips": [self._approved_ip],
+                        }
+                    ),
+                ),
+                peer,
+            )
+            self.sock = self._context.wrap_socket(raw_socket, server_hostname=self.host)
+        except BaseException:
+            raw_socket.close()
+            raise
+
+
+class StdlibPinnedTransport:
+    """Production transport with no environment-proxy integration or connection pooling."""
+
+    def __init__(self, *, ssl_context: ssl.SSLContext | None = None) -> None:
+        self._context = ssl_context or ssl.create_default_context()
+        if (
+            self._context.check_hostname is not True
+            or self._context.verify_mode != ssl.CERT_REQUIRED
+        ):
+            raise AcquisitionSecurityError(
+                "TLS_CONTEXT",
+                "TLS context must require certificate and hostname verification",
+            )
+
+    def request(
+        self,
+        target: ValidatedTarget,
+        *,
+        approved_ip: str,
+        headers: Mapping[str, str],
+        limits: RetrievalLimits,
+        byte_range: ByteRange | None = None,
+    ) -> TransportResponse:
+        outgoing = dict(headers)
+        if byte_range is not None:
+            outgoing["Range"] = byte_range.header_value
+        attempt_deadline = time.monotonic() + limits.total_timeout_seconds
+        connection = _PinnedHTTPSConnection(
+            hostname=target.hostname,
+            approved_ip=approved_ip,
+            port=target.port,
+            timeout=min(limits.connect_timeout_seconds, limits.total_timeout_seconds),
+            context=self._context,
+        )
+        total = 0
+        try:
+            connection.request("GET", target.request_target, headers=outgoing)
+            if connection.sock is not None:
+                connection.sock.settimeout(
+                    _remaining_socket_timeout(
+                        attempt_deadline,
+                        configured=limits.read_timeout_seconds,
+                    )
+                )
+            response = connection.getresponse()
+            raw_headers = tuple(
+                (key.lower(), value.strip()) for key, value in response.getheaders()
+            )
+            _validate_response_headers(raw_headers)
+            content_length = next(
+                (value for key, value in raw_headers if key == "content-length"),
+                None,
+            )
+            if content_length is not None:
+                try:
+                    if int(content_length) > limits.max_response_bytes:
+                        raise AcquisitionSecurityError(
+                            "RESPONSE_LIMIT",
+                            "declared response length exceeds the configured limit",
+                        )
+                except ValueError:
+                    raise AcquisitionSecurityError(
+                        "CONTENT_LENGTH",
+                        "response content length is invalid",
+                    ) from None
+            chunks: list[bytes] = []
+            while True:
+                if connection.sock is not None:
+                    connection.sock.settimeout(
+                        _remaining_socket_timeout(
+                            attempt_deadline,
+                            configured=limits.read_timeout_seconds,
+                        )
+                    )
+                chunk = response.read(min(65_536, limits.max_response_bytes + 1 - total))
+                if not chunk:
+                    break
+                total += len(chunk)
+                if total > limits.max_response_bytes:
+                    raise AcquisitionSecurityError(
+                        "RESPONSE_LIMIT",
+                        "response exceeded the configured byte limit",
+                    )
+                chunks.append(chunk)
+            peer = connection.connected_peer
+            if peer is None:
+                raise AcquisitionSecurityError(
+                    "PEER_ADDRESS",
+                    "transport did not record its connected peer",
+                )
+            return TransportResponse(
+                status=response.status,
+                headers=raw_headers,
+                body=b"".join(chunks),
+                connected_peer=peer,
+                tls_verified=True,
+                hostname_verified=True,
+            )
+        except ssl.SSLError as exc:
+            raise AcquisitionSecurityError(
+                "TLS_VERIFICATION",
+                f"HTTPS TLS verification failed: {type(exc).__name__}",
+            ) from None
+        except http.client.IncompleteRead as exc:
+            partial = exc.partial if isinstance(exc.partial, bytes) else bytes(exc.partial)
+            raise TransportFailureError(
+                f"HTTPS peer disconnected during a response: {type(exc).__name__}",
+                response_body_size_bytes=total + len(partial),
+            ) from None
+        except http.client.RemoteDisconnected as exc:
+            raise TransportFailureError(
+                f"HTTPS peer disconnected before a response: {type(exc).__name__}",
+                response_body_size_bytes=total,
+            ) from None
+        except http.client.HTTPException as exc:
+            raise AcquisitionSecurityError(
+                "RESPONSE_HEADERS",
+                f"HTTPS response protocol failed: {type(exc).__name__}",
+            ) from None
+        except OSError as exc:
+            raise TransportFailureError(
+                f"HTTPS transport failed: {type(exc).__name__}",
+                response_body_size_bytes=total,
+            ) from None
+        finally:
+            connection.close()
+
+
+def _remaining_socket_timeout(deadline: float, *, configured: float) -> float:
+    remaining = deadline - time.monotonic()
+    if remaining <= 0:
+        raise AcquisitionSecurityError(
+            "TOTAL_TIMEOUT",
+            "retrieval exceeded its total time budget",
+        )
+    return min(configured, remaining)
+
+
+def _datagov_rate_observation(response: TransportResponse) -> DatagovRateObservation | None:
+    """Parse only the bounded numeric Data.gov rate headers; retain no arbitrary headers."""
