@synap-core/cli 1.11.0 → 1.12.2

package/dist/commands/market.js

@@ -23,19 +23,22 @@
  */
 import ora from "ora";
 import chalk from "chalk";
-import { assembleCatalog, computeTemplateUpdates, isHashVersion, listPublicTemplates, listWorkspaceTemplates, toPackageDefinition, layerTemplateGraph, bundledEdgesOf, groupByDomain, } from "@synap-core/workspace-templates";
+import { assembleCatalog, computeTemplateUpdates, isHashVersion, listPublicTemplates, listWorkspaceTemplates, getWorkspaceTemplate, mergeCatalog, toPackageDefinition, layerTemplateGraph, bundledEdgesOf, groupByDomain, } from "@synap-core/workspace-templates";
 import { log } from "../utils/logger.js";
 import { resolveHubConfig, hubPost, renderHubError, HubError } from "../lib/hub-client.js";
 import { fetchProjects } from "../lib/project.js";
 import { writeGovernance } from "../lib/capture-lane.js";
 import { renderNextSteps, FLOW } from "../lib/next-steps.js";
 import { getStoredToken, isTokenLocallyExpired } from "../lib/auth.js";
-import { fetchPublicBrowseRows, fetchMyRows, fetchAvailableSlugs, fetchPackageDefinition, } from "../lib/cp-packages.js";
-import { fetchInstalledSlugs, fetchInstalledTemplates } from "../lib/installed.js";
+import prompts from "prompts";
+import { fetchPublicBrowseRows, fetchMyRows, fetchAvailableSlugs, fetchRetiredWorkspaceSlugs, fetchPackageDefinition, fetchPackageRecord, hydrateMineCategories, } from "../lib/cp-packages.js";
+import { fetchInstalledSlugs, fetchInstalledTemplates, fetchInstalledInventory, fetchInstalledInventoryStrict, installedRowsToTemplates, fetchWorkspaceAttachments, fetchWorkspaceAttachmentsStrict, verifyStampLanded, INSTALLED_KINDS } from "../lib/installed.js";
 import { isSuite } from "../lib/suite.js";
+import { TEMPLATE_STEP_LABELS, classifyTemplateStep, proposalsDoor, stepFromApplyState, templateStepGlyph, templateStepPhrase, } from "../lib/template-steps.js";
 import { capabilityAdd } from "./capability.js";
 import { bundledTemplatesVersion } from "../lib/bundle-version.js";
 import { HubNetworkError } from "../lib/hub-client.js";
+import { parseDataChanges, dataChangesFromRefusal, consentNeedsPerson, dataChangeRefusalMessage, printDataChanges, parseAcceptList, decideConsent, consentRerunCommand, consentRefusalLines, lifecycleNotice, overlayNotice, overlayNeedsAttention, } from "../lib/template-lifecycle.js";
 // Same longer budget launch uses — an apply writes profiles/views/entities.
 const APPLY_TIMEOUT_MS = 120_000;
 /** `--timeout <seconds>` → ms, falling back to `APPLY_TIMEOUT_MS` when unset/invalid. */
@@ -43,6 +46,12 @@ function parseApplyTimeoutMs(raw) {
     const secs = raw ? parseInt(raw, 10) : NaN;
     return Number.isFinite(secs) && secs > 0 ? secs * 1000 : APPLY_TIMEOUT_MS;
 }
+/** Drop workspace entries whose slug the CP retired. `null` (unknown) keeps every entry. */
+export function dropRetiredWorkspaces(entries, retiredSlugs) {
+    if (!retiredSlugs || retiredSlugs.size === 0)
+        return entries;
+    return entries.filter((e) => !(typeOf(e) === "workspace" && retiredSlugs.has(e.slug)));
+}
 /**
  * Assemble the market catalog: bundled workspace templates ∪ public CP browse
  * (all types) ∪ the caller's own packages (when logged in), through the shared
@@ -54,7 +63,7 @@ export async function buildMarketCatalog(filters) {
     const creds = getStoredToken();
     const loggedIn = !!creds && !isTokenLocallyExpired(creds);
     let reachedCp = true;
-    const [publicRows, mineRows, availableSlugs, installed] = await Promise.all([
+    const [publicRows, rawMineRows, availableSlugs, installed, retiredSlugs] = await Promise.all([
         fetchPublicBrowseRows(filters).catch(() => {
             reachedCp = false;
             return [];
@@ -66,14 +75,36 @@ export async function buildMarketCatalog(filters) {
             ? fetchAvailableSlugs(creds.token, filters).catch(() => null)
             : Promise.resolve(null),
         fetchInstalledSlugs(),
+        fetchRetiredWorkspaceSlugs(),
     ]);
+    // The `/mine` LIST PROJECTION omits `category` (CP `routes/packages.ts`), so
+    // the caller's own rows — the ONLY way a PRIVATE package can reach this
+    // catalog — arrive type-less. Untreated, `typeOf`'s display default calls
+    // every one of them a workspace: that is why a published cell package was
+    // invisible to `--list --type cell` and installed as an empty "New
+    // Workspace". Hydrate from the public rows we already have, else the authed
+    // single-package door. Best-effort: a row that can't be resolved keeps an
+    // ABSENT category (the install refusal is the floor under it).
+    const publicCategoryBySlug = new Map();
+    for (const r of publicRows)
+        publicCategoryBySlug.set(r.slug, r.category);
+    const mineRows = loggedIn && creds && rawMineRows.length > 0
+        ? await hydrateMineCategories(rawMineRows, creds.token, publicCategoryBySlug).catch(() => rawMineRows)
+        : rawMineRows;
     const merged = assembleCatalog({
         // Logged in → include PRIVATE bundled templates (e.g. the `the-arch` suite),
         // matching the "private templates unlocked" promise. Logged out → public
         // bundle only. (mergeCatalog derives `isPrivate` from each template's
         // `meta.isPublic === false`, so private bundled entries stay badged.)
         bundled: loggedIn ? listWorkspaceTemplates() : listPublicTemplates(),
-        remoteRows: [...publicRows, ...mineRows],
+        // `/mine` FIRST: `mergeCatalog` keeps the first remote row for a slug, so
+        // this makes the caller's OWN row win a collision with a stranger's public
+        // one. That matches the CP's own `GET /:slug` precedence (own row beats a
+        // public row) and `remoteVersionBySlug` below, and it is the only order
+        // under which the private flag and the hydrated category survive a slug a
+        // public package also claims. (The bundled-template squatting defense sits
+        // above both and is unaffected.)
