@bongos/core 1.19.955 → 1.19.957

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.955",
-  "core_contract": "1.19.955",
-  "source_commit": "3595ab322a25adbfb15980ecfbf3277c095e0d4b",
+  "core_version": "1.19.957",
+  "core_contract": "1.19.957",
+  "source_commit": "48e752cc136cf78939c24f100a08934f3516ed57",
   "source_ref": "HEAD",
-  "built_at": "2026-09-22T05:17:25.737Z",
+  "built_at": "2026-09-22T05:59:48.593Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 514,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2355,
+    "functional_verbatim": 2357,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2895,
-  "tree_sha256": "cb656bb0b99f15d870988930f28520127a84bbc30f2c897df885ef8139504e4a",
+  "file_count": 2897,
+  "tree_sha256": "3689a1fe6b51b1bde5cd80dc5e42e2111685ccd0ebc8f39c411ac17f4e1ff040",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2117,12 +2117,12 @@
     {
       "path": "docs/adr/0325-the-managed-fleet-control-plane-is-the-hub-we-already-run.md",
       "mode": "0000644",
-      "sha256": "cf6e701b8791462057fa5bc53dc716ef8f80b8ee2efa12a07581305f788a5e48"
+      "sha256": "6ae902e7626feb915300f4b21b6d20ae3369116a86bf624bd614ac9616c3ac11"
     },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "8d2b9a793fed7214d50fa667848b6c3037f129bff3e33113071bdbcd5acc34cf"
+      "sha256": "5db407e3565216666055365b11a5ff05b8901ff9c7fbaee011c93784c40762e6"
     },
     {
       "path": "docs/api-reference.md",
@@ -2692,7 +2692,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "e153e8b45c3cda248dfa42e233d2650353711b41650e7066287d94a43a347fc8"
+      "sha256": "d24452f51a99862ee117d68ebed98474ef8599cbbad464ad4ea07f19e760f528"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6702,7 +6702,12 @@
     {
       "path": "modules/provisioning/pollers/liveness-sweep.js",
       "mode": "0000644",
-      "sha256": "90db999a2e1d3dec2e3910281e2e5dccd55cf294d7c5c38233456c29d71bacd3"
+      "sha256": "b7db2ecae7e3df06646e04f5203a6ac8bbb61b301ccde833d2024d9d2ba64394"
+    },
+    {
+      "path": "modules/provisioning/pollers/runner-drift-notify.js",
+      "mode": "0000644",
+      "sha256": "8d861e41d66c9c14995db3921ab0b225d3abdafceda5edc0029a4020d47fe3b4"
     },
     {
       "path": "modules/provisioning/provisioning.js",
@@ -8072,12 +8077,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "4e5b09dee33c9b46fdc4e4e0a1025df50e79bdcad9ed6be9aee8d81a52d14953"
+      "sha256": "e6926dbbee5927840a3de03f03dff14b05a04ecdc2dd974941f93cca760c745e"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "e8b75ca994f900a282dedd9e5c0589c151f3e8b0eab513e4c51b4ed254ab34f2"
+      "sha256": "4f9672ddf0e6238c689b8884f85fdb3a5c85174b934d0ab57c79d8bd49acab6a"
     },
     {
       "path": "public-docs/index.html",
@@ -10082,7 +10087,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "a3909e0963c8f56e17bca596d30f27ee3e10100cefb055bf8a2f3506139a18ed"
+      "sha256": "fdab385d81b456d0cf1197085a21cac0e3e57b6d89a8a7c890d10248a16f25bf"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -13249,6 +13254,11 @@
       "mode": "0000644",
       "sha256": "f31a8fc12866f7d639b7472578422e29129db85bbd9ddecb663e753393d74e2a"
     },
+    {
+      "path": "tests/provisioning_runner_drift_notice.mjs",
+      "mode": "0000644",
+      "sha256": "18662f6f446b33a677ffc71dd7115f8e59997d6f86adbadcd91e5e4bdac2fd76"
+    },
     {
       "path": "tests/provisioning_settings.mjs",
       "mode": "0000644",

package/docs/adr/0325-the-managed-fleet-control-plane-is-the-hub-we-already-run.md

@@ -7,7 +7,7 @@
 - **Supersedes in part:** [ADR 0111](0111-instance-hosting-provisioning-module.md) §5/§7 (the "managed layer is greenfield, deferred, spec-first" sequencing)
 - **Depends on:** [ADR 0323](0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md) (the shapes and the platform this operates)
 - **Gates:** [task 1004142](https://cloudbongos.com/builders#/task/1004142) (the platform leg) · [task 1001949](https://cloudbongos.com/builders#/task/1001949) (metering) · [task 1001621](https://cloudbongos.com/builders#/task/1001621) (the spend rollup)
-- **Filed by this ADR:** [task 1004149](https://cloudbongos.com/builders#/task/1004149) (the $0 cost ledger — decision 6) · [task 1004150](https://cloudbongos.com/builders#/task/1004150) (the subscription roster — decision 5)
+- **Filed by this ADR:** [task 1004148](https://cloudbongos.com/builders#/task/1004148) (the $0 cost ledger — decision 6) · [task 1004150](https://cloudbongos.com/builders#/task/1004150) (the subscription roster — decision 5)
 
 ## Context
 
@@ -63,7 +63,7 @@ This ADR records the direction and files it as [task 1004150](https://cloudbongo
 
 `costEstimateUsd` returns **0** for `standalone` — correct when a project was a process on a box we already paid for, and wrong the moment it becomes a ~$14/month Render service. Until it is fixed the fleet cost ledger reports \$0 for every project the platform is about to be billed for, and it reports it with no error.
 
-That is a defect, not a deferral, and it is filed as [task 1004149](https://cloudbongos.com/builders#/task/1004149). The metering and invoicing track ([task 1001949](https://cloudbongos.com/builders#/task/1001949)) and the spend rollup ([task 1001621](https://cloudbongos.com/builders#/task/1001621)) stay separate work, as [ADR 0323](0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md) already says.
+That is a defect, not a deferral, and it is filed as [task 1004148](https://cloudbongos.com/builders#/task/1004148). The metering and invoicing track ([task 1001949](https://cloudbongos.com/builders#/task/1001949)) and the spend rollup ([task 1001621](https://cloudbongos.com/builders#/task/1001621)) stay separate work, as [ADR 0323](0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md) already says.
 
