@outerlayer/cli 0.16.1 → 0.18.0

package/dist/{chunk-JEHRUE3F.js → chunk-W5VPCONO.js}

@@ -1,14 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { readPin, pinExists, readBuildHold, readContextManifest, manifestFilesPresent, writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, SOURCE_CACHE_TTL_SUCCESS_MS, isLastCheckFresh, readDegraded, touchLastCheck, clearDegraded, writeContextManifest, writePinIfChanged, readSourceCache, isSourceCacheFresh } from './chunk-WTE3MQML.js';
-import { removeRetiredSkills } from './chunk-C5Y5ZJJZ.js';
-import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
-import { defaultFetch } from './chunk-YO4PSLVB.js';
-import { withTokenHeader } from './chunk-BYT5O5RV.js';
-import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-POJMEEJJ.js';
-import { normalizeRepoName, parseGoverns, CONTEXT_SOURCE_CONFIG_PATH, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-OHVJA253.js';
-import { resolveGatewayCredentials } from './chunk-PLMTLGYH.js';
+import { readPin, pinExists, readBuildHold, readContextManifest, manifestFilesPresent, writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, touchLastCheck, SOURCE_CACHE_TTL_SUCCESS_MS, readDegraded, writeContextManifest, writePinIfChanged, readSourceCache, isSourceCacheFresh, clearDegraded } from './chunk-LXAY4A2G.js';
+import { removeRetiredSkills } from './chunk-T4Y6SCG3.js';
+import { defaultFetch } from './chunk-ZRL6HKBY.js';
+import { resolveGatewayCredentials } from './chunk-52NC2FIU.js';
+import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-MNTSH4CL.js';
+import { normalizeRepoName, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-X5N6KC6V.js';
+import { withTokenHeader } from './chunk-BQXFBI7T.js';
 import { ensureContextExcludes, ensurePreCommitGuardHook } from './chunk-XCCLFVXM.js';
+import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
+import { cliInvocation } from './chunk-CRB3POP4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { execFileSync } from 'child_process';
 import { lstatSync, existsSync, mkdirSync, writeFileSync, chmodSync, unlinkSync, readdirSync, rmSync, readFileSync, copyFileSync } from 'fs';
@@ -91,16 +92,20 @@ function gitText(git, cwd, args, timeoutMs) {
   const result = git(args, { cwd, timeoutMs });
   return result.ok ? result.stdout.toString("utf8").trim() : void 0;
 }
+var GATEWAY_TOO_OLD_MESSAGE = "the OuterLayer this machine talks to is too old to name the control plane \u2014 ask whoever runs it to upgrade; context written earlier is kept";
 var NOT_GOVERNED_MESSAGE = "this repository's control plane no longer governs it";
 var ADOPTION_MESSAGE = "committed context files shadow the control plane \u2014 remove them in a commit";
 var CANNOT_IDENTIFY_MESSAGE = "this repository is governed, but the control plane cannot be identified \u2014 check OuterLayer connectivity/config";
 function designationAuthRejectedMessage(credential) {
-  return credential.startsWith("olu_") ? "the OuterLayer login was rejected (401/403) \u2014 run `outerlayer login` to sign in again" : "the OuterLayer API key was rejected (401/403) \u2014 check apiKey in ~/.outerlayer/config.json";
+  return credential.startsWith("olu_") ? `the OuterLayer login was rejected (401/403) \u2014 run \`${cliInvocation()} login\` to sign in again` : "the OuterLayer API key was rejected (401/403) \u2014 check apiKey in ~/.outerlayer/config.json";
 }
 var PARTIAL_WRITE_MESSAGE = "control-plane content could not be fully written \u2014 running on previous context";
 var OVERLAY_FAILED_MESSAGE = "control-plane content was written but the maintained skills could not be refreshed \u2014 retrying next session";
-var COMMIT_GUARD_FOREIGN_NOT_INSTALLED_MESSAGE = "the materialized-context commit guard is NOT installed \u2014 a pre-commit hook this clone did not write occupies that slot \u2014 resolve the conflict or run `outerlayer hooks install-git`";
