Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@Cargo.toml`:
- Around line 29-32: The workspace members list in Cargo.toml has inconsistent
indentation for the entries "crates/shipper-output-sanitizer",
"crates/shipper-levels", "crates/shipper-execution-core", and
"crates/shipper-config-runtime" (they use 4 spaces while others use 2); update
those four lines to use the same 2-space indentation as the rest of the members
list so the workspace members block is consistently formatted.

In `@crates/shipper-auth/CLAUDE.md`:
- Around line 1-29: Replace unsubstituted placeholders ($name, $entryPoint,
$rootDocs) with the crate-specific values for shipper-auth (use "shipper-auth"
for crate name and the crate's actual primary entry point), fix the fenced code
block marker from "`ash" to a proper triple-backtick block for bash, convert
Windows path separators in the workspace/root path to POSIX-style or neutral
notation, and ensure the file ends with a trailing newline; update the header
and context text accordingly so the CLAUDE.md content matches the other
corrected crate CLAUDE.md files.

In `@crates/shipper-auth/README.md`:
- Around line 1-36: The README contains template artifacts: remove the
duplicated "# shipper-auth" header, replace the "$entryPoint" placeholder with
the actual source entry (e.g., "src/lib.rs" or the crate's real entry), fix the
malformed code fence by replacing "`�ash" and the trailing single backtick with
a proper triple backtick fence "```bash" ... "```", and correct the broken tests
path "	ests/" to "`tests/`" in the Contributing section; update those exact
tokens ("# shipper-auth", "$entryPoint", "`�ash", "`", and "	ests/") in the
README to render clean crate docs.

In `@crates/shipper-auth/src/lib.rs`:
- Around line 1310-1337: The tests currently treat whitespace-only strings as
valid tokens; instead, update the token handling so whitespace-only credentials
are considered absent: in resolve_token(...) and
token_from_credentials_file(...), trim the extracted token (e.g., token.trim())
and only mark auth as detected / return Some(token) when the trimmed string is
non-empty; if trimmed is empty, return None / detected = false. Ensure
callers/use of token preserve the original stored token only when trimmed
non-empty.
- Around line 258-266: The mask_token function currently slices &str by byte
offsets which can panic on Unicode; update mask_token to operate on Unicode
scalar values via .chars(): compute char_count = token.chars().count(), if
char_count <= 8 return "*" repeated char_count, otherwise build the masked
string by collecting the first four chars
(token.chars().take(4).collect::<String>()) and the last four chars
(token.chars().rev().take(4).collect::<String>() then reverse that collected
tail) and concatenate with "****"; apply the same char-safe approach to the
other occurrence noted (the block around symbols handling at the second
location).
- Around line 269-276: The current is_trusted_publishing_available function
treats empty OIDC env vars as present; change the check to ensure both
ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN are non-empty
strings (e.g., use env::var_os(...).and_then(|s| if s.is_empty() { None } else {
Some(s) }).is_some() or use env::var(...) and verify non-empty), so the function
only returns true when both env vars exist and are not empty; apply the same
non-empty validation to the other identical check found later in the file (the
duplicate OIDC availability check around lines ~1531-1543).
- Around line 410-1761: Tests that mutate global environment or filesystem
(e.g., resolve_token_env_default_takes_priority_over_credentials,
resolve_token_env_registry_takes_priority_over_credentials,
has_token_returns_true_when_found, cargo_home_path_falls_back_to_env_var,
credential/file tests, trusted_publishing_* and many others) must be run
serially to avoid flakiness; add the #[serial] attribute from the serial_test
crate to each affected #[test] function (or to enclosing test modules like
snapshots, proptests, edge_snapshots, error_message_snapshots) and add use
serial_test::serial at the top of the test module so tests that set CARGO_HOME,
CARGO_REGISTRY_TOKEN, CARGO_REGISTRIES_*, or ACTIONS_ID_TOKEN_REQUEST_* run one
at a time.