 ## Consequences
 

package/docs/adr/README.md

@@ -416,4 +416,4 @@ This keeps the decision history honest and traceable.
 | 0322 | [**The five states are derived once, and a remnant needs evidence** ([task 1004103](https://cloudbongos.com/builders#/task/1004103), goal 1000095 — BONGOS-V2). The ideator surface draws a thought as one of five objects — star, protostar, satellite, remnant, cold body — and three surfaces are about to draw them (the room, the descent, the sky). Every fact already existed: `idea_inbox.status` (`core_195`), [ADR 0321](0321-brightness-is-a-weighted-share-and-the-targets-are-a-row.md)’s `hasWork` / `share` / `attributable`, and `tasks.goal_id` + `tasks.status`. What was missing was ONE place that reads them: a state inferred in three renderers is three states, and the sky can say a thought went out while the room beside it still calls it alive, with nothing erroring. **Decision:** one pure resolver (`modules/ideas/idea-state.js`), brightness exposed on the `reward` port (ideas may not reach `credit_log` any other way — [ADR 0083](0083-modular-architecture-strangler-build-plan.md) rule 1 — and already declares `reward` in `consumes`), and the ORDER of the tests IS the decision. **MERGED wins over everything:** a folded thought keeps its own money (`trail-size.js` is emphatic) but is no longer its own point in the sky, so letting work win draws one idea twice, beside the thought that absorbed it. **WORK beats a DISCARD:** a cold body “never ignited, so it has no size at all” is a stated PROPERTY, and testing work first makes it true by construction — triage really can discard a duplicate whose twin already routed and paid, and `updateIdea` never touches the ledger. **A REMNANT needs EVIDENCE, never the absence of an answer:** `share: 0` is a confirmed removal, `share: null` is an unreadable one, and ADR 0321 pays for that distinction upstream — so an idea with work and no readable facts is a STAR carrying `attributable: false`, because reading a falsy share as death turns one unmounted module into a sky of hollow rings. **A PROTOSTAR is the absence of WORK, not of a status:** ignition is being PAID for something, so a promoted-but-unshipped idea is still unignited, which is exactly what the nod queue exists for. **Position is a second axis** (`well` / `open-space` / `awaitingNod`) because the design says the object alone cannot carry it, and the nod is asked of EVERY task, not only the one that named the well. **`suggested_goal_id` is deliberately NOT a well** — `projection.js` records it as strictly advisory, the routing hint on a filing that did not convert, so reading it would put a thought in a nod queue with no task to promote; the binding `tasks.goal_id` now rides on both of the trail’s task joins at no extra round trip. The page reads the ledger ONCE: the state attach hands economy back the `byTask` breakdown size just computed, all of them or none (a partial map reads a missing entry as “no work” and draws a paid star as a protostar). An absent `reward` port does not empty the sky — states still resolve, flagged unattributable. Nothing writes; ADR 0313 stands. Rejected: resolving in each renderer; deriving from `share` alone (it merges a protostar with a remnant, the exact BV2.R19 distinction); treating an unreadable share as zero; status-first ordering; reading the hint as a home; a sixth object for “unknown brightness” (the vocabulary is the owner’s and is five — the uncertainty is a flag on the answer, not a new thing in the sky).](0322-a-remnant-needs-evidence-and-merged-wins.md) | ideas / economy |
 | 0323 | [**Hosting is three shapes, and we are not the landlord** ([task 1004140](https://cloudbongos.com/builders#/task/1004140), goal 1000106 — BONGOS-V2). Five projects ran as one Node process each on the control-plane droplet, about $0.80/month apiece — the cheapest arrangement available, bought with ~4,600 lines of `provision*.js` that write systemd units, create unix accounts, render Caddy snippets, `createdb`, install backup timers and count memory against a ceiling. That is the cost nobody priced: **we are a landlord.** The owner reframed the question — build on what others maintain, and let an owner keep the deployment platform they already use. **Seven decisions.** The shapes become `byo-host` (the owner runs it), `cloud-host` (we stand it up for them) and `dedicated-cloud-host` (the same path, larger plan); `co-tenant` is **retired, not renamed**, because it means *a process on our box from our checkout* — the opposite of bring-your-own-host, so reusing the name would make every existing comment lie. **DigitalOcean hosts hubs only**, which closes [ADR 0145](0145-free-hosted-project-tier-isolation-and-domain-separation.md) Finding 1 by removing its precondition rather than hardening the cookie: with no customer code on a `cloudbongos.com` subdomain there is no tenant to receive the hub session. **Render is the default** — its Postgres carries PITR and automated backups on every paid tier; Fly's managed Postgres starts ~$38/mo and Railway's is explicitly unmanaged, which is the exact responsibility being shed. **Cloudflare is the front door, not the compute**: Workers is a V8-isolate runtime that would require rewriting Express and `pg`, and Containers is built for bursty workloads that sleep, which a hall with background sweeps and a live event stream does not survive. **No deployment-platform adapter is built at all** — their application already deploys itself from the repository, so the platform we do not talk to is the platform we do not have to add. **Secrets: the platform is the system of record and Bongos stores names, never values** — a manifest of name, purpose and environment, no application secret, no platform API token, no "is it set?" probe, because each of those makes us custodian of other companies' credentials for convenience the manifest already delivers; `byo-host` marks the manifest unverifiable rather than opening an exception. **The free tier becomes a capped trial**, since ~$14/project cannot be subsidised indefinitely. Per-project cost rises ~17×, which is the price of not being a landlord and the reason metering stops being deferred work. Mostly a DELETION: [ADR 0306](0306-instance-supervision-is-a-seam-with-systemd-as-the-default.md)'s supervision seam is not extended (Render supervises its own processes), [ADR 0285](0285-a-shared-box-holds-about-twelve-projects-per-gb-and-memory-is-the-wall.md) stays true and stops being load-bearing with its queued resize held rather than spent, and the hub's offsite backup becomes the highest-consequence open item. Rejected: AWS/GCP (2–3× the cost for a bare instance, plus an IAM and billing surface to learn — maintenance added where the goal is to remove it); keeping the shared box and fixing only the cookie (cheaper, closes the finding, leaves the landlord runner and answers nothing else); a Vercel/Netlify/Render adapter layer (speculative pluggability); Bongos as the secrets vault pushing values through platform APIs.](0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md) | hosting / provisioning / cost |
 | 0324 | [**The public npm CLI channel is retired** ([task 1004144](https://cloudbongos.com/builders#/task/1004144), goal 1000091 — BONGOS-V2). The owner deleted `@cloudbongos/cli` from the registry on 2026-09-22 (`npm view` → E404; the `@cloudbongos` scope is empty). This supersedes [ADR 0258](0258-the-public-cli-is-a-generated-client-package-not-the-published-core.md) and [ADR 0292](0292-both-install-paths-stay-and-vendoring-is-the-production-one.md) §2 — the latter titled "`@cloudbongos/cli` STAYS, on a new justification" and written *because* task 1003872 proposed removing it once the public core flip dissolved its original reason. 0292's measured argument (~0.5 MB front door vs a 46 MB core pull to print a task list) is still true and is NOT what changed; the owner's decision about carrying a public channel at all is. `scripts/gds/build-cli-package.js` + `tests/cli_package.mjs` are deleted, no doc offers `npx @cloudbongos/cli`, and the way in is the hall at `<origin>/builders` or a checkout. The COMPILED binary channel (`build-bongos.js` → `/downloads/bongos/*` via `config/bongos-cli.json`) is a different artifact and is untouched — the same near-twin task 1003889 warned about. Three tests used the package's FILES manifest as a stand-in for "what a terminal user can run" and now read `bin/bongos.js`'s verb table, which is what that set always meant.](0324-the-public-npm-cli-channel-is-retired.md) | distribution / CLI |