-var COMMIT_GUARD_HOOKSPATH_NOT_INSTALLED_MESSAGE = "the materialized-context commit guard is NOT installed \u2014 hooks are managed via core.hooksPath, which this clone never writes to automatically \u2014 adopt it yourself: `outerlayer hooks install-git --print`";
+function isStagingWriteFault(message) {
+  return message === PARTIAL_WRITE_MESSAGE || message === OVERLAY_FAILED_MESSAGE;
+}
+var COMMIT_GUARD_FOREIGN_NOT_INSTALLED_MESSAGE = `the materialized-context commit guard is NOT installed \u2014 a pre-commit hook this clone did not write occupies that slot \u2014 resolve the conflict or run \`${cliInvocation()} hooks install-git\``;
+var COMMIT_GUARD_HOOKSPATH_NOT_INSTALLED_MESSAGE = `the materialized-context commit guard is NOT installed \u2014 hooks are managed via core.hooksPath, which this clone never writes to automatically \u2014 adopt it yourself: \`${cliInvocation()} hooks install-git --print\``;
 function guardNotInstalledMessage(guard) {
   if (guard.adopted) return void 0;
   if (guard.status === "skipped-foreign") return COMMIT_GUARD_FOREIGN_NOT_INSTALLED_MESSAGE;
@@ -188,100 +193,67 @@ async function materializeContext(deps) {
   if (ownRepoName === void 0) {
     return selfOutcome();
   }
-  const designation = await resolveDesignation({ git, fetchImpl, home, cloud: deps.cloud, now, gitCommonDir, ownRepoName, repoRoot, lookup: deps.designationLookup ?? { timeoutMs: 2e3, attempts: 1 } });
+  const designation = deps.pinnedSource === void 0 ? await resolveDesignation({ git, fetchImpl, home, cloud: deps.cloud, now, gitCommonDir, ownRepoName, repoRoot, lookup: deps.designationLookup ?? { timeoutMs: 2e3, attempts: 1 } }) : deps.pinnedSource === null ? { status: "self" } : { status: "governed", ...deps.pinnedSource };
   const answered = { designation: "answered" };
   if (designation.status === "self") {
+    if (designation.unanswered !== void 0 && !hasPin) {
+      const { authRejected, gatewayTooOld } = designation.unanswered;
+      const message = authRejected ?? (gatewayTooOld ? GATEWAY_TOO_OLD_MESSAGE : void 0);
+      if (message !== void 0) {
+        writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind: "designation-unverified", message });
+      }
+      return {
+        status: "self",
+        sha: null,
+        verification: "none",
+        designation: "unknown",
+        ...authRejected ? { authRejected: true } : {},
+        ...message !== void 0 && !authRejected ? { message } : {}
+      };
+    }
     return { ...selfOutcome(), ...answered };
   }
   if (designation.status === "unknown") {
-    const message = designation.authRejected ?? CANNOT_IDENTIFY_MESSAGE;
+    const message = designation.authRejected ?? (designation.gatewayTooOld ? GATEWAY_TOO_OLD_MESSAGE : CANNOT_IDENTIFY_MESSAGE);
     if (hasPin) {
       writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind: "designation-unverified", message });
       record(null, "none");
       return { status: "designation-unverified", message, sha: null, verification: "none", designation: "unknown" };
     }
-    if (designation.authRejected) {
+    if (designation.authRejected || designation.gatewayTooOld) {
       writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind: "designation-unverified", message });
     }
-    writeSourceCache(gitCommonDir, { checkedAt: new Date(now()).toISOString(), status: "self", ttlMs: SOURCE_CACHE_TTL_RETRY_MS });
-    return { status: "self", sha: null, verification: "none", designation: "unknown", ...designation.authRejected ? { authRejected: true } : {}, lookupFailure: designation.lookupFailure };
-  }
-  let repository;
-  let ref;
-  let unverifiedIdentity;
-  let preFetched;
-  let unreadableCandidates = [];
-  if (designation.status === "candidates") {
-    const sortedCandidates = [...designation.candidates].sort((a, b) => a.repository.localeCompare(b.repository));
