Complete procedures with a way back.

Diagnose Docker failed to resolve reference and manifest unknown errors by proving the exact image name, registry path, authentication boundary, tag or digest, daemon network path, and target platform before retrying a pull or deployment.

Release OCI images from protected source through a disposable digest-pinned BuildKit builder, native SPDX and SLSA provenance, optional CycloneDX inventory, Cosign keyless or KMS signing, exact identity verification, digest-only admission, and evidence-backed recovery.