@bongos/core 1.21.13 → 1.21.15

package/tests/autobongos_host_access.mjs

@@ -0,0 +1,176 @@
+// tests/autobongos_host_access.mjs — the runner skips work it structurally
+// cannot do (task 1004537).
+//
+// The runner machine holds no SSH key, no root and no service environment for a
+// live droplet (ADR 0031 §6 / ADR 0055). Tasks 1003969 and 1003980 were still
+// picked, three times between them, and each run burned a claim and filed an
+// owner blocker saying the work was never doable there. These tests hold the
+// fence that stops that: a host-access task is SKIPPED, before any claim, with
+// the reason `needs_host_access` in nothing_claimable's skipped[], and an
+// ordinary code task beside it is still picked.
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import os from 'node:os';
+import path from 'node:path';
+
+const require = createRequire(import.meta.url);
+const fence = require('../modules/autonomy/fence.js');
+const runner = require('../scripts/gds/autobongos-run.js');
+
+const { needsHostAccess, decideTask } = fence;
+
+// The two real shapes, excerpted from their task rows (touches, tags and
+// manual_degree exactly as they were: nothing explicit marked either one).
+const T1003969 = {
+  id: 1003969, goal_id: 1000119, kind: 'bug', status: 'ready', requires_rank: 'xenos',
+  touches: ['docs/recipes/upgrading-the-core.md'], manual_degree: null, automation_tag: null,
+  title: 'Install the core-update-subscription timer at the declared 15min cadence on the cloudbongos.com control plane',
+  description: [
+    'WHAT REMAINS (host state, not in this repo): the systemd unit lives on the droplet.',
+    '/etc/systemd/system/cloudbongos-core-update-subscription.timer is still OnCalendar=daily with RandomizedDelaySec=1800. Change it to:',
+    '    OnCalendar=*:0/15',
+    'then `sudo systemctl daemon-reload && sudo systemctl restart cloudbongos-core-update-subscription.timer`',
+  ].join('\n'),
+};
+const T1003980 = {
+  id: 1003980, goal_id: 1000119, kind: 'bug', status: 'ready', requires_rank: 'xenos',
+  touches: [], manual_degree: null, automation_tag: null,
+  title: 'Recover the five lost bug-attachment screenshots from the co-hosting box, or accept the loss on the record',
+  description: [
+    'WHAT IS LEFT. ADR 0126 kept the old co-hosting droplet as a rollback net after the 2026-07-05 move.',
+    'If its var/bug-attachments survived, the five files are recoverable by copying them onto the control-plane droplet at BUG_ATTACHMENTS_DIR.',
+    'WHY IT IS A SEPARATE ROW. It needs an interactive session on two live boxes - look for var/bug-attachments on the old droplet,',
+    'copy across, set BUG_ATTACHMENTS_DIR in the service environment, confirm the probe goes green.',
+    'DONE WHEN: either the audit reports zero missing, or the files are confirmed unrecoverable.',
+  ].join('\n'),
+};
+const CODE_TASK = {
+  id: 9002, goal_id: 1000119, kind: 'feature', status: 'ready', requires_rank: 'xenos',
+  touches: ['scripts/gds/sequence.js'], manual_degree: null, automation_tag: null,
+  title: 'Teach the picker a new halt reason',
+  description: 'Add a halt reason to scripts/gds/sequence.js and cover it with a tests/*.mjs case. '.repeat(4)
+    + 'DONE WHEN: the new case passes and the old ones still do.',
+};
+
+// ── the predicate ───────────────────────────────────────────────────────────────
+
+test('the 1003969 shape (systemd unit edited on the droplet via sudo) needs host access', () => {
+  const d = needsHostAccess(T1003969);
+  assert.equal(d.needs, true);
+  assert.equal(d.source, 'text');
+  assert.ok(d.signals.length, 'the matched phrase is named, so a false positive can be seen and overridden');
+});
+
+test('the 1003980 shape (copying files between two live boxes) needs host access', () => {
+  const d = needsHostAccess(T1003980);
+  assert.equal(d.needs, true);
+  assert.equal(d.source, 'text');
+});
+
+test('an ordinary code task does not', () => {
+  assert.equal(needsHostAccess(CODE_TASK).needs, false);
+});
+
+test("the explicit tag wins both ways: 'live-only' skips with no text, 'overnight-safe' overrides the text", () => {
+  const tagged = needsHostAccess({ ...CODE_TASK, automation_tag: 'live-only' });
+  assert.equal(tagged.needs, true);
+  assert.equal(tagged.source, 'automation_tag');
+  // An owner who reads the reason and disagrees marks the task safe; the phrase
+  // match must then stay quiet rather than refuse forever.
+  assert.equal(needsHostAccess({ ...T1003969, automation_tag: 'overnight-safe' }).needs, false);
+});
+
+test('code that merely talks ABOUT droplets is not mistaken for work ON one', () => {
+  const t = { ...CODE_TASK, description: 'The DigitalOcean droplet-create call in modules/box/do-client.js leaks a droplet when the API blips. Fix the retry so no droplet is orphaned. '.repeat(2) };
+  assert.equal(needsHostAccess(t).needs, false);
