@bongos/core 1.21.14 → 1.21.15

package/tests/core_upgrade_runner.mjs

@@ -507,12 +507,20 @@ await t('the control plane upgrades as the operator account, never as root', asy
   assert.doesNotMatch(cmd, /sudo node /, 'a bare `sudo node` is the bug — it lands on root');
 });
 
-await t('a tenant upgrades as its OWN account, which is also its Postgres login role', async () => {
+await t('a tenant MOVES as the account that owns its checkout and MIGRATES as its own (task 1004512)', async () => {
+  // The move writes: the pin, node_modules, .claude/, the pin commit — and before any of
+  // that, `git status`. Those belong to the app user, which is who scaffolded the
+  // checkout; the instance account only has group READ on it, so running the move as that
+  // account made git refuse with "detected dubious ownership" and the clean-tree pre-flight
+  // report dirt that did not exist. The DATABASE is the opposite: it is owned by the
+  // instance's own Postgres login role with CONNECT revoked from PUBLIC, so only that
+  // account can migrate it. Hence one move, two accounts.
   const d = { ...makeDeps({ served: '1.19.762' }), privileged: true };
   await R.coreUpgradeInstance(inst({ hosting_shape: 'cloud-host', slug: 'test4', port: 3006 }), d, intent());
   const cmd = upgradeCall(d);
-  assert.match(cmd, /sudo -u bongos-test4 /, 'the instance account, not the operator and not root');
-  assert.doesNotMatch(cmd, /sudo -u appsvc /, 'one tenant must never be upgraded under another account');
+  assert.match(cmd, /sudo -u appsvc /, 'the move runs as the account that owns the checkout');
+  assert.match(cmd, /--migrate-as bongos-test4\b/, 'and hands the database steps to the instance account');
+  assert.doesNotMatch(cmd, /sudo -u bongos-test4 /, 'the instance account must not be asked to write a checkout it can only read');
 });
 
 await t('the database is NAMED, not discovered — an adopted repo has no core at its root to ask', async () => {
@@ -568,7 +576,9 @@ await t('ONE builder serves both legs — the preview and the move cannot drift
   const box = { id: 7, slug: 'test4', port: 3006, hosting_shape: 'cloud-host', db_name: 'test4' };
   const move = R.upgradeInvocation(box, '1.19.921', { privileged: true, requestedBy: '42' });
   const peek = R.upgradeInvocation(box, '1.19.921', { privileged: true, dryRun: true });
-  for (const shared of ['sudo -u bongos-test4 ', 'env PGDATABASE=test4 ', '--to 1.19.921', '--registry']) {
+  // --migrate-as is SHARED, not tail: the dry run's own database pre-check connects as that
+  // account too, so a preview that omitted it would test a different identity than the move.
+  for (const shared of ['sudo -u appsvc ', 'env PGDATABASE=test4 ', '--to 1.19.921', '--registry', '--migrate-as bongos-test4']) {
     assert.ok(move.cmd.includes(shared), `move carries ${shared}`);
     assert.ok(peek.cmd.includes(shared), `preview carries the same ${shared}`);
   }
@@ -746,12 +756,15 @@ function acctDeps({ accountExists = true, dryRunStdout = '', dryRunStderr = '',
   return d;
 }
 
-await t('a tenant WITH its own account runs as that account — the security model is kept', () => {
+await t('a tenant WITH its own account MIGRATES as that account — the security model is kept', () => {
   // task 1003369: a distinct uid per instance is what stops a co-tenant reading a
-  // sibling's /proc/<pid>/environ. Falling back everywhere would quietly undo it.
+  // sibling's /proc/<pid>/environ. Falling back everywhere would quietly undo it. Task
+  // 1004512 moved the file half of the work to the checkout's owner and left this half
+  // exactly where it was: the database is where the per-instance identity does its job.
   const d = acctDeps({ accountExists: true });
   const r = R.resolveRunAs(inst({ hosting_shape: 'cloud-host', slug: 'test4' }), d);
-  assert.deepEqual({ runAs: r.runAs, fellBack: r.fellBack }, { runAs: 'bongos-test4', fellBack: false });
+  assert.deepEqual({ runAs: r.runAs, migrateAs: r.migrateAs, fellBack: r.fellBack },
+    { runAs: 'appsvc', migrateAs: 'bongos-test4', fellBack: false });
 });
 
