@bongos/core 1.19.938 → 1.19.939

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.938",
-  "core_contract": "1.19.938",
-  "source_commit": "8dd584dae92b44faa1bbed125048a59789ad8535",
+  "core_version": "1.19.939",
+  "core_contract": "1.19.939",
+  "source_commit": "5a36a537ba12fc2d9dc3ce29ec6e84fb102238e8",
   "source_ref": "HEAD",
-  "built_at": "2026-09-21T18:26:08.361Z",
+  "built_at": "2026-09-21T18:56:49.358Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 511,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2334,
+    "functional_verbatim": 2335,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2871,
-  "tree_sha256": "fbde3b87a4c049acf1a6d2075d3bf614fd92e74ffdf94d5cb9f96ac8d80439f5",
+  "file_count": 2872,
+  "tree_sha256": "718dc449d9f22dd45347cce2f17dc24d6ca3d8e0cce9c9b1e7aad67a8683df47",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2677,7 +2677,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "91500af9d7c272807c97d945b549ae8cbd0c6f30904e9c90b55c1a4c990451c3"
+      "sha256": "4e9e33798c5671990f7d9d45e0695f43b8de1621cdaa316dd30d4e014f93df90"
     },
     {
       "path": "docs/modules-contract.md",
@@ -8002,12 +8002,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "5deecad0d887fedac8dedc460fe2ad83990dbd7955fde8cc46e5a88f550f45ba"
+      "sha256": "f9412625c08d05fd8718e0590544e5b4ac8d61ce85168c01c98973b0b0afbafd"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "59e6e64dcbb6313c3d7db30d0a5466958207792de738adc0c47151a3f5eed45b"
+      "sha256": "fcdd31f9e93e415ebe9384cfa896520ea80733044e833513f914c0f873180774"
     },
     {
       "path": "public-docs/index.html",
@@ -8067,7 +8067,7 @@
     {
       "path": "scripts/gds/address-park-sweep.sh",
       "mode": "0000644",
-      "sha256": "9cf1964d675f385ff73bbbd7683f9b0fd2b9776c832548c2e662536af31b2d15"
+      "sha256": "b08a77da7a834dbe30fa9bd041ce05289f8abf48b3c44764ecbe2238cbc88e9c"
     },
     {
       "path": "scripts/gds/adopt-detect.js",
@@ -8137,7 +8137,7 @@
     {
       "path": "scripts/gds/audit-authorship.sh",
       "mode": "0000644",
-      "sha256": "f3aab6f76580d418c7920ef54a37c9577c057f220f43720a8f151487e3ef2841"
+      "sha256": "95607e7f1383148ecb21d448196872f752988d5c70169f5470a12eafc7e2643e"
     },
     {
       "path": "scripts/gds/audit-deps.js",
@@ -8427,12 +8427,12 @@
     {
       "path": "scripts/gds/db-backup-nightly.sh",
       "mode": "0000644",
-      "sha256": "f021271073004e3c80a89e82626dde9f2b38ce9760b7bbadb51190f97a648f5d"
+      "sha256": "6123be86860d43d95d5d44966eb3e49caf9c5dc05a2a9ec02c67f53f527919dd"
     },
     {
       "path": "scripts/gds/db-backup-offsite.sh",
       "mode": "0000644",
-      "sha256": "97f52f6aff95e1c81e069c1d4228eecb514af6068c810441465b5f5b7ee0f2ce"
+      "sha256": "f530f46117bb052f8294e29c95970f6325e1e39f7ee27c96b92c2d672537b37d"
     },
     {
       "path": "scripts/gds/demote.js",
@@ -9512,7 +9512,7 @@
     {
       "path": "scripts/gds/stray-unit-sweep.sh",
       "mode": "0000644",
-      "sha256": "7bc5a6193130085d7faebfb6a71a16b89aa09747f30fdfd612d7cf4c7a1778ff"
+      "sha256": "f90a8ae14f3715f1454431d49be858b605bb3030a2ff3359f5ba2d41ebfd7a3f"
     },
     {
       "path": "scripts/gds/surface.js",
@@ -10007,7 +10007,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "211ea75dbda9c058e7945f56db78eafcfeb5e0d9ffece439fcd0ca3a6adc51d2"
+      "sha256": "7e4584b3285ed7261fa69727d9100dc10856000a7d8f75c8e9f1f47c26eb2f93"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14009,6 +14009,11 @@
       "mode": "0000644",
       "sha256": "24257ca4ad1a7bcefb735ee1b02609469035730e0723645f71e10eb71525bb72"
     },
+    {
+      "path": "tests/sweep_app_account.mjs",
+      "mode": "0000644",
+      "sha256": "46fef77aa82d7f5295ed119b2d5ca77aeb29f5f267a3b82235260a94ee5bd41f"
+    },
     {
       "path": "tests/task_classifier_vocab.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -2350,5 +2350,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.936 with no explicit bump. run 35566446478. (task 1002620)
   1.19.938 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.937 with no explicit bump. run 35638291152. (task 1002620)
+  1.19.939 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.938 with no explicit bump. run 35641614084. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.938",
+  "version": "1.19.939",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.938",
+      "version": "1.19.939",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.938",
+  "version": "1.19.939",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/address-park-sweep.sh