+});
+
+test('one passing mention of the box does not refuse a code task (the task 1004463 shape)', () => {
+  // A real ready task on 2026-10-02: a code fix whose description quotes the
+  // owner's current workaround. One phrase is description, not the work.
+  const t = { ...CODE_TASK, description: `${CODE_TASK.description} Today the owner's only route is \`ssh cloudbongos 'systemctl restart cloudbongos'\`; the hall should do it instead.` };
+  const d = needsHostAccess(t);
+  assert.equal(d.needs, false);
+  assert.deepEqual(d.signals, ['systemctl restart'], 'the lone phrase is still reported, so the threshold is visible');
+  // The same phrase twice over, as in the two real shapes, does refuse.
+  const twice = { ...t, description: `${t.description} Then sudo systemctl daemon-reload on the production droplet.` };
+  assert.equal(needsHostAccess(twice).needs, true);
+});
+
+test('a missing task is not a host-access task (decideTask refuses it on its own)', () => {
+  assert.equal(needsHostAccess(null).needs, false);
+});
+
+// ── decideTask refuses it, like protected_path ─────────────────────────────────
+
+test('decideTask refuses a host-access task with code needs_host_access', () => {
+  const d = decideTask({ task: T1003969, goals: [1000119], protectedHits: [] });
+  assert.equal(d.go, false);
+  assert.equal(d.code, 'needs_host_access');
+  assert.match(d.reason, /live host/);
+  assert.equal(decideTask({ task: CODE_TASK, goals: [1000119], protectedHits: [] }).go, true);
+});
+
+// ── the picker: skipped with a reason, and the code task behind it is picked ───
+
+function fakeApi(tasks, claimable) {
+  return {
+    me: { getMe: async () => ({ ok: true, data: { builder: { rank: 'archon' } } }) },
+    tasks: {
+      getTasks: async ({ query }) => ({ ok: true, data: { tasks: query.offset ? [] : tasks } }),
+      getTasksId: async ({ id }) => {
+        const t = tasks.find((x) => Number(x.id) === Number(id));
+        return t ? { ok: true, data: { task: { dependencies: [], dependents: [], ...t } } } : { ok: false };
+      },
+      getTasksClaimable: async () => ({ ok: true, data: { claimable: claimable.map((id) => ({ id })) } }),
+    },
+  };
+}
+
+test('pickTask walks past the host-access tasks to the code task behind them', async () => {
+  const api = fakeApi([T1003969, T1003980, CODE_TASK], [1003969, 1003980, 9002]);
+  const got = await runner.pickTask([1000119], { api, rank: 'archon' });
+  assert.equal(got.task && got.task.id, 9002, 'an ordinary code task is still picked');
+});
+
+test('when only host-access tasks are left, they appear in skipped[] as needs_host_access', async () => {
+  const api = fakeApi([T1003969, T1003980], [1003969, 1003980]);
+  const got = await runner.pickTask([1000119], { api, rank: 'archon' });
+  assert.equal(got.none, true, 'no claim is made on work the machine cannot do');
+  const byId = new Map(got.skipped.map((s) => [Number(s.id), s]));
+  for (const id of [1003969, 1003980]) {
+    const sk = byId.get(id);
+    assert.ok(sk, `task ${id} must be listed, not silently vanish`);
+    assert.ok(sk.reasons.some((r) => r.code === 'needs_host_access'), `task ${id} carries the reason`);
+    assert.equal(sk.goal_id, 1000119);
+  }
+});
+
+test('the nothing_claimable row the iteration writes carries needs_host_access', async () => {
+  const api = fakeApi([T1003969], [1003969]);
+  let claimed = false;
+  const row = await runner.iteration({ goals: [1000119] }, {
+    readFence: async () => ({ raw: { enabled: true, paused_reason: null, goals: [{ goal_id: 1000119 }] }, graderBypassed: false }),
+    gauge: () => ({ decision: { go: true, unknown: false, sleepUntil: null, reason: 'headroom' } }),
+    state: runner.newRunnerState(),
+    pickTask: (goals, d) => runner.pickTask(goals, { ...d, api, rank: 'archon' }),
+    run: async () => { claimed = true; return { ok: true, code: 0, stdout: '', stderr: '' }; },
+    // Inert stand-ins, so a regression that DOES pick the task fails this test
+    // without spawning a real worker or writing to a real ledger.
+    spawnWorker: async () => { claimed = true; return { code: 0, envelope: null, stdout: '', stderr: '' }; },
+    worktreeName: () => 'autobongos-test-host-access',
+    gradeLedgerPath: () => path.join(os.tmpdir(), `autobongos-host-access-${process.pid}.jsonl`),
+    api,
+    verifyDeps: {
+      task: { id: 1003969, status: 'shipped', updated_at: new Date().toISOString() },
+      probeArtifact: async () => ({ checked: true, onMain: true, sha: 'a'.repeat(40), subject: 'x' }),
+      fileBlocker: async () => ({ filed: false }),
+    },
+    record: (r) => r,
+  });
+  assert.equal(row.event, 'nothing_claimable');
+  assert.equal(claimed, false, 'no worktree is made and no claim is attempted');
+  assert.deepEqual(row.skipped, [{ id: 1003969, goal_id: 1000119, reasons: ['needs_host_access'] }]);
+});

