@bongos/core 1.21.116 → 1.21.118

package/scripts/gds/provision-auto-upgrade.js

@@ -0,0 +1,139 @@
+'use strict';
+
+// scripts/gds/provision-auto-upgrade.js — the hub moves each hosted project's core on
+// its own, by that project's update rule (task 1004729, ADR 0381).
+//
+// WHY THIS EXISTS. Every runner tick, snapshotAllCoreVersions works out `recommended`
+// for every active cloud-host under its own rule (pinned / patch / minor, follow
+// released) — and then stopped. A move only happened when someone pressed the button on
+// /deploy, so a project on `patch` sat on 1.21.20 for 11 days while 1.21.69 was out
+// (toast, 2026-10). The rule already IS the owner's decision about taking updates; this
+// step acts on it, with the same two steps the button uses:
+//
+//   1. behind, not pinned, no open intent, target not held → queue a
+//      `core-upgrade-preflight` for `recommended` (the dry run; changes nothing);
+//   2. that preflight PASSED for that same target → queue the `core-upgrade` to it.
+//
+// Every intent goes through provisioning.enqueueIntent, exactly as the runner's own
+// reconcile does, so the control-plane guard and the single-open-intent slot apply, and
+// /deploy shows these moves like any other (requested_by 'runner:auto-upgrade').
+//
+// MINIMAL FAILURE HOLD. A passing preflight does not run migrations (toast's 1.21.115
+// passed its preflight and failed at migrate, intent 267), so without a hold this would
+// re-queue a target that already failed, every tick, forever. A target is held for an
+// instance when it already has, FOR THAT TARGET: a core-upgrade that ended (error, or
+// done but the box is still behind), a preflight intent that errored, or a stored
+// preflight verdict that refused. A newer release is a new target and is not held. The
+// richer hold — telling the project owner, releasing it — is task 1004730.
+//
+// Carved into its own file because provision.js and provision-core-upgrade.js sit at
+// the size ratchet. Best-effort: nothing here may fail the tick.
+
+const { resolveEnv } = require('../../src/instance-config');
+
+// At most this many automatic intents per tick, across ALL projects, so a release never
+// restarts every hosted project at once. The tick runs every few minutes; one is plenty.
+const AUTO_MOVES_PER_TICK = 1;
+
+const REQUESTED_BY = 'runner:auto-upgrade';
+const OPEN_STATES = new Set(['pending', 'running']);
+const OFF_VALUES = new Set(['off', '0', 'false', 'no', 'disabled']);
+
+/**
+ * The platform-wide off switch: `<PREFIX>_AUTO_CORE_UPGRADE` (BONGOS_AUTO_CORE_UPGRADE on
+ * a vanilla hub) in the runner's environment. Unset means ON — the owner asked for this
+ * behaviour (2026-10-14). off / 0 / false / no / disabled stops every automatic move; the
+ * per-project `pinned` rule stays the project-level off switch. PURE over `env`.
+ */
+function autoUpgradeEnabled(env = process.env) {
+  const v = resolveEnv('AUTO_CORE_UPGRADE', { env, warn: () => {}, warnPack: () => {} });
+  if (v === undefined || v === null || String(v).trim() === '') return true;
+  return !OFF_VALUES.has(String(v).trim().toLowerCase());
+}
+
+function parseVerdict(p) {
+  if (!p) return null;
+  if (typeof p === 'string') { try { return JSON.parse(p); } catch { return null; } }
+  return p;
+}
+
+/**
+ * What, if anything, to queue for one project. PURE.
+ * @param {object} inst     provisioning_instances row joined with its core-version snapshot
+ * @param {object[]} intents that instance's intents (open ones + core-upgrade history)
+ * @param {object} channelMod update-channel.js
+ * @returns {{ action: string, to: string } | { skip: string }}
+ */
+function decideAutoMove(inst, intents, channelMod) {
+  if (inst.hosting_shape !== 'cloud-host') return { skip: 'not a hosted project' }; // never the control-plane row
