release: 0.19.0

.github/workflows/browser-runtime-pin.yml

@@ -25,5 +25,7 @@ jobs:
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 22
+      # The check parses its upstream answers with zod.
+      - run: npm ci --ignore-scripts --no-audit
       - name: the runtime pin is current
         run: node scripts/check-browser-runtime-pin.mjs

.github/workflows/build.yml

@@ -91,7 +91,7 @@ jobs:
           - name: unit lint
             gates: 'lint:js:unit'
           - name: build
-            gates: 'typecheck check:badges check:tokens check:l10n check:reference check:host-api check:plan check:roadmap check:catches check:usable-reply check:wrap-up-request check:no-output-cap check:no-round-cap deadcode cycles duplication build security:audit'
+            gates: 'typecheck check:badges check:tokens check:l10n check:reference check:host-api check:plan check:roadmap check:catches check:usable-reply check:wrap-up-request check:no-output-cap check:no-round-cap check:workflow-scripts deadcode cycles duplication build security:audit'
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.github/workflows/release.yml

@@ -69,6 +69,13 @@ jobs:
             echo "::error::tag ${GITHUB_REF_NAME} points at ${GITHUB_SHA}, which is not on main" >&2
             exit 1
           fi
+      # The pin check parses its upstream answers with zod, so the
+      # dependencies are installed first (scripts/check-workflow-scripts.mjs
+      # holds every job to that).
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 22
+      - run: npm ci --ignore-scripts --no-audit
       # M81 A1: never ship an expired browser check runtime pin, or one more
       # than 14 days behind the newest Stable (design spec v4 §4.2).
       - name: the browser check runtime pin is current
@@ -213,6 +220,15 @@ jobs:
           path: reused/*.cdx.json
           if-no-files-found: error
           retention-days: 30
+      # The receipt travels with them, so a recovery from this run checks
+      # the same per-asset hashes (release-reuse.mjs findRecovery).
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        if: steps.check.outputs.reused == 'true' && steps.lookup.outputs.legacy-recovery != 'true'
+        with:
+          name: source-tree-${{ steps.lookup.outputs.tree }}
+          path: reused/release-build.json
+          if-no-files-found: error
+          retention-days: 30
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: steps.check.outputs.reused == 'true' && hashFiles('reused-helpers/x64/**') != ''
         with:
@@ -341,18 +357,40 @@ jobs:
               staged=1
             fi
           done
+          # Every VSIX (the universal one and the six targets) carries the
+          # Linux voice bundle. Its dist/voiceLinux.js is only a loader: the
+          # code is that member of the VSIX's runtime archive.
+          voice_linux() {
+            unzip -p "$1" extension/dist/runtime.bundles.json.br > release/runtime.bundles.json.br
+            node scripts/runtime-archive-member.mjs release/runtime.bundles.json.br voiceLinux.js > release/voiceLinux.js
+            rm release/runtime.bundles.json.br
+          }
+          shopt -s nullglob
+          vsixes=(release/*.vsix)
+          if [ "${#vsixes[@]}" -eq 0 ]; then
+            echo '::error::no VSIX to check the helper pins of' >&2
+            exit 1
+          fi
           if [ "$staged" = 1 ]; then
             # The tagged source carries unset pins by design; measure the
             # staged helpers (and this tag) into the checker's own copy so
-            # it verifies the VSIX against real bytes, not empty pins.
+            # it verifies each VSIX against real bytes, not empty pins.
             node scripts/build-linux-helper-pins.mjs helpers/x64 helpers/arm64
-            unzip -p release/*.vsix extension/dist/voiceLinux.js > release/voiceLinux.js
-            node scripts/check-linux-helper-pins.mjs --bundle release/voiceLinux.js --assets release/helpers
-            rm release/voiceLinux.js
-          elif unzip -p release/*.vsix extension/dist/voiceLinux.js | grep -q 'linux-x64-muse-dictate'; then
-            echo '::error::this VSIX pins helper assets but none were staged' >&2
-            exit 1
+            for vsix in "${vsixes[@]}"; do
+              voice_linux "$vsix"
+              echo "${vsix##*/}:"
+              node scripts/check-linux-helper-pins.mjs --bundle release/voiceLinux.js --assets release/helpers
+              rm release/voiceLinux.js
+            done
           else
+            for vsix in "${vsixes[@]}"; do
+              voice_linux "$vsix"
+              if grep -q 'linux-x64-muse-dictate' release/voiceLinux.js; then
+                echo "::error::${vsix##*/} pins helper assets but none were staged" >&2
+                exit 1
+              fi
+              rm release/voiceLinux.js
+            done
             rmdir release/helpers
           fi
       - name: checksums for every release asset

CHANGELOG.md

@@ -5,7 +5,7 @@ All notable changes to this project are documented here. The format follows
 [Semantic Versioning](https://semver.org/). Entries record what actually
 happened, not what was planned; superseded entries are kept.
 
-## [0.19.1] - 2026-10-21
+## [0.19.0] - 2026-10-21
 
 ### Highlights
 
@@ -388,6 +388,18 @@ al.` notice suffixes, terminal periods, paired email/URL contacts) while
   Windows PowerShell starts slowly (a fresh machine, heavy antivirus): the
   process identity a vault writer records is read by a small native reader
   instead, and nothing gives up after 10 seconds.
+- On Windows, steps that read or end processes through Windows PowerShell,
+  `taskkill` or the process table are no longer killed after 20 seconds. On
+  a slow machine Windows PowerShell's first start can take longer, and the
+  step it served (building a Windows helper, reading a process tree, ending
+  one) then failed. These steps, and their macOS and Linux counterparts, now
+  run until they end; Stop, or a deadline the caller sets, still ends them.
+- Reports no longer give up on a source after 5 seconds. A slow answer from
+  GitHub, the Marketplace, Open VSX, npm or a large repository's git history
+  used to make that part of the report read "unavailable"; each source now
+  waits for its answer, and Stop still ends the report. A source rate-limited
+  without saying until when is asked again on the next report instead of
+  being held back for 5 seconds.
 - On Windows as an elevated administrator (Windows Server's defaults), work
   the resource governor starts is no longer refused, and the private folder
   for a screen-recording preview is locked to its owner alone.
@@ -852,11 +864,19 @@ al.` notice suffixes, terminal periods, paired email/URL contacts) while
 
 ### Release infrastructure
 
-- 0.19.1 is the first published 0.19 release. Its first tag, `v0.19.0`,
-  was never published: the release stopped at its own checks, before
-  building anything, because the browser check's pinned Chrome for Testing
-  runtime had fallen more than 14 days behind Chrome's Stable channel. A
-  tag never moves, so the renewed pin ships as 0.19.1.
+- Two earlier release tags for this version stopped at the release's own
+  checks, before anything was built or published: first because the browser
+  check's pinned Chrome for Testing runtime had fallen more than 14 days
+  behind Chrome's Stable channel, then because the pin check, which had just
+  begun reading Google's version lists through a schema, could not load that
+  schema's library in a job that installed nothing. Both are fixed; the
+  unpublished tags were deleted and 0.19.0 was tagged again.
+- A new gate, `npm run check:workflow-scripts`, fails any workflow step
+  that runs one of the repository's scripts before its job installs the
+  dependencies that script imports.
+- The release checks every package's Linux helper pins (each VSIX's voice
+  bundle read from its runtime archive), and a release that reused its CI
+  packages can be recovered from like one that built them.
 - Every fake test is gone. Deleted: the tests that used stand-ins or
   invented data, the tests that only checked that some text, key or file
   exists, the editor host checks that drove the fake CLI, the fake-only