package/tests/core_upgrade_runner.mjs

@@ -507,12 +507,20 @@ await t('the control plane upgrades as the operator account, never as root', asy
   assert.doesNotMatch(cmd, /sudo node /, 'a bare `sudo node` is the bug — it lands on root');
 });
 
-await t('a tenant upgrades as its OWN account, which is also its Postgres login role', async () => {
+await t('a tenant MOVES as the account that owns its checkout and MIGRATES as its own (task 1004512)', async () => {
+  // The move writes: the pin, node_modules, .claude/, the pin commit — and before any of
+  // that, `git status`. Those belong to the app user, which is who scaffolded the
+  // checkout; the instance account only has group READ on it, so running the move as that
+  // account made git refuse with "detected dubious ownership" and the clean-tree pre-flight
+  // report dirt that did not exist. The DATABASE is the opposite: it is owned by the
+  // instance's own Postgres login role with CONNECT revoked from PUBLIC, so only that
+  // account can migrate it. Hence one move, two accounts.
   const d = { ...makeDeps({ served: '1.19.762' }), privileged: true };
   await R.coreUpgradeInstance(inst({ hosting_shape: 'cloud-host', slug: 'test4', port: 3006 }), d, intent());
   const cmd = upgradeCall(d);
-  assert.match(cmd, /sudo -u bongos-test4 /, 'the instance account, not the operator and not root');
-  assert.doesNotMatch(cmd, /sudo -u appsvc /, 'one tenant must never be upgraded under another account');
+  assert.match(cmd, /sudo -u appsvc /, 'the move runs as the account that owns the checkout');
+  assert.match(cmd, /--migrate-as bongos-test4\b/, 'and hands the database steps to the instance account');
+  assert.doesNotMatch(cmd, /sudo -u bongos-test4 /, 'the instance account must not be asked to write a checkout it can only read');
 });
 
 await t('the database is NAMED, not discovered — an adopted repo has no core at its root to ask', async () => {
@@ -568,7 +576,9 @@ await t('ONE builder serves both legs — the preview and the move cannot drift
   const box = { id: 7, slug: 'test4', port: 3006, hosting_shape: 'cloud-host', db_name: 'test4' };
   const move = R.upgradeInvocation(box, '1.19.921', { privileged: true, requestedBy: '42' });
   const peek = R.upgradeInvocation(box, '1.19.921', { privileged: true, dryRun: true });
-  for (const shared of ['sudo -u bongos-test4 ', 'env PGDATABASE=test4 ', '--to 1.19.921', '--registry']) {
+  // --migrate-as is SHARED, not tail: the dry run's own database pre-check connects as that
+  // account too, so a preview that omitted it would test a different identity than the move.
+  for (const shared of ['sudo -u appsvc ', 'env PGDATABASE=test4 ', '--to 1.19.921', '--registry', '--migrate-as bongos-test4']) {
     assert.ok(move.cmd.includes(shared), `move carries ${shared}`);
     assert.ok(peek.cmd.includes(shared), `preview carries the same ${shared}`);
   }
@@ -746,12 +756,15 @@ function acctDeps({ accountExists = true, dryRunStdout = '', dryRunStderr = '',
   return d;
 }
 