-| 0325 | [**The managed fleet control plane is the hub we already run** ([task 1001948](https://cloudbongos.com/builders#/task/1001948), goal 1000106 — BONGOS-V2). The spike was written against [ADR 0111](0111-instance-hosting-provisioning-module.md) §5/§7, which deferred the managed offering as **"genuinely greenfield (no fleet registry exists)"** behind two gates — Mercury and a real `bongos upgrade`. Both gates are shipped and **the premise is not**: measuring the call sites first changed the answer, as it did for [task 1004141](https://cloudbongos.com/builders#/task/1004141). The registry is `provisioning_instances` (owner, shape, domain, database, port, lifecycle, cost estimate, module selection, the liveness overlay and the served/available core-version snapshot), with `provisioning_intents` as the queue and `provisioning_events` as the audit trail; the operator is `scripts/gds/provision.js`, the single token-holder draining that queue behind ADR 0111 §2's trust boundary; oversight is `GET /provisioning/fleet` and `/fleet/cost-ledger`; and the update channel is not one mechanism but two shipped ones — the owner's per-instance deploy door ([ADR 0293](0293-the-owners-deploy-door-is-an-intent-the-control-plane-drains.md), health-gated with auto-rollback) and the opt-in patch-only sweep ([ADR 0136](0136-update-channel-subscription-policy.md)). **Decision: there is no greenfield fleet control plane to design, and none will be built — the hub IS it.** It never needed to sit *above* the per-repo databases [ADR 0100](0100-two-repo-instance-model.md) §3 locks: the roster is a hub table and the operator has never read one. The genuinely missing leg is a **platform leg** — `grep -rl RENDER_API scripts modules src` returns nothing, and after [ADR 0323](0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md) a `cloud-host` is a Render service — and this ADR **deliberately specifies none of it**, because that is [task 1004142](https://cloudbongos.com/builders#/task/1004142)'s with those files open and a second spec for one implementation is how two drift. The fleet **driven** and the fleet **observed** are different populations: `byo-host` is in the registry and operated by nobody, its liveness the [ADR 0252](0252-the-self-hosted-visibility-report-is-a-pull-and-auto-appear-buys-a-retraction-lever.md) pull, so every operator surface must state which it counts — a roster that mixes them reports a fleet-wide upgrade as complete while an unknown number were never asked. The operator holds **exactly one** credential and it is **its own** (the platform account token, root-only on the control plane, never the web tier, never per-customer); ADR 0323 D6's "names, never values" rule is about the CUSTOMER's secrets and is unchanged. Two gaps are filed rather than fixed here: the subscription roster living in `config/update-subscriptions.json` is the one fleet fact the roster route cannot report and a restored backup can lose independently of the rows it describes ([task 1004150](https://cloudbongos.com/builders#/task/1004150), a recommendation and not a ruling), and **`costEstimateUsd` returns 0 for every shape but `dedicated`** — measured live, all 24 fleet rows report `$0`, confidently and with no error, for projects about to cost ~\$14/month each ([task 1004149](https://cloudbongos.com/builders#/task/1004149)). **No fleet-wide "upgrade everything" button**: both channels are per-instance by construction, and one action that moves the whole fleet is the shape most likely to take every customer down at once. AGPL posture unchanged — ADR 0111 §5's one-sentence rule survives its own table. Rejected: building the separate control plane §5 described (a second registry and a second operator holding the same rows with nothing keeping them equal); specifying Render here; reading per-instance databases for fleet reporting; and continuing to defer the whole layer, which is now the reason the ledger reads \$0 for a fleet about to cost real money.](0325-the-managed-fleet-control-plane-is-the-hub-we-already-run.md) | hosting / fleet / provisioning |
+| 0325 | [**The managed fleet control plane is the hub we already run** ([task 1001948](https://cloudbongos.com/builders#/task/1001948), goal 1000106 — BONGOS-V2). The spike was written against [ADR 0111](0111-instance-hosting-provisioning-module.md) §5/§7, which deferred the managed offering as **"genuinely greenfield (no fleet registry exists)"** behind two gates — Mercury and a real `bongos upgrade`. Both gates are shipped and **the premise is not**: measuring the call sites first changed the answer, as it did for [task 1004141](https://cloudbongos.com/builders#/task/1004141). The registry is `provisioning_instances` (owner, shape, domain, database, port, lifecycle, cost estimate, module selection, the liveness overlay and the served/available core-version snapshot), with `provisioning_intents` as the queue and `provisioning_events` as the audit trail; the operator is `scripts/gds/provision.js`, the single token-holder draining that queue behind ADR 0111 §2's trust boundary; oversight is `GET /provisioning/fleet` and `/fleet/cost-ledger`; and the update channel is not one mechanism but two shipped ones — the owner's per-instance deploy door ([ADR 0293](0293-the-owners-deploy-door-is-an-intent-the-control-plane-drains.md), health-gated with auto-rollback) and the opt-in patch-only sweep ([ADR 0136](0136-update-channel-subscription-policy.md)). **Decision: there is no greenfield fleet control plane to design, and none will be built — the hub IS it.** It never needed to sit *above* the per-repo databases [ADR 0100](0100-two-repo-instance-model.md) §3 locks: the roster is a hub table and the operator has never read one. The genuinely missing leg is a **platform leg** — `grep -rl RENDER_API scripts modules src` returns nothing, and after [ADR 0323](0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md) a `cloud-host` is a Render service — and this ADR **deliberately specifies none of it**, because that is [task 1004142](https://cloudbongos.com/builders#/task/1004142)'s with those files open and a second spec for one implementation is how two drift. The fleet **driven** and the fleet **observed** are different populations: `byo-host` is in the registry and operated by nobody, its liveness the [ADR 0252](0252-the-self-hosted-visibility-report-is-a-pull-and-auto-appear-buys-a-retraction-lever.md) pull, so every operator surface must state which it counts — a roster that mixes them reports a fleet-wide upgrade as complete while an unknown number were never asked. The operator holds **exactly one** credential and it is **its own** (the platform account token, root-only on the control plane, never the web tier, never per-customer); ADR 0323 D6's "names, never values" rule is about the CUSTOMER's secrets and is unchanged. Two gaps are filed rather than fixed here: the subscription roster living in `config/update-subscriptions.json` is the one fleet fact the roster route cannot report and a restored backup can lose independently of the rows it describes ([task 1004150](https://cloudbongos.com/builders#/task/1004150), a recommendation and not a ruling), and **`costEstimateUsd` returns 0 for every shape but `dedicated`** — measured live, all 24 fleet rows report `$0`, confidently and with no error, for projects about to cost ~\$14/month each ([task 1004148](https://cloudbongos.com/builders#/task/1004148)). **No fleet-wide "upgrade everything" button**: both channels are per-instance by construction, and one action that moves the whole fleet is the shape most likely to take every customer down at once. AGPL posture unchanged — ADR 0111 §5's one-sentence rule survives its own table. Rejected: building the separate control plane §5 described (a second registry and a second operator holding the same rows with nothing keeping them equal); specifying Render here; reading per-instance databases for fleet reporting; and continuing to defer the whole layer, which is now the reason the ledger reads \$0 for a fleet about to cost real money.](0325-the-managed-fleet-control-plane-is-the-hub-we-already-run.md) | hosting / fleet / provisioning |