 await t('a tenant WITHOUT one falls back to the app user, and says so', () => {
@@ -762,6 +775,7 @@ await t('a tenant WITHOUT one falls back to the app user, and says so', () => {
   const d = acctDeps({ accountExists: false });
   const r = R.resolveRunAs(inst({ hosting_shape: 'cloud-host', slug: 'test4' }), d);
   assert.equal(r.runAs, 'appsvc');
+  assert.equal(r.migrateAs, 'appsvc', 'both halves land on the app user — the shape that was already working');
   assert.equal(r.fellBack, true);
   assert.equal(r.wanted, 'bongos-test4', 'and names the account that is missing');
 });
@@ -769,7 +783,8 @@ await t('a tenant WITHOUT one falls back to the app user, and says so', () => {
 await t('the control plane is never probed — it has no instance account by design', () => {
   const d = acctDeps({ accountExists: false });
   const r = R.resolveRunAs(inst({ hosting_shape: 'control-plane', slug: 'cloudbongos' }), d);
-  assert.deepEqual({ runAs: r.runAs, fellBack: r.fellBack }, { runAs: 'appsvc', fellBack: false });
+  assert.deepEqual({ runAs: r.runAs, migrateAs: r.migrateAs, fellBack: r.fellBack },
+    { runAs: 'appsvc', migrateAs: 'appsvc', fellBack: false });
   assert.equal(d.ranWith.filter((c) => /^id -u /.test(c.cmd)).length, 0, 'no probe was spent');
 });
 
@@ -796,7 +811,7 @@ await t('an INCONCLUSIVE probe keeps the isolated account rather than quietly wi
   const d = makeDeps({ served: '1.19.762' });
   d.exec = () => ({ ok: true, stdout: '', stderr: 'id: cannot connect to name service\n', softFailed: true });
   const r = R.resolveRunAs(inst({ hosting_shape: 'cloud-host', slug: 'test4' }), d);
-  assert.equal(r.runAs, 'bongos-test4', 'the intended account is kept');
+  assert.equal(r.migrateAs, 'bongos-test4', 'the intended account is kept');
   assert.equal(r.fellBack, false);
   assert.equal(r.probeInconclusive, true, 'and the caller can tell it was not a clean answer');
 });
@@ -813,7 +828,7 @@ await t('the probe uses the SAME executor the upgrade will use', () => {
   const r = R.resolveRunAs(inst({ hosting_shape: 'cloud-host', slug: 'test4' }), d);
   assert.deepEqual(asked.remote, [], 'the remote executor was not asked');
   assert.equal(asked.control.length, 1, 'the control-plane executor was');
-  assert.equal(r.runAs, 'bongos-test4', 'and its answer is the one that counts');
+  assert.equal(r.migrateAs, 'bongos-test4', 'and its answer is the one that counts');
 });
 
 await t('a planning tick probes ONCE, not twice', async () => {
@@ -860,9 +875,18 @@ await t('a fallback is recorded on the verdict the owner reads', async () => {
   const d = acctDeps({ accountExists: false, dryRunStdout: '  ✓ pre-flight: ok\n' });
   const v = await R.preflightUpgrade(inst({ hosting_shape: 'cloud-host', slug: 'test4', port: 3006 }), '1.19.762', d);
   assert.equal(v.ran_as, 'appsvc');
+  assert.equal(v.migrated_as, 'appsvc', 'the verdict names BOTH accounts — since task 1004512 there are two');
   assert.match(v.account_note, /no bongos-test4 account yet/);
 });
 
