v0.67.5

Added

• Added [crates.e2e.snippets].curated_snippets: glob patterns (relative to output) declaring hand-authored snippet files as curated on purpose rather than alef-generated. Resolved into SnippetGenerationReport::curated_paths and into migration::MigrationEntry::curated, so both the generation report and alef e2e snippets-migrate can distinguish a declared, intentional absence of a generated equivalent from a genuine coverage gap.
• A curated_snippets pattern that matches zero files, or that matches a path alef itself generates, now fails the run instead of being silently accepted.
• Implemented render_snippet_body for the brew (shell) e2e code generator: documentation snippets for CLI-based bindings now render a single binary subcommand "<url>" --flags line, built from the same call-config resolution the executable brew e2e suite already uses.

Fixed

• docs.snippets validation now fails fast, before any toolchain runs, when a language needs a compiled artifact (compile/typecheck/run) but has no configured session that could plausibly have produced one yet -- no session at all, an ambiguous session, or a session with an empty before list. Warns always; under strict, bails immediately instead of spending an hour validating snippets that were doomed from the start (GH #256).

• alef snippets check --lang <language> (and any other filtered run_validation call) now prepares only the configured sessions its filtered snippet set actually needs, instead of running every configured before build hook regardless of the filter -- a single-language diagnostic no longer pays for every other language's build. Sessions sharing a working directory with a needed one are still prepared together, so the scratch sweep never treats a cohabiting session's live build cache as abandoned.

• resolve() on an alef.toml with zero [[crates]] entries now returns ResolveError::NoCratesConfigured instead of Ok(vec![]), so alef go-tag, alef validate versions --exit-code, and alef publish validate can no longer silently process zero crates and exit 0.

• alef check-registry --registry github-release now warns when it verified only that the release exists (no --asset-prefix or --required-assets given), so a CI variable that expanded to nothing is no longer indistinguishable from "all N artifacts are attached"; --registry zig/--registry swift are unaffected since they intentionally check existence only.

• alef e2e validate now applies the same [e2e].languages fallback (to the crate's scaffolded languages) that alef e2e generate --snippets-migrate and alef test-apps run already applied, so an unset [e2e].languages no longer silently disables the "0 test functions" and "unsupported language" checks. The success message also now distinguishes "no fixtures found" from "N fixtures validated".

• alef lint now fails when poly is not on PATH instead of warning and reporting a clean run; poly is the entire implementation of alef lint, so there was no partial coverage to report.

• alef release-metadata --targets now rejects a CSV that trims to non-empty but splits into zero real target tokens (e.g. ,,, or a lone ,), which used to resolve identically to the deliberate --targets none (release_any: false, exit 0, no diagnostic).

• Fixed the FFI feature-drift warning comparing each binding's configured feature set against [crates.ffi]'s configured set instead of the effective default set ([crates.ffi]'s configured features unioned with every feature discovered from emitted #[cfg(feature = "X")] gates) that scaffold_ffi actually writes into the generated FFI crate's Cargo.toml. Two configured lists could match while the effective set was a strict superset, and the warning stayed silent through that drift.

• Added codegen::cfg::effective_ffi_default_features as the single derivation of the FFI crate's effective default feature set, used by both scaffold_ffi and warn_on_ffi_feature_drift so the two can no longer disagree.

• warn_on_ffi_feature_drift now distinguishes unsafe host-only features (configured for a binding but absent from the FFI crate's effective default set, which can produce glue referencing a symbol the shipped library was never built with) from safe parity gaps (in the effective default set but undeclared by a binding, which the binding simply omits).

• Fixed FfiTargetDepOverride.default_features (per-target [crates.jni] target_dep_overrides) being ignored by the JNI Cargo.toml scaffolder: a per-target default_features = false never reached the generated [target.'cfg(...)'.dependencies] block, unlike the equivalent FFI crate scaffolding.

