chore(build-codegen): Phase-9 gap closure — 6 missed env vars + Set-by column + per-crate rustdoc

crates/uffs-cli/build.rs

@@ -63,6 +63,31 @@
 //! admin at the manifest level would pop UAC on every `uffs <pattern>`
 //! invocation and defeat the v0.5.36 elevation refactor.  See
 //! `docs/refactor/elevation-posture.md` for the full posture doc.
+//!
+//! # Environment
+//!
+//! Build-time env vars consumed by this script (registry:
+//! `docs/architecture/code-quality/build_codegen_policy.md` §5.1, playbook
+//! §1049-1056):
+//!
+//! | Name | Type | Default | Notes |
+//! |---|---|---|---|
+//! | `CARGO_CFG_TARGET_OS`  | `string` | (set by Cargo) | Gates the effectful block on `target_os == "windows"`. |
+//! | `CARGO_CFG_TARGET_ENV` | `string` | (set by Cargo) | Gates the effectful block on `target_env == "msvc"` (vs `gnu`). |
+//!
+//! Both vars are auto-tracked by Cargo (no explicit
+//! `cargo:rerun-if-env-changed=` needed); changes to either value invalidate
+//! the build cache automatically.
+//!
+//! # Inputs / tools / platform
+//!
+//! - **Files read** (declared via `cargo:rerun-if-changed=`): `build.rs`
+//!   (self), `app.manifest`, `../../assets/brand/icons/uffs.ico`.
+//! - **Tools required**: MSVC `link.exe` + `delayimp.lib` (for `/DELAYLOAD`);
+//!   [`winresource`] crate (for PE resource embedding).
+//! - **Platform assumptions**: the effectful block is MSVC-Windows only; on
+//!   macOS / Linux / MinGW build hosts the script emits only the three
+//!   `cargo:rerun-if-changed=` hints (harmless no-ops).
 
 fn main() {
     // Re-run when this file, the app manifest, or the icon change.  The

crates/uffs-cli/src/main.rs

@@ -26,6 +26,21 @@
 //! would be linked on Windows; gating its use behind a non-default
 //! feature lets package builds opt in only when probe data is worth
 //! the launch-time hit.
+//!
+//! # Environment
+//!
+//! Runtime env vars read by this binary (registry:
+//! `docs/architecture/code-quality/build_codegen_policy.md` §5, playbook
+//! §1049-1056).  Build-time env vars (`CARGO_CFG_TARGET_OS` /
+//! `CARGO_CFG_TARGET_ENV`) are documented in [`build.rs`](../../build.rs).
+//!
+//! | Env var | Type | Default | Notes |
+//! |---|---|---|---|
+//! | `CARGO_PKG_VERSION` | `string` | (set by Cargo) | Read via `env!()` for `--version` output + log preludes.  CARGO semver class. |
+//! | `RUST_LOG` | `string` | `info` | `tracing-subscriber` filter directive; consulted as a fallback when `UFFS_LOG` is unset.  STANDARD semver class (tracing convention). |
+//! | `UFFS_LOG` | `string` | `info` | UFFS-specific log level override (preferred over `RUST_LOG` for UFFS binaries).  INTERNAL semver class. |
+//! | `UFFS_LOG_DIR` | `path` | platform default (`%LOCALAPPDATA%\UFFS\logs` / `$XDG_CACHE_HOME/uffs/logs`) | Log directory override for `uffs daemon start` and `uffs search`.  Mirrors the `--log-dir` CLI flag.  INTERNAL semver class. |
+//! | `UFFS_LOG_FILE` | `path` | (none — auto-generated under `UFFS_LOG_DIR`) | Log-file path override.  Mirrors the `--log-file` CLI flag.  INTERNAL semver class. |
 