+
+    limit = response.header("x-ratelimit-limit")
+    remaining = response.header("x-ratelimit-remaining")
+    retry_after = response.header("retry-after")
+    reset = response.header("x-ratelimit-reset")
+    if limit is None and remaining is None and retry_after is None and reset is None:
+        return None
+    if limit is None or remaining is None:
+        raise AcquisitionSecurityError(
+            "DATAGOV_RATE", "Data.gov rate limit and remaining headers must appear together"
+        )
+
+    def bounded_decimal(value: str, *, name: str, maximum: int) -> int:
+        if not _DECIMAL_ONLY.fullmatch(value):
+            raise AcquisitionSecurityError("DATAGOV_RATE", f"{name} is not a bounded integer")
+        parsed = int(value)
+        if parsed > maximum:
+            raise AcquisitionSecurityError("DATAGOV_RATE", f"{name} is outside its bound")
+        return parsed
+
+    return DatagovRateObservation(
+        limit=bounded_decimal(limit, name="X-RateLimit-Limit", maximum=1_000_000_000),
+        remaining=bounded_decimal(remaining, name="X-RateLimit-Remaining", maximum=1_000_000_000),
+        retry_after_seconds=(
+            None
+            if retry_after is None
+            else bounded_decimal(
+                retry_after,
+                name="Retry-After",
+                maximum=MAX_DATAGOV_RATE_SECONDS,
+            )
+        ),
+        reset_epoch_seconds=(
+            None
+            if reset is None
+            else bounded_decimal(reset, name="X-RateLimit-Reset", maximum=(1 << 53) - 1)
+        ),
+    )
+
+
+def seal_content_addressed_snapshot(
+    root: Path,
+    *,
+    content: bytes,
+    suffix: str,
+) -> Path:
+    """Seal exact bytes, refusing a digest withdrawn by governed deletion."""
+
+    if not root.is_absolute():
+        raise AcquisitionSecurityError("SNAPSHOT_ROOT", "snapshot root must be absolute")
+    if not _is_allowlisted_snapshot_suffix(suffix):
+        raise AcquisitionSecurityError("SNAPSHOT_SUFFIX", "snapshot suffix is not allowlisted")
+    digest = sha256_bytes(content)
+    final_name = f"{digest}.{suffix}"
+    directory_flags = os.O_RDONLY | getattr(os, "O_DIRECTORY", 0) | getattr(os, "O_NOFOLLOW", 0)
+    try:
+        root_fd = os.open(root, directory_flags)
+    except OSError:
+        raise AcquisitionSecurityError(
+            "SNAPSHOT_ROOT",
+            "snapshot root must be an existing non-symlink directory",
+        ) from None
+    temporary_name = f".stage-{os.getpid()}-{threading.get_ident()}-{time.monotonic_ns()}"
+    file_flags = os.O_WRONLY | os.O_CREAT | os.O_EXCL | getattr(os, "O_NOFOLLOW", 0)
+    temporary_fd: int | None = None
+    try:
+        root_info = os.fstat(root_fd)
+        ownership_policy = (root_info.st_uid, root_info.st_gid)
+        with _serialized_snapshot_seal(
+            root_fd,
+            root_info.st_dev,
+            root_info.st_ino,
+            final_name,
+        ):
+            evidence_root = configured_retention_evidence_root(root)
+            if evidence_root is not None:
+                require_snapshot_admission(
+                    evidence_root=evidence_root,
+                    content_sha256=digest,
+                )
+            try:
+                try:
+                    _read_existing_digest_snapshot(
+                        root_fd,
+                        final_name,
+                        expected_content=content,
+                        expected_digest=digest,
+                        ownership_policy=ownership_policy,
+                    )
+                except FileNotFoundError:
+                    pass
+                else:
+                    return root / final_name
+                temporary_fd = os.open(
+                    temporary_name,
+                    file_flags,
+                    0o600,
+                    dir_fd=root_fd,
+                )
+                view = memoryview(content)
+                written = 0
+                while written < len(view):
+                    count = os.write(temporary_fd, view[written:])
+                    if count <= 0:
+                        raise AcquisitionSecurityError(
+                            "SNAPSHOT_WRITE",
+                            "snapshot write made no progress",
+                        )
+                    written += count
+                os.fchmod(temporary_fd, 0o444)
+                os.fsync(temporary_fd)
+                os.close(temporary_fd)
+                temporary_fd = None
+                try:
+                    os.link(
+                        temporary_name,
+                        final_name,
+                        src_dir_fd=root_fd,
+                        dst_dir_fd=root_fd,
+                        follow_symlinks=False,
+                    )
+                except FileExistsError:
+                    _read_existing_digest_snapshot(
+                        root_fd,
+                        final_name,
+                        expected_content=content,
+                        expected_digest=digest,
+                        ownership_policy=ownership_policy,
+                    )
+                os.unlink(temporary_name, dir_fd=root_fd)
+                # The staging name is deliberately visible for the shortest possible interval,
+                # but a same-UID directory racer can still link that inode while it is visible.
+                # Authenticate the published name only after our staging link is gone: nlink must
+                # now be exactly one, and the stable-descriptor check below also rebinds kind,
+                # mode, owner, size, name and digest.
+                _read_existing_digest_snapshot(
+                    root_fd,
+                    final_name,
+                    expected_content=content,
+                    expected_digest=digest,
+                    ownership_policy=ownership_policy,
+                )
+                os.fsync(root_fd)
+                return root / final_name
+            finally:
+                # Inside the per-target lock: the staging entry must be gone before the next
+                # sealer of this same digest observes the published name, or that sealer sees
+                # our second link and refuses a file we are in the middle of publishing.
+                if temporary_fd is not None:
+                    os.close(temporary_fd)
+                with contextlib.suppress(FileNotFoundError):
+                    os.unlink(temporary_name, dir_fd=root_fd)
+    finally:
+        os.close(root_fd)
+
+
+# The cross-process half's lock file sits beside the staging entries, under a prefix that no
+# content-addressed name can take: a snapshot is `<64 hex>.<suffix>`, and `sources.deletion`
+# matches removable names against exactly that.  It is created while a name is held and unlinked
+# when it is released, so a settled root holds snapshots and nothing else.
