rustytree-xarray 0.2.1__tar.gz → 0.4.0__tar.gz

rustytree_xarray-0.4.0/.github/dependabot.yml

@@ -0,0 +1,73 @@
+# Dependabot version updates. Opens PRs on a schedule; nothing auto-merges —
+# every PR is reviewed and merged by hand (including the grouped github-actions
+# one). Security updates (CVE-triggered PRs) are enabled separately at the repo
+# level, independent of this schedule.
+#
+# Deliberately NOT managed here (bumped by hand — coordinated, cross-manifest):
+#   - icechunk / typetag: FFI lockstep. The Python `icechunk` (pyproject) must
+#     share a minor with the Rust `icechunk` (`=2.1.0`) and `typetag`
+#     (`=0.2.22`) the crate links — the msgpack `Session` bytes format is
+#     coupled across the boundary, so a solo bump breaks `Session::from_bytes`
+#     (the 2.0.5→2.0.6 skew behind #46). Bump all three together manually.
+#   - ruff: pinned in pyproject AND hardcoded in ci.yml (`uvx ruff@0.15.8`),
+#     which Dependabot can't edit; a solo bump desyncs the lint gate and can
+#     churn formatting. Bump pyproject + both ci.yml literals together.
+#   - dtolnay/rust-toolchain@stable, pypa/gh-action-pypi-publish@release/v1:
+#     branch refs, not semver tags — Dependabot leaves them alone (no rule
+#     needed).
+version: 2
+
+updates:
+  # GitHub Actions — the `uses:` version pins in .github/workflows/* (exactly
+  # the manual toil of #54). One grouped PR per run.
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    labels: ["dependencies"]
+    commit-message:
+      prefix: ci
+    groups:
+      actions:
+        patterns: ["*"]
+
+  # Rust crates (Cargo.toml / Cargo.lock).
+  - package-ecosystem: cargo
+    directory: "/"
+    schedule:
+      interval: weekly
+    labels: ["dependencies"]
+    commit-message:
+      prefix: deps
+    open-pull-requests-limit: 5
+    groups:
+      # Keep the zarrs family (zarrs, zarrs_storage, zarrs_object_store,
+      # zarrs_icechunk) moving together — they share a release cadence.
+      zarrs:
+        patterns: ["zarrs*"]
+      # pyo3 and numpy track matched 0.x minors (pyo3 0.28 ↔ numpy 0.28).
+      pyo3:
+        patterns: ["pyo3", "numpy"]
+      # Everything else: fold minor/patch into one PR; majors get their own.
+      cargo-minor:
+        update-types: ["minor", "patch"]
+    ignore:
+      - dependency-name: "icechunk"  # FFI lockstep — bump by hand (see header)
+      - dependency-name: "typetag"   # FFI lockstep — bump by hand (see header)
+
+  # Python deps (pyproject.toml: project deps + the `dev` extra).
+  - package-ecosystem: pip
+    directory: "/"
+    schedule:
+      interval: weekly
+    labels: ["dependencies"]
+    commit-message:
+      prefix: deps
+    open-pull-requests-limit: 5
+    groups:
+      # Fold minor/patch into one PR; majors get their own.
+      python:
+        update-types: ["minor", "patch"]
+    ignore:
+      - dependency-name: "icechunk"  # FFI lockstep — bump by hand (see header)
+      - dependency-name: "ruff"      # also hardcoded in ci.yml — bump by hand

{rustytree_xarray-0.2.1 → rustytree_xarray-0.4.0}/.github/workflows/ci.yml

@@ -15,19 +15,45 @@ env:
   RUSTFLAGS: -D warnings
 
 jobs:
-  # Cargo gates run once on stable Rust. Cheap; no Python needed.
+  # Python lint + format gate. Fast and dependency-free (ruff is a standalone
+  # binary; no extension build needed), so it runs in parallel with the cargo
+  # and pytest jobs and fails fast on style drift. The pinned version must
+  # match the `ruff` pin in pyproject's `dev` extra so local `ruff format`
+  # and this check agree.
