v2: resolve the parity gate's #499/#500 surface before the lock (codes generated in all four; one shape per concept)

[EricAndrechek]

Summary

The parity gate (#436) carried each binding's one-binding conveniences and shape differences as allowlist entries citing #499, #500 and #487. 2.0.0 is the last window before the v2 lock for removing or renaming public binding API, so this PR resolves every one of them, following the ruled table. A convenience exists in every binding or in none (docs/reference/bindings-v1.md §1, principle 2). Every removed allowlist entry goes with its item, and no entry cites #499, #500 or #487 any more. Each binding's CHANGELOG has a migration note under ### Changed, marked Breaking, old → new.

Error codes, in all four, generated

• scripts/fetch-v1/gen-constants.py generates the codes from spec/fetch-v1/constants.json into every binding, so --check covers them and no binding types a code by hand:
  • Go: ErrorCode plus Code…, as a type of the public package's own (go/chtypes/codes_gen.go, no methods), and ocifetch's own Code….
  • Python: CODE_*, in the private chtypes._codes.
  • TypeScript: CODE_* and the ErrorCode union.
  • Rust: chtypes::code::*, which Error::code() returns.
• bindings-v1.md §4 gains a codes table, and the gate reads it.
• A code's exit status is now the command's, never the library's. Go's ErrorCode.ExitCode() and .Sentinel() are removed, and so is TypeScript's ArtifactError.exitStatus. The CLIs keep the exit status internally.

Go

• ArtifactError no longer exports Msg, Err, Request, Platform or Source. Use Error() and errors.Unwrap.
• Every fetch error's message now names the request, the platform and the source it concerns, wherever its text did not already. A source URL's password is redacted. TestFetchErrorMessageCarriesRequestPlatformSource pins this, including the "layer: %v" case.
• FetchOptions.ConnectTimeout and .IdleReadTimeout are removed.
• Format.CHName() is renamed Format.ChName(), through the generator.

Python

• chtypes.errors.internal and misuse are private (Python: chtypes.errors exports internal and misuse helpers through __all__ #499).
• SourceUnreachableError.retryable and .retry_after are removed. retry_after was never set.
• TrustedKey is no longer public. FetchOptions.trusted_keys takes hex keys, as Go and Rust do, and derives each key id.

Rust

• Refusal.detail is removed. A one-sided finding is now in got, as the other three already did, and Refusal is #[non_exhaustive].
• The fetch layer's own corruption now has an empty reason (it was "fetch"), as Go's has.
• FetchOptions.platform is removed.
• reason::is_lossy is renamed reason::lossy, through the generator.

TypeScript

• ArtifactError now carries reason, path, want and got, as Go and Python do.
• LoaderCorruptError and LoaderErrorFields are removed. The loader's corrupt refusal is an ArtifactCorruptError.
• isChtypesError is removed. Since v2 fetch: zero-request frozen paths (#414), Go frozen re-download, TS lock platforms and error class, Python index duplicates (#487) #606, e instanceof ChtypesError is the same test.
• retryAfterRefused, BatchOutcome and batchOutcomeKnown are removed.
• FetchOptions is now an interface of its own, so the gate reads its fields; an allowlist entry covers them, like the other three bindings' entries.
  • trustedKeys takes hex keys.
  • platform and lockAllPlatforms are removed. A registry opens libraries for this host only, and CHTYPES_TARGET stays the CLI's.
• Python and TypeScript now ignore a trusted-keys option, without validating it, on a channel that honors no trust override, as Go and Rust already do.

Documentation

• bindings-v1.md §3 gains the discover_query_param row; all four bindings have that vocabulary on v2.
• §3 also states the rule that a TypeScript fact is a free function. The gate's §3 reader does not read free-function spellings (it reads a TypeScript fact as a member), so the four fact spellings stay allowlisted as the documented idiom, with no issue.
• §4 says where each binding carries a loader refusal's fields.
• §6 says the trusted keys are hex, and that no option names a platform or a timeout.
• The per-language reference pages, the Go tour and the TypeScript tour are updated to match.

Test plan

Run locally, each gate on its own and unpiped, with its exit status:

• go vet ./...: 0. go test ./... with the ABI v2 stubs (CHTYPES_ABI2_STUBS): 0. The Go fetch conformance (TestConformance(V1|ProdV2), TestDevChannel*) against tests/fixtures/fetch-v1 and fetch-v2: 0.
• uv run pytest -q with the stubs and both conformance corpora: 0 (712 passed, 3 skipped by name).
• ruff check and ruff format --check: 0.
• scripts/fetch-v1/gen-constants.py --selftest and --check: 0. scripts/abi-v1/gen.py --check, --major 2 --check and --selftest: 0. check-no-hand-decls.py --scope all: 0.
• scripts/parity-surface.py --selftest: 0. scripts/parity-surface.py run --only go python: 0, green, with no findings and no allowlist problems.
• policy-merge-check.py --check-ci-names and --check-guide: 0. lint-public.sh, lint-spelling.sh, lint-cited-paths.sh, check-quoting-passthrough.py, check-no-error-code-table.py, check-reserved-test-names.sh and check-selftests-wired.py: 0.
• check-cli-parity.sh go and python: 0.
• markdownlint-cli2 and dprint check: 0. biome lint (ts): 0. rustfmt --check on every changed Rust file: 0.
• TypeScript and Rust build, test, clippy and the parity gate's TypeScript and Rust surfaces: CI only, since there is no local cargo or pnpm build.
• golangci-lint: CI only. The local binary was built with an older Go and cannot read Go 1.27.2's export data.

Related issues

Closes #499
Closes #500

🤖 Generated with Claude Code