-    const claimants = [];
-    const unfetched = [];
-    const access = await deps.controlPlaneAccess?.(sortedCandidates);
-    for (const candidate of sortedCandidates) {
-      const candidateUrl = deps.resolveControlPlaneUrl ? deps.resolveControlPlaneUrl(candidate.repository, candidate.ref, repoRoot) : buildControlPlaneUrl(git, repoRoot, candidate.repository);
-      const candidateHost = parseRemoteHost(candidateUrl).host || "unknown-host";
-      const candidateCacheDir = ensureBareCache(git, home, candidate.repository, candidateHost);
-      const candidateLocalRef = `refs/outerlayer/${sanitizeRefName(candidate.ref)}`;
-      const token = access !== void 0 && normalizeRepoName(access.repository) === normalizeRepoName(candidate.repository) ? access.token : void 0;
-      const candidateFetch = git(["fetch", "--depth", "1", candidateUrl, `+${candidate.ref}:${candidateLocalRef}`], {
-        cwd: candidateCacheDir,
-        timeoutMs: 1e4,
-        ...token === void 0 ? {} : { env: (base) => withTokenHeader(base, candidateUrl, token) }
-      });
-      if (!candidateFetch.ok) {
-        unfetched.push(candidate.repository);
-        continue;
-      }
-      const candidateSha = gitText(git, candidateCacheDir, ["rev-parse", candidateLocalRef], 2e3);
-      if (candidateSha === void 0) {
-        unfetched.push(candidate.repository);
-        continue;
-      }
-      const candidateConfig = readBlobAtPath(git, candidateCacheDir, candidateSha, CONTEXT_SOURCE_CONFIG_PATH);
-      const candidateGoverns = candidateConfig === void 0 ? { governs: [] } : parseGoverns(candidateConfig);
-      const candidateGovernsList = "error" in candidateGoverns ? [] : candidateGoverns.governs;
-      if (candidateGovernsList.some((r) => normalizeRepoName(r) === normalizeRepoName(ownRepoName))) {
-        claimants.push({ repository: candidate.repository, ref: candidate.ref, sha: candidateSha, cacheRepoDir: candidateCacheDir });
-      }
-    }
-    if (claimants.length === 0) {
-      writeSourceCache(gitCommonDir, { checkedAt: new Date(now()).toISOString(), status: "self", ttlMs: SOURCE_CACHE_TTL_SUCCESS_MS });
-      return { ...selfOutcome(), ...answered, ...unfetched.length > 0 ? { unfetched } : {} };
-    }
-    if (claimants.length > 1) {
-      const names = claimants.map((c) => c.repository).sort();
-      const message = `${names.join(" and ")} both claim to govern this repository \u2014 resolve the designation before context can materialize`;
-      writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind: "conflict", message });
-      const manifestForConflict = readContextManifest(gitCommonDir);
-      const lastGood = manifestForConflict?.sha ?? null;
-      const verification = manifestForConflict ? "unverified" : "none";
-      record(lastGood, verification);
-      return { status: "conflict", message, sha: lastGood, verification };
-    }
-    unreadableCandidates = unfetched;
-    const winner = claimants[0];
     writeSourceCache(gitCommonDir, {
       checkedAt: new Date(now()).toISOString(),
-      status: "governed",
-      repository: winner.repository,
-      ref: winner.ref,
-      ttlMs: SOURCE_CACHE_TTL_SUCCESS_MS
+      status: "self",
+      ttlMs: SOURCE_CACHE_TTL_RETRY_MS,
+      unanswered: {
+        ...designation.authRejected ? { authRejected: designation.authRejected } : {},
+        ...designation.gatewayTooOld ? { gatewayTooOld: true } : {}
+      }
     });
-    repository = winner.repository;
-    ref = winner.ref;
-    preFetched = { sha: winner.sha, cacheRepoDir: winner.cacheRepoDir };
-  } else {
-    repository = designation.repository;
-    ref = designation.ref;
-    unverifiedIdentity = designation.unverifiedIdentity;
+    return {
+      status: "self",
+      sha: null,
+      verification: "none",
+      designation: "unknown",
+      ...designation.authRejected ? { authRejected: true } : {},
