From 6c16d25039d47c55f48c30c93af4f32c98846cee Mon Sep 17 00:00:00 2001
From: damocles <damocles@hyperhive.local>
Date: Thu, 4 Jun 2026 20:47:40 +0200
Subject: [PATCH] fix(#1304) scope state/harness chowns to own agent dir in
 hive-agent-user-migrate

---
 nix/templates/harness-base.nix | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/nix/templates/harness-base.nix b/nix/templates/harness-base.nix
index c2d4acaa..d81178d5 100644
--- a/nix/templates/harness-base.nix
+++ b/nix/templates/harness-base.nix
@@ -705,14 +705,19 @@ in
       fi
       mkdir -p "$(dirname "$marker")"
       : > "$marker"
-      for stateDir in /agents/*/state; do
-        [ -d "$stateDir" ] || continue
-        chown -hR "$userName:$userName" "$stateDir" 2>/dev/null || true
-      done
-      for harnessDir in /agents/*/harness; do
-        [ -d "$harnessDir" ] || continue
-        chown -hR "$userName:$userName" "$harnessDir" 2>/dev/null || true
-      done
+      # Scope state + harness chowns to THIS container's own dirs only.
+      # The glob `/agents/*/state` also matches child-agent state dirs that
+      # are bind-mounted into parent containers, which would clobber the
+      # ownership those dirs' own activation scripts set — producing
+      # intermittent EACCES for the child agent's harness between a parent
+      # rebuild and the child's next activation. Config dirs are kept broad
+      # because the parent legitimately owns child proposed-config repos.
+      if [ -d "/agents/$userName/state" ]; then
+        chown -hR "$userName:$userName" "/agents/$userName/state" 2>/dev/null || true
+      fi
+      if [ -d "/agents/$userName/harness" ]; then
+        chown -hR "$userName:$userName" "/agents/$userName/harness" 2>/dev/null || true
+      fi
       # The proposed-config repo is RW-mounted into the editing (parent/
       # manager) agent and owned by it; hive-c0re only pulls from it. Heal
       # it to this user too — same as state/harness. In an agent's own