.forgejo/workflows/build.yml

@@ -787,6 +787,15 @@ jobs:
               print("guard: no ext-* release yet — nothing to go backwards from")
               raise SystemExit(0)
 
+          # A version that is already signed is reused from its release, not
+          # signed again, so it cannot be a downgrade. The weekly refresh builds
+          # main, whose version trails whatever dev has signed since; refusing
+          # it here would stop :latest from ever being refreshed while dev is
+          # ahead.
+          if any(v == derived for v, _ in signed):
+              print(f"guard: {derived_s} is already signed — reused, not re-signed")
+              raise SystemExit(0)
+
           hi, hi_tag = signed[-1]
           print(f"guard: derived={derived_s}  highest already signed={hi_tag}")
           if derived < hi:

tests/test_api_workers.py

@@ -13,12 +13,25 @@ from sqlalchemy import select
 from backend.app.api import workers as workers_api
 from backend.app.models import WorkerLane
 from backend.app.services import worker_control as wc
+from backend.app.services import worker_lanes as wl
 from backend.app.services.worker_lanes import LANES, SWEEP_PERIOD_SECONDS
 from tests.doubles import RecordingSession
 
 pytestmark = pytest.mark.integration
 
 
+@pytest.fixture(autouse=True)
+def a_known_machine(monkeypatch):
+    """A 16-core, 64 GiB container, whatever runs the suite.
+
+    Each lane's ceiling is derived from the container's CPU quota and memory
+    limit, so without this the caps these tests may set depend on the CI
+    runner's size, and a smaller runner refuses them as above the ceiling.
+    """
+    monkeypatch.setattr(wl, "container_cpu_count", lambda: 16)
+    monkeypatch.setattr(wl, "container_memory_bytes", lambda: 64 * wl.GIB)
+
+
 @pytest_asyncio.fixture
 async def no_live_workers(monkeypatch):
     """Nothing is running — which is the CI lane's actual truth, asserted