+  if (inst.status !== 'active') return { skip: 'not active' };
+  if (channelMod.normalizeChannel(inst.update_channel) === 'pinned') return { skip: 'pinned' };
+  const served = inst.served_version;
+  const to = inst.recommended;
+  if (!served || !to || channelMod.compareSemver(to, served) <= 0) return { skip: 'current' };
+  if (intents.some((i) => OPEN_STATES.has(i.state))) return { skip: 'open intent' };
+  const same = (i) => String(i.target_version || '') === String(to);
+  const held = intents.some((i) => same(i) && (
+    (i.action === 'core-upgrade' && (i.state === 'error' || i.state === 'done'))
+    || (i.action === 'core-upgrade-preflight' && i.state === 'error')));
+  const verdict = parseVerdict(inst.preflight);
+  const verdictForTarget = verdict && String(verdict.target || '') === String(to) ? verdict : null;
+  if (held || (verdictForTarget && verdictForTarget.ok !== true)) return { skip: `held: ${to} already failed here` };
+  if (verdictForTarget) return { action: 'core-upgrade', to };
+  return { action: 'core-upgrade-preflight', to };
+}
+
+/**
+ * Queue at most AUTO_MOVES_PER_TICK automatic core intents. Runs after the snapshot on an
+ * --apply tick. Never throws.
+ */
+async function autoUpgradeTick(deps) {
+  const { db, provisioning, log = () => {} } = deps;
+  if (!autoUpgradeEnabled(deps.env || process.env)) {
+    log('auto core-upgrade: off (AUTO_CORE_UPGRADE) — no automatic moves');
+    return { queued: 0, off: true };
+  }
+  const channelMod = deps.updateChannel || require('./update-channel.js');
+  let queued = 0;
+  try {
+    const { rows } = await db.query(
+      `SELECT i.id, i.slug, i.owner_builder_id, i.hosting_shape, i.status, i.update_channel,
+              s.served_version, s.recommended, s.preflight
+         FROM provisioning_instances i
+         JOIN provisioning_core_version_snapshot s ON s.instance_id = i.id
+        WHERE i.status = 'active' AND i.hosting_shape = 'cloud-host' AND s.recommended IS NOT NULL
+        ORDER BY i.id`);
+    if (!rows.length) return { queued };
+    const { rows: intents } = await db.query(
+      `SELECT instance_id, action, state, target_version FROM provisioning_intents
+        WHERE instance_id = ANY($1)
+          AND (state IN ('pending', 'running')
+               OR (action IN ('core-upgrade', 'core-upgrade-preflight') AND target_version IS NOT NULL))`,
+      [rows.map((r) => r.id)]);
+    for (const inst of rows) {
+      if (queued >= AUTO_MOVES_PER_TICK) break;
+      const mine = intents.filter((i) => String(i.instance_id) === String(inst.id));
+      const d = decideAutoMove(inst, mine, channelMod);
+      if (d.skip) { if (d.skip.startsWith('held')) log(`  auto core-upgrade: ${inst.slug} ${d.skip}`); continue; }
+      try {
+        const r = await provisioning.enqueueIntent(db, inst.id, d.action, REQUESTED_BY, d.to);
+        if (!r || !r.created) continue; // lost a race for the open slot — not spent
+        queued++;
+        log(`  auto core-upgrade: ${inst.slug} ${inst.served_version} → ${d.to} (${d.action} queued)`);
+        if (provisioning.recordEvent) {
+          await provisioning.recordEvent(db, {
+            instanceId: inst.id, ownerBuilderId: inst.owner_builder_id, event: d.action, actor: REQUESTED_BY,
+            detail: d.action === 'core-upgrade' ? `automatic core move to ${d.to} (update rule)` : `automatic pre-flight check for ${d.to} (update rule)`,
+          }).catch(() => {});
+        }
+      } catch (e) {
+        log(`  auto core-upgrade: ${inst.slug} not queued (${(e && e.message) || e})`);
+      }
+    }
+  } catch (e) {
+    log(`  auto core-upgrade skipped (${(e && e.message) || e})`);
+  }
+  return { queued };
+}
+
+module.exports = { AUTO_MOVES_PER_TICK, autoUpgradeEnabled, autoUpgradeTick };

