[nhairs-bot]

After a successful PyPI upload, GitHub finalization can see missing or incomplete JSON metadata before both distributions become visible. The dev3 run failed about ten seconds after upload; the later API response matched the original manifest, and rerunning only finalization successfully published the original GitHub assets.

Wait up to five minutes for absent or partial-but-matching metadata. Stop immediately on conflicting filenames/hashes and on API/network errors. Report expected and observed files on conflict or timeout, and recheck the live tag after waiting. This changes only finalization reads, with no rebuilding or repeat uploads.

Check PyPI existence before other release-eligibility conditions so a completed version is rejected as already published, rather than suggesting GitHub cleanup. Repeat this shared check before and after approved draft-asset verification. Split missing/inaccessible-release and source-mismatch errors, and include expected/actual commits for stale runs.

Observed run: https://github.com/nhairs/python-json-logger/actions/runs/41156050496

nhairs-bot-ref: T0027

Test Plan

• 417 local tests passed, including 46 release-policy cases for missing, partial, complete and conflicting publication metadata, existing-version refusal, and stale-run diagnostics.
• Formatting, targeted type checks, actionlint and git diff --check passed.
• Independently compared PyPI's later JSON response, downloaded public GitHub assets and the original bundle: filenames/hashes match. Verified retained attestation subjects match both original distributions.
• Confirmed attempt 2 finalized using build artifact 13025540338 from attempt 1; build/upload timestamps did not change. Subsequent historical reruns still use their original workflow code, so these guard-order changes need a future corrected workflow to exercise live.
• No release tags, packages, assets or settings were changed while preparing this PR. Checksum-format changes remain a separate follow-up.