[2.0] Verify package artifacts and stable release promotion

This is a release-readiness audit, not a code change: the open gates are blocker #477 (the @master/css-binding tarball ships build-host artifacts/ and its loader picks that binary before the matching optional platform package) and the registry/channel checks listed in the body. Read the release plugin configuration and the binding loader, then rerun the packed-consumer tests on each platform. Done means the remaining gate checkboxes are verified with recorded versions and checksums, and the promotion sequence is rehearsed without publishing.

Parent: #467

Scope and acceptance

Inspect all 34 public workspace packages, exports/types/files, exact internal dependency rewriting, native/Wasm delivery, checksums/provenance, ordering, stable channels and interrupted-publication recovery. Actual registry installation and promotion remain separate acceptance gates.

Candidate: 9efee4d32. Publication and deployment remain on hold. These records distinguish source/assembled-artifact evidence from public-registry and deployed-product evidence.

Implemented

• The generic binding archive excludes build-host native payloads; #477 is closed. Actual release-prepared dependency archives are installed and executed on all eight native targets.
• Workspace publication first stages a complete cohort under a candidate tag. Formal tags move only after whole-cohort integrity/provenance-metadata checks and a fresh isolated registry consumer pass. Provenance metadata presence does not replace cryptographic attestation verification.
• State records archive SHA-512, source revision, original formal tags and pending/completed operations. Explicit same-revision recovery restores the original GitHub artifact after repository/workflow/run/attempt/SHA/digest checks. It does not regenerate tarballs, choose a new version, create Git notes/releases, publish editors or deploy.
• Recovery tests include immutable conflicts, lost responses and moved tags. A 34-archive working-tree rehearsal exercised 70 interrupted upload/promotion boundaries; a fresh local consumer exercised native/Wasm, explicit public PHP sources and CLI. This rehearsal is not a published or clean final-candidate artifact claim.
• .github/RELEASING.md records the concrete sequence, limitations and recovery procedure. There is no blind rollback, multi-package atomic transaction or automatic semantic-release addChannel fallback.

Current public registry baseline

The final 2026-11-05 Asia/Taipei read-only inventory (20:40 UTC November 4) found no 2.0.0 version among the 34 names. @master/css still has latest: 1.37.8 and rc: 2.0.0-rc.88. Six names return 404: @master/css-next, @master/css-nuxt, @master/css-svelte, @master/css-svelte-addon, @master/css-vscode, @master/css-webpack. A public 404 does not establish ownership or availability to the account.

Acceptance status

• Fix #477 and execute cross-platform packed consumers.
• Implement and rehearse interrupted-publication recovery before stable promotion.
• Stage all public names and required channels; verify documented commands against actual registry tarballs.
• Verify publication permissions/provenance privately and preserve the final exact published versions/checksums.
• Match every published artifact to the verified source/program version; run the registry-only integration/browser/CDN matrix before declaring stable readiness.

Final verification — 2026-11-05 (Asia/Taipei)

Exact committed candidate: 9efee4d32, pushed to rc. Source preparation and the complete non-publishing matrix are verified. Public stable readiness remains held by the delivery acceptance items below.

• Full release-candidate CI: SUCCESS, 33/33 jobs, attempt 1. All eight native targets, Linux quality/site/E2E, Rust, full Windows/macOS graphs, editor gate and aggregate required gate passed on this exact source. No CI or failed-test retry was needed for this final candidate.
• Packed native closure: SUCCESS, 11/11 jobs, including all eight actual native consumers and the full Windows required gate. Fresh ZIP digests, exact source/run/target identities and non-target dependency integrities were independently verified.
• Independent full Windows validation: SUCCESS. CLI 112/112, installer 73/73, ten CLI/MCP repetitions, focused Next 10/10, 59/59 package tasks with zero cache hits, and 37/37 example tasks (26 cached prerequisites; all 11 example builds executed). Actual watcher traces end with exact none-only CSS, no obsolete rules or excluded grid, successful quietness/cleanup and valid controlled registration chronology. Hosted macOS 26 also passed 59/59 uncached package tasks and 37/37 example tasks on the same revision.
• All 16 VSIX archives and 16 actual host/publisher proofs passed exact-source/version/hash/native-payload validation: version 2.0.37, both publishers, 12 desktop and four official Alpine remote host proofs. Activation, completion, hover and restart passed in real installed extension hosts; native/LSP-only checks did not substitute for installation. The source gate revalidated those same VSIX bytes, not rebuilt replacements.
• Current Rust/Wasm versus JavaScript engine differential: 0 / 200,099 differences. Runtime browser E2E 672/672 and Next E2E 11/11 passed; bundle/CDN and generated-program gates passed. No failed/flaky/retry summary was observed in the E2E log.
• The clean same-source 34-archive cohort, 0.0.0-archive.20261105.7, passed fresh npm 11.19.1, Bun 1.4.4 and pnpm 12.15.0 consumers. Wrapper and native-artifact revisions are both exactly 9efe. Each locks all 34 candidate versions/integrities and installs 27 host-compatible packages. Native/Wasm, compiler/PHP, CLI, runtime/integrations, exact-cohort installer and MCP rendering/observed child-exit checks pass. npm additionally passes packed Astro/Svelte SSR/hydration, actual missing-hook rejection and Chromium startup/mutation. This is local assembled-archive evidence, not public registry evidence. Proof SHA-256: 819ddbcdfcbaf3c7e996d235073fb5f407ad6249590322dd84dbcbb9e4c51c45.
• Current site artifact: 155 pages, 16,202 links, 84 profiles (28 each Chromium/Firefox/WebKit), zero failures; LLMS 39/39, 80 CSS contracts / 2,287 exact segments, 85 public assets and the 44-CSS-asset budget passed. All 1,375 retained output files rehash to build digest 395c44f327876695e989747166a3298d79b75f26dd1aadf01357432e52f4e4ed; ZIP digest d469a9fb4034334be19da398ef59595fbad923e37751058f8b7d9e004e9f32e5 matches GitHub. Report revision is exact 9efe. sourceStatus contains only generated untracked site/.cache/, with no tracked source changes; that actual porcelain is disclosed rather than relabeled wholly clean. liveEdgeVerified=false.
• Both-publisher RC authorization passed on 9efe. Separate stable-main authorization passed on auth-only ee4d1cade, using VSCE 4.0.0 and Open VSX 1.0.2. This is existing identity evidence, not promotion of the 2.0 product to main or a public store release.
• Source defects #484–#488 are fixed and explicitly unreleased. Historical allocation failures, the 5dab stale-rule trace and f9 Windows EPERM failure remain recorded in their owning issues; historical or mixed-native evidence was not substituted for this final matrix.
• The final read-only registry inventory (2026-11-04 20:40 UTC / November 5 Asia/Taipei) still finds no 2.0.0 version among all 34 names; the same six public package metadata endpoints return 404. Public absence does not prove namespace ownership. Release and site-snapshot workflows remain disabled; no package/store publication, channel promotion, deployment or DNS/cache change occurred.