+        remoteRows: [...mineRows, ...publicRows],
         bundleVersion: bundledTemplatesVersion(),
         remoteStatus: reachedCp ? "ok" : "unreachable",
     });
@@ -102,7 +133,9 @@ export async function buildMarketCatalog(filters) {
         if (r.version)
             remoteVersionBySlug.set(r.slug, r.version);
     return {
-        entries: merged.entries,
+        // A template the CP retired is never offered, listed as installable or
+        // suggested — even when the bundled copy this CLI ships still carries it.
+        entries: dropRetiredWorkspaces(merged.entries, retiredSlugs),
         tierBySlug,
         lockedSlugs,
         installed,
@@ -112,10 +145,89 @@ export async function buildMarketCatalog(filters) {
         remoteVersionBySlug,
     };
 }
-/** The package type of an entry — bundled templates are always `workspace`. */
+/**
+ * The human plural for a package kind, in the CLI's own listing.
+ *
+ * This was `t.charAt(0).toUpperCase() + t.slice(1)`, which `.claude/rules/
+ * vocabulary.md` forbids by name — and it showed: the listing printed "Cell"
+ * (the registry says **Card**) and "Workflow" (the registry says Automation).
+ *
+ * The real SSOT is `@synap-core/types/vocabulary`, but this package cannot
+ * resolve it — the CLI links only `@synap-core/workspace-templates`, and adding
+ * a cross-repo dependency is an install-topology change, not a labelling fix.
+ * So the table is local AND pinned: `test/kind-heading-vocabulary-parity.test.ts`
+ * source-scans the registry and fails if these words drift from it. That is the
+ * same shape as `market-install-kind-parity.test.ts`, which keeps
+ * `marketInstallKind` honest against the pod's zod enum across repos.
+ */
+const KIND_HEADINGS = {
+    capability: "Tools",
+    skill: "Tools",
+    // The CP publish vocabulary calls it `workflow`; the pod's install ledger
+    // (`GET /installed`) calls the same thing `automation`. Both tokens reach
+    // `kindHeading()` — `market --list` speaks CP, `market installed` speaks pod —
+    // so both are mapped, to the ONE plural the registry says.
+    workflow: "Rules",
+    automation: "Rules",
+    view: "Views",
+    cell: "Cards",
+    workspace: "Spaces",
+};
+/** Max width of the NAME column in `market installed` — see `displayName`. */
+const NAME_COL_MAX = 44;
+function kindHeading(kind) {
+    return KIND_HEADINGS[kind] ?? humanizeKindToken(kind);
+}
+/** Last resort for a kind the CP added and this CLI has not learned yet. */
+function humanizeKindToken(kind) {
+    const words = kind.replace(/[-_]+/g, " ").trim();
+    return words ? words[0].toUpperCase() + words.slice(1) : kind;
+}
+/**
+ * The package type of an entry — bundled templates are always `workspace`.
+ *
+ * ⚠️ The `?? "workspace"` default is safe for DISPLAY and FILTERING (a bundled
+ * template genuinely has no category). It is NOT safe for INSTALL: a package
+ * whose category is merely UNKNOWN would install as a workspace. That is not
+ * hypothetical — on 2026-09-05 `synap market install probe-card-pack`, a
+ * freshly published CELL package, created an empty "New Workspace" and reported
+ * "✓ Installed". Install paths must use {@link declaredCategoryOf} and refuse
+ * an unknown, never fall through to this default.
+ */
 function typeOf(entry) {
     return entry.category ?? "workspace";
 }
+/**
+ * The category the catalog ACTUALLY declared, or null when it said nothing.
+ *
+ * The distinction `typeOf` erases: "this is a workspace" and "I don't know what
+ * this is" are different facts, and only one of them may be acted on. Third
+ * instance in one day of a defaulted discriminator turning "I don't know" into
+ * a confident claim (`status ?? "installed"`, an absent `runResult.success`
+ * read as failure, and this).
+ */
+function declaredCategoryOf(entry) {
+    return entry.category ?? null;
+}
+/**
+ * The `kind` values the pod's `market.install` verb provisions.
+ *
+ * SSOT: the `kind` zod enum of `marketInstallParams` in
+ * `synap-backend/packages/api/src/services/capabilities/builtin-verbs.ts`
+ * (each arm implemented in `marketplace-install.ts`). This list is a
+ * hand-maintained copy — `test/market-install-kind.test.ts` pins it against a
+ * copy of that enum so a widening on the pod cannot silently leave the CLI
+ * refusing a kind the verb accepts (which is exactly how `view` and `skill`
+ * became uninstallable from the CLI).
+ */
+export const MARKET_INSTALL_KINDS = [
+    "capability",
+    "automation",
+    "template",
+    "cell",
+    "skill",
+    "view",
+];
 /**
  * Map a CP package `category` (what {@link typeOf} returns) → the pod
  * `market.install` verb's `kind` vocabulary, or `null` when the verb can't
@@ -137,10 +249,53 @@ export function marketInstallKind(type) {
             return "automation";
         case "template":
             return "template";
+        // The verb has always accepted these — the CLI returning null here is what
+        // made the published `view` packages uninstallable from the terminal.
+        case "skill":
+            return "skill";
+        case "view":
+            return "view";
         default:
             return null;
     }
 }
+/**
+ * Kinds whose `market.install` arm HARD-REQUIRES an acting workspace and 400s
+ * without one (`marketplace-install.ts`): an automation is added TO a workspace,
+ * and a view package needs a workspace to place its views in. Every other kind
+ * (capability / cell / skill) lands pod-wide — that branch is deliberate, so
+ * they must NOT be added here.
+ */
+export function marketInstallNeedsWorkspace(kind) {
+    return kind === "automation" || kind === "view";
+}
+/**
+ * Classify the PER-ITEM results of a kind:automation (workflow) install.
+ *
+ * The backend `market.install` automation case installs each automation under
+ * its own try/catch (per-item isolation), so the verb can report the overall
+ * install as `{status:"installed"}` while individual items are
+ * `{status:"error"}`. The CLI must inspect these before printing success — a
+ * bare "✓ Installed" is a lie when every item errored (the false-success bug).
+ *
+ * Returns null for any outcome that carries NO per-item array (cell, skill,
+ * workspace, …) so the caller falls through to the unchanged success line.
+ * Reads `automations[]` (the automation kind's field) or a generic `results[]`.