In `@crates/shipper-cargo-failure/README.md`:
- Around line 1-36: The README contains leftover scaffold artifacts: a duplicate
H1, an unresolved placeholder $entryPoint, a malformed bash code fence, and a
broken tests path; fix by removing the redundant H1, replace $entryPoint with
the actual main entry (or remove the "Source entry point" section) and correct
the fenced code block marker to ```bash (or ```), and update the tests path to
`tests/` in the Contributing section (refer to the README headings and the
"Source entry point", the malformed code fence block containing cargo commands,
and the Contributing line that currently shows "(	ests/, src/)").

In `@crates/shipper-cargo/Cargo.toml`:
- Around line 19-26: The crate declares shipper-output-sanitizer in both
[dependencies] and [dev-dependencies]; remove the duplicate entry from the
[dev-dependencies] section so shipper-output-sanitizer is only listed once as a
regular dependency, leaving the existing shipper-output-sanitizer = { path =
"../shipper-output-sanitizer" } in [dependencies] and deleting the same line
under [dev-dependencies]; keep other dev-dependencies (tempfile,
proptest.workspace, insta, temp-env) unchanged and run cargo check to verify.

In `@crates/shipper-cargo/README.md`:
- Around line 1-36: Remove the duplicate top-level heading and clean up
placeholders in README.md: keep a single H1/title, replace or remove the
unresolved $entryPoint placeholder in the "Source entry point" section (use the
actual entry or omit the section), fix the malformed code fence label that
currently reads "�ash" to a proper "```bash" fenced block for the development
commands, and correct the broken tests path by changing "(	ests/, src/)" to
backticked "`tests/`, `src/`" in the Contributing paragraph so the markdown
renders correctly.

In `@crates/shipper-cargo/src/lib.rs`:
- Around line 1198-1222: These three tests (cargo_program_defaults_to_cargo,
cargo_program_respects_shipper_cargo_bin, cargo_program_empty_env_returns_empty)
mutate the process-wide SHIPPER_CARGO_BIN env var and must be serialized; add
the #[serial] attribute from the serial_test crate above each test (or import
serial and annotate all three) so they run sequentially and cannot race with
other tests that call cargo_program().
- Around line 1217-1221: The test cargo_program_empty_env_returns_empty
currently treats SHIPPER_CARGO_BIN="" as a valid program path, which leads to
Command::new("") later; change cargo_program() to treat an environment value
that is empty or only whitespace as unset (e.g., if
env::var("SHIPPER_CARGO_BIN").ok().filter(|s| !s.trim().is_empty()).map(...) {
... } else fallback to "cargo"), and update the test
cargo_program_empty_env_returns_empty (and any related tests) to expect the
fallback ("cargo") when SHIPPER_CARGO_BIN is set to "" rather than returning an
empty string. Ensure references to cargo_program and the test name are used when
locating the change.

In `@crates/shipper-cargo/tests/redaction_contract.rs`:
- Around line 4-9: The test
cargo_crate_redact_sensitive_matches_output_sanitizer is tautological because it
only compares two implementations; change it to call
shipper_cargo::redact_sensitive(input) and assert the returned string does not
contain the raw secrets ("shipper_secret_token" and "abc123") and/or matches the
expected redaction pattern; in other words, replace the equality check against
shipper_output_sanitizer::redact_sensitive with direct assertions that
redact_sensitive(input) does not contain the original tokens (and optionally
that it contains the expected mask placeholder) so the test fails if secrets are
leaked.

In `@crates/shipper-chunking/CLAUDE.md`:
- Around line 1-29: The CLAUDE.md contains unsubstituted template variables and
syntax/platform issues: replace $name with "shipper-chunking", $entryPoint with
"src/lib.rs" (or the crate's actual entry file), and $rootDocs with the relative
path "../../CLAUDE.md"; fix the code fence header from "`ash" to "```bash"; and
convert Windows backslashes in the workspace root and link
("h:\Code\Rust\shipper" and "$rootDocs\CLAUDE.md") to cross-platform
forward-slash/relative forms (e.g., "h:/Code/Rust/shipper" or preferably remove
the absolute path and use "../../CLAUDE.md" for the link). Ensure the commands
remain inside a proper fenced block and update any remaining placeholders
consistently.

