OLD_ID vs NEW_ID only caught updates landed during this run. If an image was pulled externally (Unraid UI), the container stayed on the old image while :latest moved on — this run saw nothing to do. Now also compare the container's current image ID against :latest and rebuild if behind.