@bongos/core 1.19.836 → 1.19.837

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.836",
-  "core_contract": "1.19.836",
-  "source_commit": "faff4dc07439d637df2442a60de7b6ffe4942bef",
+  "core_version": "1.19.837",
+  "core_contract": "1.19.837",
+  "source_commit": "d3feb6abfa5bf8256137d7be87929d517c266c48",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T16:35:52.288Z",
+  "built_at": "2026-09-17T16:49:51.613Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 493,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2251,
+    "functional_verbatim": 2253,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2770,
-  "tree_sha256": "b5a83bc0c677727ffcea2ac2708a0cecfbc67bf4ad36bb5fd810f89370f8a5a7",
+  "file_count": 2772,
+  "tree_sha256": "ce96f2d9d0c9b141f032d74100c6f505b5c6fdce72de9da3a6a8620538af685b",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2562,7 +2562,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "5945b79e8b7f10f3a6fdd8d2e4df80e0219ee19101801cc3d8dd39a412f3c957"
+      "sha256": "7b2488f4099bcc1060d6257077010857c05b886459ad106f722ed19b0b5178f0"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7852,12 +7852,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "c03405cc4429940c79f245171cd6b474c802187584b108f842bfffcf1b904bdf"
+      "sha256": "376f02b1d5253b7b790331c0f6639d16da022314d4a83c58ca10a9648337f01e"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f6889cab0ca16f36a0902f132a23f0251d8e30ad20f4b11b861ab60f66d6fef6"
+      "sha256": "f8da5247d7da8fdcdb322b12a5ebb362315389a7049ea4d76160115066a6cf3f"
     },
     {
       "path": "public-docs/index.html",
@@ -8097,7 +8097,7 @@
     {
       "path": "scripts/gds/box.js",
       "mode": "0000644",
-      "sha256": "bf2f9c0ccbdaaa615bcd4020402dac32466a5a3ace6a1fb5cb543baa905a2ecd"
+      "sha256": "a2d44a3c30aa83d675edc985bb562ed0599ed1a59bdca3efb515c8be2abcea35"
     },
     {
       "path": "scripts/gds/bug-attachment-audit.js",
@@ -8317,7 +8317,7 @@
     {
       "path": "scripts/gds/doctor.js",
       "mode": "0000644",
-      "sha256": "2fcc3f97558ed6a653638df96d585dc7a1ef7dd884657a63d3a9545dbdb03e92"
+      "sha256": "eaae00a0124635c26f45b4f6620ed95e913a5c2140178fb85bd3f5020dab5d44"
     },
     {
       "path": "scripts/gds/enroll-control-plane.js",
@@ -8792,7 +8792,7 @@
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "4f60207affe476f637b2b2c13c38ab785940deef9bf8b5a8fa43b5d6448a408a"
+      "sha256": "94a77427cb16c8a959eb279866f3777830d7a33617f02aed5eedb383ca26e84a"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -8909,6 +8909,11 @@
       "mode": "0000644",
       "sha256": "c5fb602f48d48ca31f5f5290d3624050267ec9bdf4b0c2988e3ff7d59e523bff"
     },
+    {
+      "path": "scripts/gds/runner-drift.js",
+      "mode": "0000644",
+      "sha256": "2a0919b7769007eba2b58f2c0a3f77d42a644c8c2912059ae2af689e06302d6e"
+    },
     {
       "path": "scripts/gds/sandbox-stage.js",
       "mode": "0000644",
@@ -9782,7 +9787,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "7faebdb6698a23244085b855c10b7f25d3363a5fd92f8f1190305f4a3b627da9"
+      "sha256": "5434f6390d888bb9c3181c449483867da3fd6637a8748fe98f0609cc57f75022"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12602,7 +12607,7 @@
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",
-      "sha256": "56be00457be12f34e12658e032285865a6e3a2997df629e4d8dec3ec78c52b31"
+      "sha256": "09a759a1b1e0cac3ddafdd64adca4daed0f6a8ab4c48a07f42954f38ed510433"
     },
     {
       "path": "tests/provision_disconnect.mjs",
@@ -12974,6 +12979,11 @@
       "mode": "0000644",
       "sha256": "b5698af4ca50c44b384a3adfd1a1b1132bab630241ebb70ac77b13a67ffc8eae"
     },
+    {
+      "path": "tests/runner_drift.mjs",
+      "mode": "0000644",
+      "sha256": "51e07247e84af72a316fac8b3c373198d80af6f97ec3fd08a9e99ab010a1b6ff"
+    },
     {
       "path": "tests/sandbox_stage.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -2146,5 +2146,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.834 with no explicit bump. run 35245617627. (task 1002620)
   1.19.836 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.835 with no explicit bump. run 35247495964. (task 1002620)
+  1.19.837 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.836 with no explicit bump. run 35248928789. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.836",
+  "version": "1.19.837",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.836",
+      "version": "1.19.837",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.836",
+  "version": "1.19.837",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/box.js

