From ca1a0b3d6b5c4a98627f2779a019b4aa7d0df038 Mon Sep 17 00:00:00 2001
From: Wid-L-Hacker <nilekim@gmail.com>
Date: Fri, 6 Nov 2026 02:54:51 +0000
Subject: [PATCH 1/9] Check in the Rust crate manifest with a literal version

The crate's Cargo.toml was generated on every invocation by a
wrapper script that stamped the package version from the nearest
git tag. Check the manifest in directly, with the current release
version (0.10.0) as a literal, and call plain cargo at every call
site: CI, the CTest cargo_test, and the Dockerfile test stage
(which no longer needs the checkout's .git copied in just so the
wrapper could read the tag).

The crates.io smoke-test crate gets the same treatment: its
checked-in manifest pins the current published release exactly,
and the release smoke workflow rewrites that pin to the version
under test.

With the version a literal in the manifest, the committed
Cargo.lock's root entry agrees with it in every checkout, and a
release version bump is a deliberate manifest edit followed by a
lock refresh.
---
 .github/workflows/build.yml                    | 18 +++++++++---------
 .github/workflows/release-smoke.yml            |  6 +++---
 CMakeLists.txt                                 |  2 +-
 Dockerfile                                     |  6 +-----
 bindings/rust/.gitignore                       |  2 --
 bindings/rust/{Cargo.toml.in => Cargo.toml}    |  2 +-
 bindings/rust/cargo                            | 18 ------------------
 test/cargo_smoke_test/.gitignore               |  2 --
 .../{Cargo.toml.in => Cargo.toml}              |  2 +-
 test/cargo_smoke_test/cargo                    | 18 ------------------
 10 files changed, 16 insertions(+), 60 deletions(-)
 rename bindings/rust/{Cargo.toml.in => Cargo.toml} (96%)
 delete mode 100755 bindings/rust/cargo
 rename test/cargo_smoke_test/{Cargo.toml.in => Cargo.toml} (78%)
 delete mode 100755 test/cargo_smoke_test/cargo

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 617607f6..b70442fc 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -32,8 +32,8 @@ jobs:
     - name: rust lint
       run: |
         cd bindings/rust
-        ./cargo check --no-default-features --locked
-        ./cargo fmt -- --check
+        cargo check --no-default-features --locked
+        cargo fmt -- --check
 
