v6.0.0

Fixed

• Made dry-runs and status waits resilient behind active live-run locks while surfacing missing or non-directory watch roots at the watch-root path instead of a fabricated nested target.toml path.
• Added a pinned Ubuntu 24.04 contributor devcontainer, a writable-cache repair hook, maintained validate-devcontainer.sh and run-devcontainer-check.sh entrypoints, and the matching docs/CI contract so FFHN's preferred development path is one reproducible container environment instead of a hand-assembled host toolchain; the contributor workflow now keeps both target/ and fuzz/target/ on dedicated Docker volumes, and the semver lane precreates a namespaced temp-root scratch tree before cargo semver-checks starts so mounted host filesystems do not strand busy tombstones under the repository target/ tree.
• Strengthened the contributor-container validation path so validate-devcontainer.sh now proves the real Dev Container client flow in addition to the raw image contract, derives that helper path from the already-built contributor image instead of a second remote base image, run-devcontainer-check.sh can reuse the validator's warmed image in CI instead of rebuilding it immediately, and ./check.sh shows normal Cargo startup output instead of looking hung on cold runs.
• Hardened the host-native maintainer and release path for flaky repository mounts by making cargo xtask's final dist smoke plus coverage report and build-release-artifact.sh all honor the active CARGO_TARGET_DIR instead of assuming a repo-local target/ tree.
• Release handoff scripts now reject tracked checkout drift before publishing or verifying GitHub releases, so maintained local release entrypoints all derive version and asset expectations from one checkout state.
• Bumped the unreleased workspace line to 6.0.0 because ffhn-core intentionally breaks its public configuration and notification-report surfaces again: file fetches now use their own typed schema instead of inheriting HTTP-only knobs, notification payloads and delivery entries now use explicit write and delivery result objects, and the exported Rust contract types now expose a coherent read API instead of half-private result bags.
• Tightened FFHN's public target and report contracts by making target source and fetch config discriminator-specific types, removing the redundant notification-trigger field from hook payloads and delivery records, enforcing stronger state/status/timestamp invariants during decode, removing the duplicate AFAD version: release stamp from maintained docs, hardening unsafe-code and truncating-cast lint boundaries, and making catalog/time/error-mapping internals more explicit and less reorder-fragile.
• Hardened the maintained release tooling for Windows and cross-platform portability by normalizing bash source paths, centralizing release-target script access through a Rust wrapper in xtask, making the release helpers self-describing with --help, and extending CI with a real macOS/Windows Rust gate plus retry-hardened toolchain bootstrap.
• Raised the cross-platform GitHub CI timeout budget to 150 minutes for Windows and 30 minutes for macOS so the Windows required-check lane can finish a cold cargo nextest build and run, dependency-policy, and semver verification instead of expiring mid-run and leaving the aggregate Check gate unset; added a .config/nextest.toml profile that warns after 60 seconds and terminates any single test after 180 seconds so a hanging test cannot silently exhaust the job budget.
• Fixed the Windows release-prep gate after live protocol exercise by making semver-baseline assertions line-ending agnostic and by teaching the delayed notification timing test to drain FFHN's JSONL hook payload before sleeping, so the Windows runner no longer hangs inside a healthy run_once notification proof.
• Removed Bash-4-only mapfile usage from the maintained release and contributor-container scripts so the release protocol and devcontainer validator run correctly under stock macOS /bin/bash as well as newer GNU Bash installs.
• Tightened the public CLI and report contract so run --help and status --help teach target layout directly, invalid target or state reports carry structured error_detail, ./check.sh --help behaves like a real entrypoint, and packaged archives reject macOS metadata sidecars during build and smoke verification.
• Hardened the executable and library boundaries by switching the CLI to args_os, making notification-hook stdin newline-delimited JSONL-friendly, moving the checked-in example hook log to a target-local path, narrowing ffhn-core's public read surface to deliberate view/projection types instead of internal config/report section structs, and splitting the major target/report/state/status/notification wire DTOs away from their validated domain models.
• Fixed the advertised minimal HTTP target so it validates as written, reclassified semantic target-config failures from toml to contract in structured status/run error detail, and made local source-archive plus checksum generation discoverable through a maintained build-release-source-archives.sh entrypoint and clearer checksum-prerequisite diagnostics.
• Reclassified persisted state.json and snapshot extraction.json contract failures from generic json decode errors into contract errors with concrete artifact paths where FFHN knows them, tightened the public Rust run-report API around canonical notification-delivery and persist-write status access instead of lossy helper booleans, and made the maintained local release builders refuse tracked dirty checkouts before they can emit mismatched assets or checksums.
• Clarified the executable and maintainer help boundaries by teaching that missing or unreadable target.toml paths remain fatal process errors, documenting the required cargo xtask refresh-semver-baseline --git-ref <REF> input directly in subcommand help, and aligning the core batch-runtime docs with the live outcome_counts.notification_failure aggregate.
• Made the curated cargo xtask coverage lane run test binaries with --test-threads=1, which keeps the instrumented CLI integration target deterministic when it spawns child ffhn processes under cargo llvm-cov.
• Closed a repo-integrity gap around the new contributor-container and split-module surfaces by tracking the maintained files, making repo-contract tests fail when public docs or maintained source trees depend on dirty-worktree-only files, and promoting the CI devcontainer lane from validator-only smoke to the full headless run-devcontainer-check.sh proof path.
• Unified xtask's maintained-surface inventory so trackedness checks, watchlist starter-target discovery, and checked-in example assets now derive from one canonical owner instead of separate partial root lists; the repo-contract and coverage test authorities were split into smaller modules, and the fuzz maintainer doc freshness cue now matches the current change date.
• Removed the misleading artifacts.current_valid / artifacts.previous_valid bag from ffhn.status_report so snapshot presence and invalid-state reporting are the only status signals consumers need to interpret.