package/docs/module-api-changelog.md

@@ -2384,5 +2384,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.953 with no explicit bump. run 35687914716. (task 1002620)
   1.19.955 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.954 with no explicit bump. run 35690089430. (task 1002620)
+  1.19.956 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.955 with no explicit bump. run 35691908420. (task 1002620)
+  1.19.957 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.956 with no explicit bump. run 35692861666. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/provisioning/pollers/liveness-sweep.js

@@ -28,12 +28,24 @@ const { Agent: UndiciAgent } = require('undici');
 const api = require('../../../src/module-api');
 const provisioning = require('../provisioning');
 const { planNotices, postNotice } = require('./liveness-notify');
+// task 1004000: the runner-drift check rides this tick rather than installing a timer of
+// its own — the sweep already runs every ~5 min on the one host that can see the systemd
+// units. It reads the checker as a SUBPROCESS, not a require: `scripts/gds/runner-drift.js`
+// is core-package territory (ADR 0083) and its systemctl reads are blocking, so requiring
+// it would have put N×15s of event-loop work in the process serving live traffic. See
+// ./runner-drift-notify.js's header.
+const { planDriftNotices, formatDriftLine, readRunnerDrift } = require('./runner-drift-notify');
 
 // Notice state between sweeps (task 1002894): id → { streak, notified }. In memory
 // on purpose — it is seeded only by a fall this process observed, which is exactly
 // what stops a restarted control plane re-announcing an outage it arrived to find.
 const noticeState = new Map();
-function resetNoticeState() { noticeState.clear(); }
+// Unit names already announced as drifting (task 1004000). In memory like its neighbour,
+// but for the opposite reason: this one exists only to stop a stale runner posting every
+// five minutes forever, NOT to suppress a first sighting — a drift that predates this
+// process is exactly the thing nobody noticed, so a restart re-announcing it is correct.
+const driftState = new Set();
+function resetNoticeState() { noticeState.clear(); driftState.clear(); }
 
 // Name a project in an owner-facing message only when it is public on the platform's
 // map; a private or stealth one is described, never identified.
@@ -241,6 +253,34 @@ async function sweepOnce(deps = {}) {
   for (const notice of plan.notices) {
     try { notify(notice); } catch (e) { log(`[liveness] notice failed (non-blocking): ${e && e.message ? e.message : e}`); }
   }
+
+  // ── runner drift (task 1004000) ───────────────────────────────────────────
+  // Placed at the TAIL, after the account is built and the liveness notices are out, so
+  // that a systemctl hiccup can never cost this tick its liveness verdict — the reason
+  // the whole block is wrapped. `collect` is injected so the composition stays hermetic
+  // in tests; production uses readRunnerDrift, which spawns the checker and answers null
+  // when there is no systemd to ask. AWAITED, and that is the point: the read is a
+  // subprocess rather than a blocking in-process require, so a hung systemctl costs this
+  // tick its drift check and never the event loop serving live requests. Not gated on
+  // `rows.length`: the runners are worth checking on a control plane with no tenant
+  // projects at all.
+  try {
+    const collect = deps.collectRunnerDrift || readRunnerDrift;
+    const instanceRoot = deps.instanceRoot || process.env.BONGOS_INSTANCE_ROOT || process.cwd();
+    const drift = planDriftNotices(await collect({ instanceRoot }), driftState);
+    const line = formatDriftLine(drift);
+    if (line) log(line);
+    for (const notice of drift.notices) {
+      try { notify(notice); } catch (e) { log(`[liveness] drift notice failed (non-blocking): ${e && e.message ? e.message : e}`); }
+    }
+    out.runnerDrift = drift.drifting;
+    out.runnerUnresolved = drift.unresolved;
+  } catch (e) {
+    // A drift check that throws must not take the sweep with it. Logged rather than
+    // swallowed: silence here would be indistinguishable from a healthy host, which is
+    // the exact failure this task was filed about.
+    log(`[drift] check failed (non-blocking): ${e && e.message ? e.message : e}`);
+  }
   return out;
 }
 