   test:
     runs-on: ubuntu-24.04
@@ -109,7 +109,7 @@ jobs:
         mkdir -p bindings/rust/lib/x86_64-linux-gnu
         cp build/libgenomicsqlite.so bindings/rust/lib/x86_64-linux-gnu/
         ln -sf libsqlite3.so.0 build/libsqlite3.so
-        env LD_LIBRARY_PATH="$(pwd)/build" LIBRARY_PATH="$(pwd)/build" SQLITE_WEB_LOG=99 bindings/rust/cargo test --release --locked
+        env LD_LIBRARY_PATH="$(pwd)/build" LIBRARY_PATH="$(pwd)/build" SQLITE_WEB_LOG=99 cargo test --release --locked --manifest-path bindings/rust/Cargo.toml
     - name: test
       run: |
         export PATH="$FLOOR_PATH"
@@ -198,8 +198,8 @@ jobs:
         mkdir -p bindings/rust/lib/${{ matrix.target }}
         cp build/libgenomicsqlite.so bindings/rust/lib/${{ matrix.target }}/
         ln -sf libsqlite3.so.0 build/libsqlite3.so  # linker name, scoped to build/ like the Dockerfile rust stage
-        env LD_LIBRARY_PATH="$(pwd)/build" LIBRARY_PATH="$(pwd)/build" SQLITE_WEB_LOG=99 bindings/rust/cargo test --release --locked
-        bindings/rust/cargo package --list | grep lib/${{ matrix.target }}/libgenomicsqlite.so
+        env LD_LIBRARY_PATH="$(pwd)/build" LIBRARY_PATH="$(pwd)/build" SQLITE_WEB_LOG=99 cargo test --release --locked --manifest-path bindings/rust/Cargo.toml
+        cargo package --list --manifest-path bindings/rust/Cargo.toml | grep lib/${{ matrix.target }}/libgenomicsqlite.so
     - name: test rust crate (rusqlite ceiling)
       if: matrix.target == 'x86_64-linux-gnu'
       run: |
@@ -209,8 +209,8 @@ jobs:
         mkdir build/rust-ceiling
         tar -C bindings/rust --exclude=target -cf - . | tar -C build/rust-ceiling -xf -
         cd build/rust-ceiling
-        env LD_LIBRARY_PATH="$(pwd)/.." LIBRARY_PATH="$(pwd)/.." ./cargo update -p rusqlite
-        env LD_LIBRARY_PATH="$(pwd)/.." LIBRARY_PATH="$(pwd)/.." SQLITE_WEB_LOG=99 ./cargo test --release --locked
+        env LD_LIBRARY_PATH="$(pwd)/.." LIBRARY_PATH="$(pwd)/.." cargo update -p rusqlite
+        env LD_LIBRARY_PATH="$(pwd)/.." LIBRARY_PATH="$(pwd)/.." SQLITE_WEB_LOG=99 cargo test --release --locked
     - name: installed-package smoke test
       run: |
         python3 -m pip install -q setuptools wheel
@@ -296,8 +296,8 @@ jobs:
         set -e
         mkdir -p bindings/rust/lib/aarch64-darwin
         cp build/libgenomicsqlite.dylib bindings/rust/lib/aarch64-darwin/
-        SQLITE_WEB_LOG=99 bindings/rust/cargo test --release --locked
-        bindings/rust/cargo package --list | grep lib/aarch64-darwin/libgenomicsqlite.dylib
+        SQLITE_WEB_LOG=99 cargo test --release --locked --manifest-path bindings/rust/Cargo.toml
+        cargo package --list --manifest-path bindings/rust/Cargo.toml | grep lib/aarch64-darwin/libgenomicsqlite.dylib
     - name: installed-package smoke test
       run: |
         python3 -m pip install -q setuptools wheel
diff --git a/.github/workflows/release-smoke.yml b/.github/workflows/release-smoke.yml
index 37527291..5115b433 100644
--- a/.github/workflows/release-smoke.yml
+++ b/.github/workflows/release-smoke.yml
@@ -122,10 +122,10 @@ jobs:
           brew install sqlite
           echo "SQLITE3_LIB_DIR=$(brew --prefix sqlite)/lib" >> "$GITHUB_ENV"
           echo "SQLITE3_INCLUDE_DIR=$(brew --prefix sqlite)/include" >> "$GITHUB_ENV"
-      - name: Generate the smoke crate manifest for the release version
+      - name: Pin the smoke crate to the release version
         run: |
-          sed 's/{{GENOMICSQLITE_VERSION}}/=${{ steps.v.outputs.semver }}/' \
-            test/cargo_smoke_test/Cargo.toml.in > test/cargo_smoke_test/Cargo.toml
+          sed -i -E 's/^genomicsqlite = .*/genomicsqlite = "=${{ steps.v.outputs.semver }}"/' \
+            test/cargo_smoke_test/Cargo.toml
           grep '^genomicsqlite' test/cargo_smoke_test/Cargo.toml
       - name: Build & run the smoke crate against crates.io
         working-directory: test/cargo_smoke_test
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 4df53c2e..45eb832c 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -74,6 +74,6 @@ if(CMAKE_PROJECT_NAME STREQUAL PROJECT_NAME)
     add_test(NAME extension_loading COMMAND python3 ${CMAKE_CURRENT_SOURCE_DIR}/test/extension_loading.py $<TARGET_FILE:genomicsqlite>)
     add_test(NAME capi_smoke_test COMMAND ${GENOMICSQLITE_TEST_ENV} ${CMAKE_BINARY_DIR}/test/capi_smoke_test)
     add_test(NAME JdbcTests COMMAND ${GENOMICSQLITE_TEST_ENV} mvn test -B -f ${CMAKE_CURRENT_SOURCE_DIR}/bindings/jdbc/genomicsqlite-jdbc/pom.xml)
-    add_test(NAME cargo_test COMMAND ${GENOMICSQLITE_TEST_ENV} ${CMAKE_CURRENT_SOURCE_DIR}/bindings/rust/cargo test --no-default-features)
+    add_test(NAME cargo_test COMMAND ${GENOMICSQLITE_TEST_ENV} cargo test --no-default-features --manifest-path ${CMAKE_CURRENT_SOURCE_DIR}/bindings/rust/Cargo.toml)
     add_test(NAME pytest COMMAND ${GENOMICSQLITE_TEST_ENV} python3 -m pytest -xv -n 4 --tb=short ${CMAKE_CURRENT_SOURCE_DIR}/test)
 endif()
diff --git a/Dockerfile b/Dockerfile
index 853e3463..1f15c5c1 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -124,15 +124,11 @@ RUN mkdir -p /work/lib
 WORKDIR /work
 COPY --from=builder /usr/local/lib/libsqlite3.so.0 ./lib/
 RUN ln -s libsqlite3.so.0 lib/libsqlite3.so
-ADD ./.git ./.git
 ADD ./bindings/rust ./rust
 COPY --from=builder /work/GenomicSQLite/build/libgenomicsqlite.so ./libgenomicsqlite.so
 # plant the library in the crate's per-target directory for this build's CPU
 RUN mkdir -p ./rust/lib/$(uname -m)-linux-gnu && cp ./libgenomicsqlite.so ./rust/lib/$(uname -m)-linux-gnu/
-# git in the cargo wrapper must accept the context's .git even if the build
-# host checked it out under a different uid than root
-RUN git config --global --add safe.directory /work
-RUN SQLITE_WEB_LOG=99 LD_LIBRARY_PATH=$(pwd)/lib LIBRARY_PATH=$(pwd)/lib rust/cargo test --release
+RUN SQLITE_WEB_LOG=99 LD_LIBRARY_PATH=$(pwd)/lib LIBRARY_PATH=$(pwd)/lib cargo test --release --manifest-path ./rust/Cargo.toml
 
