fix author git publication recovery

backend/src/workspaces/git-repository.ts

@@ -232,6 +232,10 @@ export class GitWorkspaceRepository {
     try {
       await this.git(["push", "origin", `${revision}:refs/heads/${this.config.branch}`]);
     } catch (error) {
+      // `git` already returns a sanitized WorkspaceRegistryError. Preserve it rather
+      // than mapping its public code a second time (notably git_push_rejected).
+      await this.restoreFailedPublication();
+      if (error instanceof WorkspaceRegistryError) throw error;
       throw this.sanitizeGitError(error);
     }
   }
@@ -239,9 +243,16 @@ export class GitWorkspaceRepository {
   /** Create a local publication commit without contacting the remote. */
   async commitOnly(paths: readonly string[], message: string): Promise<GitStatus> {
     if (paths.length === 0 || paths.some((path) => !this.isRegistryArtifactPath(path))) throw new WorkspaceRegistryError("workspace_invalid", "Workspace repository path is invalid");
-    await this.git(["add", "--", ...paths]);
-    await this.git(["commit", "-m", message], this.publicationIdentity());
-    return await this.status();
+    try {
+      await this.git(["add", "--", ...paths]);
+      await this.git(["commit", "-m", message], this.publicationIdentity());
+      return await this.status();
+    } catch (error) {
+      // A failed prepare must not leave staged or generated artifacts in the
+      // long-lived author checkout for the next request.
+      await this.restoreFailedPublication();
+      throw error;
+    }
   }
 
   /** Commit and push a fixed set of validated artifact paths without exposing Git output. */