 // CLI main module uses single-call functions by design
 #![expect(

crates/uffs-client/src/lib.rs

@@ -51,6 +51,20 @@
 //!   change in Phase 3b); safe under both external usage patterns in
 //!   `uffs-cli`.
 //! - **§3.7** N/A — no `pub trait` declarations in this crate.
+//!
+//! # Environment
+//!
+//! Env vars read by this crate (registry:
+//! `docs/architecture/code-quality/build_codegen_policy.md` §5, playbook
+//! §1049-1056):
+//!
+//! | Env var | Type | Default | Notes |
+//! |---|---|---|---|
+//! | `CARGO_PKG_VERSION` | `string` | (set by Cargo) | Read via `env!()` for `ResponseStatus::version`.  CARGO semver class. |
+//! | `UFFS_CLIENT_SKIP_HEALTH_CHECK` | `bool` | `false` | Skips post-connect health probe in [`daemon_ctl`].  Used by `just ship` cross-check.  INTERNAL semver class. |
+//! | `UFFS_CLIENT_TIMEOUT_SECS` | `int` (seconds) | `5` | Sync connect timeout override in `connect_sync_platform`.  INTERNAL semver class. |
+//! | `UFFS_ELEVATE` | `string` (`auto` / `never` / `always` / `prefer`) | `auto` | Elevation policy for daemon spawn; read in `daemon_spawn::resolve_elevation_policy` (private module).  INTERNAL semver class. |
+//! | `XDG_RUNTIME_DIR` | `path` | (XDG: `/run/user/$UID`) | Linux daemon-socket location in [`daemon_ctl`].  STANDARD semver class. |
 
 // On docs.rs only: enable the `doc_cfg` rustdoc feature so cfg-gated items
 // (`#[cfg(feature = "async")]`, `#[cfg(windows)]`, etc.) render with their

crates/uffs-core/src/lib.rs

@@ -87,6 +87,16 @@
 //! reader and the test-side mock reader.  External impls are by
 //! design.  Sealing would defeat the trait's purpose.  **Kept open**
 //! (see the type-level decision record on `FileReader` itself).
+//!
+//! # Environment
+//!
+//! Env vars read by this crate (registry:
+//! `docs/architecture/code-quality/build_codegen_policy.md` §5, playbook
+//! §1049-1056):
+//!
+//! | Env var | Type | Default | Notes |
+//! |---|---|---|---|
+//! | `UFFS_CACHE_PROFILE` | `bool` (`env::var_os(…).is_some()` — *any* value enables) | `false` (unset) | Emits per-phase cache I/O timings to stderr (`[CACHE_PROFILE]` prefix) from `compact_cache::{load,save,seek}` and `search::query`.  Dev / benchmark only.  INTERNAL semver class. |
 
 #![forbid(unsafe_code)]
 #![warn(clippy::all, clippy::pedantic)]

