@caelo-cms/provisioning 0.11.11 → 0.11.13

package/dist/wizards/gcp-cost.js

@@ -127,7 +127,7 @@ export function estimateGcpCost(inputs) {
         {
             name: "Quality checks (Cloud Run audit job)",
             monthlyUsd: 2,
-            notes: "one container per Lighthouse run, all in parallel (up to 5 pages x 3 runs, ~90 s at 2 vCPU each): ~$0.05 per audited Stage, partly in the free tier; results bucket ~$0",
+            notes: "one container per Lighthouse run, all in parallel (up to 5 pages x 3 runs, ~90 s at 2 vCPU each; a page whose runs disagree gets 2 more): ~$0.05 per audited Stage, at most ~$0.08, partly in the free tier; results bucket ~$0",
         },
         {
             name: "Screenshots (Cloud Run capture job)",

package/dist/wizards/gcp-cost.js.map

@@ -1 +1 @@
-{"version":3,"file":"gcp-cost.js","sourceRoot":"","sources":["../../src/wizards/gcp-cost.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;GASG;AAEH,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,6BAA6B,EAC7B,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAkC9B;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAW,CAAC;AAE1E;;;GAGG;AACH,MAAM,eAAe,GAAG;IACtB,eAAe,EAAE,IAAI;IACrB,eAAe,EAAE,KAAK;IACtB,YAAY,EAAE,KAAK;IACnB,YAAY,EAAE,KAAK;CACX,CAAC;AAEX,wFAAwF;AACxF,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC,CAAC;IACjF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CACvB,CAAC,EACD,KAAK,GAAG,oBAAoB,CAAC,QAAQ,GAAG,eAAe,CAAC,YAAY,CACrE,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CACvB,CAAC,EACD,KAAK,GAAG,oBAAoB,CAAC,QAAQ,GAAG,eAAe,CAAC,YAAY,CACrE,CAAC;IACF,MAAM,GAAG,GACP,iBAAiB;QACjB,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,eAAe,CAAC,eAAe;QACnD,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,eAAe,CAAC,eAAe,CAAC;IACtD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,wBAAwB,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAW,CAAC;AAExF,oDAAoD;AACpD,MAAM,aAAa,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAExC;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,iBAAyB;IAC5D,OAAO,iBAAiB,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;AAC5D,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,MAAM,SAAS,GAAG,wBAAwB,CAAC,UAAU,GAAG,GAAG,GAAG,wBAAwB,CAAC,SAAS,CAAC;IACjG,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,aAAa,CAAC,CAAC;AAC/C,CAAC;AAED,uDAAuD;AACvD,MAAM,aAAa,GAAG,cAAc,CAAC;AAErC,MAAM,YAAY,GAA2B;IAC3C,+CAA+C;IAC/C,aAAa,EAAE,GAAG;IAClB,aAAa,EAAE,EAAE;IACjB,qCAAqC;IACrC,uBAAuB,EAAE,EAAE;IAC3B,uBAAuB,EAAE,EAAE;IAC3B,uBAAuB,EAAE,GAAG;IAC5B,kCAAkC;IAClC,kBAAkB,EAAE,EAAE;IACtB,kBAAkB,EAAE,EAAE;IACtB,mBAAmB,EAAE,GAAG;CACzB,CAAC;AAEF,MAAM,UAAU,eAAe,CAAC,MAA0B;IAMxD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;IACxD,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACpD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,aAAa,CAAC,CAAC;IAEvD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC;IAC1C,MAAM,gBAAgB,GAAG,6BAA6B,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACxF,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,oBAAoB,CAAC;IAC/D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAChD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,gBAAgB,WAAW,uCAAuC,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,GAAG,IAAI,CAAC;IACjC,wEAAwE;IACxE,mDAAmD;IACnD,