Hi… I think the following classic post implies that as long as the image is in use by at least one Machine anywhere in the organization (not necessarily in the same app) then it will remain pinned in the registry:
In that same vein, it’s not obvious at first, but it’s possible to deploy using a different app’s image.
For example…
$ cd customer-107
$ fly app create tenant-107-app
$ generate-config 107 > fly.toml
$ fly deploy --image registry.fly.io/template-app:1JABC123
^^^^^^^^^^^^
@pb30 mentioned that he does this on a regular basis. (The template-app in that case having no Machines whatsoever, if I understand correctly.)
Personally, I’ve never had problems with an image turning out to be missing, and I do a lot of slowpoke experiments with Guix-built images manually uploaded and then—some time later—finally used to create a Machine, 
.
(It would be nice if some of the limits and expectations around this were officially documented, though.)
Aside: For extra peace of mind, a person could try skopeo copy right before the call to the Machines API. This is a lightweight utility (no background daemon) in the standard Debian packaging system that can transfer between registries. I use a closely related mode of it all the time, and, although there are some caveats about exact knobs to get right for the Fly.io side, it does work well…