+  lint:
+    name: ruff (lint + format)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v7
+      - run: uvx 'ruff@0.15.8' check .
+      - run: uvx 'ruff@0.15.8' format --check .
+
+  # Cargo gates run once on stable Rust. `cargo test` links libpython (see the
+  # test step), so Python is set up here too.
   cargo:
     name: cargo (fmt, clippy, test)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: clippy, rustfmt
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
       - uses: Swatinem/rust-cache@v2
       - run: cargo fmt --check
       - run: cargo clippy --all-targets --all-features --locked -- -D warnings
-      - run: cargo test --locked
+      # Build tests WITHOUT `extension-module` so PyO3 links libpython: the
+      # credential-fetcher shim's `#[typetag::serde]` impls are force-retained
+      # by `inventory` and call `Python::attach`, so the test binary references
+      # libpython symbols that can't be dead-code-eliminated (they can under
+      # `extension-module`, which suppresses libpython linking for the cdylib).
+      - name: cargo test
+        run: cargo test --locked --no-default-features
+        env:
+          LD_LIBRARY_PATH: ${{ env.pythonLocation }}/lib
 
   # Python integration: build the cdylib via maturin and run pytest against
   # the supported interpreter range. Each matrix cell rebuilds the extension
@@ -41,16 +67,16 @@ jobs:
       matrix:
         python-version: ["3.12"]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
         with:
           # Keyed by Python version so each matrix cell gets its own cache.
           key: py-${{ matrix.python-version }}
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
-      - uses: astral-sh/setup-uv@v4
+      - uses: astral-sh/setup-uv@v7
       - name: Set up venv and install maturin
         run: |
           uv venv --python "${{ matrix.python-version }}"
@@ -59,8 +85,9 @@ jobs:
         # Install the [dev] extras directly rather than `pip install -e ".[dev]"`,
         # which would re-trigger a full cdylib rebuild on top of maturin develop
         # below (we'd build the wheel twice — saves ~80s per matrix cell).
-        # Keep this list in sync with the `dev` extra in pyproject.toml.
-        run: uv pip install --python .venv/bin/python pytest pytest-cov 'zarr>=3.0' 'icechunk>=2.0.5' ruff
+        # These are the deps pytest needs; ruff is not among them — linting runs
+        # in the dedicated `lint` job above.
+        run: uv pip install --python .venv/bin/python pytest pytest-cov 'zarr>=3.0' 'icechunk>=2.1.0,<2.2' 'dask[distributed]>=2024.1'
       - name: Build extension (maturin develop)
         run: .venv/bin/maturin develop
       - name: pytest

{rustytree_xarray-0.2.1 → rustytree_xarray-0.4.0}/.github/workflows/release.yml

@@ -47,8 +47,8 @@ jobs:
         python-version: ["3.12", "3.13"]
     runs-on: ${{ matrix.platform.os }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
       - uses: dtolnay/rust-toolchain@stable
@@ -61,7 +61,7 @@ jobs:
           target: ${{ matrix.platform.target }}
           manylinux: ${{ matrix.platform.manylinux }}
           args: --release --strip --out dist -i python${{ matrix.python-version }}
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: wheel-${{ matrix.platform.target }}-py${{ matrix.python-version }}
           path: dist/*.whl
@@ -71,12 +71,12 @@ jobs:
     name: sdist
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: PyO3/maturin-action@v1
         with:
           command: sdist
           args: --out dist
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: sdist
           path: dist/*.tar.gz
@@ -97,8 +97,8 @@ jobs:
       group: release-${{ github.ref }}
       cancel-in-progress: false
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@v7
+      - uses: actions/download-artifact@v8
         with:
           path: dist
           merge-multiple: true
@@ -128,7 +128,7 @@ jobs:
     permissions:
       id-token: write   # mint short-lived OIDC tokens for trusted publishing
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           path: dist
           merge-multiple: true

{rustytree_xarray-0.2.1 → rustytree_xarray-0.4.0}/CHANGELOG.md

@@ -11,6 +11,311 @@ release, that section is renamed to `[x.y.z] - YYYY-MM-DD` and a fresh
 
 ## [Unreleased]
 
+## [0.4.0] - 2026-07-24
+
+### Added
+
+- Dependabot dependency automation ([#56]). A `.github/dependabot.yml` opens
+  weekly grouped version-update PRs for three ecosystems — `cargo`, `pip`
+  (pyproject), and `github-actions` — plus repo-level vulnerability alerts and
+  Dependabot security updates for CVE-triggered PRs. Nothing auto-merges; every
+  PR is reviewed by hand. `icechunk`/`typetag` (FFI lockstep) and `ruff` (also
+  pinned in `ci.yml`) are intentionally ignored and stay manual, coordinated
+  bumps.
