Fix Asset Store release staging

[Eli Pinkerton (wallstop)]

Why

Unity documents interactive Editor workflows for classic and UPM Asset Store publishing. It does not document a supported non-interactive upload API or service credential.

The release workflow staged an operator artifact, but uploaded it after npm publication. Its generator did not reject corrupt or stale store media, tag drift, or changelog drift. The UPM procedure also lacked a complete, supported acceptance test for per-version notes.

What changed

• Upload the verified asset-store-submission artifact before npm publication.
• Validate release checksums, tag/version agreement, shipped changelog agreement, PNG structure and dimensions, and SVG/PNG source locks.
• Generate classic and UPM checklists, exact expected UPM field values, and a size/hash manifest.
• Use Unity's official classic Validator and uploader flow.
• Make the two-version Package Manager Version History result the acceptance proof for issue upm: Version History shows the best-match changelog for versions that are not installed #403.
• Quarantine unsupported-upload research behind a protected manual environment.
• Capture recognized official Unity pages with bounded requests and fail closed when evidence is incomplete.

How we know

• npm test: 524 passed, 0 failed.
• npm run validate:all: passed.
• Formatting, spelling, Markdown lint, YAML validation, and diff checks passed.
• A fresh npm pack rehearsal generated the ten-file v3.3.0 submission artifact.
• Unity MCP confirmed the connected editor can answer editor-backed calls.
• The final adversarial review reported zero material and zero minor findings.

Remaining limitation

The authenticated Asset Store upload remains interactive. The workflow does not call undocumented endpoints, harvest Unity ID sessions, or store publisher credentials.

Progresses #399.
Prepares the owner-run experiment for #403.

---

Note

Medium Risk
Changes reorder the release publish job and add strict pre-npm gates on store collateral; a bad media hash or changelog drift blocks publication, but npm/GitHub release semantics are otherwise unchanged.

Overview
Release workflow now uploads the asset-store-submission artifact immediately after assembly and before npm publish, so a successful registry step cannot run without the operator payload being available.

asset-store-submission.js gains fail-fast checks (release checksums, tag vs package.json version, _upm.changelog vs CHANGELOG.md, PNG structure/dimensions, and pinned SVG/PNG hashes). It emits EXPECTED-UPM-FIELDS.json and expands classic/UPM checklists to match Unity’s documented Validator/Uploader flows and Package Manager Version History acceptance for per-version notes.

The quarantined research workflow fetches five official Unity publishing URLs into artifacts and fails when any page is missing or unrecognized, instead of printing a static risk brief.

Ops/runbook docs are aligned with the new artifact contents, staging order, media hash lock procedure, and manual UPM verification steps; tests assert workflow ordering and the new validation paths.

^{Reviewed by Cursor Bugbot for commit 41ed20e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

Performance Numbers

Measured commit: 41ed20e
Trusted reporting code (PR base): d398c09
Measured historical baseline: 63a2dc7
Workflow run: 33206399758 attempt 1

Benchmark methodology and execution profile are unchanged; the historical Standalone comparison is diagnostic regression smoke.

Historical Standalone delta

Delta direction: + is better; - is worse.

