bootstrap plan contains resources with unknown state

Error message

bootstrap plan contains resources with unknown state

What it means

Bailed from the bootstrap plan command (src/cli/bootstrap.rs:1963) when --detailed-exitcode is set and the plan summary has_unknown(). With that flag mise uses terraform-like exit codes (2 = changes present); resources whose current state could not be determined turn the run into a hard error instead of an ambiguous 2, so automation never applies on top of unreadable state.

Source

Thrown at src/cli/bootstrap.rs:1963

                    resource.action.to_string(),
                    resource.id.to_string(),
                    resource.current.clone(),
                    resource.desired.clone(),
                ]);
            }
            table.print()?;
            miseprintln!(
                "Plan: {} create, {} update, {} unchanged, {} remove, {} unknown",
                output.summary.create,
                output.summary.update,
                output.summary.unchanged,
                output.summary.remove,
                output.summary.unknown,
            );
        }
        if self.detailed_exitcode {
            if output.summary.has_unknown() {
                bail!("bootstrap plan contains resources with unknown state");
            }
            if output.summary.has_changes() {
                return Err(crate::request_exit(2));
            }
        }
        Ok(())
    }
}

impl BootstrapApplySystemPlan {
    fn run(self) -> Result<()> {
        system::managed_files::apply_privileged_plan_from_stdin()
    }
}

impl BootstrapApplyAccountPlan {
    fn run(self) -> Result<()> {
        system::accounts::apply_privileged_plan_from_stdin()

View on GitHub (pinned to 9dcfcaa0dc)

Solutions

Re-run 'mise bootstrap plan' without --detailed-exitcode and read the plan table rows counted as unknown to identify the resources
Fix permissions/ownership on those targets (or run the plan with the needed privileges), then re-plan
Adjust the bootstrap config if those resources should not be managed on this host
Gate on exit code 2 only once the plan reports 0 unknown

Example fix

# before (CI gate)
mise bootstrap plan --detailed-exitcode; rc=$?; [ $rc -eq 2 ] && mise bootstrap apply
# Error: bootstrap plan contains resources with unknown state

# after
mise bootstrap plan                          # inspect and fix 'unknown' rows first
mise bootstrap plan --detailed-exitcode; rc=$?
[ $rc -eq 2 ] && mise bootstrap apply

Defensive patterns

Strategy: try-catch

Try / catch

# bash: treat --detailed-exitcode like terraform (0 clean, 2 changes, else hard fail)
set +e; mise bootstrap plan --detailed-exitcode; rc=$?; set -e
case "$rc" in
  0) echo 'no changes' ;;
  2) mise bootstrap apply ;;
  *) echo "plan failed (rc=$rc) - resolve unknown-state resources first" >&2; exit "$rc" ;;
esac

Prevention

Run plans as a user that can stat every managed file
Resolve 'unknown' rows before gating CI on exit code 2
Keep managed-file permissions aligned with the user running the plan

When it happens

Trigger: 'mise bootstrap plan --detailed-exitcode' where at least one managed resource could not be compared - permission denied while stat-ing a target file/symlink, a target removed mid-plan, or a state source unreadable by the current user.

Common situations: CI pipelines gating bootstrap apply on the exit code; a plan run as an unprivileged user against root-owned managed files; managed dotfiles with restrictive modes.

Related errors

AI-assisted analysis of jdx/mise@9dcfcaa0dc (2026-08-17). Data as JSON: /api/errors/c55bbbba8eea88d0. Report an issue: GitHub.