package/scripts/gds/provision-core-upgrade.js

@@ -36,6 +36,7 @@ const { spawnSync } = require('child_process');
 const { CONFIG, MANIFEST_VERIFY_INTERVAL_MS, MANIFEST_VERIFY_TRIES, REPO_ROOT } = require('./provision-config.js');
 const { appUser, dbName, instanceUser, parseTargetRef, resolveOwnerGithubToken, selfInstanceRoot, standaloneRoot } = require('./provision-repo.js');
 const { ensurePinWriteKey, hasOwnAccount, pinKeyPath, pinSshCommand } = require('./provision-pin-key.js');
+const { replayPinCommit } = require('./provision-pin-replay.js'); // GitHub ahead → pin on top (task 1004733)
 const { isValidSlug } = require('../../modules/provisioning/provisioning.js');
 const { RELEASE_NOTES_FILE, RELEASE_NOTES_MAX_BYTES, parseChangeRecords, notesBetween } = require('./release-notes.js');
 const outcome = require('./upgrade-outcome.js'); // how far a failed move got, as a class (task 1004446)
@@ -411,9 +412,13 @@ async function coreUpgradeInstance(inst, deps, intent) {
 // parseRepoNote in modules/provisioning/core-upgrade.js (re-stated there because a
 // module may not require a script; tests/core_upgrade_runner.mjs round-trips the two).
 //
-// NOTHING IS FORCED OR REBASED. When GitHub has commits the box does not, putting the pin
-// on top of them would change what the live box runs with no restart and no health check.
-// That is reported for an operator to reconcile, never resolved here.
+// NOTHING IS FORCED, AND THE LIVE BOX IS NEVER REBASED. When GitHub has commits the box
+// does not, moving the box onto them would change what it runs with no restart and no
+// health check. Since task 1004733 the pin commit ALONE is replayed onto GitHub's history in
+// a scratch worktree and pushed as an ordinary fast-forward (provision-pin-replay.js), so
+// GitHub names the new core and the box stays exactly what the move proved. A conflict in
+// the pin files is reported ("conflict"), never resolved here. The box still does not pick
+// up the owner's other commits — that would be a deploy, not a pin push (ADR 0350 amendment).
 //
 // WHAT MAKES IT DURABLE (task 1004291, ADR 0350). The owner's token is kept for an hour
 // after they sign in with repository access (GITHUB_TOKEN_TTL_MS in src/bongos/db.js — one
@@ -431,6 +436,7 @@ const REPO_NOTES = Object.freeze({
   needs_account: 'The hub could not set up lasting write access to the project\'s GitHub repository: this project needs its own account on the server first. Once it has one, reconnecting GitHub with repository access sets up lasting access.',
   refused: 'GitHub turned down the owner\'s GitHub access — it may have expired, or lack permission to write to the repository.',
   behind: 'GitHub has changes the server does not have, so the new version could not be added on top of them. An operator needs to bring the two back in line; the site itself is running normally.',
+  conflict: 'GitHub has its own changes to the same version files (package.json or package-lock.json), so the new version was not added on top of them and nothing there was overwritten. An operator needs to choose between the two; the site itself is running normally.',
   failed: 'The hub could not save the new version to GitHub.',
 });
 // A branch name that is safe to interpolate. Narrower than git's own ref grammar on
@@ -498,6 +504,14 @@ async function pushUpgradePin(inst, deps, { instanceDir }) {
   const at = `${repo.owner}/${repo.name}@${branch}`;
   const hardened = `git -C ${instanceDir} -c core.hooksPath=/dev/null`;
   const env = { GIT_TERMINAL_PROMPT: '0' };   // a refused credential fails; it never waits at a prompt
+  // GitHub is ahead: replay the pin commit alone on top, over the credential that was just
+  // refused as behind, and push again — never forced (task 1004733, provision-pin-replay.js).
+  const replayed = (via, git, remote) => {
+    const rr = replayPinCommit({ exec, instanceDir, branch, git, remote, env, slug: inst.slug, tmpDir: deps.tmpDir, pushFault, gitLine, log });
+    if (!rr.ok) return miss(rr.code, rr.extra);
+    if (rr.already) log(`  ✓ ${at} already names this version — nothing to add`);
+    return { pushed: true, via, branch, ...(rr.replayed ? { replayed: true } : { already: true }) };
+  };
 
   const token = await resolveOwnerGithubToken(inst, deps, { tag: '[core-upgrade]' });
 
@@ -515,8 +529,9 @@ async function pushUpgradePin(inst, deps, { instanceDir }) {
       return { pushed: true, via: 'write-key', branch };
     }
     const fault = pushFault(r);
-    // The key WORKED and the history stopped it: no other credential changes that.
-    if (fault === 'behind') return miss('behind', gitLine(r));
+    // The key WORKED and the history stopped it: no other credential changes that, so the
+    // pin is replayed on top of GitHub's history over this same key (task 1004733).
+    if (fault === 'behind') return replayed('write-key', `${hardened} -c ${pinSshCommand(keyPath)}`, `git@github.com:${repo.owner}/${repo.name}.git`);
     log(`  • ${inst.slug}: the write key did not push (${fault}) — trying the next credential`);
   }
 
@@ -525,8 +540,11 @@ async function pushUpgradePin(inst, deps, { instanceDir }) {
     let r = null;
     try {
       writeFile(credFile, `https://x-access-token:${token}@github.com\n`, { mode: 0o600 });
-      r = exec(`${hardened} -c credential.helper= -c credential.helper='store --file=${credFile}' push https://x-access-token@github.com/${repo.owner}/${repo.name}.git HEAD:${branch}`,
-        { allowFail: true, env });
+      const viaToken = `${hardened} -c credential.helper= -c credential.helper='store --file=${credFile}'`;
+      const tokenRemote = `https://x-access-token@github.com/${repo.owner}/${repo.name}.git`;
+      r = exec(`${viaToken} push ${tokenRemote} HEAD:${branch}`, { allowFail: true, env });
+      // Behind: replayed while the credential file still exists (the finally removes it).
+      if (failedRun(r) && pushFault(r) === 'behind') return replayed('owner-token', viaToken, tokenRemote);
     } catch (e) {
       return miss('failed', `(could not stage the owner's credential: ${String((e && e.message) || e).slice(0, 160)})`);
     } finally {
@@ -547,6 +565,7 @@ async function pushUpgradePin(inst, deps, { instanceDir }) {
     return { pushed: true, via: 'origin', branch };
   }
   const fault = pushFault(r);
+  if (fault === 'behind') return replayed('origin', hardened, 'origin');
   // A refusal here is not the owner's access being turned down — there was none to turn
   // down. It is the read-only key, which is the no-access case.
   // ...unless the project has no account of its own, in which case no key CAN be minted

