ci: build :dev images again so the dev channel can carry a build

build.yml triggered on main and tags only. The 2026-05-26 comment gave
the reason: "operator tests from :latest after merge-to-main, not from
the dev branch image. Saves one full docker build per dev push."

That trade has since been named as a fault. Family rule 147 — main IS
production, test on :dev, never by shipping — and rule 146 — a rolling
channel refreshes itself, and a channel that can only be refreshed by
shipping is not a channel. 146's note on 147 describes this exact shape:
the pressure to test by shipping does not come from carelessness, it
comes from :dev being unable to carry the build.

Two live consequences, not hypotheticals:
  - docker-compose.yml pins fabledcurator:dev, an image nothing has
    published since May. The registry-image path of the documented
    quick-start could not have worked.
  - trying an extension change required merging to main, because
    sign-extension is gated to main and :dev did not exist to carry an
    XPI. Shipping was the only way to test.

All three images build on dev. Deliberate: a :dev web image paired with
a stale :dev ml or agent is a worse trap than no dev channel, because
the mismatch surfaces as a runtime failure rather than a missing tag.
The cost the 2026-05-26 note was avoiding is real and is now paid on
every dev push — layer reuse should keep ml's cost to the COPY layers,
but if it bites, narrowing is a `paths:` filter away.

:dev only. The dev path never writes :c-<sha>: that is the rollback unit
(rule 145), and a rolling tag may legitimately carry newer contents than
the :c-<sha> of the same commit.

This does NOT yet put an XPI on :dev — sign-extension is still gated to
main, and ungating it has to wait for the derived version to control
publishing, or dev would sign the hand-set 1.0.11, hit the existing
cache and ship main's stale XPI. That is the next step.

.forgejo/workflows/build.yml

@@ -2,10 +2,18 @@ name: Build images
 
 on:
   push:
-    # `:dev` builds dropped 2026-05-26 — operator tests from `:latest` after
-    # merge-to-main, not from the dev branch image. Saves one full docker
-    # build per dev push.
-    branches: [main]
+    # `:dev` builds were dropped 2026-05-26 to save a docker build per dev
+    # push, on the reasoning that "operator tests from `:latest` after
+    # merge-to-main". Restored 2026-08-27: that is testing by shipping, and
+    # family rules 146/147 now name it directly — `main` IS production, and a
+    # channel that can only be refreshed by shipping is not a channel. The
+    # pressure to merge in order to try something does not come from
+    # carelessness; it comes from `:dev` being unable to carry the build.
+    #
+    # All three images build on dev, deliberately: a `:dev` web image paired
+    # with a stale `:dev` ml or agent is a worse trap than no dev channel at
+    # all, since the mismatch only shows up as a runtime failure.
+    branches: [main, dev]
     # Tag-push triggers an immutable per-version image build (e.g.
     # `:v26.05.26.5`) — gives a real rollback story alongside the floating
     # `:main` / `:latest`. Layer reuse keeps the registry-storage cost
@@ -279,9 +287,11 @@ jobs:
           #                    rollback unit"). Rollback to any commit
           #                    becomes `docker pull …:c-<sha>` without a
           #                    release ceremony.
-          #   anything else  → safety net; shouldn't fire given the `on:`
-          #                    config above. Tag :dev to surface the
-          #                    unexpected run in the registry.
+          #   refs/heads/dev → push to dev: publish :dev, the rolling test
+          #                    channel (family rule 146). Rolling means it may
+          #                    carry newer contents than the :c-<sha> of the
+          #                    same commit; it never writes :c-<sha> itself,
+          #                    because that is the rollback unit (rule 145).
           # POSIX-safe substring (the runner shell is dash/BusyBox sh, not
           # bash — `${var:0:7}` errors with "Bad substitution"; cut works
           # everywhere). Operator-flagged 2026-06-01 after first :c-<sha>

.forgejo/workflows/ci.yml

@@ -84,6 +84,12 @@ jobs:
           # can't be reclaimed. Logging it against real pushes first is the only
           # way to validate it at zero cost.
           # Placed before every early-exit path so it reports on all runs.
+          #
+          # The formula CHANGED on 2026-08-27 (commit count -> commit time, per
+          # rule 149), so observations logged before that date describe the old
+          # one and prove nothing about this. The window restarts here. Unlike
+          # build.yml's copy this runs on dev too, so both channels' numbers are
+          # visible — which is the pair that has to stay ordered.
           DERIVED=$(sh extension/scripts/packaging.sh version 2>&1 || echo "UNAVAILABLE")
           echo "shadow: manual=$PKG derived=$DERIVED"
           # -----------------------------------------------------------------