+SNAPSHOT_LOCK_PREFIX = ".seal-lock-"
+# The backoff that keeps re-taking a moved lock file from being a spin.  Every release destroys the
+# file, so one release wakes every waiter at once and all but one of them find a name that has
+# moved -- a herd that re-races itself.  Measured at a deliberately lowered ceiling of 32, sixteen
+# processes holding for 0.3 ms over 400 rounds each: 1117-1270 losses that deep without a backoff,
+# 139-152 with one, an 8x reduction.  There is deliberately no ceiling above it; see
+# :func:`_hold_snapshot_lock`.
+SNAPSHOT_LOCK_BACKOFF_SECONDS = 0.0002
+MAX_SNAPSHOT_LOCK_BACKOFF = 0.005
+# The one thing the unbounded retry still has to give up on: a root directory removed out from
+# under the descriptor answers every ``O_CREAT`` open with the same ``ENOENT``, forever.  Only
+# CONSECUTIVE losses on that branch are counted, and the deepest streak observed under real
+# contention was four, so this is sixty-four times the worst measured case.
+MAX_CONSECUTIVE_VANISHED_LOCK_OPENS = 256
+
+# One lock per (snapshot root inode, final name), created on demand and dropped when the last
+# holder leaves, so the registry cannot grow with the number of digests a long-lived process
+# seals.  Keying on the root's device and inode rather than its pathname means two spellings of
+# one directory serialize together, which is exactly the contention that matters.
+_SNAPSHOT_SEAL_REGISTRY_GUARD = threading.Lock()
+_SNAPSHOT_SEAL_LOCKS: dict[tuple[int, int, str], tuple[threading.Lock, int]] = {}
+
+
+@contextlib.contextmanager
+def _serialized_snapshot_seal(
+    root_fd: int,
+    root_device: int,
+    root_inode: int,
+    final_name: str,
+) -> Iterator[None]:
+    """Hold one content-addressed name against every other writer of it, in and out of process.
+
+    Publishing is ``link(stage, final)`` followed by ``unlink(stage)``, and non-overwriting
+    publication has no primitive that skips that pair: ``rename`` would clobber whatever already
+    holds the name, which is the one thing this sealer must never do.  So between those two calls
+    the published inode legitimately carries two links, and a second sealer of the *same* bytes --
+    same content, therefore same digest, therefore same final name -- that reads the name in that
+    window sees ``st_nlink == 2`` and refuses a snapshot that is merely mid-publication.  A
+    remover of that name is the mirror of it: an ``unlink`` inside the read window moves
+    ``st_nlink`` from 1 to 0 under the open descriptor, which is the ``changed during validation``
+    refusal issue #209 reported.
+
+    Neither refusal is relaxed here, and neither may be: a second link on the published inode is
+    exactly how a same-UID racer keeps a writable alias to a sealed snapshot, and a name that
+    vanishes mid-read is exactly what a rebind looks like from the inside.  What is removed is the
+    benign racer.  Writers of one name take turns, so the next one arrives after the last has
+    unlinked its stage and finds a settled, single-linked file through the ordinary already-exists
+    path.  Serializing also stops N sealers from each writing N full copies of the same
+    multi-gigabyte snapshot.
+
+    **Two locks, because there are two kinds of racer.**  The ``threading.Lock`` below excludes
+    other threads of this interpreter.  It cannot exclude other PROCESSES, and those are real: the
+    hosted crawler and the CLI seal into one snapshot root, and #229 shipped the thread half alone
+    and named this as the residual it left open.  Measured on macOS/APFS, six processes sealing
+    identical bytes into one root over 24 rounds refused 5 to 7 of 144 attempts, every one of them
+    ``st_nlink 2 != 1``.  The second half is an ``flock`` on a per-name lock file beside the
+    staging area, taken by :func:`_hold_snapshot_lock`.
+
+    Order is fixed -- threads first, then the file -- and only ever one name is held, so nothing
+    can wait on a cycle.  ``sources.deletion`` takes the same pair through
+    :func:`exclusive_content_addressed_name` before it removes a snapshot, which is what stops the
+    harness racing its own retention sweep; while it holds one it may take a *second* name under
+    its evidence root to seal a tombstone, and that direction is the only nesting in the tree.
+
+    Neither wait is bounded.  A holder finishes on its own -- the kernel drops an ``flock`` when
+    its holder dies -- but "finishes" is measured in the payload: a seal or a governed deletion of
+    a multi-gigabyte snapshot holds its name for the full write or re-hash plus its fsyncs, which
+    is seconds on local disk and longer on slow storage, and every same-name waiter waits it out.
+    A deadline here would have to choose between refusing an acquisition that is merely queued and
+    admitting a second writer of a name that is mid-publication, so there is none.
+    """
+
+    key = (root_device, root_inode, final_name)
+    with _SNAPSHOT_SEAL_REGISTRY_GUARD:
+        lock, holders = _SNAPSHOT_SEAL_LOCKS.get(key, (threading.Lock(), 0))
+        _SNAPSHOT_SEAL_LOCKS[key] = (lock, holders + 1)
+    try:
+        # Acquiring inside this ``try``, and releasing through ``with``, is what keeps the
+        # registry honest.  A signal delivered during the blocking acquire would otherwise skip
+        # the bookkeeping below and strand this key's entry -- held, in the worst case -- for the
+        # life of the process.
+        lock_name = f"{SNAPSHOT_LOCK_PREFIX}{final_name}"
+        with lock:
+            # The same shape as the comment above, one level down and with a worse consequence.
+            # ``descriptor`` is bound inside this ``try`` so that a signal delivered between the
+            # acquire returning and the release being armed does not strand an ``flock`` -- which,
+            # unlike a thread lock, no other process can break for the life of this one.  This
+            # narrows that window to the bytecode between the call returning and the store; it
+            # does not close it, because the eval breaker is still checked there.