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC;IAE/D,MAAM,KAAK,GAAe;QACxB;YACE,IAAI,EAAE,uBAAuB,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG;YACrF,UAAU,EAAE,UAAU;YACtB,KAAK,EAAE,MAAM,CAAC,UAAU;gBACtB,CAAC,CAAC,6CAA6C;gBAC/C,CAAC,CAAC,wCAAwC;SAC7C;QACD;YACE,IAAI,EAAE,oBAAoB,WAAW,GAAG;YACxC,qEAAqE;YACrE,mEAAmE;YACnE,oEAAoE;YACpE,8DAA8D;YAC9D,UAAU,EAAE,oBAAoB,CAAC,MAAM,CAAC,iBAAiB,CAAC;gBACxD,CAAC,CAAC,wBAAwB,CAAC,QAAQ,CAAC;gBACpC,CAAC,CAAC,MAAM,CAAC,iBAAiB,KAAK,CAAC;oBAC9B,CAAC,CAAC,CAAC;oBACH,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;YAClE,KAAK,EAAE,oBAAoB,CAAC,MAAM,CAAC,iBAAiB,CAAC;gBACnD,CAAC,CAAC,4EAA4E,gBAAgB,oFAAoF,WAAW,gEAAgE;gBAC7P,CAAC,CAAC,MAAM,CAAC,iBAAiB,KAAK,CAAC;oBAC9B,CAAC,CAAC,2FAA2F;oBAC7F,CAAC,CAAC,GAAG,MAAM,CAAC,iBAAiB,gBAAgB,MAAM,CAAC,iBAAiB,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,8EAA8E;SACvK;QACD;YACE,IAAI,EAAE,sCAAsC;YAC5C,UAAU,EAAE,CAAC;YACb,KAAK,EACH,yKAAyK;SAC5K;QACD;YACE,IAAI,EAAE,qCAAqC;YAC3C,UAAU,EAAE,CAAC;YACb,KAAK,EACH,qLAAqL;SACxL;QACD;YACE,yDAAyD;YACzD,+DAA+D;YAC/D,IAAI,EAAE,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,wBAAwB;YACzE,UAAU,EAAE,MAAM,CAAC,mBAAmB,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,mBAAmB,GAAG,EAAE;YACtF,KAAK,EACH,MAAM,CAAC,mBAAmB,KAAK,CAAC;gBAC9B,CAAC,CAAC,qCAAqC;gBACvC,CAAC,CAAC,GAAG,MAAM,CAAC,mBAAmB,gBAAgB,MAAM,CAAC,mBAAmB,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;SAC/F;QACD;YACE,iEAAiE;YACjE,uEAAuE;YACvE,uEAAuE;YACvE,IAAI,EAAE,0BAA0B;YAChC,UAAU,EAAE,CAAC;YACb,KAAK,EACH,iHAAiH;SACpH;QACD,gEAAgE;QAChE,+DAA+D;QAC/D,6DAA6D;QAC7D,4DAA4D;QAC5D,8CAA8C;QAC9C,GAAG,CAAC,QAAQ,KAAK,KAAK;YACpB,CAAC,CAAE;gBACC;oBACE,IAAI,EAAE,kCAAkC;oBACxC,UAAU,EAAE,EAAE;oBACd,KAAK,EAAE,yCAAyC;iBACjD;gBACD;oBACE,IAAI,EAAE,iBAAiB;oBACvB,UAAU,EAAE,CAAC;oBACb,KAAK,EAAE,gCAAgC;iBACxC;gBACD;oBACE,IAAI,EAAE,iBAAiB;oBACvB,UAAU,EAAE,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAChD,KAAK,EAAE,MAAM,CAAC,qBAAqB;wBACjC,CAAC,CAAC,+CAA+C;wBACjD,CAAC,CAAC,4CAA4C;iBACjD;gBACD;oBACE,6DAA6D;oBAC7D,+DAA+D;oBAC/D,sDAAsD;oBACtD,6DAA6D;oBAC7D,kDAAkD;oBAClD,0DAA0D;oBAC1D,gEAAgE;oBAChE,sBAAsB;oBACtB,IAAI,EAAE,6CAA6C;oBACnD,UAAU,EAAE,CAAC;oBACb,KAAK,EACH,yFAAyF;iBAC5F;aACoB;YACzB,CAAC,CAAE;gBACC;oBACE,IAAI,EAAE,kBAAkB;oBACxB,UAAU,EAAE,CAAC;oBACb,KAAK,EAAE,8CAA8C;iBACtD;aACoB,CAAC;QAC5B;YACE,IAAI,EACF,QAAQ,KAAK,KAAK;gBAChB,CAAC,CAAC,gCAAgC;gBAClC,CAAC,CAAC,uDAAuD;YAC7D,UAAU,EAAE,CAAC;YACb,KAAK,EAAE,qDAAqD;SAC7D;QACD;YACE,IAAI,EAAE,kCAAkC;YACxC,UAAU,EAAE,GAAG;YACf,KAAK,EACH,0OAA0O;SAC7O;QACD;YACE,IAAI,EAAE,wBAAwB;YAC9B,UAAU,EAAE,CAAC;YACb,KAAK,EAAE,wCAAwC;SAChD;QACD;YACE,IAAI,EAAE,4CAA4C;YAClD,UAAU,EAAE,IAAI;YAChB,KAAK,EACH,+FAA+F;SAClG;QACD;YACE,IAAI,EAAE,wDAAwD;YAC9D,UAAU,EAAE,CAAC;YACb,KAAK,EACH,0HAA0H;SAC7H;QACD;YACE,IAAI,EAAE,sDAAsD,gBAAgB,OAAO;YACnF,UAAU,EAAE,uBAAuB,CAAC,gBAAgB,CAAC;YACrD,KAAK,EAAE,oBAAoB,oBAAoB,CAAC,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,4EAA4E,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,gBAAgB,CAAC,kEAAkE;SACnR;KACF,CAAC;IAEF,uEAAuE;IACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;IACzF,MAAM,UAAU,GACd,MAAM,CAAC,MAAM,KAAK,aAAa;QAC7B,CAAC,CAAC,WAAW,MAAM,CAAC,MAAM,wBAAwB;QAClD,CAAC,CAAC,WAAW,MAAM,CAAC,MAAM,6CAA6C,aAAa,gBAAgB,MAAM,CAAC,MAAM,mBAAmB,CAAC;IACzI,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;AACzC,CAAC"}