-await t('a tenant WITH its own account runs as that account — the security model is kept', () => {
+await t('a tenant WITH its own account MIGRATES as that account — the security model is kept', () => {
   // task 1003369: a distinct uid per instance is what stops a co-tenant reading a
-  // sibling's /proc/<pid>/environ. Falling back everywhere would quietly undo it.
+  // sibling's /proc/<pid>/environ. Falling back everywhere would quietly undo it. Task
+  // 1004512 moved the file half of the work to the checkout's owner and left this half
+  // exactly where it was: the database is where the per-instance identity does its job.
   const d = acctDeps({ accountExists: true });
   const r = R.resolveRunAs(inst({ hosting_shape: 'cloud-host', slug: 'test4' }), d);
-  assert.deepEqual({ runAs: r.runAs, fellBack: r.fellBack }, { runAs: 'bongos-test4', fellBack: false });
+  assert.deepEqual({ runAs: r.runAs, migrateAs: r.migrateAs, fellBack: r.fellBack },
+    { runAs: 'appsvc', migrateAs: 'bongos-test4', fellBack: false });
 });
 
 await t('a tenant WITHOUT one falls back to the app user, and says so', () => {
@@ -762,6 +775,7 @@ await t('a tenant WITHOUT one falls back to the app user, and says so', () => {
   const d = acctDeps({ accountExists: false });
   const r = R.resolveRunAs(inst({ hosting_shape: 'cloud-host', slug: 'test4' }), d);
   assert.equal(r.runAs, 'appsvc');
+  assert.equal(r.migrateAs, 'appsvc', 'both halves land on the app user — the shape that was already working');
   assert.equal(r.fellBack, true);
   assert.equal(r.wanted, 'bongos-test4', 'and names the account that is missing');
 });
@@ -769,7 +783,8 @@ await t('a tenant WITHOUT one falls back to the app user, and says so', () => {
 await t('the control plane is never probed — it has no instance account by design', () => {
   const d = acctDeps({ accountExists: false });
   const r = R.resolveRunAs(inst({ hosting_shape: 'control-plane', slug: 'cloudbongos' }), d);
-  assert.deepEqual({ runAs: r.runAs, fellBack: r.fellBack }, { runAs: 'appsvc', fellBack: false });
+  assert.deepEqual({ runAs: r.runAs, migrateAs: r.migrateAs, fellBack: r.fellBack },
+    { runAs: 'appsvc', migrateAs: 'appsvc', fellBack: false });
   assert.equal(d.ranWith.filter((c) => /^id -u /.test(c.cmd)).length, 0, 'no probe was spent');
 });
 
@@ -796,7 +811,7 @@ await t('an INCONCLUSIVE probe keeps the isolated account rather than quietly wi
   const d = makeDeps({ served: '1.19.762' });
   d.exec = () => ({ ok: true, stdout: '', stderr: 'id: cannot connect to name service\n', softFailed: true });
   const r = R.resolveRunAs(inst({ hosting_shape: 'cloud-host', slug: 'test4' }), d);
-  assert.equal(r.runAs, 'bongos-test4', 'the intended account is kept');
+  assert.equal(r.migrateAs, 'bongos-test4', 'the intended account is kept');
   assert.equal(r.fellBack, false);
   assert.equal(r.probeInconclusive, true, 'and the caller can tell it was not a clean answer');
 });
@@ -813,7 +828,7 @@ await t('the probe uses the SAME executor the upgrade will use', () => {
   const r = R.resolveRunAs(inst({ hosting_shape: 'cloud-host', slug: 'test4' }), d);
   assert.deepEqual(asked.remote, [], 'the remote executor was not asked');
   assert.equal(asked.control.length, 1, 'the control-plane executor was');
-  assert.equal(r.runAs, 'bongos-test4', 'and its answer is the one that counts');
+  assert.equal(r.migrateAs, 'bongos-test4', 'and its answer is the one that counts');
 });
 
 await t('a planning tick probes ONCE, not twice', async () => {
@@ -860,9 +875,18 @@ await t('a fallback is recorded on the verdict the owner reads', async () => {
   const d = acctDeps({ accountExists: false, dryRunStdout: '  ✓ pre-flight: ok\n' });
   const v = await R.preflightUpgrade(inst({ hosting_shape: 'cloud-host', slug: 'test4', port: 3006 }), '1.19.762', d);
   assert.equal(v.ran_as, 'appsvc');
+  assert.equal(v.migrated_as, 'appsvc', 'the verdict names BOTH accounts — since task 1004512 there are two');
   assert.match(v.account_note, /no bongos-test4 account yet/);
 });
 
