Some checks failed
CI / lint (push) Failing after 55s
CI / notebooks-smoke (push) Successful in 1m58s
Deploy / changes (push) Successful in 15s
CI / test (push) Successful in 3m39s
Deploy / zotero (push) Has been skipped
Deploy / docs (push) Has been skipped
Deploy / api (push) Has been skipped
Deploy / bcda (push) Has been skipped
Deploy / llm (push) Has been skipped
Deploy / mc (push) Has been skipped
Deploy / notebooks (push) Successful in 6m22s
Deploy / report (push) Successful in 17s
The first systemd run reported marimo 0.25.2 rolled while the container stayed on the old image: the unit loads .env as EnvironmentFile, compose prefers the process environment over .env, so the HEAVY_TAG the script wrote was ignored and `compose up` recreated nothing. The health check and live probe then passed against the old container. roll_notebooks() now passes HEAVY_TAG to compose explicitly and fails unless the running container's image carries the expected tag. Verified under systemd-run with a stale HEAVY_TAG in the environment.