[2.0] Establish complete candidate CI and release validation evidence

This is a release-readiness audit tracker, not a code change. Start with validation.yml to see which site checks run, then the linked failing runs and #475 for the Windows failure. Done means the frozen candidate has full matrix evidence and every checklist item above is resolved or explicitly deferred by maintainers.

Parent: #467

Scope and acceptance

Obtain matching full validation evidence for Linux, macOS, Windows, browsers and native artifacts on one candidate. Keep failed checks, historical SHAs, cached builds and unverified public artifacts distinct.

Candidate: 9efee4d32. Publication and deployment remain on hold. These records distinguish source/assembled-artifact evidence from public-registry and deployed-product evidence.

Implemented validation gates

• Full manual validation selects every package, site and editor check even when base and head are equal. Editor publication selection remains independent; native/shared inputs are included and query failures stop the workflow.
• Linux checks package tests/lint/types, Rust/browser differential, runtime/program size, all built artifact surfaces, authored docs, CSS/style contracts and Chromium/Firefox/WebKit site behavior.
• Windows and macOS each run the complete package-test graph and framework example builds. Rust quality/codegen/parity and all eight native targets remain required.
• Read-only verification installs release-prepared native closures. Full candidate CI and affected release validation now require the reusable editor gate in the same workflow run; publication revalidates and uploads those exact VSIX bytes without rebuilding. Final editor proofs require six desktop and two official Alpine remote hosts, both publishers.
• The exact static site output and its digest/report are retained; E2E failure/retry diagnostics are also retained.

Historical findings resolved

#475, #481 and #482 are closed. The complete first verification round at 30d755550 passed all CI jobs and all eight packed consumers; one WebKit startup test passed on retry. That test now polls hidden streaming startup independently of animation frames, without changing its deadline or assertions. Windows/macOS editor-harness failures from the first round were repaired; the final round must verify those fixes and the corrected VS Code minimum.

Acceptance status

• Fix the original Windows/CLI/MCP blockers and require the complete validation gates.
• Add runtime size, program/differential, authored-document, CSS-contract, postbuild and browser checks where applicable.
• Complete the final same-SHA matrix, with no historical evidence substituted.
• Verify published artifacts correspond to that same source and generated-program version (#470).

Final verification — 2026-11-05 (Asia/Taipei)

Exact committed candidate: 9efee4d32, pushed to rc. Source preparation and the complete non-publishing matrix are verified. Public stable readiness remains held by the delivery acceptance items below.

• Full release-candidate CI: SUCCESS, 33/33 jobs, attempt 1. All eight native targets, Linux quality/site/E2E, Rust, full Windows/macOS graphs, editor gate and aggregate required gate passed on this exact source. No CI or failed-test retry was needed for this final candidate.
• Packed native closure: SUCCESS, 11/11 jobs, including all eight actual native consumers and the full Windows required gate. Fresh ZIP digests, exact source/run/target identities and non-target dependency integrities were independently verified.
• Independent full Windows validation: SUCCESS. CLI 112/112, installer 73/73, ten CLI/MCP repetitions, focused Next 10/10, 59/59 package tasks with zero cache hits, and 37/37 example tasks (26 cached prerequisites; all 11 example builds executed). Actual watcher traces end with exact none-only CSS, no obsolete rules or excluded grid, successful quietness/cleanup and valid controlled registration chronology. Hosted macOS 26 also passed 59/59 uncached package tasks and 37/37 example tasks on the same revision.
• All 16 VSIX archives and 16 actual host/publisher proofs passed exact-source/version/hash/native-payload validation: version 2.0.37, both publishers, 12 desktop and four official Alpine remote host proofs. Activation, completion, hover and restart passed in real installed extension hosts; native/LSP-only checks did not substitute for installation. The source gate revalidated those same VSIX bytes, not rebuilt replacements.
• Current Rust/Wasm versus JavaScript engine differential: 0 / 200,099 differences. Runtime browser E2E 672/672 and Next E2E 11/11 passed; bundle/CDN and generated-program gates passed. No failed/flaky/retry summary was observed in the E2E log.
• The clean same-source 34-archive cohort, 0.0.0-archive.20261105.7, passed fresh npm 11.19.1, Bun 1.4.4 and pnpm 12.15.0 consumers. Wrapper and native-artifact revisions are both exactly 9efe. Each locks all 34 candidate versions/integrities and installs 27 host-compatible packages. Native/Wasm, compiler/PHP, CLI, runtime/integrations, exact-cohort installer and MCP rendering/observed child-exit checks pass. npm additionally passes packed Astro/Svelte SSR/hydration, actual missing-hook rejection and Chromium startup/mutation. This is local assembled-archive evidence, not public registry evidence. Proof SHA-256: 819ddbcdfcbaf3c7e996d235073fb5f407ad6249590322dd84dbcbb9e4c51c45.
• Current site artifact: 155 pages, 16,202 links, 84 profiles (28 each Chromium/Firefox/WebKit), zero failures; LLMS 39/39, 80 CSS contracts / 2,287 exact segments, 85 public assets and the 44-CSS-asset budget passed. All 1,375 retained output files rehash to build digest 395c44f327876695e989747166a3298d79b75f26dd1aadf01357432e52f4e4ed; ZIP digest d469a9fb4034334be19da398ef59595fbad923e37751058f8b7d9e004e9f32e5 matches GitHub. Report revision is exact 9efe. sourceStatus contains only generated untracked site/.cache/, with no tracked source changes; that actual porcelain is disclosed rather than relabeled wholly clean. liveEdgeVerified=false.
• Both-publisher RC authorization passed on 9efe. Separate stable-main authorization passed on auth-only ee4d1cade, using VSCE 4.0.0 and Open VSX 1.0.2. This is existing identity evidence, not promotion of the 2.0 product to main or a public store release.
• Source defects #484–#488 are fixed and explicitly unreleased. Historical allocation failures, the 5dab stale-rule trace and f9 Windows EPERM failure remain recorded in their owning issues; historical or mixed-native evidence was not substituted for this final matrix.
• The final read-only registry inventory (2026-11-04 20:40 UTC / November 5 Asia/Taipei) still finds no 2.0.0 version among all 34 names; the same six public package metadata endpoints return 404. Public absence does not prove namespace ownership. Release and site-snapshot workflows remain disabled; no package/store publication, channel promotion, deployment or DNS/cache change occurred.