+await t('a project WITH its own account has its two accounts named separately (task 1004512)', async () => {
+  const d = acctDeps({ accountExists: true, dryRunStdout: '  ✓ pre-flight: ok\n' });
+  const v = await R.preflightUpgrade(inst({ hosting_shape: 'cloud-host', slug: 'test4', port: 3006 }), '1.19.762', d);
+  assert.equal(v.ran_as, 'appsvc', 'the files are written by the account that owns the checkout');
+  assert.equal(v.migrated_as, 'bongos-test4', 'the database is touched by the account that owns it');
+  assert.equal(v.account_note, null, 'and nothing is missing, so there is nothing to report');
+});
+
 await t('and a silent failure STILL refuses rather than inventing a pass', async () => {
   const d = acctDeps({ softFail: true, dryRunStdout: '', dryRunStderr: '' });
   const v = await R.preflightUpgrade(inst({ hosting_shape: 'cloud-host', slug: 'test4', port: 3006 }), '1.19.762', d);

package/tests/instance_db_migrated_on_code_move.mjs

@@ -32,7 +32,7 @@ const tenant = { slug: 'charter', db_name: 'charter_db', hosting_shape: 'co-tena
 
 test('bongos upgrade migrates before it restarts, and only --skip-migrate opts out', () => {
   const src = fs.readFileSync(path.join(ROOT, 'scripts/gds/upgrade.js'), 'utf8');
-  const migrate = src.indexOf('const mig = runMigrate(instanceDir, run);');
+  const migrate = src.indexOf('const mig = runMigrate(instanceDir, run, opts.migrateAs || null);');
   const restart = src.lastIndexOf('restartService({ service: opts.service, restartCmd: opts.restartCmd }');
   assert.ok(migrate > 0, 'the upgrade flow runs migrate');
   assert.ok(restart > migrate, 'the restart that makes new code live comes AFTER migrate');
@@ -42,14 +42,32 @@ test('bongos upgrade migrates before it restarts, and only --skip-migrate opts o
   // no scripts is migrated rather than rolled back. tests/upgrade_migrate.mjs exercises both.
   assert.match(src, /function runMigrate\([^)]*\) \{\n\s*const \{ cmd, args, env \} = require\('\.\/upgrade-migrate'\)\.migratePlan\(instanceDir\)/,
     'the migrate step spawns what migratePlan decides');
+  // …and as the account that OWNS the database, when the move itself runs as the one that
+  // owns the checkout (task 1004512). Those are two different accounts on every project
+  // provisioned since task 1003369, and the wrong one cannot connect at all: the project's
+  // database is owned by its own Postgres login role with CONNECT revoked from PUBLIC.
+  // Asserting the CALL SITE, not just the helper — the helper was never the gap.
+  assert.match(src, /const mig = runMigrate\(instanceDir, run, opts\.migrateAs \|\| null\);/,
+    'the migrate step is handed --migrate-as, not left on whoever the move happens to be');
   assert.equal(`bash ${CORE_MIGRATE_SCRIPT}`, INSTANCE_MIGRATE_SCRIPT, 'migrate is the instance scaffold script, i.e. the core migrate.sh');
 });
 