+{"version":3,"file":"gcp-cost.js","sourceRoot":"","sources":["../../src/wizards/gcp-cost.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;GASG;AAEH,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,6BAA6B,EAC7B,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAkC9B;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAW,CAAC;AAE1E;;;GAGG;AACH,MAAM,eAAe,GAAG;IACtB,eAAe,EAAE,IAAI;IACrB,eAAe,EAAE,KAAK;IACtB,YAAY,EAAE,KAAK;IACnB,YAAY,EAAE,KAAK;CACX,CAAC;AAEX,wFAAwF;AACxF,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC,CAAC;IACjF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CACvB,CAAC,EACD,KAAK,GAAG,oBAAoB,CAAC,QAAQ,GAAG,eAAe,CAAC,YAAY,CACrE,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CACvB,CAAC,EACD,KAAK,GAAG,oBAAoB,CAAC,QAAQ,GAAG,eAAe,CAAC,YAAY,CACrE,CAAC;IACF,MAAM,GAAG,GACP,iBAAiB;QACjB,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,eAAe,CAAC,eAAe;QACnD,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,eAAe,CAAC,eAAe,CAAC;IACtD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,wBAAwB,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAW,CAAC;AAExF,oDAAoD;AACpD,MAAM,aAAa,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAExC;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,iBAAyB;IAC5D,OAAO,iBAAiB,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;AAC5D,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,MAAM,SAAS,GAAG,wBAAwB,CAAC,UAAU,GAAG,GAAG,GAAG,wBAAwB,CAAC,SAAS,CAAC;IACjG,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,aAAa,CAAC,CAAC;AAC/C,CAAC;AAED,uDAAuD;AACvD,MAAM,aAAa,GAAG,cAAc,CAAC;AAErC,MAAM,YAAY,GAA2B;IAC3C,+CAA+C;IAC/C,aAAa,EAAE,GAAG;IAClB,aAAa,EAAE,EAAE;IACjB,qCAAqC;IACrC,uBAAuB,EAAE,EAAE;IAC3B,uBAAuB,EAAE,EAAE;IAC3B,uBAAuB,EAAE,GAAG;IAC5B,kCAAkC;IAClC,kBAAkB,EAAE,EAAE;IACtB,kBAAkB,EAAE,EAAE;IACtB,mBAAmB,EAAE,GAAG;CACzB,CAAC;AAEF,MAAM,UAAU,eAAe,CAAC,MAA0B;IAMxD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;IACxD,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACpD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,aAAa,CAAC,CAAC;IAEvD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC;IAC1C,MAAM,gBAAgB,GAAG,6BAA6B,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACxF,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,oBAAoB,CAAC;IAC/D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAChD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,gBAAgB,WAAW,uCAAuC,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,GAAG,IAAI,CAAC;IACjC,wEAAwE;IACxE,mDAAmD;IACnD,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC;IAE/D,MAAM,KAAK,GAAe;QACxB;YACE,IAAI,EAAE,uBAAuB,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG;YACrF,UAAU,EAAE,UAAU;YACtB,KAAK,EAAE,MAAM,CAAC,UAAU;gBACtB,CAAC,CAAC,6CAA6C;gBAC/C,CAAC,CAAC,wCAAwC;SAC7C;QACD;YACE,IAAI,EAAE,oBAAoB,WAAW,GAAG;YACxC,qEAAqE;YACrE,mEAAmE;YACnE,oEAAoE;YACpE,8DAA8D;YAC9D,UAAU,EAAE,oBAAoB,CAAC,MAAM,CAAC,iBAAiB,CAAC;gBACxD,CAAC,CAAC,wBAAwB,CAAC,QAAQ,CAAC;gBACpC,CAAC,CAAC,MAAM,CAAC,iBAAiB,KAAK,CAAC;oBAC9B,CAAC,CAAC,CAAC;oBACH,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;YAClE,KAAK,EAAE,oBAAoB,CAAC,MAAM,CAAC,iBAAiB,CAAC;gBACnD,CAAC,CAAC,4EAA4E,gBAAgB,oFAAoF,WAAW,gEAAgE;gBAC7P,CAAC,CAAC,MAAM,CAAC,iBAAiB,KAAK,CAAC;oBAC9B,CAAC,CAAC,2FAA2F;oBAC7F,CAAC,CAAC,GAAG,MAAM,CAAC,iBAAiB,gBAAgB,MAAM,CAAC,iBAAiB,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