Reconcile uncertain tag pushes

docs/roadmap/implementation.md

@@ -614,11 +614,12 @@ validates once between exact remote guards, creates an unsigned annotated tag,
 rechecks local and remote state, and pushes only the captured tag object. Bare
 remote tests verify the note bytes, peeled commit, tag object, unchanged branch
 and unrelated refs, disabled follow-tags and mirror expansion, validation count,
-remote conflicts, and retained local tags with `unknown` status after push error.
+remote conflicts, and retained local tags after push error; Stage 8 adds outcome
+classification through remote reconciliation.
 
 ## Stage 8: Resolve rejected and ambiguous publication
 
-Status: Pending. Depends on Stage 7.
+Status: Complete. Depends on Stage 7.
 
 1. Add the one-query reconciliation path and public error/result classification.
    Preserve the original push cause when resolution does not confirm success.
@@ -635,6 +636,17 @@ missing, conflicting, and unavailable remote tags have distinct outcomes. Failed
 pushes issue one reconciliation query, successful pushes issue none, and no
 recovery force-update or automatic tag deletion occurs.
 
+Evidence: failed tag pushes receive one bounded exact-tag query. Matching object
+identity returns published; absence returns not_published with the original push
+error; a different object returns conflict; query failure returns unknown while
+preserving the push cause. Tests cover rejection by a bare remote's receive
+hook, an installed conflicting tag, unavailable reconciliation, and a lost
+acknowledgment after the bare remote accepted the tag while the caller context
+was canceled. Query counts confirm one recovery read after errors and none after
+a successful push.
+Tests also verify that a remote branch change during validation and a changed
+local tag before push prevent publication.
+
 ## Stage 9: Expose publication and document ReleaseKit bootstrap
 
 Status: Pending. Depends on Stage 8.