[2.0] Validate integrations, CLI, MCP and language tooling

This is a release-audit tracker rather than a single fix: the open blocker is the Next.js publication-lock race in #475, observed on Windows CI, and the PHP extraction report #465 needs triage. Start with the framework example builds, the Next.js E2E suite and the packed-consumer smoke checks described in the body. Done means the Windows failure in #475 is fixed and verified, plus the remaining release gates are checked off.

Parent: #467

Scope and acceptance

Verify framework adapters, production examples and HMR, CLI/project loading, MCP, language services and ESLint against their public contracts. Exercise documented installs using coherent public packages before declaring release readiness.

Candidate: 9efee4d32. Publication and deployment remain on hold. Source/assembled-artifact evidence is distinct from public registry and deployed-product evidence.

Repairs and evidence

• #475 fixes the Next publication-lock race. #481 deduplicates successfully completed CLI dependency revisions while preserving genuine edits and recovery. #482 verifies MCP canonical source identity and junction containment. All three issues are closed with fresh Windows regression and full-suite evidence.
• #465 was reproduced against the published package with a documented workaround; the candidate regression exercises explicit public PHP sources through native/Wasm compilation. The source issue is closed, explicitly unreleased.
• Frozen-source validation includes package lint/types/tests, the complete framework example graph on Linux/macOS/Windows, and Next browser E2E. Passing supported fixtures does not certify every downstream framework configuration.
• Release-prepared native closures are installed and executed on all eight native targets, with source/version/SHA-512 matching. Registry-only consumers remain a separate post-staging gate.

Acceptance status

• Fix #475/#481/#482 and establish complete Windows compatibility evidence.
• Triage #465 against published behavior and add the current public-source regression.
• Verify final supported framework fixtures, package graph and exact release-prepared artifacts on one candidate.
• Run the documented installation/framework commands against the coherent registry cohort after authorized staging (#470).

Final verification — 2026-11-05 (Asia/Taipei)

Exact committed candidate: 9efee4d32, pushed to rc. Source preparation and the complete non-publishing matrix are verified. Public stable readiness remains held by the delivery acceptance items below.

• Full release-candidate CI: SUCCESS, 33/33 jobs, attempt 1. All eight native targets, Linux quality/site/E2E, Rust, full Windows/macOS graphs, editor gate and aggregate required gate passed on this exact source. No CI or failed-test retry was needed for this final candidate.
• Packed native closure: SUCCESS, 11/11 jobs, including all eight actual native consumers and the full Windows required gate. Fresh ZIP digests, exact source/run/target identities and non-target dependency integrities were independently verified.
• Independent full Windows validation: SUCCESS. CLI 112/112, installer 73/73, ten CLI/MCP repetitions, focused Next 10/10, 59/59 package tasks with zero cache hits, and 37/37 example tasks (26 cached prerequisites; all 11 example builds executed). Actual watcher traces end with exact none-only CSS, no obsolete rules or excluded grid, successful quietness/cleanup and valid controlled registration chronology. Hosted macOS 26 also passed 59/59 uncached package tasks and 37/37 example tasks on the same revision.
• All 16 VSIX archives and 16 actual host/publisher proofs passed exact-source/version/hash/native-payload validation: version 2.0.37, both publishers, 12 desktop and four official Alpine remote host proofs. Activation, completion, hover and restart passed in real installed extension hosts; native/LSP-only checks did not substitute for installation. The source gate revalidated those same VSIX bytes, not rebuilt replacements.
• Current Rust/Wasm versus JavaScript engine differential: 0 / 200,099 differences. Runtime browser E2E 672/672 and Next E2E 11/11 passed; bundle/CDN and generated-program gates passed. No failed/flaky/retry summary was observed in the E2E log.
• The clean same-source 34-archive cohort, 0.0.0-archive.20261105.7, passed fresh npm 11.19.1, Bun 1.4.4 and pnpm 12.15.0 consumers. Wrapper and native-artifact revisions are both exactly 9efe. Each locks all 34 candidate versions/integrities and installs 27 host-compatible packages. Native/Wasm, compiler/PHP, CLI, runtime/integrations, exact-cohort installer and MCP rendering/observed child-exit checks pass. npm additionally passes packed Astro/Svelte SSR/hydration, actual missing-hook rejection and Chromium startup/mutation. This is local assembled-archive evidence, not public registry evidence. Proof SHA-256: 819ddbcdfcbaf3c7e996d235073fb5f407ad6249590322dd84dbcbb9e4c51c45.
• Current site artifact: 155 pages, 16,202 links, 84 profiles (28 each Chromium/Firefox/WebKit), zero failures; LLMS 39/39, 80 CSS contracts / 2,287 exact segments, 85 public assets and the 44-CSS-asset budget passed. All 1,375 retained output files rehash to build digest 395c44f327876695e989747166a3298d79b75f26dd1aadf01357432e52f4e4ed; ZIP digest d469a9fb4034334be19da398ef59595fbad923e37751058f8b7d9e004e9f32e5 matches GitHub. Report revision is exact 9efe. sourceStatus contains only generated untracked site/.cache/, with no tracked source changes; that actual porcelain is disclosed rather than relabeled wholly clean. liveEdgeVerified=false.
• Both-publisher RC authorization passed on 9efe. Separate stable-main authorization passed on auth-only ee4d1cade, using VSCE 4.0.0 and Open VSX 1.0.2. This is existing identity evidence, not promotion of the 2.0 product to main or a public store release.
• Source defects #484–#488 are fixed and explicitly unreleased. Historical allocation failures, the 5dab stale-rule trace and f9 Windows EPERM failure remain recorded in their owning issues; historical or mixed-native evidence was not substituted for this final matrix.
• The final read-only registry inventory (2026-11-04 20:40 UTC / November 5 Asia/Taipei) still finds no 2.0.0 version among all 34 names; the same six public package metadata endpoints return 404. Public absence does not prove namespace ownership. Release and site-snapshot workflows remain disabled; no package/store publication, channel promotion, deployment or DNS/cache change occurred.

