Keep push recovery on captured endpoint

docs/internal/overview.md

@@ -37,7 +37,7 @@ these implemented packages:
 | `internal/build` | Candidate-build coordination, selected Go target compilation, version injection, native smoke check, and artifact digests. |
 | `internal/candidate` | Stable-version, note, repository-state, candidate capture, and post-validation checks. |
 | `internal/delivery` | Tagged-checkout verification, artifact inventory/hash validation, manifest assembly, and coordination of hosted delivery results. |
-| `internal/git` | Git command boundary, push-destination resolution, exact ref inspection, and tag operations. |
+| `internal/git` | Git command boundary, push-destination resolution, exact ref inspection, and tag operations, including captured-endpoint verification during recovery. |
 | `internal/gitea` | Gitea API transport, hosted release pages, asset inspection, manifests, and uploads. |
 | `internal/tempdir` | Disposable system temporary storage outside source worktrees. |
 | `internal/process` | Cancellable child-process execution with per-command environment overlays. |
@@ -63,7 +63,7 @@ not a separate release matrix:
 | Runtime version lookup and injected application version | `buildinfo`, `internal/runtimeinfo`, `internal/versioncontract`, `internal/build` | `TestVersionInConsumerExecutable`, `TestVersion` |
 | Candidate capture, committed note, one validation, and rechecks | `releasekit.Check`, `internal/candidate`, `cmd/releasekit/internal/cli` | `TestCheckCapturesCandidateAndCallsValidationOnce`, `TestCheckRechecksHeadAndWorktreeAfterCallback`, `TestCheckCommandBindsConfiguredChecksToCapturedCandidate` |
 | Authoritative endpoint and exact annotated tag publication | `releasekit.Publish`, `internal/publish`, `internal/git` | `TestPublishPushesOnlyTheCapturedAnnotatedTag`, `TestResolveUsesPushURLAndQueriesWithoutMutation` |
-| Publication partial and uncertain recovery | `internal/publish` | `TestPublishRejectedPushKeepsLocalTagAndReportsNotPublished`, `TestPublishLostAcknowledgmentConfirmsExactRemoteObject`, `TestPublishUnavailableReconciliationRemainsUnknownAndPreservesPushError` |
+| Publication partial and uncertain recovery | `internal/publish`, `internal/git` | `TestPublishRejectedPushKeepsLocalTagAndReportsNotPublished`, `TestPublishLostAcknowledgmentConfirmsExactRemoteObject`, `TestPublishLostAcknowledgmentWithChangedEndpointRemainsUnknown`, `TestPublishUnavailableReconciliationRemainsUnknownAndPreservesPushError` |
 | Cross-builds, version smoke checks, empty target sets, and partial outputs | `releasekit.Build`, `internal/build`, `buildinfo` | `TestBuildCreatesSelectedTargetsAndInjectsVersion`, `TestBuildWithNoTargetsDoesNotInvokeCompiler`, `TestBuildReturnsPartialArtifactsAfterTargetFailure` |
 | Page-only and binary tagged-source delivery | `releasekit.Deliver`, `internal/delivery`, `internal/gitea`, CLI | `TestDeliverPageOnlyCreatesAndReusesRelease`, `TestDeliverBuildsTaggedArtifactsAndReusesAssets`, `TestDeliverRejectsTamperedAssetsAndStaleReceiptBeforeRemoteWrites` |
 | Page, manifest, asset comparison, and additive retry outcomes | `internal/gitea` | `TestEnsureReleaseCreatesMissingPageFromCommittedNote`, `TestInspectAssetsDetectsSameNameAndSizeWithDifferentBytes`, `TestUploadMissingPartialFailureThenRerunOnlyMissingAssets` |

docs/release.md

@@ -73,15 +73,19 @@ offline validation begins.
 
 ## Resolve failures
 
-A failed push triggers one exact authoritative tag query. An exact tag-object
-match confirms publication even when Git reported an error. A proven absent tag
-is `not_published`; a different object is a conflict; an unreadable query is
-`unknown`. The command retains its local tag and reports the state, phase,
+A failed push triggers a URL-resolution check against the captured endpoint,
+then at most one exact authoritative tag query. If the endpoint no longer
+resolves to itself, recovery reports `unknown` without querying the rewritten
+destination. An exact tag-object match confirms publication even when Git
+reported an error. A proven absent tag is `not_published`; a different object
+is a conflict; an unreadable query is `unknown`. The command retains its local
+tag and reports the state, phase,
 candidate commit, tag object, and captured publication endpoint when available.
 Do not retry an unknown result until you resolve the authoritative ref at that
 exact endpoint. Copy the reported endpoint value into the variable below using
 normal shell quoting; retain the version and tag object from the same result.
-Check that Git URL rewriting still resolves this value to itself before querying:
+The command checks that Git URL rewriting still resolves this value to itself;
+the manual check below applies the same rule before querying:
 
 ```sh
 releasekit_endpoint='COPY_CAPTURED_ENDPOINT'

docs/roadmap/implementation.md

@@ -1,6 +1,6 @@
 # ReleaseKit audit implementation plan
 
-Status: planned; implementation has not started.
+Status: Stage 1 complete; Stage 2 not started.
 Baseline: `e4be7fa` (2026-10-06). The [audit](audit.md) records the evidence,
 product goals, and selected direction. This document owns implementation order
 and completion criteria for that work.
@@ -100,6 +100,12 @@ remote must find the intended object. Existing unchanged-endpoint success,
 absence, conflict, and unreadable-recovery tests continue to pass. Test the
 behavior through publication; avoid a second copy of the full recovery matrix.
 
+**Completed:** Recovery now verifies the captured URL before its one tag query.
+The rewrite reproduction returns unknown, preserves the local tag and both
+errors, and confirms the object on the original remote. Focused publication
+tests, the full offline suite, API boundary checks, and documentation whitespace
+checks pass.
+
 ## Stage 2 — Own effective Go settings for validation and builds
 
 **Covers:** F1, F3, Go-environment portion of F8. **Primary owners:**