In `@crates/shipper-chunking/README.md`:
- Around line 1-36: Remove duplicate headings and repeated description in README
(the second "# shipper-chunking" and the repeated "Chunking helpers..."
sentence), replace the unsubstituted placeholder "$entryPoint" with a meaningful
entry point description or remove the "Source entry point" section if none
exists, fix the fenced code block marker by changing the malformed "`ash" to a
proper triple-backtick with language "bash", correct the typo "(	ests/" to
"(tests/" in the Contributing line, and ensure the file ends with a trailing
newline; update the README content in crates/shipper-chunking/README.md
accordingly.

In `@crates/shipper-chunking/tests/chunking_bdd.rs`:
- Around line 1-46: Add a property-based test using proptest that generates
arbitrary vectors of items and an integer max_concurrent >= 1 and asserts the
chunking invariants for chunk_by_max_concurrent: for any generated items and
limit, the flattened sequence of chunks equals the original items (order
preserved, no loss/duplication), every chunk has length <= max_concurrent, and
the total number of chunks is consistent (e.g., sum of chunk lengths ==
items.len()); import proptest, create a test (e.g.,
prop_bdd_chunking_invariants) that uses proptest::collection::vec(...) for items
and a strategy for max_concurrent with a min of 1, call
chunk_by_max_concurrent(&items, max_concurrent) and check the three invariants
above to catch regressions.

In `@crates/shipper-cli/CLAUDE.md`:
- Line 29: The file CLAUDE.md is missing a trailing newline; open the CLAUDE.md
file and add a single newline character at the end of the file (ensure the file
ends with exactly one '\n'), then save so markdownlint MD047 is satisfied.
- Around line 14-20: Replace the malformed code fence marker "ash" with a proper
fenced code block using triple backticks and the "bash" language tag and ensure
the block is closed with triple backticks; in CLAUDE.md locate the code block
starting with "`�ash" and change it to "```bash" and add a closing "```" after
the cargo commands so the snippet renders with correct syntax highlighting.
- Around line 3-10: Replace the template placeholders in CLAUDE.md with concrete
values: change all occurrences of $name to "shipper-cli", replace $entryPoint
with "src/main.rs", and remove or replace $rootDocs (e.g., remove the $rootDocs
variable or use a relative path) so the file no longer contains unsubstituted
template variables; ensure the header and Scope section reflect the actual crate
name and entry point.

In `@crates/shipper-cli/src/main.rs`:
- Around line 1457-1475: The cleanup currently deletes directories as it
iterates dirs_to_clean which can leave partial state if a later subdirectory has
an active lock; before calling clean_single_dir, add a read-only lock-validation
pass that scans the same dirs_to_clean (derived from abs_state and registry
subdirs) and checks for active locks (unless force is true), returning an error
and aborting before any mutation if any lock is held; only if the validation
passes (or force is set) proceed to the existing deletion loop that calls
clean_single_dir(workspace_root, keep_receipt, force). Apply the same two-phase
validation-then-delete change for the other block noted around lines 1489-1516.
- Around line 450-486: The loop over target_registries currently prints
per-registry banners/progress and calls print_receipt per registry, which breaks
JSON output when cli.format == "json"; instead collect each registry's receipt
(from engine::run_publish) into a Vec and, after the loop, if cli.format is json
serialize and print a single JSON array/object (suppress banners/progress during
iteration), otherwise keep the existing human-mode behavior (show
banner/progress and call print_receipt per registry). Apply the same change to
the analogous publish/resume loop (the other target_registries loop that also
calls ProgressReporter, engine::run_publish and print_receipt).
- Around line 467-479: The ProgressReporter is being preset to package 1 but
never updated, so multi-package runs stall; either remove the pre-call to
ProgressReporter::set_package(...) and let the engine drive progress via the
existing reporter, or explicitly wire ProgressReporter into the publish/resume
flow so engine::run_publish and engine::run_resume (or the reporter callbacks
they use) call ProgressReporter::set_package/update as packages change; locate
the ProgressReporter instantiation and the set_package call near
current_planned/current_opts/reporter and either delete that initial
set_package(1, ...) or pass &mut progress (or register progress callbacks) into
engine::run_publish/run_resume so the progress bar advances for each package
before calling progress.finish().
- Around line 549-565: The loop uses the original opts when calling run_doctor
so checks run against the shared state_dir instead of the registry-scoped
directory; create a registry-scoped RuntimeOptions (clone opts into a new
variable, update its state_dir to re-root under state_dir/<registry> or the same
logic used by publish/resume) and pass that into run_doctor (use the same scope
where current_planned.plan.registry is set). Ensure you reference and update the
RuntimeOptions instance used for runtime checks (opts -> registry_opts) before
calling run_doctor(&current_planned, &registry_opts, &mut reporter).

