build(release-automation): R6 publishability + R3.5 dep version requirements

[githubrobbi]

Summary

Bundles two phases of docs/architecture/release-automation-plan.md into one PR per the routing decision recorded in §8.1 deviations log:

• R3.5 — internal-dep version = requirements (silent shadow-mode failure unblocker)
• R6 — crates.io metadata audit + per-crate [package.metadata.docs.rs] + dry-run CI workflow + DORMANT publishing runbook

R3.5 — silent shadow-mode unblocker

R3 landed on 2026-04-25 (#67) and was expected to start producing per-merge release-plz update summaries. Twelve days passed with empty summaries on every push.

Root cause: release-plz update invokes cargo package per crate, and cargo refuses to package any crate whose [dependencies] lack a version = requirement, even with path = present. UFFS had:

• 8 internal-dep aliases in [workspace.dependencies] (path-only)
• 2 direct path-deps in crates/uffs-cli/Cargo.toml
• 1 polars git pin in crates/uffs-polars/Cargo.toml

…all unversioned. The failure was swallowed by the workflow's tee-to-log-file step + the empty-diff branch of the summary template, masking it from any reviewer who didn't expand the inner step log.

Fix

 [workspace.dependencies]
-uffs-polars = { path = "crates/uffs-polars" }
+uffs-polars = { path = "crates/uffs-polars", version = "0.5.90" }
 # ...8 internal aliases total

 # crates/uffs-polars/Cargo.toml
-polars = { git = "...", rev = "1e9a63b9...", features = [...] }
+polars = { git = "...", rev = "1e9a63b9...", version = "0.53.0", features = [...] }

 # crates/uffs-cli/Cargo.toml
-uffs-client = { path = "../uffs-client", default-features = false }
-uffs-format = { path = "../uffs-format" }
+uffs-client = { path = "../uffs-client", version = "0.5.90", default-features = false }
+uffs-format = { path = "../uffs-format", version = "0.5.90" }

just polars now updates the polars version = field in lockstep with the resolved git rev, so future polars major-version bumps don't drift the version requirement.

R3.5 verification

$ release-plz update --config release-plz.toml
* `uffs-polars`: 0.5.90
* `uffs-security`: 0.5.90
* ... (12 publishable crates total) ...

12 crates enumerated cleanly. uffs-diag excluded (per-crate publish = false); uffs-ci-pipeline / uffs-gen-hooks / uffs-gen-workflow excluded (per-package release = false blocks added in this PR).

R6 — crates.io metadata audit

Per-crate [package.metadata.docs.rs]

Added to all 12 publishable crates with targets / default-target calibrated per-crate:

Tier	Crates	targets
Single-target Linux	uffs-time, uffs-text, uffs-format, uffs-polars	(unset — defaults to Linux)
Linux + Windows	uffs-mft, uffs-core, uffs-daemon, uffs-client, uffs-cli, uffs-mcp	["x86_64-unknown-linux-gnu", "x86_64-pc-windows-msvc"]
Linux + Windows + macOS	uffs-security	three targets (Keychain on macOS, DACL on Windows, flock on Unix)
Windows-only	uffs-broker	default-target = "x86_64-pc-windows-msvc" (whole crate is Windows-specific)

Per-package publish / release overrides

• crates/uffs-diag/Cargo.toml — explicit publish = false (workspace-only diagnostic crate per plan §R6 step 2)
• release-plz.toml — [[package]] release = false for uffs-ci-pipeline, uffs-gen-hooks, uffs-gen-workflow (already publish = false at the crate level; this is the surgical fix to keep them out of release-plz's per-package iteration)

.github/workflows/crates-io-dry-run.yml

Weekly schedule (Mondays 06:00 UTC) + workflow_dispatch. Loops every publishable crate, runs cargo publish --dry-run -p <crate>, posts a per-crate status table to the workflow summary.

Currently runs in ADVISORY mode (FAIL_ON_DRY_RUN_ERROR=false) because two known-expected failure classes exist:

1. Crate-name reservations not yet pushed (R6 step 6, deferred): every dry-run fails with no matching package named uffs-X found until 0.0.0 stub versions are reserved on crates.io from a throwaway external workspace.
2. polars / chrono publishability gap: uffs-polars and any crate transitively depending on it fails with failed to select a version for chrono because the published-form polars = "0.53.0" resolution conflicts with the workspace chrono pin. Resolution is R8 dress rehearsal scope.

Flip FAIL_ON_DRY_RUN_ERROR=true once both blockers are resolved.

docs/publishing.md — DORMANT runbook

Covers:

• Pre-publish checklist (per go-live decision)
• Per-release checklist (every release post-R9)
• Yank decisions log
• Post-publish smoke checks
• Manual fallback ordering (when release-plz is unavailable)
• OIDC trusted-publisher section placeholder for R7
• Four-layer dormancy stack (publish = false workspace + per-package + if: false job + missing token)

Plan dashboard updates

docs/architecture/release-automation-plan.md §8 dashboard:

• R3 → 🟢 (PR build(release-automation): R3 release-plz shadow mode #67 reference + post-merge observation note)
• New R3.5 row 🟡 (this PR)
• R6 → 🟡 (this PR)
• R4 row updated: "Now unblocked by R3.5"

§8.1 deviations log: 3 new entries

• R3 → R4 readiness (silent failure root cause + R3.5 fix)
• R6 step 6 (crate-name reservations deferral)
• R6 → R8 publishability (polars/chrono gap)

docs/architecture/release-automation-baseline.md §10 R3.5 + R6 addendum (113 lines): silent-failure root cause, fix diff, validation evidence, R6 deliverables breakdown, deliberately-NOT-doing list, forward-compat assertion.

Deliberately deferred (not in this PR)

• Crate-name reservations on crates.io — plan §R6 step 6 mandates these happen from a throwaway external workspace, not the UFFS repo, so the UFFS repo never carries a publish = true state.
• cargo-semver-checks integration — needs a published baseline; deferred until post-R8.
• OIDC trusted-publisher scaffolding — R7 scope.
• Workspace-level publish = false flip — R8 scope.
• FAIL_ON_DRY_RUN_ERROR=true — flipped once both blockers above are resolved.

Validation

• ✅ cargo check --workspace --all-targets passes
• ✅ cargo fmt --check --all passes
• ✅ taplo format clean (formatting normalized)
• ✅ actionlint .github/workflows/crates-io-dry-run.yml passes
• ✅ typos clean
• ✅ release-plz update --config release-plz.toml lists 12 crates without error
• ✅ Local pre-commit hooks: file-size, typos, reuse, taplo all pass
• ✅ Local pre-push hooks: cargo-check, lint-ci, lint-prod, lint-tests, rustdoc, doc-tests, tests, smoke, deny, lint-ci-windows all pass

Files

• 18 modified (Cargo.toml × 14, release-plz.toml, just/test.just, plan.md, baseline.md)
• 2 added (.github/workflows/crates-io-dry-run.yml, docs/publishing.md)
• Net: +882 / −42 LOC

Plan refs

• docs/architecture/release-automation-plan.md §R6 (steps 1–5; step 6 explicitly deferred)
• docs/architecture/release-automation-plan.md §8 dashboard
• docs/architecture/release-automation-plan.md §8.1 deviations log (three new entries)
• docs/architecture/release-automation-baseline.md §10 (new addendum)