crates/uffs-daemon/src/lib.rs

@@ -16,6 +16,27 @@
 //! across sibling modules fragments the shared `DaemonConfig` /
 //! `EventSender` wiring and obscures the parent-task lifetime
 //! relationships between them.
+//!
+//! # Environment
+//!
+//! Env vars read by this crate (registry:
+//! `docs/architecture/code-quality/build_codegen_policy.md` §5, playbook
+//! §1049-1056).  Cache-tier knobs are read via `pub(crate) const FOO_ENV: &str
+//! = "UFFS_FOO_…";` indirections in `cache::policy`; the audit script
+//! `scripts/dev/build_codegen_audit.sh` detects these.
+//!
+//! | Env var | Type | Default | Notes |
+//! |---|---|---|---|
+//! | `CARGO_MANIFEST_DIR` | `path` | (set by Cargo) | Test-fixture path resolution.  CARGO semver class. |
+//! | `CARGO_PKG_VERSION` | `string` | (set by Cargo) | Read via `env!()` for status payload + log preludes.  CARGO semver class. |
+//! | `RUST_LOG` | `string` | `info` | `tracing-subscriber` filter directive; consulted in `main` when `UFFS_LOG` is unset.  STANDARD semver class (tracing convention). |
+//! | `UFFS_LOG` | `string` | `info` | UFFS-specific log level override for the daemon binary.  INTERNAL semver class. |
+//! | `UFFS_HOT_TO_WARM_IDLE_SECS` | `int` (seconds) | `60` | Cache tier `Hot → Warm` transition timer override (via `HOT_TO_WARM_IDLE_ENV` const indirection).  INTERNAL semver class. |
+//! | `UFFS_WARM_TO_PARKED_IDLE_SECS` | `int` (seconds) | `300` (5 min) | Cache tier `Warm → Parked` transition timer override (via `WARM_TO_PARKED_IDLE_ENV` const indirection).  INTERNAL semver class. |
+//! | `UFFS_PARKED_TO_COLD_IDLE_SECS` | `int` (seconds) | `86_400` (24 h) | Cache tier `Parked → Cold` transition timer override (via `PARKED_TO_COLD_IDLE_ENV` const indirection).  INTERNAL semver class. |
+//! | `UFFS_USN_REFRESH_INTERVAL_SECS` | `int` (seconds) | `300` (5 min) | USN journal refresh interval override (via `USN_REFRESH_INTERVAL_ENV` const indirection).  INTERNAL semver class. |
+//! | `UFFS_SEARCH_MAX_CONCURRENCY` | `int` (search permits) | auto: `max(2, cpus × 26 / (drives × 10))` | Overrides the auto-tuned search-permit target for `(cpus, drives)` topology (via `index::DriveIndex::SEARCH_CONCURRENCY_ENV` const indirection).  INTERNAL semver class. |
+//! | `XDG_RUNTIME_DIR` | `path` | (XDG: `/run/user/$UID`) | Linux daemon-socket location.  STANDARD semver class. |
 
 // Enable unstable Windows Unix domain socket support (Windows 10 1803+).
 #![cfg_attr(windows, feature(windows_unix_domain_sockets))]

crates/uffs-mcp/src/lib.rs

@@ -44,6 +44,19 @@
 //! stdio transport can pass `default-features = false` to drop
 //! axum and tower-service from their binary; both transports share
 //! the same tool / resource / prompt surface.
+//!
+//! # Environment
+//!
+//! Env vars read by this crate (registry:
+//! `docs/architecture/code-quality/build_codegen_policy.md` §5, playbook
+//! §1049-1056):
+//!
+//! | Env var | Type | Default | Notes |
+//! |---|---|---|---|
+//! | `CARGO_PKG_VERSION` | `string` | (set by Cargo) | Read via `env!()` for the MCP `serverInfo.version` field.  CARGO semver class. |
+//! | `UFFS_LOG` | `string` | `info` | Log level for `tracing-subscriber` (preferred over `RUST_LOG` for UFFS binaries).  INTERNAL semver class. |
+//! | `UFFS_LOG_FILE` | `path` | (none) | Optional log-file path override for the MCP HTTP gateway binary.  INTERNAL semver class. |
+//! | `UFFS_MCP_AUTH_TOKEN` | `token` | (auto-generated per session) | Bearer-token override for the MCP HTTP gateway binary in `bin/http_gateway.rs`.  INTERNAL semver class. |
 
 // On docs.rs only: enable the `doc_cfg` rustdoc feature so cfg-gated items
 // render with their cfg badge.  Gated behind `cfg(docsrs)` so local