,8EAA8E;SACvK;QACD;YACE,IAAI,EAAE,sCAAsC;YAC5C,UAAU,EAAE,CAAC;YACb,KAAK,EACH,iOAAiO;SACpO;QACD;YACE,IAAI,EAAE,qCAAqC;YAC3C,UAAU,EAAE,CAAC;YACb,KAAK,EACH,qLAAqL;SACxL;QACD;YACE,yDAAyD;YACzD,+DAA+D;YAC/D,IAAI,EAAE,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,wBAAwB;YACzE,UAAU,EAAE,MAAM,CAAC,mBAAmB,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,mBAAmB,GAAG,EAAE;YACtF,KAAK,EACH,MAAM,CAAC,mBAAmB,KAAK,CAAC;gBAC9B,CAAC,CAAC,qCAAqC;gBACvC,CAAC,CAAC,GAAG,MAAM,CAAC,mBAAmB,gBAAgB,MAAM,CAAC,mBAAmB,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;SAC/F;QACD;YACE,iEAAiE;YACjE,uEAAuE;YACvE,uEAAuE;YACvE,IAAI,EAAE,0BAA0B;YAChC,UAAU,EAAE,CAAC;YACb,KAAK,EACH,iHAAiH;SACpH;QACD,gEAAgE;QAChE,+DAA+D;QAC/D,6DAA6D;QAC7D,4DAA4D;QAC5D,8CAA8C;QAC9C,GAAG,CAAC,QAAQ,KAAK,KAAK;YACpB,CAAC,CAAE;gBACC;oBACE,IAAI,EAAE,kCAAkC;oBACxC,UAAU,EAAE,EAAE;oBACd,KAAK,EAAE,yCAAyC;iBACjD;gBACD;oBACE,IAAI,EAAE,iBAAiB;oBACvB,UAAU,EAAE,CAAC;oBACb,KAAK,EAAE,gCAAgC;iBACxC;gBACD;oBACE,IAAI,EAAE,iBAAiB;oBACvB,UAAU,EAAE,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAChD,KAAK,EAAE,MAAM,CAAC,qBAAqB;wBACjC,CAAC,CAAC,+CAA+C;wBACjD,CAAC,CAAC,4CAA4C;iBACjD;gBACD;oBACE,6DAA6D;oBAC7D,+DAA+D;oBAC/D,sDAAsD;oBACtD,6DAA6D;oBAC7D,kDAAkD;oBAClD,0DAA0D;oBAC1D,gEAAgE;oBAChE,sBAAsB;oBACtB,IAAI,EAAE,6CAA6C;oBACnD,UAAU,EAAE,CAAC;oBACb,KAAK,EACH,yFAAyF;iBAC5F;aACoB;YACzB,CAAC,CAAE;gBACC;oBACE,IAAI,EAAE,kBAAkB;oBACxB,UAAU,EAAE,CAAC;oBACb,KAAK,EAAE,8CAA8C;iBACtD;aACoB,CAAC;QAC5B;YACE,IAAI,EACF,QAAQ,KAAK,KAAK;gBAChB,CAAC,CAAC,gCAAgC;gBAClC,CAAC,CAAC,uDAAuD;YAC7D,UAAU,EAAE,CAAC;YACb,KAAK,EAAE,qDAAqD;SAC7D;QACD;YACE,IAAI,EAAE,kCAAkC;YACxC,UAAU,EAAE,GAAG;YACf,KAAK,EACH,0OAA0O;SAC7O;QACD;YACE,IAAI,EAAE,wBAAwB;YAC9B,UAAU,EAAE,CAAC;YACb,KAAK,EAAE,wCAAwC;SAChD;QACD;YACE,IAAI,EAAE,4CAA4C;YAClD,UAAU,EAAE,IAAI;YAChB,KAAK,EACH,+FAA+F;SAClG;QACD;YACE,IAAI,EAAE,wDAAwD;YAC9D,UAAU,EAAE,CAAC;YACb,KAAK,EACH,0HAA0H;SAC7H;QACD;YACE,IAAI,EAAE,sDAAsD,gBAAgB,OAAO;YACnF,UAAU,EAAE,uBAAuB,CAAC,gBAAgB,CAAC;YACrD,KAAK,EAAE,oBAAoB,oBAAoB,CAAC,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,4EAA4E,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,gBAAgB,CAAC,kEAAkE;SACnR;KACF,CAAC;IAEF,uEAAuE;IACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;IACzF,MAAM,UAAU,GACd,MAAM,CAAC,MAAM,KAAK,aAAa;QAC7B,CAAC,CAAC,WAAW,MAAM,CAAC,MAAM,wBAAwB;QAClD,CAAC,CAAC,WAAW,MAAM,CAAC,MAAM,6CAA6C,aAAa,gBAAgB,MAAM,CAAC,MAAM,mBAAmB,CAAC;IACzI,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;AACzC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@caelo-cms/provisioning",
-  "version": "0.11.11",
+  "version": "0.11.13",
   "private": false,
   "license": "MPL-2.0",
   "description": "Pulumi-driven provisioning for Caelo CMS — `bunx @caelo-cms/provisioning --provider <self-hosted|gcp|aws|azure>` brings up a TLS-served install with Postgres + storage + secrets manager + the admin + the API gateway.",
@@ -40,7 +40,7 @@
     "prepublishOnly": "tsc -b --force && bun build ../platform-updater/src/agent-db.ts --target=bun --outfile=dist/agent-db.js && tsc --project stacks/gcp/tsconfig.json && tsc --project stacks/gcp-firebase/tsconfig.json"
   },
   "dependencies": {
-    "@caelo-cms/shared": "^0.11.11",
+    "@caelo-cms/shared": "^0.11.13",
     "@clack/prompts": "1.8.1",
     "@pulumi/command": "^1",
     "@pulumi/gcp": "^10",