In `@crates/shipper-cli/tests/bdd_doctor.rs`:
- Around line 87-264: The tests mutate process-wide env/state and must be run
serially: add a use serial_test::serial; import at top of the test file and
annotate each affected test function with #[serial] (e.g. above
given_clean_environment_when_running_doctor_then_reports_environment_info,
given_cargo_is_installed_when_running_doctor_then_cargo_version_is_detected,
given_no_cargo_registry_token_when_running_doctor_then_warns_about_missing_token,
given_valid_workspace_when_running_doctor_then_checks_workspace_health, and
given_nonexistent_state_dir_when_running_doctor_then_reports_will_be_created) so
they run sequentially and avoid cross-test interference.

In `@crates/shipper-cli/tests/bdd_error_handling.rs`:
- Around line 723-738: Replace the permissive existence checks that let
scenarios pass when files are missing with hard assertions so missing
persistence fails the test: instead of wrapping the state.json handling in if
state_path.exists(), assert that state_path.exists() (with a clear message like
"state.json not written"), then read and parse the file into
state/serde_json::Value and continue the same checks (e.g. the packages lookup
and core package assertion in this block); do the same for the receipt.json
checks referenced (the blocks around the other ranges) so they assert presence
before reading rather than silently skipping when the file is absent.
- Around line 219-239: The test helper spawn_registry uses
server.recv_timeout(Duration::from_secs(30)) which can add long stalls when
tests overprovision expected_requests; change the hardcoded 30s to a much
shorter, shared constant (e.g., TEST_SERVER_RECV_TIMEOUT =
Duration::from_secs(1) or Duration::from_millis(500)) and replace all
occurrences of server.recv_timeout(Duration::from_secs(30)) in spawn_registry
and the other test helpers to use that constant so the loop breaks quickly when
fewer requests arrive; keep the existing Ok(Some(r)) / break behavior unchanged.

In `@crates/shipper-cli/tests/bdd_error_recovery.rs`:
- Around line 325-343: The test currently invokes the real cargo and default
registry, causing non-hermetic, network-dependent behavior; instead create a
local tiny_http mock registry and a fake cargo executable that simulates cargo
behavior (responds to metadata, skip/publish flow and then deterministically
fails on publish), start the tiny_http server for registry/index endpoints,
point the test to the mock registry (via environment or a temporary
.cargo/config) and ensure shipper_cmd() is run with the PATH or CARGO env
updated to pick up the fake cargo; update the invocation around shipper_cmd() /
td.path().join("Cargo.toml") / --state-dir & state_dir so the resume run hits
the mock registry and fake cargo and then assert the stderr contains the skip
message and the deterministic terminal failure.

In `@crates/shipper-cli/tests/bdd_micro_backends.rs`:
- Around line 131-234: The two tests that mutate process-wide environment
(given_dependency_chain_and_no_token_when_preflight_with_micro_backends_then_stable_output
and
given_dependency_chain_and_no_token_when_preflight_with_all_micro_crates_then_stable_output)
must be run serially to avoid cross-test pollution: add the #[serial] attribute
from the serial_test crate above each test and ensure serial_test::serial is
imported in the test module so tests that call env("CARGO_HOME", ...) and
env_remove(...) execute one at a time.

