fix: honor release-local Bun in generated Stacks scheduler and queue units

Observed behavior

Open Farming release 110992205bd21e7515032468938cffd89e0e56f6 uses explicit release-local Bun 1.4.4 for its main and API starts, preStart commands and child PATH. Actual pinned-host readback proves those processes and bare children use 1.4.4 while the shared host remains 1.4.2.

The same deployment's native generated openfarming-main-scheduler.service still runs /root/.bun/bin/bun (host 1.4.2). This is a separate generated-service boundary. Do not patch the deployed unit or replace the global host runtime to conceal it.

The installed ts-cloud 0.16.11 driver hardcodes /usr/local/bin/bun and static global PATH in drivers/shared/app-frameworks. Maintained source 3d673bdf84a31d50012aa25c9f75b3f2823528e5 (0.16.69) still has BUN_BIN in packages/ts-cloud/src/drivers/shared/app-frameworks.ts; app-services.ts supplies only { current } and driver execEnv to scheduler/queue units.

Acceptance

• Let the maintained Stacks app framework driver honor an explicitly selected release-local runtime for scheduler and queue services, with correct child PATH and active-release lifecycle. Preserve defaults for existing global-runtime apps and Laravel behavior.
• Use bare systemd ExecStart without a login-shell wrapper, retain process/resource limits and prevent executable/argument injection. Define how missing local runtime fails rather than falling back silently.
• Cover generated scheduler and queue units, custom appBase, release switching and the unchanged default/Laravel cases. Qualify a real finite child using the selected runtime and actual current symlink.
• Fix the owning ts-cloud source and run its native bun run release:patch; qualify the released package in Stacks and Open Farming with native frozen installs. No installed/distribution patches, manual unit rewrites or global host runtime change.

This finding does not invalidate the recovered catalog or verified main/API services. Physical jobs and scheduled treatment remain separately unqualified.

The isolated source branch codex/release-local-background-runtime, based on 3d673bdf84a31d50012aa25c9f75b3f2823528e5, now has a first generated-unit cycle: a real failing case for ignored private-runtime selection, followed by 17 passing unit cases and 57 assertions after the source change. The proposed opt-in is a release-relative SiteConfig.backgroundBun; omission preserves existing global-runtime units. Generated scheduler and queue units retain bare ExecStart and resource limits.

This is partial source work, not a release or completed process qualification. A finite native scheduler/current-switch test is prepared but has not run. Startup validation, physical-release child PATH, queue behavior, argument rejection and ordinary release pruning still need qualification. Source ordering also shows pruning before background-service reconciliation; its runtime impact must be tested before selecting a correction. No installed package, generated production unit or shared host runtime has been edited.

Publication remains gated on source behavior, full checks, independent review, current-main integration and native bun run release:patch, followed by public-package and downstream qualification. Open Farming adoption remains theopenfarm/openfarm.ing#42.

The native process cycle now reproduces and corrects release switching in the isolated source branch. With two real copied Bun 1.4.4 executables, the admitted scheduler stayed on release A while its later bare Bun child actually ran release B after current switched. Original failed fixtures and native stdout/stderr/lifecycle receipts are retained.

An in-process PATH change also failed this exact case. Bun documents that default Bun.spawn uses the process launch environment. The source now generates opted-in scheduler and queue units against a physical release ID from startup, including WorkingDirectory, executable and PATH. The native entry refuses missing, external or mismatched runtime selections before application work. Defaults and Laravel paths remain covered. No wrapper, installed-package edit or host runtime replacement is used.

The current focused result is 23 passing cases, zero failures, 80 Bun assertions. Separate native assert checks cover both real scheduler and queue processes, their bare children after the current switch, unchanged PID and exact queue argv; both entrypoints also qualify selected/contained-symlink success and missing/external/mismatched/unsafe/wrong-PATH refusal before a finite action marker. A real alias-admission failure was corrected at the executable identity boundary. Generated private-runtime queue options now reject argument/directive injection and non-finite tuning values after a genuine failing case.

This is still incomplete source work. Release pruning before background reconciliation remains the next lifecycle boundary to reproduce and correct. Whole-source checks, independent review, native bun run release:patch, public-package qualification and downstream adoption remain pending. No source release or remote systemd qualification is claimed.

Primary runtime reference: https://bun.com/reference/bun/Spawn/BaseOptions

Completed in #198, implementation 64ab19ddc78d3a8a8e322d612c61927b32d0a18b, then native bun run release:patch produced v0.16.70 at 3f43e0e3ab1266606b17e2b9368eee3ce013d033. Both commits are on main as Chris without coauthors. Exact release CI and native publication passed.

Public SDK/core/aws-types archives match npm SHA512 integrity and their provenance payloads name this source/tag/run. Fresh normal and frozen installs pass. Actual published root/driver exports cover eight app/static selected/default/enabled/empty deployment cases, and ten real published native scheduler/queue entry cases verify contained aliases, bare children and rejected missing, escaped, mismatched or wrong-PATH runtimes. Positive and negative published SiteConfig type checks pass. Signature verification beyond registry bundle readback was not independently performed.

Owned source tests qualify actual current switching, selected child identity, old-release pruning after drain, same-ID/existing-target replacement, stop/disable refusal, real EXIT-trap ownership and failed-fixture retention. Default and Laravel runtime commands retain their prior selection. Stale managed-service stop failures now deliberately propagate; non-PHP reconciliation also removes the final stale service before pruning. Limits and direct systemd ExecStart are preserved.

Open Farming #43 consumed the release through native Stacks 0.75.301/Buddy, normal dependency update and frozen installation. Its exact main CI and native deployment passed. Live readback proves the generated scheduler is active with zero restarts under private Bun 1.4.4 in the physical new release; main/API also use private 1.4.4 and all three installed SDK packages are 0.16.70. A finite child probe using each live process's observed executable/cwd/PATH reports parent and child 1.4.4. This does not assert a scheduled production job executed. The shared host remains 1.4.2, and all seven protected customer-row groups match both pre-deploy state and the immediate native backup. Consumer acceptance is complete.

No installed/distribution patches, manual production-unit edits, global-runtime replacement or physical-operation qualification.