Scenario	Baseline	Current	Delta
Empty Bus Dispatch	52.82 M emits/sec	52.58 M emits/sec	-0.44%
Untargeted Flood (One Handler)	47.69 M emits/sec	47.81 M emits/sec	+0.26%
Untargeted Flood (One Direct Handler)	50.74 M emits/sec	49.60 M emits/sec	-2.26%
Untargeted Flood (Two Handlers, One Priority)	46.00 M emits/sec	44.84 M emits/sec	-2.52%
Untargeted Flood (Three Handlers, One Priority)	43.00 M emits/sec	42.85 M emits/sec	-0.34%
Untargeted Flood (Four Handlers, One Priority)	40.42 M emits/sec	40.65 M emits/sec	+0.59%
Untargeted Flood (Four Handlers, Four Priorities)	40.22 M emits/sec	40.41 M emits/sec	+0.48%
Untargeted Flood (Sixteen Handlers, One Priority)	22.81 M emits/sec	23.46 M emits/sec	+2.87%
Untargeted Flood (One Inactive Handler)	49.12 M emits/sec	49.56 M emits/sec	+0.89%
Untargeted First Dispatch (Cold, Distinct Types)	0.205 ms	0.202 ms	+1.46%
Targeted Flood (No Matching Target)	18.37 M emits/sec	18.66 M emits/sec	+1.61%
Targeted Flood (One Listener)	15.35 M emits/sec	15.72 M emits/sec	+2.43%
Targeted Flood (Sixteen Listeners)	11.21 M emits/sec	11.29 M emits/sec	+0.73%
Targeted First Dispatch (Cold, Distinct Types)	0.194 ms	0.190 ms	+2.06%
Broadcast Flood (One Handler)	27.46 M emits/sec	32.80 M emits/sec	+19.43%
Broadcast First Dispatch (Cold, Distinct Types)	0.198 ms	0.203 ms	-2.53%
Targeted Post Route (Stable)	25.52 M emits/sec	26.92 M emits/sec	+5.50%
Targeted Post Route (Rewritten, Empty Final Route)	22.22 M emits/sec	24.77 M emits/sec	+11.47%
Targeted Post Route (Rewritten, Populated Final Route)	16.36 M emits/sec	17.11 M emits/sec	+4.60%
Broadcast Post Route (Stable)	26.41 M emits/sec	28.47 M emits/sec	+7.82%
Broadcast Post Route (Rewritten, Empty Final Route)	22.64 M emits/sec	25.49 M emits/sec	+12.57%
Broadcast Post Route (Rewritten, Populated Final Route)	16.20 M emits/sec	17.87 M emits/sec	+10.27%
Interceptor Heavy (Four Interceptors)	33.89 M emits/sec	33.46 M emits/sec	-1.26%
Post-Processing Heavy (Four Post-Processors)	29.06 M emits/sec	29.83 M emits/sec	+2.67%
Message Bus Construction (1000)	16.229 ms	18.882 ms	-16.35%
Registration Token Construction (1000, Prebuilt Handler + Bus)	0.046 ms	0.046 ms	0.00%
Registration Flood (1000 Types, Cold Bus)	468.610 ms	471.436 ms	-0.60%
Registration Flood (1000 Types, Warm JIT)	2.378 ms	2.699 ms	-13.50%
Untargeted Registration (Marginal, 1000 Same-Type)	0.401 ms	0.392 ms	+2.24%
Targeted Registration (Marginal, 1000 Same-Type)	0.448 ms	0.443 ms	+1.12%
Broadcast Registration (Marginal, 1000 Same-Type)	0.458 ms	0.440 ms	+3.93%
Deregistration Flood (1000 Types, Cold)	1.786 ms	1.958 ms	-9.63%
Deregistration Flood (1000 Types, Warm JIT)	1.152 ms	1.105 ms	+4.08%
Registration Attribution (Direct Bus, 131072)	29.365 ms	29.550 ms	-0.63%
Registration Attribution (Direct Handler, 131072)	61.099 ms	60.434 ms	+1.09%
Registration Attribution (Token Stage, 131072)	11.575 ms	11.639 ms	-0.55%
Registration Attribution (Token Active, 131072)	87.376 ms	85.924 ms	+1.66%
Deregistration Attribution (Direct Bus, 131072)	7.044 ms	7.022 ms	+0.31%
Deregistration Attribution (Direct Handler, 131072)	27.597 ms	26.989 ms	+2.20%
Deregistration Attribution (Token Remove, 131072)	32.113 ms	31.914 ms	+0.62%
Deregistration Attribution (Token Disable, 131072)	33.774 ms	32.131 ms	+4.86%
Global -> 1 subscriber	48.48 M emits/sec	48.35 M emits/sec	-0.27%
Global -> 16 subscribers	18.18 M emits/sec	20.95 M emits/sec	+15.20%
Keyed/targeted -> 1 of many	15.25 M emits/sec	15.27 M emits/sec	+0.17%
Priority-ordered dispatch	39.19 M emits/sec	38.46 M emits/sec	-1.87%
Filtered/intercepted dispatch	35.91 M emits/sec	37.73 M emits/sec	+5.06%
Post-processing dispatch	31.64 M emits/sec	33.21 M emits/sec	+4.95%
Intercepted + post-processed dispatch	29.16 M emits/sec	30.47 M emits/sec	+4.51%
Subscribe/unsubscribe churn	1.49 M emits/sec	1.49 M emits/sec	+0.01%
Struct message (no boxing)	47.04 M emits/sec	46.50 M emits/sec	-1.15%

