relay1/2/3 pin `flamenet-relay:prod`, but a container keeps running the
image it STARTED with — so every deploy silently left the fleet a build
behind. It was eleven days stale when that was first noticed, answering
every health check the whole time, while the Android live suite ran
against it and reported green about a build production had already moved
off.
That is the failure worth naming: not an outage, a suite that proves the
wrong thing and says it proved the right one.
It drifted twice more today, both times within an hour of my own deploys,
which is how I know a note in a runbook would not have held.
⚠️ Best-effort on purpose. The fleet is disposable and a production deploy
must not fail because a test relay would not come up — but it must not
quietly stop matching either, so the outcome is printed either way and
`messenger-privacy-check` asserts it independently rather than trusting
this step.
659 tests pass.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
