[2.0] Verify VS Code and Open VSX launch readiness

This is a release-readiness audit, not a single change. Start with packages/figma/manifest.json and the Figma exporter behavior described in #476, then the editor publication workflow that only runs on rc (see #472). Done means the linked gates are resolved and verified: #476 fixed with behavioral tests, VSIX install checks on supported targets, and Marketplace and Open VSX versions aligned.

Parent: #467

Scope and acceptance

Verify exact VSIX identities, versions, native payloads, installation/activation, Marketplace/Open VSX authorization and public post-release installation. Packaging alone is insufficient evidence of target support.

Candidate: 9efee4d32. Publication and deployment remain on hold. These records distinguish source/assembled-artifact evidence from public-registry and deployed-product evidence.

Implemented

• Source editor version remains 2.0.37. An anonymous availability preflight rejects an occupied version on either store before npm publication; this does not reserve the version. Automatic version bumps, source commits and duplicate-skipping were removed from publication.

• Both publisher identities are packaged for eight native targets. The inventory checks source version/engines, publisher/target and exact bundled/native bytes, then records every VSIX SHA-256. Execution proofs must match the same inventory and revision.

• All six desktop targets install a real VSIX in a clean profile and exercise activation, completion, hover and restart. The two Alpine targets install those same bytes in the official pinned VS Code Server remote Node host; a loopback browser runs the same functional assertions. Native/LSP-only proofs no longer satisfy the gate.

• The minimum supported VS Code is now 1.123.0, whose official remote server uses Node 24. The old 1.120.0 server uses Node 22 and cannot parse the bundled language server. The bundle is not rewritten and a system Node is not substituted.

• Windows uses its native ZIP extractor instead of Git Bash tar; macOS launchers avoid Bash 3.2 empty-array expansion. Failure logs are retained and temporary servers/containers are cleaned up.

• A required reusable editor gate now completes before npm publication. Editor delivery downloads and revalidates the same run’s exact 16 VSIX archives and host proofs; it does not rebuild or repackage. A manual CI rehearsal with release_candidate: true exercises this gate without publishing.

Acceptance status

• Install final VSIX artifacts and pass every supported desktop/remote target.
• Verify access to the intended publisher management page and inspect CI configuration privately.
• Run a non-publishing vsce verify-pat check on the RC CI identity.
• Verify both publishers through the existing stable-branch authorization path without publishing.
• Align both public marketplaces with the final version and publisher metadata after an authorized release.
• Verify public listings and installations after an authorized release.
• Complete public legacy-listing messaging and target/migration policy before announcing readiness.

Final verification — 2026-11-05 (Asia/Taipei)

Exact committed candidate: 9efee4d32, pushed to rc. Source preparation and the complete non-publishing matrix are verified. Public stable readiness remains held by the delivery acceptance items below.

• Full release-candidate CI: SUCCESS, 33/33 jobs, attempt 1. All eight native targets, Linux quality/site/E2E, Rust, full Windows/macOS graphs, editor gate and aggregate required gate passed on this exact source. No CI or failed-test retry was needed for this final candidate.
• Packed native closure: SUCCESS, 11/11 jobs, including all eight actual native consumers and the full Windows required gate. Fresh ZIP digests, exact source/run/target identities and non-target dependency integrities were independently verified.
• Independent full Windows validation: SUCCESS. CLI 112/112, installer 73/73, ten CLI/MCP repetitions, focused Next 10/10, 59/59 package tasks with zero cache hits, and 37/37 example tasks (26 cached prerequisites; all 11 example builds executed). Actual watcher traces end with exact none-only CSS, no obsolete rules or excluded grid, successful quietness/cleanup and valid controlled registration chronology. Hosted macOS 26 also passed 59/59 uncached package tasks and 37/37 example tasks on the same revision.
• All 16 VSIX archives and 16 actual host/publisher proofs passed exact-source/version/hash/native-payload validation: version 2.0.37, both publishers, 12 desktop and four official Alpine remote host proofs. Activation, completion, hover and restart passed in real installed extension hosts; native/LSP-only checks did not substitute for installation. The source gate revalidated those same VSIX bytes, not rebuilt replacements.
• Current Rust/Wasm versus JavaScript engine differential: 0 / 200,099 differences. Runtime browser E2E 672/672 and Next E2E 11/11 passed; bundle/CDN and generated-program gates passed. No failed/flaky/retry summary was observed in the E2E log.
• The clean same-source 34-archive cohort, 0.0.0-archive.20261105.7, passed fresh npm 11.19.1, Bun 1.4.4 and pnpm 12.15.0 consumers. Wrapper and native-artifact revisions are both exactly 9efe. Each locks all 34 candidate versions/integrities and installs 27 host-compatible packages. Native/Wasm, compiler/PHP, CLI, runtime/integrations, exact-cohort installer and MCP rendering/observed child-exit checks pass. npm additionally passes packed Astro/Svelte SSR/hydration, actual missing-hook rejection and Chromium startup/mutation. This is local assembled-archive evidence, not public registry evidence. Proof SHA-256: 819ddbcdfcbaf3c7e996d235073fb5f407ad6249590322dd84dbcbb9e4c51c45.
• Current site artifact: 155 pages, 16,202 links, 84 profiles (28 each Chromium/Firefox/WebKit), zero failures; LLMS 39/39, 80 CSS contracts / 2,287 exact segments, 85 public assets and the 44-CSS-asset budget passed. All 1,375 retained output files rehash to build digest 395c44f327876695e989747166a3298d79b75f26dd1aadf01357432e52f4e4ed; ZIP digest d469a9fb4034334be19da398ef59595fbad923e37751058f8b7d9e004e9f32e5 matches GitHub. Report revision is exact 9efe. sourceStatus contains only generated untracked site/.cache/, with no tracked source changes; that actual porcelain is disclosed rather than relabeled wholly clean. liveEdgeVerified=false.
• Both-publisher RC authorization passed on 9efe. Separate stable-main authorization passed on auth-only ee4d1cade, using VSCE 4.0.0 and Open VSX 1.0.2. This is existing identity evidence, not promotion of the 2.0 product to main or a public store release.
• Source defects #484–#488 are fixed and explicitly unreleased. Historical allocation failures, the 5dab stale-rule trace and f9 Windows EPERM failure remain recorded in their owning issues; historical or mixed-native evidence was not substituted for this final matrix.
• The final read-only registry inventory (2026-11-04 20:40 UTC / November 5 Asia/Taipei) still finds no 2.0.0 version among all 34 names; the same six public package metadata endpoints return 404. Public absence does not prove namespace ownership. Release and site-snapshot workflows remain disabled; no package/store publication, channel promotion, deployment or DNS/cache change occurred.

All source/native/editor validation above is complete. Actual public-registry/store correspondence, installation and legacy-listing acceptance, authorized staging/cutover/live accessibility checks, and the remaining private configuration/rollback prerequisites are still open. Publication and deployment remain held.

Editor homepage metadata audit — 2026-11-05

The 34-public-package source audit found 20 documentation homepages: 19 resolve to the generated site root; the editor homepage alone still targeted the absent /guide/installation/language-service route, with no generated redirect. The actual guide is /guide/language-service. The correction is committed in 303c41b9f, included unchanged in candidate 9efee4d32, and passes the owning editor lint check; the complete VSIX inventory/host matrix must use that corrected metadata. No public listing was edited. Legacy-listing migration copy and omitted-target policy remain prepared in packages/vscode/RELEASE.md; their externally visible publication remains held.