[2.0] Track stable release readiness across all public products

This is a release-readiness tracker, not a single change, so there is no one entry point. Start from the linked defects (#477, #475, #476, #478, #480) and the workstream issues (#468 to #474), and pick one whose scope is narrow enough to finish. Done means that issue's failing gate passes on a clean candidate revision, with the result recorded on the tracker.

2.0.0 is public — 2026-11-06

The GitHub Release, all 34 npm stable tags and both current extension stores are live. The complete public registry, signatures, CDN, integration and editor checks passed, including the separate legacy migration notice. css.master.co, Master.co and v1.css.master.co passed their release verification. The native v1 selector preserves English and Traditional Chinese on the way to 2.0. The release tag and CSS main remain on C10 6bf9adc44.

#473 remains open for the deferred real screen-reader check. Registry-backed documentation, five-language delivery, public browsers and automated accessibility all passed.

---

npm name registration incident — 2026-11-05

The authorized registration run 41983776353 attempted only @master/css-next. npm created the exact nonstable 0.0.0-bootstrap.41977322027.1 tarball and assigned both bootstrap and latest despite the requested --tag bootstrap. The public tarball matches the original GitHub Actions artifact byte for byte, including verified Sigstore source provenance. The remaining five writes were never attempted. No 2.0.0 package, GitHub release, editor listing or site deployment resulted.

The separate scoped cleanup run 41987078212 stopped after the one tag-removal attempt; direct npm reads still showed the same tags. The operation was not retried, and no versions were unpublished. The remaining names will use npm staged name creation: verify the npm-owned 0.0.0-stage placeholder on one name before continuing, with no approval of the staged contents. Formal release and production delivery remain held.

Current verification status — 2026-11-05

441516cfe is the frozen 2.0 candidate. The complete candidate CI passed 33/33 jobs; the packed native closure passed 11/11; Windows compatibility and both-store authorization passed. Fresh same-source archives passed npm, Bun and pnpm plus all 16 default installation recipes. The six-name dry run is in progress. Actual public packages, stores, website cutover and acceptance below remain open.

The older candidate records below are retained as historical evidence.

---

The following earlier candidate evidence is historical and superseded by the current verification status above.

Decision: NOT READY for public stable 2.0

The source repairs and non-publishing verification are tracked below. Actual package promotion, public editor delivery and website cutover are conditionally authorized after the remaining readiness gates; passing source CI alone does not complete those acceptance gates.

Candidate and scope

Candidate: 9efee4d32, committed and pushed to rc. Remote checks use that committed source, excluding unrelated local edits. Scope is 36 workspaces / 34 public packages after the requested Figma removal. #476 was closed as not planned after removal; it is no longer a launch requirement.

Completed source defects

• #444 — Published rc.88 nested-media regression reproduced; current native/Wasm behavior verified and source issue closed, explicitly unreleased.
• #465 — Published PHP exclusion reproduced with a workaround; explicit public PHP-source regression verified, explicitly unreleased.
• #475 — Next publication-lock race fixed and full Windows compatibility verified.
• #477 — Build-host contamination excluded from generic native archives; real packed consumers executed on all eight native targets.
• #478 — Runtime animation validation corrected and repeated WebKit regression coverage added.
• #479 — Duplicate SVG IDs removed; original browser checks pass without baseline exemptions.
• #480 — Runtime-program verification includes custom containers and malformed-input checks.
• #481 — CLI dependency revision deduplication verified with fresh Windows regressions.
• #482 — MCP canonical-path/junction assertions verified on Windows without changing containment behavior.
• #484 — Vite lifecycle ordering and fresh Windows package/example validation completed.
• #485 — Missing-source watcher registration, filesystem identity and physical-publication reporting verified on fresh Windows, explicitly unreleased.
• #486 — Explicit installer subcommand options and read-only planning repaired, explicitly unreleased.
• #487 — Installer defaults follow its installed package cohort version, explicitly unreleased.
• #488 — Bounded Windows atomic entry/journal rename recovery verified on fresh Windows and hosted macOS, explicitly unreleased.

Final verification — 2026-11-05 (Asia/Taipei)

Exact committed candidate: 9efee4d32, pushed to rc. Source preparation and the complete non-publishing matrix are verified. Public stable readiness remains held by the delivery acceptance items below.

