Well this was interesting... One thing that mercurial does is if you clone a repo and the target directory is on the same filesystem as the source, it create hardlinks of files on the destination for efficiency. Well this is fine, but...
One of the things my project does is create a virtual appliance of itself, and how it does that is it creates a chroot, installs gentoo, installs itself, and then copies the chroot to a disk image. Well, this happens on the same filesystem (as root) and in the appliance-making process a user is created in the chroot and also the rep is cloned inside the chroot and chowned to that user. Well the first regular uid is 1000 and since "hg clone" was making symlinks, my repo got ownership changed to the user inside the chroot :| So the fix is to use "hg clone" with the "--pull" option to prevent mercurial from creating hard links.