+
+### Changed
+
+- Bump `zarrs` 0.22 → 0.23 ([#60]). A breaking upstream release: `DataType`
+  became a newtype over `Arc<dyn DataTypeTraits>` rather than an enum, so the
+  shared `for_each_supported_dtype!` dispatch is now an
+  `is::<Float64DataType>()` chain against the marker types in
+  `zarrs::array::data_type`. `ArraySubset` moved from the removed
+  `zarrs::array_subset` module into `zarrs::array`, and
+  `async_retrieve_array_subset_elements::<T>` (deprecated in 0.23, already
+  deleted upstream for 0.24) became `async_retrieve_array_subset::<Vec<T>>`.
+  The supported-dtype set, the read path, and the storage stack are otherwise
+  unchanged — `zarrs_storage` still resolves to a single 0.4.x, so
+  `zarrs_object_store` and `zarrs_icechunk` needed no bump and the icechunk
+  FFI lockstep is untouched.
+  - Fixes a dtype string that 0.23 would have silently corrupted: the walk
+    built `VarMeta::dtype` via `format!("{}", array.data_type())`, and 0.23's
+    `Display` renders *both* Zarr spellings when they differ (`float64` →
+    `"float64 / <f8"`), which `numpy.dtype()` rejects. Both walk sites now
+    route through `zarrs_dtype_to_numpy_str`, the same canonical mapper the
+    array handle already used.
+  - `zarrs_dtype_to_numpy_str` now reads the dtype's Zarr V3 name (identical
+    to the NumPy name for all thirteen dtypes we can name; pinned by a new
+    unit test) instead of maintaining a parallel hand-written table. The one
+    exception is `bytes`, reported as `object` to match zarr-python —
+    `np.dtype("bytes")` is `|S0`, which would mislabel a variable-length
+    binary array rather than fail. Dtypes we can neither read nor safely
+    rename (`string`, `numpy.datetime64`, `r32`, …) still surface as a
+    `TypeError` from `np.dtype()` at open, as before.
+
+- CI: bump GitHub Actions off the deprecated Node 20 runtime ([#55], fixes #54).
+  `actions/checkout` v4 → v5, `actions/setup-python` v5 → v6,
+  `actions/upload-artifact` v4 → v6, `actions/download-artifact` v4 → v7 — the
+  lowest major of each that runs on Node 24 (verified via each tag's
+  `runs.using`; the artifact actions only moved to Node 24 at v6/v7, so a naïve
+  bump to v5 would still have been Node 20). No workflow behaviour change.
+
+- Raise the NumPy floor `numpy>=1.24` → `numpy>=2.0` ([#71]). Variable-length
+  `string` arrays are surfaced as numpy 2's variable-width `StringDType`
+  (`np.dtype("T")`), which did not exist before 2.0. rustytree's other pins
+  (`zarr>=3`, recent `xarray`) already track numpy 2, so this only makes an
+  existing expectation explicit.