In `@crates/shipper-cli/tests/bdd_parallel.rs`:
- Around line 435-669: Tests that mutate PATH/REAL_CARGO/SHIPPER_* run in
parallel and interfere; mark the tests that set those env vars with #[serial] to
run them serially. Add use serial_test::serial; (near other imports) and
annotate the test functions
given_partially_published_workspace_when_resuming_then_skips_completed_levels,
given_failure_in_one_level_when_continuing_then_stops_subsequent_levels, and
given_max_concurrent_setting_when_publishing_then_limits_parallelism with
#[serial] directly above their fn declarations so each test that rewrites
PATH/SHIPPER_* runs in isolation.
- Around line 231-260: In prepend_fake_cargo and prepend_fake_cargo_failing,
resolve the real cargo path to an absolute path before you mutate PATH (e.g.,
call which/resolution on std::env::var("CARGO") or use
std::env::current_exe/which equivalent) so that real_cargo is an absolute path
(not the bare "cargo") before creating fake_bin and prepending it; keep
referencing real_cargo, fake_cargo_bin_path and
create_fake_cargo_proxy/create_fake_cargo_failing to locate the logic to change.
Also ensure tests that mutate PATH, REAL_CARGO and SHIPPER_CARGO_BIN are
annotated with #[serial] from serial_test to prevent parallel runs.

In `@crates/shipper-cli/tests/bdd_preflight.rs`:
- Around line 261-270: The test currently only asserts aggregate counts in
stdout, which allows package classifications to be swapped; update the
assertions to assert the package/state pairing instead by checking that stdout
contains the specific package lines for core@0.1.0 as already published and
app@0.1.0 as new (e.g., assert stdout contains the "Already published:
core@0.1.0" and "New crates: app@0.1.0" strings) using the existing stdout
variable so the test verifies per-package status rather than just totals.
- Around line 343-353: The tests invoking
shipper_cmd(...).arg("--manifest-path")...preflight must mock the crates
registry to avoid real network calls; call spawn_registry(vec![404, 404], 0)
before the shipper_cmd invocation, pass its base URL to the command via
.arg("--api-base").arg(&registry.base_url), and after the assertion call
registry.join() to clean up; do the same change for the other block referenced
(lines 374-385) so both expected-zero-request tests use the local mock.

In `@crates/shipper-cli/tests/bdd_publish_advanced.rs`:
- Around line 7-9: Add the #[serial] attribute from the serial_test crate to
every test function in this file (i.e., replace or augment each existing #[test]
on the test functions) so tests run serially instead of relying on the comment
workaround; also import the attribute (use serial_test::serial) near the top if
not already present so the attribute resolves. Ensure you add #[serial] to all
test functions in bdd_publish_advanced.rs to match other tests like
bdd_resume.rs and bdd_workflow.rs and prevent concurrent tiny_http server
resource exhaustion on Windows.

In `@crates/shipper-cli/tests/bdd_publish_flow.rs`:
- Around line 196-227: The test
given_unpublished_workspace_when_plan_then_shows_publish_order_without_side_effects
currently only checks presence of "core@0.1.0", "utils@0.1.0", and "app@0.1.0";
add an assertion that enforces their order by locating their positions in the
captured stdout (e.g., use stdout.find("core@0.1.0"),
stdout.find("utils@0.1.0"), stdout.find("app@0.1.0")) and assert pos_core <
pos_utils < pos_app so the plan output respects dependency order while keeping
the existing non-destructive .shipper check.

In `@crates/shipper-cli/tests/bdd_workflow.rs`:
- Around line 1567-1575: Add an assertion to the preflight (dry-run) test to
verify events.jsonl is not created: in the same test block that currently checks
state_dir.join("state.json") and state_dir.join("receipt.json"), also assert
that state_dir.join("events.jsonl").exists() is false with a clear failure
message (e.g., "preflight (dry-run) should not create events.jsonl") so the test
fails if any event log is emitted; this change should be made in the test
function in crates/shipper-cli/tests/bdd_workflow.rs where state_dir is used.
- Around line 22-162: This file duplicates shared BDD helpers—extract the common
helpers into a single test-support module and import it here: move functions and
types like write_file, shipper_cmd, TestRegistry (and its join), spawn_registry,
spawn_doctor_registry, path_sep, create_fake_cargo_proxy, fake_cargo_bin_path,
setup_fake_cargo, and fast_args into the new module, update this test to use
that module's public API (remove local definitions), and update other BDD test
files (the same duplicated regions) to import the same test-support module so
all tests share one implementation.
- Around line 1996-2035: In bdd_ci_github_actions_produces_valid_yaml_steps
replace the multiple substring asserts with a YAML validity check and an insta
snapshot assertion: parse stdout as YAML to ensure it's valid, then call
insta::assert_snapshot!() on the full stdout to capture the template; update the
test to import/enable insta and any YAML parser you already use (or serde_yaml)
and apply the same refactor to the GitLab and CircleCI tests (functions around
lines noted in the review) so structural regressions are caught by snapshots
instead of simple contains() checks.

