Lab handoff must not dispatch through a known stale runner command binary

[chubes4]

Problem

Homeboy detected exact controller/runner command-binary skew during Lab offload, printed a refresh command, and then dispatched the benchmark through the stale binary anyway.

Observed preflight:

controller: homeboy 0.301.2+bb9e84514d51
runner command: homeboy 0.301.1+82cbc0da624d
refresh with: homeboy runner refresh-homeboy homeboy-lab --ref v0.301.2 --reconnect ...

Despite knowing the selected command binary was stale, Homeboy continued materializing two workspaces and ran the remote command. The remote process then failed during scenario discovery. Whether that specific failure is caused by skew or not, the handoff contract allowed a runtime that the controller had already identified as stale.

Context: browser verification for Automattic/blocks-engine#659.

Durable evidence

• Runner job: afecb0a5-5cb1-44f9-aebb-c5764c04cf83
• Persisted run: runner-exec-bench-static-site-importer-homeboy-lab-afecb0a5-5cb1-44f9-aebb-c5764c04cf83
• Remote command binary: /home/chubes/Developer/_homeboy_binaries/homeboy-82cbc0da624df03a06b314f363f59407a200cb72/target/release/homeboy

Expected

A Lab handoff binds an immutable required Homeboy capability/build identity. If the configured command binary cannot satisfy it, Homeboy should automatically converge the runner when policy permits or fail before workspace materialization with one exact recovery command. A warning followed by dispatch is not a safe convergence contract.

Acceptance criteria

• Handoff preflight compares controller-required and selected runner command build identities.
• Known-incompatible or stale command binaries never receive the workload silently.
• Policy-controlled auto-convergence refreshes/selects a compatible immutable build before materialization.
• If convergence is unavailable, failure occurs before snapshot upload and includes one exact recovery command.
• Run evidence records requested, configured, daemon, and executed Homeboy identities.
• Deterministic coverage proves stale-runner detection cannot degrade into warning-only dispatch.

Related

• Automatically converge controller and runner Homeboy runtimes #8012 defined automatic controller/runner runtime convergence and is closed; this live run violates that accepted contract.
• Prevent stale-daemon recovery from downgrading post-tag runner builds #9088 tracks monotonic refresh and downgrade prevention, not warning-only stale dispatch.

AI assistance

• AI assistance: Yes
• Tool: OpenCode with OpenAI GPT-5.6 Sol
• Used for: Correlated controller preflight, selected remote binary, and runner job evidence; deduplicated related runtime issues; drafted this report with Chris.