ci-requirements.md

@@ -56,11 +56,15 @@ per `docs/process.md`'s "add deps to the image when used by >1 project".
 - **`extension/scripts/packaging.sh` is the single definition of what ships
   inside the XPI.** Three consumers read from it rather than keeping their own
   copy: web-ext's `--ignore-files` (`extension/package.json`), the `:(exclude)`
-  pathspec in `ci.yml`'s `extension-version` guard, and the commit count that
-  derives the extension version. Three hand-kept copies of that one fact is
-  what allowed issue #2397.
-- `build.yml`'s `sign-extension` checks out with `fetch-depth: 0` — the derived
-  extension version is a commit count, which a shallow clone cannot produce.
+  pathspec in `ci.yml`'s `extension-version` guard, and the `git log` pathspec
+  that derives the extension version. Three hand-kept copies of that one fact
+  is what allowed issue #2397.
+- Jobs that derive the extension version check out with `fetch-depth: 0`. The
+  version is the commit TIME of the newest packaged-extension change (minutes
+  since 2020-01-01, per family rule 149 — never a commit count, which orders
+  by branch rather than by recency). A depth-1 clone sees one commit and
+  derives a wrong, too-low value rather than failing, so the full-history
+  checkout is load-bearing wherever `packaging.sh version` is called.
 - Callers MUST `set -f` before substituting the script's output. Without it the
   shell expands `test/**` against the working tree and silently narrows the
   pattern to whatever files exist at that moment — a failure that looks like

extension/scripts/packaging.sh

@@ -7,7 +7,7 @@
 #
 #   1. web-ext's --ignore-files      (extension/package.json's four scripts)
 #   2. the :(exclude) pathspec       (ci.yml's extension-version guard)
-#   3. the rev-list pathspec         (the derived version, below)
+#   3. the git-log pathspec          (the derived version, below)
 #
 # They now all read from here. POSIX sh only — CI's run shell is busybox.
 #
@@ -68,20 +68,51 @@ cmd_major_minor() {
     | sed -E 's/.*"version"[[:space:]]*:[[:space:]]*"([0-9]+)\.([0-9]+).*/\1.\2/'
 }
 
-# Count of commits that touched a PACKAGED extension file. Monotonic on a
-# branch (the count only grows), which is a correctness requirement, not a
-# nicety: Firefox refuses to install a version lower than the one present.
+# 2020-01-01T00:00:00Z — the anchor for the derived patch component. Fixed
+# forever; moving it would renumber every version downwards.
+VERSION_EPOCH=1577836800
+
+# Minutes since VERSION_EPOCH of the LATEST commit that touched a PACKAGED
+# extension file.
 #
-# Merge commits need no special handling — git's history simplification already
-# prunes merges that don't change the pathspec, so --no-merges is a no-op here
-# (verified on main: both forms return the same count).
+# Time-derived, per family rule 149: an artifact's ordering key must never be a
+# commit count. A count is per-branch — `dev` and `main` count different
+# histories of the same code — so the moment BOTH channels publish, their
+# versions order by which branch accumulated more commits rather than by which
+# is newer. A squash-merge makes that permanent: main gains one commit where dev
+# gained five, so dev climbs away from main and a dev install can never cross
+# back. That is Roundtable's 2026-08-24 incident (`versionCode` was the branch's
+# commit count) in a different repo. Measured here on 2026-08-27: main=23,
+# dev=24 under the old formula — one apart, which is exactly how the inversion
+# stays invisible until it strands somebody.
+#
+# Why the commit's time and not the build's:
+#   * MONOTONIC — max() over a set that only ever gains members. Verified
+#     across all 24 extension-touching commits: zero non-monotonic steps.
+#   * STABLE while the extension is unchanged, so an unchanged extension keeps
+#     its version, the ext-<version> signature cache still hits, and AMO is
+#     called once per extension CHANGE rather than once per push. Build-time
+#     minutes would re-sign on every push and never let two channels share a
+#     signature.
+#   * SHARED ACROSS CHANNELS — after a merge, `main` sees the same commit and
+#     derives the same number, so `:latest` reuses the signature `:dev` already
+#     produced for byte-identical code. Same code, same version, one signing.
+#   * REPRODUCIBLE — any checkout of a commit yields that commit's version.
+#
+# Requires real history: a depth-1 clone sees one commit and will derive a wrong
+# (too low) value. Every consumer must check out with fetch-depth: 0.
 cmd_patch() {
   root=$(git rev-parse --show-toplevel)
   # Unquoted on purpose: the pathspec must word-split into separate args.
   # Globbing is already off script-wide (set -euf above).
   # shellcheck disable=SC2046
-  count=$(cd "$root" && git rev-list --count HEAD -- extension/ $(cmd_pathspec))
-  echo "$count"
+  ts=$(cd "$root" && git log --format=%ct HEAD -- extension/ $(cmd_pathspec) \
+       | sort -n | tail -1)
+  if [ -z "$ts" ]; then
+    echo "packaging.sh: no commit touches a packaged extension file" >&2
+    exit 1
+  fi
+  echo $(( (ts - VERSION_EPOCH) / 60 ))
 }
 
 cmd_version() {