In `@crates/shipper-cli/tests/cli_e2e.rs`:
- Around line 290-310: The snapshot in crates/shipper-cli/tests/cli_e2e.rs
contains hardcoded git metadata (git_commit, git_branch, git_dirty) that vary
per environment; update the test to normalize those values before asserting by
replacing the concrete values with stable placeholders (e.g. <GIT_COMMIT>,
<GIT_BRANCH>, <GIT_DIRTY>) or by calling the same normalization helper used
previously (the function used in the other test—apply_snapshot_sanitizer or
similar) so the snapshot assertion in this test no longer depends on
environment-specific git_commit/git_branch/git_dirty values.
- Around line 236-256: The snapshot includes environment-specific git fields
(git_commit, git_branch, git_dirty) that aren't being normalized by
normalize_output, so update the normalize_output function in tests/cli_e2e.rs
(the function currently handling "  Commit: " and "  Branch: ") to also match
and replace lines starting with "git_commit:", "git_branch:", and "git_dirty:"
with stable placeholders (e.g., <GIT_COMMIT>, <GIT_BRANCH>, <GIT_DIRTY>) and
then update the expected snapshot block to use those placeholders instead of
concrete values.

In `@crates/shipper-cli/tests/e2e_doctor.rs`:
- Around line 48-77: The test server can run past a panic and the fixed
expected_requests loop is brittle; modify TestRegistry and spawn_registry to
support graceful shutdown by adding a shared Arc<AtomicBool> (e.g., stop_flag)
stored on TestRegistry, have the spawned thread loop until stop_flag is set
(using recv_timeout in a short interval to remain responsive) instead of relying
on expected_requests, and replace join(self) with a shutdown method that sets
stop_flag and then joins the thread handle; update callers to call that shutdown
method (or ensure Drop triggers it) so the server thread always exits promptly
even if tests panic or request counts change.
- Around line 175-206: The test doctor_reports_missing_token unnecessarily wraps
the command in temp_env::with_vars while the closure only sets variables to None
and the Command already calls env_remove; remove the temp_env::with_vars wrapper
and run the shipper_cmd()... chain directly (keep the same args,
.env("CARGO_HOME", ...), .env_remove("CARGO_REGISTRY_TOKEN") and
.env_remove("CARGO_REGISTRIES_CRATES_IO_TOKEN") calls) so the subprocess
environment is controlled only via the Command; update the test body accordingly
and leave spawn_registry(1) / registry.join() unchanged.
- Around line 146-173: The test doctor_detects_token_when_set currently mutates
the process environment via temp_env::with_vars which can cause races; instead
remove the temp_env::with_vars wrapper and set the token only on the subprocess
by calling .env("CARGO_REGISTRY_TOKEN", "secret-test-token") on the Command
returned by shipper_cmd() (keep the existing .env("CARGO_HOME", ...) and
.env_remove("CARGO_REGISTRIES_CRATES_IO_TOKEN") as needed), or alternatively add
#[serial] to the test if global env mutation is desired; update imports/usages
accordingly so the process-wide temp_env is not used.

In `@RELEASE_CHECKLIST_v0.3.0.md`:
- Around line 21-23: Add a blank line before the fenced code block that starts
with "```bash" so the Markdown renders correctly; locate the checklist item line
"- [ ] Publish to crates.io (dry-run first):" and insert a single empty line
between that paragraph and the following "```bash" fence to separate the block
from the preceding text.
- Around line 22-50: The publish checklist is out of dependency order and
missing crates; reorder and update the bash block so crates are topologically
sorted and include the missing workspace crates (shipper-levels,
shipper-storage, shipper-git, shipper-chunking). Specifically, ensure
dependencies like shipper-encrypt, shipper-webhook, shipper-retry,
shipper-duration, and shipper-levels appear before shipper-types; place
shipper-state before shipper-execution-core; place shipper-chunking before
shipper-engine-parallel; and add shipper-storage and shipper-git in the correct
positions according to the workspace dependency graph before running the cargo
publish dry-run list.

