sc-publish pin drift: consumer tree matches upstream 5da1f71db, pin records 25668ecc (ADR-050)

[randlee]

Finding

Surfaced by the BB-READY-004 fix review (quality-mgr finding ATM-QA-BB004-2 on PR #1484, ADR-050). While rehearsing the sanctioned adoption path (installer dry-run from a kit clone), the consumer tree on integrate/phase-bb @ da035e4 was checked against every sc-publish revision between the recorded pin and main:

sc-publish revision	installer --dry-run drift
25668ecc (recorded revision in release/sc-publish-pin.toml)	20 files
ce5571a2c, 5da1f71db (inside sc-publish PR #89)	0 files
733195032 (#89 merge)	25 files
8d302bb8a (main, #90 merge)	20 files

So the tree is a faithful installer output of sc-publish 5da1f71db, not of the pin, and the pin-file note ("prerelease kit files are temporarily vendored from unmerged sc-publish PR #90 at cd6c52d4") is inaccurate: #90 merged 2026-09-09 and cd6c52d4 is not on main. Introduced by 009a585 "feat(release): adopt generic prerelease workflow kit".

The 20 drifted files at main are the release pipeline itself (release.yml, release-preflight.yml, homebrew/pypi/scoop/winget publish workflows, release_artifacts.py, install.py, publisher prompts, README.sc-publish.md), so advancing the pin is a qualification event per README.sc-publish.md, not a closeout fix.

Decision for Phase BB closeout

• The BB-READY-004 defect (5-minute archive wait) is fixed upstream first: fix(prerelease): wait up to 20 minutes for the archive workflow sc-publish#93.
• atm-core adopts only the three prerelease-kit files from the feat: O.1 — input validation and allocation safety (H-1, M-2) #93 merge commit, byte-identical to upstream, and rewrites the pin-file note to state the true synced revision (5da1f71db) plus the feat: O.1 — input validation and allocation safety (H-1, M-2) #93 adoption and this issue as the tracking reference. PR fix(prerelease): wait for the archive workflow within the API budget (BB-READY-004) #1484 is closed as superseded.
• The 1.5.x prereleases and the coming production release run on the 5da1f71db kit already in the tree.

To do (after the production release)

1. Run the qualification checklist in README.sc-publish.md against sc-publish main.
2. Advance revision to the qualified SHA and re-sync through an unchanged installer run (install.py --input release/sc-publish-consumer-input.json), then prove --dry-run exits 0.
3. Advance the other consumer repositories together, per the pin manifest's convention.

🤖 Generated with Claude Code

https://claude.ai/code/session_019kon2YPcoTpu2ok838FrgZ

[github-actions]

🤖 Hi @randlee, I've received your request, and I'm working on it now! You can track my progress in the logs for more details.

[github-actions]

🤖 I'm sorry @randlee, but I was unable to process your request. Please see the logs for more details.