[perNyfelt]

Stalled Central uploads and response bodies can block releases indefinitely, while stale metadata, filename-derived entries and incomplete signatures can produce invalid bundles. This implements the reviewed v2.3.0 fixes:

• Bound CentralPortalClient callers with asynchronous HTTP requests, validated connect/request timeouts and a 60 s small-call cap. Preserve polling attempt counts and pending-state progress messages, distinguish connect timeouts from overall deadlines, retry transient failures, and report friendly authentication/permission errors and unknown deployment outcomes.
• Name all publication artifacts from Maven coordinates, include signed module metadata and classified artifacts, declare metadata/signature inputs, and clear stale metadata through a fixed lazily wired task with destroyables. Preserve JAR-producing packaging (including OSGi bundle, maven-plugin, ejb and custom packaging), and validate signatures and checksums before upload; install only the selected publication to Maven local.
• Parse credential-bearing GitHub remotes and compact git config entries, encode credentials as UTF-8, and validate Plugin Portal publication before the Central release. Match origin subsection names case-sensitively, and add the portable Bash policy/harness with its interpreter probe deferred until the harness runs and a Gradle/JDK CI matrix.

Verification: full builds passed with TestKit Gradle 8.13 and 9.4.0 on JDK 17; timeout, Central API/TestKit, compatibility and metadata suites passed on both versions with JDK 21. Actual daemon JVM/Gradle versions are asserted and recorded. Mechanism A passed the timeout/cancellation proof in all four cells, including draining a stalled upload until EOF/reset within 5 s. The final full suite passed 99 normal tests plus the dedicated non-UTF-8 test. Baseline stalled-body/upload/trickle, charset and publishing-order regressions were confirmed. All three phase commits compile independently.

Relocation option used: whole test task restoration succeeded for the policy-test selection in two isolated checkouts despite different absolute TestKit metadata paths. No runtime-classpath normalization was added. Changing only the policy script re-executed the tests; a separate minimal fixture also proved the provider input is path-insensitive and content-sensitive.

Scope/cost: releaseAll uses default CentralPortalClient deadlines; its separate PublicationStatus and HEAD availability checks remain unchanged. Cleanup affects all publishing builds of the selected publication and can re-sign every artifact/prompt through pinentry. Metadata generation is not cacheable by default on either tested Gradle version, so the observed result is regeneration, not FROM_CACHE. These limits are documented.

Detailed commands, runtime versions, baseline outcomes and cache fingerprints: verification record. No real Portal upload was performed because no throwaway version/verified namespace was allocated; merging, the publishing smoke test and tagging remain release-owner steps.

CI for the preceding implementation commit passed: full build and all four Gradle/JDK cells. The run retains build reports and a runtime-proof report artifact for each matrix cell.
CI retained 101 passing build tests and 37 passing tests per matrix cell. Actual test JVMs were JDK 17.0.20.1+1 and 21.0.12.1+1-LTS; TestKit asserted the corresponding daemon major versions and selected Gradle versions.

Follow-up review fixes: all items 2–8 addressed, including dead-code removal and deadline + 5 s scheduling slack in caller timing tests. The final local full build passed 106 normal tests plus the charset test, with no failures/skips and configuration-cache reuse. New regression tests cover packaging compatibility, pending/validating messages, timeout classification, subsection case and lazy Bash probing.

Review-fix CI passed the full build and all four Gradle/JDK cells: https://github.com/Alipsa/nexus-release-plugin/actions/runs/38084312155 (38 tests per matrix cell).

Ordinary-publishing regression: metadata dependencies now fall back to an empty list when mavenPublication is unset. Both publish and publishToMavenLocal were confirmed to fail before the fix and pass afterward on Gradle 8.13, including strict configuration-cache reuse and parallel execution. Cleanup is never scheduled, metadata/signature bytes remain unchanged, signing stays up to date, and bundle still reports a missing selection. The final local full build passed 108 normal tests plus the charset test, zero failures/skips. Both new cases run in every CI matrix cell.

Latest CI for commit 20c1052 passed the full build and all four runtime cells: https://github.com/Alipsa/nexus-release-plugin/actions/runs/38084878236. Each matrix cell ran 40 tests with zero failures/skips; reports retain the asserted daemon JVM versions.