@@ -16,6 +16,7 @@
 # Run on the control plane as a sudoer:
 #   bash scripts/gds/address-park-sweep.sh            # survey only — read-only
 #   bash scripts/gds/address-park-sweep.sh --apply    # remove the snippets, reload Caddy, park the hostnames
+# Run from anywhere but an instance's own vendored core, set INSTANCE_DIR to that instance.
 #
 # Left in place on purpose, even with --apply: each project's database, dumps and checkout,
 # and the row's domain + port (ADR 0181 — a revive re-uses that address).
@@ -23,15 +24,25 @@ set -uo pipefail
 
 APPLY=0; [ "${1:-}" = "--apply" ] && APPLY=1
 DB="${PGDATABASE:-cloudbongos}"
-INSTANCE_DIR="${INSTANCE_DIR:-/home/lars/cloudbongos-instance}"
+# The instance checkout and the account that owns it (task 1004135) — never a named person.
+# Run from an instance's vendored core, the checkout is three levels up (the rule
+# selfInstanceRoot() in provision-repo.js uses); from anywhere else it must be named. The
+# account is that checkout's owner unless PROVISION_APP_USER pins it; root holds no role here.
+CORE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+case "$CORE_DIR" in */node_modules/@bongos/core) INSTANCE_DIR="${INSTANCE_DIR:-${CORE_DIR%/node_modules/@bongos/core}}" ;; esac
+[ -n "${INSTANCE_DIR:-}" ] || { echo "set INSTANCE_DIR to the control plane's instance checkout — this sweep is not running from one"; exit 1; }
+APP_USER="${PROVISION_APP_USER:-$(stat -c %U "$INSTANCE_DIR" 2>/dev/null)}"
+if [ "$APP_USER" = root ] || ! [[ "$APP_USER" =~ ^[a-z_][a-z0-9_-]{0,31}$ ]]; then
+  echo "cannot use '$APP_USER' as the app account — set PROVISION_APP_USER to the unprivileged account that owns $INSTANCE_DIR"; exit 1
+fi
 SITES="${PROVISION_CADDY_SNIPPET_DIR:-/etc/caddy/sites}"
 BOX_ENV="${BOX_ENV:-/etc/cloudbongos/box.env}"
 
-rows=$(sudo -n -u lars psql -d "$DB" -tAF '|' -c "select slug, coalesce(domain, '') from provisioning_instances where status='torn_down' order by slug" 2>/dev/null) \
-  || { echo "cannot read provisioning_instances from $DB as lars"; exit 1; }
+rows=$(sudo -n -u "$APP_USER" psql -d "$DB" -tAF '|' -c "select slug, coalesce(domain, '') from provisioning_instances where status='torn_down' order by slug" 2>/dev/null) \
+  || { echo "cannot read provisioning_instances from $DB as $APP_USER"; exit 1; }
 
