diff --git a/.github/workflows/publish-images.yml b/.github/workflows/publish-images.yml
index 16bea88a..a1d4fb64 100644
--- a/.github/workflows/publish-images.yml
+++ b/.github/workflows/publish-images.yml
@@ -8,22 +8,31 @@
 # A single image pull is one resumable HTTPS stream, far more robust through
 # the proxy than hundreds of npm requests.
 #
-# Channels map to branches:
-#   main   -> ghcr.io/<owner>/shopdb-flask:stable  (badge off)
-#   dev-be -> ghcr.io/<owner>/shopdb-flask:edge    (SHOPDB_ENV_LABEL=DEV badge)
+# Channels are mapped to how THIS repo actually ships, which is not how the
+# branch this came from ships. Upstream, main is a release branch and dev-be is
+# the trunk. Here main IS the trunk - it runs hundreds of commits past the last
+# release - and releases are tags (ADR-007). Publishing main as :stable would
+# put unreleased work behind a word that promises the opposite, to sites that
+# have no way to know:
 #
-# Each push to those branches rebuilds and republishes its channel tag, so
-# `edge` stays genuinely bleeding edge. The image is also tagged with the short
-# commit SHA for traceability and rollback.
+#   tag v*  -> ghcr.io/<owner>/shopdb-flask:stable  (badge off)  the release
+#   main    -> ghcr.io/<owner>/shopdb-flask:edge    (DEV badge)  the trunk
+#
+# The image also carries a short-SHA tag for traceability and rollback.
+#
+# Automatic publishing is OFF until someone confirms the GHCR package exists
+# under this owner and decides who may pull it. Re-enable by uncommenting the
+# push: block below; workflow_dispatch works meanwhile.
 
 name: publish-images
 
 on:
-  push:
-    branches:
-      - main
-      - dev-be
-  # Allow a manual rebuild/publish of the current branch's channel image.
+  # push:
+  #   tags:
+  #     - 'v*'
+  #   branches:
+  #     - main
+  # Manual rebuild/publish of the current ref's channel image.
   workflow_dispatch:
 
 # One in-flight publish per branch; a newer push supersedes an older one.
@@ -48,7 +57,10 @@ jobs:
         run: |
           owner="$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')"
           image="ghcr.io/${owner}/shopdb-flask"
-          if [ "${{ github.ref_name }}" = "main" ]; then
+          # A tag is a release, anything else is the trunk. Deliberately not
+          # keyed on the branch name: a release here is a tag, so keying on
+          # "main" would label the trunk stable.
+          if [ "${{ github.ref_type }}" = "tag" ]; then
             channel="stable"
           else
             channel="edge"
diff --git a/docs/DEV-BUILD-TEST.md b/docs/DEV-BUILD-TEST.md
index ac357d1b..7e8a10f2 100644
--- a/docs/DEV-BUILD-TEST.md
+++ b/docs/DEV-BUILD-TEST.md
@@ -22,14 +22,14 @@ so it works on a box that has only Docker installed.
 You will be sent `Start-ShopDBDev.ps1` directly. Save it anywhere (for example
 your Downloads folder) and open PowerShell in that folder.
 
-## Bleeding edge (dev-be)
+## Bleeding edge (main, the trunk)
 
 	powershell -ExecutionPolicy Bypass -File .\Start-ShopDBDev.ps1 -Channel edge
 
 Comes up at https://localhost:5011. Red DEV badge in the sidebar. Pulls the
 `edge` image.
 
-## Stable (main)
+## Stable (newest release tag)
 
 	powershell -ExecutionPolicy Bypass -File .\Start-ShopDBDev.ps1 -Channel stable
 
diff --git a/scripts/Start-ShopDBDev.ps1 b/scripts/Start-ShopDBDev.ps1
index bd0e8a48..d4deade9 100644
--- a/scripts/Start-ShopDBDev.ps1
+++ b/scripts/Start-ShopDBDev.ps1
@@ -19,7 +19,7 @@
 	GCM handles those.
 
 .PARAMETER Channel
-	'stable' (main) or 'edge' (dev-be). Defaults to 'stable'.
+	'stable' (the newest release tag) or 'edge' (main, the trunk). Defaults to 'stable'.
 
