diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 847e12de..f0e1b71b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -136,13 +136,21 @@ jobs:
             echo "Typechecking ${config}"
             pnpm dlx --package @typescript/native-preview@beta tsgo -p "${config}" --noEmit
           done
-      - name: Typecheck VS Code extension
-        run: pnpm --filter pythinker-code run typecheck
-      - name: Typecheck pythinker-web (vue-tsc)
-        run: pnpm --filter @pymodel/pythinker-web run typecheck
-      - name: Typecheck dashboard-server
-        run: pnpm --filter @pymodel/dashboard-server run typecheck
-      - name: Typecheck dashboard-web
-        run: pnpm --filter @pymodel/dashboard-web run typecheck
-      - name: Typecheck desktop
-        run: pnpm --filter @pymodel/pythinker-desktop run typecheck
+      # `pnpm --filter <name>` exits 0 when nothing matches, so a renamed
+      # package silently turns its gate into a no-op. Three of these filters
+      # had already gone stale that way: `@pymodel/dashboard-server` and
+      # `@pymodel/dashboard-web` matched nothing after the vis rename, and
+      # `pythinker-code` matched the CLI directory instead of the VS Code
+      # extension (`pythinker`), so the extension was never typechecked here.
+      # Resolving each filter first turns a stale name back into a failure.
+      - name: Typecheck workspace apps
+        run: |
+          set -euo pipefail
+          for package in pythinker @pymodel/pythinker-web @pymodel/vis-server @pymodel/vis-web @pymodel/pythinker-desktop; do
+            if [ -z "$(pnpm ls --filter "$package" --depth -1 --parseable)" ]; then
+              echo "No workspace package matches the filter '${package}'" >&2
+              exit 1
+            fi
+            echo "Typechecking ${package}"
+            pnpm --filter "$package" run typecheck
+          done
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index cf9f2dc8..4cd4a02c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -240,11 +240,18 @@ jobs:
     needs:
       - release
       - publish-native-assets
+    # A native release whose zips never reached the GitHub release must not
+    # reach the CDN either. `publish-native-assets` refuses to publish a
+    # partial set, and a job whose needs failed reports `skipped`, not
+    # `failure` — so checking only for failure let a release with zero assets
+    # through and pointed every native installer at a release that has none.
+    # Requiring success (only when this release has native artifacts at all)
+    # leaves the CDN on the last installable version instead.
     if: >-
       always()
       && needs.release.result == 'success'
-      && needs.publish-native-assets.result != 'failure'
-      && needs.publish-native-assets.result != 'cancelled'
+      && (needs.release.outputs.pythinker_native_release != 'true'
+          || needs.publish-native-assets.result == 'success')
       && (needs.release.outputs.packages_published == 'true'
           || startsWith(github.event.head_commit.message, 'ci: release packages'))
     runs-on: ubuntu-latest
@@ -308,9 +315,16 @@ jobs:
     needs:
       - release
       - redeploy-cdn
+    # Without `always()` a skip anywhere upstream skips this job too, and the
+    # gate that exists to catch a half-shipped release goes quiet in exactly
+    # the runs that need it. It stays out of `redeploy-cdn`'s result on
+    # purpose: a CDN that never redeployed is the failure this asserts, so it
+    # has to run and report it rather than disappear with it.
     if: >-
-      needs.release.outputs.packages_published == 'true'
-      || startsWith(github.event.head_commit.message, 'ci: release packages')
+      always()
+      && needs.release.result == 'success'
+      && (needs.release.outputs.packages_published == 'true'
+          || startsWith(github.event.head_commit.message, 'ci: release packages'))
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
diff --git a/apps/pythinker-code/dist-web/.web-bundle-manifest.json b/apps/pythinker-code/dist-web/.web-bundle-manifest.json
index 64c98110..c2823588 100644
--- a/apps/pythinker-code/dist-web/.web-bundle-manifest.json
+++ b/apps/pythinker-code/dist-web/.web-bundle-manifest.json
@@ -1,4 +1,4 @@
 {
-  "sourceHash": "dcb2227d96cf476915942656bc127bb1d7801258b01daa6995ee76e915ff199b",
+  "sourceHash": "39adcc1ccb551ac03f06fe2152c6a69004701da14fd2535f8b26202cb9d27c14",
   "sourceFileCount": 389
 }
diff --git a/apps/pythinker-web/package.json b/apps/pythinker-web/package.json
index fa9ca06b..96f5b74b 100644
--- a/apps/pythinker-web/package.json
+++ b/apps/pythinker-web/package.json
@@ -6,7 +6,7 @@
   "type": "module",
   "scripts": {
     "dev": "vite",
-    "build": "vite build",
+    "build": "node --max-old-space-size=4096 ./node_modules/vite/bin/vite.js build",
     "typecheck": "vue-tsc --noEmit",
     "test": "vitest run",
     "check:style": "node scripts/check-style.mjs",