Modules compile in the toolchain and ship on the runtime

modules/amqp-ping/Dockerfile

@@ -5,14 +5,16 @@
 # other artifact. That is what makes this buildable by the mesh from a repository and a path
 # (novox/hq ADR 0069) rather than only on a workstation that happens to have the siblings.
 #
-# Named, not pinned. The mesh answers this with the copy of the runtime it holds, because a
-# fingerprint written here would name one particular copy — the one on whichever machine the person
-# typing it was using — and on any other mesh that copy has never existed (novox/hq issue 044).
-# Declared in module.json's `build.on`; there is deliberately no default, so a build nobody told
-# stops here rather than on a reference that resolves to nothing.
+# Two bases, named rather than pinned: the image this is COMPILED in, and the image it RUNS in.
+# They are different images on purpose — the first carries a compiler and the second must not, or
+# every running container would carry one it never invokes. The mesh answers both with the copies it
+# holds, because a fingerprint written here would name one particular copy and no other mesh has it
+# (novox/hq issue 044). Declared in module.json's `build.on`; deliberately no defaults, so a build
+# nobody told stops here and says which module to build first.
+ARG BUILD_BASE
 ARG RUNTIME_BASE
 
-FROM ${RUNTIME_BASE} AS build
+FROM ${BUILD_BASE} AS build
 # Compiled under /app/modules, so resolving `@novox/mesh-sdk` walks up to the base's own
 # node_modules — the module is compiled against exactly the sdk it will run against.
 WORKDIR /app/modules/amqp-ping