+
+- Routine dependency and CI-action bumps via Dependabot ([#57], [#58], [#59],
+  [#64]) — the first batch after the automation ([#56]) landed. Cargo: `tokio`
+  1.52.3 → 1.53.0, `futures` 0.3.32 → 0.3.33, `zarrs_storage` 0.4.3 → 0.4.4
+  ([#64]); `chrono` 0.4.44 → 0.4.45, `zarrs_icechunk` 0.5.0 → 0.5.1 ([#59]);
+  `cmov` 0.5.3 → 0.5.4 ([#57]). CI actions ([#58]): `actions/checkout` 5 → 7,
+  `astral-sh/setup-uv` 4 → 7, `actions/upload-artifact` 6 → 7, and
+  `actions/download-artifact` 7 → 8 — superseding the v5/v6/v7 pins the [#55]
+  entry above describes.
+
+### Fixed
+
+- Zarr v3 string arrays now open and read instead of crashing ([#71], fixes
+  #70). Both v3 string flavours failed before: a variable-length `string` array
+  raised `TypeError: data type 'string' not understood` (its name reached
+  `np.dtype()` unmapped), and a `fixed_length_utf32` array (numpy `<U…`,
+  xarray's default `str` encoding) raised `NotImplementedError` at read. This
+  became a production regression when raw2zarr's FM301 retrofit added
+  `sweep_mode`/`prt_mode`/`follow_mode` as vlen-`string` scalars to the KLOT
+  eager store and the Serbian OSN stores, forcing consumers to fall back to the
+  slower `engine="zarr"`. rustytree now mirrors `engine="zarr"` for both
+  flavours — `xr.testing.assert_identical` holds against it for all
+  valid-Unicode content (2-D chunking, interior NULs, non-BMP code points,
+  empty strings, and unwritten-chunk fill values all included):
+  - **vlen `string`** is *declared* `object` but its values *materialise* as
+    numpy-2 `StringDType`. That declared/read split is exactly what
+    `engine="zarr"` produces: xarray's CF-decode flattens a
+    `StringDType`-declared variable's values back to `object`, so declaring
+    `object` up-front is the only way to keep `StringDType` values. The `numpy`
+    crate can only build `object` arrays across the FFI boundary, so the read
+    returns `object` and `RustyBackendArray` casts to the dtype the new
+    `ZarrsArrayHandle.read_dtype` reports.
+  - **`fixed_length_utf32`** → fixed-width `<U{n}` (`n` code points). zarrs 0.23
+    opens this dtype (0.22 could not); rustytree decodes the native-endian
+    UTF-32 to `str` and builds the `<U` array. One documented divergence: lone
+    surrogate code points (U+D800–U+DFFF, malformed Unicode) are dropped rather
+    than preserved, because the decode goes through Rust `char`.
+  - `slice_nd`'s bound relaxed from `T: Copy` to `T: Clone` so the same slicer
+    serves the `String` buffers; zero-cost for the numeric arms.
+
+- An empty selection no longer returns a stray element or panics ([#68], fixes
+  #65). `isel(time=slice(1, 1))` and friends returned one bogus element whenever
+  the offset was not a multiple of the chunk size, and raised
+  `pyo3_runtime.PanicException` when the selection sat at the end of a ragged
+  final chunk (e.g. `slice(13, 13)` on a shape-13 array with chunks of 4).
+  Raggedness was needed only for the panic — the wrong length happened on any
+  non-chunk-aligned offset, including on arrays whose shape divides evenly.
+  `slice_nd`'s walk was a do-while that pushed an element before it could test
+  the bounds; it is now driven by the output element count, so an empty request
+  runs zero iterations and totality is structural rather than a guard. The panic
+  mattered beyond the wrong length: `PanicException` derives from
+  `BaseException`, so it passed straight through ordinary `except Exception:`
+  handlers. Empty selections also short-circuit before the chunk-alignment step
+  now, so they no longer pull a chunk off the network to return nothing.