+ */
+export function summarizeItemInstall(installed) {
+    const raw = Array.isArray(installed.automations)
+        ? installed.automations
+        : Array.isArray(installed.results)
+            ? installed.results
+            : undefined;
+    if (!raw)
+        return null;
+    const items = raw;
+    const created = items.filter((i) => i.status === "created").length;
+    const reused = items.filter((i) => i.status === "reused").length;
+    const errored = items.filter((i) => i.status === "error");
+    return { created, reused, errored, okCount: created + reused };
+}
 /**
  * Client-side filter. The CP browse route filters REMOTE rows server-side, but
  * `assembleCatalog` always adds the BUNDLED (all-`workspace`) templates — so a
@@ -163,6 +318,17 @@ function matchesFilters(entry, filters) {
 function clip(s, n) {
     return s.length <= n ? s : s.slice(0, n - 1).trimEnd() + "…";
 }
+/**
+ * True when the pod reported a FAILED install layer.
+ *
+ * Reads `status` explicitly rather than inferring failure from the absence of a
+ * success marker: an unrecognised status is not a failure, and an absent
+ * `layers` array is not a success. Both are simply "not a reported failure",
+ * which is what the pre-existing `seedFailed` path already covers.
+ */
+export function hasLayerFailure(layers) {
+    return (layers ?? []).some((l) => l?.status === "failed");
+}
 /**
  * Print an honest per-dependency seed summary — no more silent "✓ ready" when
  * a dependency's capabilities/playbooks failed to seed. Prefers the top-level
@@ -170,6 +336,23 @@ function clip(s, n) {
  * back to re-deriving from the per-dependency `dependencies[]` array on older
  * pod builds. No-op when there's nothing to report.
  */
+/**
+ * Name the install layers the pod reported as FAILED.
+ *
+ * The verdict line already says "some capabilities failed"; without
+ * this the user is told something failed and never which thing — the same
+ * complaint that made `install-layers.ts` fall back from `name` to `key`.
+ * Silent when the pod sent no layers (an older pod) or none failed.
+ */
+export function printLayerOutcomes(layers) {
+    const failed = (layers ?? []).filter((l) => l?.status === "failed");
+    if (failed.length === 0)
+        return;
+    for (const l of failed) {
+        log.error(`${l.layer ?? "(unnamed layer)"} — ${l.message ?? "no detail reported"}`);
+    }
+    log.hint("The workspace itself was created. Re-run the install to retry the failed layer(s); nothing above is retried automatically.");
+}
 function printSeedOutcomes(dependencies, seedSummary) {
     if (seedSummary) {
         if (seedSummary.attempted === 0)
@@ -218,11 +401,61 @@ function hasSeedFailure(dependencies, seedSummary) {
  * not that the install was genuinely a no-op (the observed `market install
  * the-arch` → "already up to date" bug).
  */
-function detectStampContradiction(ws, seedSummary, remoteVersionSent, wasUnstamped) {
-    if (!remoteVersionSent || !wasUnstamped)
+function detectStampContradiction(ws, seedSummary, remoteVersionSent, wasUnstamped, stampVerified) {
+    if (!remoteVersionSent)
+        return false;
+    // GROUND TRUTH wins: a post-apply re-read of the workspace's stored stamp.
+    // `true` = it landed (never warn), `false` = reached the pod and it's still
+    // missing (warn — old pod, no stamp-on-reconcile). Only fall back to the
+    // proxy below when the re-read wasn't attempted/possible (`undefined`/`null`),
+    // because the proxy false-positives once the pod DOES stamp on an unchanged
+    // (content-identical) reconcile — `outcome` still comes back `"unchanged"`.
+    if (stampVerified === true)
+        return false;
+    if (stampVerified === false)
+        return true;
+    if (!wasUnstamped)
         return false;
     return ws?.outcome === "unchanged" || (ws?.outcome === undefined && seedSummary === undefined);
 }
+/**
+ * How far the pod says layer 2 got, read from the `/packages/apply` response
+ * (synap-backend `hub-protocol/rest/packages.ts`): a thrown layer 2 arrives as
+ * `layer2: {status: "failed"}`, an unconverged one as the `templateApply`
+ * record, and either way the pod's sentence as `templateApplyWarning`.
+ * `null` = the pod reported nothing unfinished (converged, or an older pod).
+ */
+export function podApplyState(res) {
+    const layer2 = res.layer2;
+    if (layer2?.status === "failed")
+        return "not-finished";
+    const record = res.templateApply;
+    if (record?.state === "awaiting-approval")
+        return "awaiting-approval";
+    if (record || heldVersionLine(res))
+        return "not-finished";
+    return null;
+}
+/**
+ * The verdict of one `/packages/apply` response — the ONE reader both
+ * `marketInstall` and `applyOnePackage` call. Layer 2's outcome comes from the
+ * pod's own state (`podApplyState`): an apply the pod says is unfinished is
+ * never "updated", and never a stamp contradiction (the pod held the version
+ * on purpose — redeploying fixes nothing).
+ */
+export function classifyApplyResponse(entry, res, ctx) {
+    const state = podApplyState(res);
+    if (state) {
+        const recorded = res.templateApply?.proposals;
+        const ids = Array.isArray(recorded) ? recorded.filter((p) => typeof p === "string") : [];
+        const next = heldVersionLine(res) ??
+            (state === "awaiting-approval"
+                ? `Approve its proposals (${proposalsDoor(ids) ?? "synap proposals"}), then run synap templates update ${entry.slug}.`
+                : `Run synap templates update ${entry.slug} to finish it.`);
+        return { status: state, warnings: [next] };
+    }
+    return classifyApplyResult(entry, res.workspace, res.dependencies, res.seedSummary, ctx);
+}
 /**
  * Classify one `/packages/apply` response into the honest verdict both
  * `marketInstall` and `applyOnePackage` print (and both put in `--json`).
@@ -232,8 +465,11 @@ function detectStampContradiction(ws, seedSummary, remoteVersionSent, wasUnstamp
  * already-versioned slugs, so it always passes `false`).
  */
 export function classifyApplyResult(entry, ws, dependencies, seedSummary, ctx) {
-    const seedFailed = hasSeedFailure(dependencies, seedSummary);
-    if (detectStampContradiction(ws, seedSummary, ctx.remoteVersionSent, ctx.wasUnstamped)) {
+    // A post-workspace LAYER failure counts the same as a seed failure: the
+    // workspace exists, but part of what the package promised did not land.