package/modules/provisioning/pollers/runner-drift-notify.js

@@ -0,0 +1,203 @@
+'use strict';
+
+// modules/provisioning/pollers/runner-drift-notify.js — say it out loud when an
+// intent-runner unit is pointed at a different core than the instance installed
+// (task 1004000, the follow-up the task 1002722 grade asked for).
+//
+// WHY. Three drift signals already existed and every one of them needed a human to go
+// and look: `scripts/gds/runner-drift.js` exits 1, `bongos doctor` has an "Intent
+// runners" section, and each run-intents tick writes a `⚠ DRIFT:` banner into the
+// journal. A stale runner is exactly the condition nobody is looking for — it drains
+// intents perfectly happily using last month's code — so a signal that waits to be read
+// is a signal that is not doing its job.
+//
+// WHERE IT RUNS. Inside the liveness sweep, not on a timer of its own. The sweep already
+// ticks every ~5 minutes on the control plane, which is the one host that can see the
+// systemd units (CI cannot), and `collectRunnerDrift` is two `systemctl` reads. A second
+// timer would be a second thing to install, a second thing to forget to install, and a
+// second thing whose silence means nothing.
+//
+// HOW IT DIFFERS FROM ITS SIBLING, AND WHY. `./liveness-notify.js` is the pattern here,
+// but two of its three rules are deliberately NOT copied:
+//
+//   * IT ANNOUNCES ON FIRST SIGHT. Liveness stays silent about a project that was already
+//     down before this process started, so that a restarted control plane does not
+//     re-announce an outage it merely arrived to find. Drift is the opposite case: a
+//     runner that has been stale for a fortnight is precisely the thing nobody noticed,
+//     and this task exists because those three signals went unread. Waiting for an edge
+//     would mean the only drift ever announced is drift that begins while the process
+//     happens to be watching.
+//   * THERE IS NO CONFIRM STREAK. Liveness waits out a second sweep because one refused
+//     connection is a blip. Drift is a deterministic read of two files on local disk —
+//     there is no blip to wait out, and a delay would buy nothing but a later notice.
+//
+// The third rule IS copied, and matters more here than there:
+//
+//   * COLLAPSE A FAN-OUT. Every unit drifting at once is one cause — an upgrade moved the
+//     installed core and the units still run the old checkout — so it is ONE message. A
+//     host with several runners would otherwise emit a burst that reads like several
+//     independent faults. Unconditional here rather than threshold-gated; see the note
+//     where liveness's FLEET_GUARD would have been.
+//
+// And one rule of its own:
+//
+//   * `unresolved` IS NOT DRIFT. It means the checker could not tell (an ExecStart that
+//     runs no .js directly, no core version above the script, no installed core). That is
+//     the absence of a verdict, not a bad one, so announcing it would be a siren over
+//     nothing. It is counted into the sweep's log line instead, where it is visible
+//     without being urgent — and a host that is ALL unresolved says so in that line
+//     rather than reading as healthy.
+//
+// HOW IT READS SYSTEMD, AND WHY NOT BY require(). The checker itself is
+// `scripts/gds/runner-drift.js`, which is CORE-package territory: a module may require
+// only the published doorway `src/module-api.js` (ADR 0083, `docs/modules-contract.md`,
+// and this module's own CLAUDE.md header). So this reads it the way its sibling reads
+// `scripts/discord/post.js` — as a SUBPROCESS, `node scripts/gds/runner-drift.js --json`
+// — which crosses no require boundary and needs no new doorway for a fact only the
+// control plane's own host can answer.
+//
+// The subprocess is ALSO the reason this is safe inside the web process. `collectRunnerDrift`
+// uses `spawnSync` with a 15-second timeout per `systemctl` call; requiring it would have
+// put N×15s of blocking work on the event loop that serves live HTTP traffic, once every
+// five minutes. `execFile` is async, so a hung systemctl costs this tick its drift check
+// and nothing else.
+//
+// **A NON-ZERO EXIT IS NOT AN ERROR HERE.** `runner-drift.js` exits 1 precisely WHEN it
+// finds drift — that is its contract as a CI-style gate — so treating a failed exit as a
+// failed read would discard the only result worth reporting. The JSON on stdout is the
+// answer; the exit code is ignored when it parses, and only an unparseable stdout counts
+// as "could not look".
+//
+// PURE except `readRunnerDrift`, which spawns that subprocess, and `postNotice`, which
+// ./liveness-sweep.js imports straight from ./liveness-notify.js — one Discord path, one
+// dry-run switch, one place a webhook change lands.
+
+const { execFile } = require('node:child_process');
+const path = require('node:path');
+
+// scripts/gds/runner-drift.js is invoked from the repo root regardless of cwd, the same
+// way ./liveness-notify.js invokes scripts/discord/post.js.
+const REPO_ROOT = path.resolve(__dirname, '..', '..', '..');
+// Generous next to the checker's own per-call 15s, and it exists so a hung systemctl
+// costs this tick its drift check rather than the tick.
+const READ_TIMEOUT_MS = Number(process.env.PROVISIONING_DRIFT_TIMEOUT_MS) || 30_000;
+
+// Ask the checker what the host's runner units look like. Resolves to the units array, or
+// NULL for "could not look" — no systemd, an unparseable answer, a timeout, a missing
+// script. Null is deliberately not an empty array: "no runner units" and "could not ask"
+// must not read the same, and planDriftNotices treats them differently.
+function readRunnerDrift({ instanceRoot, execFileImpl = execFile, timeoutMs = READ_TIMEOUT_MS } = {}) {
+  return new Promise((resolve) => {
+    let settled = false;
+    const done = (v) => { if (!settled) { settled = true; resolve(v); } };
+    try {
+      execFileImpl('node',
+        ['scripts/gds/runner-drift.js', '--instance-root', String(instanceRoot || ''), '--json'],
+        { cwd: REPO_ROOT, timeout: timeoutMs, maxBuffer: 4 * 1024 * 1024 },
+        (_err, stdout) => {
+          // _err is IGNORED on purpose: exit 1 IS the drift signal (see the header).
+          let parsed = null;