+await t('a project WITH its own account has its two accounts named separately (task 1004512)', async () => {
+  const d = acctDeps({ accountExists: true, dryRunStdout: '  ✓ pre-flight: ok\n' });
+  const v = await R.preflightUpgrade(inst({ hosting_shape: 'cloud-host', slug: 'test4', port: 3006 }), '1.19.762', d);
+  assert.equal(v.ran_as, 'appsvc', 'the files are written by the account that owns the checkout');
+  assert.equal(v.migrated_as, 'bongos-test4', 'the database is touched by the account that owns it');
+  assert.equal(v.account_note, null, 'and nothing is missing, so there is nothing to report');
+});
+
 await t('and a silent failure STILL refuses rather than inventing a pass', async () => {
   const d = acctDeps({ softFail: true, dryRunStdout: '', dryRunStderr: '' });
   const v = await R.preflightUpgrade(inst({ hosting_shape: 'cloud-host', slug: 'test4', port: 3006 }), '1.19.762', d);

package/tests/instance_db_migrated_on_code_move.mjs

@@ -32,7 +32,7 @@ const tenant = { slug: 'charter', db_name: 'charter_db', hosting_shape: 'co-tena
 
 test('bongos upgrade migrates before it restarts, and only --skip-migrate opts out', () => {
   const src = fs.readFileSync(path.join(ROOT, 'scripts/gds/upgrade.js'), 'utf8');
-  const migrate = src.indexOf('const mig = runMigrate(instanceDir, run);');
+  const migrate = src.indexOf('const mig = runMigrate(instanceDir, run, opts.migrateAs || null);');
   const restart = src.lastIndexOf('restartService({ service: opts.service, restartCmd: opts.restartCmd }');
   assert.ok(migrate > 0, 'the upgrade flow runs migrate');
   assert.ok(restart > migrate, 'the restart that makes new code live comes AFTER migrate');
@@ -42,14 +42,32 @@ test('bongos upgrade migrates before it restarts, and only --skip-migrate opts o
   // no scripts is migrated rather than rolled back. tests/upgrade_migrate.mjs exercises both.
   assert.match(src, /function runMigrate\([^)]*\) \{\n\s*const \{ cmd, args, env \} = require\('\.\/upgrade-migrate'\)\.migratePlan\(instanceDir\)/,
     'the migrate step spawns what migratePlan decides');
+  // …and as the account that OWNS the database, when the move itself runs as the one that
+  // owns the checkout (task 1004512). Those are two different accounts on every project
+  // provisioned since task 1003369, and the wrong one cannot connect at all: the project's
+  // database is owned by its own Postgres login role with CONNECT revoked from PUBLIC.
+  // Asserting the CALL SITE, not just the helper — the helper was never the gap.
+  assert.match(src, /const mig = runMigrate\(instanceDir, run, opts\.migrateAs \|\| null\);/,
+    'the migrate step is handed --migrate-as, not left on whoever the move happens to be');
   assert.equal(`bash ${CORE_MIGRATE_SCRIPT}`, INSTANCE_MIGRATE_SCRIPT, 'migrate is the instance scaffold script, i.e. the core migrate.sh');
 });
 
 test('the control-plane runner targets the instance database, not its own', () => {
-  const { cmd } = upgradeInvocation(tenant, '1.19.940', { privileged: true, runAs: 'appsvc' });
+  const { cmd } = upgradeInvocation(tenant, '1.19.940', { privileged: true, runAs: 'appsvc', migrateAs: 'appsvc' });
   assert.match(cmd, new RegExp(`PGDATABASE=${dbName(tenant)} `));
   assert.match(cmd, /upgrade\.js/);
   assert.doesNotMatch(cmd, /--skip-migrate/, 'the Deploy door never skips the schema');
+  assert.doesNotMatch(cmd, /--migrate-as/, 'one account for both halves emits no flag — unchanged from before task 1004512');
+});
+
+test('a project with its OWN account is migrated as it, whoever the move runs as (task 1004512)', () => {
+  // Naming the right database is only half of reaching it; the other half is connecting as
+  // a role that may. The runner used to solve both by running the WHOLE move as the
+  // project's account — which can only READ its checkout, so the move died at `git status`
+  // and the schema moved nowhere. Splitting the two keeps the database leg where it was.
+  const { cmd } = upgradeInvocation(tenant, '1.19.940', { privileged: true, runAs: 'appsvc', migrateAs: 'bongos-charter' });
+  assert.match(cmd, new RegExp(`PGDATABASE=${dbName(tenant)} `), 'still the instance database');
+  assert.match(cmd, /--migrate-as bongos-charter\b/, 'and now also the account that owns it');
 });
 
 test('provisioning migrates the new instance database at stand-up', () => {

package/tests/upgrade.mjs

@@ -1926,6 +1926,153 @@ t('parseArgs: --allow-downgrade is read, and is OFF unless asked for', () => {
   assert.equal(u.parseArgs(['--to', '1.0.0', '--allow-downgrade']).allowDowngrade, true);
 });
 