+      ...designation.gatewayTooOld ? { message } : {},
+      lookupFailure: designation.lookupFailure
+    };
   }
+  const repository = designation.repository;
+  const ref = designation.ref;
+  const unverifiedIdentity = designation.unverifiedIdentity;
+  const storedSha = designation.sha;
   const manifest = readContextManifest(gitCommonDir);
-  const evidenced = hasGovernedEvidence(hasPin, manifest);
+  const evidenced = hasGovernedEvidence(hasPin, manifest) || !unverifiedIdentity;
   const clearOrFlagIdentity = () => {
     if (unverifiedIdentity) {
       writeDegraded(gitCommonDir, {
         at: new Date(now()).toISOString(),
         kind: "designation-unverified",
-        message: CANNOT_IDENTIFY_MESSAGE,
+        message: designation.gatewayTooOld ? GATEWAY_TOO_OLD_MESSAGE : CANNOT_IDENTIFY_MESSAGE,
         repository,
         ref
       });
@@ -289,99 +261,77 @@ async function materializeContext(deps) {
       clearDegraded(gitCommonDir);
     }
   };
-  let sha;
-  let cacheRepoDir;
-  if (preFetched) {
-    sha = preFetched.sha;
-    cacheRepoDir = preFetched.cacheRepoDir;
-  } else {
-    if (isLastCheckFresh(gitCommonDir, now()) && manifest !== void 0 && pin?.sha === manifest.sha && manifestFilesPresent(repoRoot, manifest)) {
-      const degraded = readDegraded(gitCommonDir);
-      const verification = degraded ? "unverified" : "verified";
-      ensureContextExcludes(gitCommonDir);
-      recordMaintainedOverlay(repoRoot, gitCommonDir, manifest);
-      const guardMessage2 = guardNotInstalledMessage(ensurePreCommitGuardHook(repoRoot, gitCommonDir));
-      record(manifest.sha, verification, repository, ref);
-      return {
-        status: "debounced",
-        sha: manifest.sha,
-        verification,
-        ...guardMessage2 ? { message: guardMessage2 } : {}
-      };
-    }
-    const recentFailure = readDegraded(gitCommonDir);
-    if (recentFailure && (recentFailure.kind === "unreachable" || recentFailure.kind === "no-access") && recentFailure.repository === repository && recentFailure.ref === ref && now() - Date.parse(recentFailure.at) < FAILURE_DEBOUNCE_MS) {
-      const lastGood = manifest?.sha ?? null;
-      const verification = lastGood ? "unverified" : "none";
-      if (evidenced) {
-        record(lastGood, verification, repository, ref);
-        return { status: recentFailure.kind, message: recentFailure.message, sha: lastGood, verification };
-      }
-      return { status: recentFailure.kind, sha: null, verification: "none" };
-    }
-    const remoteUrl = deps.resolveControlPlaneUrl ? deps.resolveControlPlaneUrl(repository, ref, repoRoot) : buildControlPlaneUrl(git, repoRoot, repository);
-    const cacheHost = parseRemoteHost(remoteUrl).host || "unknown-host";
-    const lsRemote = git(["ls-remote", remoteUrl, ref], { cwd: repoRoot, timeoutMs: 2e3 });
-    if (lsRemote.ok) {
-      const remoteSha = parseLsRemoteSha(lsRemote.stdout.toString("utf8"));
-      if (remoteSha && manifest !== void 0 && manifest.sha === remoteSha && pin?.sha === remoteSha && manifestFilesPresent(repoRoot, manifest)) {
-        touchLastCheck(gitCommonDir, now());
-        clearOrFlagIdentity();
-        ensureContextExcludes(gitCommonDir);
-        recordMaintainedOverlay(repoRoot, gitCommonDir, manifest);
-        const guardMessage2 = guardNotInstalledMessage(ensurePreCommitGuardHook(repoRoot, gitCommonDir));
-        writeSourceCache(gitCommonDir, { checkedAt: new Date(now()).toISOString(), status: "governed", repository, ref, ttlMs: SOURCE_CACHE_TTL_SUCCESS_MS });
-        record(remoteSha, "verified", repository, ref);
-        return {
-          status: "debounced",
-          sha: remoteSha,
-          verification: "verified",
-          ...guardMessage2 ? { message: guardMessage2 } : {}
-        };
-      }
-    }
-    cacheRepoDir = ensureBareCache(git, home, repository, cacheHost);
