@@ -18,10 +18,10 @@ jobs:
     name: Build, vet, test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
@@ -45,10 +45,10 @@ jobs:
     name: Vulnerability scan
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
@@ -62,7 +62,7 @@ jobs:
     name: Docker build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Build image
         run: docker build -t branchy:ci .
 
@@ -14,7 +14,26 @@ jobs:
     name: Build image and publish release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Require the tag on the branch its channel is published from
+        # docs/versioning.md: pre-releases are tagged on dev, stable releases on
+        # main. A stable tag that never went through main would publish
+        # something the production branch has not seen.
+        run: |
+          if printf '%s' "${GITHUB_REF_NAME}" | grep -Eq -- '-(alpha|beta|rc)\.'; then
+            branch=dev
+          else
+            branch=main
+          fi
+          git fetch --no-tags origin "${branch}:refs/remotes/origin/${branch}"
+          if ! git merge-base --is-ancestor "${GITHUB_SHA}" "origin/${branch}"; then
+            echo "tag ${GITHUB_REF_NAME} is not an ancestor of origin/${branch}"
+            exit 1
+          fi
+
 
       - name: Resolve build metadata
         id: meta
@@ -47,22 +66,25 @@ jobs:
             capture { print }
           ' CHANGELOG.md >"${notes_file}"
           if [ ! -s "${notes_file}" ]; then
-            printf 'Release %s\n' "${version}" >"${notes_file}"
+            # A release whose notes are the word "Release" tells nobody anything,
+            # and the changelog section is the only place they are written.
+            echo "CHANGELOG.md has no '## ${version}' section"
+            exit 1
           fi
           echo "file=${notes_file}" >>"$GITHUB_OUTPUT"
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Build and push image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           push: true
 
@@ -83,6 +83,9 @@ Temporary Telegram/GitHub failures should retry with `retry_at` and `attempts`.
 
 ## Versioning
 
+- Work on `dev`. Pre-releases (`-alpha.N`, `-beta.N`, `-rc.N`) are tagged on
+  `dev`; stable versions are tagged on `main`, on the merge commit from `dev`.
+  The test bot runs `dev`, the production bot runs `main`.
 - Follow `docs/versioning.md` for release tags.
 - Keep the first release line as `v0.1.0-alpha.1`, `v0.1.0-beta.1`, `v0.1.0-rc.1`, then `v0.1.0`.
 - Use patch versions for fixes, minor versions for MVP-compatible product or operations improvements, and reserve `v1.0.0` for a stable production contract.
@@ -143,3 +146,17 @@ Branchy is licensed under Apache-2.0. Preserve the root `LICENSE` and `NOTICE` f
   `editEphemeralMessageText`. Notifications are rich messages and group
   overlays are ephemeral ones, so a server without them makes Branchy mute.
 
+## Deploying
+
+Do not invent a deploy. [`docs/releases.md`](docs/releases.md) has a **Deploying**
+section describing this stack exactly: which host directory it lives in, which
+env file names the image, which networks it needs, and how to roll back. Read it
+before touching anything on the host.
+
+Two rules that hold everywhere and are easy to get wrong:
+
+- **Nothing is built on the host.** A production stack pulls the image the
+  release workflow published. A `build:` section in a production manifest is a
+  bug.
+- **Pin the digest, not the tag.** A tag moves; a digest names one build that was
+  tested, and a rollback becomes one line with nothing to rebuild.
@@ -2,14 +2,103 @@
 
 All notable Branchy changes are documented here.
 
-Branchy uses SemVer-style versions with pre-release tags before `v1.0.0`. Release
-notes should be copied from the relevant changelog section and lightly edited for
-GitHub Releases.
+The `## <tag>` section of this file *is* the GitHub Release body: the release
+workflow copies it verbatim and refuses a tag that has no section. Write it
+for whoever has to decide whether to upgrade.
+
+See [`docs/versioning.md`](docs/versioning.md) for what the numbers mean and
+[`docs/releases.md`](docs/releases.md) for how a release is published.
 
 ## Unreleased
 
 Use this section for changes that are merged but not released yet.
 