+
+- A reversed slice is empty rather than an error ([#68]). `v.isel(n=slice(5, 3))`
+  and `v[5:3]` raised `ValueError: start 5 > stop 3`, where numpy, pandas and
+  `engine="zarr"` all return an empty array. `slice.indices()` reports a reversed
+  slice faithfully as `(5, 3, 1)`, and that pair reached `read_subset` unchanged;
+  the Python adapter now normalises it. `read_subset` keeps its stricter
+  `start <= stop` contract, so a genuinely malformed range still raises.
+
+- Tests: the two opt-in KTWX smoke tests now skip when the directory exists but
+  holds no icechunk repository ([#60]). The guard tested `KTWX_PATH.exists()`,
+  so an empty leftover directory failed the guard's purpose and the tests
+  errored with `KeyError: group / not found in store` instead of skipping. The
+  shared `ktwx_repo_available()` helper in `tests/conftest.py` now mirrors
+  rustytree's own detector (`looks_like_icechunk_repo`): a `repo` manifest file
+  plus a `snapshots/` directory.
+
+### Security
+
+- Bump `pyo3` and `numpy` 0.28 → 0.29 ([#61]) to fix a **high**-severity
+  out-of-bounds read in PyO3's `PyIterator` `nth`/`nth_back` (RUSTSEC/GHSA)
+  plus a medium-severity missing `Sync` bound on `PyCFunction::new_closure`.
+  A clean bump — no source changes; the pyo3/numpy majors move in lockstep.
+  (Surfaced by the newly-enabled Dependabot security alerts.)
+
+## [0.3.0] - 2026-07-04
+
+### Added
+
+- `group_filter` keyword for `open_datatree` ([#49]). An
+  `fnmatch`-style glob matched against every group path — only matching groups
+  (plus their ancestors and the root, so the tree stays connected) are loaded.
+  Mirrors xarray PR [pydata/xarray#11302](https://github.com/pydata/xarray/pull/11302):
+  matching follows `PurePosixPath.match` (right-anchored), so
+  `group_filter="*/sweep_0"` opens the lowest sweep of every volume, and group
+  names that literally contain glob metacharacters are reachable via character-
+  class escapes (`[*]`, `[?]`, `[[]`). Mutually exclusive with `group`. The Rust
+  walk prunes non-matching subtrees up front (conservative prefix predicate);
+  Python's `_filter_by_glob` remains the source of truth. `open_dataset` rejects
+  `group_filter` (a single Dataset has no defined target for a multi-match glob).
+
+- Docs: a "Distributed compute (`dask.distributed` / Coiled)" section in
+  `docs/usage.md` ([#46]) covering the requirements for a remote cluster
+  (`spawn` workers, matching `rustytree` + `icechunk` in the worker environment)
+  and — mirroring icechunk's own guidance — how to avoid shipping secrets to
+  workers: use `from_env` / `refreshable` / `anonymous` credentials (secret-free
+  in the task graph) rather than `static` keys. Verified end-to-end that a
+  `from_env` session opened via rustytree pickles with no secret in the graph and
+  still computes on a distributed cluster.
+
+- Picklable array handles for `dask.distributed` ([#44], fixes #44).