+          try { parsed = JSON.parse(String(stdout || '')); } catch (_) { parsed = null; }
+          if (!parsed || parsed.systemd !== true) return done(null);
+          done(Array.isArray(parsed.units) ? parsed.units : null);
+        });
+    } catch (_) {
+      done(null);
+    }
+  });
+}
+
+// NO FLEET-GUARD KNOB, and the absence is deliberate. ./liveness-notify.js needs one
+// because it posts per PROJECT and a fleet can be large, so "how many at once means look
+// at the platform" is a real threshold. Here the collapse is unconditional: a host runs
+// two or three runner units, every drifting one has the same cause (an upgrade moved the
+// installed core), and the notice is one message whose wording already branches on the
+// count. A tunable that can only ever be 1 or 2 on a population of 2 is a knob that does
+// nothing, and a knob that does nothing still has to be read and reasoned about.
+
+// What the owner reads. Owner-audience and plain: the reader is being told their
+// automation is quietly running old code, and what that means for them. A unit name is
+// operator vocabulary, so it appears once, at the end, for whoever goes to fix it. PURE.
+function driftNoticeText({ kind, units = [], installed = null } = {}) {
+  const n = units.length;
+  if (kind === 'clear') {
+    return n > 1
+      ? `✅ All ${n} background runners are back on the current version.`
+      : `✅ The background runner is back on the current version.`;
+  }
+  const version = installed ? ` The project installed **${installed}**.` : '';
+  const which = units.length ? ` (${units.join(', ')})` : '';
+  if (n > 1) {
+    return `⚠️ ${n} background runners are running an older version of the platform than this project has installed.${version} When that many disagree at once it is almost always one upgrade that moved the code without restarting them, so they are still doing their work with last month's rules — worth pointing them at the new version${which}.`;
+  }
+  return `⚠️ A background runner is running an older version of the platform than this project has installed.${version} It will keep doing its work, but with the older rules, which is the kind of thing that goes unnoticed for weeks — worth pointing it at the new version${which}.`;
+}
+
+// The decision, given this tick's assessment (the rows `collectRunnerDrift` returns) and
+// the notice state carried between ticks. MUTATES `state` (a Set of unit names already
+// announced) and returns what to post; everything else is pure, so the rules above are
+// unit-tested with no systemd, no sweep and no network.
+//
+// `units === null` means there is no systemd to ask — not a healthy host, and not a
+// drifted one. It returns nothing and touches no state, so a checker that cannot run
+// never clears an announcement it also cannot re-make.
+function planDriftNotices(units, state) {
+  if (units === null || units === undefined) {
+    return { notices: [], drifting: 0, unresolved: 0, checked: 0, systemd: false };
+  }
+  const drifting = units.filter((u) => u && u.status === 'drift');
+  const unresolved = units.filter((u) => u && u.status === 'unresolved');
+  const names = drifting.map((u) => u.name);
+
+  // NEW drift only: a unit already announced stays silent until it recovers, so a stale
+  // runner does not post every five minutes for a fortnight.
+  const fresh = names.filter((name) => !state.has(name));
+  // Recovery: a unit we announced that is no longer drifting. Read from the units this
+  // tick actually assessed — a unit that has been REMOVED from the host is not a
+  // recovery and is dropped from the state without a notice, because "the unit is gone"
+  // and "the unit is fixed" are different facts and only one of them is good news.
+  const assessed = new Set(units.map((u) => u && u.name).filter(Boolean));
+  const stillDrifting = new Set(names);
+  const recovered = [...state].filter((name) => assessed.has(name) && !stillDrifting.has(name));
+  const vanished = [...state].filter((name) => !assessed.has(name));
+
+  const notices = [];
+  if (fresh.length) {
+    // The installed version is the same for every unit on the host, so the first one
+    // carries it for the message.
+    const installed = (drifting.find((u) => u.instanceVersion) || {}).instanceVersion || null;
+    notices.push({ kind: 'drift', units: fresh, text: driftNoticeText({ kind: 'drift', units: fresh, installed }) });
+  }
+  if (recovered.length) {
+    notices.push({ kind: 'clear', units: recovered, text: driftNoticeText({ kind: 'clear', units: recovered }) });
+  }
+
+  for (const name of fresh) state.add(name);
+  for (const name of recovered) state.delete(name);
+  for (const name of vanished) state.delete(name);
+
+  return {
+    notices,
+    drifting: drifting.length,
+    unresolved: unresolved.length,
+    checked: units.length,
+    systemd: true,
+  };
+}
+
+// The sweep's one-line account of what the drift check saw. Returns null when there is
+// nothing worth a line — no systemd, or no runner units at all — so a vanilla control
+// plane does not narrate an empty check every five minutes. A host whose every unit is
+// `unresolved` DOES get a line: that is not health, and it must not read as health. PURE.
+function formatDriftLine({ systemd, checked, drifting, unresolved }) {
+  if (!systemd || !checked) return null;
+  if (!drifting && !unresolved) return null;
+  const parts = [`runners=${checked}`];
+  if (drifting) parts.push(`drift=${drifting}`);
+  if (unresolved) parts.push(`unresolved=${unresolved} (cannot tell — not a verdict)`);
+  return `[drift] ${parts.join(' · ')}`;
+}
+
+// postNotice is NOT re-exported: ./liveness-sweep.js imports it straight from
+// ./liveness-notify.js, so a re-export here would be API surface with no caller.
+module.exports = { planDriftNotices, driftNoticeText, formatDriftLine, readRunnerDrift };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.955",
+  "version": "1.19.957",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.955",
+      "version": "1.19.957",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.955",
+  "version": "1.19.957",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.955'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.957'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/provisioning_runner_drift_notice.mjs

