Context
Archon is our build runner. Given a feature brief it plans, implements and validates in a loop we call prp-piv. Each run works in a worktree so two runs never touch the same files, and each run ends in a validate script: type check, tests, and for the CMS, a migration dry-run against a database.
The CMS is Payload on Postgres. Its migrations are the usual kind: a numbered file per schema change, a table that records which have run. Running them against the wrong database is not loud. It succeeds.
Local development reads the database URL from the repo’s root .env and from apps/cms/.env.local. Both are ignored by git, so they never ship. But a run’s agents can read the main checkout, and a gate that needs a database will find one there. One old gate even asserts that apps/cms/.env.local does not exist in the worktree: an agent had copied it in.
The runner was the obvious suspect because it is the thing that launches the gate. We spent the first diagnosis on it.