The OpenShell gateway drift tests can fail depending on the developer’s local host state. Several tests inject getGatewayClusterImageRef: () => null to model “no cluster gateway container,” but gateway-drift.ts resolves the image ref with ??, so an injected null falls through to getGatewayClusterImageRef(...) and probes real Docker state.

This makes host-process drift tests accidentally depend on whether the machine has an openshell-cluster-* container. On a host with a stale cluster image, tests expecting host_process_drift may instead receive image_drift, or null if the real cluster is considered active.

Example failing cases:

detects host-process gateway binary drift when no cluster container exists
surfaces host-process drift as a preflight issue when cluster image drift is absent
ignores host-process gateway drift when the Vitest sentinel is set
attaches host-process drift to a protobuf mismatch when there is no cluster container
Expected behavior:

Injected test dependencies should be authoritative. If getGatewayClusterImageRef is provided and returns null, the drift detector should treat that as an intentional “no cluster image/container” result and should not inspect the actual host machine.

Suggested fix:

Replace deps.getGatewayClusterImageRef?.(gatewayName) ?? getGatewayClusterImageRef(...) with an explicit function-present check, so returned null is preserved:

const clusterImage =
  typeof deps.getGatewayClusterImageRef === "function"
    ? deps.getGatewayClusterImageRef(gatewayName)
    : getGatewayClusterImageRef(gatewayName, { timeoutMs });