The model-usage bed says what the machine knows when the login fails

test/integration/assigned-model-usage.test.ts

@@ -305,6 +305,14 @@ test("usage events are upserted into model-usage's store — latest-per-key, bot
   assert.equal(bound.provision, "postgres-database", `model-usage was bound the wrong provision: ${bound.provision}`);
   const pw = (await must(NODE, `cat /var/lib/model-usage/database.secret`)).trim();
   assert.ok(bound.as && pw, `model-usage's login or password was empty (as=${bound.as})`);
+  // What the machine can say when the login below fails — asked now, so the failure carries it.
+  const account = async () => [
+    "--- provisioner (mesh-postgres):", (await on(NODE, `docker logs --tail 25 mesh-postgres 2>&1`)).out,
+    "--- runtime (mesh-model-usage):", (await on(NODE, `docker logs --tail 25 mesh-model-usage 2>&1`)).out,
+    "--- grants:", (await on(NODE, `ls -la /var/lib/postgres/grants/; cat /var/lib/postgres/grants/mesh.json 2>&1 | head -30`)).out,
+    "--- roles:", (await on(NODE, `docker exec postgres psql -U postgres -tAc "select rolname from pg_roles where rolname like 'mesh%'" 2>&1`)).out,
+    "--- host log:", (await on(NODE, `tail -40 /var/log/mesh-host.log 2>&1`)).out,
+  ].join("\n");
   const conn = `postgresql://${bound.as}:${encodeURIComponent(pw)}@postgres:5432/${bound.as}?sslmode=disable`;
 
   async function usageQuery(sql: string): Promise<{ out: string; ok: boolean }> {
@@ -329,7 +337,7 @@ test("usage events are upserted into model-usage's store — latest-per-key, bot
   // for it before emitting, so the consumer's upsert has a table to write (a reading that arrives
   // before the table would be logged and lost).
   const tableReady = await waitFor("select to_regclass('usage') is not null", /^t$/m);
-  assert.match(tableReady, /^t$/m, `the usage table was never created (the consumer did not migrate):\n${tableReady}`);
+  assert.match(tableReady, /^t$/m, `the usage table was never created (the consumer did not migrate):\n${tableReady}\n${await account()}`);
 
   // Inject a usage event into the mesh. model-usage is a PURE CONSUMER, so its own broker account has
   // no publish right (mesh-controller grants write to mesh.events only to a module that declares `emits`).