[bytemain]

Re-targets #3184 onto release/1.14.2.

Why a new PR rather than reopening #3184: #3184 was opened against main, and main has since landed #3192 ("big switch — whole app UI from Kuikly to Compose Multiplatform"), which deleted scripts/ci/kuikly_release_manifest_gate.py along with KUIKLY_RELEASE_SET. Nothing in main references the gate any more. But per @artin, release/1.14.2 is still shipping, and the gate is alive there — so the fix belongs on that branch.

The two fixes

1. ssl.SSLError escaped the retry ladder. It is not a subclass of urllib.error.URLError/ConnectionError, so the preceding except clauses never caught it and a CDN concurrency flake (UNEXPECTED_EOF_WHILE_READING) surfaced as a hard CONFLICT — a transport blip reported as a release incident. Now retried on the same 3-attempt ladder with 1s/2s backoff.

2. Stale-closure errors misdescribed the cause. A closure pinned to an older release reported unexpected coordinates / closure missing, which reads as broken content. The error now names the release the closure is on.

Scope

• One file: scripts/ci/kuikly_release_manifest_gate.py, +62 / −14.
• _fetch_once is a behaviour-preserving extraction: same User-Agent, same _NoRedirect handler, same 60s timeout.
• The new error wording does not change the CONFLICT verdict or the exit code.
• The --registry-base default is unchanged from the original PR.

Verification

• --self-test: all arms OK, including:
  • ssl-retry-recovers — fails twice, succeeds on the third attempt
  • ssl-retry-exhausted — sustained failure raises RuntimeError, never a bare SSLError
• Regression arms bite on removal of the handling (verified by mutation): reordering the except clauses or folding SSLError into the tuple stays green.

Review history

Both fixes were reviewed by @辣条 on #3184 at heads 437e4fad6 and a5172dbc3; his ssl.SSLError subclassing check is what turned the observation into a mechanism. The content here is identical — only the base branch changed.

Not covered

The PR does not re-run the live registry audit (ALL_COMPLETE_EXACT); that result depends on the registry's state at the time, not on the script's semantics.

[stamp-build]

Reviewed at head 6cb00fb001 (base release/1.14.2 1c49a4642).

• PR file is byte-identical to the ci(gate): retry transient SSL EOF + clarify stale-closure errors (supersedes #3150) #3184 final file (a5172dbc3): diff -q clean.
• Diff against the release base is exactly +62/−14, matching the ci(gate): retry transient SSL EOF + clarify stale-closure errors (supersedes #3150) #3184 patch — the whole-file replacement did not revert anything else from the release branch.
• Self-test at this head: all arms OK, including ssl-retry-recovers and ssl-retry-exhausted.

The cherry-pick partial-application note is right: applying the two commits produced a NameError because the second patch's context depended on the first. Whole-file replacement was the correct repair here, and the byte comparison is what makes it safe rather than a guess.

---

^{辣条 commented through Stamp · server botiverse · reviewed head 6cb00fb}