package/src/admin-domain.test.ts

@@ -340,3 +340,68 @@ describe("setAdminStagingHostEnv (#1058)", () => {
     expect(b.status === "failed" && b.error).toContain("set CAELO_STAGING_HOST on the admin");
   });
 });
+
+describe("stagingDomainState", () => {
+  const target = { projectId: "p", region: "europe-west1", stagingHost: "staging.example.com" };
+
+  it("reports an existing mapping as mapped", async () => {
+    const { run, calls } = fakeGcloud({
+      "beta run domain-mappings describe": [ok("staging.example.com\n")],
+    });
+    const { stagingDomainState } = await import("./admin-domain.js");
+    expect(await stagingDomainState({ ...target, run })).toEqual({ status: "mapped" });
+    expect(calls).toContainEqual([
+      "beta",
+      "run",
+      "domain-mappings",
+      "describe",
+      "--domain=staging.example.com",
+      "--region=europe-west1",
+      "--project=p",
+      "--format=value(metadata.name)",
+    ]);
+  });
+
+  it("reports gcloud's NOT_FOUND as unmapped", async () => {
+    const { run } = fakeGcloud({
+      "beta run domain-mappings describe": [
+        fail(
+          "ERROR: (gcloud.beta.run.domain-mappings.describe) NOT_FOUND: Resource 'staging.example.com' of kind 'DOMAIN_MAPPING' in region 'europe-west1' in project 'p' does not exist.",
+        ),
+      ],
+    });
+    const { stagingDomainState } = await import("./admin-domain.js");
+    expect(await stagingDomainState({ ...target, run })).toEqual({ status: "unmapped" });
+  });
+
+  it("does not guess on another error", async () => {
+    const { run } = fakeGcloud({
+      "beta run domain-mappings describe": [fail("PERMISSION_DENIED: run.domainmappings.get")],
+    });
+    const { stagingDomainState } = await import("./admin-domain.js");
+    expect(await stagingDomainState({ ...target, run })).toEqual({
+      status: "unknown",
+      reason: "PERMISSION_DENIED: run.domainmappings.get",
+    });
+  });
+
+  it("says why when gcloud cannot list its components", async () => {
+    const { run } = fakeGcloud({ "components list": [fail("component manager crashed")] });
+    const { stagingDomainState } = await import("./admin-domain.js");
+    expect(await stagingDomainState({ ...target, run })).toEqual({
+      status: "unknown",
+      reason: 'check the gcloud "beta" component: component manager crashed',
+    });
+  });
+
+  it("never installs the beta component to answer", async () => {
+    const { run, calls } = fakeGcloud({ "components list": [ok("")] });
+    const { stagingDomainState } = await import("./admin-domain.js");
+    expect(await stagingDomainState({ ...target, run })).toEqual({
+      status: "unknown",
+      reason: 'the gcloud "beta" component is not installed',
+    });
+    expect(calls.some((c) => c.join(" ").startsWith("components install"))).toBe(false);
+    expect(calls.some((c) => c[0] === "beta")).toBe(false);
+  });
+});

package/src/admin-domain.ts

@@ -183,6 +183,59 @@ export async function enableStagingDomain(
   return mapDomain(run, logOf(opts), scope, verifyDomain, opts.stagingHost, found.service);
 }
 
+/** What {@link stagingDomainState} found. */
+export type StagingDomainState =
+  | { readonly status: "mapped" }
+  | { readonly status: "unmapped" }
+  | { readonly status: "unknown"; readonly reason: string };
+
+/**
+ * Whether the install's staging host already has its Cloud Run domain
+ * mapping, read-only. The upgrade asks before it tells the operator to run
+ * `staging-domain enable`, so an install that serves its staging host is
+ * not sent to set it up again. It never installs the gcloud `beta`
+ * component (an upgrade should not pause for a download to print a hint):
+ * without it, or on any error but gcloud's NOT_FOUND, the state is unknown
+ * and says why.
+ */
+export async function stagingDomainState(opts: {
+  projectId: string;
+  region: string;
+  stagingHost: string;
+  run?: Run;
+}): Promise<StagingDomainState> {
+  const run = opts.run ?? defaultGcloud;
+  const listed = await run([
+    "components",
+    "list",
+    "--only-local-state",
+    "--filter=id=beta",
+    "--format=value(id)",
+  ]);
+  if (!listed.ok) {
+    return {
+      status: "unknown",
+      reason: `check the gcloud "beta" component: ${listed.stderr.trim() || `exit ${listed.exitCode}`}`,
+    };
+  }
+  if (!listed.stdout.split("\n").some((s) => s.trim() === "beta")) {
+    return { status: "unknown", reason: 'the gcloud "beta" component is not installed' };
+  }
+  const described = await run([
+    "beta",
+    "run",
+    "domain-mappings",
+    "describe",
+    `--domain=${opts.stagingHost}`,
+    `--region=${opts.region}`,
+    `--project=${opts.projectId}`,
+    "--format=value(metadata.name)",
+  ]);
+  if (described.ok) return { status: "mapped" };
+  if (/\bNOT_FOUND\b/.test(described.stderr)) return { status: "unmapped" };
+  return { status: "unknown", reason: described.stderr.trim() };
+}
+
 /** What {@link setAdminStagingHostEnv} did. */
 export type AdminStagingEnvResult =
   | { readonly status: "set"; readonly service: string; readonly previous: string | null }