 # slug|domain|zone|reserved|blackhole per row, plus an apex line — from the installed core.
-plan=$(sudo -n -u lars env ROWS="$rows" bash -c 'cd "$1" && exec node -' _ "$INSTANCE_DIR" <<'JS'
+plan=$(sudo -n -u "$APP_USER" env ROWS="$rows" bash -c 'cd "$1" && exec node -' _ "$INSTANCE_DIR" <<'JS'
 const core = './node_modules/@bongos/core';
 const { isReservedHostname } = require(`${core}/modules/provisioning/provisioning.js`);
 const { dnsReleaseEnv } = require(`${core}/scripts/gds/provision-net.js`);
@@ -66,7 +77,7 @@ while IFS='|' read -r kind slug domain zone reserved blackhole; do
   printf '  %-22s %s resolves to %s — park at %s (zone %s)\n' "$slug" "$domain" "$now" "$blackhole" "$zone"
   left+=("$slug:dns")
   [ "$APPLY" = 1 ] || continue
-  sudo -n -u lars bash -c 'set -a; . "$1"; set +a; BOX_HOSTNAME="$2" BOX_IP="$3" CLOUDFLARE_ZONE="$4" BOX_PROXIED=0 exec "$BOX_DNS_HOOK"' \
+  sudo -n -u "$APP_USER" bash -c 'set -a; . "$1"; set +a; BOX_HOSTNAME="$2" BOX_IP="$3" CLOUDFLARE_ZONE="$4" BOX_PROXIED=0 exec "$BOX_DNS_HOOK"' \
     _ "$BOX_ENV" "$domain" "$blackhole" "$zone" </dev/null || echo "  ⚠ could not park $domain — re-run to retry"
 done <<< "$plan"
 

package/scripts/gds/audit-authorship.sh

@@ -293,11 +293,6 @@ grep -vE "$OPS_ALLOWLIST_PATTERN" "$TMP_HITS" \
 # ----------------------------------------------------------------------------
 UNIX_USER_PATTERN='((^|[^A-Za-z0-9_.-])(-o|-g|-u)[ =]lars\b)|(\b(User|Group)=lars\b)|(\bchown( -R)? lars\b)|([A-Za-z_]*[Uu][Ss][Ee][Rr][A-Za-z_]*\s*[:=]\s*["'"'"']lars["'"'"'])'
 UNIX_ALLOWLIST=(
-  # One-off backfill sweeps (tasks 1003939, 1003947), run by hand on the plane
-  # whose rows predate the fix; they name that plane's account on purpose.
-  'scripts/gds/address-park-sweep.sh'
-  'scripts/gds/stray-unit-sweep.sh'
-
   # This script's own pattern.
   'scripts/gds/audit-authorship.sh'
 )

package/scripts/gds/db-backup-nightly.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 # Nightly pg_dump of the GDS Postgres DB.
 #
-# Runs as user `lars` via the gds-db-backup.timer systemd unit (see
+# Runs as the unit's User= (the plane's app account) via the gds-db-backup.timer systemd unit (see
 # scripts/gds/gds-db-backup.timer + .service in this repo). Output lands
 # in /var/backups/gds/ as <db>-YYYY-MM-DDTHHMMSSZ.sql.gz (UTC timestamp), and
 # files older than 30 days are pruned.
@@ -33,7 +33,7 @@ set -euo pipefail
 
 # ---- configuration ----------------------------------------------------------
 
-# Destination directory for dumps. Owned by lars:lars, mode 0750.
+# Destination directory for dumps. Owned by that account and its primary group, mode 0750.
 BACKUP_DIR="${GDS_BACKUP_DIR:-/var/backups/gds}"
 
 # Database to dump: explicit GDS_BACKUP_DB wins, else the instance's own branding

package/scripts/gds/db-backup-offsite.sh

@@ -9,7 +9,7 @@
 #
 # Vendor decision: DigitalOcean Spaces over Backblaze B2 — see ADR 0025.
 #
-# Runs as user `lars` via the gds-db-offsite.timer systemd unit (see
+# Runs as the unit's User= (the plane's app account) via the gds-db-offsite.timer systemd unit (see
 # scripts/gds/gds-db-offsite.service + .timer). Weekly cadence.
 #
 # Authentication: S3-style credentials for the Space live OUTSIDE the repo
@@ -121,7 +121,7 @@ for v in SPACES_KEY SPACES_SECRET SPACES_BUCKET SPACES_REGION SPACES_ENDPOINT; d
 done
 if [ "${#missing[@]}" -gt 0 ]; then
   echo "ERROR: missing Spaces credentials: ${missing[*]}" >&2
-  echo "       Set them in $ENV_FILE (chmod 600, owned by lars). See ADR 0022 + 0025." >&2
+  echo "       Set them in $ENV_FILE (chmod 600, owned by $(id -un)). See ADR 0022 + 0025." >&2
   exit 2
 fi
 

package/scripts/gds/stray-unit-sweep.sh

@@ -13,6 +13,7 @@
 # Run on the control plane as a sudoer:
 #   bash scripts/gds/stray-unit-sweep.sh            # survey only — read-only
 #   bash scripts/gds/stray-unit-sweep.sh --apply    # disable --now, remove the unit files, reload, reset-failed
+# Run from anywhere but an instance's own vendored core, set INSTANCE_DIR to that instance.
 #
 # Left in place on purpose, even with --apply: the project's database, its dumps under
 # /var/backups/gds, any checkout, and its Caddy block — data is precious, and the address is
@@ -23,10 +24,22 @@ APPLY=0; [ "${1:-}" = "--apply" ] && APPLY=1
 DB="${PGDATABASE:-cloudbongos}"
 ETC=/etc/systemd/system
 
