From 851d0ef109d5d353889d49881299a4f73a7033ac Mon Sep 17 00:00:00 2001
From: Codex <codex@geointel.local>
Date: Sat, 18 Jul 2026 02:37:54 +0200
Subject: [PATCH] Preserve rollback image on repeated deploys

---
 CHANGELOG.md                                 |  2 ++
 backend/tests/test_rc5_release_deployment.py |  3 +++
 deploy/unraid/deploy-release.sh              | 11 ++++++++++-
 3 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index da48d3f3..bbbec905 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -75,6 +75,8 @@
 - Bound immutable release tags to both commit and dependency profile
   (`<sha>-ai` or `<sha>-gis`) and reuse matching images instead of rebuilding
   or overwriting an existing release tag.
+- Preserved the actual prior rollback image across repeated no-op deploys of
+  the same immutable release.
 - Made production startup reject known-default PostGIS passwords and apply the
   configured upload limit consistently to nginx and FastAPI.
 
diff --git a/backend/tests/test_rc5_release_deployment.py b/backend/tests/test_rc5_release_deployment.py
index cb8e7d40..1ab3b5b2 100644
--- a/backend/tests/test_rc5_release_deployment.py
+++ b/backend/tests/test_rc5_release_deployment.py
@@ -25,7 +25,10 @@ def test_release_deploy_preserves_immutable_and_previous_images() -> None:
     assert 'GEOINTEL_RELEASE_VARIANT="gis"' in script
     assert 'GEOINTEL_RELEASE_IMAGE="${GEOINTEL_IMAGE_REPOSITORY}:${GEOINTEL_BUILD_SHA}-${GEOINTEL_RELEASE_VARIANT}"' in script
     assert 'GEOINTEL_PREVIOUS_IMAGE="${GEOINTEL_IMAGE_REPOSITORY}:previous"' in script
+    assert 'release_image_id="$(' in script
+    assert '[ "$current_image_id" != "$release_image_id" ]' in script
     assert 'docker tag "$current_image_id" "$GEOINTEL_PREVIOUS_IMAGE"' in script
+    assert "preserving the existing previous image" in script
     assert 'if docker image inspect "$GEOINTEL_RELEASE_IMAGE"' in script
     assert "Immutable release tag has conflicting metadata" in script
     assert "Reusing existing immutable image" in script
diff --git a/deploy/unraid/deploy-release.sh b/deploy/unraid/deploy-release.sh
index bc6da251..b8fd436c 100644
--- a/deploy/unraid/deploy-release.sh
+++ b/deploy/unraid/deploy-release.sh
@@ -66,8 +66,17 @@ rollback_previous() {
 docker compose -f docker-compose.unraid.yml config >/dev/null
 
 current_image_id="$(docker inspect --format '{{.Image}}' geointel 2>/dev/null || true)"
-if [ -n "$current_image_id" ] && docker image inspect "$current_image_id" >/dev/null 2>&1; then
+release_image_id="$(
+  docker image inspect --format '{{.Id}}' "$GEOINTEL_RELEASE_IMAGE" 2>/dev/null || true
+)"
+if (
+  [ -n "$current_image_id" ] &&
+  [ "$current_image_id" != "$release_image_id" ] &&
+  docker image inspect "$current_image_id" >/dev/null 2>&1
+); then
   docker tag "$current_image_id" "$GEOINTEL_PREVIOUS_IMAGE"
+elif [ -n "$current_image_id" ] && [ "$current_image_id" = "$release_image_id" ]; then
+  echo "Current container already uses ${GEOINTEL_RELEASE_IMAGE}; preserving the existing previous image."
 fi
 
 if docker image inspect "$GEOINTEL_RELEASE_IMAGE" >/dev/null 2>&1; then