Current TargetMap evidence

These raw rows are current-run diagnostics. Use fresh bracketed controls before accepting a micro-optimization.

[Standalone] DXM_TARGET_MAP_BENCHMARK scenario=TargetMap_16_Churn keyCount=16 operation=Churn totalOperations=2420000 operationsPerSecond=482671.408 wallClockMs=5013.763 gcAllocations=-1 gcAllocatedBytes=-1 targetMapEntries=16 targetMapCapacity=32 observedInvocations=2440000
[Standalone] DXM_TARGET_MAP_BENCHMARK scenario=TargetMap_16_Hit keyCount=16 operation=Hit totalOperations=74970000 operationsPerSecond=14992546.623 wallClockMs=5000.485 gcAllocations=-1 gcAllocatedBytes=-1 targetMapEntries=16 targetMapCapacity=32 observedInvocations=74990000
[Standalone] DXM_TARGET_MAP_BENCHMARK scenario=TargetMap_16_Miss keyCount=16 operation=Miss totalOperations=81170000 operationsPerSecond=16232807.538 wallClockMs=5000.367 gcAllocations=-1 gcAllocatedBytes=-1 targetMapEntries=16 targetMapCapacity=32 observedInvocations=0
[Standalone] DXM_TARGET_MAP_BENCHMARK scenario=TargetMap_1_Churn keyCount=1 operation=Churn totalOperations=2530000 operationsPerSecond=505741.354 wallClockMs=5002.557 gcAllocations=-1 gcAllocatedBytes=-1 targetMapEntries=1 targetMapCapacity=4 observedInvocations=2550000
[Standalone] DXM_TARGET_MAP_BENCHMARK scenario=TargetMap_1_Hit keyCount=1 operation=Hit totalOperations=75620000 operationsPerSecond=15123823.959 wallClockMs=5000.058 gcAllocations=-1 gcAllocatedBytes=-1 targetMapEntries=1 targetMapCapacity=4 observedInvocations=75640000
[Standalone] DXM_TARGET_MAP_BENCHMARK scenario=TargetMap_1_Miss keyCount=1 operation=Miss totalOperations=83000000 operationsPerSecond=16598933.685 wallClockMs=5000.321 gcAllocations=-1 gcAllocatedBytes=-1 targetMapEntries=1 targetMapCapacity=4 observedInvocations=0
[Standalone] DXM_TARGET_MAP_BENCHMARK scenario=TargetMap_256_Churn keyCount=256 operation=Churn totalOperations=2340000 operationsPerSecond=467664.722 wallClockMs=5003.585 gcAllocations=-1 gcAllocatedBytes=-1 targetMapEntries=256 targetMapCapacity=512 observedInvocations=2360000
[Standalone] DXM_TARGET_MAP_BENCHMARK scenario=TargetMap_256_Hit keyCount=256 operation=Hit totalOperations=69660000 operationsPerSecond=13931784.336 wallClockMs=5000.077 gcAllocations=-1 gcAllocatedBytes=-1 targetMapEntries=256 targetMapCapacity=512 observedInvocations=69680000
[Standalone] DXM_TARGET_MAP_BENCHMARK scenario=TargetMap_256_Miss keyCount=256 operation=Miss totalOperations=80520000 operationsPerSecond=16103643.787 wallClockMs=5000.111 gcAllocations=-1 gcAllocatedBytes=-1 targetMapEntries=256 targetMapCapacity=512 observedInvocations=0
