CAS: type=encrypted wrapping a CAS disk — CREATE succeeds, INSERT fails with Autocommit writes are not supported

[alsugiliazova]

✅ I checked the Altinity Stable Builds lifecycle table, and the Altinity Stable Build version I'm using is still supported.

Type of problem

Limitation / feature gap — composition accepted at config / CREATE TABLE, refused on the first write.

Describe the situation

A type=encrypted disk wrapping a metadata_type=cas disk is accepted. CREATE TABLE succeeds. The first INSERT fails with Code: 48 NOT_IMPLEMENTED.

This issue:

• Is a late failure: the operator only learns the combination is unusable on the first write
• Is distinct from S3 SSE on the CAS object-store disk, which is the supported encryption path
• Matches audit item CAS-113 (DiskEncrypted over CAS is unguarded)

Confirmed on PR #2159 (f76335f4d1a3933d80fe9812e47eca3f61eaa686), 26.6.2.20000.altinityantalya arm64 release.

---

How to reproduce the behavior

Environment

• Version: 26.6.2.20000.altinityantalya
• Build: PR 2159 arm64 release
• Backend: MinIO / RustFS (admin / password)

Config (equivalent XML)

<clickhouse>
    <storage_configuration>
        <disks>
            <cas_disk>
                <type>object_storage</type>
                <object_storage_type>s3</object_storage_type>
                <metadata_type>cas</metadata_type>
                <server_root_id>encrypted-cas-repro</server_root_id>
                <endpoint>http://minio:9000/warehouse/encrypted_cas_repro/</endpoint>
                <access_key_id>admin</access_key_id>
                <secret_access_key>password</secret_access_key>
            </cas_disk>
            <encrypted_cas>
                <type>encrypted</type>
                <disk>cas_disk</disk>
                <path>encrypted/</path>
                <key>firstfirstfirstf</key>
            </encrypted_cas>
        </disks>
        <policies>
            <encrypted_cas_policy>
                <volumes>
                    <main>
                        <disk>encrypted_cas</disk>
                    </main>
                </volumes>
            </encrypted_cas_policy>
        </policies>
    </storage_configuration>
</clickhouse>

Steps (exact SQL from the failing test)

The run used an inline nested disk() instead of the XML policy. Same composition:

CREATE TABLE encrypted_cas_repro (id UInt64, s String)
ENGINE = MergeTree
ORDER BY id
SETTINGS disk = disk(
    type = encrypted,
    disk = disk(
        type = object_storage,
        object_storage_type = s3,
        metadata_type = cas,
        server_root_id = 'encrypted-cas-repro',
        endpoint = 'http://minio:9000/warehouse/encrypted_cas_repro/',
        access_key_id = 'admin',
        secret_access_key = 'password'
    ),
    key = 'firstfirstfirstf',
    path = 'encrypted/'
);

CREATE returns 0. Then:

INSERT INTO encrypted_cas_repro VALUES (1, 'x');

---

Expected behavior

Either reject at disk load / CREATE TABLE with a clear message that encrypted must not wrap a content-addressed disk, or support the composition.

---

Actual behavior

CREATE TABLE succeeds.

INSERT fails:

Received exception from server (version 26.6.2):
Code: 48. DB::Exception: Received from localhost:9000. DB::Exception: Autocommit writes are not supported for content part files on a content-addressed disk: While executing WaitForAsyncInsert. (NOT_IMPLEMENTED)
(query: INSERT INTO encrypted_cas_89c35ef4_97de_11f1_a1a6_de7b9eea3491 VALUES (1, 'x'))

Regression test: /cas/content addressed storage/encrypted wrapping cas/create succeeds and insert is readable

---

Additional context

• Related PR: #2159
• Tracking: #2031 CAS-113
• Recommended alternative until this is designed: S3 SSE on the CAS object_storage disk