diff --git a/design/F48-publish-dry-run.md b/design/F48-publish-dry-run.md
new file mode 100644
index 0000000..b680008
--- /dev/null
+++ b/design/F48-publish-dry-run.md
@@ -0,0 +1,65 @@
+# F48 publish dry-run validation — 2026-05-06
+
+This document captures the per-crate `cargo publish --dry-run` outcome on the V1-pre-cut workspace state. Run from `rust/` against the workspace at `version = "0.0.0"`.
+
+## Tier 1 — leaves (no internal deps)
+
+```text
+$ cargo publish --dry-run -p mxaccess-codec --allow-dirty
+    Finished `dev` profile [unoptimized + debuginfo] target(s)
+   Uploading mxaccess-codec v0.0.0
+warning: aborting upload due to dry run                          ← OK
+
+$ cargo publish --dry-run -p mxaccess-rpc --allow-dirty           ← OK
+$ cargo publish --dry-run -p mxaccess-asb-nettcp --allow-dirty    ← OK
+```
+
+All three pass. The `cargo package` step assembles the source tarball without errors; `--dry-run` aborts only at the network upload step.
+
+## Tiers 2 + 3 — dependent crates
+
+```text
+$ cargo publish --dry-run -p mxaccess-galaxy --allow-dirty
+Caused by:
+  no matching package named `mxaccess-codec` found
+  location searched: crates.io index
+  required by package `mxaccess-galaxy v0.0.0`
+```
+
+Identical "no matching package" failure for:
+- `mxaccess-galaxy`, `mxaccess-callback`, `mxaccess-asb` (tier 2)
+- `mxaccess-nmx`, `mxaccess`, `mxaccess-compat` (tier 3)
+
+This is **expected** — the workspace internal deps are pinned at `version = "0.0.0"` (placeholder for the as-yet-unpublished V1 cut). Cargo's registry lookup happens even with `--no-verify`, and `0.0.0` won't exist on crates.io until the leaves are actually published. The dependent crates will dry-run cleanly after each upstream tier lands.
+
+## Package contents
+
+`cargo package -p <crate> --list` confirms each crate's tarball includes only source, tests, and fixture data — no captures, decompiled binaries, or accidental large files.
+
+| Crate | File count | Notes |
+|---|---|---|
+| `mxaccess-codec` | 27 | source + 2 round-trip fixture binaries (~1KB each) |
+| `mxaccess-rpc` | 16 | source only |
+| `mxaccess-asb-nettcp` | 12 | source only |
+| `mxaccess-galaxy` | 11 | source only |
+| `mxaccess-callback` | 9 | source only |
+| `mxaccess-asb` | 14 | source only |
+| `mxaccess-nmx` | 7 | source only |
+| `mxaccess` | 18 | source + 7 examples |
+| `mxaccess-compat` | varies | source + 5 live tests |
+
+## What the actual V1 publish needs
+
+Per F48's "Resolves when":
+
+1. Bump workspace version `0.0.0` → `0.1.0` in `rust/Cargo.toml` `[workspace.package]`.
+2. For each crate's `[dependencies]` block, bump the workspace-internal `version = "0.0.0"` pins to `version = "0.1.0"` (path deps can stay).
+3. Publish in tier order (1 → 2 → 3). Wait for crates.io to index each tier (~30–60s) before starting the next.
+4. After all 9 are live, run `cargo install mxaccess` from a fresh checkout — should resolve cleanly without `--locked`.
+5. Tag `git tag v0.1.0 && git push origin v0.1.0`.
+
+## Open observations
+
+- The `--allow-dirty` flag was used because the workspace has uncommitted edits during this validation pass; the actual publish should run from a clean working tree without that flag.
+- `Cargo.lock` is included in the published tarball for binary-target crates (notably `mxaccess` ships examples). This is the cargo default for crates with executables; library-only crates don't need it but cargo includes it anyway under the modern resolver.
+- No `package.exclude` rules were tripped: the `tests/fixtures/m6-buffered/*.bin` files in `mxaccess-codec` are tiny (round-trip fixtures, not big captures) and are deliberately shipped because the parity tests reference them.
diff --git a/design/followups.md b/design/followups.md
index 298b354..9cd29d3 100644
--- a/design/followups.md
+++ b/design/followups.md
@@ -7,6 +7,8 @@ move to `## Resolved` with a date + commit hash.
 ## Open
 
 ### F48 — Execute `cargo publish` for the V1 release cut
+**Dry-run status (2026-05-06):** `cargo publish --dry-run` validation pass per `design/F48-publish-dry-run.md`. Tier 1 leaves (`mxaccess-codec`, `mxaccess-rpc`, `mxaccess-asb-nettcp`) dry-run cleanly. Tiers 2 + 3 surface the documented "no matching package" registry-lookup failure for unpublished workspace internal deps — expected, resolves at actual publish time. All 9 crates' `cargo package --list` outputs are clean (no captures, no big files; only source + tests + tiny round-trip fixtures). The actual publish to crates.io has not happened — that's the maintainer-driven V1 cut step.
+
 **Severity:** P1 — V1 release driver. F43 only validated dry-run for the leaf crates; the actual publish to crates.io has not happened.
 **Source:** `design/60-roadmap.md:100` (M6 DoD bullet 6 — "Release: cargo publish all crates"); `CHANGELOG.md` "Publish order" section.
 **Depends on:** F43 (dry-run validation), F49 (live verification of M6 features before publishing them).