Preserve and report release candidates after post-commit failure

Public @stacksjs/bumpx@0.2.30 reports completed rollback after a rejected release push while retaining the release commit and annotated tag. It restores the old working manifest against the new HEAD/index, leaving the candidate inconsistent.

A normal exact public installation and frozen install reproduced this through the declared CLI and a real local bare Git remote. A pre-receive hook wrote an explicit marker and exited73. The CLI exited2 after its atomic push was rejected, printed Rollback completed due to error., and retained local release0.1.1 refs while the working manifest became0.1.0. The remote stayed unchanged. Success and precommit required-command refusal controls passed:2pass/1failing regression,86assertions,5.40seconds; each case used Bun's default5second bound.

The retained receipt is /tmp/bumpx-rollback-investigation/public-reproduction-receipt.json, SHA256 d7224898e32c939c127ef5810c6ca54823eb75c0ac016f7f1694dec638422ff4, with158 artifact identities and the real fixture repositories. All19 installed public payload files matched the original registry archive before and after. HOME and global Git configuration were unchanged.

Acceptance:

• Before a local release commit or final tag exists, retain existing owned-file/index restoration and the original error.
• After either ref exists, preserve candidate files/index/refs and report the failed phase, retained local state and original error. Never reset/delete refs or claim remote publication was undone.
• Preserve no-commit/index semantics and existing caught-cancellation behavior without adding global signal hooks.
• Report incomplete precommit restoration honestly rather than claiming completed rollback.
• Maintain real whole-operation CLI coverage for late rejection, ordinary atomic success, precommit refusal, tag-only/no-commit and relevant error/cancellation boundaries. Preserve existing budgets and source/public package contracts.
• Deliver and qualify the owning source release before downstream tool adoption.

Related: closed #2007 owns atomic publication and already fixed the old branch-name mismatch trigger. Synchronous backup writes were separately fixed in ca87da4. Neither is reopened. The current reporting path remains in published0.2.28/0.2.30 and current source.

Downstream observation: https://github.com/stacksjs/dtsx/issues/3135 . Its qualified0.11.25 release is complete and is not blocked or reclassified by this separate source defect.

Completed in 0.2.31, implementation 7ab4d758, released source 00b51ef105def09f309c59b28439a08eb18d914d.

All acceptance criteria are met:

• Before release refs exist, owned file/index restoration and the original error remain intact. Failed restoration is reported as incomplete.
• After a release commit or final tag exists, candidate files/index/refs are retained. Diagnostics identify the failed phase and actual retained refs, preserve the original error, and distinguish an unconfirmed push from a completed push. No ref reset/deletion or remote rollback is claimed.
• No-commit/index ownership and caught cancellation are covered, without new global signal hooks.
• The maintained whole-operation public CLI/API suite passed 12 cases, 0 failures, 379 assertions, including real bare-remote rejection with its hook marker, atomic success, precommit refusal, tag-only/index ownership, cancellation/error callbacks, post-push failure, partial commit, foreign-tag ownership and incomplete restoration. Original default 5-second cases, 2-second Git helpers, 5-second CLI children and 60-second outer bound were preserved, with full evidence recording.
• Original implementation CI, release-source CI and Releaser all succeeded. Hosted package tests passed 522, with 2 existing skips. The separate local root run passed 543, with the same skips, because it additionally includes 21 Action tests; those additional tests are not claimed as hosted package coverage.
• Both actual npm packages were normally installed and frozen-installed: all 32 original files matched before/after. Strict public types and a sole expected TS2322 negative control passed. All five original native ZIPs passed identity/integrity checks; actual Darwin-arm64 version/help and strict signature checks passed. Other native targets were not locally executed. Registry integrity signatures were verified; full independent Sigstore trust-chain verification is not claimed.

The first public qualification timeout remains retained. One new complete run was admitted only after a comparable timing boundary changed, and passed in 29.56 seconds without source, fixture, assertions, evidence, provider or budget changes. Earlier journal timings include evidence I/O; exact historical attribution to Git, wrappers, filesystem activity or later host workers remains unknown.

Retained qualification receipt: /tmp/bumpx-0.2.31-verification/publication-proof.json, SHA256 1700f1883c72197d4b5b7b88550e9c81b9282eaa29d24d532866e83f6daa8970, independently audited against 1,195 inputs. This completes this owning-source issue; it does not claim downstream framework installation or alter the completed DTSX release.