package/scripts/gds/provision-pin-replay.js

@@ -0,0 +1,126 @@
+'use strict';
+// provision-pin-replay.js — when GitHub is AHEAD of a hosted project's box, put the core move's
+// pin commit on top of GitHub's history instead of leaving GitHub on the old core (task 1004733,
+// ADR 0350 amendment).
+//
+// WHY. pushUpgradePin pushes the pin commit the move made on the box. For a project the owner
+// works from a laptop, GitHub almost always has commits the box does not, so that push is
+// refused as non-fast-forward ("behind"). Before this file the move then finished `done` with a
+// repo_not_updated note: the box ran the new core, GitHub still named the old one, and the next
+// deploy from GitHub could quietly roll the core back.
+//
+// WHAT IT DOES. Fetch the branch over the SAME credential that was refused, replay ONLY the pin
+// commit (package.json + package-lock.json, and any generated file upgrade.js committed with it)
+// on top of what was fetched, and push that — an ordinary fast-forward, never forced.
+//
+// THE LIVE BOX IS NOT TOUCHED. The replay happens in a scratch worktree (mode 0700, outside the
+// checkout, removed whatever happened). The box's HEAD, files and running site stay exactly what
+// the move's health check proved, which is why the old "nothing is rebased" rule (changing what
+// the box runs with no restart and no health check) still holds.
+//
+// A REAL CONFLICT STOPS. If the owner changed the same lines of those files, choosing between the
+// two is a person's call: the cherry-pick is aborted, nothing is pushed, and the note names the
+// files ("conflict"). Anything else that goes wrong reports, never retries in a loop.
+//
+// OUT OF SCOPE, ON PURPOSE: the box picking up the owner's OTHER commits. Nothing pulls them onto
+// a hosted box after provisioning (standalonePullCmd runs at provision time only, provision.js);
+// merging them into a live checkout here would deploy the owner's code with no install, migrate,
+// restart or health check — a deploy, not a pin push. ADR 0350's amendment records that ruling.
+//
+// NEVER THROWS: the caller turns a throw into a broken instance, and this instance is running.
+
+const crypto = require('node:crypto');
+const os = require('node:os');
+
+// The subject upgrade.js persistPin gives the pin commit. Anything else at HEAD is not ours to
+// replay onto someone's history.
+const PIN_SUBJECT_RE = /^pin @bongos\/core /;
+const PIN_FILES = ['package.json', 'package-lock.json'];
+const SHA_RE = /^[0-9a-f]{40,64}$/;
+// A scratch path the shell may see unquoted (the tmp dir itself is the runner's, but checked).
+const SAFE_PATH_RE = /^[A-Za-z0-9_./:~-]+$/;
+
+const failedRun = (r) => !r || r.softFailed === true || r.ok === false;
+const out = (r) => String((r && r.stdout) || '').trim();
+
+/**
+ * Replay the box's pin commit onto the branch GitHub has, and push it.
+ *
+ * @param {object} o
+ *   exec        the CONTROL PLANE executor (the one pushUpgradePin pushed with)
+ *   instanceDir the project's checkout on the hub
+ *   branch      the branch pushUpgradePin pushed (already BRANCH_RE-checked)
+ *   git         the credentialed, hardened git prefix that was refused as behind
+ *   remote      the remote that same push named
+ *   env         that push's env (GIT_TERMINAL_PROMPT=0)
+ *   slug        the project's (validated) slug, for the scratch path's name
+ *   tmpDir      where the scratch worktree goes (default os.tmpdir())
+ *   pushFault, gitLine  pushUpgradePin's own readers of a git refusal
+ * @returns {{ ok:true, replayed?:true, already?:true } | { ok:false, code:string, extra:string }}
+ */
+function replayPinCommit(o) {
+  try { return replay(o); } catch (e) {
+    return { ok: false, code: 'failed', extra: `(the pin could not be replayed: ${String((e && e.message) || e).slice(0, 160)})` };
+  }
+}
+