+// ---- 11. WHICH ACCOUNT DOES WHAT (task 1004512) -----------------------------
+//
+// Found live on cloudbongos.com: every core move on a project provisioned since task
+// 1003369 failed, and reported a dirty tree it had invented. The move ran wholly as the
+// project's own `bongos-<slug>` account, which can only READ the checkout, so `git status`
+// refused with `detected dubious ownership`, the clean-tree pre-flight read that as dirt,
+// the self-heal chain committed a tree nobody had touched, and the retry failed identically.
+// Both halves are pinned here: git's refusal is its own failure, and the database steps run
+// as the account that actually owns the database.
+
+t('a `git status` that could NOT ANSWER is not reported as uncommitted work', async () => {
+  const dir = scratchConsumer();
+  const res = await u.runUpgrade({ to: '1.15.0', instance: dir }, {
+    log: () => {}, err: () => {},
+    run: (cmd, args) => (cmd === 'git' && args[0] === 'status'
+      ? { status: 128, stdout: '', stderr: `fatal: detected dubious ownership in repository at '${dir}'\n` }
+      : { status: 0 }),
+  });
+  assert.equal(res.ok, false, 'it still refuses — nothing is known about the tree');
+  assert.match(res.error, /git could not read the working tree/, 'and says which question went unanswered');
+  assert.match(res.error, /dubious ownership/, 'carrying git\'s OWN words, not "not a git repo?"');
+  assert.doesNotMatch(res.error, /^working tree not clean/m, 'it must never claim there is uncommitted work');
+});
+
+t('…and that refusal is classified as unknown, so no remedy commits a guess', async () => {
+  const o = require('../scripts/gds/upgrade-outcome.js');
+  const dir = scratchConsumer();
+  const res = await u.runUpgrade({ to: '1.15.0', instance: dir }, {
+    log: () => {}, err: () => {},
+    run: (cmd, args) => (cmd === 'git' && args[0] === 'status'
+      ? { status: 128, stdout: '', stderr: 'fatal: detected dubious ownership in repository\n' }
+      : { status: 0 }),
+  });
+  // The whole point: dirty_tree is known_wedge, and wedge-remedy.js answers it by running
+  // `git add -u && git commit`. Doing that to a tree git would not describe commits whatever
+  // happens to be lying there, under a runner identity, in someone else's repository.
+  const reason = o.upgradeReason(res);
+  assert.equal(reason, 'git_unreadable', `got ${reason} — a failed "git status" is not a dirty tree`);
+  assert.equal(o.classifyFailure(reason).class, 'unknown', 'unknown reaches a person; known_wedge would "fix" it');
+  assert.notEqual(o.classifyFailure(reason).class, 'known_wedge');
+});
+
+t('--migrate-as hands the DATABASE steps to another account, and nothing else', async () => {
+  const dir = scratchConsumer();
+  const calls = [];
+  const res = await u.runUpgrade(
+    { to: '1.15.0', registry: true, instance: dir, migrateAs: 'bongos-p', healthCheck: false },
+    {
+      log: () => {}, err: () => {},
+      run: (cmd, args) => {
+        calls.push(`${cmd} ${(args || []).join(' ')}`.trim());
+        if (cmd === 'git' && args[0] === 'status') return { status: 0, stdout: '' };
+        if (cmd === 'npm' && args[0] === 'install') {
+          writeFileSync(join(dir, 'node_modules', '@bongos', 'core', 'package.json'),
+            JSON.stringify({ name: '@bongos/core', version: '1.15.0' }) + '\n');
+        }
+        return { status: 0, stdout: '' };
+      },
+      materialize: () => ({ skills: 0, writtenPaths: [] }),
+      regenerateApiArtifacts: () => ({ ok: true, ran: [] }),
+      resolveInstanceDb: () => ({ db: 'p', ran: true }),
+      databaseUrl: '', pgDatabase: '',
+    }
+  );
+  assert.equal(res.ok, true, `the bump ran: ${res.error || ''}`);
+  const migrate = calls.find((c) => /\bnpm run migrate\b/.test(c));
+  assert.ok(migrate, `migrate ran: ${JSON.stringify(calls)}`);
+  assert.match(migrate, /^sudo -n -u bongos-p env /, 'migrate connects as the account that owns the database');
+  const identity = calls.find((c) => /psql -tAc/.test(c));
+  assert.match(identity, /^sudo -n -u bongos-p env /, 'and so does the pre-check that decides whether it could');
+  // The other half of the split: the file work stays with whoever is running, because the
+  // project's own account cannot write this checkout.
+  for (const bare of ['git status', 'npm install']) {
+    assert.ok(calls.some((c) => c.startsWith(bare)), `${bare} runs as the move itself, unescalated`);
+    assert.ok(!calls.some((c) => c.includes(`bongos-p env ${bare}`)), `${bare} must NOT be handed to the project's account`);
+  }
+});
+
+t('with no --migrate-as, every step is spawned exactly as it was before', async () => {
+  // The shape half the fleet is on (a control plane, a project older than the per-instance
+  // account model). A flag that quietly started escalating there would be a new failure.
+  const dir = scratchConsumer();
+  const calls = [];
+  await u.runUpgrade(
+    { to: '1.15.0', registry: true, instance: dir, healthCheck: false },
+    {
+      log: () => {}, err: () => {},
+      run: (cmd, args) => {
+        calls.push(`${cmd} ${(args || []).join(' ')}`.trim());
+        if (cmd === 'npm' && args[0] === 'install') {
+          writeFileSync(join(dir, 'node_modules', '@bongos', 'core', 'package.json'),
+            JSON.stringify({ name: '@bongos/core', version: '1.15.0' }) + '\n');
+        }
+        return { status: 0, stdout: '' };
+      },
+      materialize: () => ({ skills: 0, writtenPaths: [] }),
+      regenerateApiArtifacts: () => ({ ok: true, ran: [] }),
+      resolveInstanceDb: () => ({ db: 'p', ran: true }),
+      databaseUrl: '', pgDatabase: '',
+    }
+  );
+  assert.ok(!calls.some((c) => c.startsWith('sudo')), `nothing escalated: ${JSON.stringify(calls.filter((c) => c.startsWith('sudo')))}`);
+  assert.ok(calls.some((c) => /^npm run migrate$/.test(c)), 'migrate is still the bare command');
+});
+
+t('sudo refusing the hand-over is caught BEFORE the pin moves, not at migrate', async () => {
+  // The one failure this split can add. Soft-skipping it (as "psql failed for another
+  // reason") would move the pin, install the new core, and then fail at migrate for a
+  // reason that was knowable up front — a full rollback, restarting a live service twice,
+  // to learn something one `select 1` already said.
+  const dir = scratchConsumer();
+  const calls = [];
+  const res = await u.runUpgrade(
+    { to: '1.15.0', registry: true, instance: dir, migrateAs: 'bongos-p', healthCheck: false },
+    {
+      log: () => {}, err: () => {},
+      run: (cmd, args) => {
+        calls.push(`${cmd} ${(args || []).join(' ')}`.trim());
+        if (cmd === 'sudo') return { status: 1, stdout: '', stderr: 'sudo: a password is required\n' };
+        return { status: 0, stdout: '' };
+      },
+      resolveInstanceDb: () => ({ db: 'p', ran: true }),
+      materialize: () => ({ skills: 0, writtenPaths: [] }),
+      databaseUrl: '', pgDatabase: '',
+    }
+  );
+  assert.equal(res.ok, false);
+  assert.match(res.error, /cannot run as "bongos-p"/);
+  assert.match(res.error, /a password is required/, 'carrying what sudo actually said');
+  assert.ok(!calls.some((c) => c.startsWith('npm install')), 'and nothing was installed — the pin never moved');
+  assert.equal(u.readPinnedCoreVersion(dir), '1.14.1', 'the pin is untouched');
+});
+
+t('an account name that is not one is refused before anything moves', () => {
+  // It reaches `sudo` as an argv entry, so it is refused rather than quoted into shape.
+  return u.runUpgrade({ to: '1.15.0', instance: scratchConsumer(), migrateAs: 'root; rm -rf /' }, { log: () => {}, err: () => {} })
+    .then((res) => {
+      assert.equal(res.ok, false);
+      assert.match(res.error, /not a unix account name/);
+    });
+});
+
+t('parseArgs: --migrate-as is read, and is absent unless passed', () => {
+  assert.equal(u.parseArgs(['--to', '1.0.0']).migrateAs, null);
+  assert.equal(u.parseArgs(['--to', '1.0.0', '--migrate-as', 'bongos-p']).migrateAs, 'bongos-p');
+});
+
 await Promise.all(pending);
 console.log(`\nupgrade: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/upgrade_outcome.mjs

