README.md

@@ -69,9 +69,19 @@ or a `.env` file (see `.env.example` for the variable names) and use:
 
 ```bash
 docker compose -f docker-compose.yml up -d
-# (skips the override so containers pull registry images)
+# (skips the dev override, so containers pull published :latest images)
 ```
 
+`-f` is doing real work there: it tells Compose to use *only* that file, which
+skips `docker-compose.override.yml` and its local builds. What you get is the
+`:latest` images — the stable channel, built from `main`. This is the install
+path, and it is the one to use if you are running FabledCurator rather than
+working on it.
+
+`:dev` is the other channel: rebuilt from the `dev` branch several times a day,
+bleeding edge, no stability promise. Nothing in this repo points an installer at
+it, and nothing should.
+
 The GPU agent is deployed separately, on the machine with the card —
 `agent/docker-compose.yml`, not this stack.
 

docker-compose.yml

@@ -74,7 +74,25 @@ services:
       retries: 5
 
   web:
-    image: git.fabledsword.com/bvandeusen/fabledcurator:dev
+    # :latest, NOT :dev — this file IS the install path.
+    #
+    # `docker compose up -d` merges docker-compose.override.yml, which sets
+    # build: for all five app services, and a build: wins over image:. So a
+    # contributor never pulls this tag and is unaffected by what it says.
+    #
+    # The tag is consulted only on `docker compose -f docker-compose.yml up -d`
+    # — the documented production path, which skips the override. That is a
+    # stranger installing the product, and they must land on the stable channel.
+    #
+    # :latest is main, which IS production (rule 147). :dev is the rolling
+    # bleeding-edge channel we work out of, republished several times a day with
+    # no stability promise. This file pinned :dev on all five services until
+    # 2026-08-31 (#3270), so the documented install shipped development builds.
+    # It went unnoticed because nobody who works on the project takes this path:
+    # the operator deploys from a swarm stack file, contributors get the
+    # override. Do not "fix" this back to :dev while debugging — use the
+    # override, or -f with an explicit tag on the command line.
+    image: git.fabledsword.com/bvandeusen/fabledcurator:latest
     command: ["web"]
     # Graceful shutdown: give the container time to drain in-flight work on a
     # deploy (docker SIGTERMs, then SIGKILLs after this window — default is only
@@ -122,7 +140,7 @@ services:
       redis:    { condition: service_healthy }
 
   worker:
-    image: git.fabledsword.com/bvandeusen/fabledcurator:dev
+    image: git.fabledsword.com/bvandeusen/fabledcurator:latest
     command: ["worker"]
     # Drain in-flight import/thumbnail/download tasks before SIGKILL on deploy.
     stop_grace_period: 90s
@@ -142,7 +160,7 @@ services:
       redis:    { condition: service_healthy }
 
   scheduler:
-    image: git.fabledsword.com/bvandeusen/fabledcurator:dev
+    image: git.fabledsword.com/bvandeusen/fabledcurator:latest
     command: ["scheduler"]
     # Quick maintenance/scan lane + beat — short tasks, modest drain window.
     stop_grace_period: 60s
@@ -163,7 +181,7 @@ services:
   # 30-min backup or a multi-chunk audit can never starve the 5-min recovery
   # sweeps / vacuum (operator-flagged 2026-06-07). One slot — these are heavy.
   maintenance-long:
-    image: git.fabledsword.com/bvandeusen/fabledcurator:dev
+    image: git.fabledsword.com/bvandeusen/fabledcurator:latest
     command: ["worker"]
     # Longest lane (DB backups, library audits, translation backfill) — give it
     # the most room to finish a chunk gracefully. Chunked + idempotent, so a job
@@ -184,7 +202,7 @@ services:
       redis:    { condition: service_healthy }
 
   ml-worker:
-    image: git.fabledsword.com/bvandeusen/fabledcurator-ml:dev
+    image: git.fabledsword.com/bvandeusen/fabledcurator-ml:latest
     command: ["ml-worker"]
     # A single GPU inference pass can run tens of seconds — let it finish.
     stop_grace_period: 120s