All source/native/editor validation above is complete. Actual public-registry/store correspondence, installation and legacy-listing acceptance, authorized staging/cutover/live accessibility checks, and the remaining private configuration/rollback prerequisites are still open. Publication and deployment remain held.

Assembled archive and installer evidence — 2026-11-05

Source repairs #486 (5f29e1590) and #487 (91759fce5) are included in the current candidate. The full installer suite passed 73/73 plus lint/build; actual built package-copy tests cover stable/prerelease metadata, unversioned development, explicit overrides, root/subcommand options and read-only planning.

A clean-wrapper rehearsal at 5dab0ea48 prepared all 34 public archives through the release preparation path, version 0.0.0-archive.20261105.5. Fresh npm 11.19.1, Bun 1.4.4 and pnpm 12.15.0 consumers verified exact versions/integrities, no published Master fallback, native/Wasm parity, public-PHP compiler/CLI, runtime/integration exports, installer cohort plans and MCP stdio including actual child termination. npm additionally built packed Astro/Svelte SSR fixtures with the dynamic rule and matching hydration payload, rejected a real missing-server-hook build, and verified packed browser runtime startup/mutation.

This retained proof is scoped preparation evidence: its wrapper source is clean 5dab, while its native payloads explicitly record 5f3fb77c7. It does not satisfy the new candidate's complete same-source native gate or any public-registry gate. At that historical stage, a fresh all-eight-native rehearsal was still pending; the completed same-source 9efe verification below supersedes that limitation. No older payload was relabeled. Publication, public channel/store verification and deployment remain held.

Clean same-source archive verification — 2026-11-05 (Asia/Taipei)

The frozen clean source is 9efee4d32. All eight native target jobs completed successfully. Each fresh artifact ZIP was matched to that exact workflow run/repository/source and GitHub SHA-256 digest, then checked for the exact allowed target files and manifest identity before its binary pair was staged. Current-source Wasm/public-wrapper builds also passed (32/32 package build tasks, zero Turbo task-cache hits); compiled-output hashes are retained.

A fresh local assembled-archive rehearsal prepared the complete 34-package cohort at private version 0.0.0-archive.20261105.7. The source and native-artifact revisions are both exactly 9efee4d32c4c81fd1ae8d9f1c51c467a9950860b, and the source worktree remained clean. Fresh npm 11.19.1, Bun 1.4.4 and pnpm 12.15.0 consumers verified all 34 locked candidate versions/integrities; each physically installed the 27 packages compatible with the local macOS ARM64 host. No published Master fallback or workspace link was allowed. Each passed host native/Wasm parity, stacked media, compiler/PHP sources, CLI, runtime/integration exports, exact-cohort installer dependency/MCP guidance, and MCP stdio rendering with observed child exit before cleanup.

The npm consumer additionally built the packed Astro and Svelte examples. A dynamic native opacity rule was verified in the actual parsed SSR style#master-css and matching hydration payload; the real Svelte build with its server hook removed was rejected. Packed runtime/program bytes also passed Chromium startup and DOM-mutation checks. Exact archives, SHA-512 values, native ZIP metadata/digests, rendered probe HTML/hydration payloads and JSON proof are retained. The proof SHA-256 is 819ddbcdfcbaf3c7e996d235073fb5f407ad6249590322dd84dbcbb9e4c51c45.

This supersedes the earlier mixed-native local rehearsal for this preparation item. It does not claim the entire final CI/editor/site matrix is complete, that public registry tarballs are available, or that any publication, channel promotion, public editor delivery or deployment acceptance gate has passed. Those separate results must remain explicit; publication and deployment remain held.

Historical f9 clean cohort .6 also passed (proof SHA-256 4faa7f2e5822f88e135d400d6b1aacbbf29ef752026dd460905124f42d990dc8); its main CI still exposed #488. The current .7 proof above supersedes it for this preparation item without erasing that failure.