@@ -54,6 +54,8 @@ const REPO_ROOT = path.resolve(__dirname, '..', '..');
 // INSTANCE root, riding ADR 0108's resolvers, instead of assuming it sits beside
 // box.js. ADR 0150 (BV1.R97/R98).
 const instanceConfig = require(path.join(REPO_ROOT, 'src/instance-config'));
+const { installedCoreVersion, runnerBanner } = require('./runner-drift.js');
+const { coreVersionSafe } = require('./provision-config.js');
 const BOX_INFRA_TEMPLATE = 'builder-box-cloud-init.yaml';
 
 // Ordered candidate infra/ dirs — first that actually holds the cloud-init
@@ -1120,6 +1122,8 @@ async function cmdReconcileDrift(pool, boxes, { apply }) {
 const MAX_INTENT_ATTEMPTS = numEnv('BOX_INTENT_MAX_ATTEMPTS', 3);
 
 async function cmdRunIntents(pool, boxes, boxOnboard, { apply }) {
+  const instanceRoot = process.env.BONGOS_INSTANCE_ROOT || process.cwd();
+  console.log(runnerBanner({ runnerVersion: coreVersionSafe(), runnerRoot: REPO_ROOT, instanceVersion: installedCoreVersion(instanceRoot), instanceRoot }));
   if (!apply) {
     const { rows } = await pool.query(
       `SELECT bi.*, b.github_login FROM box_intents bi
@@ -1325,4 +1329,4 @@ async function main() {
 
 if (require.main === module) main();
 
-module.exports = { cmdProvision, deprovisionOne, parkOne, cmdSweepIdle, cmdSweepDormant, deleteWithRetry, cmdReconcileDrift, runDnsHook, runDnsHookBlackhole, markErrorUnlessDestroyed, resolveBoxInfraDir, boxInfraCandidates, readCloudInit, buildBoxEnv, BOX_INFRA_TEMPLATE };
+module.exports = { cmdProvision, cmdRunIntents, deprovisionOne, parkOne, cmdSweepIdle, cmdSweepDormant, deleteWithRetry, cmdReconcileDrift, runDnsHook, runDnsHookBlackhole, markErrorUnlessDestroyed, resolveBoxInfraDir, boxInfraCandidates, readCloudInit, buildBoxEnv, BOX_INFRA_TEMPLATE };

package/scripts/gds/doctor.js

@@ -375,12 +375,38 @@ function checkDeployTooling() {
   }
 }
 
+// Intent-runner drift (task 1002722): a runner on a stale core once turned a domain-attach
+// into a teardown (task 1002716). Only a host with *intent-runner* units shows this section,
+// so a builder laptop or dev box sees nothing.
+function runnerDriftRows(results) {
+  return (results || []).map((r) => {
+    const msg = `${r.name}: ${r.reason}`;
+    if (r.status === 'ok') return { status: 'ok', msg };
+    if (r.status === 'drift') return { status: 'fail', msg: `${msg} — repoint the unit's WorkingDirectory + ExecStart at the installed core (a systemd drop-in, as task 1002716 did).` };
+    return { status: 'warn', msg };
+  });
+}
+
+function checkRunnerDrift() {
+  let rows = [];
+  try {
+    const { collectRunnerDrift } = require('./runner-drift.js');
+    rows = runnerDriftRows(collectRunnerDrift({ instanceRoot: process.env.BONGOS_INSTANCE_ROOT || process.cwd() }));
+  } catch (_) {
+    return;
+  }
+  if (!rows.length) return;
+  section('Intent runners');
+  const emit = { ok, warn, fail };
+  for (const row of rows) emit[row.status]('runners', row.msg);
+}
+
 // --------------------------------------------------------------------------
 // main
 // --------------------------------------------------------------------------
 // Guarded so requiring this file for its pure helpers (tests/doctor_hooks.mjs)
 // does not run the checks, which shell out to git and hit the network.
-module.exports = { classifyHooksState };
+module.exports = { classifyHooksState, runnerDriftRows };
 