All source/native/editor validation above is complete. Actual public-registry/store correspondence, installation and legacy-listing acceptance, authorized staging/cutover/live accessibility checks, and the remaining private configuration/rollback prerequisites are still open. Publication and deployment remain held.

Assembled archive and installer evidence — 2026-11-05

Source repairs #486 (5f29e1590) and #487 (91759fce5) are included in the current candidate. The full installer suite passed 73/73 plus lint/build; actual built package-copy tests cover stable/prerelease metadata, unversioned development, explicit overrides, root/subcommand options and read-only planning.

A clean-wrapper rehearsal at 5dab0ea48 prepared all 34 public archives through the release preparation path, version 0.0.0-archive.20261105.5. Fresh npm 11.19.1, Bun 1.4.4 and pnpm 12.15.0 consumers verified exact versions/integrities, no published Master fallback, native/Wasm parity, public-PHP compiler/CLI, runtime/integration exports, installer cohort plans and MCP stdio including actual child termination. npm additionally built packed Astro/Svelte SSR fixtures with the dynamic rule and matching hydration payload, rejected a real missing-server-hook build, and verified packed browser runtime startup/mutation.

This retained proof is scoped preparation evidence: its wrapper source is clean 5dab, while its native payloads explicitly record 5f3fb77c7. It does not satisfy the new candidate's complete same-source native gate or any public-registry gate. At that historical stage, a fresh all-eight-native rehearsal was still pending; the completed same-source 9efe verification below supersedes that limitation. No older payload was relabeled. Publication, public channel/store verification and deployment remain held.

Clean same-source archive verification — 2026-11-05 (Asia/Taipei)

The frozen clean source is 9efee4d32. All eight native target jobs completed successfully. Each fresh artifact ZIP was matched to that exact workflow run/repository/source and GitHub SHA-256 digest, then checked for the exact allowed target files and manifest identity before its binary pair was staged. Current-source Wasm/public-wrapper builds also passed (32/32 package build tasks, zero Turbo task-cache hits); compiled-output hashes are retained.

A fresh local assembled-archive rehearsal prepared the complete 34-package cohort at private version 0.0.0-archive.20261105.7. The source and native-artifact revisions are both exactly 9efee4d32c4c81fd1ae8d9f1c51c467a9950860b, and the source worktree remained clean. Fresh npm 11.19.1, Bun 1.4.4 and pnpm 12.15.0 consumers verified all 34 locked candidate versions/integrities; each physically installed the 27 packages compatible with the local macOS ARM64 host. No published Master fallback or workspace link was allowed. Each passed host native/Wasm parity, stacked media, compiler/PHP sources, CLI, runtime/integration exports, exact-cohort installer dependency/MCP guidance, and MCP stdio rendering with observed child exit before cleanup.

The npm consumer additionally built the packed Astro and Svelte examples. A dynamic native opacity rule was verified in the actual parsed SSR style#master-css and matching hydration payload; the real Svelte build with its server hook removed was rejected. Packed runtime/program bytes also passed Chromium startup and DOM-mutation checks. Exact archives, SHA-512 values, native ZIP metadata/digests, rendered probe HTML/hydration payloads and JSON proof are retained. The proof SHA-256 is 819ddbcdfcbaf3c7e996d235073fb5f407ad6249590322dd84dbcbb9e4c51c45.

This supersedes the earlier mixed-native local rehearsal for this preparation item. It does not claim the entire final CI/editor/site matrix is complete, that public registry tarballs are available, or that any publication, channel promotion, public editor delivery or deployment acceptance gate has passed. Those separate results must remain explicit; publication and deployment remain held.

Historical f9 clean cohort .6 also passed (proof SHA-256 4faa7f2e5822f88e135d400d6b1aacbbf29ef752026dd460905124f42d990dc8); its main CI still exposed #488. The current .7 proof above supersedes it for this preparation item without erasing that failure.