+            descriptor: int | None = None
+            try:
+                descriptor = _hold_snapshot_lock(root_fd, lock_name)
+                yield
+            finally:
+                if descriptor is not None:
+                    _release_snapshot_lock(root_fd, lock_name, descriptor)
+    finally:
+        with _SNAPSHOT_SEAL_REGISTRY_GUARD:
+            held, holders = _SNAPSHOT_SEAL_LOCKS[key]
+            if holders <= 1:
+                del _SNAPSHOT_SEAL_LOCKS[key]
+            else:
+                _SNAPSHOT_SEAL_LOCKS[key] = (held, holders - 1)
+
+
+@contextlib.contextmanager
+def exclusive_content_addressed_name(root: Path, name: str) -> Iterator[None]:
+    """Hold ``name`` under ``root`` against every sealer and remover of it, in and out of process.
+
+    The seam :mod:`mostlyright.data_harness.sources.deletion` reaches for.  Removing a published
+    snapshot and validating one are the same window from opposite ends -- an ``unlink`` between a
+    validator's two observations of its descriptor is the ``st_nlink 1 -> 0`` drift of #209 -- and
+    a remover that takes this cannot land inside a sealer's read, or a sealer inside its removal.
+    It is the same pair of locks :func:`_serialized_snapshot_seal` takes, keyed the same way, so
+    the two paths exclude each other rather than each other's copy.
+
+    The key is the root's device and inode, read from this function's own descriptor.  A caller
+    that re-opens the root by pathname afterwards is holding a lock on the directory this saw,
+    which is the directory that name resolved to when the lock was taken; if the pathname is
+    rebound in between, the caller validates a different directory than the one locked.  Nothing
+    in this tree does that on purpose -- the caller that exists,
+    :meth:`~mostlyright.data_harness.sources.deletion.DeletionCoordinator.delete`, re-validates
+    its target by identity and refuses anything that moved -- and a caller that wants the
+    guarantee outright should hand its own descriptor down rather than a path.
+    """
+
+    if not root.is_absolute():
+        raise AcquisitionSecurityError("SNAPSHOT_ROOT", "snapshot root must be absolute")
+    if name in {"", ".", ".."} or name != PurePosixPath(name).name:
+        raise AcquisitionSecurityError(
+            "SNAPSHOT_NAME",
+            "content-addressed name must be one path component",
+        )
+    directory_flags = os.O_RDONLY | getattr(os, "O_DIRECTORY", 0) | getattr(os, "O_NOFOLLOW", 0)
+    try:
+        root_fd = os.open(root, directory_flags)
+    except OSError:
+        raise AcquisitionSecurityError(
+            "SNAPSHOT_ROOT",
+            "snapshot root must be an existing non-symlink directory",
+        ) from None
+    try:
+        root_info = os.fstat(root_fd)
+        with _serialized_snapshot_seal(root_fd, root_info.st_dev, root_info.st_ino, name):
+            yield
+    finally:
+        os.close(root_fd)
+
+
+def _hold_snapshot_lock(root_fd: int, lock_name: str) -> int:
+    """Take the cross-process half of the per-name lock, and prove it is still that name's.
+
+    ``flock`` binds an inode, not a name, so a lock file that is unlinked while a waiter is
+    blocked on it leaves that waiter holding an inode no longer reachable through the name --
+    while a newcomer creates a fresh file at the name and takes it uncontended.  Two holders, no
+    exclusion.  The published fix for that is here: unlink only while holding the lock (see
+    :func:`_release_snapshot_lock`), and after acquiring, re-read the name and accept only if it
+    still resolves to the inode just locked.  Anything else means the file was replaced under the
+    wait, so drop it and take the new one.
+
+    ``ENOENT`` from an ``O_CREAT`` open is part of that same race rather than a fault.  Measured
+    on macOS/APFS, six processes opening and unlinking one name 4,000 times each took a transient
+    ``ENOENT`` on 17 to 26 percent of opens -- the entry is found and then removed before the open
+    completes -- so it is retried, not refused.  Every other errno is refused: an unreadable entry
+    at this name is not contention, and ``O_NOFOLLOW`` makes a symlink here ``ELOOP`` rather than
+    something to follow.
+
+    **Queueing is not bounded, and a ceiling on it would be a bug.**  Losing the name is
+    queueing, not tampering, and every loss means some other holder had it -- so a ceiling refuses
+    a byte-correct snapshot for being popular, which is the class of false refusal #209 is about.
+    An earlier revision capped total attempts at 1024 and an independent review measured the cap
+    being spent by ordinary contention.  What a ceiling would otherwise guard against is a hot
+    loop, and :func:`_snapshot_lock_backoff` rules that out: every retry sleeps, so this waits at
+    a bounded rate exactly as the ``flock`` above waits without one.  A same-UID racer rewriting
+    this name in a loop can stall a caller here, which is strictly less than the stall it can
+    already impose by holding the lock and never releasing it.
+
+    **One state is not queueing, and it does end the wait.**  ``openat`` answers ``ENOENT`` both
+    when a holder unlinked as this open resolved the name and when the directory ``root_fd``
+    names has been REMOVED -- and the second is permanent for the life of that descriptor, so
+    retrying it never terminates.  Nothing hostile is needed to reach it: a caller queued behind
+    a multi-gigabyte seal holds a ``root_fd`` that a sweep of the acquisition boundary
+    invalidates, and neither ``st_nlink`` nor ``stat(".", dir_fd=...)`` tells the two apart on
+    APFS.  So consecutive losses on that branch alone are counted against
+    :data:`MAX_CONSECUTIVE_VANISHED_LOCK_OPENS`, and any other outcome resets the count: a queued
+    caller keeps an unbounded wait, and a vanished root gets a prompt, typed refusal.