 if (require.main === module) (async () => {
   console.log(`${C.bold}GDS Doctor${C.reset} — local-machine health check`);
@@ -390,6 +416,7 @@ if (require.main === module) (async () => {
   checkGitPlumbing();
   await checkRepoState();
   checkEnvironment();
+  checkRunnerDrift();
 
   const fails = findings.filter((f) => f.status === 'fail').length;
   const warns = findings.filter((f) => f.status === 'warn').length;

package/scripts/gds/provision.js

@@ -54,6 +54,7 @@ const { APP_USER, alreadyScaffolded, buildCorePinRefreshCommit, dbCreateCmd, dbN
 const { backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath, backupUnitName, instanceManifestCmd, originEnvVarsFor, serviceUnit, serviceUnitPath, settingsConsumed, settingsEnvVarsFor, upsertEnvVars, webEnvBody, webEnvPath } = require('./provision-units.js');
 const { caddyBlock, caddySnippetPath, checkDnsTokenScope, classifyZoneScope, dnsReleaseEnv, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, identityCmd, identityVerdict, shouldFederate, zoneForDomain } = require('./provision-net.js');
 const { capacityPreflight, statusCapacityLine } = require('./provision-capacity.js');
+const { installedCoreVersion, runnerBanner } = require('./runner-drift.js');
 const { teardownInstance } = require('./provision-teardown.js');
 const { disconnectInstance } = require('./provision-disconnect.js');
 const { coreUpgradeInstance, snapshotAllCoreVersions } = require('./provision-core-upgrade.js'); // the owner's deploy door, ADR 0293
@@ -1221,6 +1222,8 @@ async function drainOAuthManifests(deps) {
 // ---------------------------------------------------------------------------
 async function cmdRunIntents(deps) {
   const { db, provisioning, log, apply } = deps;
+  const instanceRoot = deps.instanceRoot || process.env.BONGOS_INSTANCE_ROOT || process.cwd();
+  log(runnerBanner({ runnerVersion: coreVersionSafe(), runnerRoot: REPO_ROOT, instanceVersion: installedCoreVersion(instanceRoot), instanceRoot }));
   if (!apply) {
     const { rows } = await db.query(
       `SELECT pi.*, i.slug FROM provisioning_intents pi
@@ -1254,7 +1257,7 @@ async function cmdRunIntents(deps) {
       else if (intent.action === 'restart') result = await restartInstance(inst, deps);
       else if (intent.action === 'disconnect') result = await disconnectInstance(inst, deps);
       else if (intent.action === 'core-upgrade') result = await coreUpgradeInstance(inst, deps, intent); // also reads the INTENT: the version the owner previewed (ADR 0293 D4)
-      else result = { ok: false, error: `unknown intent action '${intent.action}' — refusing to guess` };
+      else result = { ok: false, error: `unknown_action '${intent.action}' — runner core ${coreVersionSafe() || '?'} does not know it (runner too old?); refusing to guess` };
       if (result && result.ok === false) {
         if (intent.attempts >= MAX_INTENT_ATTEMPTS) {
           await provisioning.resolveIntent(db, intent.id, 'error', result.error || 'op failed');

