tlmgr repository pinning crosses a package database compatibility boundary between TeX Live releases

TeX Live’s annual release model preserves frozen tlnet-final repositories, and tlmgr option repository can pin an installation to one of these snapshots. The intent is a repeatable package set where tlmgr update --all treats the frozen database as authoritative. However, the transition window between annual releases introduces uncertainty: an unpinned installation may briefly pull next-year pretest packages from the default repository, silently drifting across the compatibility boundary.

A separate version-sensitive boundary exists between the tlmgr binary and the frozen repository it targets. A newer tlmgr pointed at a very old frozen repository may reject the texlive.tlpdb revision or fail signature verification, breaking the repeatable setup. Even when the package database is accepted, pinning only governs managed packages; user-local TEXMFLOCAL and TEXMFHOME trees remain outside the snapshot and can introduce nondeterminism. Format files generated by fmtutil are also tied to the engine binary and package versions, so a frozen package set does not guarantee reproducible formats if the engine is updated separately.

Given these constraints, what is the supported compatibility range between a tlmgr version and a frozen historic repository, and how should a workflow handle the annual transition window to prevent drift? Should the pin be set before or after the default repository switches to pretest content, and what is the recommended way to verify that the local texlive.tlpdb revision matches the intended snapshot?