diff --git a/docs/release.md b/docs/release.md
index ac61d4b..73b7d93 100644
--- a/docs/release.md
+++ b/docs/release.md
@@ -188,25 +188,35 @@ Woodpecker workflow builds the CLI from the tagged checkout, then uses
 destination and secret, copy it to `.woodpecker/releasekit-source-delivery.yml`
 and add the Woodpecker repository secret `releasekit_gitea_token`. If page
 delivery fails or is uncertain, inspect the hosted release and retry the same
-immutable version from its tag:
+immutable version from its tag. The retry requires a clean tagged checkout
+before preparing or building the tool:
 
 ```sh
-git fetch origin "refs/tags/vX.Y.Z:refs/tags/vX.Y.Z"
-git checkout --detach "vX.Y.Z"
 (
   set -e
+  version=vX.Y.Z
+  tag_ref="refs/tags/$version"
+  git fetch origin "$tag_ref:$tag_ref"
+  tag_commit=$(git rev-parse --verify "$tag_ref^{commit}")
+  git checkout --detach "$tag_commit"
+  worktree_status=$(git status --porcelain --untracked-files=all)
+  if [ -n "$worktree_status" ]; then
+    printf '%s\n' 'Delivery retry requires a clean tagged checkout.' >&2
+    exit 1
+  fi
+
   releasekit_host_os=$(GOTOOLCHAIN=local go env GOHOSTOS)
   releasekit_host_arch=$(GOTOOLCHAIN=local go env GOHOSTARCH)
   export GOOS="$releasekit_host_os" GOARCH="$releasekit_host_arch"
   GOTOOLCHAIN=local go mod download
   mkdir -p .releasekit/bin
   GOTOOLCHAIN=local GOPROXY=off GOSUMDB=off go build -o .releasekit/bin/releasekit ./cmd/releasekit
-  .releasekit/bin/releasekit deliver "vX.Y.Z"
+  .releasekit/bin/releasekit deliver "$version"
 )
 ```
 
-For an older tag whose CLI predates `token_file`, supply the token through its
-environment variable when retrying that tagged tool:
+For an older tag whose CLI predates `token_file`, build the tagged executable
+as above, then supply the token through its environment variable when retrying:
 
 ```sh
 RELEASEKIT_GITEA_TOKEN="$(cat .releasekit/gitea-token)" \
diff --git a/docs/roadmap/remediation.md b/docs/roadmap/remediation.md
index f698170..2c2a784 100644
--- a/docs/roadmap/remediation.md
+++ b/docs/roadmap/remediation.md
@@ -262,6 +262,11 @@ name and verify that only the intended tool runs.
 
 ### Stage 3: Build the manual retry tool only from a clean tagged checkout
 
+**Completed.** The retry resolves and checks out the fetched tag and checks
+cleanliness before invoking Go. Local probes verified that fetch failure,
+checkout failure, and remaining edits stop before Go, and a clean retry
+builds and runs the tagged tool for the host.
+
 **Evidence:** The [manual retry block](../release.md) runs `git fetch` and
 `git checkout --detach` before the subshell that enables `set -e`. A
 failed checkout can therefore be followed by dependency preparation, a