package/scripts/gds/runner-drift.js

@@ -0,0 +1,151 @@
+#!/usr/bin/env node
+// scripts/gds/runner-drift.js — do the intent-runner units run the core this instance installed? (task 1002722)
+//
+// WHY. For weeks the prod intent runners ran core 1.19.2 from a retired clone while the
+// instance served a current core, so an owner's domain-attach click executed as a TEARDOWN
+// (task 1002716). The hotfix repointed the units with systemd drop-ins; nothing noticed the
+// drift, and the only tell was a PWD in sudo logs. This reads each `*intent-runner*` unit the
+// way systemd does (a drop-in overrides the base file), finds the core package the ExecStart
+// script lives in, and compares its version to the instance's installed @bongos/core.
+//
+// A unit whose version cannot be read — a shell wrapper that picks the core at runtime, a
+// missing package — is UNRESOLVED, never ok: a gate that guesses green is the incident again.
+//
+//   node scripts/gds/runner-drift.js [--instance-root <dir>] [--json]
+//     exit 0 = every unit resolved and matched (or no systemd here), 1 = drift, 2 = bad usage.
+//     Unresolved units are listed but do not fail the run. `bongos doctor` runs the same check.
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+
+const CORE_NAMES = ['@bongos/core', '@cloudbongos/core'];
+const P = path.posix;   // unit files describe the Linux control plane, whatever runs the tests
+
+// The effective WorkingDirectory + ExecStart lines from `systemctl cat` output. Later files
+// are drop-ins: a later WorkingDirectory wins, an empty `ExecStart=` clears the list, and a
+// drop-in that only ADDS one leaves the base command running too (oneshot runs them all).
+function effectiveUnit(catText) {
+  let workingDirectory = null;
+  let execs = [];
+  for (const raw of String(catText || '').split(/\r?\n/)) {
+    const line = raw.trim();
+    const m = line.match(/^(WorkingDirectory|ExecStart)=(.*)$/);
+    if (!m) continue;
+    const value = m[2].trim();
+    if (m[1] === 'WorkingDirectory') workingDirectory = value.replace(/^-/, '') || null;
+    else if (value === '') execs = [];
+    else execs.push(value);
+  }
+  return { workingDirectory, execStarts: execs };
+}
+
+// The absolute path of the .js script an ExecStart runs, or null when its first argument is
+// not one (a shell wrapper decides at runtime which core it loads).
+function runnerScriptPath({ workingDirectory, execStart }) {
+  const tokens = String(execStart || '').trim().split(/\s+/).filter(Boolean);
+  if (!tokens.length) return null;
+  let i = 0;
+  if (P.basename(tokens[i].replace(/^[@\-:+!]+/, '')) === 'env') {
+    i++;
+    while (i < tokens.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[i])) i++;
+  }
+  const script = tokens.slice(i + 1).find((tok) => !tok.startsWith('-'));
+  if (!script || !/\.[cm]?js$/.test(script)) return null;
+  if (script.startsWith('/')) return script;
+  return workingDirectory ? P.join(workingDirectory, script) : null;
+}
+
+function readJson(p, fsImpl) {
+  try { return JSON.parse(fsImpl.readFileSync(p, 'utf8')); } catch { return null; }
+}
+
+// The core version a script belongs to: the nearest enclosing @bongos/core package, or a
+// source checkout's CORE_VERSION. Null when neither is found.
+function coreVersionFor(scriptPath, { fsImpl = fs } = {}) {
+  let dir = P.dirname(String(scriptPath || ''));
+  for (;;) {
+    const pkg = readJson(P.join(dir, 'package.json'), fsImpl);
+    if (pkg && CORE_NAMES.includes(pkg.name) && pkg.version) return String(pkg.version);
+    try {
+      const m = String(fsImpl.readFileSync(P.join(dir, 'src', 'module-api.js'), 'utf8')).match(/CORE_VERSION\s*=\s*['"]([^'"]+)['"]/);
+      if (m) return m[1];
+    } catch { /* not a checkout root */ }
+    const up = P.dirname(dir);
+    if (up === dir) return null;
+    dir = up;
+  }
+}
+
+function installedCoreVersion(instanceRoot, { fsImpl = fs } = {}) {
+  if (!instanceRoot) return null;
+  for (const name of CORE_NAMES) {
+    const pkg = readJson(P.join(instanceRoot, 'node_modules', name, 'package.json'), fsImpl);
+    if (pkg && pkg.version) return String(pkg.version);
+  }
+  return null;
+}
+
