fix(update): compare the running image version, not just the git tag

[CheeryProgrammer]

Problem

./brainiac update's "already up to date" check compared only the tag at HEAD (git describe --tags --exact-match) to the newest tag:

if [ "$current" = "$latest" ]; then echo "already up to date"; exit 0; fi

This assumes git tag at HEAD == running image, which breaks for a from-source build (or any checkout left sitting on the latest tag while the running image is older/different). Observed live: after tagging a release on the checked-out commit while the stack ran a local from-source build, update said "already up to date (v1.118.0)" and skipped the image pull — leaving the running container on the local build, not the released image.

Fix

Also compare the running app's reported version, and only short-circuit when both the checkout and the running image are on the latest tag:

running="$(docker compose exec -T app /brainiac version 2>/dev/null | awk '{print $NF}' || true)"
if [ "$current" = "$latest" ] && [ "${running#v}" = "${latest#v}" ]; then
    echo "update: already up to date ($latest)."; exit 0
fi

If the container is down or reports a different version, it proceeds to pull — the correct behaviour. v-prefix normalized on both sides.

Verification

• sh -n brainiac clean (POSIX).
• Against the live stack (running a 0.0.0-docker from-source build, latest tag v1.118.0): the new check evaluates "0.0.0-docker" != "1.118.0" → mismatch → would pull (old behaviour: false "up to date").

Docs: SYSTEM.md decision-log entry.

---

🤖 Generated with Claude Code