Keep publication recovery usable after cold Go tool runs

docs/cli.md

@@ -144,10 +144,14 @@ relative override is resolved from the source repository root. Standard error
 reports the absolute saved record path or a recording warning separately from
 the publication result. Recording failure does not change publication status.
 When publication fails and a record was saved, the CLI also prints a copyable
-`reconcile --record` command for that exact record. The command uses the running
-executable's absolute path, so it remains usable when the executable is not on
-`PATH`; if that executable is no longer available, use another supported
-ReleaseKit CLI.
+`reconcile --record` command for that exact record. The command selects the
+consumer module's registered Go tool when available. API-only consumers receive
+a Go-tool invocation with durable private module files; see
+[recovery storage](consumers/publish.md#retain-and-reconcile-publication-evidence).
+Consumers without a module-selected ReleaseKit dependency use the running
+executable's absolute path. Each entry point preserves the recovery exit status.
+If the selected entry point becomes unavailable, use another supported ReleaseKit
+CLI with the saved record.
 
 The command returns status 0 for confirmed publication, 1 for a known
 publication failure or conflict, 2 for usage, profile, or invalid-version

docs/consumers/publish.md

@@ -135,6 +135,18 @@ directories privately and creates record files with owner-only permissions;
 existing directory permissions are left as they are. The caller owns storage
 retention and removal.
 
+The CLI prepares a recovery entry point when a failed publication has a saved
+record. Registered-tool consumers use their selected module's Go tool directly.
+For API-only consumers, ReleaseKit retains alternate module and checksum files
+under `<Git common directory>/releasekit/publication-recovery/`, with private
+directory and file permissions. These files add the CLI tool declaration and
+prepare its module graph without changing consumer source. They survive a
+launcher's temporary module-file cleanup. The printed command runs Go from the
+selected module directory; retain that checkout and the private recovery files
+while the entry point is needed. Remove the private recovery directories when
+their recovery value expires. Another supported CLI can read the saved record
+independently of these launch files.
+
 The saved endpoint is retained exactly for later observation and may include
 credentials. Treat records, `PublicationEvidence`, and `PublicationResult` as
 sensitive. Store overrides in a location with suitable access controls, avoid

docs/internal/gotool.md

@@ -8,6 +8,15 @@ Standalone and delivery builds create their own owners. The package uses
 `internal/process` for cancellation, the working directory, output, and wrapped
 errors.
 
+For CLI publication recovery, the package selects a registered module tool or
+prepares durable alternate module files for an API-only consumer. Go's module
+graph query includes transitive dependencies; preparation retains local module
+selection and uses the original module directory for relative replacements.
+The CLI formats the later invocation and falls back to its native executable
+for consumers without a selected ReleaseKit module. The
+[publication consumer guide](../consumers/publish.md#retain-and-reconcile-publication-evidence)
+owns recovery-file placement and retention.
+
 ## Command output ownership
 
 `Tool.Run` executes a status-only command. It forwards combined stdout and

docs/roadmap/remediation.md

@@ -249,6 +249,13 @@ remain open and are preserved rather than duplicated here.
 
 ## R07: Make the recovery handoff survive a cold Go-tool invocation — P2
 
+**Completed:** CLI recovery prefers the selected module's Go tool. API-only
+consumers receive privately retained alternate module/checksum files under Git
+metadata; native consumers retain the executable-path fallback. Assembled tests
+passed after cold executables disappeared and launcher files were removed,
+covering both adoption styles, relative replacements, clean candidates, and
+recovery exit statuses 0–3. CLI, consumer, and internal guidance is updated.
+
 **Relevant code:** `cmd/releasekit/main.go:134` (`publicationRecoveryCommand`);
 `examples/multi-module/release.sh`; `docs/consumers/adoption.md`'s module-selected
 Go-tool workflow; `cmd/releasekit/publication_handoff_test.go`.