+    const seedFailed = hasSeedFailure(dependencies, seedSummary) || hasLayerFailure(ws?.layers);
+    if (!ctx.stampHeld &&
+        detectStampContradiction(ws, seedSummary, ctx.remoteVersionSent, ctx.wasUnstamped, ctx.stampVerified)) {
         return {
             status: "stamp-contradiction",
             warnings: [
@@ -248,8 +484,13 @@ export function classifyApplyResult(entry, ws, dependencies, seedSummary, ctx) {
     if (ws?.outcome === "unchanged")
         return { status: "unchanged", warnings: [] };
     if (ws?.status === "composed") {
+        // Honest: a compose-overlay has no standalone workspace — it merges INTO
+        // its base. But it IS updatable: `market update <slug>` re-sends the
+        // package, the pod re-resolves the base and re-layers the latest content
+        // (idempotent, additive). So this agrees with `market update` listing the
+        // slug as a normal updatable row — don't tell the user it "isn't updatable".
         const warnings = [
-            `${entry.name} is a compose-overlay — it rides its base workspace and isn't independently updatable; update the base workspace to update this too.`,
+            `${entry.name} is a compose-overlay — it layers onto its base workspace rather than creating its own. Pull its latest anytime with: synap market update ${entry.slug}`,
         ];
         return { status: seedFailed ? "composed-with-failures" : "composed", warnings };
     }
@@ -257,6 +498,25 @@ export function classifyApplyResult(entry, ws, dependencies, seedSummary, ctx) {
         return { status: "legacy-unknown", warnings: [] };
     return { status: "no-workspace", warnings: [] };
 }
+/** One plain line per deferred placement; `[]` when none (or an older pod). */
+export function deferredPlacementLines(res) {
+    const deferred = res.actionPlacements?.deferred;
+    if (!Array.isArray(deferred))
+        return [];
+    return deferred
+        .filter((d) => d && typeof d.proposalId === "string")
+        .map((d) => `The "${d.label ?? d.ref}" button appears once you approve proposal ${d.proposalId} (synap open proposal ${d.proposalId}), then run synap market update again.`);
+}
+/**
+ * Why the pod did NOT record the template version — the pod's ONE sentence
+ * (`templateApplyWarning` on the `/packages/apply` response, synap-backend
+ * `templateApplyWarning`): the same words `synap templates` keeps showing under
+ * the space. Printed verbatim; `null` when the version was recorded (or an
+ * older pod that does not say).
+ */
+export function heldVersionLine(res) {
+    return typeof res.templateApplyWarning === "string" ? res.templateApplyWarning : null;
+}
 /** Render a `classifyApplyResult` verdict — the ONE honest-text door for both `marketInstall` and `applyOnePackage`. */
 export function printApplyVerdict(entry, verdict) {
     switch (verdict.status) {
@@ -264,13 +524,13 @@ export function printApplyVerdict(entry, verdict) {
             log.success(`Installed ${entry.name}.`);
             return;
         case "installed-with-failures":
-            log.warn(`Installed ${entry.name} — completed with capability failures (see below).`);
+            log.warn(`Installed ${entry.name}, but ${templateStepPhrase("unfinished")}: some capabilities failed (see below).`);
             return;
         case "updated":
             log.success(`Updated ${entry.name}.`);
             return;
         case "updated-with-failures":
-            log.warn(`Updated ${entry.name} — completed with capability failures (see below).`);
+            log.warn(`Updated ${entry.name}, but ${templateStepPhrase("unfinished")}: some capabilities failed (see below).`);
             return;
         case "unchanged":
             log.info(`• ${entry.name} is already up to date.`);
@@ -280,7 +540,15 @@ export function printApplyVerdict(entry, verdict) {
             log.hint(verdict.warnings[0]);
             return;
         case "composed-with-failures":
-            log.warn(`${entry.name} — layered onto its base workspace, with capability failures (see below).`);
+            log.warn(`${entry.name} — layered onto its base workspace, but ${templateStepPhrase("unfinished")}: some capabilities failed (see below).`);
+            log.hint(verdict.warnings[0]);
+            return;
+        case "not-finished":
+            log.warn(`${entry.name} is in place, but ${templateStepPhrase("unfinished")}.`);
+            log.hint(verdict.warnings[0]);
+            return;
+        case "awaiting-approval":
+            log.info(`${entry.name} is in place; the rest waits on your approval.`);
             log.hint(verdict.warnings[0]);
             return;
         case "stamp-contradiction":
@@ -463,7 +731,7 @@ function renderCatalog(entries, cat) {
         }
         const types = [...byType.keys()].sort((a, b) => (order.indexOf(a) + 1 || 99) - (order.indexOf(b) + 1 || 99));
         for (const t of types) {
-            log.heading(`  ${t.charAt(0).toUpperCase() + t.slice(1)}`);
+            log.heading(`  ${kindHeading(t)}`);
             log.blank();
             for (const e of byType.get(t))
                 row(e);
@@ -578,7 +846,41 @@ export async function marketInstall(slug, opts) {
         log.hint("Browse what's available: synap market --list");
         process.exit(1);
     }
-    const type = typeOf(entry);
+    // Install must know what it is installing. `typeOf`'s display default would
+    // silently provision a WORKSPACE for anything the catalog could not classify
+    // — which is exactly how a published cell package became "New Workspace".
+    // Last chance before refusing: the catalog's `/mine` rows carry no category,
+    // and hydration there is bounded/best-effort. For THIS one slug we can ask
+    // the authed single-package door directly — the only door that can see a
+    // private package the caller owns. Still no defaulting: an unresolved
+    // category falls through to the refusal below.
+    let declared = declaredCategoryOf(entry);
+    if (!declared) {
+        const token = getStoredToken()?.token;
+        if (token) {
+            const rec = await fetchPackageRecord(slug, token);
+            declared = rec?.category ?? null;
+        }
+    }
+    if (!declared) {
+        log.error(`Can't install "${slug}": the catalog didn't say what kind of package it is.`);
+        log.hint("This usually means the package is PRIVATE and the public catalog can't see it. Run `synap login`, then retry — nothing was installed.");
+        process.exit(1);
+    }
+    const type = declared;
+    // `--dry-run` promises "writes nothing". Only the WORKSPACE path below can
+    // keep that promise: it has a write-free preflight (`/packages/preflight`).
+    // The `market.install` verb has no `dryRun` parameter (see
+    // `marketInstallParams` in the pod's `builtin-verbs.ts`), and `cap add`
+    // installs immediately — so for every other kind this flag used to be
+    // silently ignored and the package was INSTALLED FOR REAL. A safety flag that
+    // performs the action it promises to skip is worse than no flag, so refuse
+    // and say why rather than quietly doing the write.
