diff --git a/harnesses/contexts/agent-repo/v1/finalize.sh b/harnesses/contexts/agent-repo/v1/finalize.sh
index a10d084..8d710db 100644
--- a/harnesses/contexts/agent-repo/v1/finalize.sh
+++ b/harnesses/contexts/agent-repo/v1/finalize.sh
@@ -344,13 +344,23 @@ for attempt in $(seq 1 $((PUSH_RETRIES + 1))); do
         sleep 5
         echo "Retry $attempt: git push $REPO_URL HEAD:refs/heads/$BRANCH --force"
     fi
-    if timeout 120 git push "$REPO_URL" "HEAD:refs/heads/$BRANCH" --force 2>&1; then
+    # Capture push output explicitly to stderr so it shows in finalize-error
+    # capture (the previous `if cmd 2>&1; then` form let git stderr go to
+    # stdout where it was lost — the actual push error message wasn't
+    # visible in CP logs, hiding e.g. "Permission denied (publickey)" or
+    # "remote: error: ..." rejections. Real incident: 2026-05-08 probe 6
+    # silently failed for 6 retries with no visible reason.
+    set +e
+    PUSH_OUT=$(timeout 120 git push "$REPO_URL" "HEAD:refs/heads/$BRANCH" --force 2>&1)
+    PUSH_EXIT=$?
+    set -e
+    echo "git push attempt $attempt exit=$PUSH_EXIT, output:" >&2
+    echo "$PUSH_OUT" >&2
+    if [ "$PUSH_EXIT" -eq 0 ]; then
         echo "Push succeeded (attempt $attempt)"
         PUSHED=true
-        PUSH_EXIT=0
         break
     else
-        PUSH_EXIT=$?
         echo "Push attempt $attempt failed with exit code $PUSH_EXIT"
         if [ "$attempt" -lt $((PUSH_RETRIES + 1)) ]; then
             echo "Will retry..."