[thekevinbot]

Fixes #939

packages/rust/Cargo.toml's [package].exclude covers tests/ and the VitePress tooling under docs/, but not the fragment dirs. cargo ships everything not excluded, so the published .crate carried 60 fragment files — more than half its 119 entries — none of them read by a crate consumer.

npm keeps its fragments out structurally ("files": ["dist/", "docs/", "README.md", "LICENSE"] is an allowlist) and maturin's wheel layout does the same, so this is a cargo-only gap. release-ci.yml's path filters already treat every package's changelog.d/ / migrations.d/ as non-shipping (!packages/rust/changelog.d/**, …) — the crate manifest was the one place that hadn't been told.

before: 119 files, 60 under changelog.d/ + migrations.d/
after:   59 files,  0

Test

tests/crate_contents.rs asserts cargo package --list — the archive's own manifest — rather than the exclude patterns, so a pattern that parses but matches nothing still fails. A third case pins src/lib.rs as present so a --list returning nothing can't satisfy the two absence checks vacuously. --allow-dirty is passed deliberately: without it cargo aborts on the VCS check the moment a packaged file is uncommitted, so editing exclude to try a fix would stop the test reporting on its own assertions.

RED is in this PR's history on purpose, per AGENTS.md — the failing test was pushed and observed red in CI before the fix:

commit	CI	result
7a73e31 test	run 32401685972	RED — 1 passed; 2 failed, both fragment assertions
a446c70 test hardening	run 32401935265	RED — same two, everything else green
6e78117 fix	this run	expected GREEN

Note on the pointer stubs

packages/rust/CHANGELOG.md / MIGRATIONS.md still ship, and their relative links into changelog.d/ are now dead inside the archive (their link to the repo-root CHANGELOG.md already was). Left deliberately: they're 13-line signposts to where history lives, which is still useful in a vendored crate, and excluding them is outside this issue.

E2E Verification

• Ran e2e suites locally for every affected SDK
• Python SDK e2e: N/A — packages/python untouched; its e2e --scope is packages/python/dirsql + packages/rust/src, neither of which this diff touches
• TypeScript SDK e2e: N/A — same, scope is packages/ts/src + packages/rust/src + packages/ts/napi
• Rust core e2e (if applicable): pass (1 pre-existing sandbox failure, below)
• packages/python/e2e-attestation.json refreshed if packages/python changed — N/A, unchanged
• packages/ts/e2e-attestation.json refreshed if packages/ts changed — N/A, unchanged
• Command(s) run: cargo test --manifest-path packages/rust/Cargo.toml --features cli --tests
• Result summary: every suite green except vtab::unreadable_file_yields_null_content_without_erroring_the_row, which chmods a file unreadable and asserts NULL content. The hosted sandbox runs as uid 0, and root bypasses the permission bits, so the read succeeds and returns Some("classified"). Pre-existing and environmental — this diff touches no src/; the same test passes in CI's non-root runner (both RED runs' only integration failures were the two new assertions).

Manual exercise (AGENTS.md — tests aren't sufficient): built the real archive rather than trusting the listing.

$ cargo package -p dirsql --no-verify --allow-dirty
    Packaged 59 files, 799.3KiB (207.1KiB compressed)

$ tar -tzf target/package/dirsql-0.2.7.crate | sed 's|^dirsql-0.2.7/||' \
    | grep -cE '^(changelog|migrations)\.d/'
0

Changelog / Migrations

• Changelog fragment added under <root>/<pkg>/changelog.d/ for each changed package — packages/rust/changelog.d/2026-08-20-crate-excludes-fragment-dirs.md
• Migration fragment added under <root>/<pkg>/migrations.d/ (or: not required — additive/bugfix only) — not required: no public API break, no deprecation removed, no runtime behavior change. Only files that never should have shipped stop shipping.

PARITY.md: not updated — no SDK public API surface changes, so this neither introduces nor restores parity drift.