 ###################################################################################################
 # Run-up in ubuntu 20.04 (final stage: the default docker build target, and the
diff --git a/bindings/rust/.gitignore b/bindings/rust/.gitignore
index 5041fd10..bec38e17 100644
--- a/bindings/rust/.gitignore
+++ b/bindings/rust/.gitignore
@@ -9,8 +9,6 @@ target/
 # These are backup files generated by rustfmt
 **/*.rs.bk
 
-# Cargo.toml is generated from Cargo.toml.in by ./cargo
-Cargo.toml
 # planted prebuilt libraries, in per-target directories (release pipeline)
 lib/*/libgenomicsqlite.so
 lib/*/libgenomicsqlite.dylib
diff --git a/bindings/rust/Cargo.toml.in b/bindings/rust/Cargo.toml
similarity index 96%
rename from bindings/rust/Cargo.toml.in
rename to bindings/rust/Cargo.toml
index 15bc1670..d164af39 100644
--- a/bindings/rust/Cargo.toml.in
+++ b/bindings/rust/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "genomicsqlite"
-version = "{{GENOMICSQLITE_VERSION}}"
+version = "0.10.0"
 description = "Genomics Extension for SQLite"
 authors = ["Mike Lin <dna@mlin.net>"]
 edition = "2018"
diff --git a/bindings/rust/cargo b/bindings/rust/cargo
deleted file mode 100755
index e3227b60..00000000
--- a/bindings/rust/cargo
+++ /dev/null
@@ -1,18 +0,0 @@
-#!/bin/bash
-# wrapper for cargo that generates Cargo.toml from Cargo.toml.in, filling in git revision as
-# crate version
-set -e
-cd `dirname $0`
-
-revision="$(git describe --tags --abbrev=0)"
-# -dirty only for changes other than the tracked Cargo.lock: builds rewrite
-# the lock's root-package version entry, and that must not feed back into
-# the version itself (which would rewrite the lock again on the next run).
-if git status --porcelain --untracked-files=no | grep -v 'Cargo.lock' | grep -q .; then
-    revision="${revision}-dirty"
-fi
-revision="${revision#v}"  # strip 'v' prefix
->&2 echo "$revision"
-
-sed "s/{{GENOMICSQLITE_VERSION}}/${revision}/" Cargo.toml.in > Cargo.toml
-cargo "$@"
diff --git a/test/cargo_smoke_test/.gitignore b/test/cargo_smoke_test/.gitignore
index 2d7878f6..4cfaae23 100644
--- a/test/cargo_smoke_test/.gitignore
+++ b/test/cargo_smoke_test/.gitignore
@@ -10,6 +10,4 @@ Cargo.lock
 # These are backup files generated by rustfmt
 **/*.rs.bk
 