+function replay({ exec, instanceDir, branch, git, remote, env, slug, tmpDir, pushFault, gitLine, log = () => {} }) {
+  const plain = `git -C ${instanceDir} -c core.hooksPath=/dev/null`;
+  const run = (cmd, extraEnv) => exec(cmd, { allowFail: true, env: { ...env, ...(extraEnv || {}) } });
+
+  // 1. HEAD must be the move's own pin commit, with one parent, or there is nothing of ours to replay.
+  const head = run(`${plain} log -1 --format=%H%n%P%n%cn%n%ce%n%s HEAD`);
+  const [sha, parents, cn, ce, subject] = out(head).split('\n');
+  if (failedRun(head) || !SHA_RE.test(sha || '') || String(parents || '').split(' ').length !== 1 || !PIN_SUBJECT_RE.test(subject || '')) {
+    return { ok: false, code: 'behind', extra: '(the newest change on the server is not the version change, so it was not added on top)' };
+  }
+
+  // 2. What GitHub has now, over the same credential. Only FETCH_HEAD is written for it.
+  const fetched = run(`${git} fetch --no-tags ${remote} ${branch}`);
+  if (failedRun(fetched)) return { ok: false, code: 'behind', extra: gitLine(fetched) };
+  const upR = run(`${plain} rev-parse FETCH_HEAD`);
+  const up = out(upR);
+  if (failedRun(upR) || !SHA_RE.test(up)) return { ok: false, code: 'behind', extra: '(could not read what GitHub has)' };
+
+  // Already pinned the same way upstream (the owner bumped it by hand): nothing to add.
+  const same = run(`${plain} diff --quiet ${up} ${sha} -- ${PIN_FILES.join(' ')}`);
+  if (!failedRun(same)) return { ok: true, already: true };
+
+  // 3. Replay in a private scratch worktree, so the live checkout never moves.
+  const base = String(tmpDir || os.tmpdir()).replace(/\\/g, '/').replace(/\/+$/, '');
+  const wt = `${base}/bongos-pin-replay-${slug}-${process.pid}-${crypto.randomBytes(6).toString('hex')}`;
+  if (!SAFE_PATH_RE.test(wt)) return { ok: false, code: 'failed', extra: '(no safe scratch folder to replay the version change in)' };
+  try {
+    const made = run(`umask 077 && mkdir ${wt}`);
+    const added = failedRun(made) ? made : run(`${plain} worktree add --detach ${wt} ${up}`);
+    if (failedRun(added)) return { ok: false, code: 'failed', extra: gitLine(added) };
+    const at = `git -C ${wt} -c core.hooksPath=/dev/null`;
+    // The pin commit keeps its author and message; its committer stays who committed it on the
+    // box (env, not argv — a name is never shell-interpolated).
+    const who = cn && ce ? { GIT_COMMITTER_NAME: cn, GIT_COMMITTER_EMAIL: ce } : {};
+    const picked = run(`${at} cherry-pick ${sha}`, who);
+    if (failedRun(picked)) {
+      const both = out(run(`${at} diff --name-only --diff-filter=U`)).split('\n').filter(Boolean);
+      run(`${at} cherry-pick --abort`);
+      if (both.length) return { ok: false, code: 'conflict', extra: `(changed on both sides: ${both.join(', ').slice(0, 200)})` };
+      return { ok: false, code: 'failed', extra: gitLine(picked) };
+    }
+    const nextR = run(`${at} rev-parse HEAD`);
+    const next = out(nextR);
+    if (failedRun(nextR) || !SHA_RE.test(next)) return { ok: false, code: 'failed', extra: '(the replayed version change could not be read back)' };
+
+    // 4. A plain fast-forward of GitHub's branch to the replayed commit. A second refusal
+    // (someone pushed in between) is reported, not chased.
+    const pushed = run(`${git} push ${remote} ${next}:refs/heads/${branch}`);
+    if (failedRun(pushed)) return { ok: false, code: pushFault(pushed), extra: gitLine(pushed) };
+    log(`  ✓ GitHub had newer commits: the pin was added on top of them (${next.slice(0, 12)})`);
+    return { ok: true, replayed: true };
+  } finally {
+    // Not --force: the abort above leaves it clean, and the rm + prune catch anything left.
+    run(`${plain} worktree remove ${wt}`);
+    run(`rm -rf ${wt}`);
+    run(`${plain} worktree prune`);
+  }
+}
+
+module.exports = { replayPinCommit };

