v7.0.0

Changed

• Bumped the workspace line to 7.0.0 because FFHN intentionally breaks its public contracts again: ffhn.target, ffhn.extraction_record, ffhn.state, ffhn.run_report, ffhn.last_run_snapshot, ffhn.notification_payload, ffhn.batch_run_report, and ffhn.status_report now ship on schema version 1, 3, or 4 as applicable; target notifications are now modeled as notification_endpoints plus notification_routes; persisted state now models baseline plus typed last_run; last_run.json now stores a dedicated wrapper artifact instead of pretending to be the final emitted ffhn.run_report; run reports now use baseline_phase_before_run / baseline_phase_after_run without the old target-status projection; and extraction records remain FFHN-owned instead of persisting raw upstream HTMLCut metadata.
• Bumped the maintained workspace dependency floor to assert_cmd 2.2.1, clap 4.6.1, time 0.3.47, and htmlcut-core v10.0.0; FFHN's frozen HTMLCut adapter now builds plans through HTMLCut's current interop types while continuing to reject unsupported HTMLCut selection or output modes outside FFHN's own contract.
• Added explicit CLI output-format selection for run and status: compact json, json-pretty, and human-oriented summary now render the same canonical FFHN result documents without changing the underlying machine contract.
• Centralized the maintained Rust toolchain, coverage toolchain, and Cargo QA tool version pins in tooling/rust-tooling.env, added the repo-owned bootstrap-rust-tools.sh installer, and aligned CI plus the contributor devcontainer with that one manifest instead of duplicating tool-version facts across workflows and setup docs.
• Added a first-class artifact hygiene system: FFHN now keeps Cargo output in managed sibling roots by default, exposes cargo xtask hygiene report|verify|clean, isolates coverage and semver scratch under typed managed roots, validates the same policy in the contributor devcontainer, and documents the maintained cleanup workflow instead of relying on ad hoc target/ deletion.
• Rebuilt the maintained documentation index into a task-oriented routing page under docs/README.md and clarified the root README so the storefront now uses plain language, an explicit quick-start sequence, and direct links to the quick start, full docs index, and highest-signal contract references.
• Standardized the public naming split across maintained docs: FFHN is now the prose product name, while lowercase ffhn is reserved for literal identifiers such as commands, crate names, schema ids, file names, release assets, and URLs; the repo-contract suite now enforces that distinction for public Markdown prose.
• Routed maintained RustSec auditing through cargo xtask audit, which now owns bounded retries for transient advisory-database fetch failures and is shared by the local maintainer gate plus cross-platform CI instead of duplicating raw cargo audit calls in multiple lanes.