[Standalone] DXM_TARGET_MAP_BENCHMARK scenario=TargetMap_4096_Churn keyCount=4096 operation=Churn totalOperations=2070000 operationsPerSecond=411829.682 wallClockMs=5026.350 gcAllocations=-1 gcAllocatedBytes=-1 targetMapEntries=4096 targetMapCapacity=8192 observedInvocations=2090000
[Standalone] DXM_TARGET_MAP_BENCHMARK scenario=TargetMap_4096_Hit keyCount=4096 operation=Hit totalOperations=61330000 operationsPerSecond=12265072.025 wallClockMs=5000.378 gcAllocations=-1 gcAllocatedBytes=-1 targetMapEntries=4096 targetMapCapacity=8192 observedInvocations=61350000
[Standalone] DXM_TARGET_MAP_BENCHMARK scenario=TargetMap_4096_Miss keyCount=4096 operation=Miss totalOperations=79560000 operationsPerSecond=15911860.294 wallClockMs=5000.044 gcAllocations=-1 gcAllocatedBytes=-1 targetMapEntries=4096 targetMapCapacity=8192 observedInvocations=0
[Standalone] DXM_TARGET_MAP_BENCHMARK scenario=TargetMap_4_Churn keyCount=4 operation=Churn totalOperations=2450000 operationsPerSecond=489694.450 wallClockMs=5003.120 gcAllocations=-1 gcAllocatedBytes=-1 targetMapEntries=4 targetMapCapacity=8 observedInvocations=2470000
[Standalone] DXM_TARGET_MAP_BENCHMARK scenario=TargetMap_4_Hit keyCount=4 operation=Hit totalOperations=77630000 operationsPerSecond=15524824.460 wallClockMs=5000.379 gcAllocations=-1 gcAllocatedBytes=-1 targetMapEntries=4 targetMapCapacity=8 observedInvocations=77650000
[Standalone] DXM_TARGET_MAP_BENCHMARK scenario=TargetMap_4_Miss keyCount=4 operation=Miss totalOperations=84000000 operationsPerSecond=16798828.786 wallClockMs=5000.349 gcAllocations=-1 gcAllocatedBytes=-1 targetMapEntries=4 targetMapCapacity=8 observedInvocations=0
[Standalone] DXM_TARGET_MAP_CONSTRUCTION keyCount=1 wallClockMs=0.000110 operationsPerSecond=9066183.137 gcAllocations=-1 gcAllocatedBytes=-1 targetMapCapacity=4
[Standalone] DXM_TARGET_MAP_CONSTRUCTION keyCount=16 wallClockMs=0.000617 operationsPerSecond=1620253.165 gcAllocations=-1 gcAllocatedBytes=-1 targetMapCapacity=32
[Standalone] DXM_TARGET_MAP_CONSTRUCTION keyCount=256 wallClockMs=0.008475 operationsPerSecond=117994.100 gcAllocations=-1 gcAllocatedBytes=-1 targetMapCapacity=512
[Standalone] DXM_TARGET_MAP_CONSTRUCTION keyCount=4 wallClockMs=0.000225 operationsPerSecond=4440497.336 gcAllocations=-1 gcAllocatedBytes=-1 targetMapCapacity=8
[Standalone] DXM_TARGET_MAP_CONSTRUCTION keyCount=4096 wallClockMs=0.123300 operationsPerSecond=8110.300 gcAllocations=-1 gcAllocatedBytes=-1 targetMapCapacity=8192