+function assessExecStart({ workingDirectory, execStart, instanceVersion, instanceRoot, fsImpl }) {
+  const scriptPath = runnerScriptPath({ workingDirectory, execStart });
+  const base = { scriptPath, runnerVersion: null, instanceVersion };
+  if (!scriptPath) return { ...base, status: 'unresolved', reason: `ExecStart does not run a .js script directly (${execStart}) — cannot tell which core it loads` };
+  const runnerVersion = coreVersionFor(scriptPath, { fsImpl });
+  const found = { ...base, runnerVersion };
+  if (!runnerVersion) return { ...found, status: 'unresolved', reason: `no core version found above ${scriptPath}` };
+  if (!instanceVersion) return { ...found, status: 'unresolved', reason: `no installed @bongos/core under ${instanceRoot}` };
+  if (runnerVersion === instanceVersion) return { ...found, status: 'ok', reason: `runs core ${runnerVersion}` };
+  return { ...found, status: 'drift', reason: `runs core ${runnerVersion} (${scriptPath}) but the instance installed ${instanceVersion} at ${instanceRoot}` };
+}
+
+// One verdict per unit, from its WORST ExecStart: drift, then unresolved, then ok.
+function assessRunnerUnit({ name, catText, instanceRoot, fsImpl = fs }) {
+  const { workingDirectory, execStarts } = effectiveUnit(catText);
+  const instanceVersion = installedCoreVersion(instanceRoot, { fsImpl });
+  if (!execStarts.length) return { name, status: 'unresolved', reason: 'no ExecStart in the unit', scriptPath: null, runnerVersion: null, instanceVersion };
+  const all = execStarts.map((execStart) => assessExecStart({ workingDirectory, execStart, instanceVersion, instanceRoot, fsImpl }));
+  const worst = ['drift', 'unresolved', 'ok'].map((s) => all.find((r) => r.status === s)).find(Boolean);
+  return { name, ...worst };
+}
+
+function parseUnitList(stdout) {
+  return String(stdout || '').split(/\r?\n/).map((l) => l.trim().split(/\s+/)[0]).filter((n) => n && n.endsWith('.service'));
+}
+
+// The first line of every run-intents, so a journal grep shows a stale runner at once.
+function runnerBanner({ runnerVersion, runnerRoot, instanceVersion, instanceRoot }) {
+  const tail = instanceVersion ? `instance core ${instanceVersion} at ${instanceRoot}` : `no installed core at ${instanceRoot}`;
+  const line = `runner core ${runnerVersion || '?'} from ${runnerRoot} (${tail})`;
+  return runnerVersion && instanceVersion && runnerVersion !== instanceVersion ? `⚠ DRIFT: ${line}` : line;
+}
+
+// Every intent-runner unit on this host, assessed. Null when there is no systemd to ask.
+function collectRunnerDrift({ instanceRoot }) {
+  const run = (args) => spawnSync('systemctl', args, { encoding: 'utf8', timeout: 15000 });
+  const list = run(['list-units', '--all', '--plain', '--no-legend', '--no-pager', '--type=service', '*intent-runner*']);
+  if (list.error || list.status !== 0) return null;
+  return parseUnitList(list.stdout).map((name) => {
+    const cat = run(['cat', '--no-pager', name]);
+    return assessRunnerUnit({ name, catText: cat.status === 0 ? cat.stdout : '', instanceRoot });
+  });
+}
+
+function main(argv) {
+  const at = argv.indexOf('--instance-root');
+  const instanceRoot = (at >= 0 ? argv[at + 1] : null) || process.env.BONGOS_INSTANCE_ROOT;
+  if (!instanceRoot) {
+    console.error('runner-drift: name the instance root — --instance-root <dir> or BONGOS_INSTANCE_ROOT');
+    return 2;
+  }
+  const results = collectRunnerDrift({ instanceRoot });
+  if (argv.includes('--json')) console.log(JSON.stringify({ instanceRoot, systemd: results !== null, units: results || [] }, null, 2));
+  else if (results === null) console.log('runner-drift: no systemd on this host — nothing to check');
+  else if (!results.length) console.log('runner-drift: no *intent-runner* units on this host');
+  else for (const r of results) console.log(`${r.status === 'ok' ? '✓' : r.status === 'drift' ? '✖' : '?'} ${r.name}: ${r.reason}`);
+  return results && results.some((r) => r.status === 'drift') ? 1 : 0;
+}
+
+module.exports = { effectiveUnit, runnerScriptPath, coreVersionFor, installedCoreVersion, assessRunnerUnit, parseUnitList, runnerBanner, collectRunnerDrift };
+
+if (require.main === module) process.exitCode = main(process.argv.slice(2));