-# Cargo.toml is generated from Cargo.toml.in by ./cargo
-Cargo.toml
 libgenomicsqlite.*
diff --git a/test/cargo_smoke_test/Cargo.toml.in b/test/cargo_smoke_test/Cargo.toml
similarity index 78%
rename from test/cargo_smoke_test/Cargo.toml.in
rename to test/cargo_smoke_test/Cargo.toml
index 6f36d5b6..885f98e8 100644
--- a/test/cargo_smoke_test/Cargo.toml.in
+++ b/test/cargo_smoke_test/Cargo.toml
@@ -5,6 +5,6 @@ authors = ["Mike Lin <dna@mlin.net>"]
 edition = "2018"
 
 [dependencies]
-genomicsqlite = "{{GENOMICSQLITE_VERSION}}"
+genomicsqlite = "=0.10.0"
 rusqlite = "^0.25"
 json = "^0"
diff --git a/test/cargo_smoke_test/cargo b/test/cargo_smoke_test/cargo
deleted file mode 100755
index e3227b60..00000000
--- a/test/cargo_smoke_test/cargo
+++ /dev/null
@@ -1,18 +0,0 @@
-#!/bin/bash
-# wrapper for cargo that generates Cargo.toml from Cargo.toml.in, filling in git revision as
-# crate version
-set -e
-cd `dirname $0`
-
-revision="$(git describe --tags --abbrev=0)"
-# -dirty only for changes other than the tracked Cargo.lock: builds rewrite
-# the lock's root-package version entry, and that must not feed back into
-# the version itself (which would rewrite the lock again on the next run).
-if git status --porcelain --untracked-files=no | grep -v 'Cargo.lock' | grep -q .; then
-    revision="${revision}-dirty"
-fi
-revision="${revision#v}"  # strip 'v' prefix
->&2 echo "$revision"
-
-sed "s/{{GENOMICSQLITE_VERSION}}/${revision}/" Cargo.toml.in > Cargo.toml
-cargo "$@"

From c373fe695dcc4b27df1bb237f06347eeaf060833 Mon Sep 17 00:00:00 2001
From: Wid-L-Hacker <nilekim@gmail.com>
Date: Sat, 7 Nov 2026 22:46:52 +0000
Subject: [PATCH 2/9] Allow the planted library in cargo package --list checks

