{"record":{"id":"4f071aa22a1f50e8","repo":"jdx/mise","slug":"managed-system-files-require-owner-owner-but-4f071a","errorCode":null,"errorMessage":"managed system files require owner '{owner}', but that bootstrap user cannot be safely converged","messagePattern":"managed system files require owner '(.+?)', but that bootstrap user cannot be safely converged","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/system/managed_files.rs","lineNumber":866,"sourceCode":"        .chain(\n            directories\n                .iter()\n                .filter(|request| request.state == ManagedState::Present)\n                .map(|request| (request.owner.as_deref(), request.group.as_deref())),\n        )\n    {\n        if let Some(owner) = owner {\n            match accounts\n                .and_then(|accounts| accounts.users.iter().find(|request| request.name == owner))\n            {\n                Some(request) if request.state == super::accounts::AccountState::Absent => bail!(\n                    \"managed system files require owner '{owner}', but that bootstrap user is absent\"\n                ),\n                Some(request)\n                    if allow_pending_accounts\n                        && request.plan().action == ResourceAction::Unknown =>\n                {\n                    bail!(\n                        \"managed system files require owner '{owner}', but that bootstrap user cannot be safely converged\"\n                    )\n                }\n                Some(_) if allow_pending_accounts => {}\n                Some(_) | None => {\n                    resolve_user(owner)?;\n                }\n            }\n        }\n        if let Some(group) = group {\n            match accounts\n                .and_then(|accounts| accounts.groups.iter().find(|request| request.name == group))\n            {\n                Some(request) if request.state == super::accounts::AccountState::Absent => bail!(\n                    \"managed system files require group '{group}', but that bootstrap group is absent\"\n                ),\n                Some(request)\n                    if allow_pending_accounts","sourceCodeStart":848,"sourceCodeEnd":884,"githubUrl":"https://github.com/jdx/mise/blob/afd2eddd3a50c16190efc1c7e94404b48f72af57/src/system/managed_files.rs#L848-L884","documentation":"Raised during cross-resource validation when a managed file declares an `owner` matching a bootstrap user request whose own plan has action ResourceAction::Unknown — i.e. the user exists on disk in a form the account resource cannot safely converge (and allow_pending_accounts is enabled). Since the owner account cannot be guaranteed to exist correctly before chown, the file plan is refused.","triggerScenarios":"Converging with allow_pending_accounts enabled where the file entry's owner matches a bootstrap user request and that request's plan().action == ResourceAction::Unknown (unsafe/ambiguous account state, e.g. conflicting on-disk identity).","commonSituations":"An account exists on the host in a state the accounts module cannot classify (corrupt passwd entry, name/uid mismatch); pending-account handling enabled to defer user creation, but the on-disk state is neither cleanly present nor absent; stale system users shadowed by config.","solutions":["Inspect the account state on the host (passwd entry) and fix or remove the malformed user so the accounts module can plan it cleanly.","Remove the problematic bootstrap user entry so the file's owner resolves via the system account instead.","Change the file entry's `owner` to an account that converges safely.","Disable allow_pending_accounts only if you instead want the stricter resolve_user behavior, after fixing the account."],"exampleFix":"// before: file owner points at a user whose bootstrap plan is Unknown\nfiles: owner = \"svc-app\"\nusers: [ { name = \"svc-app\", state = \"present\" } ]  // plan: Unknown\n\n// after: fix or drop the ambiguous user entry so it converges cleanly\nusers: [] // let resolve_user find the existing system account\nfiles: owner = \"svc-app\"","handlingStrategy":"validation","validationCode":"fn validate_owner_convergable(files: &[ManagedFileRequest], users: &[UserRequest]) -> Result<(), String> {\n    for f in files {\n        if let Some(owner) = &f.owner {\n            if let Some(u) = users.iter().find(|u| &u.name == owner) {\n                if u.plan().action == ResourceAction::Unknown {\n                    return Err(format!(\"owner '{}' cannot be safely converged\", owner));\n                }\n            }\n        }\n    }\n    Ok(())\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Before enabling allow_pending_accounts, ensure every declared account converges to a known state.","Fix malformed host accounts (passwd corruption, name/uid mismatch) that yield Unknown plans.","Verify each file owner resolves to a safe account on every target host before rollout."],"tags":["bootstrap","users","ownership","plan-conflict"],"backgroundTag":"invalid-state-transition","analyzedSha":"afd2eddd3a50c16190efc1c7e94404b48f72af57","analyzedAt":"2026-09-09T01:38:25.179Z","contentChangedAt":"2026-09-09T01:38:25.179Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}