fix(publish): retain recovery guidance on canceled uploads

[mldangelo-oai]

Summary

Keep the caller's cancellation reason without losing Cloud upload recovery guidance. An interrupted upload may already have been accepted, so the CLI must still tell users to check Cloud before retrying.

Follow-up to merged #677. Its caller-cancellation change stays unchanged; this PR preserves the matching CLI recovery behavior.

Changes

• Track whether the current scan reached the POST through the publisher's existing fetch hook, resetting that state for each batch entry.
• Keep check-before-retrying guidance in CLI diagnostics and batch failure records instead of exposing only SIGINT or SIGTERM.
• Exercise the real Cloud publisher through the CLI for preflight, request, and receipt cancellation, single and batch uploads, and both termination signals. Verify confirmed receipts survive, remaining scans are not attempted, and no request is retried.
• Keep picker cancellation, CSV/local-artifact loading, and canceled dry runs free of upload-recovery warnings before any POST starts.

Testing

• Confirmed the missing-recovery and premature-recovery regression cases fail before their fixes and pass afterward, including the existing picker-cancellation test.
• Bun 1.3.14, seed 12345: 118 tests passed across cloud-publish.test.ts, cli-cloud-publish.test.ts, and cli-publish.test.ts.
• A synthetic CSV-to-Cloud caller probe also passed for request and receipt cancellation with both signals, preserving recovery guidance and making only one request.
• Built CLI smoke test on Node 24 against a local HTTP fixture: real SIGINT and SIGTERM both retained recovery guidance, exited with 130/143, and made only one request.
• pnpm run types, pnpm run format, and pnpm run build: passed.
• git diff --check: passed.
• Platform CI and complete-install results are tracked in the PR checks.
• Attempted the full seeded suite locally. The local review install omits the optional Codex native binary, and tests requiring it fail. Three representative failures reproduced on the main baseline; the full suite is not claimed as passing locally.

Risk and rollout

The production change is limited to cancellation propagation and error presentation. It adds no public flags, configuration, dependencies, or retry behavior. Cancellation still exits with 130 for SIGINT and 143 for SIGTERM; confirmed receipts and unattempted batch entries are preserved. Picker, dry-run, and Linear cancellation behavior remain unchanged. The recovery message is conditional and does not claim that an upload was accepted.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[mldangelo-oai]

@codex review

Please review head 8e28127, especially cancellation propagation, single/batch CLI recovery guidance, and preservation of confirmed receipts. The new integration cases failed before the CLI fix; all 115 focused publication tests, typechecking, formatting, and build now pass.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-27T16:55:40.080544Z	f57a29a	Manual request
🔒 Security Review	✅ Completed 2026-08-27T11:01:40.865742Z	8e28127	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8e28127ab7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3b04e0425e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[mldangelo-oai]

@codex security review

Please review current head f57a29a. The original fix in #677 is now merged, so this PR changes only CLI recovery presentation and tests. Request tracking now begins at the POST boundary and resets between batch entries. All 118 focused tests, typechecking, formatting, build, and real-signal CLI smoke tests pass.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: f57a29a607

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".