-    const localRef = `refs/outerlayer/${sanitizeRefName(ref)}`;
-    const fetchResult = git(["fetch", "--depth", "1", remoteUrl, `+${ref}:${localRef}`], { cwd: cacheRepoDir, timeoutMs: 1e4 });
-    if (!fetchResult.ok) {
-      const kind = classifyGitFailure(fetchResult.stderr);
-      const lastGood = manifest?.sha ?? null;
-      const verification = lastGood ? "unverified" : "none";
-      const doctorMessage = kind === "no-access" ? noAccessMessage(lastGood) : unreachableMessage(lastGood);
-      writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind, message: doctorMessage, repository, ref, lastGoodSha: lastGood ?? void 0 });
-      if (evidenced) {
-        record(lastGood, verification, repository, ref);
-        return { status: kind, message: doctorMessage, sha: lastGood, verification };
-      }
-      return { status: kind, sha: null, verification: "none" };
+  if (manifest !== void 0 && manifest.sha === storedSha && pin?.sha === storedSha && manifestFilesPresent(repoRoot, manifest)) {
+    touchLastCheck(gitCommonDir, now());
+    clearOrFlagIdentity();
+    ensureContextExcludes(gitCommonDir);
+    recordMaintainedOverlay(repoRoot, gitCommonDir, manifest);
+    const guardMessage2 = guardNotInstalledMessage(ensurePreCommitGuardHook(repoRoot, gitCommonDir));
+    writeSourceCache(gitCommonDir, {
+      checkedAt: new Date(now()).toISOString(),
+      status: "governed",
+      repository,
+      ref,
+      sha: storedSha,
+      ttlMs: SOURCE_CACHE_TTL_SUCCESS_MS
+    });
+    const verification = unverifiedIdentity ? "unverified" : "verified";
+    record(storedSha, verification, repository, ref);
+    return {
+      status: "debounced",
+      sha: storedSha,
+      verification,
+      ...guardMessage2 ? { message: guardMessage2 } : {}
+    };
+  }
+  const recentFailure = readDegraded(gitCommonDir);
+  if (recentFailure && (recentFailure.kind === "unreachable" || recentFailure.kind === "no-access") && recentFailure.repository === repository && recentFailure.ref === ref && now() - Date.parse(recentFailure.at) < FAILURE_DEBOUNCE_MS) {
+    const lastGood = manifest?.sha ?? null;
+    const verification = lastGood ? "unverified" : "none";
+    if (evidenced) {
+      record(lastGood, verification, repository, ref);
+      return { status: recentFailure.kind, message: recentFailure.message, sha: lastGood, verification };
     }
-    const fetchedSha = gitText(git, cacheRepoDir, ["rev-parse", localRef], 2e3);
-    if (fetchedSha === void 0) {
-      const lastGood = manifest?.sha ?? null;
-      const verification = lastGood ? "unverified" : "none";
-      const doctorMessage = unreachableMessage(lastGood);
-      writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind: "unreachable", message: doctorMessage, repository, ref, lastGoodSha: lastGood ?? void 0 });
-      if (evidenced) {
-        record(lastGood, verification, repository, ref);
-        return { status: "unreachable", message: doctorMessage, sha: lastGood, verification };
-      }
-      return { status: "unreachable", sha: null, verification: "none" };
+    return { status: recentFailure.kind, sha: null, verification: "none" };
+  }
+  const remoteUrl = deps.resolveControlPlaneUrl ? deps.resolveControlPlaneUrl(repository, ref, repoRoot) : buildControlPlaneUrl(git, repoRoot, repository);
+  const cacheHost = parseRemoteHost(remoteUrl).host || "unknown-host";
+  const cacheRepoDir = ensureBareCache(git, home, repository, cacheHost);
+  const localRef = `refs/outerlayer/sha-${sanitizeRefName(storedSha)}`;
+  const wanted = `+${storedSha}:${localRef}`;
+  const access = await deps.controlPlaneAccess?.([{ repository, ref }]);
+  const token = access !== void 0 && normalizeRepoName(access.repository) === normalizeRepoName(repository) ? access.token : void 0;
+  const fetchResult = git(["fetch", "--depth", "1", remoteUrl, wanted], {