+    if (opts.dryRun && type !== "workspace") {
+        log.error(`--dry-run isn't available for ${type} packages.`);
+        log.hint(`Only workspace packages have a write-free preflight. Nothing was installed. To install for real: synap market install ${slug}`);
+        process.exit(1);
+    }
     // A CAPABILITY installs through the SAME door as `cap add` — one code path, so
     // the two commands can never diverge. That door resolves the template by key
     // (so opt-in / syncByDefault:false caps like unipile-linkedin work — the
@@ -612,13 +914,36 @@ export async function marketInstall(slug, opts) {
             renderHubError(e);
             process.exit(1);
         }
+        // An `automation`/`workflow` install is added TO a workspace, and a `view`
+        // package needs a workspace to place its views in — the backend
+        // `market.install` verb hard-requires `workspaceId` for both
+        // (marketplace-install.ts) and 400s without it. Resolve it from the
+        // explicit `--workspace` flag, else the active lens (`synap use` / env),
+        // and fail with an actionable message rather than passing null downstream.
+        // Every OTHER kind (cell/capability/skill) lands pod-wide — leave
+        // workspaceId undefined so that deliberate pod-wide branch is preserved.
+        let workspaceId;
+        if (marketInstallNeedsWorkspace(kind)) {
+            workspaceId = opts.workspace ?? cfg.workspaceId;
+            if (!workspaceId) {
+                log.error(`Installing "${entry.name}" (a ${type}) needs an acting workspace to add it to.`);
+                log.hint("Pass one: synap market install " + slug + " --workspace <workspaceId>");
+                log.hint("Or set a default lens: synap use <workspace>   (see: synap orient)");
+                process.exit(1);
+            }
+        }
         const s = opts.json ? null : ora(`Installing ${entry.name}…`).start();
         let res;
         try {
-            // Pod-wide install: no workspaceId (a capability/cell/template lands on
-            // the pod). `market.install` is a WRITE builtin — an operator run
-            // owner-bypasses the gate and runs it in-process.
-            res = (await hubPost("/capabilities/execute", { verbId: "market.install", parameters: { slug, kind } }, cfg, applyTimeoutMs));
+            // Pod-wide install by default: no workspaceId (a capability/cell lands on
+            // the pod). An automation/workflow carries the resolved `workspaceId`
+            // (required — see above). `market.install` is a WRITE builtin — an
+            // operator run owner-bypasses the gate and runs it in-process.
+            res = (await hubPost("/capabilities/execute", {
+                verbId: "market.install",
+                parameters: { slug, kind },
+                ...(workspaceId ? { workspaceId } : {}),
+            }, cfg, applyTimeoutMs));
         }
         catch (e) {
             s?.stop();
@@ -641,18 +966,85 @@ export async function marketInstall(slug, opts) {
         }
         s?.stop();
         // The execute door wraps the verb's return as { status:"run", result: <MarketInstallOutcome> }.
-        // The outcome is { status:"installed", result } (operator) or { status:"proposed", proposalId, reviewUrl }.
+        //
+        // ⚠️ DO NOT default this to "installed". A governed install comes back as a
+        // PROPOSAL, and the envelope's discriminator is `kind` — not `status`
+        // (`execute-capability.ts`: `{ kind:"proposed", proposalId, reviewUrl,
+        // ackState:"proposed" }`). Some hops flatten that to `{ proposed:true, … }`.
+        // Either way `outcome.status` is undefined, so `?? "installed"` printed a
+        // green "✓ Installed" for a write that had NOT happened — found by
+        // dogfooding `synap market install task-views-pack` on a live pod
+        // 2026-09-05, which returned `outcome:"installed"` alongside
+        // `proposed:true`. This is the same defaulted-discriminator class as the
+        // `changeType ?? "update"` bug that once titled every capability run
+        // "Update Capability".
+        //
+        // So: read every honest marker, and when none is present say so rather than
+        // assuming success.
         const outcome = (res.result ?? res);
-        const status = String(outcome.status ?? "installed");
+        const isProposed = outcome.kind === "proposed" ||
+            outcome.status === "proposed" ||
+            outcome.ackState === "proposed" ||
+            outcome.proposed === true;
+        const status = isProposed
+            ? "proposed"
+            : outcome.status
+                ? String(outcome.status)
+                : outcome.ackState === "applied" || outcome.result !== undefined
+                    ? "installed"
+                    : "unknown";
         if (opts.json) {
             console.log(JSON.stringify({ slug, kind, outcome: status, result: outcome }, null, 2));
             return;
         }
         if (status === "proposed") {
             const proposalId = outcome.proposalId ? String(outcome.proposalId) : undefined;
-            log.info(`${entry.name} — proposed (under review, not live yet).`);
+            const reviewUrl = outcome.reviewUrl ? String(outcome.reviewUrl) : undefined;
+            log.info(`${entry.name} — proposed (under review, NOT installed yet).`);
             if (proposalId)
-                log.hint(`Approve: synap proposals approve ${proposalId}`);
+                log.hint(`Review and approve: synap open proposal ${proposalId}`);
+            if (reviewUrl)
+                log.hint(`Review: ${reviewUrl}`);
+            return;
+        }
+        if (status === "unknown") {
+            // The pod answered with a shape carrying no honest marker at all. Saying
+            // "installed" here is exactly the lie this block exists to prevent.
+            log.warn(`${entry.name} — the pod returned an unrecognised result; nothing is assumed installed. Check \`synap market installed\` before retrying.`);
+            return;
+        }
+        // A kind:automation (workflow) install returns PER-ITEM results with
+        // per-item isolation — each automation can be {status:"error"} while the
+        // verb overall still reports {status:"installed"} (marketplace-install.ts
+        // automation case). A bare "✓ Installed" here would lie when every item
+        // errored (0 automations created). Inspect the per-item array and report
+        // the real outcome: N created · N reused · N error, surfacing each error's
+        // message, and exit non-zero if NOTHING was created. Other kinds carry no
+        // such array — `summarizeItemInstall` returns null and we fall through to
+        // the unchanged success line.
+        const installed = (outcome.result ?? outcome);
+        const summary = summarizeItemInstall(installed);
+        if (summary) {
+            const { created, reused, errored, okCount } = summary;
+            const counts = `${created} created · ${reused} reused · ${errored.length} error`;
+            if (errored.length > 0) {
+                // Never print a bare success when any item failed.
+                if (okCount === 0) {
+                    log.error(`${entry.name} — install failed (${counts}).`);
+                }
+                else {
+                    log.warn(`${entry.name} — installed partially (${counts}).`);
+                }
+                for (const e of errored) {
+                    log.error(`${e.name ?? "(unnamed)"} — ${e.message ?? "unknown error"}`);
+                }
+                // Total failure (nothing created or reused) exits non-zero so scripts
+                // and users see the real outcome; a partial install stays exit 0.