In `@RELEASE_NOTES_v0.3.0.md`:
- Around line 20-22: Add a single blank line immediately before the fenced code
block that begins with "```bash" containing the command "shipper publish
--resume-from my-critical-crate" so the code block is surrounded by blank lines
per Markdown best practices; locate the fenced block in RELEASE_NOTES_v0.3.0.md
and insert one empty line above the "```bash" marker.

---

Outside diff comments:
In @.github/workflows/fuzz.yml:
- Around line 82-100: The fuzz run step currently uses continue-on-error: true
and has no id, so non-crasher failures are hidden; give the "Run fuzz target"
step a stable id (e.g., id: run_fuzz_target), keep continue-on-error: true if
you want to collect artifacts, then in the "Check for crashers" step inspect
both the artifacts directory and the run step outcome (check
steps.run_fuzz_target.outcome != 'success') and emit crashers_found=true plus an
error if either crash artifacts exist or the run step failed (and set
crashers_found=false only when no artifacts exist and the run step outcome is
success) so build/toolchain failures are surfaced.

In `@crates/shipper-cargo-failure/src/lib.rs`:
- Around line 26-47: RETRYABLE_PATTERNS currently contains the bare substring
"500" which can false-match numeric contexts (e.g., ports or versions); update
the RETRYABLE_PATTERNS constant to use a more specific match for HTTP 500 (for
example change "500" to " 500 " or "500 " or use a regex word-boundary variant
like r"\b500\b") so only standalone status codes are matched; modify the entry
for "500" (and similarly "502","503","504" if desired) inside the
RETRYABLE_PATTERNS array or switch to a regex-based check where the matching
code consults the new pattern to avoid the documented false positives.

In `@ROADMAP.md`:
- Line 7: Update the Table of Contents entry that currently reads "Current
Release: v0.2.0" (and its anchor "(`#current-release-v020`)") to match the
document's new release string "v0.3.0-rc.1" and update the anchor to the
corresponding heading anchor (e.g., "(`#current-release-v030-rc1`)" or whatever
the generated slug for the "Current Release: v0.3.0-rc.1" heading is) so the ToC
label and link both reflect v0.3.0-rc.1.
- Around line 560-563: The version table currently marks v0.2.0 as "Current";
change the table so the "Version" cell shows v0.3.0-rc.1 with "Status" set to
**Current** (replace the v0.2.0 row), and update the v0.2.0 row to "Released"
under Status with its existing Theme/Notes; ensure the table includes
v0.3.0-rc.1 Theme/Notes (e.g., release candidate details) and that rows remain
properly aligned (refer to the Version entries v0.3.0-rc.1, v0.2.0 as unique
identifiers).

---

Duplicate comments:
In `@crates/shipper-cargo-failure/CLAUDE.md`:
- Around line 1-29: Replace template placeholders and fix formatting in
CLAUDE.md: substitute $name with "shipper-cargo-failure", set $entryPoint to the
crate's primary entry (e.g., lib.rs or main.rs as applicable), and update
$rootDocs to the actual relative docs path; correct the malformed shell code
fence (replace the stray control character and use a proper ```bash block) and
ensure the cargo commands are on separate lines; normalize backslashes in the
workspace path or use forward slashes for consistency and fix any
punctuation/typo issues so the file matches the other CLAUDE.md files' format.

In `@crates/shipper-cargo/CLAUDE.md`:
- Around line 1-29: The CLAUDE.md uses placeholders and a broken code fence;
replace every placeholder ($name, $entryPoint, $rootDocs) with the actual crate
name "shipper-cargo" (and the correct primary entry if known), fix the malformed
code block (remove the stray control char and use a proper triple-backtick
fenced block with "bash"), clean up Windows path escaping (use consistent path
formatting or a relative path), and apply the same formatting fixes you applied
to other CLAUDE.md files so headers, bullets, and the "Useful commands" block
are stable and readable; locate and edit the CLAUDE.md in crates/shipper-cargo
and update the placeholders and code fence accordingly.