Fixed

• Unified disabled-target behavior across explicit runs, dry-runs, and watch-root discovery: FFHN now keeps disabled targets visible in discovered batches, reports them as skipped_disabled, and never executes their fetch or extraction stages.
• Replaced raw fatal stderr for explicit missing or unreadable target paths with structured target_unavailable / unavailable_target run and status results, and added trusted display_name identity to valid run and status documents so operators do not have to remap opaque target ids by hand.
• Simplified the top-level CLI contract so bare ffhn is clear usage error, ffhn --version is one parseable line, misplaced operation flags get directed recovery guidance, and the built-from-source path is documented against FFHN's managed artifact roots instead of hidden behind cargo run.
• Realigned the release smoke and post-release verification path with the shipped CLI contract: packaged artifact checks now treat ffhn --version as one exact line instead of a two-line banner, and the release protocol plus release-script tests now enforce that same owned contract.
• Tightened summary-mode CLI rendering so valid run reports without trusted display names, partial fetch reports without a final URL, and fatal batch entries without a path all render cleanly through the same maintained contract instead of relying on implicitly covered happy-path shapes.
• Reworked live persistence finalization so persist.state_commit and persist.last_run_write are separate durable write paths, notification routing no longer races a later last_run.json downgrade, persist timing reflects the real write boundaries, and batch outcome counts now report any persist failure instead of only the old persist_error result shape.
• Hardened snapshot persistence by staging history archives inside the same transaction boundary as state.json, preserving the primary write failure when rollback also fails, and surfacing rollback/cleanup detail through a dedicated structured persist_transaction process-error kind instead of collapsing it into generic internal noise.
• Enforced local-file fetch.max_bytes as a bounded read instead of a post-read check, extended public Rust read APIs with coherent target/report view types plus growable non-exhaustive vocabularies, and removed the panic-prone raw-string TargetPaths::new constructor from the public boundary.
• Fixed the HTMLCut v10 file-target seam so FFHN no longer forces file:// fetch URLs through HTMLCut's HTTP-only input-base contract; file targets now preserve HTMLCut's documented rewrite behavior, including warning with EFFECTIVE_BASE_URL_UNRESOLVED when URL rewriting has no effective HTTP(S) base.
• Moved dependency freshness out of the required correctness gate, added markdown-embedded target example validation plus toolchain-manifest drift checks to the repo-contract suite, refreshed the maintained fuzz seeds and public docs to the new contracts, and made maintained shell/Rust entrypoints scrub stale ambient compiler overrides instead of inheriting broken host LLVM paths.
• Path-gated the contributor-devcontainer-gate CI job so it fires only when devcontainer-relevant files actually change (.devcontainer/, the devcontainer helper scripts, or check.sh); non-devcontainer PRs now skip the full Docker build-and-run cycle entirely, reducing typical PR wall-clock time from ~45 minutes to ~3 minutes.
• Added a devcontainer-changes detection job that computes a git diff of the PR's changed files against the devcontainer trigger paths before the gate is evaluated; the aggregate Check required-status job uses if: always() with explicit ${{ toJSON(needs.*.result) }} failure detection so a correctly skipped contributor-devcontainer-gate does not prevent Check from being reported or block merge — only a failed or cancelled gate prevents success.
• Made the contributor-container bootstrap contract self-contained by removing the image-build dependency on an untracked helper import, moved the validator's Dev Container CLI helper onto a pinned supported Node 20 runtime, pinned a Docker Buildx CLI plugin into that helper so Dev Containers no longer falls back to Docker's deprecated legacy builder path, fixed the helper Dockerfile so its base-image override is declared in valid Docker arg scope, taught the helper path to trust the mounted repo as a Git safe directory so Buildx can capture commit metadata cleanly, and widened the CI devcontainer trigger set to include tooling/rust-tooling.env, scripts/bootstrap-rust-tools.sh, and the workflow file that defines the gate so contributor-environment drift cannot bypass validation.
• Added a Windows Defender exclusion for the Cargo target/ directory in cross-platform-rust-gate before any Cargo operations begin, eliminating AV scan overhead that otherwise scans every file write during compilation.
• Fixed the maintained release-shell Cargo-target helpers on Windows by owning the Git-Bash/native-python3 path-conversion boundary explicitly, so release scripts and cross-platform release checks now read the committed .cargo/config.toml artifact roots correctly, keep default and custom Cargo target roots in one stable /d/... path dialect, and avoid silently falling back to a repo-local target/ path.
• Fixed the GitHub Actions Rust-cache ownership boundary by excluding ~/.cargo/bin from cached state in both CI and release publication lanes, keeping tool entrypoints under the repo-owned bootstrap contract, and tightening bootstrap-rust-tools.sh plus devcontainer validation to prove the stable Cargo surface with a real subcommand instead of trusting version output alone.
• Fixed a Windows-specific flaky test in the ffhn-core fetch suite where dropping a TcpListener did not guarantee immediate ECONNREFUSED — the port lingered and the 1-second timeout fired, producing FetchTimeout instead of FetchNetworkError; replaced the dropped-listener pattern with a server that accepts and reads the request then resets the stream, producing a reliable FetchNetworkError on all platforms.
• Tightened ffhn.run_report validation around lifecycle ownership: live successful runs now require baseline_phase_after_run = has_baseline, dry-run reports may not mutate the durable phase, initialized requires baseline_phase_before_run = never_succeeded, and live changed / unchanged runs require baseline_phase_before_run = has_baseline.
• Removed the legacy top-level state_phase recovery path from invalid persisted-state handling; FFHN now recovers invalid-state phase only from the current ffhn.state baseline.kind shape instead of carrying an obsolete generic-surface compatibility path.
• Removed the duplicate workspace-version.sh release entrypoint and routed release docs, workflows, and helper scripts through the canonical workspace-package-field.sh version contract; the repo-contract AFAD parser now accepts only the committed **Version:** protocol heading syntax.
• Fixed ffhn run selector diagnostics so missing --target or --all is named explicitly, prefixed fatal stderr output with error: consistently, and made release scripts surface missing tokens, unsupported targets, or incomplete asset inventory before complaining about a dirty tracked checkout.
• Rebuilt the maintained run and status help surfaces around explicit grammar, runnable command examples, structured-stdout notes, and separate operational notes; target-authoring TOML blocks no longer masquerade as command grammar, and conflicting run invocations now reuse the same canonical usage synopsis as --help.
• Made ffhn.status_report schema 4 expose target enabled for every valid target so disabled targets no longer masquerade as generic pending, fixed lock_unavailable reports to recover lifecycle metadata from one stable post-contention state view instead of fabricating never_succeeded, and switched the maintained devcontainer shell entrypoints to linear Docker build progress by default so terminal and agent users can read real build logs.