package/src/converge-job-gcp.ts

@@ -22,9 +22,10 @@ import { join } from "node:path";
 import { CAELO_VERSION } from "@caelo-cms/shared";
 import { readConvergeCheckpoint, writeConvergeCheckpoint } from "./converge-checkpoint.js";
 import type { ConvergeJobDeps, ConvergeQueue, ConvergeUpgradeOutcome } from "./converge-job.js";
+import { isSelfGrantableRole } from "./converge-job-preflight.js";
 import { CONVERGE_TASK_TIMEOUT_MINUTES } from "./converge-job-setup.js";
 import { gcloud } from "./gcloud.js";
-import { type GcloudRunner, realSleep } from "./gcloud-retry.js";
+import { type GcloudRunner, realSleep, runWithRetry } from "./gcloud-retry.js";
 import {
   convergeJobName,
   GCP_STACK_ENV,
@@ -42,6 +43,7 @@ import {
 } from "./install-state.js";
 import { runMigrationsViaCloudRunJob } from "./migration-runner.js";
 import { installIapAllowlist } from "./operator-access.js";
+import { provisionerServiceAccountEmail } from "./provisioner-identity.js";
 import { fetchVerifiedReleaseManifest, manifestServiceImages } from "./release-manifest.js";
 import type { HttpFetch } from "./runtime-secrets.js";
 import { publicSiteUrl, STAGING_HOST_ENV } from "./stack-contract.js";
@@ -203,6 +205,26 @@ export function startedExecutionName(stdout: string, stderr: string): string | n
   return /^[a-z0-9-]+$/.test(name) ? name : null;
 }
 
+/**
+ * The `gcloud` argv that grants the install's provisioner — this job's
+ * own identity, never another principal — `role` on the project, or null
+ * when `role` is not on the self-grant allowlist (converge-job-preflight.ts).
+ * Exported for the tests that pin the boundary.
+ */
+export function selfGrantArgs(projectId: string, role: string): string[] | null {
+  if (!isSelfGrantableRole(role)) return null;
+  return [
+    "projects",
+    "add-iam-policy-binding",
+    projectId,
+    `--member=serviceAccount:${provisionerServiceAccountEmail(projectId)}`,
+    `--role=${role}`,
+    "--condition=None",
+    "--quiet",
+    "--format=none",
+  ];
+}
+
 /**
  * Every dependency of {@link runConvergeJob} except the database (the queue
  * and how it is secured, #1373) and the log.
@@ -366,6 +388,16 @@ export function gcpConvergeDeps(
     projectId,
     region,
     iam: gcloudIamTester(run, http),
+    grantOwnRole: async (role) => {
+      const args = selfGrantArgs(projectId, role);
+      if (!args)
+        return { ok: false, error: `${role} is not a role the converge job may grant itself` };
+      const r = await runWithRetry(run, realSleep, args);
+      return r.ok
+        ? { ok: true }
+        : { ok: false, error: r.stderr.trim() || `gcloud exited ${r.exitCode}` };
+    },
+    sleep: realSleep,
     execution: placement.execution,
     ownVersion: CAELO_VERSION,
     // The default deps: the fixed registry and signer, never overridden.