 test('the control-plane runner targets the instance database, not its own', () => {
-  const { cmd } = upgradeInvocation(tenant, '1.19.940', { privileged: true, runAs: 'appsvc' });
+  const { cmd } = upgradeInvocation(tenant, '1.19.940', { privileged: true, runAs: 'appsvc', migrateAs: 'appsvc' });
   assert.match(cmd, new RegExp(`PGDATABASE=${dbName(tenant)} `));
   assert.match(cmd, /upgrade\.js/);
   assert.doesNotMatch(cmd, /--skip-migrate/, 'the Deploy door never skips the schema');
+  assert.doesNotMatch(cmd, /--migrate-as/, 'one account for both halves emits no flag — unchanged from before task 1004512');
+});
+
+test('a project with its OWN account is migrated as it, whoever the move runs as (task 1004512)', () => {
+  // Naming the right database is only half of reaching it; the other half is connecting as
+  // a role that may. The runner used to solve both by running the WHOLE move as the
+  // project's account — which can only READ its checkout, so the move died at `git status`
+  // and the schema moved nowhere. Splitting the two keeps the database leg where it was.
+  const { cmd } = upgradeInvocation(tenant, '1.19.940', { privileged: true, runAs: 'appsvc', migrateAs: 'bongos-charter' });
+  assert.match(cmd, new RegExp(`PGDATABASE=${dbName(tenant)} `), 'still the instance database');
+  assert.match(cmd, /--migrate-as bongos-charter\b/, 'and now also the account that owns it');
 });
 
 test('provisioning migrates the new instance database at stand-up', () => {

package/tests/upgrade.mjs

@@ -1926,6 +1926,153 @@ t('parseArgs: --allow-downgrade is read, and is OFF unless asked for', () => {
   assert.equal(u.parseArgs(['--to', '1.0.0', '--allow-downgrade']).allowDowngrade, true);
 });
 