All source/native/editor validation above is complete. Actual public-registry/store correspondence, installation and legacy-listing acceptance, authorized staging/cutover/live accessibility checks, and the remaining private configuration/rollback prerequisites are still open. Publication and deployment remain held.

Assembled archive and installer evidence — 2026-11-05

Source repairs #486 (5f29e1590) and #487 (91759fce5) are included in the current candidate. The full installer suite passed 73/73 plus lint/build; actual built package-copy tests cover stable/prerelease metadata, unversioned development, explicit overrides, root/subcommand options and read-only planning.

A clean-wrapper rehearsal at 5dab0ea48 prepared all 34 public archives through the release preparation path, version 0.0.0-archive.20261105.5. Fresh npm 11.19.1, Bun 1.4.4 and pnpm 12.15.0 consumers verified exact versions/integrities, no published Master fallback, native/Wasm parity, public-PHP compiler/CLI, runtime/integration exports, installer cohort plans and MCP stdio including actual child termination. npm additionally built packed Astro/Svelte SSR fixtures with the dynamic rule and matching hydration payload, rejected a real missing-server-hook build, and verified packed browser runtime startup/mutation.

This retained proof is scoped preparation evidence: its wrapper source is clean 5dab, while its native payloads explicitly record 5f3fb77c7. It does not satisfy the new candidate's complete same-source native gate or any public-registry gate. At that historical stage, a fresh all-eight-native rehearsal was still pending; the completed same-source 9efe verification below supersedes that limitation. No older payload was relabeled. Publication, public channel/store verification and deployment remain held.

Clean same-source archive verification — 2026-11-05 (Asia/Taipei)

The frozen clean source is 9efee4d32. All eight native target jobs completed successfully. Each fresh artifact ZIP was matched to that exact workflow run/repository/source and GitHub SHA-256 digest, then checked for the exact allowed target files and manifest identity before its binary pair was staged. Current-source Wasm/public-wrapper builds also passed (32/32 package build tasks, zero Turbo task-cache hits); compiled-output hashes are retained.

A fresh local assembled-archive rehearsal prepared the complete 34-package cohort at private version 0.0.0-archive.20261105.7. The source and native-artifact revisions are both exactly 9efee4d32c4c81fd1ae8d9f1c51c467a9950860b, and the source worktree remained clean. Fresh npm 11.19.1, Bun 1.4.4 and pnpm 12.15.0 consumers verified all 34 locked candidate versions/integrities; each physically installed the 27 packages compatible with the local macOS ARM64 host. No published Master fallback or workspace link was allowed. Each passed host native/Wasm parity, stacked media, compiler/PHP sources, CLI, runtime/integration exports, exact-cohort installer dependency/MCP guidance, and MCP stdio rendering with observed child exit before cleanup.

The npm consumer additionally built the packed Astro and Svelte examples. A dynamic native opacity rule was verified in the actual parsed SSR style#master-css and matching hydration payload; the real Svelte build with its server hook removed was rejected. Packed runtime/program bytes also passed Chromium startup and DOM-mutation checks. Exact archives, SHA-512 values, native ZIP metadata/digests, rendered probe HTML/hydration payloads and JSON proof are retained. The proof SHA-256 is 819ddbcdfcbaf3c7e996d235073fb5f407ad6249590322dd84dbcbb9e4c51c45.

This supersedes the earlier mixed-native local rehearsal for this preparation item. It does not claim the entire final CI/editor/site matrix is complete, that public registry tarballs are available, or that any publication, channel promotion, public editor delivery or deployment acceptance gate has passed. Those separate results must remain explicit; publication and deployment remain held.

Historical f9 clean cohort .6 also passed (proof SHA-256 4faa7f2e5822f88e135d400d6b1aacbbf29ef752026dd460905124f42d990dc8); its main CI still exposed #488. The current .7 proof above supersedes it for this preparation item without erasing that failure.