+  DataArrays opened with `engine="rustytree"` could not be computed under a
+  `dask.distributed` cluster — `.compute()` failed while distributed pickled
+  the task graph, because each lazy chunk held a native
+  `ZarrsArrayHandle` that raised `TypeError: cannot pickle
+  'rustytree._rustytree.ZarrsArrayHandle' object`. `ZarrsArrayHandle` now
+  implements `__reduce__`: for stores opened via an icechunk `Session` (both
+  local-filesystem and remote S3, the cases in #44) the handle carries the
+  session's own `as_bytes()` msgpack plus the array path, and a worker revives
+  it via icechunk's `Session::from_bytes` + `Array::async_open`. This mirrors
+  icechunk exactly — rustytree adds **no** credential handling of its own, so
+  credential exposure is precisely icechunk's: `from_env` / `anonymous` sessions
+  carry no secret into the task graph, while **static** credentials (and a
+  refreshable session's scattered `initial` creds) are embedded in the session
+  bytes and travel to every worker in the pickled graph — the same as
+  distributing an icechunk Session directly. Opening through an icechunk Session
+  with `from_env` / `anonymous` / `refreshable` credentials is the recommended
+  distributed pattern. Workers must use the `spawn` start-method (the
+  `dask.distributed` default); rustytree's tokio runtime is not fork-safe, so
+  fork-based multiprocessing after opening a store is unsupported. Vanilla
+  `s3://` / local Zarr stores are not yet picklable (no icechunk Session to
+  mirror) and now raise a clear, actionable error at pickle time instead of the
+  opaque default. New `tests/test_pickle.py` covers the pickle round-trip
+  (including deeply-nested arrays and multi-hop re-pickling), the not-picklable
+  and corrupt-state error paths, and an opt-in `distributed`-marked
+  `LocalCluster` compute.
+
+- `numcodecs.zlib` codec support ([#41], fixes #42). Enables the `zlib`
+  feature on the `zarrs` dependency so rustytree can decode arrays whose
+  codec pipeline uses the non-standard `numcodecs.`-namespace codecs
+  zarr-python writes — e.g. the public `earthmover-public/goes-16`
+  arraylake dataset (and the ismip6 icechunk store reported in #42, where
+  enabling it gave a ~10× speedup over `engine="zarr"`), which chain
+  `bytes → numcodecs.shuffle → numcodecs.zlib`. zarrs's `zlib` codec is
+  documented byte-compatible
+  with zarr-python's; `numcodecs.shuffle` is always compiled, and
+  `gzip` / `blosc` / `zstd` / `crc32c` already come from zarrs's
+  default features. Verified bit-for-bit against zarr-python on a
+  GOES-16 `CMI_C01` slice. New non-gated `tests/test_codecs.py` writes
+  the shuffle+zlib pipeline to a local store and checks the decode
+  round-trips.
+
+### Changed
+
+- CI now runs `ruff check` and `ruff format --check` in a dedicated `lint` job,
+  and `ruff` is pinned (`>=0.15.8,<0.16`) in the `dev` extra so local and CI
+  formatting agree ([#50], fixes #48). Previously CI installed `ruff` but never
+  invoked it, so lint/format drift accumulated silently on `main`; this normalises
+  the drifted files (`backend.py`, `conftest.py`, `test_backend_entrypoint.py`,
+  `test_codecs.py`, `klot_demo.ipynb`) in one no-logic-change pass and gates
+  against recurrence. No runtime behaviour change.
+
+- **Breaking:** `group=` is now exact-path only and no longer auto-detects glob
+  patterns ([#49]). Previously a `group=` value containing `*`, `?`, or `[`
+  silently switched to glob filtering; that overloaded behaviour is removed in
+  favour of the explicit `group_filter=` (see Added). This aligns with the final
+  design of xarray PR [pydata/xarray#11302](https://github.com/pydata/xarray/pull/11302),
+  which rejected the ambiguous overloaded form because group names may legitimately
+  contain glob metacharacters. Migrate `open_datatree(group="*/sweep_0")` to
+  `open_datatree(group_filter="*/sweep_0")`; `group` and `group_filter` are
+  mutually exclusive (passing both raises `ValueError`). A `group=` value with
+  glob characters is now looked up as a literal path.
+
+- Docs: tidy the `notebooks/klot_demo.ipynb` demo — trim WHAT-narrating comments
+  and add an `xradar` prerequisite note ([#47]). No code change.