package/src/converge-job-preflight.test.ts

@@ -7,10 +7,15 @@
  */
 
 import { describe, expect, it } from "bun:test";
+import { selfGrantArgs } from "./converge-job-gcp.js";
 import {
   CONVERGE_PREFLIGHT_VOICE,
+  CONVERGE_SELF_GRANTABLE_ROLES,
   convergeAccessChecks,
   INSTALL_ROLE_USES,
+  isSelfGrantableRole,
+  SELF_GRANT_FORBIDDEN_ROLES,
+  selfGrantPlan,
 } from "./converge-job-preflight.js";
 import { PROVISIONER_ROLE_LIST } from "./gcloud.js";
 import { INSTALL_JOB_ROLES } from "./install-job.js";
@@ -79,6 +84,7 @@ describe("convergeAccessChecks", () => {
     for (const role of INSTALL_JOB_ROLES) {
       expect(checks).toContainEqual({
         resource: { kind: "project", projectId: "acme" },
+        role,
         ...INSTALL_ROLE_USES[role],
       });
     }
@@ -111,3 +117,98 @@ describe("convergeAccessChecks", () => {
     expect(reason).toContain("Cloud Shell or the computer you installed from");
   });
 });
+
+describe("the converge job's self-grant allowlist (2026-11-03)", () => {
+  it("is exactly the roles converge-job-setup.ts grants the provisioner", () => {
+    expect([...CONVERGE_SELF_GRANTABLE_ROLES]).toEqual([...INSTALL_JOB_ROLES]);
+    expect(CONVERGE_SELF_GRANTABLE_ROLES).toContain("roles/workflows.editor");
+  });
+
+  it("names no ownership or IAM-policy role", () => {
+    for (const role of CONVERGE_SELF_GRANTABLE_ROLES) {
+      for (const f of SELF_GRANT_FORBIDDEN_ROLES) {
+        expect(role === f || (f.endsWith(".") && role.startsWith(f))).toBe(false);
+      }
+    }
+  });
+
+  it("refuses every role outside the list, escalations first", () => {
+    for (const role of [
+      "roles/owner",
+      "roles/editor",
+      "roles/resourcemanager.projectIamAdmin",
+      "roles/iam.securityAdmin",
+      "roles/iam.serviceAccountKeyAdmin",
+      "roles/run.admin",
+      "roles/workflows.admin",
+      "roles/workflows.editor ",
+      "",
+    ]) {
+      expect(isSelfGrantableRole(role)).toBe(false);
+    }
+    for (const role of INSTALL_JOB_ROLES) expect(isSelfGrantableRole(role)).toBe(true);
+  });
+
+  it("the grant names the project and the provisioner only, and refuses other roles", () => {
+    expect(selfGrantArgs("acme", "roles/workflows.editor")).toEqual([
+      "projects",
+      "add-iam-policy-binding",
+      "acme",
+      "--member=serviceAccount:caelo-provisioner@acme.iam.gserviceaccount.com",
+      "--role=roles/workflows.editor",
+      "--condition=None",
+      "--quiet",
+      "--format=none",
+    ]);
+    for (const role of [
+      "roles/owner",
+      "roles/resourcemanager.projectIamAdmin",
+      "roles/run.admin",
+    ]) {
+      expect(selfGrantArgs("acme", role)).toBeNull();
+    }
+  });
+});
+
+describe("selfGrantPlan", () => {
+  it("an install from before 0.11.11 (no workflows.editor) needs one grant and nothing blocks", async () => {
+    const r = await runIamPreflight(
+      convergeAccessChecks(TARGET),
+      provisioner([
+        ...PROVISIONER_ROLE_LIST,
+        ...INSTALL_JOB_ROLES.filter((role) => role !== "roles/workflows.editor"),
+      ]),
+    );
+    expect(r.kind).toBe("missing");
+    if (r.kind !== "missing") return;
+    expect(selfGrantPlan(r.missing)).toEqual({ grant: ["roles/workflows.editor"], blocking: [] });
+  });
+
+  it("every install-job role missing: all of them, in list order", async () => {
+    const r = await runIamPreflight(
+      convergeAccessChecks(TARGET),
+      provisioner(PROVISIONER_ROLE_LIST),
+    );
+    if (r.kind !== "missing") throw new Error("expected missing");
+    const plan = selfGrantPlan([...r.missing].reverse());
+    expect(plan.grant).toEqual([...INSTALL_JOB_ROLES]);
+    expect(plan.blocking).toEqual([]);
+  });
+
+  it("a check without a role, or with a role off the list, blocks", () => {
+    const actAs = convergeAccessChecks(TARGET).find((c) =>
+      c.permissions.includes("iam.serviceAccounts.actAs"),
+    );
+    if (!actAs) throw new Error("no actAs check");
+    const forged = {
+      ...actAs,
+      role: "roles/owner" as unknown as (typeof INSTALL_JOB_ROLES)[number],
+    };
+    const plan = selfGrantPlan([
+      { check: actAs, missing: ["iam.serviceAccounts.actAs"] },
+      { check: forged, missing: ["iam.serviceAccounts.actAs"] },
+    ]);
+    expect(plan.grant).toEqual([]);
+    expect(plan.blocking).toHaveLength(2);
+  });
+});

package/src/converge-job-preflight.ts

@@ -26,6 +26,23 @@
  *   - the Cloud SQL IAM login `ensureConvergeJob` creates (member of
  *     {@link UPGRADER_DB_ROLE}): the request row and the timeline.
  *
+ * Self-grant (maintainer decision 2026-11-03). A release may add a role to
+ * {@link INSTALL_JOB_ROLES} (0.11.11 added roles/workflows.editor for the
+ * scheduler tick, #1140); an install set up before it lacks that role until
+ * a converge's `ensureConvergeJob` grants it, and the converge job used to
+ * stop here and send the Owner to Cloud Shell for exactly that grant. Now a
+ * missing role of {@link CONVERGE_SELF_GRANTABLE_ROLES} — this release's own
+ * compiled-in list, nothing a request, a record or the environment names —
+ * is not a reason to stop: stage 1 leaves it to stage 2, and stage 2 (the
+ * target release's verified ops image, under the state lock) grants it to
+ * the provisioner at project level, records each grant on the timeline and
+ * asks IAM again (converge-job.ts). Not an escalation: the provisioner holds
+ * roles/resourcemanager.projectIamAdmin since install, so it could grant
+ * itself any role already; the allowlist only narrows what the job does
+ * with that. {@link SELF_GRANT_FORBIDDEN_ROLES} pins that the list never
+ * names an ownership or IAM-policy role, and the upgrader job — which holds
+ * no IAM rights at all — has no grant step.
+ *
  * Not checked: the permissions `pulumi up` needs for the stack. They are the
  * provisioner's PROVISIONER_ROLE_LIST (gcloud.ts), granted at install by the
  * Owner's own account; a converge cannot repair them and Pulumi names what
@@ -37,7 +54,7 @@ import { convergeJobName } from "./gcp-names.js";
 import { INSTALL_JOB_ROLES, type InstallJobRole } from "./install-job.js";
 import { provisionerServiceAccountEmail } from "./provisioner-identity.js";
 import { OPS_INSTALL_PREFIX, opsBucketName } from "./state-backend.js";
-import type { AccessCheck, PreflightVoice } from "./upgrader-iam-preflight.js";
+import type { AccessCheck, MissingAccess, PreflightVoice } from "./upgrader-iam-preflight.js";
 import { UPGRADER_DB_ROLE } from "./upgrader-setup.js";
 
