managed system files require owner '{owner}', but that boots

Error message

managed system files require owner '{owner}', but that bootstrap user cannot be safely converged

What it means

Raised during cross-resource validation when a managed file declares an `owner` matching a bootstrap user request whose own plan has action ResourceAction::Unknown — i.e. the user exists on disk in a form the account resource cannot safely converge (and allow_pending_accounts is enabled). Since the owner account cannot be guaranteed to exist correctly before chown, the file plan is refused.

Source

Thrown at src/system/managed_files.rs:866

        .chain(
            directories
                .iter()
                .filter(|request| request.state == ManagedState::Present)
                .map(|request| (request.owner.as_deref(), request.group.as_deref())),
        )
    {
        if let Some(owner) = owner {
            match accounts
                .and_then(|accounts| accounts.users.iter().find(|request| request.name == owner))
            {
                Some(request) if request.state == super::accounts::AccountState::Absent => bail!(
                    "managed system files require owner '{owner}', but that bootstrap user is absent"
                ),
                Some(request)
                    if allow_pending_accounts
                        && request.plan().action == ResourceAction::Unknown =>
                {
                    bail!(
                        "managed system files require owner '{owner}', but that bootstrap user cannot be safely converged"
                    )
                }
                Some(_) if allow_pending_accounts => {}
                Some(_) | None => {
                    resolve_user(owner)?;
                }
            }
        }
        if let Some(group) = group {
            match accounts
                .and_then(|accounts| accounts.groups.iter().find(|request| request.name == group))
            {
                Some(request) if request.state == super::accounts::AccountState::Absent => bail!(
                    "managed system files require group '{group}', but that bootstrap group is absent"
                ),
                Some(request)
                    if allow_pending_accounts

View on GitHub (pinned to afd2eddd3a)

Solutions

Inspect the account state on the host (passwd entry) and fix or remove the malformed user so the accounts module can plan it cleanly.
Remove the problematic bootstrap user entry so the file's owner resolves via the system account instead.
Change the file entry's `owner` to an account that converges safely.
Disable allow_pending_accounts only if you instead want the stricter resolve_user behavior, after fixing the account.

Example fix

// before: file owner points at a user whose bootstrap plan is Unknown
files: owner = "svc-app"
users: [ { name = "svc-app", state = "present" } ]  // plan: Unknown

// after: fix or drop the ambiguous user entry so it converges cleanly
users: [] // let resolve_user find the existing system account
files: owner = "svc-app"

Defensive patterns

Strategy: validation

Validate before calling

fn validate_owner_convergable(files: &[ManagedFileRequest], users: &[UserRequest]) -> Result<(), String> {
    for f in files {
        if let Some(owner) = &f.owner {
            if let Some(u) = users.iter().find(|u| &u.name == owner) {
                if u.plan().action == ResourceAction::Unknown {
                    return Err(format!("owner '{}' cannot be safely converged", owner));
                }
            }
        }
    }
    Ok(())
}

Prevention

Before enabling allow_pending_accounts, ensure every declared account converges to a known state.
Fix malformed host accounts (passwd corruption, name/uid mismatch) that yield Unknown plans.
Verify each file owner resolves to a safe account on every target host before rollout.

When it happens

Trigger: Converging with allow_pending_accounts enabled where the file entry's owner matches a bootstrap user request and that request's plan().action == ResourceAction::Unknown (unsafe/ambiguous account state, e.g. conflicting on-disk identity).

Common situations: An account exists on the host in a state the accounts module cannot classify (corrupt passwd entry, name/uid mismatch); pending-account handling enabled to defer user creation, but the on-disk state is neither cleanly present nor absent; stale system users shadowed by config.

Understand the failure class

Background: "Invalid state transition" errors: "status must be X, actually Y", "already rejected/charging/uninstalled", "cannot ... while running" — what they mean when a library rejects your call — this error's family across 31 libraries.

Related errors

AI-assisted analysis of jdx/mise@afd2eddd3a (2026-09-09). Data as JSON: /api/errors/4f071aa22a1f50e8. Report an issue: GitHub.