[Volv-G]

Problem

A resolve-config entry's version constraint did not work:

• digest entries: the constraint (direct or inherited from _defaults) was ignored. The pin, or its deprecation successor, shipped whatever its version.
• name entries: a constrained lookup never matched against a real server. It compared against ComponentInfo.version, but the published-components listing (PublishedComponentResponse) has no version field, so that was always None. The version only exists in the component spec (GET /api/components/{digest}). Existing tests hid this by fabricating ComponentInfo(version=...).

Change

Constraints are checked against the spec's own version (metadata.annotations.version, then top-level version):

• name: only candidates whose spec satisfies the constraint are considered, and the highest is chosen. Missing specs (404) are skipped; other errors propagate.
• digest: deprecation successors are followed only while they satisfy the constraint. Starting at the pin, links that don't satisfy are passed until one does, and the walk stops before a successor that would leave the range.
  • 1.0 → 1.5 → 2.1 with "<2" ships 1.5.
  • 1.0 → 3.0 → 1.5 with "<2" ships 1.0.
  • A 1.0 pin superseded by 2.1 still ships 2.1 under ">=2".
  • With upgrade_deprecated=False only the pin is checked.
  • A custom digest resolver's result is checked, not replaced.
• Mismatch: a miss. The entry's local source or the next entry is tried, and if nothing matches hydration reports the component as not found.
• Missing digest: a digest whose specs are all missing is still an error, as without a constraint. A successor that 404s after an accepted link keeps that link.
• No version: a spec without a version never satisfies a constraint.

TangleApiClient.resolve_digest takes an optional accept predicate for the constrained walk. Without it, the result is unchanged.

Unchanged and out of scope: entries without a constraint, url primaries, version-parsing quirks, and a local source winning on a higher version (now documented).

Tests

tests/test_resolve_config_version_constraints.py drives PipelineHydrator.resolve_components over resolve:// fragments. Only the client's HTTP transport is faked, returning server-shaped listing rows without a version and specs that carry one. Assertions are on the shipped component or the error raised.

The tests/test_symbolic_publisher_hydration.py fixture is now server-shaped as well.