+    cwd: cacheRepoDir,
+    timeoutMs: 1e4,
+    ...token === void 0 ? {} : { env: (base) => withTokenHeader(base, remoteUrl, token) }
+  });
+  const commitNote = (message) => `could not fetch commit \`${storedSha.slice(0, 7)}\` of ${repository}; ${message}`;
+  if (!fetchResult.ok) {
+    const kind = classifyGitFailure(fetchResult.stderr);
+    const lastGood = manifest?.sha ?? null;
+    const verification = lastGood ? "unverified" : "none";
+    const doctorMessage = commitNote(kind === "no-access" ? noAccessMessage(lastGood) : unreachableMessage(lastGood));
+    writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind, message: doctorMessage, repository, ref, lastGoodSha: lastGood ?? void 0 });
+    if (evidenced) {
+      record(lastGood, verification, repository, ref);
+      return { status: kind, message: doctorMessage, sha: lastGood, verification };
     }
-    sha = fetchedSha;
-    const configContent = readBlobAtPath(git, cacheRepoDir, sha, CONTEXT_SOURCE_CONFIG_PATH);
-    const parsedGoverns = configContent === void 0 ? { governs: [] } : parseGoverns(configContent);
-    const governsList = "error" in parsedGoverns ? [] : parsedGoverns.governs;
-    const governed = governsList.some((r) => normalizeRepoName(r) === normalizeRepoName(ownRepoName));
-    if (!governed) {
-      writeSourceCache(gitCommonDir, { checkedAt: new Date(now()).toISOString(), status: "self", ttlMs: SOURCE_CACHE_TTL_SUCCESS_MS });
-      if (hasPin) {
-        writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind: "not-governed", message: NOT_GOVERNED_MESSAGE });
-        return { status: "not-governed", message: NOT_GOVERNED_MESSAGE, sha: pin?.sha ?? null, verification: "none" };
-      }
-      clearDegraded(gitCommonDir);
-      return { status: "self", sha: null, verification: "none" };
+    return { status: kind, sha: null, verification: "none" };
+  }
+  const fetchedSha = gitText(git, cacheRepoDir, ["rev-parse", localRef], 2e3);
+  if (fetchedSha !== storedSha) {
+    const lastGood = manifest?.sha ?? null;
+    const verification = lastGood ? "unverified" : "none";
+    const doctorMessage = commitNote(unreachableMessage(lastGood));
+    writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind: "unreachable", message: doctorMessage, repository, ref, lastGoodSha: lastGood ?? void 0 });
+    if (evidenced) {
+      record(lastGood, verification, repository, ref);
+      return { status: "unreachable", message: doctorMessage, sha: lastGood, verification };
     }
+    return { status: "unreachable", sha: null, verification: "none" };
   }
+  const sha = fetchedSha;
   const tracked = git(["ls-files", "-z", "--", "AGENTS.md", ".claude", ".outerlayer"], { cwd: repoRoot, timeoutMs: 2e3 });
   if (tracked.ok && tracked.stdout.length > 0) {
     writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind: "adoption-conflict", message: ADOPTION_MESSAGE, repository, ref });
@@ -449,14 +399,20 @@ async function materializeContext(deps) {
   writePinIfChanged(repoRoot, sha);
   touchLastCheck(gitCommonDir, now());
   clearOrFlagIdentity();
-  writeSourceCache(gitCommonDir, { checkedAt: new Date(now()).toISOString(), status: "governed", repository, ref, ttlMs: SOURCE_CACHE_TTL_SUCCESS_MS });
+  writeSourceCache(gitCommonDir, {
+    checkedAt: new Date(now()).toISOString(),
+    status: "governed",
+    repository,
+    ref,
+    sha: storedSha,
+    ttlMs: SOURCE_CACHE_TTL_SUCCESS_MS
+  });
   record(sha, "verified", repository, ref);
   return {
     status: "materialized",
     sha,
     verification: "verified",
-    ...guardMessage ? { message: guardMessage } : {},
-    ...unreadableCandidates.length > 0 ? { unfetched: unreadableCandidates } : {}
+    ...guardMessage ? { message: guardMessage } : {}
   };
 }
 function recordMaintainedOverlay(repoRoot, gitCommonDir, manifest) {