The linux-so and macOS jobs stage the freshly built library into
bindings/rust/lib/ and verify it appears in the package file list.
The library is uncommitted by design, and cargo package's version
control check now rejects it: with the manifest checked in, cargo
takes its git-based listing path and counts the planted library
as an uncommitted change. (While the manifest was generated, its
.gitignore entry kept cargo on the non-git listing path, which
has no such check.) Pass --allow-dirty, cargo's switch for
including uncommitted changes, at both call sites.
---
 .github/workflows/build.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index b70442fc..f39182d2 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -199,7 +199,7 @@ jobs:
         cp build/libgenomicsqlite.so bindings/rust/lib/${{ matrix.target }}/
         ln -sf libsqlite3.so.0 build/libsqlite3.so  # linker name, scoped to build/ like the Dockerfile rust stage
         env LD_LIBRARY_PATH="$(pwd)/build" LIBRARY_PATH="$(pwd)/build" SQLITE_WEB_LOG=99 cargo test --release --locked --manifest-path bindings/rust/Cargo.toml
-        cargo package --list --manifest-path bindings/rust/Cargo.toml | grep lib/${{ matrix.target }}/libgenomicsqlite.so
+        cargo package --list --allow-dirty --manifest-path bindings/rust/Cargo.toml | grep lib/${{ matrix.target }}/libgenomicsqlite.so
     - name: test rust crate (rusqlite ceiling)
       if: matrix.target == 'x86_64-linux-gnu'
       run: |
@@ -297,7 +297,7 @@ jobs:
         mkdir -p bindings/rust/lib/aarch64-darwin
         cp build/libgenomicsqlite.dylib bindings/rust/lib/aarch64-darwin/
         SQLITE_WEB_LOG=99 cargo test --release --locked --manifest-path bindings/rust/Cargo.toml
-        cargo package --list --manifest-path bindings/rust/Cargo.toml | grep lib/aarch64-darwin/libgenomicsqlite.dylib
+        cargo package --list --allow-dirty --manifest-path bindings/rust/Cargo.toml | grep lib/aarch64-darwin/libgenomicsqlite.dylib
     - name: installed-package smoke test
       run: |
         python3 -m pip install -q setuptools wheel

From ed34d208431551d720799fa0b425a37138479528 Mon Sep 17 00:00:00 2001
From: Wid-L-Hacker <nilekim@gmail.com>
Date: Sat, 7 Nov 2026 22:46:52 +0000
Subject: [PATCH 3/9] Document crate release versioning in the manifests

The git tag is the version source of truth; the checked-in
version is bookkeeping that is stamped from the tag only in the
publish checkout. Record this at the manifest's version, and note
that the smoke-test pin is rewritten by the release-smoke
workflow.
---
 bindings/rust/Cargo.toml         | 7 +++++++
 test/cargo_smoke_test/Cargo.toml | 1 +
 2 files changed, 8 insertions(+)

diff --git a/bindings/rust/Cargo.toml b/bindings/rust/Cargo.toml
index d164af39..54aa75f3 100644
--- a/bindings/rust/Cargo.toml
+++ b/bindings/rust/Cargo.toml
@@ -1,5 +1,12 @@
 [package]
 name = "genomicsqlite"
+# Release versioning: the git tag is the version source of truth.
+# This literal is bookkeeping (the last stamped version); it is not
+# bumped to cut a release. At publish time the tag's version is
+# stamped into the publish checkout (cargo set-version) and the
+# crate is published from there. Cargo.lock is committed to pin
+# dependency versions; its root entry follows the stamp in the
+# publish checkout only.
 version = "0.10.0"
 description = "Genomics Extension for SQLite"
 authors = ["Mike Lin <dna@mlin.net>"]
diff --git a/test/cargo_smoke_test/Cargo.toml b/test/cargo_smoke_test/Cargo.toml
index 885f98e8..7573da12 100644
--- a/test/cargo_smoke_test/Cargo.toml
+++ b/test/cargo_smoke_test/Cargo.toml
@@ -5,6 +5,7 @@ authors = ["Mike Lin <dna@mlin.net>"]
 edition = "2018"
 
 [dependencies]
+# The release-smoke workflow rewrites this pin to the version under test.
 genomicsqlite = "=0.10.0"
 rusqlite = "^0.25"
 json = "^0"

From eff132c32ec42e69c30283ce4202086b4e357a22 Mon Sep 17 00:00:00 2001
From: Wid-L-Hacker <nilekim@gmail.com>
Date: Sat, 7 Nov 2026 13:09:21 -1000
Subject: [PATCH 4/9] Use a dummy crate version and explain --allow-dirty

