chore: pin cleaned Dolos publisher graph

Cargo.toml

@@ -13,10 +13,11 @@ edition = "2021"
 license = "Apache-2.0"
 repository = "https://github.com/txpipe/stelae"
 
-# Dolos v2.0.0-alpha.0 pins the released v0.2.0 Stelae crates. The publisher
-# is built in this workspace, so patch both names back to these paths: this is
-# what makes the profile's trait and registry types identical to the host's,
-# rather than two same-version crates from different sources.
+# The accepted Dolos publisher-retirement revision pins the released v0.2.0
+# Stelae crates. The publisher is built in this workspace, so patch both names
+# back to these paths: this is what makes the profile's trait and registry
+# types identical to the host's, rather than two same-version crates from
+# different sources.
 [patch."https://github.com/txpipe/stelae"]
 stelae = { path = "stelae" }
 stelae-driver = { path = "stelae-driver" }

docs/publisher-packaging.md

@@ -45,10 +45,30 @@ identify the released image and source revision. Native binaries are only
 intermediate workflow artifacts; there are no standalone binary releases or
 custom provenance files.
 
+## Candidate identity
+
+A candidate is the tuple of the full Stelae commit, committed `Cargo.lock`,
+accepted Dolos revision
+`2cadf62a2cd9b15ed1c17a9816f976a8646ac2e5`, chart source at that same Stelae
+commit, and reviewed values/configuration. Record all of them at handoff. Before
+publication the image digest is intentionally unknown; use the commit as the
+candidate identity, then add the registry digest and attestation after the
+explicit tag-driven publication. Never substitute a moving image tag for the
+missing digest.
+
+The publisher image and its Dolos profile/protocol dependencies do not need an
+artificial release cadence. The immutable git pin and lockfile make the exact
+combination reproducible, so a publisher candidate can be tested without a new
+Dolos release, and a Dolos or Stelae protocol release need not publish a new
+publisher image when its locked inputs did not change. This repository's one
+workspace tag remains a source identity for the Stelae crates and application;
+publication of protocol crates, image artifacts and deployment are still
+distinct, explicit decisions.
+
 ## Release
 
-1. Verify the candidate commit passed the workspace, parity, registry, image
-   and chart checks.
+1. Verify the candidate tuple above passed the workspace, parity, registry,
+   image and chart checks.
 2. Prepare the version/changelog with the repository's `cargo release` flow
    and review the release commit and signed `v<version>` tag before pushing.
 3. Pushing the version tag triggers image publication after both architecture

docs/publisher-parity.md

@@ -9,6 +9,9 @@ wire format or the Dolos consumer.
 - old host: Dolos `1ae4e91c18a9e1456a3612af402d7b9b97546d30`
   (`dolos snapshot publish` and its headless snapshot facade);
 - new host base: Stelae `47b38a4`, the merge of publisher-host PR 3;
+- final Dolos consumer/facade graph:
+  `2cadf62a2cd9b15ed1c17a9816f976a8646ac2e5`, the merge of publisher-retirement
+  PR 1335;
 - protocol/profile: Stelae 0.2.0 and `io.txpipe.dolos.cardano` v1;
 - real fixture: `stelae-cardano/tests/fixtures/preview-epoch-0`, identified
   and explained by its README;
@@ -33,10 +36,11 @@ cargo test --locked -p stelae-cardano --test publisher_parity \
   -- --ignored --nocapture
 ```
 
-The JSON report identifies both hosts and all pins, records pass/fail checks,
-and measures replay/publish wall time, process peak RSS, artifact size,
-transfer, and scratch use. Directory publication moves zero network bytes and
-uses no OCI scratch, so both values are explicitly zero rather than omitted.
+The JSON report identifies both hosts, the final Dolos dependency pin and all
+fixture/profile pins, records pass/fail checks, and measures replay/publish
+wall time, process peak RSS, artifact size, transfer, and scratch use. Directory
+publication moves zero network bytes and uses no OCI scratch, so both values
+are explicitly zero rather than omitted.
 The report also records each host's first-push layer and byte transfer counters
 from separate repositories in a disposable `registry:2`. CI runs the command
 in the `Real publisher parity` job and uploads `publisher-parity-report`.
@@ -95,9 +99,11 @@ exercise the orchestration seams around it.
 ## Scope and interpretation
 
 All repositories are loopback/disposable and no production registry is named.
-The old source is required only by immutable git revision, not by a future
-Dolos release branch. The real fixture and genesis inputs live here by content
-identity, so removal of the old Dolos command does not remove the evidence.
+The old source is required only by immutable, test-only git aliases; its package
+types remain separate from the final Dolos graph used by `stelae-publisher` and
+the consumer restore checks. It needs no future Dolos release branch. The real
+fixture and genesis inputs live here by content identity, so removal of the old
+Dolos command does not remove the evidence.
 
 This gate establishes code-path parity for packaging. Production canary, soak,
 and mainnet performance remain separate operations and must not be inferred