@@ -476,11 +432,12 @@ function recordMaintainedOverlay(repoRoot, gitCommonDir, manifest) {
 }
 async function resolveDesignation(ctx) {
   const cache = readSourceCache(ctx.gitCommonDir);
-  if (cache && isSourceCacheFresh(cache, ctx.now())) {
-    return cache.status === "governed" && cache.repository && cache.ref ? { status: "governed", repository: cache.repository, ref: cache.ref } : { status: "self" };
+  if (cache && cache.status === "self" && isSourceCacheFresh(cache, ctx.now())) {
+    return { status: "self", unanswered: cache.unanswered };
   }
   let authRejected;
   let lookupFailure;
+  let gatewayTooOld = false;
   const destination = resolveGatewayCredentials({
     home: ctx.home,
     env: {},
@@ -497,8 +454,7 @@ async function resolveDesignation(ctx) {
     if (lookup.kind === "rejected") authRejected = designationAuthRejectedMessage(destination.credential);
     if (lookup.kind === "failed") lookupFailure = lookup.failure;
     if (lookup.kind === "answered") {
-      const sources = lookup.sources;
-      if (sources.length === 0) {
+      if (lookup.source === null) {
         writeSourceCache(ctx.gitCommonDir, {
           checkedAt: new Date(ctx.now()).toISOString(),
           status: "self",
@@ -506,13 +462,25 @@ async function resolveDesignation(ctx) {
         });
         return { status: "self" };
       }
-      return { status: "candidates", candidates: sources };
+      if (lookup.source !== void 0) {
+        return { status: "governed", repository: lookup.source.repository, ref: lookup.source.ref, sha: lookup.source.sha };
+      }
+      gatewayTooOld = true;
     }
   }
-  if (cache) {
-    return cache.status === "governed" && cache.repository && cache.ref ? { status: "governed", repository: cache.repository, ref: cache.ref, unverifiedIdentity: true } : { status: "self" };
+  if (cache?.status === "self") {
+    return cache.unanswered !== void 0 || authRejected !== void 0 || gatewayTooOld ? {
+      status: "self",
+      unanswered: { ...cache.unanswered, ...authRejected ? { authRejected } : {}, ...gatewayTooOld ? { gatewayTooOld } : {} }
+    } : { status: "self" };
+  }
+  if (cache?.repository && cache.ref && cache.sha !== void 0) {
+    return { status: "governed", repository: cache.repository, ref: cache.ref, sha: cache.sha, unverifiedIdentity: true, ...gatewayTooOld ? { gatewayTooOld } : {} };
   }
-  return { status: "unknown", authRejected, lookupFailure };
+  return { status: "unknown", authRejected, gatewayTooOld, lookupFailure };
+}
+async function lookupGoverningSource(config, repository, fetchImpl, lookup) {
+  return fetchContextSource(config, repository, fetchImpl, lookup);
 }
 async function fetchContextSource(config, ownRepoName, fetchImpl, lookup) {
   const url = `${config.url.replace(/\/$/, "")}/v1/context/source?repo=${encodeURIComponent(ownRepoName)}`;
@@ -541,8 +509,12 @@ async function askContextSource(url, config, fetchImpl, timeoutMs) {
     }
     if (!res.ok) return { kind: "failed", failure: { kind: "status", status: res.status } };
     const body = await res.json();
-    if (body.data?.sources === void 0) return { kind: "failed", failure: { kind: "network", message: "the answer named no sources" } };
-    return { kind: "answered", sources: body.data.sources };
+    const data = body.data;
+    const source = validSource(data?.source);
+    if (typeof data !== "object" || data === null) {
+      return { kind: "failed", failure: { kind: "network", message: "the answer held no data" } };
+    }
+    return { kind: "answered", source };
   } catch (err) {
     return {
       kind: "failed",
@@ -552,6 +524,14 @@ async function askContextSource(url, config, fetchImpl, timeoutMs) {
     clearTimeout(timer);
   }
 }
+function validSource(source) {
+  if (source === null) return null;
+  const candidate = source;
