JT
Great point; it's always the unlogged layer. In my experience, the seed bites most often (first thing to break on a re-run, one-line fix), but environment drift is the more expensive one, silent and delayed, showing up on someone else's machine or next month's CI instead of your second run. That's exactly why the tool checks statically instead of trusting a re-run to reveal it. Do you pin the full transitive tree + base-image digest, or stop at top-level pins?