Release: guard the crates.io 10 MiB tarball cap before the first upload (v0.10.1: tui/cli stranded by HTTP 413) #6910

0.10.2 candidate update (2026-10-13). The complete strict no-upload preflight passes for all 29 workspace crates at 6e72400bbb, including the new saved-DeepSeek-key correction. Every package built from its packaged source with dirty inputs disallowed; all archives carry that exact clean Git SHA, and 1,319 non-generated payloads match committed blobs with no unexpected/mismatched files. TUI is 9,431,125 bytes / 8.994222 MiB (956 files), below the 10,485,760-byte cap, with no installed Node dependency payload. All29 pass; no Codewhale crate was uploaded. The preceding7bf pass and its29 archives are retained as historical evidence.

The audit also found and fixed two preflight defects in 2750a5d124: Cargo’s separate build directory was being ignored, so the checker measured stale target-directory archives, and four ignored installed Node dependency files entered the TUI tarball. The checker now selects the active build directory, and the manifest explicitly excludes those installed dependencies. The frozen vendored codewhale-ratatui 0.1.2 dependency was published with founder approval and its downloaded bytes match the verified dry-run package.

This establishes candidate packaging readiness, with final-main freeze, RC/dist acceptance and actual all-29 registry/install readback still required before closing this issue. It does not repair or relabel the historical 0.10.1 packages. The original failure record follows.

Founder followup2026-10-09: Cargo should be0.10.1 and updatewinget. Fresh cache-busted registryreadback verifies26/28 packages published0.10.1; TUI+CLI still0.10.0. Independently rehashed frozenfead51ee TUIcrate is12,504,591bytes SHA2560dc03f1fa6d2dd977477051745dca2770bc8c2ea1ac2e1b796f8187391edefd6, exceeding10MiB and matching recordedHTTP413; CLI depends onTUI. Current0.10.2 contains packagingtrim+beforefirstuploadsizeguard, but it doesnot fill0.10.1 retroactively. No tags changed and no packages published inthisfollowup. Missing stableTUI/CLI publication needs historical packaging/provenance resolution; do not relabel dirty0.10.2as0.10.1. All29 0.10.2 tarballs+actualregistry/installreadback remain releaseacceptance gates. Winget0.10.1 alreadyexists in microsoft/winget-pkgs#448554 at1aaee6b99689: hashes/manifest/schema/scanpass, installationNEUTRAL/Validation-Executable-Error andMicrosoftreviewrequired. Parenthas noMicrosoftmergeauthority; no duplicatesubmission/comments. Verified3-manifest/x64binarypacket andCargo sourceevidence: artifacts/packaging-repair-20261009/winget-0.10.1/EVIDENCE.md. Rootowns publicationreconciliation and claims existingissue ratherthannewqueue.

What happened (2026-10-08, v0.10.1). The crates.io publish uploaded 26 of 28 crates and then failed:

error: failed to publish codewhale-tui v0.10.1 to registry at https://crates.io
Caused by: the remote server responded with an error (status 413 Payload Too Large): max upload size is: 10485760

The packaged tarball was 11.9 MiB compressed ("Packaged 1796 files, 53.9MiB (11.9MiB compressed)"). 0.10.0 was 8.94 MiB, so the crate crossed the 10 MiB cap in one cycle. codewhale-tui and its dependent codewhale-cli never reached crates.io for 0.10.1; The missing TUI/CLI versions leave the older published CLI available until a complete later release is published; 0.10.2 has not shipped yet.

Why the existing gates did not catch it. cargo publish --dry-run cannot see the limit — it is enforced server-side, and the dry run passed cleanly. The 413 surfaces only during the real upload, after all 28 crates have been packaged and verified (~40 minutes in), which is also where it strands the release half-published.

Proposal. After the preflight packaging (the dry run already writes every target/package/<crate>-<version>.crate), stat each tarball and fail before any upload when one exceeds 10,485,760 bytes compressed, naming the crate and pointing at exclude/include in its Cargo.toml. A warning threshold around 9.5 MiB would give notice as a crate grows toward the cap.

0.10.2 already carries the content fix for codewhale-tui: exclude in crates/tui/Cargo.toml trims test sources from the published package (1796 → 1176 files; 11.9 → 9.5 MiB compressed, verified with publish-crates.sh dry-run).

Receipts. Publish log lines quoted above; scripts/release/check-published.sh 0.10.1 lists codewhale-tui/codewhale-cli as not published; crates.io size history for codewhale-tui: 8.42 MiB (0.9.13) → 8.94 MiB (0.10.0) → 11.9 MiB (0.10.1, refused).