The checked-in crate version is now 0.0.0: it is only ever
overwritten by the release stamp, so a real-looking value
invited confusion with the current release. The manifest
comment says so. Also note beside each cargo package --list
call in CI why --allow-dirty is there: the staged library is
git-ignored but named in the manifest's include list, so the
version-control check would otherwise reject it.
---
 .github/workflows/build.yml |  4 ++++
 bindings/rust/Cargo.lock    |  2 +-
 bindings/rust/Cargo.toml    | 14 +++++++-------
 3 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f39182d2..fbde79ff 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -199,6 +199,8 @@ jobs:
         cp build/libgenomicsqlite.so bindings/rust/lib/${{ matrix.target }}/
         ln -sf libsqlite3.so.0 build/libsqlite3.so  # linker name, scoped to build/ like the Dockerfile rust stage
         env LD_LIBRARY_PATH="$(pwd)/build" LIBRARY_PATH="$(pwd)/build" SQLITE_WEB_LOG=99 cargo test --release --locked --manifest-path bindings/rust/Cargo.toml
+        # --allow-dirty: the library staged above is git-ignored but named in the manifest's
+        # include list, so cargo's version-control check counts it as an uncommitted change.
         cargo package --list --allow-dirty --manifest-path bindings/rust/Cargo.toml | grep lib/${{ matrix.target }}/libgenomicsqlite.so
     - name: test rust crate (rusqlite ceiling)
       if: matrix.target == 'x86_64-linux-gnu'
@@ -297,6 +299,8 @@ jobs:
         mkdir -p bindings/rust/lib/aarch64-darwin
         cp build/libgenomicsqlite.dylib bindings/rust/lib/aarch64-darwin/
         SQLITE_WEB_LOG=99 cargo test --release --locked --manifest-path bindings/rust/Cargo.toml
+        # --allow-dirty: the library staged above is git-ignored but named in the manifest's
+        # include list, so cargo's version-control check counts it as an uncommitted change.
         cargo package --list --allow-dirty --manifest-path bindings/rust/Cargo.toml | grep lib/aarch64-darwin/libgenomicsqlite.dylib
     - name: installed-package smoke test
       run: |
diff --git a/bindings/rust/Cargo.lock b/bindings/rust/Cargo.lock
index 3f380035..2d734a92 100644
--- a/bindings/rust/Cargo.lock
+++ b/bindings/rust/Cargo.lock
@@ -62,7 +62,7 @@ checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
 
 [[package]]
 name = "genomicsqlite"
-version = "0.10.0"
+version = "0.0.0"
 dependencies = [
  "json",
  "rusqlite",
diff --git a/bindings/rust/Cargo.toml b/bindings/rust/Cargo.toml
index 54aa75f3..d24dd3fe 100644
--- a/bindings/rust/Cargo.toml
+++ b/bindings/rust/Cargo.toml
@@ -1,13 +1,13 @@
 [package]
 name = "genomicsqlite"
 # Release versioning: the git tag is the version source of truth.
-# This literal is bookkeeping (the last stamped version); it is not
-# bumped to cut a release. At publish time the tag's version is
-# stamped into the publish checkout (cargo set-version) and the
-# crate is published from there. Cargo.lock is committed to pin
-# dependency versions; its root entry follows the stamp in the
-# publish checkout only.
-version = "0.10.0"
+# This version is a dummy, never a release version: at publish
+# time the tag's version is stamped into the publish checkout
+# (cargo set-version) and the crate is published from there. No
+# commit bumps it to cut a release. Cargo.lock is committed to
+# pin dependency versions; its root entry follows the stamp in
+# the publish checkout only.
+version = "0.0.0"
 description = "Genomics Extension for SQLite"
 authors = ["Mike Lin <dna@mlin.net>"]
 edition = "2018"

From f4009817ca936cb26e5687459911543aaad20c68 Mon Sep 17 00:00:00 2001
From: Wid-L-Hacker <nilekim@gmail.com>
Date: Sat, 7 Nov 2026 23:25:40 +0000
Subject: [PATCH 5/9] release-smoke: check the smoke crate pin was actually
 rewritten