+
+    ``O_NONBLOCK`` is not optional and is here for the reason it is on the snapshot read at
+    :func:`_read_existing_digest_snapshot`: opening a FIFO read-only BLOCKS in the kernel until a
+    writer arrives, and nothing on this path holds a deadline.  Without it a same-UID racer could
+    leave one ``mkfifo`` at this name and wedge every sealer and every governed deletion of that
+    digest for the life of the process -- an artifact that outlives the racer, that
+    ``sources.deletion`` cannot remove because it matches only ``<64 hex>.<suffix>``, and that no
+    kind check can reach because the open never returns.
+
+    The kind is bound too, and it is bound before the wait: a FIFO opens without blocking under
+    ``O_NONBLOCK``, and an exclusive ``flock`` already held on a hostile FIFO would otherwise
+    queue this caller behind a live racer instead of refusing -- the kind check exists to refuse
+    exactly that, so it runs on the descriptor before the lock is asked for.  A directory at this
+    name refuses at the open itself, because the descriptor is opened for writing.
+
+    It is opened for writing -- ``O_RDWR``, never ``O_RDONLY`` -- even though nothing is ever
+    written through it, because an exclusive ``flock`` is emulated as a whole-file write lock on
+    NFS and refuses a read-only descriptor with ``EBADF``.  Every other regular-file lock in this
+    tree already opens ``O_RDWR`` for this reason, ``review``'s publication lock and
+    ``FileCapStore.lock`` among them.
+
+    None of this is a security control.  The stat binding in
+    :func:`_read_existing_digest_snapshot` is what refuses a hostile link, and it is untouched by
+    anything here; a same-UID racer squatting this name can withhold the lock, which costs
+    availability that a same-UID racer in the snapshot root already has by other means.
+
+    **What the storage has to be.**  ``flock`` is a POSIX advisory lock, so the snapshot root has
+    to sit on a filesystem that honours it, exactly as ``FileCapStore`` requires of the volume it
+    is pointed at.  A Cloud Storage bucket mounted with gcsfuse is not such a volume.  Nothing
+    here can detect the difference in advance, so a filesystem that refuses the lock refuses the
+    seal, with the errno in the message: sealing without exclusion is the state #209 was filed
+    about, and choosing it silently is not this function's call to make.
+
+    That is a widened requirement and it is worth stating plainly.  The lock file has to be
+    creatable, so sealing now needs write access to the snapshot root even on the path where the
+    snapshot is already published and nothing would be written -- a read-only root, or one whose
+    permissions were narrowed after the fact, refuses with ``EROFS`` or ``EACCES`` where it used
+    to return the existing path.
+
+    A refusal raised after the lock file is created leaves that file behind, because a caller that
+    could not establish it holds the name must not unlink a name it cannot prove is its own.  On a
+    volume that honours the lock the entry is inert and self-healing -- the next successful hold
+    of that digest adopts and removes it -- and one stray zero-byte file is the cheaper of the two
+    mistakes.  On a volume that refuses the lock outright no later hold ever succeeds, so a stray
+    left there is permanent until an operator removes it; the refusal that created it is the
+    signal that the volume cannot host this root at all.
+    """
+
+    if fcntl is None:  # pragma: no cover - POSIX-only path; sealing needs dir_fd links anyway
+        raise AcquisitionSecurityError(
+            "SNAPSHOT_LOCK",
+            "content-addressed sealing requires POSIX advisory locking",
+        )
+    flags = (
+        os.O_RDWR
+        | os.O_CREAT
+        | getattr(os, "O_NOFOLLOW", 0)
+        | getattr(os, "O_NONBLOCK", 0)
+        | getattr(os, "O_CLOEXEC", 0)
+    )
+    attempt = 0
+    vanished = 0
+    while True:
+        if attempt:
+            time.sleep(_snapshot_lock_backoff(attempt))
+        attempt += 1
+        try:
+            descriptor = os.open(lock_name, flags, 0o600, dir_fd=root_fd)
+        except FileNotFoundError:
+            # Two different states arrive here.  A holder unlinking as this open resolved the
+            # name is transient and must be retried; a root directory REMOVED out from under this
+            # descriptor gives the same errno forever, and retrying that is a spin with no end.
+            # Only consecutive losses are counted, so a caller merely queueing -- which never
+            # loses on this branch, it loses on the identity re-check below -- keeps its
+            # unbounded wait.  Sixteen and twenty-four processes contending on one name never ran
+            # a streak longer than four.
+            vanished += 1
+            if vanished > MAX_CONSECUTIVE_VANISHED_LOCK_OPENS:
+                raise AcquisitionSecurityError(
+                    "SNAPSHOT_LOCK",
+                    "snapshot name lock could not be created"
+                    " (the snapshot root no longer holds a name to lock)",
+                ) from None
+            continue
+        except OSError as error:
+            raise AcquisitionSecurityError(
+                "SNAPSHOT_LOCK",
+                "snapshot name lock is not a safe lock file"
+                f" (open refused: {_describe_os_error(error)})",
+            ) from None
+        try:
+            # Kind first, wait second: the descriptor's kind is a property of its inode and
+            # cannot change, and binding it before the flock means a hostile FIFO or directory
+            # already holding an exclusive lock is refused here rather than queued on -- the
+            # same order _require_readable_evidence_kind states for the evidence reads.
+            held = os.fstat(descriptor)
+            if not stat.S_ISREG(held.st_mode):
+                raise AcquisitionSecurityError(
+                    "SNAPSHOT_LOCK",
+                    "snapshot name lock is not a safe lock file"
+                    f" (kind {stat.S_IFMT(held.st_mode):#o} is not a regular file)",
+                )
+            fcntl.flock(descriptor, fcntl.LOCK_EX)
+            # An adopted stray keeps whatever mode its creator gave it; bind it to the mode a
+            # fresh create gets, the way the review publication lock does after its own flock.
