chore(hygiene): Node 24 actions, --version flag, update-apply install priority

.github/workflows/check.yml

@@ -14,9 +14,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Cache cargo registry + target
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.cargo/registry
@@ -38,9 +38,9 @@ jobs:
     needs: build
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Cache cargo registry + target
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.cargo/registry

.github/workflows/release.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: ${{ matrix.os }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
@@ -41,7 +41,7 @@ jobs:
         run: cp rust/target/${{ matrix.target }}/release/s5d ${{ matrix.binary }}
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ matrix.binary }}
           path: ${{ matrix.binary }}
@@ -51,10 +51,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Download artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
 
       - name: Create release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           prerelease: ${{ contains(github.ref_name, '-') }}
           files: |

rust/src/bin/s5d.rs

@@ -14,7 +14,11 @@ mod cmd_provision;
 mod cmd_skill;
 
 #[derive(Parser)]
-#[command(name = "s5d", about = "S5D — control plane for agentic repo changes")]
+#[command(
+    name = "s5d",
+    version,
+    about = "S5D — control plane for agentic repo changes"
+)]
 struct Cli {
     #[command(subcommand)]
     command: S5dCommand,

rust/src/bin/s5d/cmd_provision.rs

@@ -487,17 +487,37 @@ fn install_binary_from_repo(
     repo_root: &std::path::Path,
     destination: &std::path::Path,
 ) -> anyhow::Result<()> {
-    let source = if let Some(prebuilt) = prebuilt_binary(repo_root) {
-        prebuilt
-    } else {
-        let status = std::process::Command::new("cargo")
-            .args(["build", "--release"])
-            .current_dir(repo_root.join("rust"))
-            .status()?;
-        if !status.success() {
-            anyhow::bail!("cargo build --release failed");
+    // Build from the checked-out source first: it always matches the repo
+    // revision. The tracked prebuilt is refreshed only at release time and
+    // has shipped stale binaries silently (alpha.7 → alpha.8 both lagged) —
+    // it is a fallback ONLY for hosts without a Rust toolchain. A failed
+    // build on a host that HAS cargo is an error, not a fallback: silently
+    // installing a lagging prebuilt over broken source recreates the very
+    // divergence this path exists to prevent. The explicit --target-dir
+    // pins the output location regardless of CARGO_TARGET_DIR/config.
+    let cargo_build = std::process::Command::new("cargo")
+        .args(["build", "--release", "--target-dir", "target"])
+        .current_dir(repo_root.join("rust"))
+        .status();
+    let source = match cargo_build {
+        Ok(status) if status.success() => repo_root.join("rust/target/release/s5d"),
+        Ok(status) => anyhow::bail!(
+            "cargo build --release failed ({status}) — fix the build; refusing to install a prebuilt over broken source"
+        ),
+        Err(e) => {
+            let reason = format!("cargo unavailable ({e})");
+            match prebuilt_binary(repo_root) {
+                Some(prebuilt) => {
+                    eprintln!(
+                        "  warn: {} — installing tracked prebuilt {} (may lag the repo revision)",
+                        reason,
+                        prebuilt.display()
+                    );
+                    prebuilt
+                }
+                None => anyhow::bail!("{} and no tracked prebuilt for this platform", reason),
+            }
         }
-        repo_root.join("rust/target/release/s5d")
     };
 
     if let Some(parent) = destination.parent() {