diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml
index a63cee9..e5ffbd6 100644
--- a/.forgejo/workflows/build.yml
+++ b/.forgejo/workflows/build.yml
@@ -2,10 +2,18 @@ name: Build images
 
 on:
   push:
-    # `:dev` builds dropped 2026-05-26 — operator tests from `:latest` after
-    # merge-to-main, not from the dev branch image. Saves one full docker
-    # build per dev push.
-    branches: [main]
+    # `:dev` builds were dropped 2026-05-26 to save a docker build per dev
+    # push, on the reasoning that "operator tests from `:latest` after
+    # merge-to-main". Restored 2026-08-27: that is testing by shipping, and
+    # family rules 146/147 now name it directly — `main` IS production, and a
+    # channel that can only be refreshed by shipping is not a channel. The
+    # pressure to merge in order to try something does not come from
+    # carelessness; it comes from `:dev` being unable to carry the build.
+    #
+    # All three images build on dev, deliberately: a `:dev` web image paired
+    # with a stale `:dev` ml or agent is a worse trap than no dev channel at
+    # all, since the mismatch only shows up as a runtime failure.
+    branches: [main, dev]
     # Tag-push triggers an immutable per-version image build (e.g.
     # `:v26.05.26.5`) — gives a real rollback story alongside the floating
     # `:main` / `:latest`. Layer reuse keeps the registry-storage cost
@@ -279,9 +287,11 @@ jobs:
           #                    rollback unit"). Rollback to any commit
           #                    becomes `docker pull …:c-<sha>` without a
           #                    release ceremony.
-          #   anything else  → safety net; shouldn't fire given the `on:`
-          #                    config above. Tag :dev to surface the
-          #                    unexpected run in the registry.
+          #   refs/heads/dev → push to dev: publish :dev, the rolling test
+          #                    channel (family rule 146). Rolling means it may
+          #                    carry newer contents than the :c-<sha> of the
+          #                    same commit; it never writes :c-<sha> itself,
+          #                    because that is the rollback unit (rule 145).
           # POSIX-safe substring (the runner shell is dash/BusyBox sh, not
           # bash — `${var:0:7}` errors with "Bad substitution"; cut works
           # everywhere). Operator-flagged 2026-06-01 after first :c-<sha>