 /**
@@ -83,17 +100,86 @@ export const CONVERGE_PREFLIGHT_VOICE: PreflightVoice = {
     "Run the update once from Cloud Shell or the computer you installed from (Settings → Updates shows the command); it repairs the converge job's access.",
 };
 
+/**
+ * The roles the converge job may grant its own account when the self-check
+ * finds them missing: exactly the roles `ensureConvergeJob` grants it, as
+ * compiled into this release (see the file comment).
+ */
+export const CONVERGE_SELF_GRANTABLE_ROLES: readonly InstallJobRole[] = INSTALL_JOB_ROLES;
+
+/**
+ * Roles the converge job must never grant itself, whatever a release's list
+ * says — ownership and IAM-policy roles (prefix matches). The tests assert
+ * {@link CONVERGE_SELF_GRANTABLE_ROLES} names none of them, and the grant
+ * step refuses them again at run time.
+ */
+export const SELF_GRANT_FORBIDDEN_ROLES = [
+  "roles/owner",
+  "roles/editor",
+  "roles/resourcemanager.",
+  "roles/iam.securityAdmin",
+  "roles/iam.organizationRoleAdmin",
+  "roles/iam.serviceAccountKeyAdmin",
+  "roles/iam.workloadIdentityPoolAdmin",
+  "roles/orgpolicy.",
+  "roles/billing.",
+] as const;
+
+/** Whether the converge job may grant `role` to its own account (see the file comment). */
+export function isSelfGrantableRole(role: string): role is InstallJobRole {
+  return (
+    (CONVERGE_SELF_GRANTABLE_ROLES as readonly string[]).includes(role) &&
+    !SELF_GRANT_FORBIDDEN_ROLES.some((f) => role === f || (f.endsWith(".") && role.startsWith(f)))
+  );
+}
+
+/** A converge self-check; `role` marks a check that granting that role repairs. */
+export interface ConvergeAccessCheck extends AccessCheck {
+  readonly role?: InstallJobRole;
+}
+
+/** What the converge job does about the self-check's missing permissions. */
+export interface SelfGrantPlan {
+  /** Allowlisted roles to grant the provisioner, in list order. */
+  readonly grant: readonly InstallJobRole[];
+  /** What no grant of the job repairs: the run stops on any of these. */
+  readonly blocking: readonly MissingAccess<ConvergeAccessCheck>[];
+}
+
+/**
+ * Split the self-check's missing permissions into roles the job grants
+ * itself and the rest. A check counts as repairable only when its whole
+ * shortfall is permissions of an allowlisted role it is marked with.
+ */
+export function selfGrantPlan(
+  missing: readonly MissingAccess<ConvergeAccessCheck>[],
+): SelfGrantPlan {
+  const grant: InstallJobRole[] = [];
+  const blocking: MissingAccess<ConvergeAccessCheck>[] = [];
+  for (const m of missing) {
+    const role = m.check.role;
+    if (role && isSelfGrantableRole(role) && !(m.unchecked && m.unchecked.length > 0)) {
+      if (!grant.includes(role)) grant.push(role);
+    } else {
+      blocking.push(m);
+    }
+  }
+  const order = CONVERGE_SELF_GRANTABLE_ROLES as readonly string[];
+  grant.sort((a, b) => order.indexOf(a) - order.indexOf(b));
+  return { grant, blocking };
+}
+
 /** Every permission a converge run relies on after its decision (see the file comment). */
 export function convergeAccessChecks(target: {
   readonly projectId: string;
   readonly region: string;
   readonly env: string;
-}): AccessCheck[] {
+}): ConvergeAccessCheck[] {
   const { projectId, region, env } = target;
   const project = { kind: "project", projectId } as const;
   const bucket = opsBucketName(projectId);
   return [
-    ...INSTALL_JOB_ROLES.map((role) => ({ resource: project, ...INSTALL_ROLE_USES[role] })),
+    ...INSTALL_JOB_ROLES.map((role) => ({ resource: project, role, ...INSTALL_ROLE_USES[role] })),
     {
       need: `read and write the install's records and state lock (${OPS_INSTALL_PREFIX}/) and the update's checkpoint (${CONVERGE_STATE_PREFIX}/) in the ops bucket`,
       resource: { kind: "bucket", bucket },

package/src/converge-job-setup.ts

@@ -41,7 +41,10 @@
  *   - {@link INSTALL_JOB_ROLES} (the operator-access step of a converge
  *     creates a custom role and a Cloud Scheduler job, and the job's lines
  *     must reach Cloud Logging) — what an install-job install already
- *     grants; not an escalation, the provisioner holds projectIamAdmin;
+ *     grants; not an escalation, the provisioner holds projectIamAdmin. The
+ *     converge job of a release that adds a role here grants it itself when
+ *     it finds it missing (converge-job-preflight.ts, the self-grant), so
+ *     the role reaches an older install without a terminal run;
  *   - a Cloud SQL IAM database login that is a member of `platform_updater`
  *     only (migration 0267): it reads its request and writes the timeline,
  *     nothing else in the database.