[F48 dry-run] validate publish chain on workspace 0.0.0

cargo publish --dry-run on each of the 9 workspace crates:
- Tier 1 leaves (mxaccess-codec, mxaccess-rpc, mxaccess-asb-nettcp)
  pass cleanly. cargo assembles each tarball, the only failure is
  the dry-run upload abort.
- Tiers 2 + 3 (galaxy, callback, asb, nmx, mxaccess, mxaccess-compat)
  surface the documented "no matching package" registry-lookup
  failure because workspace internal deps are pinned at version
  "0.0.0" which doesn't exist on crates.io. Expected; resolves at
  actual publish time once the leaves are uploaded and indexed.

cargo package --list confirms each crate ships only source + tests
+ small round-trip fixtures. No captures, decompiled binaries, or
accidental big files.

design/F48-publish-dry-run.md captures the per-crate run output,
the per-crate file count, and the V1 publish recipe (bump 0.0.0
→ 0.1.0 across workspace + internal-dep pins, publish in tier
order, wait for indexing between tiers, tag).

design/followups.md F48 entry annotated with the dry-run status.
The actual publish to crates.io is deliberately not done — that
needs maintainer auth + a deliberate version bump that's a release-
cut decision, not a routine validation.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

design/F48-publish-dry-run.md

@@ -0,0 +1,65 @@
+# F48 publish dry-run validation — 2026-05-06
+
+This document captures the per-crate `cargo publish --dry-run` outcome on the V1-pre-cut workspace state. Run from `rust/` against the workspace at `version = "0.0.0"`.
+
+## Tier 1 — leaves (no internal deps)
+
+```text
+$ cargo publish --dry-run -p mxaccess-codec --allow-dirty
+    Finished `dev` profile [unoptimized + debuginfo] target(s)
+   Uploading mxaccess-codec v0.0.0
+warning: aborting upload due to dry run                          ← OK
+
+$ cargo publish --dry-run -p mxaccess-rpc --allow-dirty           ← OK
+$ cargo publish --dry-run -p mxaccess-asb-nettcp --allow-dirty    ← OK
+```
+
+All three pass. The `cargo package` step assembles the source tarball without errors; `--dry-run` aborts only at the network upload step.
+
+## Tiers 2 + 3 — dependent crates
+
+```text
+$ cargo publish --dry-run -p mxaccess-galaxy --allow-dirty
+Caused by:
+  no matching package named `mxaccess-codec` found
+  location searched: crates.io index
+  required by package `mxaccess-galaxy v0.0.0`
+```
+
+Identical "no matching package" failure for:
+- `mxaccess-galaxy`, `mxaccess-callback`, `mxaccess-asb` (tier 2)
+- `mxaccess-nmx`, `mxaccess`, `mxaccess-compat` (tier 3)
+
+This is **expected** — the workspace internal deps are pinned at `version = "0.0.0"` (placeholder for the as-yet-unpublished V1 cut). Cargo's registry lookup happens even with `--no-verify`, and `0.0.0` won't exist on crates.io until the leaves are actually published. The dependent crates will dry-run cleanly after each upstream tier lands.
+
+## Package contents
+
+`cargo package -p <crate> --list` confirms each crate's tarball includes only source, tests, and fixture data — no captures, decompiled binaries, or accidental large files.
+
+| Crate | File count | Notes |
+|---|---|---|
+| `mxaccess-codec` | 27 | source + 2 round-trip fixture binaries (~1KB each) |
+| `mxaccess-rpc` | 16 | source only |
+| `mxaccess-asb-nettcp` | 12 | source only |
+| `mxaccess-galaxy` | 11 | source only |
+| `mxaccess-callback` | 9 | source only |
+| `mxaccess-asb` | 14 | source only |
+| `mxaccess-nmx` | 7 | source only |
+| `mxaccess` | 18 | source + 7 examples |
+| `mxaccess-compat` | varies | source + 5 live tests |
+
+## What the actual V1 publish needs
+
+Per F48's "Resolves when":
+
+1. Bump workspace version `0.0.0` → `0.1.0` in `rust/Cargo.toml` `[workspace.package]`.
+2. For each crate's `[dependencies]` block, bump the workspace-internal `version = "0.0.0"` pins to `version = "0.1.0"` (path deps can stay).
+3. Publish in tier order (1 → 2 → 3). Wait for crates.io to index each tier (~30–60s) before starting the next.
+4. After all 9 are live, run `cargo install mxaccess` from a fresh checkout — should resolve cleanly without `--locked`.
+5. Tag `git tag v0.1.0 && git push origin v0.1.0`.
+
+## Open observations
+
+- The `--allow-dirty` flag was used because the workspace has uncommitted edits during this validation pass; the actual publish should run from a clean working tree without that flag.
+- `Cargo.lock` is included in the published tarball for binary-target crates (notably `mxaccess` ships examples). This is the cargo default for crates with executables; library-only crates don't need it but cargo includes it anyway under the modern resolver.
+- No `package.exclude` rules were tripped: the `tests/fixtures/m6-buffered/*.bin` files in `mxaccess-codec` are tiny (round-trip fixtures, not big captures) and are deliberately shipped because the parity tests reference them.

design/followups.md

@@ -7,6 +7,8 @@ move to `## Resolved` with a date + commit hash.
 ## Open
 
 ### F48 — Execute `cargo publish` for the V1 release cut
+**Dry-run status (2026-05-06):** `cargo publish --dry-run` validation pass per `design/F48-publish-dry-run.md`. Tier 1 leaves (`mxaccess-codec`, `mxaccess-rpc`, `mxaccess-asb-nettcp`) dry-run cleanly. Tiers 2 + 3 surface the documented "no matching package" registry-lookup failure for unpublished workspace internal deps — expected, resolves at actual publish time. All 9 crates' `cargo package --list` outputs are clean (no captures, no big files; only source + tests + tiny round-trip fixtures). The actual publish to crates.io has not happened — that's the maintainer-driven V1 cut step.
+
 **Severity:** P1 — V1 release driver. F43 only validated dry-run for the leaf crates; the actual publish to crates.io has not happened.
 **Source:** `design/60-roadmap.md:100` (M6 DoD bullet 6 — "Release: cargo publish all crates"); `CHANGELOG.md` "Publish order" section.
 **Depends on:** F43 (dry-run validation), F49 (live verification of M6 features before publishing them).