+                if (okCount === 0)
+                    process.exit(1);
+                return;
+            }
+            log.success(`Installed ${entry.name} (${counts}).`);
             return;
         }
         log.success(`Installed ${entry.name}.`);
@@ -686,25 +1078,17 @@ export async function marketInstall(slug, opts) {
     // Build the install payload — bundled (offline, byte-identical to the CP
     // definition) when available, else the authed CP definition.
     const cpToken = getStoredToken()?.token;
-    let pkg;
-    if (cat.bundledSlugs.has(slug)) {
-        pkg = toPackageDefinition(slug);
-    }
-    else {
-        const def = await fetchPackageDefinition(slug, cpToken);
-        if (!def) {
-            log.error(`Couldn't fetch "${entry.name}"'s definition from the control plane.`);
-            log.hint(cat.loggedIn ? "" : "It may be private — try: synap login");
-            process.exit(1);
-        }
-        pkg = def;
+    // The definition + an HONEST version label (see `resolveInstallPayload`):
+    // the catalog version only rides on the catalog's own definition.
+    const payload = await resolveInstallPayload(slug, cat, cpToken);
+    if (!payload) {
+        log.error(`Couldn't fetch "${entry.name}"'s definition from the control plane.`);
+        log.hint(cat.loggedIn ? "" : "It may be private — try: synap login");
+        process.exit(1);
     }
-    // Stamp the version the catalog resolved for this slug — including the
-    // authed `/mine` version for private templates — so the pod records the
-    // installed baseline and later `market update` drift checks work.
-    const remoteVersion = cat.remoteVersionBySlug.get(slug);
-    if (remoteVersion)
-        pkg._meta = { ...(pkg._meta ?? {}), version: remoteVersion };
+    const pkg = payload.pkg;
+    // Only a catalog-sourced install can predict the stamp the pod will record.
+    const remoteVersion = payload.catalogVersion;
     // ── --dry-run: write-free preflight of the CREATE path. ───────────────────
     // Runs the pod's REAL resolver (write-free) so a template author sees
     // profileKind conflicts and other resolution failures BEFORE installing.
@@ -749,18 +1133,27 @@ export async function marketInstall(slug, opts) {
             }
             log.info(`${entry.name} — proposed (under review, not live yet).`);
             if (proposalId)
-                log.hint(`Approve: synap proposals approve ${proposalId}`);
+                log.hint(`Review and approve: synap open proposal ${proposalId}`);
             renderNextSteps(steps);
             return;
         }
         const ws = res.workspace;
         const dependencies = res.dependencies;
         const seedSummary = res.seedSummary;
+        // GROUND TRUTH: re-read the workspace's actual stored stamp instead of
+        // guessing "did it stamp?" from the apply-response `outcome` (which reads
+        // "unchanged" on a content-identical reconcile even when the stamp DID
+        // land). Only worth a call when we sent a version and know the workspace.
+        let stampVerified;
+        if (remoteVersion && ws?.workspaceId) {
+            stampVerified = await verifyStampLanded(ws.workspaceId, remoteVersion, cfg);
+        }
         const steps = FLOW.afterMarketInstall({ slug, proposed: false, projectName });
         s?.stop();
-        const verdict = classifyApplyResult(entry, ws, dependencies, seedSummary, {
+        const verdict = classifyApplyResponse(entry, res, {
             remoteVersionSent: remoteVersion,
             wasUnstamped,
+            stampVerified,
         });
         if (opts.json) {
             console.log(JSON.stringify({
@@ -789,7 +1182,7 @@ export async function marketInstall(slug, opts) {
                     break;
                 case "installed-with-failures":
                 case "updated-with-failures":
-                    log.warn(`Reconciled ${entry.name} onto ${wsLabel} — completed with capability failures (see below).`);
+                    log.warn(`Reconciled ${entry.name} onto ${wsLabel}, but ${templateStepPhrase("unfinished")}: some capabilities failed (see below).`);
                     break;
                 case "unchanged":
                     log.info(`• ${entry.name} is already up to date on ${wsLabel}.`);
@@ -802,6 +1195,9 @@ export async function marketInstall(slug, opts) {
             printApplyVerdict(entry, verdict);
         }
         printSeedOutcomes(dependencies, seedSummary);
+        printLayerOutcomes(ws?.layers);
+        for (const line of deferredPlacementLines(res))
+            log.info(line);
         if (ws?.outcome || ws?.status === "composed" || ws?.status === "created")
             renderNextSteps(steps);
     }
@@ -813,18 +1209,103 @@ export async function marketInstall(slug, opts) {
     }
 }
 /**
- * Per-installed-slug drift check. Starts from the shared `computeTemplateUpdates`
- * (handles bundled-only / private-only slugs via `bundleVersion`), then
- * overrides `latestVersion`/`updateAvailable` with the CP row's OWN version for
- * any slug in `remoteVersionBySlug` — the merge-winner bypass this command
- * needs (see `MarketCatalog.remoteVersionBySlug`'s doc). A slug the pod never
- * version-stamped is reported `noVersionInfo: true`, never silently "outdated".
+ * Pick the install definition through the SAME winner rule the catalog uses
+ * (`mergeCatalog`: an official CP row wins over this CLI's frozen bundle only
+ * when its `definition.sourcePackage.version` is strictly newer), and label it
+ * honestly: a catalog definition carries the catalog version; a bundled one
+ * carries the bundle's own package version (`bundle@x.y.z`), never the
+ * catalog's. The pod re-derives the stamp from what it applied either way.
+ *
+ * Returns `null` only for a non-bundled slug whose definition could not be
+ * fetched (the caller reports it). A failed fetch for a BUNDLED slug falls back
+ * to the bundle — the documented offline path — labelled as the bundle.
