Roll preview and requested image tags

During production delivery of the disposal fixes on 2026-09-09, two standard Hosting/InstanceAction dry runs requested 3.0.0-ci.8209. The Cloud deployment had no image pin, so its preview incorrectly refused to plan. The Systemorph deployment had pin 3.0.0-ci.8131, so its preview incorrectly displayed that older image. Neither dry run changed a deployment.

Execution's BuildPlan already forwarded request.ImageTag to both Problems and Steps. RenderPlan dropped that input, and the renderer consequently used the deployment pin. The preview therefore could not be used to review the commands execution would run.

The renderer now accepts and forwards the requested tag to those same validation and command builders. The control plane supplies it from the action request. Existing six- and seven-argument public overloads remain as forwarders with no override, preserving their pin fallback for runtime callers.

Four registered regression cases cover an override replacing an older pin, an override without a pin, refusal of an unsafe override despite a valid pin, and compatibility of the legacy overloads and blank-tag fallback. Command parity is asserted against the execution planner. This correction does not change the rollout commands, observation timing, or installation update policy.

Review added control-plane coverage of the exact content transform passed to the dry-run storage update, including the captured request and the private renderer forwarding. These cases inspect the appended preview and preserve the existing log and state; they do not simulate storage. Missing-tag verdicts now describe the selected tag and direct an override's correction to the action's imageTag, reserving pinnedImageTag remediation for requests without an override.

Local validation initially executed all 430 Hosting cases successfully. Restoring the old renderer behavior in the temporary test project produced exactly three failures: override precedence, a requested tag without a pin, and unsafe-override refusal (427 passed). Repository validation passed for 259 nodes in 60 modules, and the canonical compile checker passed all 88 NodeTypes without debt or unverifiable sets. These local runs used the coherent prior audit reference set built against core e1039813e4c080f46d6e54b7a84b09c92326856e; CI must additionally validate its current platform pin and execute the mesh Tests areas.

After review, the expanded Hosting suite passed all 435 cases. Removing only the control plane's forwarded ImageTag in the temporary test project caused its three override cases to fail (432 passed), while the direct-renderer cases stayed green. This distinguishes coverage of the original dropped argument from coverage of the renderer alone.

The sealed candidate was produced by CD run 34377302559: core 3cda3efdeecebba1dc1ec5b54501bbaedbd9a9b6 and Plugins e981fe15e71c7bb230c0759bb3671ebf57ad387c, containing core #3818 and Plugins #1548. That provenance identifies a candidate; it does not prove adoption by running production replicas. Deployment verification must establish the running image digest as well as the core version endpoint.