Silent Docker deploys served stale builds for hours before anyone noticed

A development team discovered on 2026-08-27 that two separate deployment workflows were silently running outdated software without raising any errors or alerts. The first issue stemmed from hot-patching files directly into a running container, a practice that works until a container is recreated and reverts to the original image with no warning. The second problem involved a rebuilt image that was missing one of 20 expected supervisord processes — specifically the certificate-expiry watcher — leaving custom domain SSL monitoring effectively blind. In both cases, standard Docker inspection tools like docker ps and health checks appeared normal, masking the discrepancy entirely. The team responded by adding explicit labeling to dev-loop scripts, building a preflight tool to diff running processes against config, and creating a drift-detection command with a distinct 'unmeasured' exit state to prevent silent false positives.