-# The torn-down slugs, from the ledger, read as the instance user (peer auth — the runner's
+# The app account (task 1004135) — never a named person: PROVISION_APP_USER, else the owner
+# of the instance checkout, found the way address-park-sweep.sh finds it (three levels up
+# from an instance's vendored core; from anywhere else INSTANCE_DIR names it). A clone in an
+# operator's own home must not decide it. root is refused: it holds no Postgres role here.
+CORE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+case "$CORE_DIR" in */node_modules/@bongos/core) INSTANCE_DIR="${INSTANCE_DIR:-${CORE_DIR%/node_modules/@bongos/core}}" ;; esac
+[ -n "${PROVISION_APP_USER:-}${INSTANCE_DIR:-}" ] || { echo "set INSTANCE_DIR to the control plane's instance checkout (or PROVISION_APP_USER) — this sweep is not running from one"; exit 1; }
+APP_USER="${PROVISION_APP_USER:-$(stat -c %U "$INSTANCE_DIR" 2>/dev/null)}"
+if [ "$APP_USER" = root ] || ! [[ "$APP_USER" =~ ^[a-z_][a-z0-9_-]{0,31}$ ]]; then
+  echo "cannot use '$APP_USER' as the app account — set PROVISION_APP_USER to the unprivileged account that owns ${INSTANCE_DIR:-the instance checkout}"; exit 1
+fi
+
+# The torn-down slugs, from the ledger, read as the app account (peer auth — the runner's
 # own identity; nothing here needs a superuser).
-slugs=$(sudo -n -u lars psql -d "$DB" -tAc "select slug from provisioning_instances where status='torn_down' order by slug" 2>/dev/null) \
-  || { echo "cannot read provisioning_instances from $DB as lars"; exit 1; }
+slugs=$(sudo -n -u "$APP_USER" psql -d "$DB" -tAc "select slug from provisioning_instances where status='torn_down' order by slug" 2>/dev/null) \
+  || { echo "cannot read provisioning_instances from $DB as $APP_USER"; exit 1; }
 
 found=(); cleared=()
 echo "== torn-down rows that still have systemd units =="

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.938'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.939'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/sweep_app_account.mjs