@@ -33,6 +33,9 @@ const TABLE = [
   ['downgrade refusal', { ok: false, downgrade: true, error: 'refusing to DOWNGRADE: --to 1.19.1 is older' }, 'refused', 'downgrade', 'needs_decision'],
   ['already on the target', { ok: false, error: 'already on 1.20.1 (pass --force to re-run the steps anyway)' }, 'refused', 'already_on', 'unknown'],
   ['dirty working tree', { ok: false, error: 'working tree not clean — commit/stash first, or pass --force.\n M package.json' }, 'refused', 'dirty_tree', 'known_wedge'],
+  // task 1004512: git REFUSING to read the checkout is not a report that the checkout is
+  // dirty, and must not be classified as one — see the dedicated section at the end.
+  ['git would not read the tree', { ok: false, error: 'git could not read the working tree in /srv/cloudbongos/p — the clean-tree pre-flight never ran, so this is NOT a report of uncommitted work.\nfatal: detected dubious ownership in repository at \'/srv/cloudbongos/p\'' }, 'refused', 'git_unreadable', 'unknown'],
   ['module pre-check', { ok: false, error: 'module pre-check failed: game incompatible with core 1.20.1' }, 'refused', 'module_incompatible', 'needs_decision'],
   ['database unresolvable', { ok: false, error: 'cannot determine which database to migrate.\n    Set PGDATABASE' }, 'refused', 'db_unresolvable', 'unknown'],
   ['database identity', { ok: false, error: 'database "cb" is not reachable as the current user: role "root" does not exist' }, 'refused', 'db_identity', 'unknown'],

