LH012 sources

What was read for LH012, when, and what each source is. All reads were anonymous: no account, key or credential was used or sent. Times are UTC on 29 September 2026; data/read_log.csv holds every logged read's time, endpoint, query text, HTTP status, rows returned and, for ClickPy, the rows and bytes read as ClickHouse reported them. This file is started in phase 1 (before the brief was fixed) and is completed in phase 2. Repository sources are cited by their number in the repository's sources.md.

Two web searches were made between 06:26 and 06:27 through the harness's search tool (not logged in data/read_log.csv): "PyPI download logs older package versions share Python version empirical study" and ""technical lag" PyPI downloads deployed versions pinned requirements empirical". Opened from their results: L04, L05 and D06. Not opened: https://arxiv.org/pdf/2608.12853 (bytecode security), https://arxiv.org/pdf/2603.07919 (social proof and downloads), https://arxiv.org/pdf/2408.10327 (package-level deprecation in Python), https://arxiv.org/pdf/1907.11073 (an empirical analysis of PyPI; LH011's check listed it from a summary), the medium.com and dev.to copies of van Kemenade's series, https://arxiv.org/pdf/1806.01545 (the arXiv copy of L03), a scribd copy of an npm technical-lag paper, three github.com issue pages (pip issue 9284 and two unrelated repositories; github.com's issue pages return HTTP 403 here) and two pypi.org project pages for a freeze-requirements tool. pypdf 6.19.0 was installed from PyPI into scratch space between 06:19 and 06:23 to read L03 and L04; that download was not logged.

What each source is, and its limits, as far as the brief relies on it

• K1, ClickPy. A copy, not the original. The tables the brief reads are materialised views of pypi.pypi (data/clickpy_schema.csv): pypi_downloads_per_day_by_version, ..._by_python (python_minor), ..._by_system, ..._by_installer_by_type; pypi.pypi carries ci, libc (lib, version), type and filename besides. The staging table pypi_raw holds python as a full string and distro.libc; the step from it to pypi.pypi is not in the catalogue. ClickPy's own README (D05) documents a backfill import that sets python_minor to the first two dot-separated parts of python and system to system.name, and keeps only rows where both are non-empty; whether the live ingestion does the same was not checked.
• K2, PyPI JSON. The versions and files listed at the read; a deleted version is absent, yanked is the state at the read, and a file's requires_python is the metadata the installer reads. Declared requirements (requires_dist) are the version's own metadata; for a version read through the project JSON they are the latest version's.
• K3, the installers' source. pip 26.2.1 (src/pip/_internal/network/session.py, user_agent()): python is platform.python_version(); on Linux, distro.libc is {"lib": "glibc", "version": ...} when a glibc version is found and absent otherwise (utils/glibc.py, libc_ver()), so pip never reports musl; system.name is platform.system(). uv 0.12.8 (crates/uv-client/src/linehaul.rs): python is the full Python version of the PEP 508 marker environment passed to it, or null when none is; libc is glibc or musl with its version, from the platform; system.name is the markers' platform_system. Which interpreter's markers each uv command passes was not read.
• D03, linehaul's parser. pip 6 and later and uv send a JSON user agent that linehaul parses whole; older clients' user agents are parsed by pattern and many carry no Python version.
• L01, L02. SPEC 0 recommends dropping support for Python versions three years after their initial release and for core package dependencies two years after theirs; NEP 29 recommended supporting the Python minors released in the prior 42 months. Policies, context only.
• L03, L04, L05. Measure declared constraints (L03, L04) or the Python field of pip downloads across all packages (L05); none measures which versions of a library are fetched.
• Not read. BigQuery itself (S20); linehaul's BigQuery schema (D04 returned 404); ClickPy's live ingestion; github.com's pages for aiobotocore's issues on its botocore bound (programme.md, Next), which returned HTTP 403 to the previous check and were not tried again.

Added after the snapshot: phase 2 reads (29 September 2026)

This section was added after the brief's snapshot on issue #14 (06:35 UTC); the text above it is as snapshotted. Phase 2's reads are logged in data/read_log_phase2.csv (amendment 1), all anonymous, all HTTP 200 at the transport level.

ClickHouse answered 15 or so of these queries with HTTP 200 and then streamed an error into the body (a result over 10,000 rows); they are in the log with the rows they read, and the collector discarded and split them (amendment 2). No documentation page was read in phase 2.

Added for version 0.4 (29 September 2026, late evening)

Anonymous reads, none of them a download count, made to check when pip stops fetching each version it tries from PyPI (the record's walk paragraph; notes/R-0025.md, problem 2).