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.836'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.837'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/provision.mjs

@@ -1219,6 +1219,21 @@ await ta('cmdRunIntents (dry-run) lists the pending queue, runs nothing', async
   assert.equal(r.ran, 0);
 });
 
+await ta('cmdRunIntents opens with the runner core version + path, so a journal grep shows a stale runner (task 1002722)', async () => {
+  for (const apply of [false, true]) {
+    const lines = [];
+    const deps = {
+      apply, log: (l) => lines.push(l), instanceRoot: '/no/such/instance',
+      db: { query: async () => ({ rows: [] }) },
+      provisioning: { claimNextIntent: async () => null, claimNextOAuthManifest: async () => null },
+      exec: () => ({ ok: true }), writeFile: () => ({ ok: true }),
+    };
+    await P.cmdRunIntents(deps);
+    const { REPO_ROOT } = require('../scripts/gds/provision-config.js');
+    assert.equal(lines[0], `runner core ${P.coreVersionSafe()} from ${REPO_ROOT} (no installed core at /no/such/instance)`, `apply=${apply}`);
+  }
+});
+
 await ta('cmdRunIntents (--apply) claims → provisions → resolves the intent done', async () => {
   let claims = 0; const resolved = [];
   const deps = {
@@ -2240,6 +2255,9 @@ await ta('cmdRunIntents (--apply): an UNKNOWN intent action never falls through
   assert.equal(resolved.length, 1);
   assert.equal(resolved[0].state, 'error');
   assert.ok(!cmds.some((c) => /systemctl (stop|disable)/.test(c)), 'no teardown commands ran');
+  // task 1002722 (the refusal itself landed in task 1002692): the error names the action AND
+  // the runner's core, so a stale runner is diagnosable from the intent row alone.
+  assert.equal(resolved[0].err, `unknown_action 'oauth-manifest' — runner core ${P.coreVersionSafe()} does not know it (runner too old?); refusing to guess`);
 });
 