+ */
+export async function resolveInstallPayload(slug, cat, cpToken) {
+    const catalogVersion = cat.remoteVersionBySlug.get(slug);
+    if (!cat.bundledSlugs.has(slug)) {
+        const def = await fetchPackageDefinition(slug, cpToken);
+        if (!def)
+            return null;
+        return { pkg: stampVersion(def, slug, catalogVersion), from: "catalog", catalogVersion };
+    }
+    if (catalogVersion && cat.reachedCp) {
+        const def = await fetchPackageDefinition(slug, cpToken).catch(() => null);
+        const tpl = getWorkspaceTemplate(slug);
+        if (def && tpl) {
+            const winner = mergeCatalog({
+                bundled: [tpl],
+                remote: [{ slug, name: slug, definition: def }],
+                bundleVersion: bundledTemplatesVersion(),
+            }).entries.find((e) => e.slug === slug);
+            if (winner?.source === "remote") {
+                return { pkg: stampVersion(def, slug, catalogVersion), from: "catalog", catalogVersion };
+            }
+        }
+    }
+    const bundleVersion = bundledTemplatesVersion();
+    const pkg = toPackageDefinition(slug);
+    return { pkg: stampVersion(pkg, slug, bundleVersion ? `bundle@${bundleVersion}` : undefined), from: "bundle" };
+}
+/**
+ * Label the payload with the slug it was resolved for and the version it came
+ * from. The SLUG is load-bearing: the pod keys "which existing workspace is
+ * this?" on `body._meta.slug`. The CP now stamps `_meta.slug` on every stored
+ * and served definition (`synap-control-plane-api` `seeds/template-identity.ts`),
+ * and the bundle's `toPackageDefinition` carries it too; setting it here keeps
+ * it true against a CP that predates the stamp. Without it a governed apply's
+ * approval matched nothing and CREATED a second "Content OS" (2026-10-06)
+ * instead of updating.
+ */
+function stampVersion(pkg, slug, version) {
+    const meta = pkg._meta ?? {};
+    return { ...pkg, _meta: { ...meta, slug, ...(version ? { version } : {}) } };
+}
+export function updateDoorFor(kind) {
+    switch (kind ?? "workspace") {
+        case "workspace":
+            return "packages-apply";
+        case "view":
+        case "skill":
+        case "automation":
+            return "configs-reconcile";
+        default:
+            return null;
+    }
+}
+/**
+ * Per-installed-slug drift check. SERVER-FIRST: when the pod runs the
+ * server-side TemplateHealth code (Hub `/workspaces` returns `drifted`/
+ * `latestVersion`), that verdict wins — the CLI stops re-deriving drift, so it
+ * can't disagree with the pod (or the browser, which reads the same authority).
+ *
+ * FALLBACK (older pod, `drifted === undefined`): the legacy client derivation —
+ * the shared `computeTemplateUpdates` (handles bundled-only / private-only slugs
+ * via `bundleVersion`), then override `latestVersion`/`updateAvailable` with the
+ * CP row's OWN version for any slug in `remoteVersionBySlug` (the merge-winner
+ * bypass). A slug the pod never version-stamped is `noVersionInfo: true`, never
+ * silently "outdated".
  */
 export function computeUpdates(installedTemplates, cat) {
-    const withVersion = installedTemplates.filter((t) => !!t.version);
-    const base = computeTemplateUpdates(withVersion.map((t) => ({ slug: t.slug, version: t.version })), cat.entries, bundledTemplatesVersion());
+    // Only the fallback path needs the client-derived base — compute it for the
+    // slugs the server didn't answer for, so a fully-modern pod does no extra work.
+    const needsFallback = installedTemplates.filter((t) => t.drifted === undefined && !!t.version);
+    const base = needsFallback.length
+        ? computeTemplateUpdates(needsFallback.map((t) => ({ slug: t.slug, version: t.version })), cat.entries, bundledTemplatesVersion())
+        : [];
     const baseBySlug = new Map(base.map((b) => [b.slug, b]));
     return installedTemplates.map((t) => {
+        // ── Server-side TemplateHealth wins ──
+        if (t.drifted !== undefined) {
+            return {
+                slug: t.slug,
+                installedVersion: t.version ?? "",
+                latestVersion: t.latestVersion ?? undefined,
+                updateAvailable: t.drifted,
+                noVersionInfo: !t.version,
+                kind: t.kind,
+            };
+        }
+        // ── Client fallback (older pod) ──
         if (!t.version) {
             return {
                 slug: t.slug,
@@ -832,6 +1313,7 @@ export function computeUpdates(installedTemplates, cat) {
                 latestVersion: cat.remoteVersionBySlug.get(t.slug),
                 updateAvailable: false,
                 noVersionInfo: true,
+                kind: t.kind,
             };
         }
         const b = baseBySlug.get(t.slug);
@@ -842,18 +1324,24 @@ export function computeUpdates(installedTemplates, cat) {
                 latestVersion: remoteVersion,
                 updateAvailable: remoteVersion !== t.version,
                 noVersionInfo: false,
+                kind: t.kind,
             };
         }
-        return { ...b, noVersionInfo: false };
+        return { ...b, noVersionInfo: false, kind: t.kind };
     });
 }
+/** First check per slug, order preserved — an update is applied per PACKAGE, not per installed object. */
+export function dedupeBySlug(checks) {
+    const seen = new Set();
+    return checks.filter((c) => (seen.has(c.slug) ? false : (seen.add(c.slug), true)));
+}
 /**
  * Apply one package via the SAME door `marketInstall` uses
  * (`POST /packages/apply`) — for an already-installed slug this re-runs the
  * pod's idempotent-create path, which reconciles when the pod build supports
  * it (see the `applyOnePackage` caveat below for what "created" means here).
  */
-async function applyOnePackage(entry, cat, cfg, opts, applyTimeoutMs = APPLY_TIMEOUT_MS) {
+async function applyOnePackage(entry, cat, cfg, opts, applyTimeoutMs = APPLY_TIMEOUT_MS, extra = {}) {
     if (cat.lockedSlugs.has(entry.slug)) {
         const tier = cat.tierBySlug.get(entry.slug)?.requiredTier;
         if (!opts.json)
@@ -861,27 +1349,19 @@ async function applyOnePackage(entry, cat, cfg, opts, applyTimeoutMs = APPLY_TIM
         return { slug: entry.slug, outcome: "locked", status: "locked", warnings: [] };
     }
     const cpToken = getStoredToken()?.token;
-    let pkg;
-    if (cat.bundledSlugs.has(entry.slug)) {
-        pkg = toPackageDefinition(entry.slug);
-    }
-    else {
-        const def = await fetchPackageDefinition(entry.slug, cpToken);
-        if (!def) {
-            if (!opts.json) {
-                log.error(`Couldn't fetch "${entry.name}"'s definition from the control plane.`);
-                if (!cat.loggedIn)
-                    log.hint("It may be private — try: synap login");
-            }
-            return { slug: entry.slug, outcome: "fetch-failed", status: "fetch-failed", warnings: [] };
+    // Same honest payload as `marketInstall` (see `resolveInstallPayload`).
