image: bake every client in, not just the phone

~104 MB on top of ~85 MB, almost all of it the AppImage. That is what the product
being complete costs (rule 23): a self-hoster gets a working app for their machine
from the server holding their notes, with no account on a forge that is private.
The AppImage is not optional within that — it is the only bundle that can replace
itself in place, so a server without one cannot serve in-app updates to anybody.

`packaging/fetch-clients.sh` replaces the inline fetch and writes the fixed names
and sidecars `client_dist.py` reads. It never fails: a platform with nothing
published means the server advertises nothing for it and the UI hides that
download, and eight fetches must not become eight ways to redden a green lane.

THE VERSION IS FETCHED, NOT DERIVED, and this is the part that would have been
wrong the easy way. The obvious shortcut is `version.sh display desktop` in the
image job — it has the checkout. But this commit may not be the commit the channel
is serving: a push touching only `src/` does not rebuild the desktop, so the
channel still holds an older build and a locally-derived version would describe
those bytes with this commit's number. `client_dist.py`'s size check could not
catch it, because size IS measured from the real file — it would sail through and
lie about the version alone. So `write-manifest.sh` now publishes
`thoughtsync-desktop.json` beside `latest.json`, from the same two values in the
same breath, and only size/sha256 are measured at bake time.

Which needed the prune's keep-list, or the sidecar would have been uploaded and
deleted again in the same run — a fixed name is self-limiting, which is exactly
why that list exists.

`version_code` is NOT uniformly an integer, and coercing it was a leftover from
the days when Android was the only platform. Android's must stay a JSON number:
`ClientRelease` in core declares it `i64` and a string fails to deserialize on
every phone in the field. The desktop's is Tauri's semver key `1.0.<minutes>` —
the value its updater actually compares — and `int()` would have rejected every
desktop sidecar CI writes. The table now says which is which, and tests pin both
directions.

Also retires the comment above the fetch step, which claimed the APK came from
"always the rolling dev release" and mentioned `:<version>` images. M314 step 3
made the channel conditional in the code directly below it, and step 6 removed
version-shaped image tags entirely.

Verified against the live dev channel before pushing: the Android half resolves
and exits 0, the desktop half degrades with a warning because the sidecar does not
exist yet, and all five constructed bundle filenames return 200.

.forgejo/workflows/ci.yml

@@ -323,53 +323,41 @@ jobs:
           docker system prune -af || true
           docker builder prune --keep-storage 5g -f || true
 
-      # Bake the Android client in, on EVERY image build, so :dev, :latest and
-      # :<version> all carry one and a `docker compose pull` delivers a new client
-      # along with the new server.
+      # Bake EVERY client in, on every image build, so a self-hoster gets a working
+      # app for their machine from the server holding their notes — without an
+      # account on this forge, which is private (issue 2091) and is why serving them
+      # from a release page was never an option for anybody but the operator.
       #
-      # Always the rolling `dev` release — the newest build there is. A versioned
-      # image therefore carries the newest client rather than one pinned to that
-      # version; the two negotiate a sync protocol version before linking, so
-      # "newest" is safe in a way "matching" would not buy anything over.
+      # ~104 MB on top of the ~85 MB image, almost all of it the AppImage. That is
+      # the price of the product being complete (rule 23), and the AppImage is not
+      # optional within it: it is the ONLY bundle that can replace itself in place,
+      # so a server without one cannot serve in-app updates to anyone.
       #
-      # Fetched by the JOB, not by the Dockerfile: the release is private, and a
+      # Fetched by the JOB, not by the Dockerfile: the releases are private, and a
       # token used inside a build lands in the context or a layer.
       #
-      # NEVER fails the build. An image with no Android client advertises none and
-      # hides the download — a supported state, and the only one available before
-      # the first Android build has ever published.
-      - name: Fetch the Android client to bake in
+      # NEVER fails the build — see the script. A platform with nothing published
+      # means the server advertises nothing for it and the UI hides that download,
+      # which is a supported state and the only one available before that platform's
+      # first build has ever published.
+      - name: Fetch the clients to bake in
         env:
           GITHUB_TOKEN: ${{ github.token }}
+          GITHUB_SERVER_URL: ${{ github.server_url }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
         run: |
-          mkdir -p client
-          # THE CHANNEL IS A PROPERTY OF THE IMAGE. A :dev image serves the dev
-          # client; :latest serves the stable one. This read `download/dev`
-          # unconditionally until M314 step 3, on every branch — so every stable
-          # server shipped a dev-channel APK to anyone who downloaded the client
-          # from it. Not a versioning gap; a plain defect, fixed here because this
-          # is the step that gave `stable` an APK to point at.
+          # THE CHANNEL IS A PROPERTY OF THE IMAGE. A :dev image serves dev clients;
+          # :latest serves stable ones. This read `download/dev` unconditionally
+          # until M314 step 3, on every branch — so every stable server shipped a
+          # dev-channel APK to anyone who downloaded the client from it. Not a
+          # versioning gap; a plain defect, and the reason the channel is chosen here
+          # rather than inside the script: the caller is what knows which image it is
+          # building.
           case "${{ github.ref_name }}" in
             main) channel=stable ;;
             *)    channel=dev ;;
           esac
-          echo "Baking in the $channel client."
-          base="${{ github.server_url }}/${{ github.repository }}/releases/download/$channel"
-          ok=1
-          for f in thoughtsync.apk thoughtsync-android.json; do
-            curl -fsSL -H "Authorization: token $GITHUB_TOKEN" -o "client/$f" "$base/$f" || ok=0
-          done
-          if [ "$ok" = 1 ]; then
-            echo "Baking in:"
-            cat client/thoughtsync-android.json
-            ls -l client/thoughtsync.apk
-          else
-            # Both or neither. Half a pair is worse than none: the server would
-            # read a sidecar describing an APK that isn't there, or an APK it
-            # cannot state a version for.
-            echo "::warning::No Android client on the dev release — this image ships without one."
-            rm -f client/thoughtsync.apk client/thoughtsync-android.json
-          fi
+          sh packaging/fetch-clients.sh "$channel" client
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4

.forgejo/workflows/desktop.yml

@@ -463,6 +463,12 @@ jobs:
           # match the binary it points at is an updater that never settles. It must
           # be `key`: this value is matched against bundle filenames.
           version="$(sh packaging/version.sh key desktop)"
+          # The version a PERSON reads, published beside the manifest as
+          # `thoughtsync-desktop.json`. The image build reads it to describe the
+          # bundles it bakes in (packaging/fetch-clients.sh) without re-deriving
+          # anything from its own checkout — which would be a different commit
+          # whenever the desktop did not rebuild.
+          display="$(sh packaging/version.sh display desktop)"
           # Both channels are rolling: the manifest lands on the same release that
           # holds the bundles, and the previous build's bundles are dropped once it
           # points at this one. Nothing can reach them, and they are ~100 MB a push.
@@ -476,4 +482,5 @@ jobs:
                   export RELEASE_NOTES="Development build from ${GITHUB_SHA}" ;;
           esac
           export PRUNE_OLD_ASSETS=true
-          APP_VERSION="$version" bash desktop/packaging/write-manifest.sh
+          APP_VERSION="$version" DISPLAY_VERSION="$display" \
+            bash desktop/packaging/write-manifest.sh