 console.log('\nprovisioning truthfulness (task 1002720 — QA-walk F15/F16/F19):');

package/tests/runner_drift.mjs

@@ -0,0 +1,173 @@
+// tests/runner_drift.mjs — the intent-runner drift gate (task 1002722).
+//
+// The incident: for weeks the prod intent runners ran core 1.19.2 from a retired clone while
+// the instance served a current core, so an owner's domain-attach click executed as a
+// TEARDOWN (task 1002716). The hotfix repointed the units with systemd drop-ins. These cases
+// pin the reading of a unit the way systemd reads it (a drop-in overrides the base file) and
+// the version comparison, against a fake filesystem shaped like the live box.
+//
+// Run:  node tests/runner_drift.mjs
+
+import { strict as assert } from 'node:assert';
+import { readFileSync } from 'node:fs';
+import { effectiveUnit, runnerScriptPath, coreVersionFor, installedCoreVersion, assessRunnerUnit, parseUnitList, runnerBanner } from '../scripts/gds/runner-drift.js';
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// The live selfhost unit as `systemctl cat` prints it (2026-09-17): base file + drop-in.
+const LIVE_CAT = `# /etc/systemd/system/selfhost-provision-intent-runner.service
+[Service]
+Type=oneshot
+WorkingDirectory=/home/lars/cloudbongos
+EnvironmentFile=/etc/cloudbongos/box.env
+ExecStart=/usr/bin/env bash infra/core-node.sh scripts/gds/provision.js run-intents --apply
+
+# /etc/systemd/system/selfhost-provision-intent-runner.service.d/override.conf
+[Service]
+WorkingDirectory=/home/lars/cloudbongos-instance
+ExecStart=
+ExecStart=/usr/bin/node node_modules/@bongos/core/scripts/gds/provision.js run-intents --apply
+`;
+
+// A fake fs: path → file body. Only readFileSync + existsSync are used.
+function fakeFs(files) {
+  return {
+    existsSync: (p) => Object.prototype.hasOwnProperty.call(files, p),
+    readFileSync: (p) => { if (!(p in files)) { const e = new Error(`ENOENT ${p}`); e.code = 'ENOENT'; throw e; } return files[p]; },
+  };
+}
+const pkg = (name, version) => JSON.stringify({ name, version });
+const INSTANCE = '/home/lars/cloudbongos-instance';
+const boxFs = (installed, runnerPkg = installed) => fakeFs({
+  [`${INSTANCE}/node_modules/@bongos/core/package.json`]: pkg('@bongos/core', installed),
+  [`${INSTANCE}/package.json`]: pkg('cloudbongos-instance', '0.0.1'),
+  ...(runnerPkg !== installed ? { '/opt/other/node_modules/@bongos/core/package.json': pkg('@bongos/core', runnerPkg) } : {}),
+  '/home/lars/cloudbongos/src/module-api.js': "const CORE_VERSION = '1.19.2'; // old clone\n",
+  '/home/lars/cloudbongos/package.json': pkg('cloud-bongos', '0.0.2'),
+});
+
+t('effectiveUnit: a drop-in WorkingDirectory wins, and an empty ExecStart= resets the base one', () => {
+  assert.deepEqual(effectiveUnit(LIVE_CAT), {
+    workingDirectory: INSTANCE,
+    execStarts: ['/usr/bin/node node_modules/@bongos/core/scripts/gds/provision.js run-intents --apply'],
+  });
+});
+
+t('effectiveUnit: with no drop-in the base file stands (the pre-hotfix shape)', () => {
+  const base = LIVE_CAT.split('# /etc/systemd/system/selfhost-provision-intent-runner.service.d')[0];
+  const u = effectiveUnit(base);
+  assert.equal(u.workingDirectory, '/home/lars/cloudbongos');
+  assert.equal(u.execStarts.length, 1);
+  assert.match(u.execStarts[0], /infra\/core-node\.sh/);
+});
+
+t('assessRunnerUnit: a drop-in that ADDS an ExecStart without clearing leaves the stale base command running — never ok', () => {
+  const cat = LIVE_CAT.replace('ExecStart=\nExecStart=/usr/bin/node', 'ExecStart=/usr/bin/node')
+    .replace('ExecStart=/usr/bin/env bash infra/core-node.sh scripts/gds/provision.js run-intents --apply', 'ExecStart=/usr/bin/node /home/lars/cloudbongos/scripts/gds/provision.js run-intents --apply');
+  assert.equal(effectiveUnit(cat).execStarts.length, 2);
+  const r = assessRunnerUnit({ name: 'x', catText: cat, instanceRoot: INSTANCE, fsImpl: boxFs('1.19.831') });
+  assert.equal(r.status, 'drift', r.reason);
+  assert.match(r.reason, /1\.19\.2/);
+});
+
+t('runnerScriptPath: node + a relative script resolves against WorkingDirectory; a wrapper resolves to null', () => {
+  assert.equal(runnerScriptPath({ workingDirectory: INSTANCE, execStart: '/usr/bin/node node_modules/@bongos/core/scripts/gds/provision.js run-intents --apply' }),
+    `${INSTANCE}/node_modules/@bongos/core/scripts/gds/provision.js`);
+  assert.equal(runnerScriptPath({ workingDirectory: '/w', execStart: '/usr/bin/env node /abs/core/scripts/gds/box.js run-intents' }), '/abs/core/scripts/gds/box.js');
+  assert.equal(runnerScriptPath({ workingDirectory: '/w', execStart: '-/usr/bin/node scripts/gds/box.js' }), '/w/scripts/gds/box.js', 'systemd exec prefixes are stripped');
+  assert.equal(runnerScriptPath({ workingDirectory: '/w', execStart: '/usr/bin/env NODE_ENV=production node --max-old-space-size=512 scripts/gds/box.js' }), '/w/scripts/gds/box.js', 'env assignments and node flags are skipped');
+  assert.equal(runnerScriptPath({ workingDirectory: '/w', execStart: '/usr/bin/env bash infra/core-node.sh scripts/gds/provision.js' }), null,
+    'a shell wrapper decides at runtime which core it loads — the gate must not guess');
+});
+
+t('coreVersionFor: an installed package reads its package.json; a source checkout reads CORE_VERSION', () => {
+  const fs = boxFs('1.19.831');