+## v1.2.1 - 2026-09-09
+
+An About card, a group panel that can be closed, and the fix for a hole that let
+any group member delete Branchy's notification cards.
+
+
+### Added
+
+- `docs/releases.md` gained a **Deploying** section, and `AGENTS.md` points at it.
+  Releasing was documented; deploying was not, in any repository in the family —
+  the process stopped at "deploy it" and never said how. That gap mattered more
+  after the stacks moved from building on the host to pulling a published image,
+  because the procedure changed on the same day. The section names this stack's
+  host directory, its env file, the variable that selects the image, the networks
+  it needs, and what a rollback actually is.
+
+- An **About** card, reachable from the main menu and from the group panel. It
+  states the running version — the same string `/healthz` reports — plus the
+  supported events, the repository, the license, and the admin contact. Until
+  now nothing in the interface could answer "which version are you running",
+  which is the first question any complaint has to answer. The repository is a
+  link in the text rather than a second button, because two ways to reach one
+  place is duplication.
+- **Close** on the group panel, and on the About card when it is opened from a
+  group. Branchy had no way to take a panel back out of a group chat. Close acts
+  only on ephemeral messages: Telegram lets a client send any callback data for
+  any message it can see, so honouring `close` against a public message would
+  have let anyone in a group delete Branchy's notification cards. There is no
+  Close in DM, where the conversation is the panel and there is nothing to
+  close.
+- `deploy/ws04/compose.yaml`, the production stack, pulling the image the
+  release workflow publishes to GHCR. The stack on the host built its own image
+  from a working copy, so what served users was not the artifact CI had tested,
+  scanned and published, and nothing on the host could say which commit it came
+  from. `BRANCHY_IMAGE` has no default: an unset one stops the stack instead of
+  quietly starting something else.
+
+### Changed
+
+- One versioning and release document for the whole family. `docs/versioning.md`
+  and `docs/releases.md` are now byte-identical across every Asterfield
+  repository apart from two clearly marked sections: this repository's own
+  version line, and the surface where a change here breaks something. They spell
+  out what each of the three numbers means, what the `-alpha.N` suffix counts,
+  when alpha becomes beta and when it is legitimate to skip to rc or run a
+  pre-release in production.
+- **Pre-releases are now tagged on `dev`, not `main`.** Only stable versions are
+  tagged on `main`, on the merge commit from `dev`. `release.yml` had no branch
+  check at all before, so a tag pushed from any branch would publish; it now
+  refuses a tag that is not on the branch its channel is published from.
+  Earlier pre-releases were tagged on `main` under the previous rule; they are
+  left as they are.
+
+
+- `github.com/FreshLabDev/tg` moves to `v0.0.1-alpha.7`. It carries one fix:
+  a preflight probe is marked as a probe, so the `404 method not found` it
+  expects stops being counted and logged as a transport failure. All four bots
+  on the shared client now run the same version.
+- The same action is now called the same thing on every screen. Three sibling
+  settings screens all returned to the settings hub and each named it
+  differently: the draft branch-filter screen said `Done`, the draft release
+  screen said `Back`, and the draft pull-request screen flipped between the two
+  depending on how many actions were selected. All three now say `Back`, which
+  is what they do — nothing on them is committed, and the hub is the screen the
+  user came from. `Done` survives in exactly one place, the draft branch list,
+  where it skips a level rather than stepping back. `Save branches` on the edit
+  branch list is now `Save`, matching the other two edit screens that commit.
+- Single-select options are marked `◉` and `◎` instead of `●` and `○`, the pair
+  the rest of the bot family uses. Multi-select options keep `■`/`□`, so the two
+  kinds of list still cannot be confused for each other.
+- Callbacks arriving from a group are answered on the ephemeral panel itself
+  (`editEphemeralMessageText`) rather than through `editMessageText`, which
+  cannot address an ephemeral message. Before this, a button on the group panel
+  would have left the panel frozen and answered in DM. A `home` callback from a
+  group now returns the group panel instead of building the DM menu, which
+  would have put one person's GitHub login and subscription count into a chat
+  they share with everyone else. A public group message is never edited into a
+  panel at all: every panel Branchy shows in a group is ephemeral, so a public
+  one is a delivered notification card, and callback data can be sent for any
+  visible message. Such a callback is answered in DM.
+- Both Telegram command descriptions moved out of `cmd/branchy/main.go` into
+  `internal/bot/copy.go`, next to the rest of Branchy's fixed copy. Behaviour is
+  unchanged — one list per scope, still `all_private_chats` plus an ephemeral
+  `all_group_chats`. The file records why there is no list per `language_code`:
+  the English-only interface is a product boundary, not missing work.
+
 ## v1.2.1-alpha.1 - 2026-09-08
 
 Internal, with one visible consequence: Branchy will not start against a
@@ -781,7 +870,7 @@ Telegram-first setup flow are unchanged.
   - Subscription view, pause, edit, delete, and test notification actions.
   - Startup SQL migrations tracked in `schema_migrations`.
   - `/healthz` runtime health endpoint.
-- Apache-2.0 license under FreshLab.
+- Apache-2.0 license under Asterfield.
 - Project documentation for architecture, GitHub integration, Telegram behavior,
   versioning, and release process.
 - Pagination for the repository and branch pickers (Prev/Next) instead of
 
@@ -169,7 +169,7 @@ recommend that a file or class name and description of purpose be included on
 the same "printed page" as the copyright notice for easier identification within
 third-party archives.
 
