ci: persist extended-stable Docker completion

docs/ci.md

@@ -317,9 +317,12 @@ preflight and Full Release Validation evidence as a core publish.
 
 Extended-stable uses this workflow only after npm publication, with
 `publish_openclaw_npm=false` and `publish_docker_only=true`. That closeout
-rechecks immutable npm evidence, publishes Docker, and finalizes the notes-only
-non-Latest GitHub Release without entering plugin, ClawHub, or native-app
-publication.
+rechecks immutable npm evidence and the exact canonical validation branch,
+publishes Docker, records durable Docker completion on the immutable release
+SHA, and finalizes the notes-only non-Latest GitHub Release without entering
+plugin, ClawHub, or native-app publication. A public release page never skips
+Docker by itself; only the verified completion status can make a retry resume
+after Docker.
 
 ```bash
 gh workflow run openclaw-release-publish.yml \

docs/reference/RELEASING.md

@@ -204,7 +204,11 @@ saved npm preflight artifact, exact `Full Release Validation` evidence, exact np
 version and `extended-stable` selector, and published tarball digest. It then
 creates or resumes a canonical non-prerelease GitHub Release draft with
 `latest=false`, calls the reusable `Docker Release` workflow, and makes the
-draft public only after Docker succeeds. A tag push never publishes Docker
+draft public only after Docker succeeds. After image, attestation, platform,
+and channel-alias verification, Docker Release records a success status on the
+immutable release SHA. Retries skip a rebuild only when that exact durable
+status and its release-workflow run are verified; a public GitHub Release page
+alone is never Docker-completion evidence. A tag push never publishes Docker
 images or a release page by itself:
 
 ```bash

docs/reference/full-release-validation.md

@@ -52,6 +52,11 @@ gh workflow run full-release-validation.yml \
   -f release_profile=stable
 ```
 
+The Docker-only closeout derives `extended-stable/YYYY.M.33` from the final
+`.33+` tag, requires the tag commit to be reachable from that exact branch, and
+passes that branch to the validation-evidence verifier. It does not substitute
+the closeout workflow's `main` ref for the candidate branch.
+
 The helper's temporary `release-ci/*` ref is valid only when every child uses
 the pinned trusted workflow SHA and the v3 manifest binds the canonical branch,
 exact release commit, run ID, and attempt. Reject narrow runs, stale attempts,