fetch: a request is answered only within its line; never older within it (#481)

[EricAndrechek]

Summary

A request is answered only within its own ClickHouse line, and the anti-rollback ("monotonic") keep is scoped to the request (#481). Concurrent installs into one cache no longer delete or replace each other's entries (#482). All four bindings follow one rule. There is no version bump.

#481: the scoped keep rule, in all four

• The keep rule. When the registry offers a build older than one already installed, the installed build is kept only if its signed version lies within the request.
  • For a line request (26.3), that means any newer build of that line.
  • For an exact request (26.3.38.2), only a newer build of that exact version.
  • An install of another line never answers.
  • The newest qualifying install is returned. This holds even when the offered build is installed too.
• What each binding did before.
  • Go newerAlreadyInstalled and TypeScript checkMonotonic compared the offer against every install for the platform. That is the wrong-line answer in Go and TypeScript can load the wrong ClickHouse line: a lower-line request is answered by a higher line already cached (measured, 1.0.2) #481.
  • Python compared the same four-part version only, so it installed an older build of a line over a newer one.
  • Rust already filtered by VersionRequest::matches.
  • All four skipped the keep check when the offered build was itself installed.
• The load-time assertion. After every open through a registry, the library's own build_info clickhouse_version must lie within the request. Otherwise the open fails as CHTYPES_ARTIFACT_CORRUPT, a loader refusal with reason build_info_mismatch:clickhouse_version, want the request and got the version.
  • Why this code: fetch-v1.md §4 already makes "the signed version does not lie within the request" CHTYPES_ARTIFACT_CORRUPT, and build_info_mismatch is the existing loader refusal for a build_info field that disagrees. No new code, class or reason is added.
  • A non-version tag is not checked.
  • open_unverified takes no request, so it is out of scope.

#482: race-safe installs, in all four

• Rename first. An entry that holds an acceptable record is never removed or replaced. Only an entry without one is moved aside, and it is put back if it turns out to be good.
  • TypeScript ran rm -rf on the final entry and then renamed.
  • Go, Python and Rust checked for an entry and then moved aside whatever stood there.
  • Measured on the unfixed code: Go across processes on macOS, and Python across threads.
• Listing. A listing reads only <manifest-hex> names, never an installer's temporary directory. Python already did this.
• TypeScript errors. A filesystem failure in the fetch layer is now a UsageError in the registry, and the usage exit status in the CLI, as in Go.

Tests

• Conformance. request-scope-* (6 cases × file/http), generated by genfixtures, run in every binding's v1-conformance leg.
• v1-cache-interop, writer × reader × line. Each writer fetches 26.8. Each reader adds 26.3 online, then answers both lines offline.
• v1-cache-interop, concurrency. 8 processes at a time, for each binding alone and for all four mixed, 3 rounds each. A watcher reports torn, vanished and replaced entries.
• Unit tests for the race and the assertion in each binding.

Evidence

• Unfixed head 936690f, run 37478628838.
  • New conformance cases: Go and TypeScript fail 6 pairs each, Python 2, Rust 0.
  • Interop line matrix: every Go and TypeScript reader answered 26.3 with 26.8.5.1, whatever binding wrote the cache.
  • ts x8: 23/24 installed, REPLACED ×6, UNRECORDED ×1, VANISHED ×1.
  • mixed x8: REPLACED ×4, TORN-LIBRARY ×1, VANISHED ×1.
• Fixed head: d11e58c (merges main at 546489f): all 21 required contexts green, v1-parity and v1-cache-interop included (measured once every run on the commit had finished). The one failure is the report-only security scan, which fails on main too.

Test plan

• the new cases fail on the unfixed bindings (CI run 37478628838; Go also locally) and pass after the fix
• go build/vet/test, golangci-lint; uv run pytest -q, ruff; tsc --noEmit (both configs), biome; cargo check/clippy/fmt
• genfixtures --selftest/--check, schema_check.py, gen-constants --check, abi-v1/gen.py --check, lint-public/spelling/cited-paths/actions, dprint, markdownlint, policy-merge-check --check-guide/--selftest
• every required check green on the head (see above)

Related issues

Fixes #481
Fixes #482

🤖 Generated with Claude Code