diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml
index a641f19..cd61c3e 100644
--- a/.forgejo/workflows/build.yml
+++ b/.forgejo/workflows/build.yml
@@ -446,7 +446,10 @@ jobs:
         run: |
           # Three trigger shapes:
           #   refs/tags/v…   → tag-push: opt-in milestone label (vYY.MM.DD,
-          #                    no `.N` per family release-posture rule).
+          #                    plus `.N` when the day already carries a tag —
+          #                    family rule 148, amended 2026-08-24 after a
+          #                    same-day tag was retargeted and a release
+          #                    deleted to make room, note 2813).
           #                    Publish ONLY the immutable version tag;
           #                    don't touch :latest (the main-push build
           #                    for the merge commit already did that).
@@ -468,6 +471,15 @@ jobs:
           # everywhere). Operator-flagged 2026-06-01 after first :c-<sha>
           # main-push build failed at this step.
           SHORT_SHA=$(printf '%s' "$GITHUB_SHA" | cut -c1-7)
+          # The pinnable tag (milestone 313 step 3): YYYY.M.D of the commit
+          # THIS artifact's shipped files last changed in. Day precision is
+          # deliberate — same-day work is not something worth pinning, so a
+          # second main build the same day replaces the first rather than
+          # accumulating a tag nobody would roll back to.
+          #
+          # Derived per artifact, so an image whose files did not change keeps
+          # the tag it already had: the agent reads 2026.7.17 today while web
+          # reads 2026.8.27. Step 4 uses that to stop rebuilding it at all.
           # `channel` is baked into the image as FC_CHANNEL and reported by
           # /api/extension/manifest (milestone 271 step 7). A tag-push counts as
           # `main`: a vYY.MM.DD tag is cut from main, so that image is a
@@ -477,7 +489,17 @@ jobs:
             echo "tags=git.fabledsword.com/bvandeusen/fabledcurator:${TAG_NAME}" >> "$GITHUB_OUTPUT"
             echo "channel=main" >> "$GITHUB_OUTPUT"
           elif [ "${GITHUB_REF##*/}" = "main" ]; then
-            echo "tags=git.fabledsword.com/bvandeusen/fabledcurator:main,git.fabledsword.com/bvandeusen/fabledcurator:latest,git.fabledsword.com/bvandeusen/fabledcurator:c-${SHORT_SHA}" >> "$GITHUB_OUTPUT"
+            CALVER=$(sh scripts/artifacts.sh tag web)
+            # Guarded, and computed only on this path. There is no `set -e` in
+            # this step, so a failed derivation would otherwise leave CALVER
+            # empty and publish the tag `fabledcurator:` — an invalid
+            # name, from a green step. An empty pin must never reach the
+            # registry.
+            if [ -z "$CALVER" ]; then
+              echo "ERROR: could not derive a web version tag" >&2
+              exit 1
+            fi
+            echo "tags=git.fabledsword.com/bvandeusen/fabledcurator:main,git.fabledsword.com/bvandeusen/fabledcurator:latest,git.fabledsword.com/bvandeusen/fabledcurator:c-${SHORT_SHA},git.fabledsword.com/bvandeusen/fabledcurator:${CALVER}" >> "$GITHUB_OUTPUT"
             echo "channel=main" >> "$GITHUB_OUTPUT"
           else
             echo "tags=git.fabledsword.com/bvandeusen/fabledcurator:dev" >> "$GITHUB_OUTPUT"
@@ -569,11 +591,30 @@ jobs:
           # everywhere). Operator-flagged 2026-06-01 after first :c-<sha>
           # main-push build failed at this step.
           SHORT_SHA=$(printf '%s' "$GITHUB_SHA" | cut -c1-7)
+          # The pinnable tag (milestone 313 step 3): YYYY.M.D of the commit
+          # THIS artifact's shipped files last changed in. Day precision is
+          # deliberate — same-day work is not something worth pinning, so a
+          # second main build the same day replaces the first rather than
+          # accumulating a tag nobody would roll back to.