• Full release-candidate CI: SUCCESS, 33/33 jobs, attempt 1. All eight native targets, Linux quality/site/E2E, Rust, full Windows/macOS graphs, editor gate and aggregate required gate passed on this exact source. No CI or failed-test retry was needed for this final candidate.
• Packed native closure: SUCCESS, 11/11 jobs, including all eight actual native consumers and the full Windows required gate. Fresh ZIP digests, exact source/run/target identities and non-target dependency integrities were independently verified.
• Independent full Windows validation: SUCCESS. CLI 112/112, installer 73/73, ten CLI/MCP repetitions, focused Next 10/10, 59/59 package tasks with zero cache hits, and 37/37 example tasks (26 cached prerequisites; all 11 example builds executed). Actual watcher traces end with exact none-only CSS, no obsolete rules or excluded grid, successful quietness/cleanup and valid controlled registration chronology. Hosted macOS 26 also passed 59/59 uncached package tasks and 37/37 example tasks on the same revision.
• All 16 VSIX archives and 16 actual host/publisher proofs passed exact-source/version/hash/native-payload validation: version 2.0.37, both publishers, 12 desktop and four official Alpine remote host proofs. Activation, completion, hover and restart passed in real installed extension hosts; native/LSP-only checks did not substitute for installation. The source gate revalidated those same VSIX bytes, not rebuilt replacements.
• Current Rust/Wasm versus JavaScript engine differential: 0 / 200,099 differences. Runtime browser E2E 672/672 and Next E2E 11/11 passed; bundle/CDN and generated-program gates passed. No failed/flaky/retry summary was observed in the E2E log.
• The clean same-source 34-archive cohort, 0.0.0-archive.20261105.7, passed fresh npm 11.19.1, Bun 1.4.4 and pnpm 12.15.0 consumers. Wrapper and native-artifact revisions are both exactly 9efe. Each locks all 34 candidate versions/integrities and installs 27 host-compatible packages. Native/Wasm, compiler/PHP, CLI, runtime/integrations, exact-cohort installer and MCP rendering/observed child-exit checks pass. npm additionally passes packed Astro/Svelte SSR/hydration, actual missing-hook rejection and Chromium startup/mutation. This is local assembled-archive evidence, not public registry evidence. Proof SHA-256: 819ddbcdfcbaf3c7e996d235073fb5f407ad6249590322dd84dbcbb9e4c51c45.
• Current site artifact: 155 pages, 16,202 links, 84 profiles (28 each Chromium/Firefox/WebKit), zero failures; LLMS 39/39, 80 CSS contracts / 2,287 exact segments, 85 public assets and the 44-CSS-asset budget passed. All 1,375 retained output files rehash to build digest 395c44f327876695e989747166a3298d79b75f26dd1aadf01357432e52f4e4ed; ZIP digest d469a9fb4034334be19da398ef59595fbad923e37751058f8b7d9e004e9f32e5 matches GitHub. Report revision is exact 9efe. sourceStatus contains only generated untracked site/.cache/, with no tracked source changes; that actual porcelain is disclosed rather than relabeled wholly clean. liveEdgeVerified=false.
• Both-publisher RC authorization passed on 9efe. Separate stable-main authorization passed on auth-only ee4d1cade, using VSCE 4.0.0 and Open VSX 1.0.2. This is existing identity evidence, not promotion of the 2.0 product to main or a public store release.
• Source defects #484–#488 are fixed and explicitly unreleased. Historical allocation failures, the 5dab stale-rule trace and f9 Windows EPERM failure remain recorded in their owning issues; historical or mixed-native evidence was not substituted for this final matrix.
• The final read-only registry inventory (2026-11-04 20:40 UTC / November 5 Asia/Taipei) still finds no 2.0.0 version among all 34 names; the same six public package metadata endpoints return 404. Public absence does not prove namespace ownership. Release and site-snapshot workflows remain disabled; no package/store publication, channel promotion, deployment or DNS/cache change occurred.

All source/native/editor validation above is complete. Actual public-registry/store correspondence, installation and legacy-listing acceptance, authorized staging/cutover/live accessibility checks, and the remaining private configuration/rollback prerequisites are still open. Publication and deployment remain held.

The editor candidate intentionally raises the minimum supported VS Code to 1.123.0, matching the official Node 24 remote host. Both publisher identities require all eight native targets, including actual desktop or official Alpine remote activation/completion/hover/restart. Release validation now requires the same-run editor proofs, and publication uploads those exact verified VSIX bytes without rebuilding.

Publication recovery stages and checks a complete npm cohort before formal tags change, preserves original archives and operation state, and fails closed on immutable conflicts. The rehearsal is not evidence that a registry publication occurred. Website delivery has explicit stable/RC origins, exact-commit output and a cutover/rollback runbook; live deployment remains unverified.

