Function try_build_fetch_plan 

pub fn try_build_fetch_plan(
    ref_: &Ref,
    store_root: &Utf8Path,
) -> Result<FetchPlan, FetchError>

Fallible builder for the dry-run preview (FetchPlan).

Identical to build_fetch_plan on the happy path, but propagates an internal allowlist-contract drift as a typed FetchError::SourceSchema (which maps to crate::ErrorCode::InternalError at the public boundary — the correct closed-set fit for an internal-invariant violation) instead of panicking. This is the API issue #156 ② asks for; it is added alongside the existing infallible build_fetch_plan rather than replacing it, because build_fetch_plan is pub and called from doiget-mcp / doiget-cli, whose signatures are out of scope for this change batch.

Errors

Returns FetchError::SourceSchema if the in-crate allowlist builders (oa_publisher_allowlist / tier_1_allowlist) stop returning the "oa-publisher" / "arxiv" source keys this function looks up — an internal-contract drift bug, surfaced rather than panicked (issue #156 ②). The in-crate tests pin the keys so this is unreachable in a correct build.