• Fixed snippet session identity so multiple configured targets that resolve to the same Language (e.g. kotlin + kotlin_android, or typescript/node/wasm) no longer collide when they validate the same physical package/working directory. resolve_session_claim now only reports SessionClaim::Ambiguous when same-language candidates validate genuinely different working directories; candidates sharing one directory collapse to a single deterministic SessionClaim::Claimed instead (issue #255).

• Added SessionIdentity trait (src/snippets/runner/session_resolution.rs) implemented for ValidationSession and SessionSpec, giving session-claim resolution access to a session's working directory alongside its language.

• Added regression coverage asserting session count collapses to one for kotlin + kotlin_android over one directory and for typescript + node + wasm over one package, plus a control case proving genuinely different directories still resolve as ambiguous.

• Swift snippet validation now resolves a session's SwiftPM module directories once per run.
  Every snippet previously launched its own swift build --show-bin-path; 32 concurrent warm
  lookups measured 1.33 seconds wall and 9.22 seconds CPU, versus 0.33 seconds wall and 0.26
  seconds CPU for a single lookup, before any swiftc validation work began. The cache is
  keyed on the resolved lookup inputs (package root plus environment) rather than on session
  identity, and holds no global state.

• alef validate versions --exit-code now asks checks_pass for its verdict instead of
  re-deriving it. The local copy disagreed in both directions: it exited 0 for a crate whose
  check set was EMPTY — the vacuous pass checks_pass explicitly refuses — and it exited 1
  on a blocked_on_publish row, which checks_pass deliberately tolerates because such a
  row is a lockfile entry pinning the crate at the very version being released and cannot
  resolve until that version is published. Failing it made the gate unsatisfiable by
  construction for any repo with a registry-depending test app. --json already reported
  checks_pass, so a single invocation could print "ok": true and still exit 1. The
  blocked_on_publish doc comment, which asserted the opposite and contradicted both
  checks_pass and its tests, is corrected.

• Fixed alef build/alef generate running the umbrella gradle build (and gradle build -Prelease) for kotlin_android when no [workspace.build_commands.kotlin_android] overlay is declared, instead of the intended gradle assembleDebug/gradle assembleRelease. build_command_for's "gradle" arm matched on the shared bc.tool string, which cannot distinguish Kotlin from KotlinAndroid; it now asks a new shared build_defaults::gradle_build_task(Language, bool) helper, the same one default_build_config uses, so both derivations agree (GH #259). An explicit [workspace.build_commands.kotlin_android] overlay is unaffected and continues to win.

• Fixed frb_version_check.rs's test module failing to compile on Windows (std::os::unix::fs::PermissionsExt, Permissions::from_mode) by gating the four unix-only items behind #[cfg(unix)], while keeping the four platform-neutral tests running unconditionally on every OS.

• Fixed swift_shim_return_marshal (the Swift trait-box FFI shim) wrapping an enum-typed trait method return directly in RustString(...), which requires a String argument and does not compile against an enum value; the shim now JSON-encodes the enum via JSONEncoder before wrapping it, decided by consulting ApiSurface::enums rather than the TypeRef::Named discriminant. Struct-typed (JSON) Named returns are unchanged.

• Fixed the Swift trait-bridge default method stub emitting return "{}" for a has_default_impl method with a non-excluded enum-typed return, which does not type-check against the enum's own declared Swift return type; it now constructs a real case of the enum when the IR has a fieldless variant, falling back to the prior placeholder body otherwise.

• Fixed the packaging template environment (src/publish/package/template_env.rs) never calling strip_keep_markers, the only built-in render path that did not, so a ~keep marker left in a packaging template would have shipped verbatim into a consumer's package tree.

• Corrected the swift e2e integration test count_min_on_optional_vec_of_named_uses_native_optional_count, which shipped red through 0.67.3 and 0.67.4. Its premise was stale rather than the codegen: field_needs_json_bridge has no dependence on the parent's opacity and returns true for any optional Vec<_> field, so the JSON-bridged .toString().count shape is correct for both parent kinds. Split into paired opaque-parent and first-class-parent tests so a fix that corrects one shape while regressing the other is caught by whichever arm it breaks.