Remaining workstreams

• #468 — Final published-version reconciliation for core/runtime fixes.
• #469 — Registry-backed documented framework/tooling installation after coherent staging.
• #470 — Public package availability, provenance, exact published artifacts and channel promotion.
• #471 — Final same-source matrix completed; correspondence to actual published artifacts remains open.
• #472 — Authorized staging/cutover and actual edge/domain checks; complete recovery baseline retained privately, final delivery authorization/worksheet fields pending.
• #473 — Final registry-backed release guidance and deployed accessibility/browser verification.
• #474 — Public store versions/installations and legacy-listing migration; final VSIX host matrix and stable identity are verified.

See each workstream for completed preparation and its remaining acceptance criteria. The open boxes are deliberate; publication/deployment-dependent conditions were not waived to close issues.

Release sequence and hold

1. Retain complete same-revision verification and exact archives/build output.
2. Confirm remaining private publisher/deployment prerequisites and authorize release separately.
3. Stage the coherent package cohort, verify signatures/provenance and isolated registry consumers, then promote the approved channels with recoverable state.
4. Deliver verified editor artifacts and the approved exact website output; verify real public installation, routing/assets/origins/search and rollback evidence.
5. Close the remaining release gates and announce only after public-path checks pass.

Release and snapshot publication workflows remain disabled, and automatic hosting builds/deployments remain held. Configuration and offline recovery preparation are authorized; publication and deployment remain prohibited. Account credentials, identities, deployment hooks and private infrastructure records are excluded from this public tracker.

Earlier audit and remediation notes are superseded by this current candidate summary; their issue history and linked defect evidence remain available.

Assembled archive and installer evidence — 2026-11-05

Source repairs #486 (5f29e1590) and #487 (91759fce5) are included in the current candidate. The full installer suite passed 73/73 plus lint/build; actual built package-copy tests cover stable/prerelease metadata, unversioned development, explicit overrides, root/subcommand options and read-only planning.

A clean-wrapper rehearsal at 5dab0ea48 prepared all 34 public archives through the release preparation path, version 0.0.0-archive.20261105.5. Fresh npm 11.19.1, Bun 1.4.4 and pnpm 12.15.0 consumers verified exact versions/integrities, no published Master fallback, native/Wasm parity, public-PHP compiler/CLI, runtime/integration exports, installer cohort plans and MCP stdio including actual child termination. npm additionally built packed Astro/Svelte SSR fixtures with the dynamic rule and matching hydration payload, rejected a real missing-server-hook build, and verified packed browser runtime startup/mutation.

This retained proof is scoped preparation evidence: its wrapper source is clean 5dab, while its native payloads explicitly record 5f3fb77c7. It does not satisfy the new candidate's complete same-source native gate or any public-registry gate. At that historical stage, a fresh all-eight-native rehearsal was still pending; the completed same-source 9efe verification below supersedes that limitation. No older payload was relabeled. Publication, public channel/store verification and deployment remain held.

Clean same-source archive verification — 2026-11-05 (Asia/Taipei)

The frozen clean source is 9efee4d32. All eight native target jobs completed successfully. Each fresh artifact ZIP was matched to that exact workflow run/repository/source and GitHub SHA-256 digest, then checked for the exact allowed target files and manifest identity before its binary pair was staged. Current-source Wasm/public-wrapper builds also passed (32/32 package build tasks, zero Turbo task-cache hits); compiled-output hashes are retained.

A fresh local assembled-archive rehearsal prepared the complete 34-package cohort at private version 0.0.0-archive.20261105.7. The source and native-artifact revisions are both exactly 9efee4d32c4c81fd1ae8d9f1c51c467a9950860b, and the source worktree remained clean. Fresh npm 11.19.1, Bun 1.4.4 and pnpm 12.15.0 consumers verified all 34 locked candidate versions/integrities; each physically installed the 27 packages compatible with the local macOS ARM64 host. No published Master fallback or workspace link was allowed. Each passed host native/Wasm parity, stacked media, compiler/PHP sources, CLI, runtime/integration exports, exact-cohort installer dependency/MCP guidance, and MCP stdio rendering with observed child exit before cleanup.

The npm consumer additionally built the packed Astro and Svelte examples. A dynamic native opacity rule was verified in the actual parsed SSR style#master-css and matching hydration payload; the real Svelte build with its server hook removed was rejected. Packed runtime/program bytes also passed Chromium startup and DOM-mutation checks. Exact archives, SHA-512 values, native ZIP metadata/digests, rendered probe HTML/hydration payloads and JSON proof are retained. The proof SHA-256 is 819ddbcdfcbaf3c7e996d235073fb5f407ad6249590322dd84dbcbb9e4c51c45.