+// ---- 11. WHICH ACCOUNT DOES WHAT (task 1004512) -----------------------------
+//
+// Found live on cloudbongos.com: every core move on a project provisioned since task
+// 1003369 failed, and reported a dirty tree it had invented. The move ran wholly as the
+// project's own `bongos-<slug>` account, which can only READ the checkout, so `git status`
+// refused with `detected dubious ownership`, the clean-tree pre-flight read that as dirt,
+// the self-heal chain committed a tree nobody had touched, and the retry failed identically.
+// Both halves are pinned here: git's refusal is its own failure, and the database steps run
+// as the account that actually owns the database.
+
+t('a `git status` that could NOT ANSWER is not reported as uncommitted work', async () => {
+  const dir = scratchConsumer();
+  const res = await u.runUpgrade({ to: '1.15.0', instance: dir }, {
+    log: () => {}, err: () => {},
+    run: (cmd, args) => (cmd === 'git' && args[0] === 'status'
+      ? { status: 128, stdout: '', stderr: `fatal: detected dubious ownership in repository at '${dir}'\n` }
+      : { status: 0 }),
+  });
+  assert.equal(res.ok, false, 'it still refuses — nothing is known about the tree');
+  assert.match(res.error, /git could not read the working tree/, 'and says which question went unanswered');
+  assert.match(res.error, /dubious ownership/, 'carrying git\'s OWN words, not "not a git repo?"');
+  assert.doesNotMatch(res.error, /^working tree not clean/m, 'it must never claim there is uncommitted work');
+});
+
+t('…and that refusal is classified as unknown, so no remedy commits a guess', async () => {
+  const o = require('../scripts/gds/upgrade-outcome.js');
+  const dir = scratchConsumer();
+  const res = await u.runUpgrade({ to: '1.15.0', instance: dir }, {
+    log: () => {}, err: () => {},
+    run: (cmd, args) => (cmd === 'git' && args[0] === 'status'
+      ? { status: 128, stdout: '', stderr: 'fatal: detected dubious ownership in repository\n' }
+      : { status: 0 }),
+  });
+  // The whole point: dirty_tree is known_wedge, and wedge-remedy.js answers it by running
+  // `git add -u && git commit`. Doing that to a tree git would not describe commits whatever
+  // happens to be lying there, under a runner identity, in someone else's repository.
+  const reason = o.upgradeReason(res);
+  assert.equal(reason, 'git_unreadable', `got ${reason} — a failed "git status" is not a dirty tree`);
+  assert.equal(o.classifyFailure(reason).class, 'unknown', 'unknown reaches a person; known_wedge would "fix" it');
+  assert.notEqual(o.classifyFailure(reason).class, 'known_wedge');
+});
+
+t('--migrate-as hands the DATABASE steps to another account, and nothing else', async () => {
+  const dir = scratchConsumer();
+  const calls = [];
+  const res = await u.runUpgrade(
+    { to: '1.15.0', registry: true, instance: dir, migrateAs: 'bongos-p', healthCheck: false },
+    {
+      log: () => {}, err: () => {},
+      run: (cmd, args) => {
+        calls.push(`${cmd} ${(args || []).join(' ')}`.trim());
+        if (cmd === 'git' && args[0] === 'status') return { status: 0, stdout: '' };
+        if (cmd === 'npm' && args[0] === 'install') {
+          writeFileSync(join(dir, 'node_modules', '@bongos', 'core', 'package.json'),
+            JSON.stringify({ name: '@bongos/core', version: '1.15.0' }) + '\n');
+        }
+        return { status: 0, stdout: '' };
+      },
+      materialize: () => ({ skills: 0, writtenPaths: [] }),
+      regenerateApiArtifacts: () => ({ ok: true, ran: [] }),
+      resolveInstanceDb: () => ({ db: 'p', ran: true }),
+      databaseUrl: '', pgDatabase: '',
+    }
+  );
+  assert.equal(res.ok, true, `the bump ran: ${res.error || ''}`);
+  const migrate = calls.find((c) => /\bnpm run migrate\b/.test(c));
+  assert.ok(migrate, `migrate ran: ${JSON.stringify(calls)}`);
+  assert.match(migrate, /^sudo -n -u bongos-p env /, 'migrate connects as the account that owns the database');
+  const identity = calls.find((c) => /psql -tAc/.test(c));
+  assert.match(identity, /^sudo -n -u bongos-p env /, 'and so does the pre-check that decides whether it could');
+  // The other half of the split: the file work stays with whoever is running, because the
+  // project's own account cannot write this checkout.
+  for (const bare of ['git status', 'npm install']) {
+    assert.ok(calls.some((c) => c.startsWith(bare)), `${bare} runs as the move itself, unescalated`);
+    assert.ok(!calls.some((c) => c.includes(`bongos-p env ${bare}`)), `${bare} must NOT be handed to the project's account`);
+  }
+});
+
+t('with no --migrate-as, every step is spawned exactly as it was before', async () => {
+  // The shape half the fleet is on (a control plane, a project older than the per-instance
+  // account model). A flag that quietly started escalating there would be a new failure.
+  const dir = scratchConsumer();
+  const calls = [];
+  await u.runUpgrade(
+    { to: '1.15.0', registry: true, instance: dir, healthCheck: false },
+    {
+      log: () => {}, err: () => {},
+      run: (cmd, args) => {
+        calls.push(`${cmd} ${(args || []).join(' ')}`.trim());
+        if (cmd === 'npm' && args[0] === 'install') {
+          writeFileSync(join(dir, 'node_modules', '@bongos', 'core', 'package.json'),
+            JSON.stringify({ name: '@bongos/core', version: '1.15.0' }) + '\n');
+        }
+        return { status: 0, stdout: '' };
+      },
+      materialize: () => ({ skills: 0, writtenPaths: [] }),
+      regenerateApiArtifacts: () => ({ ok: true, ran: [] }),
+      resolveInstanceDb: () => ({ db: 'p', ran: true }),
+      databaseUrl: '', pgDatabase: '',
+    }
+  );
+  assert.ok(!calls.some((c) => c.startsWith('sudo')), `nothing escalated: ${JSON.stringify(calls.filter((c) => c.startsWith('sudo')))}`);
+  assert.ok(calls.some((c) => /^npm run migrate$/.test(c)), 'migrate is still the bare command');
+});
+
+t('sudo refusing the hand-over is caught BEFORE the pin moves, not at migrate', async () => {
+  // The one failure this split can add. Soft-skipping it (as "psql failed for another
+  // reason") would move the pin, install the new core, and then fail at migrate for a
+  // reason that was knowable up front — a full rollback, restarting a live service twice,
+  // to learn something one `select 1` already said.
+  const dir = scratchConsumer();
+  const calls = [];
+  const res = await u.runUpgrade(
+    { to: '1.15.0', registry: true, instance: dir, migrateAs: 'bongos-p', healthCheck: false },
+    {
+      log: () => {}, err: () => {},
+      run: (cmd, args) => {
+        calls.push(`${cmd} ${(args || []).join(' ')}`.trim());
+        if (cmd === 'sudo') return { status: 1, stdout: '', stderr: 'sudo: a password is required\n' };
+        return { status: 0, stdout: '' };
+      },
+      resolveInstanceDb: () => ({ db: 'p', ran: true }),
+      materialize: () => ({ skills: 0, writtenPaths: [] }),
+      databaseUrl: '', pgDatabase: '',
+    }
+  );
+  assert.equal(res.ok, false);
+  assert.match(res.error, /cannot run as "bongos-p"/);
+  assert.match(res.error, /a password is required/, 'carrying what sudo actually said');
+  assert.ok(!calls.some((c) => c.startsWith('npm install')), 'and nothing was installed — the pin never moved');
+  assert.equal(u.readPinnedCoreVersion(dir), '1.14.1', 'the pin is untouched');
+});
+
+t('an account name that is not one is refused before anything moves', () => {
+  // It reaches `sudo` as an argv entry, so it is refused rather than quoted into shape.
+  return u.runUpgrade({ to: '1.15.0', instance: scratchConsumer(), migrateAs: 'root; rm -rf /' }, { log: () => {}, err: () => {} })
+    .then((res) => {
+      assert.equal(res.ok, false);
+      assert.match(res.error, /not a unix account name/);
+    });
+});
+
+t('parseArgs: --migrate-as is read, and is absent unless passed', () => {
+  assert.equal(u.parseArgs(['--to', '1.0.0']).migrateAs, null);
+  assert.equal(u.parseArgs(['--to', '1.0.0', '--migrate-as', 'bongos-p']).migrateAs, 'bongos-p');
+});
+
 await Promise.all(pending);
 console.log(`\nupgrade: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/upgrade_outcome.mjs

