修复跨 Docker 版本灰度镜像校验

tests/test_gray_activation.py

@@ -66,9 +66,12 @@ class GrayActivationTests(unittest.TestCase):
         unrelated.write_text('# unrelated site\n')
         config = GrayConfig('chat.example.com', 29013, str(root), str(root / 'releases/new'),
                             str(proxy), str(certificate), str(private_key), 'a'*40,
-                            'baiyue-logistics-chat-gray:' + 'a'*12 + '-b7', 'sha256:' + 'b'*64, 'sha256:' + 'c'*64)
+                            'baiyue-logistics-chat-gray:' + 'a'*12 + '-b7', 'sha256:' + 'd'*64, 'sha256:' + 'c'*64)
         release = Path(config.release)
         write_release(release, config, 'fixture-model-key')
+        # Docker 26 and 29 may assign different IDs after an archive is loaded.
+        loaded_id = ('e' if scenario == 'image-mismatch' else 'b') * 64
+        (release / 'loaded-image-ids.env').write_text('CHAT_IMAGE_ID=sha256:' + loaded_id + '\n')
         (release / 'site.htpasswd').write_text('new-auth-hash\n')
         commands = directory / 'commands'
         commands.mkdir()
@@ -105,6 +108,13 @@ class GrayActivationTests(unittest.TestCase):
     def test_failed_application_restores_previous_release(self):
         self.assert_rolled_back('app-fail')
 
+    def test_image_retagged_after_verified_load_is_rejected_before_activation(self):
+        result, root, proxy, previous, release, old_site, calls = self.run_activation('image-mismatch')
+        self.assertNotEqual(result.returncode, 0)
+        self.assertEqual((root / 'current-release').read_text().strip(), str(previous))
+        self.assertEqual((proxy / 'baiyue-logistics-chat-gray.conf').read_text(), old_site)
+        self.assertFalse(any(name == 'docker' and 'compose' in args for name, args in calls))
+
     def test_invalid_nginx_configuration_restores_previous_site_and_application(self):
         self.assert_rolled_back('proxy-fail')