@@ -0,0 +1,292 @@
+// tests/provisioning_runner_drift_notice.mjs
+//
+// An intent-runner unit pointed at a different core than the instance installed now says
+// so, once, without anybody looking (task 1004000 — the follow-up the task 1002722 grade
+// asked for).
+//
+// THE DONE-WHEN IS TWO SENTENCES AND BOTH ARE HERE: "a unit repointed at a different core
+// than the installed one produces one notice within one tick, and a healthy host produces
+// none." The first is asserted through the real sweep tick, with a fake `systemctl`
+// reader, so what is proved is the wiring and not only the planner. The second is
+// asserted the same way — silence is a result, and the only way to know it is not the
+// silence of a check that never ran is to prove the tick DID run and chose to say
+// nothing.
+//
+// Also pinned, because each is a way this kind of alert goes wrong:
+//   • ONE notice, not one every five minutes — the state suppresses a repeat
+//   • a FIRST SIGHT is announced, unlike liveness's deliberate silence about an outage
+//     that predates the process (the reason is in runner-drift-notify.js's header, and a
+//     test that got this backwards would look just as green)
+//   • `unresolved` is NOT drift — it is the absence of a verdict, and announcing it would
+//     be a siren over nothing; it reaches the log line instead
+//   • no systemd → nothing said and no state touched, so a checker that cannot run never
+//     clears an announcement it also cannot re-make
+//   • a unit that VANISHES is not a recovery — "it is gone" and "it is fixed" are
+//     different facts and only one is good news
+//   • a drift check that throws does not take the liveness sweep with it
+//
+// DB-free and network-free: the systemctl reader and the notifier are injected.
+//
+// Run:  node tests/provisioning_runner_drift_notice.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+
+const require = createRequire(import.meta.url);
+const notify = require('../modules/provisioning/pollers/runner-drift-notify.js');
+const sweep = require('../modules/provisioning/pollers/liveness-sweep.js');
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const DRIFTED = { name: 'bongos-intent-runner.service', status: 'drift', runnerVersion: '1.19.900', instanceVersion: '1.19.953', reason: 'runs core 1.19.900 but the instance installed 1.19.953' };
+const HEALTHY = { name: 'bongos-intent-runner.service', status: 'ok', runnerVersion: '1.19.953', instanceVersion: '1.19.953', reason: 'runs core 1.19.953' };
+const UNRESOLVED = { name: 'bongos-intent-runner.service', status: 'unresolved', runnerVersion: null, instanceVersion: '1.19.953', reason: 'ExecStart does not run a .js script directly' };
+
+console.log('the planner:');
+
+t('a drifted unit is announced on FIRST SIGHT, and the message names the installed version', () => {
+  const state = new Set();
+  const r = notify.planDriftNotices([DRIFTED], state);
+  assert.equal(r.notices.length, 1);
+  assert.equal(r.notices[0].kind, 'drift');
+  assert.match(r.notices[0].text, /older version/);
+  assert.match(r.notices[0].text, /1\.19\.953/, 'the installed version is in the message — it is what the runner should be on');
+  assert.match(r.notices[0].text, /bongos-intent-runner\.service/, 'and the unit name, once, for whoever fixes it');
+  assert.equal(r.drifting, 1);
+  // The opposite of liveness's rule, deliberately: drift that predates this process is
+  // exactly what nobody noticed, so a restart re-announcing it is correct.
+  assert.deepEqual([...state], ['bongos-intent-runner.service']);
+});
+
+t('the SECOND tick says nothing — one notice, not one every five minutes', () => {
+  const state = new Set();
+  notify.planDriftNotices([DRIFTED], state);
+  const again = notify.planDriftNotices([DRIFTED], state);
+  assert.deepEqual(again.notices, []);
+  assert.equal(again.drifting, 1, 'still counted in the account, just not re-announced');
+});
+
+t('a recovery is announced once, and then the unit is forgotten', () => {
+  const state = new Set();
+  notify.planDriftNotices([DRIFTED], state);
+  const fixed = notify.planDriftNotices([HEALTHY], state);
+  assert.equal(fixed.notices.length, 1);
+  assert.equal(fixed.notices[0].kind, 'clear');
+  assert.match(fixed.notices[0].text, /back on the current version/);
+  assert.deepEqual([...state], [], 'forgotten, so a later drift is a fresh first sight');
+  assert.deepEqual(notify.planDriftNotices([HEALTHY], state).notices, [], 'and the all-clear is not repeated either');
+});
+
+t('a unit that VANISHES is not a recovery', () => {
+  // "The unit is gone" and "the unit is fixed" are different facts and only one of them
+  // is good news. The state is still cleared, so a reinstated unit is a fresh first sight.
+  const state = new Set();
+  notify.planDriftNotices([DRIFTED], state);
+  const gone = notify.planDriftNotices([], state);
+  assert.deepEqual(gone.notices, [], 'no all-clear for a unit nobody fixed');
+  assert.deepEqual([...state], []);
+});
+
+t('several units drifting at once are ONE message, because they have one cause', () => {
+  const state = new Set();
+  const units = [DRIFTED, { ...DRIFTED, name: 'bongos-box-intent-runner.service' }];
+  const r = notify.planDriftNotices(units, state);
+  assert.equal(r.notices.length, 1, 'one message, not one per unit');
+  assert.match(r.notices[0].text, /2 background runners/);
+  assert.match(r.notices[0].text, /one upgrade that moved the code/, 'and it names the usual cause');
+  assert.equal(r.notices[0].units.length, 2);
+});
+
+t("'unresolved' is NOT drift — no notice, but it does reach the log line", () => {
+  const state = new Set();
+  const r = notify.planDriftNotices([UNRESOLVED], state);
+  assert.deepEqual(r.notices, [], 'the absence of a verdict is not a bad verdict');
+  assert.equal(r.unresolved, 1);
+  assert.equal(r.drifting, 0);
+  assert.deepEqual([...state], []);
+  // Visible without being urgent — and a host that is ALL unresolved must not read as
+  // healthy, which is why the line exists at all.
+  assert.match(notify.formatDriftLine(r), /unresolved=1 \(cannot tell — not a verdict\)/);
+});
+
+t('no systemd says nothing, touches no state, and reports systemd:false', () => {
+  const state = new Set(['bongos-intent-runner.service']);
+  for (const nothing of [null, undefined]) {
+    const r = notify.planDriftNotices(nothing, state);
+    assert.deepEqual(r.notices, []);
+    assert.equal(r.systemd, false);
+    assert.deepEqual([...state], ['bongos-intent-runner.service'],
+      'a checker that cannot run must not clear an announcement it also cannot re-make');
+  }
+});
+
+t('a healthy host produces no log line either — no narration every five minutes', () => {
+  const r = notify.planDriftNotices([HEALTHY], new Set());
+  assert.deepEqual(r.notices, []);
+  assert.equal(notify.formatDriftLine(r), null, 'a vanilla control plane stays quiet');
+  assert.equal(notify.formatDriftLine({ systemd: true, checked: 0, drifting: 0, unresolved: 0 }), null, 'and so does a host with no runner units');
+  assert.match(notify.formatDriftLine({ systemd: true, checked: 2, drifting: 1, unresolved: 0 }), /runners=2 · drift=1/);
+});
+
+console.log('\nthrough the real sweep tick:');
+
+// The sweep's own dependency seam, with no projects to probe: this tick is about the
+// runners. `collectRunnerDrift` is what the production path reads systemd through.
+function tickDeps({ units, notifySpy, logs }) {
+  return {
+    // `pool`, not `db` — sweepOnce's own seam name. Passing the wrong one silently falls
+    // back to the real api.pool and the tick tries to reach Postgres, which is how these
+    // five cases first failed.
+    pool: { query: async () => ({ rows: [] }) },
+    log: (m) => logs.push(String(m)),
+    notify: (n) => notifySpy.push(n),
+    collectRunnerDrift: async () => units,
+    instanceRoot: '/srv/instance',
+  };
+}
+
+// No active instances to probe: this tick is about the runners, and the roster read is
+// the only other thing sweepOnce does before reaching them.