+  if (typeof candidate?.repository === "string" && typeof candidate.ref === "string" && typeof candidate.sha === "string") {
+    return { repository: candidate.repository, ref: candidate.ref, sha: candidate.sha };
+  }
+  return void 0;
+}
 function resolveGitCommonDir(git, repoRoot) {
   const abs = gitText(git, repoRoot, ["rev-parse", "--path-format=absolute", "--git-common-dir"], 2e3);
   if (abs !== void 0) return abs;
@@ -605,12 +585,6 @@ function ensureBareCache(git, home, repository, host) {
   }
   return dir;
 }
-function parseLsRemoteSha(output) {
-  const lines = output.split("\n").filter((l) => l.trim().length > 0);
-  const peeled = lines.find((l) => l.split(/\s+/)[1]?.endsWith("^{}"));
-  const line = peeled ?? lines[0];
-  return line?.split(/\s+/)[0];
-}
 var MATERIALIZED_ROOTS = ["AGENTS.md", ".claude", ".outerlayer"];
 function listMaterializedFiles(git, cacheRepoDir, sha) {
   const result = git(["ls-tree", "-r", "-z", sha, "--", ...MATERIALIZED_ROOTS], { cwd: cacheRepoDir, timeoutMs: 1e4 });
@@ -631,10 +605,6 @@ function listMaterializedFiles(git, cacheRepoDir, sha) {
   }
   return entries;
 }
-function readBlobAtPath(git, cacheRepoDir, sha, path) {
-  const result = git(["show", `${sha}:${path}`], { cwd: cacheRepoDir, timeoutMs: 5e3 });
-  return result.ok ? result.stdout.toString("utf8") : void 0;
-}
 function parseBatchReply(files, stdout) {
   const parsed = [];
   let pos = 0;
@@ -723,4 +693,4 @@ function pruneEmptyDirs(dir, stopAt) {
   }
 }
 
-export { defaultGitRunner, hasSymlinkComponent, materializeContext, parseOwnerRepo, parseRemoteHost, resolveGitCommonDir };
+export { defaultGitRunner, hasSymlinkComponent, isStagingWriteFault, lookupGoverningSource, materializeContext, parseOwnerRepo, parseRemoteHost, resolveGitCommonDir };

package/dist/{chunk-NPQWKGUA.js → chunk-WBT5X3NH.js}

@@ -1,9 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-YDSMROTB.js';
-import { resolveRepoIdentity } from './chunk-JXYVA45C.js';
-import { resolveGatewayCredentials } from './chunk-PLMTLGYH.js';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-S76AYB4M.js';
+import { resolveRepoIdentity } from './chunk-BMYGAGBJ.js';
+import { resolveGatewayCredentials } from './chunk-52NC2FIU.js';
 import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
+import { cliInvocation } from './chunk-CRB3POP4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 
 createRequire(import.meta.url);
@@ -22,7 +23,7 @@ async function autoConnect(opts) {
   if (!listed.ok || listed.factories.length === 0) return void 0;
   const chosen = selectFactory(listed.factories, readRepoConnection(cwd), repository);
   if (chosen.factory === void 0) {
-    return `you are logged in, but no factory is chosen for this repository, and more than one fits. Run \`outerlayer connect --factory <org>/<factory>\` with one of:
+    return `you are logged in, but no factory is chosen for this repository, and more than one fits. Run \`${cliInvocation()} connect --factory <org>/<factory>\` with one of:
 ${chosen.text}
 Or pass --app-id / set OUTERLAYER_APP_ID.`;
   }

package/dist/{chunk-RLYZLUQ7.js → chunk-WGAUY5LE.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { builtinKind } from './chunk-22RMZBGW.js';
+import { builtinKind } from './chunk-XGP3VYOG.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
-import { runnerDir } from './chunk-ZM2IMMYN.js';
+import { runnerDir } from './chunk-N2PXGQRL.js';
 import { dirname } from 'path';
 import { spawnSync } from 'child_process';
 

package/dist/{chunk-RSNSZ2LJ.js → chunk-X5H2WYMB.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RELAY_PORT, GATEWAY_SOCKET, GATEWAY_PORT, CLAUDE_SOCKET, CLAUDE_PORT, DESTINATION_BASE_PORT } from './chunk-4Q7OMKAT.js';
+import { RELAY_PORT, GATEWAY_SOCKET, GATEWAY_PORT, CLAUDE_SOCKET, CLAUDE_PORT, DESTINATION_BASE_PORT } from './chunk-BQXFBI7T.js';
 import { symlinkSync, unlinkSync } from 'fs';
 import { join } from 'path';