+            os.fchmod(descriptor, 0o600)
+            try:
+                named: os.stat_result | None = os.stat(
+                    lock_name,
+                    dir_fd=root_fd,
+                    follow_symlinks=False,
+                )
+            except FileNotFoundError:
+                named = None
+        except OSError as error:
+            os.close(descriptor)
+            raise AcquisitionSecurityError(
+                "SNAPSHOT_LOCK",
+                f"snapshot name lock could not be taken ({_describe_os_error(error)})",
+            ) from None
+        except BaseException:
+            os.close(descriptor)
+            raise
+        vanished = 0
+        if named is not None and (named.st_dev, named.st_ino) == (held.st_dev, held.st_ino):
+            return descriptor
+        os.close(descriptor)
+
+
+def _snapshot_lock_backoff(attempt: int) -> float:
+    """Grow the wait between attempts, and spread it so the woken herd does not re-race in step.
+
+    The spread is derived from the caller's process and thread rather than from :mod:`random`,
+    which nothing in this package imports: what has to differ between two waiters is their phase,
+    not the unpredictability of it, and a deterministic function of identifiers that already
+    differ gives exactly that while leaving the sealer's behaviour reproducible.  Only timing
+    depends on it -- never which caller wins, and never what is accepted.
+
+    Between PROCESSES the pid does all of the work.  ``threading.get_ident()`` was measured
+    identical in eight separate interpreters on macOS, so the thread half separates threads and
+    nothing else -- which is the half that matters least, because threads of one process are
+    already serialized on this name before they reach here.  Over sixteen consecutive pids the
+    sixteen spreads are distinct at every attempt, and the delay stays inside its declared
+    bounds: 120 us to 4998 us against a 5000 us ceiling over the first hundred thousand attempts.
+    """
+
+    spread = (((os.getpid() ^ threading.get_ident()) * 2_654_435_761) + attempt * 40_503) % 1024
+    ceiling = min(attempt * SNAPSHOT_LOCK_BACKOFF_SECONDS, MAX_SNAPSHOT_LOCK_BACKOFF)
+    return ceiling * (0.5 + spread / 2048)
+
+
+def _release_snapshot_lock(root_fd: int, lock_name: str, descriptor: int) -> None:
+    """Drop the lock file and then the lock, in that order.
+
+    Unlinking first is what makes the identity re-check in :func:`_hold_snapshot_lock` sufficient:
+    the name can only stop resolving to this inode while this process still holds it, so no waiter
+    can be admitted on a stale inode.  Closing is what releases the ``flock``, so it comes second,
+    and that order is pinned by
+    ``tests/h3/test_http.py::test_the_name_lock_is_unlinked_before_the_lock_on_it_is_dropped``
+    rather than left to whoever edits these four lines next.  A settled root is left holding
+    snapshots and nothing else, which is the invariant the staging name already keeps.
+
+    Create-and-unlink is the harder of the two shapes a lock file can take, and it is chosen
+    deliberately.  ``FileCapStore.lock`` next door keeps one sidecar that is created once and
+    never replaced, which needs no protocol at all -- but there is one cap store and there is one
+    lock file per digest, and ``sources.deletion`` matches removable names against
+    ``<64 hex>.<suffix>`` alone, so a permanent sidecar per digest is an entry no governed path
+    could ever remove.  The protocol above is the price of not leaving those behind.
+
+    This runs from a ``finally``, so a failure to unlink is swallowed rather than allowed to
+    replace whatever the sealer was already reporting.  A lock file left behind costs one stray
+    entry; a raise here would turn a published snapshot into a refusal, or bury the refusal that
+    matters under a second one about a lock.  The close is what has to happen, and it does.
+    """
+
+    try:
+        with contextlib.suppress(OSError):
+            os.unlink(lock_name, dir_fd=root_fd)
+    finally:
+        os.close(descriptor)
+
+
+def _read_existing_digest_snapshot(
+    root_fd: int,
+    name: str,
+    *,
+    expected_content: bytes,
+    expected_digest: str,
+    ownership_policy: tuple[int, int],
+) -> None:
+    """Authenticate one already-named immutable snapshot without trusting its pathname."""
+
+    flags = (
+        os.O_RDONLY
+        | getattr(os, "O_NOFOLLOW", 0)
+        | getattr(os, "O_NONBLOCK", 0)
+        | getattr(os, "O_CLOEXEC", 0)
+    )
+    try:
+        descriptor = os.open(name, flags, dir_fd=root_fd)
+    except FileNotFoundError:
+        raise
+    except OSError as error:
+        raise AcquisitionSecurityError(
+            "SNAPSHOT_COLLISION",
+            "existing content-addressed snapshot is not a safe immutable file"
+            f" (open refused: {_describe_os_error(error)})",
+        ) from None
+    try:
+        opened = os.fstat(descriptor)
+        _require_existing_snapshot_stat(
+            opened,
+            expected_size=len(expected_content),
+            ownership_policy=ownership_policy,
+        )
+        try:
+            named = os.stat(name, dir_fd=root_fd, follow_symlinks=False)
+        except OSError as error:
+            raise AcquisitionSecurityError(
+                "SNAPSHOT_COLLISION",
+                "existing content-addressed snapshot name changed during validation"
+                f" (before the read: {_describe_os_error(error)})",
+            ) from None
+        _require_stable_snapshot_stat(opened, named, observed_between=_OPEN_VERSUS_NAME)
+        _require_snapshot_fd_bytes(descriptor, expected_content, expected_digest)
+        _require_stable_snapshot_stat(
+            opened,
+            os.fstat(descriptor),
+            observed_between=_OPEN_VERSUS_READ,
+        )
+    finally:
+        os.close(descriptor)
+    try:
+        after = os.stat(name, dir_fd=root_fd, follow_symlinks=False)
+    except OSError as error:
+        raise AcquisitionSecurityError(
+            "SNAPSHOT_COLLISION",
+            "existing content-addressed snapshot name changed during validation"
+            f" (after the read: {_describe_os_error(error)})",
+        ) from None
+    _require_stable_snapshot_stat(named, after, observed_between=_NAME_VERSUS_READ)
+
+
+def _describe_os_error(error: OSError) -> str:
+    """Name an errno without putting a path or any other caller string in the message."""
