[psmyrdek]

Summary

The 1.29.0 release (run 37431530565) failed in release / publish with Registry tarball unavailable, after npm publish had already succeeded. The metadata wait (#50, #69) polls with backoff, but the tarball download right after it made one attempt. npm completed 1.29.0's metadata ~45 s after publish, while the tarball 404'd for ~5 minutes (published 07:46:35, served 07:51:53). Binaries and the GitHub release were skipped until a manual rerun resumed (reason: resumed, no republish).

• downloadTarball now polls: only a 404 means "not yet" (backoff 1 s → 15 s, unique ?t= query like the metadata poll). Any other status fails at once.
• The metadata and tarball waits share one DEFAULT_WAIT budget (10 min) in both verify and the resume path, so the 20-minute job timeout still holds.
• The deadline still ends in "never republish"; the fix(release): recover from an interrupted release without manual reruns #69 resume path remains the fallback.

None of the recent commits touched this path (#79 is test-only, #80 is PR-run cancellation); it's been a single fetch since #50.

Test plan

• New tests: polls a 404 with unique URLs until served; stops at the deadline with "never republish"; fails once on a non-404
• Deliberate break (every failed fetch final): tests/publish-npm-verify.test.ts 31 pass → 29 pass / 2 fail
• Confirmed the npm tarball URL serves with a ?t= query (200)
• bun test full suite (3 failing Stop-hook tests are the known local bash 3.2 failures), typecheck, lint

🤖 Generated with Claude Code