Challenge 3: Diagnose a Rollback Failure — Possible Solution
====================================================================

WHY YESTERDAY'S EXACT IMAGE CAN'T BE IDENTIFIED OR PULLED BACK
--------------------------------------------------------------------
Since every build was tagged only as latest, and a Docker tag can only
ever point to ONE specific image at a time, today's build's docker push
...myapp:latest command OVERWROTE what latest pointed to — yesterday's
image is no longer reachable through that tag at all. The registry now
resolves myapp:latest to TODAY's image content exclusively; there is no
way to ask the registry "give me what latest pointed to yesterday,"
because that historical mapping was never preserved anywhere. The tag
latest is, by its very nature, a MOVING pointer, not a fixed, permanent
reference to one specific build.

This matches this chapter's own tip box directly: "'latest from 10
minutes ago' and 'latest right now' are indistinguishable once
overwritten." The exact same logic applies across a full day instead of
10 minutes — the underlying problem (a single mutable tag being reused
for every build) is identical regardless of the time span involved.

WHAT WOULD HAVE PREVENTED THIS
------------------------------------
If yesterday's build had ALSO been tagged with its commit SHA (e.g.
myapp:a1b2c3d) at the time it was built — following this chapter's own
recommendation to "always tag with something immutable and traceable...
in addition to, or instead of, latest" — that SHA tag would still exist
in the registry today, completely unaffected by today's build
overwriting latest. The team could simply docker pull myapp:a1b2c3d (or
redeploy using that specific tag) to restore the exact image that was
running yesterday, with full confidence it's byte-for-byte identical to
what was actually running then.

WHY THIS WORKS AS AN ANSWER
------------------------------
This is precisely the practical, real-world consequence the chapter's
own tip box warns about — an abstract-sounding rule ("always tag with
something immutable") becomes concretely necessary the moment an actual
production incident requires reaching back to a specific prior state.
Without any immutable tag ever having been created, there is simply no
mechanism left, after the fact, to recover what "yesterday's version"
even was — the information was never captured anywhere, and can't be
reconstructed retroactively.