@@ -0,0 +1,112 @@
+// tests/sweep_app_account.mjs — the two backfill sweeps act as the plane's app account,
+// never a named person (task 1004135). Both used to `sudo -u <founder>`, so a second
+// operator who ran them got `sudo: unknown user`.
+//
+// Behavioural: each sweep runs under bash with stub `sudo` / `stat` / `systemctl` first on
+// PATH. The sudo stub records its argv and answers nothing (an empty ledger), so the
+// assertion is on the account the script actually asked for. Nothing touches a box.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const REPO = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+const skip = spawnSync('bash', ['-c', 'true']).error ? 'bash not on PATH' : false;
+const slash = (p) => p.replace(/\\/g, '/');
+
+function stubs() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'sweep-stubs-'));
+  const sudoLog = slash(path.join(dir, 'sudo.log'));
+  const statLog = slash(path.join(dir, 'stat.log'));
+  const bin = (name, body) => fs.writeFileSync(path.join(dir, name), `#!/usr/bin/env bash\n${body}\n`, { mode: 0o755 });
+  bin('sudo', `echo "$*" >> "${sudoLog}"; exit 0`);
+  bin('stat', `echo "$*" >> "${statLog}"; echo checkout-owner`);
+  bin('systemctl', 'exit 0');
+  const lines = (f) => (fs.existsSync(f) ? fs.readFileSync(f, 'utf8').split('\n').filter(Boolean) : []);
+  return { dir, sudo: () => lines(sudoLog), stat: () => lines(statLog) };
+}
+
+function run(scriptPath, s, env = {}) {
+  const base = { ...process.env };
+  delete base.PROVISION_APP_USER;
+  delete base.INSTANCE_DIR;
+  return spawnSync('bash', [slash(scriptPath)], {
+    cwd: REPO, encoding: 'utf8',
+    env: { ...base, ...env, PATH: `${s.dir}${path.delimiter}${process.env.PATH}` },
+  });
+}
+
+const STRAY = path.join(REPO, 'scripts', 'gds', 'stray-unit-sweep.sh');
+const PARK = path.join(REPO, 'scripts', 'gds', 'address-park-sweep.sh');
+
+test('stray-unit-sweep: PROVISION_APP_USER is the account the ledger is read as', { skip }, () => {
+  const s = stubs();
+  run(STRAY, s, { PROVISION_APP_USER: 'appsvc' });
+  assert.match(s.sudo()[0] || '', /^-n -u appsvc psql /);
+  assert.equal(s.stat().length, 0, 'a pin is not second-guessed');
+});
+
+test('stray-unit-sweep: unpinned outside a vendored core, it refuses rather than trust whoever owns this clone', { skip }, () => {
+  const s = stubs();
+  const r = run(STRAY, s);
+  assert.equal(r.status, 1);
+  assert.match(r.stdout, /set INSTANCE_DIR/);
+  assert.deepEqual(s.stat(), [], 'the clone\'s owner was never asked');
+  assert.deepEqual(s.sudo(), []);
+});
+
+test('stray-unit-sweep: INSTANCE_DIR names the checkout whose owner acts', { skip }, () => {
+  const s = stubs();
+  const inst = fs.mkdtempSync(path.join(os.tmpdir(), 'sweep-inst-'));
+  run(STRAY, s, { INSTANCE_DIR: slash(inst) });
+  assert.match(s.stat()[0] || '', new RegExp(`^-c %U .*${path.basename(inst)}$`));
+  assert.match(s.sudo()[0] || '', /^-n -u checkout-owner psql /);
+});
+
+test('stray-unit-sweep: root is refused before anything runs', { skip }, () => {
+  const s = stubs();
+  const r = run(STRAY, s, { PROVISION_APP_USER: 'root' });
+  assert.equal(r.status, 1);
+  assert.match(r.stdout, /cannot use 'root' as the app account — set PROVISION_APP_USER/);
+  assert.deepEqual(s.sudo(), [], 'sudo never asked');
+});
+
+test('address-park-sweep: outside a vendored core, INSTANCE_DIR must be named — no founder-home default', { skip }, () => {
+  const s = stubs();
+  const r = run(PARK, s);
+  assert.equal(r.status, 1);
+  assert.match(r.stdout, /set INSTANCE_DIR/);
+  assert.deepEqual(s.sudo(), []);
+});
+
+test('address-park-sweep: root is refused before anything runs', { skip }, () => {
+  const s = stubs();
+  const r = run(PARK, s, { INSTANCE_DIR: slash(os.tmpdir()), PROVISION_APP_USER: 'root' });
+  assert.equal(r.status, 1);
+  assert.match(r.stdout, /cannot use 'root' as the app account — set PROVISION_APP_USER/);
+  assert.deepEqual(s.sudo(), [], 'sudo never asked');
+});
+
+test('address-park-sweep: every sudo hop uses the pinned account', { skip }, () => {
+  const s = stubs();
+  run(PARK, s, { INSTANCE_DIR: slash(os.tmpdir()), PROVISION_APP_USER: 'appsvc' });
+  const hops = s.sudo().filter((l) => / -u /.test(l));
+  assert.ok(hops.length >= 2, `the ledger read and the core load both ran — got ${JSON.stringify(s.sudo())}`);
+  for (const h of hops) assert.match(h, /^-n -u appsvc /);
+});
+
+for (const [name, src] of [['address-park-sweep', PARK], ['stray-unit-sweep', STRAY]]) {
+  test(`${name}: run from an instance's vendored core, the instance is three levels up and its owner acts`, { skip }, () => {
+    const s = stubs();
+    const inst = fs.mkdtempSync(path.join(os.tmpdir(), 'sweep-inst-'));
+    const gds = path.join(inst, 'node_modules', '@bongos', 'core', 'scripts', 'gds');
+    fs.mkdirSync(gds, { recursive: true });
+    fs.copyFileSync(src, path.join(gds, `${name}.sh`));
+    run(path.join(gds, `${name}.sh`), s);
+    assert.match(s.stat()[0] || '', new RegExp(`^-c %U .*${path.basename(inst)}$`), 'the instance root, not the package');
+    assert.match(s.sudo()[0] || '', /^-n -u checkout-owner psql /);
+  });
+}