Say when the persistent container is running an older image than the build

The workflow leaves an already-running lean-bench container alone, so a long
ingest is never cut off mid-run. That is still the right default, but "left
alone" and "up to date" looked identical from outside, and the gap only widens
with each build.

It cost a full debugging session. The container had been up for six hours on
the previous image, so a module added since simply was not in it; the CLI
rejected the new flags and every symptom pointed at the new code. The image
built from that same commit had the module all along.

The container is still not restarted. The build now compares its image id with
the one just built and, when they differ, emits a warning and puts a note at
the top of the job summary with both ids and the two ways to refresh.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ci5T3gWDhhmqDec3e1XtYZ

.gitea/workflows/docker.yml

@@ -234,6 +234,22 @@ jobs:
             echo "${SERVICE_CONTAINER} is already running; leaving it alone so nothing"
             echo "in flight is interrupted. Re-run with refresh_service=true to move it"
             echo "onto the image just built."
+            # ...but say so loudly, because "left alone" and "up to date" look
+            # identical from outside and the gap only widens. This cost a whole
+            # debugging session once: the container had been up for six hours on
+            # the previous build, so the feature added in between simply was not
+            # there, and every symptom pointed at the new code instead.
+            built=$(docker image inspect "$image" --format '{{.Id}}')
+            current=$(docker inspect "${SERVICE_CONTAINER}" --format '{{.Image}}')
+            if [ "$built" != "$current" ]; then
+              echo "::warning::${SERVICE_CONTAINER} is running ${current#sha256:} but the"
+              echo "::warning::image just built is ${built#sha256:} -- it is STALE."
+              echo "STALE=yes" >> "$GITHUB_ENV"
+              echo "STALE_RUNNING=${current#sha256:}" >> "$GITHUB_ENV"
+              echo "STALE_BUILT=${built#sha256:}" >> "$GITHUB_ENV"
+            else
+              echo "${SERVICE_CONTAINER} is already on the image just built."
+            fi
           else
             docker rm -f "${SERVICE_CONTAINER}" >/dev/null 2>&1 || true
             docker run -d \
@@ -259,6 +275,19 @@ jobs:
           {
             echo "### lean-bench image"
             echo ""
+            if [ "${STALE:-}" = "yes" ]; then
+              echo "> **The \`${SERVICE_CONTAINER}\` container is stale.** It is still"
+              echo "> running \`${STALE_RUNNING:0:12}\`; this build produced"
+              echo "> \`${STALE_BUILT:0:12}\`. It was left alone on purpose so that"
+              echo "> nothing in flight was interrupted, so anything you exec into it"
+              echo "> runs the OLD code. Re-run this workflow with"
+              echo "> \`refresh_service=true\` once the runner is idle, or:"
+              echo "> \`\`\`"
+              echo "> docker rm -f ${SERVICE_CONTAINER}"
+              echo "> \`\`\`"
+              echo "> and re-run to have it recreated."
+              echo ""
+            fi
             echo "Kept on the runner (not cleaned up):"
             for tag in ${{ steps.meta.outputs.local_tags }}; do echo "- \`$tag\`"; done
             echo ""