@@ -33,6 +33,9 @@ const TABLE = [
   ['downgrade refusal', { ok: false, downgrade: true, error: 'refusing to DOWNGRADE: --to 1.19.1 is older' }, 'refused', 'downgrade', 'needs_decision'],
   ['already on the target', { ok: false, error: 'already on 1.20.1 (pass --force to re-run the steps anyway)' }, 'refused', 'already_on', 'unknown'],
   ['dirty working tree', { ok: false, error: 'working tree not clean — commit/stash first, or pass --force.\n M package.json' }, 'refused', 'dirty_tree', 'known_wedge'],
+  // task 1004512: git REFUSING to read the checkout is not a report that the checkout is
+  // dirty, and must not be classified as one — see the dedicated section at the end.
+  ['git would not read the tree', { ok: false, error: 'git could not read the working tree in /srv/cloudbongos/p — the clean-tree pre-flight never ran, so this is NOT a report of uncommitted work.\nfatal: detected dubious ownership in repository at \'/srv/cloudbongos/p\'' }, 'refused', 'git_unreadable', 'unknown'],
   ['module pre-check', { ok: false, error: 'module pre-check failed: game incompatible with core 1.20.1' }, 'refused', 'module_incompatible', 'needs_decision'],
   ['database unresolvable', { ok: false, error: 'cannot determine which database to migrate.\n    Set PGDATABASE' }, 'refused', 'db_unresolvable', 'unknown'],
   ['database identity', { ok: false, error: 'database "cb" is not reachable as the current user: role "root" does not exist' }, 'refused', 'db_identity', 'unknown'],

package/tests/wedge_remedy.mjs

@@ -37,10 +37,10 @@ const intent = (over = {}) => ({ id: 99, action: 'core-upgrade', target_version:
 const wedge = (reason) => ({ ok: false, error: `core upgrade to 1.20.31 was refused (${reason})`, failure: { class: 'known_wedge', reason } });
 const selfRoot = () => '/srv/charter';
 