+
+- Bump the pinned `icechunk` from 2.0.5 to 2.1.0 ([#46]). rustytree links the
+  `icechunk` Rust crate and round-trips sessions through
+  `Session::{as,from}_bytes`, so it can only open stores whose on-disk format
+  matches its pinned icechunk — 2.0.5 could not open repositories written by
+  icechunk 2.0.6+, failing in `Repository::open` with "the repository doesn't
+  exist" even though the store was present and the credentials valid. Bumping to
+  2.1.0 restores access to current icechunk stores; `typetag` moves to `=0.2.22`
+  to keep sharing icechunk's `inventory` credential-fetcher registry (the #41
+  `py_credentials` shim). The `dev` extra and CI now require
+  `icechunk>=2.1.0,<2.2` so the Python and Rust icechunk versions share a minor —
+  the msgpack session-bytes format is coupled across the FFI boundary, and a skew
+  is exactly what produced the "repository doesn't exist" failure. No rustytree
+  source changes were needed (the API surface is unchanged). Verified end-to-end
+  against a real credentialed AWS S3 icechunk 2.0.6 store: parity with
+  `engine="zarr"`, pickle round-trip, and a distributed `LocalCluster` compute
+  whose workers reopen the store from the pickled session.
+
+### Fixed
+
+- Unified the missing-group error type across backends ([#52], fixes #51).
+  A literal `group=` path that doesn't exist now raises `KeyError` on both
+  vanilla Zarr and icechunk stores — previously vanilla raised `RuntimeError`
+  (from the Rust walk) while icechunk raised `KeyError`, so callers couldn't
+  `except` one type. The Rust walk now maps zarrs' `GroupCreateError::MissingMetadata`
+  to `RustytreeError::NotFound` (→ `PyKeyError`); genuine storage/IO/corruption
+  errors still surface as `RuntimeError`.
+
+- `open_dataset` and `open_datatree` now validate the `group`/`group_filter`
+  pair consistently ([#52]). Passing both to `open_dataset` raises the same
+  `ValueError` (mutually exclusive) as `open_datatree` instead of a
+  `NotImplementedError`; the shared validator (renamed
+  `_check_group_filter_mutex` → `_validate_group_filter` since it also rejects
+  an empty `group_filter`) runs first on both entry points.
+
+- Docs and the `klot_demo` notebook still used the removed glob-`group=`
+  form (`group="*/sweep_0"`) that [#49] turned into a literal-path lookup —
+  the examples would now raise instead of filtering. Migrated `README.md`,
+  `docs/usage.md`, and `notebooks/klot_demo.ipynb` to `group_filter=`
+  ([#50]).
+
+- Spurious `SerializationWarning: variable '...' has multiple fill values`
+  and silently-broken masking for stores whose `_FillValue` is written in
+  raw Zarr wire form ([#43]). Some virtual/icechunk stores (e.g. the
+  source.coop ISMIP6 dataset) carry `_FillValue` as a base64-encoded
+  string (`'AAAAgB2vFUQ='`) alongside a numeric `missing_value`; xarray's
+  CF mask coder saw two distinct sentinels for the same value and warned,
+  and the base64 string masked nothing (a float array never equals a
+  `str`), so masking quietly fell back to `missing_value` alone.
+  `_RustyDataStore.get_variables` now mirrors xarray's zarr backend
+  (`ZarrStore.open_store_variable`): a base64 `str`/`bytes` `_FillValue`
+  is decoded to a numeric sentinel via `FillValueCoder.decode`, while an
+  already-numeric fill is left untouched. Verified byte-for-byte against
+  `engine="zarr"` on the ISMIP6 store (warnings 28 → 0, identical
+  `_FillValue` encoding and masking). Non-numeric list/tuple wire forms
+  (e.g. a complex `[real, imag]` fill) have no decoder branch and pass
+  through unchanged rather than raising. Network-free regression tests
+  cover the base64 decode, numeric pass-through, and list pass-through.
+
+- Open arraylake / Earthmover icechunk sessions ([#41], fixes #40).
