Clarify delivery exit statuses by failure phase

docs/cli.md

@@ -208,10 +208,14 @@ first and then run `deliver --assets DIR` with the token available. The ordinary
 `deliver` command does not download application dependencies or change the
 checkout.
 
-The command returns 0 for complete delivery, 1 for an unavailable preflight,
-cancellation, known delivery failure, conflict, or partial delivery, 2 for
-usage, profile, forge-selection, credential, known permission deficiency, or
-inaccessible-destination errors, and 3 when a remote write remains uncertain.
+The command returns 0 for complete delivery, 1 for an unavailable preflight or
+a known delivery failure, conflict, or partial delivery, and 2 for usage,
+profile, forge-selection, local credential-loading, or classified preflight
+configuration/access errors. A remote write whose outcome remains uncertain
+returns 3, including when cancellation prevents reconciliation. Cancellation
+without an unresolved write returns 1, including during preflight or
+preparation. Later authorization failures follow
+the delivery outcome: known failure returns 1; an unresolved write returns 3.
 The result lists matching, uploaded, pending, conflicting, and uncertain assets
 as disjoint current observations;
 early failures may leave some declared assets unreported. On failure, the CLI
@@ -258,11 +262,12 @@ tag arguments. The event ID may identify an annotated tag object; see the
 [delivery guide](consumers/delivery.md#woodpecker-tag-workflows) for resolution
 and workflow preparation. The CLI does not read
 provider-specific environment variable names. Checkout and dependency
-preparation failures, unavailable preflight, and cancellation return status 1;
-usage, profile, forge-selection, credential, known permission deficiency,
-inaccessible-destination, and invalid-version errors return status 2. Final
-delivery uses the same statuses as `deliver`: 0 for complete, 1 for known
-failure, conflict, or partial delivery, and 3 for uncertain remote state.
+preparation failures, unavailable preflight, and cancellation during those
+steps return status 1. Usage, profile, forge-selection, local credential-loading,
+classified preflight configuration/access, and invalid-version errors return
+status 2. Final delivery uses the same statuses as `deliver`: 0 for complete,
+1 for known failure, conflict, or partial delivery, and 3 for uncertain remote
+state, including when cancellation prevents reconciliation.
 
 The maintained module-based tag workflow verifies and checks out the event tag
 before resolving the consumer module. It builds the ReleaseKit version already

docs/releases/v0.6.0.md

@@ -26,8 +26,11 @@ selection and introduces authenticated, read-only credential preflight.
   establish release-write or asset-write permission.
 - The CLI keeps `RELEASEKIT_GITEA_TOKEN` as its default token environment
   setting and preserves configured environment/file precedence. Selection,
-  credential, and inaccessible-destination errors return status 2; unavailable
-  verification and cancellation return status 1.
+  local credential-loading, and classified preflight configuration/access
+  errors return status 2; unavailable preflight and cancellation during
+  preflight/preparation return status 1. Later authorization failures follow
+  delivery outcomes. An unresolved write returns status 3, including when
+  cancellation prevents reconciliation; known delivery failures return 1.
 - Binary `ci-deliver` checks credentials before application dependency
   downloads and checks again during delivery. The automatic check now precedes
   full local artifact size and digest verification; those checks still finish

docs/roadmap/remediation.md

@@ -121,7 +121,13 @@ require a new public package restriction or a broader dependency policy.
 
 ## 3. Qualify phase-specific CLI exit-status documentation — P3
 
-Status: open.
+Status: complete.
+
+**Completed:** Qualified the CLI reference and unreleased v0.6.0 note by phase:
+local loading/classified preflight errors use status 2; later known failures
+use 1; unresolved writes retain 3 even when canceled. Added a narrow CLI
+regression for preflight versus later authorization failure and cancellation
+after an attempted page write. Focused CLI preflight/recovery tests passed.
 
 **Evidence:** [CLI exit statuses](../cli.md),
 [v0.6.0 release note](../releases/v0.6.0.md),