This supersedes the earlier mixed-native local rehearsal for this preparation item. It does not claim the entire final CI/editor/site matrix is complete, that public registry tarballs are available, or that any publication, channel promotion, public editor delivery or deployment acceptance gate has passed. Those separate results must remain explicit; publication and deployment remain held.

Historical f9 clean cohort .6 also passed (proof SHA-256 4faa7f2e5822f88e135d400d6b1aacbbf29ef752026dd460905124f42d990dc8); its main CI still exposed #488. The current .7 proof above supersedes it for this preparation item without erasing that failure.

Cloudflare configuration and recovery preparation — 2026-11-05 (Asia/Taipei)

• Configure a separate empty stable Pages target with the intended production branch. Read-back confirms zero deployments, no Git build source and no custom-domain binding; existing stable/v1 and RC production deployment identities and domains are unchanged.
• Configure the repository account secret and both stable/RC project variables. Their private values are excluded here. The scoped CI API token is still pending creation and read-only verification; existing local OAuth authorization was not copied into CI.
• Pass the existing RC target/branch/canonical-domain guard read-only using local authorization. The stable guard correctly rejects the empty target while the canonical domain still belongs to v1; it was not weakened to bypass the deployment hold.
• Close an automatic-deployment hold gap: production deployments were disabled, but preview branches were still enabled. Preview deployments are now disabled too. API read-back confirms unchanged source identity, production branch, domains, canonical deployment and retained deployment-list page. The RC Worker build hold and both publication-workflow holds remain in effect.
• Retain a complete previous-production recovery archive and manifests privately: all 2,379 content assets match the existing immutable deployment byte-for-byte, and both control files match the recorded Pages baseline. SHA-256/length verification and two actual offline extraction/rehash drills pass for all 2,381 files. An independent read-only review rehashed the archive, every entry and every retained HTTP response body.
• Retain the exact deployment's provider-reported full Git commit metadata and confirm that it matches clean preserved source. This is provider-declared source metadata, not a cryptographic source-to-build attestation or reproducible-build claim; no original provider upload manifest was exported.

The private operator record now contains the recovery target, source receipt, archive/content digests, restoration instructions, existing DNS/proxy/cache/redirect/header/Worker-route baseline, and the separate-project bootstrap/rollback sequence. Initial v1-to-v2 recovery requires restoring the old project/domain mapping; an in-project rollback in the new stable project cannot select a deployment from the old project.

Remaining: scoped CI token and its actual read-only target check; the separately approved stable candidate/deployment/version, release operator, rollback decision owner and cutover authorization/time; registry/store delivery and actual live staging/cutover/browser/accessibility verification. The stable canonical-domain guard remains expected to fail until a future authorized, verified bootstrap and domain cutover. No package/store publication, content deployment, domain/DNS/cache/routing change, workflow enablement or edge rollback occurred. The empty project and preview-build hold are configuration-only changes.

Conditional stable release authorization — 2026-11-05 (Asia/Taipei)

The maintainer now authorizes complete 2.0 publication and deployment after the release issues and the ongoing five-language local-MDX translation/review work are complete. Preparation continues; no publication or deployment has occurred. The previously verified 9efe matrix remains evidence for that revision only. The new documentation/delivery integration requires a newly frozen candidate and complete same-source validation before publication.

• The v1 version selector is prepared and locally verified in English and Traditional Chinese, including keyboard/browser navigation, preservation of /tw, and recovery-safe image origins. Its new static output is retained separately from the unchanged previous-production recovery archive. Public v1 delivery and public 2.0 switching are still pending.
• Delivery is being adapted to the existing Cloudflare GitHub App. A successful release will advance a dedicated delivery ref to the verified commit; the hosting build must match the retained release's complete file manifest before succeeding. The earlier proposed Cloudflare API token was not created; direct-upload API-token configuration is no longer the selected path.
• Stable installation/package documentation is being reconciled with the intended channel and exact release version. The current RC text must not silently become the stable installation path. Page, search and portable export examples must agree across all five languages.
• Six new public package names still require first-publication/bootstrap identity and Trusted Publisher preparation. Browser login does not establish CLI publication credentials; normal release publication remains OIDC-only. Bootstrap preparation does not waive provenance or final cohort checks.

Actual registry/store delivery, matching public consumer verification, stable domain cutover and live accessibility/browser checks remain the final acceptance gates. Hosting and release-workflow holds remain in place while these prerequisites are completed.