+          #
+          # Derived per artifact, so an image whose files did not change keeps
+          # the tag it already had: the agent reads 2026.7.17 today while web
+          # reads 2026.8.27. Step 4 uses that to stop rebuilding it at all.
           if [ "${GITHUB_REF#refs/tags/}" != "${GITHUB_REF}" ]; then
             TAG_NAME="${GITHUB_REF#refs/tags/}"
             echo "tags=git.fabledsword.com/bvandeusen/fabledcurator-ml:${TAG_NAME}" >> "$GITHUB_OUTPUT"
           elif [ "${GITHUB_REF##*/}" = "main" ]; then
-            echo "tags=git.fabledsword.com/bvandeusen/fabledcurator-ml:main,git.fabledsword.com/bvandeusen/fabledcurator-ml:latest,git.fabledsword.com/bvandeusen/fabledcurator-ml:c-${SHORT_SHA}" >> "$GITHUB_OUTPUT"
+            CALVER=$(sh scripts/artifacts.sh tag ml)
+            # Guarded, and computed only on this path. There is no `set -e` in
+            # this step, so a failed derivation would otherwise leave CALVER
+            # empty and publish the tag `fabledcurator-ml:` — an invalid
+            # name, from a green step. An empty pin must never reach the
+            # registry.
+            if [ -z "$CALVER" ]; then
+              echo "ERROR: could not derive a ml version tag" >&2
+              exit 1
+            fi
+            echo "tags=git.fabledsword.com/bvandeusen/fabledcurator-ml:main,git.fabledsword.com/bvandeusen/fabledcurator-ml:latest,git.fabledsword.com/bvandeusen/fabledcurator-ml:c-${SHORT_SHA},git.fabledsword.com/bvandeusen/fabledcurator-ml:${CALVER}" >> "$GITHUB_OUTPUT"
           else
             echo "tags=git.fabledsword.com/bvandeusen/fabledcurator-ml:dev" >> "$GITHUB_OUTPUT"
           fi
@@ -636,11 +677,30 @@ jobs:
         id: tag
         run: |
           SHORT_SHA=$(printf '%s' "$GITHUB_SHA" | cut -c1-7)
+          # The pinnable tag (milestone 313 step 3): YYYY.M.D of the commit
+          # THIS artifact's shipped files last changed in. Day precision is
+          # deliberate — same-day work is not something worth pinning, so a
+          # second main build the same day replaces the first rather than
+          # accumulating a tag nobody would roll back to.
+          #
+          # Derived per artifact, so an image whose files did not change keeps
+          # the tag it already had: the agent reads 2026.7.17 today while web
+          # reads 2026.8.27. Step 4 uses that to stop rebuilding it at all.
           if [ "${GITHUB_REF#refs/tags/}" != "${GITHUB_REF}" ]; then
             TAG_NAME="${GITHUB_REF#refs/tags/}"
             echo "tags=git.fabledsword.com/bvandeusen/fabledcurator-agent:${TAG_NAME}" >> "$GITHUB_OUTPUT"
           elif [ "${GITHUB_REF##*/}" = "main" ]; then
-            echo "tags=git.fabledsword.com/bvandeusen/fabledcurator-agent:main,git.fabledsword.com/bvandeusen/fabledcurator-agent:latest,git.fabledsword.com/bvandeusen/fabledcurator-agent:c-${SHORT_SHA}" >> "$GITHUB_OUTPUT"
+            CALVER=$(sh scripts/artifacts.sh tag agent)
+            # Guarded, and computed only on this path. There is no `set -e` in
+            # this step, so a failed derivation would otherwise leave CALVER
+            # empty and publish the tag `fabledcurator-agent:` — an invalid
+            # name, from a green step. An empty pin must never reach the
+            # registry.
+            if [ -z "$CALVER" ]; then
+              echo "ERROR: could not derive a agent version tag" >&2
+              exit 1
+            fi
+            echo "tags=git.fabledsword.com/bvandeusen/fabledcurator-agent:main,git.fabledsword.com/bvandeusen/fabledcurator-agent:latest,git.fabledsword.com/bvandeusen/fabledcurator-agent:c-${SHORT_SHA},git.fabledsword.com/bvandeusen/fabledcurator-agent:${CALVER}" >> "$GITHUB_OUTPUT"
           else
             echo "tags=git.fabledsword.com/bvandeusen/fabledcurator-agent:dev" >> "$GITHUB_OUTPUT"
           fi