+const provisioning = require('../modules/provisioning/provisioning.js');
+provisioning.listActiveInstancesForLiveness = async () => [];
+
+await ta('DONE-WHEN 1: a repointed unit produces ONE notice within ONE tick', async () => {
+  sweep.resetNoticeState();
+  const notifySpy = [], logs = [];
+  const out = await sweep.sweepOnce(tickDeps({ units: [DRIFTED], notifySpy, logs }));
+  assert.equal(notifySpy.length, 1, `one notice from one tick, got ${notifySpy.length}`);
+  assert.equal(notifySpy[0].kind, 'drift');
+  assert.equal(out.runnerDrift, 1, 'and the tick reports it in its account');
+  assert.ok(logs.some((l) => /\[drift\].*drift=1/.test(l)), 'the journal carries the line too');
+});
+
+await ta('DONE-WHEN 2: a healthy host produces NONE — and the tick demonstrably ran', async () => {
+  sweep.resetNoticeState();
+  const notifySpy = [], logs = [];
+  let asked = 0;
+  const deps = tickDeps({ units: [HEALTHY], notifySpy, logs });
+  const out = await sweep.sweepOnce({ ...deps, collectRunnerDrift: async () => { asked++; return [HEALTHY]; } });
+  assert.equal(notifySpy.length, 0, 'nothing is said');
+  assert.equal(asked, 1, 'and this is NOT the silence of a check that never ran');
+  assert.equal(out.runnerDrift, 0);
+  assert.ok(!logs.some((l) => /\[drift\]/.test(l)), 'no line either — silence all the way down');
+});
+
+await ta('the same drift over two ticks is announced once', async () => {
+  sweep.resetNoticeState();
+  const notifySpy = [], logs = [];
+  const deps = tickDeps({ units: [DRIFTED], notifySpy, logs });
+  await sweep.sweepOnce(deps);
+  await sweep.sweepOnce(deps);
+  assert.equal(notifySpy.length, 1, `the second tick must not re-announce, got ${notifySpy.length}`);
+});
+
+await ta('a drift check that THROWS does not take the sweep with it', async () => {
+  sweep.resetNoticeState();
+  const notifySpy = [], logs = [];
+  const deps = tickDeps({ units: [], notifySpy, logs });
+  const out = await sweep.sweepOnce({ ...deps, collectRunnerDrift: async () => { throw new Error('systemctl exploded'); } });
+  assert.ok(out, 'the tick still returns its liveness account');
+  assert.equal(out.swept, 0);
+  // Logged, not swallowed: silence here is indistinguishable from a healthy host, which
+  // is the exact failure this task was filed about.
+  assert.ok(logs.some((l) => /\[drift\] check failed/.test(l) && /systemctl exploded/.test(l)),
+    `the failure is said out loud: ${logs.join(' | ')}`);
+});
+
+await ta('the check is not gated on there being tenant projects', async () => {
+  // A control plane with no tenants still has runners worth checking — and that is the
+  // host this runs on.
+  sweep.resetNoticeState();
+  const notifySpy = [], logs = [];
+  const out = await sweep.sweepOnce(tickDeps({ units: [DRIFTED], notifySpy, logs }));
+  assert.equal(out.swept, 0, 'no projects at all');
+  assert.equal(notifySpy.length, 1, 'and the drift was still found');
+});
+
+console.log('\nwiring:');
+
+t('the module crosses NO require boundary into core — the checker is a subprocess', () => {
+  // A module may require only src/module-api.js (ADR 0083, docs/modules-contract.md, and
+  // this module's own CLAUDE.md header). scripts/ is core-package territory, so the
+  // checker is read the way the sibling reads scripts/discord/post.js: as a subprocess.
+  // fitness's checkModulesImportOnlyApi does not currently catch a scripts/ target, so
+  // this assertion is the only thing standing between the rule and a silent regression.
+  for (const f of ['runner-drift-notify.js', 'liveness-sweep.js']) {
+    const src = readFileSync(new URL(`../modules/provisioning/pollers/${f}`, import.meta.url), 'utf8');
+    const requires = [...src.matchAll(/require\((['"])([^'"]+)\1\)/g)].map((m) => m[2]);
+    for (const spec of requires) {
+      // src/module-api(.js) is THE doorway and is allowed; everything else under src/ or
+      // scripts/ is not.
+      if (/^(\.\.\/)+src\/module-api(\.js)?$/.test(spec)) continue;
+      assert.ok(!/(^|\/)scripts\//.test(spec) && !/(^|\/)src\//.test(spec),
+        `${f} requires "${spec}" — a module may require only src/module-api.js; spawn a script instead (ADR 0083)`);
+    }
+  }
+  const notifySrc = readFileSync(new URL('../modules/provisioning/pollers/runner-drift-notify.js', import.meta.url), 'utf8');
+  assert.match(notifySrc, /execFile/, 'the checker is spawned');
+  assert.match(notifySrc, /runner-drift\.js', '--instance-root'|scripts\/gds\/runner-drift\.js/, 'and it is the checker that is spawned');
+});
+
+t('postNotice is NOT re-exported — the sweep takes it straight from its owner', () => {
+  // A re-export with no production caller is API surface to keep true for nothing.
+  assert.equal(notify.postNotice, undefined);
+  const sweepSrc = readFileSync(new URL('../modules/provisioning/pollers/liveness-sweep.js', import.meta.url), 'utf8');
+  assert.match(sweepSrc, /const \{ planNotices, postNotice \} = require\('\.\/liveness-notify'\);/,
+    'one Discord path, imported from the file that owns it');
+});
+
+await ta('readRunnerDrift: a NON-ZERO exit is the drift signal, not a failed read', async () => {
+  // runner-drift.js exits 1 exactly WHEN it finds drift — that is its contract as a
+  // CI-style gate. Treating a failed exit as a failed read would discard the only result
+  // worth reporting, so the exit code is ignored whenever stdout parses.
+  const payload = JSON.stringify({ instanceRoot: '/srv/instance', systemd: true, units: [DRIFTED] });
+  const execFileImpl = (_cmd, _args, _opts, cb) => cb(Object.assign(new Error('Command failed'), { code: 1 }), payload, '');
+  const units = await notify.readRunnerDrift({ instanceRoot: '/srv/instance', execFileImpl });
+  assert.equal(units.length, 1);
+  assert.equal(units[0].status, 'drift');
+});
+
+await ta('readRunnerDrift: it spawns the checker with the instance root, from the repo root', async () => {
+  let seen = null;
+  const execFileImpl = (cmd, args, opts, cb) => { seen = { cmd, args, opts }; cb(null, JSON.stringify({ systemd: true, units: [] }), ''); };
+  const units = await notify.readRunnerDrift({ instanceRoot: '/srv/instance', execFileImpl });
+  assert.deepEqual(units, []);
+  assert.equal(seen.cmd, 'node');
+  assert.deepEqual(seen.args, ['scripts/gds/runner-drift.js', '--instance-root', '/srv/instance', '--json']);
+  assert.match(seen.opts.cwd, /cloud-bongos/, 'invoked from the repo root regardless of cwd');
+  assert.ok(seen.opts.timeout > 0, 'a hung systemctl costs the check, not the tick');
+});
+
+await ta('readRunnerDrift: "could not look" is NULL, never an empty array', async () => {
+  // "No runner units" and "could not ask" must not read the same — planDriftNotices
+  // treats them differently, and an empty array would silently clear announcements.
+  const cases = [
+    ['unparseable stdout', (_c, _a, _o, cb) => cb(null, 'systemctl: command not found', '')],
+    ['no systemd', (_c, _a, _o, cb) => cb(null, JSON.stringify({ systemd: false, units: [] }), '')],
+    ['empty stdout', (_c, _a, _o, cb) => cb(new Error('timeout'), '', '')],
+    ['a throwing spawn', () => { throw new Error('ENOENT'); }],
+  ];
+  for (const [why, execFileImpl] of cases) {
+    assert.equal(await notify.readRunnerDrift({ instanceRoot: '/x', execFileImpl }), null, why);
+  }
+  // And the empty-array case really is distinct: a host with systemd and no units.
+  assert.deepEqual(await notify.readRunnerDrift({ instanceRoot: '/x', execFileImpl: (_c, _a, _o, cb) => cb(null, JSON.stringify({ systemd: true, units: [] }), '') }), []);
+});
+
+t('the sweep clears BOTH notice states on reset, or a test leaks into the next one', () => {
+  const src = readFileSync(new URL('../modules/provisioning/pollers/liveness-sweep.js', import.meta.url), 'utf8');
+  assert.match(src, /function resetNoticeState\(\) \{ noticeState\.clear\(\); driftState\.clear\(\); \}/);
+});
+
+console.log(`\nprovisioning_runner_drift_notice: ${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);