{"record":{"id":"f2bf19edc6bdbe13","repo":"jdx/mise","slug":"managed-system-files-require-group-group-but-f2bf19","errorCode":null,"errorMessage":"managed system files require group '{group}', but that bootstrap group cannot be safely converged","messagePattern":"managed system files require group '(.+?)', but that bootstrap group cannot be safely converged","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/system/managed_files.rs","lineNumber":887,"sourceCode":"                }\n                Some(_) if allow_pending_accounts => {}\n                Some(_) | None => {\n                    resolve_user(owner)?;\n                }\n            }\n        }\n        if let Some(group) = group {\n            match accounts\n                .and_then(|accounts| accounts.groups.iter().find(|request| request.name == group))\n            {\n                Some(request) if request.state == super::accounts::AccountState::Absent => bail!(\n                    \"managed system files require group '{group}', but that bootstrap group is absent\"\n                ),\n                Some(request)\n                    if allow_pending_accounts\n                        && request.plan().action == ResourceAction::Unknown =>\n                {\n                    bail!(\n                        \"managed system files require group '{group}', but that bootstrap group cannot be safely converged\"\n                    )\n                }\n                Some(_) if allow_pending_accounts => {}\n                Some(_) | None => {\n                    resolve_group(group)?;\n                }\n            }\n        }\n    }\n    Ok(())\n}\n\n#[cfg(not(unix))]\npub(crate) fn validate_principals(\n    files: &[ManagedFileRequest],\n    directories: &[ManagedDirectoryRequest],\n    _accounts: Option<&super::accounts::AccountRequests>,","sourceCodeStart":869,"sourceCodeEnd":905,"githubUrl":"https://github.com/jdx/mise/blob/afd2eddd3a50c16190efc1c7e94404b48f72af57/src/system/managed_files.rs#L869-L905","documentation":"This error is thrown when the referenced bootstrap group is known but its convergence plan is Unsafe/Unknown (ResourceAction::Unknown) while pending accounts are allowed. Because the library cannot guarantee the group will exist by the time files are managed, it refuses to proceed rather than risk assigning a nonexistent group. It is a stricter sibling of the 'absent' group error in the same match.","triggerScenarios":"Managed file entry references group `g`; AccountRequests contains `g` with plan().action == ResourceAction::Unknown and allow_pending_accounts is true. Typically happens when the group's creation is itself conditional/unresolvable at plan time.","commonSituations":"Group creation depends on an external provider whose action could not be planned; account requests come from a partially-evaluated config; plans involving pending/deferred account resources combined with managed system files.","solutions":["Make the group's plan deterministic (ensure its resource action resolves to a concrete Create/Update/None) before running file management.","Set allow_pending_accounts=false to force eager group resolution via resolve_group.","Reference a group whose plan is already known instead of the pending one."],"exampleFix":"// before\nmanage_files(files, dirs, Some(&accounts), /*allow_pending_accounts*/ true)\n// group 'deploy' plan action: Unknown\n\n// after\nresolve_accounts_blocking(&accounts)?; // make plan concrete\nmanage_files(files, dirs, Some(&accounts), /*allow_pending_accounts*/ false)","handlingStrategy":"validation","validationCode":"for g in files.iter().filter_map(|f| f.group.as_deref()) {\n    if let Some(r) = accounts.groups.iter().find(|r| r.name == g) {\n        if allow_pending && r.plan().action == ResourceAction::Unknown {\n            return Err(format!(\"group {g} plan is not resolvable\"));\n        }\n    }\n}","typeGuard":"fn group_plan_is_known(name: &str, accounts: &AccountRequests) -> bool {\n    accounts.groups.iter().find(|r| r.name == name)\n        .map_or(true, |r| r.plan().action != ResourceAction::Unknown)\n}","tryCatchPattern":null,"preventionTips":["Resolve all account plans before planning managed files","Avoid mixing pending/deferred account resources with managed system files","Prefer eager resolution (allow_pending_accounts=false) for file-managed groups"],"tags":["unix","group-management","planning","precondition"],"backgroundTag":"invalid-state-transition","analyzedSha":"afd2eddd3a50c16190efc1c7e94404b48f72af57","analyzedAt":"2026-09-09T01:38:25.179Z","contentChangedAt":"2026-09-09T01:38:25.179Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}