[finding] release.yml: the publishing run's Docker job installs @objectstack/cli about a minute after changeset publish, before npm serves the fixed group's tarballs, so the image build 404s (18.1.0: spec-18.1.0.tgz) #25613

Filing gate: ① a real, reproduced failure in a release lane (run 40078805767, job 120834761830) ② no open or closed card covers it ③ the fix sits in one workflow file
Reader: CI/release lane, .github/workflows/docker-publish.yml (or the docker job in .github/workflows/release.yml); next PR adds the wait
Dedupe (open AND closed): "Docker image build fails E404 npm tarball not yet propagated right after publish" → 6 hits. None covers this: #20627 (closed) is a later landing's backfill starting mid-publish; #23801 (closed) is an npm peer-resolution crash; #4900 (closed) is the Release body size.
reach: release lane only, measured on the 18.1.0 publish 2026-10-24
QA-source: 18.1.0 re-cut thread, release run 40078805767 · Docker image · Build and push
Checklist item priority: P2 (npm publish is unaffected; the image self-heals on the next main landing or a re-run)
type: Bug

What happened

Release run 40078805767 on version commit e649c2d (#25606):

• Publish 18.1.0 to npm: success. The GitHub Release was created at 09:13:33Z.
• Docker image / Build & push: failure at Build and push, Dockerfile:88 (npm install -g @objectstack/cli@18.1.0 …), at 09:14:47Z:

npm error code E404
npm error 404 Not Found - GET https://registry.npmjs.org/@objectstack/spec/-/spec-18.1.0.tgz - Not found

A few minutes later the same URL returns 200 and npm view @objectstack/spec@18.1.0 resolves. So the failure is registry/CDN propagation lag between changeset publish returning and every tarball of the fixed group being downloadable.

Why it is not covered today

docker needs publish, and docker-publish.yml goes straight from Validate version input (a semver regex) to Build and push. Nothing waits until npm actually serves the cli's dependency tarballs. release-integrity's group probe guards a later landing (#20627), not the publishing run's own image build.

Proposed fix

Add a step to docker-publish.yml before Build and push: for each package of the fixed group that @objectstack/cli@<version> depends on (or just the whole fixed group), poll the tarball URL from npm view <pkg>@<version> dist.tarball until it returns 200. Use a bounded wait (for example up to 10 min with backoff), then fail with a message that names the missing package. On a workflow_dispatch rebuild of an old version the step passes at once.

Recovery for 18.1.0

ghcr.io/objectstack-ai/objectstack:18.1.0 is not pushed yet. Either "Re-run failed jobs" on run 40078805767 (maintainer), or the next main landing's release-integrity backfill requests the image.