Preserve rollback image on repeated deploys

CHANGELOG.md

@@ -75,6 +75,8 @@
 - Bound immutable release tags to both commit and dependency profile
   (`<sha>-ai` or `<sha>-gis`) and reuse matching images instead of rebuilding
   or overwriting an existing release tag.
+- Preserved the actual prior rollback image across repeated no-op deploys of
+  the same immutable release.
 - Made production startup reject known-default PostGIS passwords and apply the
   configured upload limit consistently to nginx and FastAPI.
 

backend/tests/test_rc5_release_deployment.py

@@ -25,7 +25,10 @@ def test_release_deploy_preserves_immutable_and_previous_images() -> None:
     assert 'GEOINTEL_RELEASE_VARIANT="gis"' in script
     assert 'GEOINTEL_RELEASE_IMAGE="${GEOINTEL_IMAGE_REPOSITORY}:${GEOINTEL_BUILD_SHA}-${GEOINTEL_RELEASE_VARIANT}"' in script
     assert 'GEOINTEL_PREVIOUS_IMAGE="${GEOINTEL_IMAGE_REPOSITORY}:previous"' in script
+    assert 'release_image_id="$(' in script
+    assert '[ "$current_image_id" != "$release_image_id" ]' in script
     assert 'docker tag "$current_image_id" "$GEOINTEL_PREVIOUS_IMAGE"' in script
+    assert "preserving the existing previous image" in script
     assert 'if docker image inspect "$GEOINTEL_RELEASE_IMAGE"' in script
     assert "Immutable release tag has conflicting metadata" in script
     assert "Reusing existing immutable image" in script

deploy/unraid/deploy-release.sh

@@ -66,8 +66,17 @@ rollback_previous() {
 docker compose -f docker-compose.unraid.yml config >/dev/null
 
 current_image_id="$(docker inspect --format '{{.Image}}' geointel 2>/dev/null || true)"
-if [ -n "$current_image_id" ] && docker image inspect "$current_image_id" >/dev/null 2>&1; then
+release_image_id="$(
+  docker image inspect --format '{{.Id}}' "$GEOINTEL_RELEASE_IMAGE" 2>/dev/null || true
+)"
+if (
+  [ -n "$current_image_id" ] &&
+  [ "$current_image_id" != "$release_image_id" ] &&
+  docker image inspect "$current_image_id" >/dev/null 2>&1
+); then
   docker tag "$current_image_id" "$GEOINTEL_PREVIOUS_IMAGE"
+elif [ -n "$current_image_id" ] && [ "$current_image_id" = "$release_image_id" ]; then
+  echo "Current container already uses ${GEOINTEL_RELEASE_IMAGE}; preserving the existing previous image."
 fi
 
 if docker image inspect "$GEOINTEL_RELEASE_IMAGE" >/dev/null 2>&1; then