The serve-path read handle -- a record of two intent operations over a registry mount, whose private state (the per-origin fetch configuration and the shared cache) the closures capture. Both fields return IO so a backend stays decoupled from the proxy core, exactly as the publish-side handle does.

A resolved full manifest: the typed packument-level view, the raw document it was decoded from (the serve path edits and re-serialises it), and the ContentDigest of the wire bytes both were derived from -- the input fingerprint the serve path's derived ETag is built over (Conditional).

A SHA-256 digest of one origin's wire body -- the exact bytes a manifest was decoded from, hashed once at the read boundary (where the strict body already exists) so downstream consumers can fingerprint a document without re-encoding or re-hashing it. Opaque: built only by digestOf, read only by digestBytes.

Digest a strict body -- one O(body) pass, paid at fetch time, never per serve.

The digest's raw 32 bytes, for feeding into a wider fingerprint.

Why a metadata fetch could not yield a usable result -- reported as a value so the serve path maps each cause onto the response it renders, byte-for-byte as before.

Each constructor preserves a distinction the serve path acts on: a name mismatch is held apart from a plain decode failure because a mount answering for a different package is an untrusted, misreporting origin (the anti-shadowing defence), dropped and surfaced distinctly rather than degraded like an outage.

The outcome of resolving one version's metadata for a policy decision: the projected version snapshot when present, or the degrade both the serve-time gate and the mirror worker map onto their own response. It is the shared classification of a single-version fetch, so the gate that decides what to serve and the worker that decides what to mirror reach the same three outcomes from the same fetch and projection.

Resolve a single version's metadata through a MetadataClient and classify the outcome into a VersionEvaluation: the one fetch-and-project step both the serve-time tarball gate and the mirror worker run before the rules engine, so a future rule that reads a new field sees the same projected PackageDetails in either context.

A transport fault (the exception channel the client leaves to its caller) and any MetadataError alike classify as VersionMetadataUnavailable, collapsing every unobtainable-metadata cause to the one transient outcome; a resolved-but-absent version is VersionMissing; a resolved version is VersionPresent. Total: a fetch failure becomes a classified value, never an escaping exception.