 .PARAMETER TargetDir
 	Where to clone. Defaults to %USERPROFILE%\shopdb-dev, a separate working copy
@@ -114,7 +114,18 @@ function Clear-InterruptedRun {
 # stored GitHub credential for github.com, so clone/fetch authenticate against
 # the private repo without anything sensitive touching this script or disk.
 $repoUrl = 'https://github.com/ge-aero/shopdb-flask.git'
-$branch = if ($Channel -eq 'edge') { 'dev-be' } else { 'main' }
+# Channels follow how this repo ships: a release is a TAG, the trunk is main.
+# Upstream this read 'dev-be' for edge, which is that repo's trunk branch and
+# does not exist here - the launcher would have cloned a missing branch.
+$branch = 'main'
+if ($Channel -ne 'edge') {
+	# Newest release tag, so 'stable' means a thing that was released rather
+	# than whatever the trunk happens to be today.
+	$tag = (git ls-remote --tags --refs --sort='-v:refname' $repoUrl 'v*' |
+		Select-Object -First 1) -replace '.*refs/tags/', ''
+	if ($tag) { $branch = $tag }
+	else { Write-Warning "No v* tag found; falling back to main for 'stable'." }
+}
 $target = if ($TargetDir) { $TargetDir } else { Join-Path $env:USERPROFILE 'shopdb-dev' }
 
 Write-Host "ShopDB dev launcher" -ForegroundColor White
diff --git a/scripts/build-channel-installer.ps1 b/scripts/build-channel-installer.ps1
index 6d85f1be..18fda7c1 100644
--- a/scripts/build-channel-installer.ps1
+++ b/scripts/build-channel-installer.ps1
@@ -6,7 +6,7 @@
 	Produces ONE self-contained installer package for the requested channel:
 
 	  stable -> built from 'main',   no DEV badge (SHOPDB_ENV_LABEL empty).
-	  edge   -> built from 'dev-be', red DEV badge (SHOPDB_ENV_LABEL=DEV).
+	  edge   -> built from 'main' (the trunk), red DEV badge (SHOPDB_ENV_LABEL=DEV).
 
 	This is the distributable counterpart to scripts/dev-bootstrap.ps1 (which
 	stands a dev box up FROM the repo). Here the operator has no repo: the script
@@ -28,14 +28,14 @@
 	by branch, image tag, and label - all data, not code.
 
 .PARAMETER Channel
-	'stable' (main) or 'edge' (dev-be). Required.
+	'stable' (the newest release tag) or 'edge' (main, the trunk). Required.
 
 .PARAMETER Version
 	Image tag / bundle version. Defaults to a channel-prefixed date stamp so two
 	channels built the same day never collide (e.g. 'stable-2024.06.01').
 
 .PARAMETER Ref
-	Override the git ref to build. Defaults to 'main' for stable, 'dev-be' for
+	Override the git ref to build. Defaults to the newest v* tag for stable, 'main' for
 	edge. Lets a release engineer cut an installer from a tag or fix branch.
 
 .PARAMETER MysqlImage
@@ -85,7 +85,7 @@ $ErrorActionPreference = 'Stop'
 # channel means.
 $channels = @{
 	stable = @{ Ref = 'main';   EnvLabel = '' }
-	edge   = @{ Ref = 'dev-be'; EnvLabel = 'DEV' }
+	edge   = @{ Ref = 'main'; EnvLabel = 'DEV' }
 }
 
 function Assert-LastExit([string]$What) {
diff --git a/scripts/dev-bootstrap.ps1 b/scripts/dev-bootstrap.ps1
index 6a95a098..a3c01e3c 100644
--- a/scripts/dev-bootstrap.ps1
+++ b/scripts/dev-bootstrap.ps1
@@ -12,7 +12,7 @@
 		 passed, because the app itself runs entirely in the container.
 	  2. Picks a channel:
 		   stable  -> pulls the 'stable' image (built from main), no DEV badge.
-		   edge    -> pulls the 'edge' image (built from dev-be), red DEV badge.
+		   edge    -> pulls the 'edge' image (built from main), red DEV badge.
 		 The two channels use different compose project names, host ports, and
 		 named volumes, so they run side by side without colliding.
 	  3. Generates a .env for the channel (dev-grade secrets, NOT for production)
@@ -25,10 +25,10 @@
 	installer - see deploy/windows/installer/shopdb-install.ps1 for that.
 
 .PARAMETER Channel
-	'stable' (main) or 'edge' (dev-be). Defaults to 'stable'.
+	'stable' (the newest release tag) or 'edge' (main, the trunk). Defaults to 'stable'.
 
 .PARAMETER Ref
-	Override the git ref to build. Defaults to 'main' for stable, 'dev-be' for
+	Override the git ref to build. Defaults to the newest v* tag for stable, 'main' for
 	edge. Retained for compatibility; the pull flow selects the image by channel
 	tag, so this now only affects which branch the working tree is prepared on.
 
@@ -74,7 +74,7 @@ $channels = @{
 		ImageTag  = 'stable'
 	}
 	edge = @{
-		Ref       = 'dev-be'
+		Ref       = 'main'
 		Project   = 'shopdb-edge'
 		ApiPort   = 5011
 		MysqlPort = 3316