crates/uffs-mft/src/lib.rs

@@ -89,6 +89,28 @@
 //!
 //! No `pub trait` declarations live in this crate, so the
 //! sealed-trait decision (§3.7) is **N/A**.
+//!
+//! # Environment
+//!
+//! Env vars read by this crate (registry:
+//! `docs/architecture/code-quality/build_codegen_policy.md` §5, playbook
+//! §1049-1056).  Several are dev / parity-debug knobs read via `env::var_os(…).
+//! is_some()` (any set value enables; absence disables).
+//!
+//! | Env var | Type | Default | Notes |
+//! |---|---|---|---|
+//! | `CARGO_MANIFEST_DIR` | `path` | (set by Cargo) | Test-fixture path resolution.  CARGO semver class. |
+//! | `CARGO_PKG_VERSION` | `string` | (set by Cargo) | Read via `env!()` for log preludes.  CARGO semver class. |
+//! | `RUST_LOG` | `string` | `info` | `tracing-subscriber` filter directive used by the standalone `uffs_mft` binary.  STANDARD semver class (tracing convention). |
+//! | `RUST_LOG_FILE` | `path` | (none) | Optional log-file path override for the standalone `uffs_mft` binary.  INTERNAL semver class. |
+//! | `UFFS_LOG_DIR` | `path` | platform default | Log directory override for the standalone `uffs_mft` binary.  INTERNAL semver class. |
+//! | `UFFS_CACHE_PROFILE` | `bool` (`env::var_os(…).is_some()`) | `false` (unset) | Emits per-phase cache I/O timings to stderr (`[CACHE_PROFILE]` prefix) from `cache`, `index/storage/{deserialize,file_io}`, and `reader/persistence`.  Dev / benchmark only.  INTERNAL semver class. |
+//! | `UFFS_MFT_TEST_DIR` | `path` | (none) | Optional test-fixture directory for the parallel-reader chaos-order harness.  Test-only.  INTERNAL semver class. |
+//! | `UFFS_MFT_TEST_FILE` | `path` | (none) | Optional test-fixture file path for the parallel-reader chaos-order harness.  Test-only.  INTERNAL semver class. |
+//! | `UFFS_PARITY_DEBUG` | `bool` | `false` | Enables verbose chaos-order parity debugging in the LIVE parser (`io::readers::parallel::to_index`).  INTERNAL semver class (dev only). |
+//! | `UFFS_REBUILD_CHILDREN_ALWAYS` | `bool` (`env::var_os(…).is_some()`) | `false` (unset) | Forces unconditional children-rebuild from name graph in `index::tree::compute_tree_metrics_impl`; removes parse-order artifacts for validation runs.  INTERNAL semver class (dev only). |
+//! | `UFFS_SINGLE_THREAD` | `bool` | `false` | Forces single-threaded reader in `reader::persistence` for parity debugging.  INTERNAL semver class (dev only). |
+//! | `UFFS_SKIP_ORPHANS` | `bool` (`env::var_os(…).is_some()`) | `false` (unset) | Skips orphan-record sweep in `index::tree::compute_tree_metrics_impl` (only paths reachable from ROOT through visible FILE_NAME edges are aggregated).  INTERNAL semver class (dev only). |
 
 // On docs.rs only: enable the `doc_cfg` rustdoc feature so cfg-gated items
 // (`#[cfg(windows)]`, `#[cfg(feature = "...")]`, etc.) render with their

crates/uffs-security/src/lib.rs

@@ -16,6 +16,17 @@
 //! - [`runtime_dir`] — Daemon-private runtime tempfile lifecycle (Phase 2b
 //!   memory tiering): owner-only file creation, orphan-pid sweep, read-only
 //!   mmap behind a typed soundness wrapper
+//!
+//! # Environment
+//!
+//! Env vars read by this crate (registry:
+//! `docs/architecture/code-quality/build_codegen_policy.md` §5, playbook
+//! §1049-1056):
+//!
+//! | Env var | Type | Default | Notes |
+//! |---|---|---|---|
+//! | `UFFS_DEV` | `bool` | `false` | Enables dev-mode keystore relaxation in [`keystore`] (no DPAPI binding; file-based key at `~/.local/share/uffs/key.bin` on Unix).  INTERNAL semver class. |
+//! | `USERNAME` | `string` | (Windows: current user) | Read by [`fs::set_file_permissions_owner_only`] on Windows to derive the principal for the `icacls /grant` ACL.  STANDARD semver class. |
 
 // Platform-gated deps: used by sub-modules behind #[cfg] gates.
 // Suppress unused-crate-dependencies lint for platforms where the