floating-latest-docker-tags-cause-silent-version-drift-mid-upgrade
Docker Compose services using :latest tags can silently resolve to different image versions during an upgrade run if the daemon pulls mid-sequence. This makes upgrades non-reproducible and violates Law #12. The fix is to pin all images to explicit version tags or digests (e.g., traefik:v3.6.7, nginx:1.29.5-alpine) before starting any multi-service upgrade. Five services were pinned this session: Traefik, FalkorDB, nginx, Excalidraw SPA, Excalidraw room.