Transition the reservation to publishing before anything can reach the destination: recovery charges publishing rows and drops reserved ones, so publishing after a confirmed upload leaves crash-window bytes unaccounted. A failed publishing transition now releases (or re-queues) the reservation and clears it from the staged nar instead of leaking a reserved row, and the narinfo retry re-reserves. A denied late reservation skips the object and answers 200 like the nar upload path does instead of failing the build with a 503. Publish failures that may have already landed keep the charge: transport uncertainty, 5xx from the destination, and anything after a confirmed nar PUT. Only definite 4xx refusals release it. Both reservations key off one canonical nar path so two spellings cannot double-charge. Signed-off-by: dawn <dawn@tangled.org>