package/scripts/gds/provision-repo.js

@@ -383,6 +383,64 @@ function dbRoleGrantsCmd(inst, { privileged = false } = {}) {
   return asPostgres(`psql -v ON_ERROR_STOP=1 -d ${db} -c '${sql}'`, privileged);
 }
 
+// Hand OWNERSHIP of everything in the schema to the instance role (task 1004735). The grants
+// above are not enough: GRANT ALL carries no right to ALTER a table or CREATE OR REPLACE a
+// function, which only the OWNER has. Later core moves migrate AS the instance role
+// (--migrate-as, task 1004512), so the first migration that changed an existing table failed
+// with "must be owner of table tasks" and the move rolled back — toast, 2026-10-14.
+//
+// Object by object, never REASSIGN OWNED BY postgres: that also reassigns every SHARED object
+// postgres owns — sibling projects' whole databases included. Skipped on purpose:
+//   • objects an EXTENSION owns (pg_depend deptype e) — not the project's, and ALTER errors;
+//   • sequences linked to a table column (deptype a/i) — they follow their table, and an
+//     ALTER SEQUENCE on one errors;
+//   • row types of tables and auto-made array types — they follow their table / element.
+// Idempotent: only objects not already owned by the role are touched, so a re-run is a no-op.
+//
+// Same quoting rule as the commands above: dollar-quoted literals, format(%I)/regclass for
+// identifiers — no single or double quote, so it rides psql -c '…' and bash -s unchanged. And
+// never the text $p$: that marks a password for the runner's log redaction (provision.mjs), which
+// is why kind lists are array literals and a procedure is the ELSE of f/w/a.
+// Run as postgres, in the instance's own database: provision.js step 2b (right after the
+// grants), and the migrate_not_owner remedy in wedge-remedy.js for projects provisioned before.
+function dbOwnershipSql(role, schema = 'public') {
+  if (!/^[A-Za-z0-9_-]{1,63}$/.test(String(role || ''))) throw new Error(`dbOwnershipSql: role ${JSON.stringify(role)} is not a plain role name`);
+  if (!/^[a-z_][a-z0-9_]{0,62}$/.test(String(schema))) throw new Error(`dbOwnershipSql: schema ${JSON.stringify(schema)} is not a plain schema name`);
+  const r = `$r$${role}$r$`;
+  const ns = `$s$${schema}$s$::regnamespace`;
+  const notExt = (cat, col, types = '$e$e$e$') =>
+    `NOT EXISTS (SELECT 1 FROM pg_depend d WHERE d.classid = $c$${cat}$c$::regclass AND d.objid = ${col} AND d.deptype IN (${types}))`;
+  const k = (x) => `$k$${x}$k$`;
+  const t = (x) => `$t$${x}$t$`;
+  const anyOf = (list) => '$k${' + list + '}$k$::char[]'; // an array literal, not $k$p$k$ — see the $p$ note above
+  return `DO $own$ DECLARE o record; BEGIN ` +
+    // tables, partitions, views, materialized views, foreign tables — their indexes, row types
+    // and column-owned sequences follow them
+    `FOR o IN SELECT c.oid::regclass AS obj, c.relkind FROM pg_class c WHERE c.relnamespace = ${ns} ` +
+    `AND c.relkind = ANY (${anyOf('r,p,v,m,f')}) AND c.relowner <> ${r}::regrole AND ${notExt('pg_class', 'c.oid')} LOOP ` +
+    `EXECUTE format($f$ALTER %s %s OWNER TO %I$f$, CASE o.relkind WHEN ${k('v')} THEN ${t('VIEW')} WHEN ${k('m')} THEN ${t('MATERIALIZED VIEW')} WHEN ${k('f')} THEN ${t('FOREIGN TABLE')} ELSE ${t('TABLE')} END, o.obj, ${r}); END LOOP; ` +
+    // free-standing sequences
+    `FOR o IN SELECT c.oid::regclass AS obj FROM pg_class c WHERE c.relnamespace = ${ns} AND c.relkind = ${k('S')} ` +
+    `AND c.relowner <> ${r}::regrole AND ${notExt('pg_class', 'c.oid', '$e$e$e$, $e$a$e$, $e$i$e$')} LOOP ` +
+    `EXECUTE format($f$ALTER SEQUENCE %s OWNER TO %I$f$, o.obj, ${r}); END LOOP; ` +
+    // functions, procedures, aggregates — what CREATE OR REPLACE needs to own
+    `FOR o IN SELECT p.oid::regprocedure AS obj, p.prokind FROM pg_proc p WHERE p.pronamespace = ${ns} ` +
+    `AND p.proowner <> ${r}::regrole AND ${notExt('pg_proc', 'p.oid')} LOOP ` +
+    `EXECUTE format($f$ALTER %s %s OWNER TO %I$f$, CASE o.prokind WHEN ${k('f')} THEN ${t('FUNCTION')} WHEN ${k('w')} THEN ${t('FUNCTION')} WHEN ${k('a')} THEN ${t('AGGREGATE')} ELSE ${t('PROCEDURE')} END, o.obj, ${r}); END LOOP; ` +
+    // free-standing types: enums, domains, ranges, and composite types made by CREATE TYPE
+    `FOR o IN SELECT y.oid::regtype AS obj, y.typtype FROM pg_type y WHERE y.typnamespace = ${ns} AND y.typowner <> ${r}::regrole ` +
+    `AND (y.typtype = ANY (${anyOf('e,d,r')}) OR (y.typtype = ${k('c')} AND EXISTS (SELECT 1 FROM pg_class c WHERE c.oid = y.typrelid AND c.relkind = ${k('c')}))) ` +
+    `AND ${notExt('pg_type', 'y.oid')} LOOP ` +
+    `EXECUTE format($f$ALTER %s %s OWNER TO %I$f$, CASE o.typtype WHEN ${k('d')} THEN ${t('DOMAIN')} ELSE ${t('TYPE')} END, o.obj, ${r}); END LOOP; ` +
+    `END $own$;`;
+}
+
+// The ownership handover as a command (task 1004735): provisioning runs it after the grants,
+// and the migrate_not_owner remedy runs it for a project provisioned before that. PURE.
+function dbOwnershipCmd(inst, { privileged = false } = {}) {
+  return asPostgres(`psql -v ON_ERROR_STOP=1 -d ${dbName(inst)} -c '${dbOwnershipSql(instanceDbRole(inst))}'`, privileged);
+}
+
 // ── STANDALONE scaffold (ADR 0108 / 0125, task 2055) ──────────────────────────
 // The MISSING first leg of the greenfield "one guided flow": provision.js used to
 // THROW if the instance repo wasn't already cloned. These generate + run the scaffold
@@ -1242,6 +1300,8 @@ module.exports = {
   dbRoleCmd,
   dbRoleCmdShown,
   dbRoleGrantsCmd,
+  dbOwnershipCmd,
+  dbOwnershipSql,
   deployKeyPath,
   deployKeyTitle,
   ensureInstanceUserCmd,