+  assert.equal(coreVersionFor(`${INSTANCE}/node_modules/@bongos/core/scripts/gds/provision.js`, { fsImpl: fs }), '1.19.831');
+  assert.equal(coreVersionFor('/home/lars/cloudbongos/scripts/gds/provision.js', { fsImpl: fs }), '1.19.2');
+  assert.equal(coreVersionFor('/nowhere/scripts/gds/provision.js', { fsImpl: fs }), null);
+});
+
+t('installedCoreVersion: reads <root>/node_modules/@bongos/core; null when absent', () => {
+  assert.equal(installedCoreVersion(INSTANCE, { fsImpl: boxFs('1.19.831') }), '1.19.831');
+  assert.equal(installedCoreVersion('/empty', { fsImpl: boxFs('1.19.831') }), null);
+});
+
+t('assessRunnerUnit: the live drop-in shape is ok', () => {
+  const r = assessRunnerUnit({ name: 'selfhost-provision-intent-runner.service', catText: LIVE_CAT, instanceRoot: INSTANCE, fsImpl: boxFs('1.19.831') });
+  assert.equal(r.status, 'ok', r.reason);
+  assert.equal(r.runnerVersion, '1.19.831');
+});
+
+t('assessRunnerUnit: a unit running a source clone on another core is DRIFT, naming both versions', () => {
+  const cat = LIVE_CAT.replace(/ExecStart=\/usr\/bin\/node node_modules[^\n]*/, 'ExecStart=/usr/bin/node /home/lars/cloudbongos/scripts/gds/provision.js run-intents --apply');
+  const r = assessRunnerUnit({ name: 'x.service', catText: cat, instanceRoot: INSTANCE, fsImpl: boxFs('1.19.831') });
+  assert.equal(r.status, 'drift');
+  assert.match(r.reason, /1\.19\.2/);
+  assert.match(r.reason, /1\.19\.831/);
+});
+
+t('assessRunnerUnit: a wrapper, or a version it cannot read, is UNRESOLVED — never reported as ok', () => {
+  const base = LIVE_CAT.split('# /etc/systemd/system/selfhost-provision-intent-runner.service.d')[0];
+  assert.equal(assessRunnerUnit({ name: 'x', catText: base, instanceRoot: INSTANCE, fsImpl: boxFs('1.19.831') }).status, 'unresolved');
+  assert.equal(assessRunnerUnit({ name: 'x', catText: LIVE_CAT, instanceRoot: '/empty', fsImpl: boxFs('1.19.831') }).status, 'unresolved');
+  assert.equal(assessRunnerUnit({ name: 'x', catText: '', instanceRoot: INSTANCE, fsImpl: boxFs('1.19.831') }).status, 'unresolved');
+});
+
+t('parseUnitList: plain list-units output → service names only', () => {
+  const out = 'cohost-provision-intent-runner.service loaded inactive dead Cloud Bongos — drain\nselfhost-provision-intent-runner.service loaded inactive dead x\n\n';
+  assert.deepEqual(parseUnitList(out), ['cohost-provision-intent-runner.service', 'selfhost-provision-intent-runner.service']);
+  assert.deepEqual(parseUnitList(''), []);
+});
+
+t('runnerBanner: names the runner core + path, and flags a differing instance core', () => {
+  assert.equal(runnerBanner({ runnerVersion: '1.19.831', runnerRoot: '/r', instanceVersion: '1.19.831', instanceRoot: '/i' }),
+    'runner core 1.19.831 from /r (instance core 1.19.831 at /i)');
+  assert.match(runnerBanner({ runnerVersion: '1.19.2', runnerRoot: '/r', instanceVersion: '1.19.831', instanceRoot: '/i' }), /^⚠ DRIFT: runner core 1\.19\.2 from \/r \(instance core 1\.19\.831 at \/i\)/);
+  assert.equal(runnerBanner({ runnerVersion: null, runnerRoot: '/r', instanceVersion: null, instanceRoot: '/i' }), 'runner core ? from /r (no installed core at /i)');
+});
+
+// box.js run-intents is the other runner the incident class covers — it opens with the same line.
+const { cmdRunIntents: boxRunIntents } = await import('../scripts/gds/box.js');
+{
+  const lines = [];
+  const origLog = console.log;
+  const origRoot = process.env.BONGOS_INSTANCE_ROOT;
+  process.env.BONGOS_INSTANCE_ROOT = '/no/such/instance';
+  console.log = (l) => lines.push(String(l));
+  try { await boxRunIntents({ query: async () => ({ rows: [] }) }, {}, null, { apply: false }); }
+  finally {
+    console.log = origLog;
+    if (origRoot === undefined) delete process.env.BONGOS_INSTANCE_ROOT; else process.env.BONGOS_INSTANCE_ROOT = origRoot;
+  }
+  t('box.js run-intents opens with the runner core version line', () => {
+    assert.match(lines[0], /^runner core \d+\.\d+\.\d+ from .+ \(no installed core at \/no\/such\/instance\)$/);
+  });
+}
+
+const { runnerDriftRows } = await import('../scripts/gds/doctor.js');
+
+t('doctor maps each verdict to a row: ok → ok, drift → FAIL with the fix, unresolved → warn', () => {
+  const rows = runnerDriftRows([
+    { name: 'a.service', status: 'ok', reason: 'runs core 1.19.831' },
+    { name: 'b.service', status: 'drift', reason: 'runs core 1.19.2 (/x) but the instance installed 1.19.831 at /i' },
+    { name: 'c.service', status: 'unresolved', reason: 'ExecStart does not run a .js script directly' },
+  ]);
+  assert.deepEqual(rows.map((r) => r.status), ['ok', 'fail', 'warn']);
+  assert.equal(rows[0].msg, 'a.service: runs core 1.19.831');
+  assert.match(rows[1].msg, /^b\.service: runs core 1\.19\.2 .* — repoint the unit's WorkingDirectory \+ ExecStart at the installed core/);
+  assert.equal(rows[2].msg, 'c.service: ExecStart does not run a .js script directly');
+  assert.deepEqual(runnerDriftRows(null), [], 'no systemd → no rows, so a laptop shows no section');
+  assert.deepEqual(runnerDriftRows([]), []);
+});
+
+t('doctor runs the runner-drift probe', () => {
+  const src = readFileSync(new URL('../scripts/gds/doctor.js', import.meta.url), 'utf8');
+  assert.match(src.slice(src.indexOf('require.main === module')), /checkRunnerDrift\(\)/);
+});
+
+console.log(`\nrunner_drift: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);