Keep recovery handoffs available after publication cancellation

docs/cli.md

@@ -149,7 +149,12 @@ consumer module's registered Go tool when available. API-only consumers receive
 a Go-tool invocation with durable private module files; see
 [recovery storage](consumers/publish.md#retain-and-reconcile-publication-evidence).
 Consumers without a module-selected ReleaseKit dependency use the running
-executable's absolute path. Each entry point preserves the recovery exit status.
+executable's absolute path. A module-preparation failure reports a warning and
+uses a persistent native executable when available. Recognized temporary Go-build
+executables provide no native fallback after their driver exits. Command
+preparation has its own bounded context after a failed publication, so publication
+cancellation permits preparing the later invocation. Each entry point preserves
+the recovery exit status.
 If the selected entry point becomes unavailable, use another supported ReleaseKit
 CLI with the saved record.
 

docs/consumers/publish.md

@@ -137,6 +137,10 @@ retention and removal.
 
 The CLI prepares a recovery entry point when a failed publication has a saved
 record. Registered-tool consumers use their selected module's Go tool directly.
+Command preparation uses a separate bounded context after publication failure,
+including cancellation. A module-preparation warning can accompany a persistent
+native executable fallback; the saved record and publication result retain their
+original meaning.
 For API-only consumers, ReleaseKit retains private bootstrap module and checksum files
 under `<Git common directory>/releasekit/publication-recovery/`, with private
 directory and file permissions. These files add the CLI tool declaration and

docs/internal/gotool.md

@@ -15,8 +15,10 @@ requirements, versioned replacements, and checksums. Local replacements resolve
 against their original module directory before relocation. The original main
 module remains a local replacement, including when releasing ReleaseKit itself.
 The private root provides tool resolution independently of consumer vendoring.
-The CLI formats the later invocation and falls back to its native executable
-for consumers without a selected ReleaseKit module. The
+The CLI formats the later invocation using a separate bounded context after
+publication failure. It falls back to a persistent native executable when module
+selection is unavailable or preparation fails, and excludes recognized temporary
+Go-work executables from that fallback. The
 [publication consumer guide](../consumers/publish.md#retain-and-reconcile-publication-evidence)
 owns recovery-file placement and retention.
 

docs/roadmap/implementation.md

@@ -465,9 +465,15 @@ failures without additional consumer release infrastructure.
    cold Go-tool executable's removal and launcher-owned metadata cleanup.
    Explain how to use another selected supported CLI if an entry point becomes
    unavailable.
+5. Prepare the command after publication using a separate bounded context so
+   publication cancellation leaves handoff construction available. Report
+   module-preparation failures separately and retain a persistent native
+   executable fallback. Recognized temporary Go-build executables provide no
+   durable native fallback. Keep publication's original status/error and
+   immediate reconciliation context unchanged.
 
-**R14 follow-up completed:** API-only recovery uses an independent private module
-root. R15 tracks cancellation and preparation-failure handling separately.
+**R14/R15 follow-ups completed:** API-only recovery uses an independent private
+module root; post-failure preparation handles cancellation and native fallback.
 
 **Verification:** Extend existing publication CLI tests for the default, override,
 recording warning with successful status, and original failed/unknown status.
@@ -479,6 +485,10 @@ Include an API-only consumer that vendors the library without declaring the CLI
 tool; execute its handoff and verify source/vendor contents remain unchanged.
 Exercise relative local replacements, versioned replacements, and ReleaseKit's
 own source-module recovery entry point.
+Coordinate cancellation at the recorded push boundary for native, cold
+registered-tool, and temporary-launcher invocations. Execute the resulting
+handoff after driver/launcher cleanup and verify retained publication diagnostics
+and recovery statuses. Exercise native fallback after module-preparation failure.
 
 ## Stage 8: Finish assembled coverage and canonical documentation
 
@@ -495,6 +505,8 @@ contracts and a short consumer recovery workflow.
    before later recovery. Cover root/nested tags and original-record selection.
    Retain the assembled vendored API-only handoff coverage added for R14,
    alongside cold registered-tool and temporary-launcher recovery.
+   R15 adds canceled publication and preparation-failure handoff cases using
+   explicit push readiness and fresh later invocations.
 2. Establish read-only behavior through resulting refs, worktree/branch state,
    saved records, and controlled observations of candidate/hosted boundaries.
    Reuse lower-level classification and codec tests. Tests use local remotes,

docs/roadmap/remediation.md

@@ -648,6 +648,13 @@ Retain existing cold-build, registered/vendored-tool, quoting, and status cases.
 
 ## R15: Preserve the recovery handoff after publication cancellation — P2
 
+**Completed:** Post-failure handoff preparation has a separate bounded context
+and retains a persistent native fallback after module-preparation failure.
+Coordinated native, cold registered-tool, and temporary-launcher cancellation
+tests passed, including execution of the printed command after cleanup and
+retained cancellation diagnostics/statuses. Temporary Go-work executable
+classification is covered, and Stage 7/8 plus canonical guidance is updated.
+
 **Relevant code:** `cmd/releasekit/main.go:116–134`, especially the caller context
 passed to `git.CommonDirectory`. Affects Stage 7 and its Stage 8 coverage.