package/scripts/gds/provision.js

@@ -49,7 +49,7 @@ const crypto = require('node:crypto');
 
 const retry = require('./intent-retry.js'); // when a failed intent is tried again (task 1004447)
 const { CONFIG, MANIFEST_UA, softFailResult, MANIFEST_VERIFY_INTERVAL_MS, MANIFEST_VERIFY_TRIES, MAX_INTENT_ATTEMPTS, REPO_ROOT, coreVersionSafe, hasFlag, loadDeps, oauthSecret, provisionerBotEmail } = require('./provision-config.js');
-const { accountPreflight, appUser, alreadyScaffolded, buildCorePinRefreshCommit, coreCheckoutHasGit, dbCreateCmd, dbName, dbRoleCmd, dbRoleCmdShown, dbRoleGrantsCmd, ensureInstanceUserCmd, generateDbPassword, grantInstanceRepoReadCmd, instanceDbRole, instanceStateDir, instanceUser, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
+const { accountPreflight, appUser, alreadyScaffolded, buildCorePinRefreshCommit, coreCheckoutHasGit, dbCreateCmd, dbName, dbRoleCmd, dbRoleCmdShown, dbRoleGrantsCmd, dbOwnershipCmd, ensureInstanceUserCmd, generateDbPassword, grantInstanceRepoReadCmd, instanceDbRole, instanceStateDir, instanceUser, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
 const { backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath, backupUnitName, envPrefixMismatch, instanceManifestCmd, originEnvVarsFor, serviceUnit, serviceUnitPath, settingsConsumed, settingsEnvVarsFor, renamedEnvCarry, upsertEnvVars, webEnvBody, webEnvPath } = require('./provision-units.js');
 const { caddyBlock, caddySnippetPath, checkCaddyWiring, checkDnsTokenScope, classifyZoneScope, dnsReleaseEnv, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, identityCmd, identityVerdict, ingressPlaneGap, ingressPreflight, shouldFederate, zoneForDomain } = require('./provision-net.js');
 const { resolveProcessManager } = require('./provision-process.js');
@@ -463,6 +463,11 @@ async function provisionInstance(inst, deps) {
   // call site also suppresses stderr). The GRANTS carry no secret and log in full.
   boxExec(dbRoleCmd(inst, { password: dbPassword, privileged }), { shown: dbRoleCmdShown(inst) });
   boxExec(dbRoleGrantsCmd(inst, { privileged }));
+  // Grants are not ownership: later moves migrate AS this role and must ALTER what the migrate
+  // above created as postgres (task 1004735). Non-fatal on purpose — if it ever fails, the
+  // project still serves, and the first move that needs it applies it (migrate_not_owner).
+  const own = boxExec(dbOwnershipCmd(inst, { privileged }), { allowFail: true });
+  if (own && own.softFailed) log('  ⚠ [db] could not hand the schema to the instance role — its first core move that ALTERs a table will retry it (migrate_not_owner)');
 
   // ── step 3: config + per-instance secrets ─────────────────────────────────
   log('  [config] per-instance web.env');
@@ -1280,6 +1285,7 @@ async function cmdRunIntents(deps) {
     }
   }
   await snapshotAllCoreVersions(deps); // refresh what the deploy control reads, AFTER the drain (ADR 0293 D3/D6)
+  await require('./provision-auto-upgrade.js').autoUpgradeTick(deps); // then act on each hosted project's update rule: preflight, then move, one per tick (task 1004729, ADR 0381)
   const m = await drainOAuthManifests(deps); // same tick: convert + place any GitHub-App-Manifest creds awaiting the control plane
   await require('./provision-github-setup.js').verifyGithubAppSetups(deps).catch((e) => log(`  github-setup check failed (non-blocking): ${e.message}`)); // install + device flow, asked of GitHub with the app's key (task 1004649)
   log(`done — ran=${ran} ok=${ok} errors=${errors}; oauth-manifest converted=${m.converted} errors=${m.errors}`);