-function harness({ execFails = false } = {}) {
+function harness({ execFails = false, privileged = false } = {}) {
   const ran = []; const events = []; const queries = [];
   const deps = {
-    apply: true, privileged: false, log: () => {}, selfInstanceRoot: selfRoot,
+    apply: true, privileged, log: () => {}, selfInstanceRoot: selfRoot,
     exec: (cmd, opts) => { ran.push({ cmd, ...opts }); return execFails ? { ok: false, softFailed: true, stderr: 'fatal: nope' } : { ok: true, stdout: '' }; },
     db: { query: async (sql, params) => { queries.push({ sql, params }); return { rows: [] }; } },
     provisioning: { recordEvent: async (_db, e) => { events.push(e); } },
@@ -143,6 +143,40 @@ for (const reason of W.REMEDY_REASONS) {
   });
 }
 
+await t('schema_pending on a PRIVILEGED runner migrates as the account that owns the DATABASE (task 1004512)', async () => {
+  // THE ONE PATH THAT CALLS runAsFor, and until this test nothing did: every other case
+  // above runs unprivileged, where planRemedy takes its no-sudo branch and the account is
+  // never resolved at all. So the account-selection change this task is about — runAsFor
+  // reading `migrateAs` instead of `runAs` — shipped with no coverage.
+  //
+  // The two answers are DIFFERENT accounts, and only one of them can connect: the project's
+  // database is owned by its own Postgres login role with CONNECT revoked from PUBLIC, so a
+  // migration run as the app user (which owns the checkout) fails outright. Asserting the
+  // assembled command, because that is where the wrong account would actually show up.
+  const h = harness({ privileged: true });
+  const r = await W.remedyAfterFailure({ intent: intent(), inst: inst(), result: wedge('schema_pending'), deps: h.deps });
+  assert.deepEqual(r, { repended: true });
+  // Two commands now: the `id -u` probe resolveRunAs spends to learn whether the project
+  // HAS an account of its own, then the migration itself.
+  assert.ok(h.ran.some((c) => /^id -u bongos-charter$/.test(c.cmd)), `the account is probed, not assumed: ${JSON.stringify(h.ran.map((c) => c.cmd))}`);
+  const migrate = (h.ran.find((c) => /migrate/.test(c.cmd)) || {}).cmd || '';
+  assert.match(migrate, /^sudo -u bongos-charter env PGDATABASE=charter /,
+    `must migrate as the project's own account — got: ${migrate}`);
+  assert.doesNotMatch(migrate, /sudo -u lars\b/,
+    'the app user owns the checkout, not the database — it has no role to connect with');
+});
+
+await t('…and the OTHER two fixes never escalate, privileged or not', async () => {
+  // The split is per-step, not per-run: dirty_tree touches the checkout and disk_full
+  // touches the backup dir, both of which belong to the runner. A sudo appearing here
+  // would mean the account change had leaked beyond the database.
+  for (const reason of ['dirty_tree', 'disk_full']) {
+    const h = harness({ privileged: true });
+    await W.remedyAfterFailure({ intent: intent(), inst: inst(), result: wedge(reason), deps: h.deps });
+    assert.doesNotMatch(h.ran[0].cmd, /sudo/, `${reason} runs as the runner, which owns what it touches`);
+  }
+});
+
 await t('the same reason again after a fix: no second fix — retired as unknown for a person', async () => {
   const h = harness();
   const r = await W.remedyAfterFailure({ intent: intent({ remedied_reason: 'dirty_tree' }), inst: inst(), result: wedge('dirty_tree'), deps: h.deps });