# 24-Aug-2026 — stop wrong-image deploys with tag validation, build assertion and estate health monitoring [#362](https://github.com/nbarrett/ngx-ramblers/issues/362)

## [build 850](https://github.com/nbarrett/ngx-ramblers/actions/runs/32706119437) — [commit eefbc82](https://github.com/nbarrett/ngx-ramblers/commit/eefbc82f61bfa33151c494c883f22a692cb41448)

_____

## What's new

Estate deploys now prove they shipped what was asked for. The deploy workflow refuses an image tag that is not `latest` or a recent successful Docker build number, the deploy itself checks each site is serving the requested build before reporting success, and a scheduled health check watches every environment round the clock. Follows the 23 Aug outage where a run number read from the wrong workflow deployed a February image to every site.

## At a glance

- Deploy to Selected Environments validates `image_tag` before any environment deploys: `latest` or a run number from the last 100 successful Docker builds; anything else is refused with the correct lookup command in the error
- A deliberate rollback to an older image is still possible with the new `allow_old_image` input
- After each environment deploys, the job fails unless the app's `/api/version` reports the requested build number
- A new Estate Health Check workflow polls every environment's `/api/version` every 15 minutes and fails when any site is down, with one retry to ride out blips
- AGENTS.md: destructive operations need an explicit same-session instruction, and image tags must come from the Docker build workflow only