package/tests/wedge_remedy.mjs

@@ -37,10 +37,10 @@ const intent = (over = {}) => ({ id: 99, action: 'core-upgrade', target_version:
 const wedge = (reason) => ({ ok: false, error: `core upgrade to 1.20.31 was refused (${reason})`, failure: { class: 'known_wedge', reason } });
 const selfRoot = () => '/srv/charter';
 
-function harness({ execFails = false } = {}) {
+function harness({ execFails = false, privileged = false } = {}) {
   const ran = []; const events = []; const queries = [];
   const deps = {
-    apply: true, privileged: false, log: () => {}, selfInstanceRoot: selfRoot,
+    apply: true, privileged, log: () => {}, selfInstanceRoot: selfRoot,
     exec: (cmd, opts) => { ran.push({ cmd, ...opts }); return execFails ? { ok: false, softFailed: true, stderr: 'fatal: nope' } : { ok: true, stdout: '' }; },
     db: { query: async (sql, params) => { queries.push({ sql, params }); return { rows: [] }; } },
     provisioning: { recordEvent: async (_db, e) => { events.push(e); } },
@@ -143,6 +143,40 @@ for (const reason of W.REMEDY_REASONS) {
   });
 }
 
+await t('schema_pending on a PRIVILEGED runner migrates as the account that owns the DATABASE (task 1004512)', async () => {
+  // THE ONE PATH THAT CALLS runAsFor, and until this test nothing did: every other case
+  // above runs unprivileged, where planRemedy takes its no-sudo branch and the account is
+  // never resolved at all. So the account-selection change this task is about — runAsFor
+  // reading `migrateAs` instead of `runAs` — shipped with no coverage.
+  //
+  // The two answers are DIFFERENT accounts, and only one of them can connect: the project's
+  // database is owned by its own Postgres login role with CONNECT revoked from PUBLIC, so a
+  // migration run as the app user (which owns the checkout) fails outright. Asserting the
+  // assembled command, because that is where the wrong account would actually show up.
+  const h = harness({ privileged: true });
+  const r = await W.remedyAfterFailure({ intent: intent(), inst: inst(), result: wedge('schema_pending'), deps: h.deps });
+  assert.deepEqual(r, { repended: true });
+  // Two commands now: the `id -u` probe resolveRunAs spends to learn whether the project
+  // HAS an account of its own, then the migration itself.
+  assert.ok(h.ran.some((c) => /^id -u bongos-charter$/.test(c.cmd)), `the account is probed, not assumed: ${JSON.stringify(h.ran.map((c) => c.cmd))}`);
+  const migrate = (h.ran.find((c) => /migrate/.test(c.cmd)) || {}).cmd || '';
+  assert.match(migrate, /^sudo -u bongos-charter env PGDATABASE=charter /,
+    `must migrate as the project's own account — got: ${migrate}`);
+  assert.doesNotMatch(migrate, /sudo -u lars\b/,
+    'the app user owns the checkout, not the database — it has no role to connect with');
+});
+
+await t('…and the OTHER two fixes never escalate, privileged or not', async () => {
+  // The split is per-step, not per-run: dirty_tree touches the checkout and disk_full
+  // touches the backup dir, both of which belong to the runner. A sudo appearing here
+  // would mean the account change had leaked beyond the database.
+  for (const reason of ['dirty_tree', 'disk_full']) {
+    const h = harness({ privileged: true });
+    await W.remedyAfterFailure({ intent: intent(), inst: inst(), result: wedge(reason), deps: h.deps });
+    assert.doesNotMatch(h.ran[0].cmd, /sudo/, `${reason} runs as the runner, which owns what it touches`);
+  }
+});
+
 await t('the same reason again after a fix: no second fix — retired as unknown for a person', async () => {
   const h = harness();
   const r = await W.remedyAfterFailure({ intent: intent({ remedied_reason: 'dirty_tree' }), inst: inst(), result: wedge('dirty_tree'), deps: h.deps });