The grep after the sed only verified that some genomicsqlite line
exists, so a sed miss (for example drifted spacing in the checked-in
manifest) would pass the step and go on to test the wrong version.
Match the exact expected line instead.
---
 .github/workflows/release-smoke.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release-smoke.yml b/.github/workflows/release-smoke.yml
index 5115b433..b68e0d15 100644
--- a/.github/workflows/release-smoke.yml
+++ b/.github/workflows/release-smoke.yml
@@ -126,7 +126,7 @@ jobs:
         run: |
           sed -i -E 's/^genomicsqlite = .*/genomicsqlite = "=${{ steps.v.outputs.semver }}"/' \
             test/cargo_smoke_test/Cargo.toml
-          grep '^genomicsqlite' test/cargo_smoke_test/Cargo.toml
+          grep -Fx 'genomicsqlite = "=${{ steps.v.outputs.semver }}"' test/cargo_smoke_test/Cargo.toml
       - name: Build & run the smoke crate against crates.io
         working-directory: test/cargo_smoke_test
         run: |

From 2a1d75c1473bd47bdf2a88372f4d84278a547853 Mon Sep 17 00:00:00 2001
From: Wid-L-Hacker <nilekim@gmail.com>
Date: Sat, 7 Nov 2026 23:25:40 +0000
Subject: [PATCH 6/9] rust: remove stale lock-refresh instruction from
 .gitignore

The comment told readers to refresh Cargo.lock as an early release
step. Pin refreshes are ordinary dependency work on their own
cadence, and the crate version is stamped at publish time; the
lock is not a release step.
---
 bindings/rust/.gitignore | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bindings/rust/.gitignore b/bindings/rust/.gitignore
index bec38e17..89ec7345 100644
--- a/bindings/rust/.gitignore
+++ b/bindings/rust/.gitignore
@@ -4,7 +4,7 @@ debug/
 target/
 
 # Cargo.lock is committed (2026-10-22): reproducible CI/dev builds for this
-# repo; cargo ignores it downstream. Refresh it as an early release step.
+# repo; cargo ignores it downstream.
 
 # These are backup files generated by rustfmt
 **/*.rs.bk

From bd208220ad0f6c379f1ceb32db238ab625c99f8e Mon Sep 17 00:00:00 2001
From: Wid-L-Hacker <nilekim@gmail.com>
Date: Sat, 7 Nov 2026 23:28:16 +0000
Subject: [PATCH 7/9] copyedit: trim the crate versioning comments

Shorten the manifest release-versioning block, and drop the date
and shorthand from the Cargo.lock note in .gitignore. The
mechanism described is unchanged.
---
 bindings/rust/.gitignore |  4 ++--
 bindings/rust/Cargo.toml | 11 ++++-------
 2 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/bindings/rust/.gitignore b/bindings/rust/.gitignore
index 89ec7345..6e24483b 100644
--- a/bindings/rust/.gitignore
+++ b/bindings/rust/.gitignore
@@ -3,8 +3,8 @@
 debug/
 target/
 
-# Cargo.lock is committed (2026-10-22): reproducible CI/dev builds for this
-# repo; cargo ignores it downstream.
+# Cargo.lock pins dependencies for reproducible CI and development builds.
+# Downstream consumers resolve their own dependencies.
 
 # These are backup files generated by rustfmt
 **/*.rs.bk
diff --git a/bindings/rust/Cargo.toml b/bindings/rust/Cargo.toml
index d24dd3fe..956658c6 100644
--- a/bindings/rust/Cargo.toml
+++ b/bindings/rust/Cargo.toml
@@ -1,12 +1,9 @@
 [package]
 name = "genomicsqlite"
-# Release versioning: the git tag is the version source of truth.
-# This version is a dummy, never a release version: at publish
-# time the tag's version is stamped into the publish checkout
-# (cargo set-version) and the crate is published from there. No
-# commit bumps it to cut a release. Cargo.lock is committed to
-# pin dependency versions; its root entry follows the stamp in
-# the publish checkout only.
+# Release versioning: the git tag is the version source of truth; this
+# 0.0.0 is a dummy. At publish time the tag's version is stamped into the
+# publish checkout (cargo set-version), never committed. Cargo.lock pins
+# dependency versions; its root entry follows the stamp there only.
 version = "0.0.0"
 description = "Genomics Extension for SQLite"
 authors = ["Mike Lin <dna@mlin.net>"]