+
+    return f"{errno.errorcode.get(error.errno or 0, 'errno')} {error.strerror or ''}".strip()
+
+
+def _require_existing_snapshot_stat(
+    info: os.stat_result,
+    *,
+    expected_size: int,
+    ownership_policy: tuple[int, int],
+) -> None:
+    """Refuse an existing entry that is not one immutable, singly-linked, owned regular file.
+
+    Every field is evaluated rather than short-circuited so the refusal can name each one that
+    failed with its observed and required value.  A ``SNAPSHOT_COLLISION`` reaching an operator
+    from a machine nobody can attach a debugger to is otherwise indistinguishable from every
+    other reason this entry could be unsafe, and those reasons used to share one sentence.
+    ``st_nlink`` is the one that a concurrent same-digest sealer can move.
+    """
+
+    faults: list[str] = []
+    if not stat.S_ISREG(info.st_mode):
+        faults.append(f"kind {stat.S_IFMT(info.st_mode):#o} is not a regular file")
+    if stat.S_IMODE(info.st_mode) != 0o444:
+        faults.append(f"st_mode {stat.S_IMODE(info.st_mode):#o} != 0o444")
+    if info.st_nlink != 1:
+        faults.append(f"st_nlink {info.st_nlink} != 1")
+    if info.st_size != expected_size:
+        faults.append(f"st_size {info.st_size} != {expected_size}")
+    if info.st_uid != ownership_policy[0]:
+        faults.append(f"st_uid {info.st_uid} != {ownership_policy[0]}")
+    if info.st_gid != ownership_policy[1]:
+        faults.append(f"st_gid {info.st_gid} != {ownership_policy[1]}")
+    if faults:
+        raise AcquisitionSecurityError(
+            "SNAPSHOT_COLLISION",
+            "existing content-addressed snapshot is not a safe immutable file"
+            f" ({', '.join(faults)})",
+        )
+
+
+# The three points at which the bound stat signature is re-observed.  They are named in the
+# refusal so a field report says which observation drifted rather than only that one did.
+_OPEN_VERSUS_NAME = "the opened descriptor and the named entry"
+_OPEN_VERSUS_READ = "the opened descriptor before and after the read"
+_NAME_VERSUS_READ = "the named entry before and after the read"
+
+# The one drift with a single cause, said in words rather than left to be read off a field.
+_LAST_NAME_REMOVED = "; the last name for it was removed while it was open"
+
+_SNAPSHOT_STAT_FIELDS = (
+    "st_dev",
+    "st_ino",
+    "st_uid",
+    "st_gid",
+    "st_mode",
+    "st_nlink",
+    "st_size",
+    "st_mtime_ns",
+    "st_ctime_ns",
+)
+
+
+def _require_stable_snapshot_stat(
+    before: os.stat_result,
+    after: os.stat_result,
+    *,
+    observed_between: str,
+) -> None:
+    """Refuse a snapshot whose bound identity moved, naming where it moved and by what.
+
+    The signature is a deliberate anti-TOCTOU binding, so it stays exactly as wide as it was.
+    What changes is only what the refusal says: which of the three observation pairs disagreed,
+    and every field that differs with its old and new value.  ``st_nlink`` moving means another
+    name was attached to or detached from this inode; ``st_ino`` or ``st_dev`` moving means the
+    name was rebound to a different file; ``st_ctime_ns`` alone means metadata was touched.
+    Those are different incidents and a field recurrence has to be able to tell them apart.
+
+    ``st_nlink`` reaching zero is the one of those with only one cause, so it is named rather than
+    left to be inferred: the last name for this inode was removed while this descriptor held it
+    open, which is a deletion of the snapshot and not a change to it.  That is the refusal #209
+    reported from the field, and it is the reason a remover inside this tree now takes the same
+    per-name lock a sealer does -- so a refusal carrying this sentence is a remover the harness
+    does not own.
+    """
+
+    moved = tuple(
+        f"{field} {getattr(before, field)} -> {getattr(after, field)}"
+        for field in _SNAPSHOT_STAT_FIELDS
+        if getattr(before, field) != getattr(after, field)
+    )
+    if moved:
+        raise AcquisitionSecurityError(
+            "SNAPSHOT_COLLISION",
+            "existing content-addressed snapshot changed during validation"
+            f" (between {observed_between}: {', '.join(moved)})"
+            f"{_LAST_NAME_REMOVED if before.st_nlink and not after.st_nlink else ''}",
+        )
+
+
+def _is_allowlisted_snapshot_suffix(suffix: str) -> bool:
+    """Report whether a snapshot filename suffix is allowlisted.
+
+    Read from the single closed set rather than restated or unioned here.  What this admits
+    for writing is exactly what ``SNAPSHOT_SUFFIX_PATTERN`` -- and therefore the governed
+    deletion path -- will match for removal: a suffix that could be sealed but not matched
+    would strand snapshots no retention sweep can find.