-Copyright 2026 FreshLab
+Copyright 2026 Asterfield
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 
@@ -1,4 +1,4 @@
 Branchy
-Copyright 2026 FreshLab
+Copyright 2026 Asterfield
 
 This product is licensed under the Apache License, Version 2.0.
@@ -138,13 +138,18 @@ All user setup is button-driven inside Telegram.
 5. Choose DM delivery or an eligible Telegram group.
 6. View, pause, edit, delete, or test subscriptions from the inline menus.
 
+`About` on the main menu reports the running version — the same string
+`/healthz` returns — along with the supported events, the repository, and who
+to reach.
+
 Groups become available only after Branchy has seen the group. Before group
 delivery is enabled, Branchy verifies that the Telegram user is a group
 `creator` or `administrator`.
 
 In groups, `/start` is registered as a Bot API 10.2 ephemeral command. Its DM
 prompt is visible only to the user who invoked it; Branchy never posts a public
-fallback into the group.
+fallback into the group. That panel offers `About` and `Close`; `Close` removes
+it from the chat.
 
 ---
 
@@ -264,6 +269,22 @@ only; restrict them at your reverse proxy if you do not want them public.
 
 ---
 
+## Production
+
+`deploy/ws04/compose.yaml` is the production stack. It pulls the image the
+release workflow published to GHCR and never builds one:
+
+```sh
+# in the stack directory, alongside .env
+BRANCHY_IMAGE=ghcr.io/freshlabdev/branchy@sha256:<digest> docker compose up -d
+```
+
+Pin `BRANCHY_IMAGE` by digest rather than tag. A digest names one exact build,
+so a rollback is a one-line change with nothing to rebuild, and `docker
+inspect` on the running container answers which commit it came from.
+
+---
+
 ## Testing
 
 ```sh
@@ -294,6 +315,6 @@ docker compose config
 </p>
 
 <p align="center">
-  Branchy is open source software by FreshLab.<br/>
-  Copyright 2026 FreshLab.
+  Branchy is open source software by Asterfield.<br/>
+  Copyright 2026 Asterfield.
 </p>
@@ -89,7 +89,7 @@ func run() error {
 		PublicBaseURL:       cfg.PublicBaseURL,
 		GitHubWebhookSecret: cfg.GitHubWebhookSecret,
 	}, store, gh, sealer)
-	service := bot.NewBot(store, client, oauthSvc, gh, sealer, subSvc)
+	service := bot.NewBot(store, client, oauthSvc, gh, sealer, subSvc, version)
 	notificationWorker := outbox.NewWorker(store, client, outbox.Config{
 		BatchSize:    cfg.OutboxBatchSize,
 		PollInterval: cfg.OutboxPollInterval,
@@ -206,6 +206,9 @@ type commandRegistrar interface {
 // ensureTelegramCommands runs independently from HTTP serving and polling.
 // Each scope is retried until it succeeds, so a transient first-deploy failure
 // cannot leave group /start public or unavailable until the next restart.
+//
+// The two lists come from internal/bot, where Branchy's fixed copy lives; that
+// file also records why there is one list per scope and not one per language.
 func ensureTelegramCommands(ctx context.Context, registrar commandRegistrar, retryBase time.Duration) {
 	if retryBase <= 0 {
 		retryBase = 30 * time.Second
@@ -218,9 +221,8 @@ func ensureTelegramCommands(ctx context.Context, registrar commandRegistrar, ret
 			return
 		}
 		if !privateReady {
-			commands := []tg.BotCommand{{Command: "start", Description: "Open the Branchy menu"}}
 			attemptCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
-			err := registrar.SetMyCommandsForScope(attemptCtx, commands, &tg.BotCommandScope{Type: "all_private_chats"})
+			err := registrar.SetMyCommandsForScope(attemptCtx, bot.PrivateCommands(), &tg.BotCommandScope{Type: "all_private_chats"})
 			cancel()
 			if err != nil {
 				slog.Warn("set private telegram commands failed; will retry", "error", err, "retry_in", delay)
@@ -229,11 +231,8 @@ func ensureTelegramCommands(ctx context.Context, registrar commandRegistrar, ret
 			}
 		}
 		if !groupReady {
-			commands := []tg.BotCommand{{
-				Command: "start", Description: "Open Branchy privately", IsEphemeral: true,
-			}}
 			attemptCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
-			err := registrar.SetMyCommandsForScope(attemptCtx, commands, &tg.BotCommandScope{Type: "all_group_chats"})
+			err := registrar.SetMyCommandsForScope(attemptCtx, bot.GroupCommands(), &tg.BotCommandScope{Type: "all_group_chats"})
 			cancel()
 			if err != nil {
 				slog.Warn("set group telegram commands failed; will retry", "error", err, "retry_in", delay)