From 4594bccd65fcba12c42b8c45bb44882666828113 Mon Sep 17 00:00:00 2001
From: Wid-L-Hacker <nilekim@gmail.com>
Date: Sat, 7 Nov 2026 13:36:40 -1000
Subject: [PATCH 8/9] Explain --allow-dirty from the release design first

The comment led with the staged library and never mentioned
the publish-time version stamp, which is the reason this
crate is packaged from dirty trees at all. Lead with the
design; the staged library is the local trigger.
---
 .github/workflows/build.yml | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index fbde79ff..16b965d4 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -199,8 +199,10 @@ jobs:
         cp build/libgenomicsqlite.so bindings/rust/lib/${{ matrix.target }}/
         ln -sf libsqlite3.so.0 build/libsqlite3.so  # linker name, scoped to build/ like the Dockerfile rust stage
         env LD_LIBRARY_PATH="$(pwd)/build" LIBRARY_PATH="$(pwd)/build" SQLITE_WEB_LOG=99 cargo test --release --locked --manifest-path bindings/rust/Cargo.toml
-        # --allow-dirty: the library staged above is git-ignored but named in the manifest's
-        # include list, so cargo's version-control check counts it as an uncommitted change.
+        # --allow-dirty: this crate is packaged from deliberately dirty trees — releases
+        # stamp the version in at publish time rather than committing it, and the library
+        # staged above is git-ignored but manifest-included, so cargo's version-control
+        # check would otherwise refuse.
         cargo package --list --allow-dirty --manifest-path bindings/rust/Cargo.toml | grep lib/${{ matrix.target }}/libgenomicsqlite.so
     - name: test rust crate (rusqlite ceiling)
       if: matrix.target == 'x86_64-linux-gnu'
@@ -299,8 +301,10 @@ jobs:
         mkdir -p bindings/rust/lib/aarch64-darwin
         cp build/libgenomicsqlite.dylib bindings/rust/lib/aarch64-darwin/
         SQLITE_WEB_LOG=99 cargo test --release --locked --manifest-path bindings/rust/Cargo.toml
-        # --allow-dirty: the library staged above is git-ignored but named in the manifest's
-        # include list, so cargo's version-control check counts it as an uncommitted change.
+        # --allow-dirty: this crate is packaged from deliberately dirty trees — releases
+        # stamp the version in at publish time rather than committing it, and the library
+        # staged above is git-ignored but manifest-included, so cargo's version-control
+        # check would otherwise refuse.
         cargo package --list --allow-dirty --manifest-path bindings/rust/Cargo.toml | grep lib/aarch64-darwin/libgenomicsqlite.dylib
     - name: installed-package smoke test
       run: |

From 775ed406f2c60a4117670f2fc6e82e72a0aa3ad4 Mon Sep 17 00:00:00 2001
From: Wid-L-Hacker <nilekim@gmail.com>
Date: Sat, 7 Nov 2026 14:41:34 -1000
Subject: [PATCH 9/9] Dummy pin in the smoke-test crate too

Its genomicsqlite pin is rewritten by the release-smoke
workflow in every real use, so the checked-in value is a
placeholder like the crate version: 0.0.0.
---
 test/cargo_smoke_test/Cargo.toml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/test/cargo_smoke_test/Cargo.toml b/test/cargo_smoke_test/Cargo.toml
index 7573da12..d13ddad7 100644
--- a/test/cargo_smoke_test/Cargo.toml
+++ b/test/cargo_smoke_test/Cargo.toml
@@ -5,7 +5,7 @@ authors = ["Mike Lin <dna@mlin.net>"]
 edition = "2018"
 
 [dependencies]
-# The release-smoke workflow rewrites this pin to the version under test.
-genomicsqlite = "=0.10.0"
+# Dummy pin — the release-smoke workflow rewrites it to the version under test.
+genomicsqlite = "=0.0.0"
 rusqlite = "^0.25"
 json = "^0"