package/scripts/gds/run-unit-tests.js

@@ -184,6 +184,10 @@ const INTEGRATION = new Set([
   // the --integration lane never saw them either, because it runs only this set. A
   // test that cannot fail in either lane is a file that looks like a gate.
   'handle_machinery', 'hub_profile_leak', 'profile_fields',
+  // task 1004735: the schema ownership handover (provision-repo.js dbOwnershipSql) against a
+  // real engine — one DO block of catalog queries, so only Postgres can say it runs, what it
+  // reaches and that it leaves extension objects alone. Throwaway schema + role, dropped after.
+  'db_ownership_handover',
   // task 1002300 (R24): guilds against real SQL. The DB-free sibling
   // (guilds_api) pins the route layer and statement shapes; only a real engine
   // proves the one-owner partial index, the expiry CTE drained before its insert,

package/scripts/gds/upgrade-outcome.js

@@ -66,6 +66,9 @@ const REASON_CLASS = Object.freeze({
   // a migration's CHECK constraint is broken by rows the project already has (task 1004734): a
   // retry fails identically and no remedy may rewrite the owner's data, so a person decides.
   migrate_check_violation: 'unknown',
+  // a migration ALTERs an object the project's own account does not OWN — the tables were made
+  // by postgres at provisioning (task 1004735). Known fix: hand them over (wedge-remedy.js).
+  migrate_not_owner: 'known_wedge',
   restart: 'unknown',
   health: 'unknown',
   // the runner's one automatic fix did not clear it, or itself failed (task 1004448)
@@ -90,6 +93,7 @@ const UPGRADE_REASONS = [
   [/^npm install failed/, 'npm_install'],
   [/^integrity pin/, 'integrity_pin'],
   [/^migrate failed .*\bERROR: .*check constraint/, 'migrate_check_violation'], // upgrade-migrate.js migrateError (task 1004734)
+  [/^migrate failed .*\bmust be owner of /, 'migrate_not_owner'], // Postgres' own wording (task 1004735)
   [/^migrate failed/, 'migrate'],
   [/^restart failed/, 'restart'],
   [/^(health check failed after restart|served core version did not change)/, 'health'],

package/scripts/gds/wedge-remedy.js

@@ -14,6 +14,10 @@
 //                     knows is safe to delete — they are copies, and the newest are kept).
 //   schema_pending  — the project's database is behind the code it is running NOW. Fix:
 //                     migrate that database, with its own PGDATABASE, before the code moves.
+//   migrate_not_owner — a migration changed a table or function the project's own account
+//                     does not OWN: provisioning made them as postgres (task 1004735). Fix:
+//                     hand ownership of the project's schema to its account, as postgres.
+//                     Heals every project provisioned before provision-repo.js did this itself.
 // intent-retry.js retires every known_wedge at once, so on its own the failure only waited
 // for a person. This file runs the fix, records it as an event on the project, and re-pends
 // the move for ONE more try.
@@ -33,13 +37,13 @@
 // runner's own exec and db, so every fix is testable with an injected exec.
 
 const { CONFIG } = require('./provision-config.js');
-const { dbName, selfInstanceRoot, standaloneRoot } = require('./provision-repo.js');
+const { dbName, dbOwnershipCmd, instanceDbRole, selfInstanceRoot, standaloneRoot } = require('./provision-repo.js');
 const { migratePlan, CORE_MIGRATE_SCRIPT, ACCOUNT_RE } = require('./upgrade-migrate.js');
 const { isValidSlug } = require('../../modules/provisioning/provisioning.js');
 const outcome = require('./upgrade-outcome.js');
 const { DEFAULT_RETRY_DELAY_MS } = require('./intent-retry.js');
 
-const REMEDY_REASONS = Object.freeze(['dirty_tree', 'disk_full', 'schema_pending']);
+const REMEDY_REASONS = Object.freeze(['dirty_tree', 'disk_full', 'schema_pending', 'migrate_not_owner']);
 // The newest dumps a disk-full prune always leaves behind: a week of nightlies. The nightly
 // job's own retention is 30 days; this only ever cuts below that when the disk is full.
 const DUMP_KEEP_FLOOR = 7;
@@ -95,6 +99,13 @@ function planRemedy(inst, reason, o = {}) {
       describe: `pruned ${db}'s old database backups in ${backupDir}, keeping the newest ${DUMP_KEEP_FLOOR}`,
     };
   }
+  if (reason === 'migrate_not_owner') {
+    // A control plane migrates as its own app user, which created its tables — there is no
+    // separate project account to hand them to, so the snag cannot be this one there.
+    if (inst.hosting_shape === 'control-plane') return { refused: 'the control plane has no separate project account to hand its tables to' };
+    const role = instanceDbRole(inst);
+    return { reason, cwd: null, env: null, cmd: dbOwnershipCmd(inst, { privileged: o.privileged }), describe: `handed ownership of ${db}'s tables and functions to ${role}, the account its migrations run as` };
+  }
   // schema_pending — the project's OWN migrate command (a declared script wins, else the
   // core's migrate.sh: upgrade-migrate.js), aimed at its OWN database. migrate.sh defaults to
   // production when PGDATABASE is unset, so it is always set, never inherited.

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.116'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.118'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');