+    """
+
+    return suffix in SNAPSHOT_SUFFIXES
+
+
+def _validate_response_headers(
+    headers: tuple[tuple[str, str], ...],
+) -> tuple[tuple[str, str], ...]:
+    if len(headers) > MAX_HEADER_COUNT:
+        raise AcquisitionSecurityError(
+            "RESPONSE_HEADERS",
+            f"response has more than {MAX_HEADER_COUNT} headers",
+        )
+    total = 0
+    normalized: list[tuple[str, str]] = []
+    for raw_name, raw_value in headers:
+        name = raw_name.lower().strip()
+        value = raw_value.strip()
+        if (
+            not name
+            or not all(char.isalnum() or char == "-" for char in name)
+            or "\r" in value
+            or "\n" in value
+        ):
+            raise AcquisitionSecurityError(
+                "RESPONSE_HEADER",
+                "response contains an invalid header",
+            )
+        total += len(name.encode("ascii", errors="strict")) + len(
+            value.encode("utf-8", errors="strict")
+        )
+        normalized.append((name, value))
+    if total > MAX_HEADER_BYTES:
+        raise AcquisitionSecurityError(
+            "RESPONSE_HEADERS",
+            f"response headers exceed {MAX_HEADER_BYTES} bytes",
+        )
+    return tuple(normalized)
+
+
+def _parse_content_range(value: str | None) -> tuple[int, int, int | None]:
+    """Parse a ``Content-Range`` strictly, or refuse it."""
+
+    if value is None:
+        raise AcquisitionSecurityError(
+            "CONTENT_RANGE",
+            "partial response carries no content range",
+        )
+    match = _CONTENT_RANGE.fullmatch(value)
+    if match is None:
+        raise AcquisitionSecurityError(
+            "CONTENT_RANGE",
+            "response content range is not a single canonical byte span",
+        )
+    first_byte = int(match.group(1))
+    last_byte = int(match.group(2))
+    complete = match.group(3)
+    if last_byte < first_byte:
+        raise AcquisitionSecurityError(
+            "CONTENT_RANGE",
+            "response content range ends before it begins",
+        )
+    complete_size = None if complete == "*" else int(complete)
+    if complete_size is not None and complete_size < last_byte + 1:
+        raise AcquisitionSecurityError(
+            "CONTENT_RANGE",
+            "response content range runs past the object it names",
+        )
+    return first_byte, last_byte, complete_size
+
+
+def _accept_header(limits: RetrievalLimits) -> str:
+    """What this retrieval will admit, spelled every way it would admit it.
+
+    Derived from the allowlist and the alias table rather than restated, so what is asked
+    for cannot drift from what is accepted: a source negotiating on ``Accept`` must not be
+    told a spelling is unwelcome that the response check would then have admitted.  Sorted,
+    so one allowlist has one header.
+    """
+
+    admitted = set(limits.allowed_media_types)
+    admitted.update(
+        alias for alias, canonical in MEDIA_TYPE_ALIASES.items() if canonical in admitted
+    )
+    return ", ".join(sorted(admitted))
+
+
+def _media_type(value: str | None) -> str:
+    """The one reader of a ``Content-Type`` header, and the one place a spelling is settled.
+
+    Parameters are dropped, case is folded, and a non-standard spelling of a type is
+    canonicalised to the spelling every allowlist in this package is written in.  The
+    canonicalisation belongs HERE rather than beside each allowlist: an alias added to one
+    tuple and missed on the other is precisely how the slice path came to admit the object
+    but refuse the sidecar of the same S3 response.  One normaliser means the allowlists, the
+    ``multipart/byteranges`` refusal, the outgoing ``Accept`` header and the media type this
+    boundary reports all speak the same vocabulary, and a new alias is one line.
+    """
+
+    if value is None:
+        raise AcquisitionSecurityError("MEDIA_TYPE", "response has no content type")
+    media_type = value.split(";", 1)[0].strip().lower()
+    if not media_type or "/" not in media_type:
+        raise AcquisitionSecurityError("MEDIA_TYPE", "response content type is invalid")
+    return MEDIA_TYPE_ALIASES.get(media_type, media_type)
+
+
+def _require_snapshot_fd_bytes(
+    file_descriptor: int,
+    expected_content: bytes,
+    expected_digest: str,
+) -> None:
+    """Verify a descriptor's bytes against the expected snapshot without materializing them.
+
+    The verdict is identical to reading the whole descriptor and then comparing: the same
+    ``expected_length + 1`` over-read still detects a longer file, the length is still decided
+    before the contents are, and acceptance still requires *both* the expected SHA-256 and exact
+    equality with the expected bytes.  Only the residency changes.  Accumulating the file into a
+    chunk list and joining it cost a second and a third full copy alongside the caller's own
+    ``content``, so sealing the 2.12 GB EPA snapshot peaked near 6.4 GB; comparing each 64 KiB
+    chunk against the corresponding zero-copy slice of ``expected_content`` peaks at one copy
+    plus a chunk.
+
+    A mismatched chunk stops further comparison but not the read: the length verdict has to come
+    first, exactly as it did when the whole file was read before anything was compared, so a
+    short *and* different file still reports its length rather than its contents.
+    """
+
+    expected_length = len(expected_content)
+    expected = memoryview(expected_content)
+    digest = hashlib.sha256()
+    identical = True
+    total = 0
+    while total <= expected_length:
+        chunk = os.read(file_descriptor, min(65_536, expected_length + 1 - total))
+        if not chunk:
+            break
+        digest.update(chunk)
+        if identical:
+            identical = expected[total : total + len(chunk)] == chunk
+        total += len(chunk)
+    if total != expected_length:
+        raise AcquisitionSecurityError(
+            "SNAPSHOT_COLLISION",
+            f"existing snapshot length differs (read {total} bytes, expected {expected_length})",
+        )
+    if digest.hexdigest() != expected_digest or not identical:
+        raise AcquisitionSecurityError(
+            "SNAPSHOT_COLLISION",
+            "existing content-addressed snapshot bytes differ",
+        )