+  `xr.open_datatree(session.store, engine="rustytree")` raised
+  `ValueError: icechunk session: unknown error: unknown variant
+  PythonCredentialsFetcher, there are no variants` for sessions
+  created via arraylake. Such sessions store S3 credentials as
+  `Refreshable(Arc<dyn S3CredentialsFetcher>)` whose concrete fetcher
+  is `#[typetag::serde]`-registered only inside icechunk-python's
+  cdylib; rustytree links the vanilla `icechunk` crate, whose fetcher
+  registry is empty, so `Session::from_bytes` couldn't resolve the tag.
+  `xr.open_zarr` is unaffected because it uses the live in-process
+  store and never round-trips through bytes. New `src/py_credentials.rs`
+  re-registers `PythonCredentialsFetcher` (S3 / GCS / Azure) inside
+  rustytree's cdylib, mirroring icechunk-python's `get()`: serve the
+  scattered `initial` static credentials while fresh, else acquire the
+  GIL and re-run the embedded pickled credential callable to refresh —
+  so the common case and `scatter_initial_credentials=False` /
+  mid-walk credential expiry all keep working. `typetag` is pinned
+  `=0.2.21` to share icechunk's `inventory` registry. A Python-side
+  friendly error (`_rust_open_or_explain` in `backend.py`) is a safety
+  net for a future icechunk-python that renames the fetcher. CI now
+  builds tests with `--no-default-features` so PyO3 links libpython:
+  the inventory-retained fetcher impls reference `Python::attach`, so
+  their libpython symbols can no longer be dead-code-eliminated from
+  the test binary.
+
 ## [0.2.1] - 2026-05-23
 
 ### Fixed
@@ -530,7 +835,10 @@ below.
   intentionally not normalized — relative-vs-absolute glob
   semantics differ in `PurePosixPath.match`.
 
-[Unreleased]: https://github.com/aladinor/rustytree/compare/v0.2.0...HEAD
+[Unreleased]: https://github.com/aladinor/rustytree/compare/v0.4.0...HEAD
+[0.4.0]: https://github.com/aladinor/rustytree/compare/v0.3.0...v0.4.0
+[0.3.0]: https://github.com/aladinor/rustytree/compare/v0.2.1...v0.3.0
+[0.2.1]: https://github.com/aladinor/rustytree/compare/v0.2.0...v0.2.1
 [0.2.0]: https://github.com/aladinor/rustytree/compare/v0.1.0...v0.2.0
 [0.1.0]: https://github.com/aladinor/rustytree/releases/tag/v0.1.0
 [#1]: https://github.com/aladinor/rustytree/pull/1
@@ -558,3 +866,21 @@ below.
 [#25]: https://github.com/aladinor/rustytree/pull/25
 [#26]: https://github.com/aladinor/rustytree/pull/26
 [#27]: https://github.com/aladinor/rustytree/pull/27
+[#41]: https://github.com/aladinor/rustytree/pull/41
+[#43]: https://github.com/aladinor/rustytree/pull/43
+[#44]: https://github.com/aladinor/rustytree/pull/44
+[#46]: https://github.com/aladinor/rustytree/pull/46
+[#47]: https://github.com/aladinor/rustytree/pull/47
+[#49]: https://github.com/aladinor/rustytree/pull/49
+[#50]: https://github.com/aladinor/rustytree/pull/50
+[#52]: https://github.com/aladinor/rustytree/pull/52
+[#55]: https://github.com/aladinor/rustytree/pull/55
+[#56]: https://github.com/aladinor/rustytree/pull/56
+[#57]: https://github.com/aladinor/rustytree/pull/57
+[#58]: https://github.com/aladinor/rustytree/pull/58
+[#59]: https://github.com/aladinor/rustytree/pull/59
+[#60]: https://github.com/aladinor/rustytree/pull/60
+[#61]: https://github.com/aladinor/rustytree/pull/61
+[#64]: https://github.com/aladinor/rustytree/pull/64
+[#68]: https://github.com/aladinor/rustytree/pull/68
+[#71]: https://github.com/aladinor/rustytree/pull/71