+    const payload = extra.payload !== undefined ? extra.payload : await resolveInstallPayload(entry.slug, cat, cpToken);
+    if (!payload) {
+        if (!opts.json) {
+            log.error(`Couldn't fetch "${entry.name}"'s definition from the control plane.`);
+            if (!cat.loggedIn)
+                log.hint("It may be private — try: synap login");
         }
-        pkg = def;
+        return { slug: entry.slug, outcome: "fetch-failed", status: "fetch-failed", warnings: [] };
     }
-    // Same version stamp as `marketInstall` — needed for private templates too,
-    // since `applyOnePackage` re-runs the apply door on every update.
-    const remoteVersion = cat.remoteVersionBySlug.get(entry.slug);
-    if (remoteVersion)
-        pkg._meta = { ...(pkg._meta ?? {}), version: remoteVersion };
+    const pkg = extra.acceptDataChanges && extra.acceptDataChanges.length > 0
+        ? { ...payload.pkg, acceptDataChanges: extra.acceptDataChanges }
+        : payload.pkg;
     const s = opts.json ? null : ora(`Updating ${entry.name}…`).start();
     try {
         const res = (await hubPost("/packages/apply", pkg, cfg, applyTimeoutMs));
@@ -891,7 +1371,7 @@ async function applyOnePackage(entry, cat, cfg, opts, applyTimeoutMs = APPLY_TIM
             if (!opts.json) {
                 log.info(`${entry.name} — update proposed (under review, not live yet).`);
                 if (proposalId)
-                    log.hint(`Approve: synap proposals approve ${proposalId}`);
+                    log.hint(`Review and approve: synap open proposal ${proposalId}`);
             }
             return { slug: entry.slug, outcome: "proposed", status: "proposed", warnings: [] };
         }
@@ -903,13 +1383,16 @@ async function applyOnePackage(entry, cat, cfg, opts, applyTimeoutMs = APPLY_TIM
         // which by construction means it already carried a recorded version. The
         // stamp-contradiction check is therefore a no-op here by design; it's
         // `marketInstall`'s job to catch it on a first-time/unstamped install.
-        const verdict = classifyApplyResult(entry, ws, dependencies, seedSummary, {
-            remoteVersionSent: remoteVersion,
+        const verdict = classifyApplyResponse(entry, res, {
+            remoteVersionSent: payload.catalogVersion,
             wasUnstamped: false,
         });
         if (!opts.json) {
             printApplyVerdict(entry, verdict);
             printSeedOutcomes(dependencies, seedSummary);
+            printLayerOutcomes(ws?.layers);
+            for (const line of deferredPlacementLines(res))
+                log.info(line);
         }
         return {
             slug: entry.slug,
@@ -922,10 +1405,33 @@ async function applyOnePackage(entry, cat, cfg, opts, applyTimeoutMs = APPLY_TIM
     }
     catch (e) {
         s?.stop();
+        // The pod refused: data changes are owed that the person has not agreed to.
+        // Nothing was written. Show the list and the exact command that agrees.
+        const owed = dataChangesFromRefusal(e);
+        if (owed) {
+            if (!opts.json) {
+                const said = consentRefusalLines(entry.name, entry.slug, owed, consentNeedsPerson(e));
+                log.warn(said.warn);
+                printDataChanges(entry.slug, owed);
+                for (const hint of said.hints)
+                    log.hint(hint);
+            }
+            return {
+                slug: entry.slug,
+                outcome: "needs-consent",
+                status: "needs-consent",
+                warnings: [],
+                pendingDataChanges: owed,
+            };
+        }
         const timedOut = e instanceof HubNetworkError && e.code === "TIMEOUT";
+        const refusal = dataChangeRefusalMessage(e);
         if (!opts.json) {
             log.error(`${entry.name} update failed`);
-            renderHubError(e);
+            if (refusal)
+                log.warn(refusal);
+            else
+                renderHubError(e);
         }
         return {
             slug: entry.slug,
@@ -936,19 +1442,120 @@ async function applyOnePackage(entry, cat, cfg, opts, applyTimeoutMs = APPLY_TIM
         };
     }
 }
+/**
+ * Ask the pod's write-free preview door (`POST /packages/preflight`, the same
+ * body `/packages/apply` takes) which data changes an update would run.
+ */
+async function previewDataChanges(entry, cat, cfg) {
+    const payload = await resolveInstallPayload(entry.slug, cat, getStoredToken()?.token).catch(() => null);
+    if (!payload)
+        return { payload: null, error: "its definition couldn't be fetched" };
+    try {
+        const res = await hubPost("/packages/preflight", payload.pkg, cfg);
+        return { payload, changes: parseDataChanges(res) };
+    }
+    catch (e) {
+        const status = e instanceof HubError ? `HTTP ${e.status}` : e instanceof Error ? e.message : String(e);
+        return { payload, error: `the pod's preview failed: ${status}` };
+    }
+}
+/** One slug's outcome out of the shared pod-wide config reconcile. */
+async function reconcileOutcome(c, report, opts) {
+    let r;
+    try {
+        r = await report;
+    }
+    catch (e) {
+        if (!opts.json) {
+            log.error(`${c.slug} update failed`);
+            renderHubError(e);
+        }
+        return { slug: c.slug, outcome: "failed", status: "failed", warnings: [], error: e instanceof Error ? e.message : String(e) };
+    }
+    // A report this CLI cannot read is a FAILED read — never "up to date".
+    const lists = [r?.updated, r?.ownerOwnedSkipped, r?.skipped, r?.conflicts];
+    if (!lists.some(Array.isArray) || lists.some((l) => l !== undefined && !Array.isArray(l))) {
+        const error = "the pod's reconcile answered with a report this CLI can't read — not assuming it updated";
+        if (!opts.json)
+            log.error(`${c.slug} — ${error}`);
+        return { slug: c.slug, outcome: "failed", status: "failed", warnings: [], error };
+    }
+    const mine = (rows) => (rows ?? []).filter((e) => e.packageSlug === c.slug);
+    const conflicts = mine(r.conflicts);
+    const owned = mine(r.ownerOwnedSkipped);
+    const updated = mine(r.updated);
+    const warnings = owned.map((e) => `${e.name}: kept your edits — ${e.reason}`);
+    if (conflicts.length > 0) {
+        const error = conflicts.map((e) => `${e.name}: ${e.reason}`).join("; ");
+        if (!opts.json)
+            log.error(`${c.slug} update failed — ${error}`);
+        return { slug: c.slug, outcome: "failed", status: updated.length > 0 ? "updated-with-failures" : "failed", warnings, error };
+    }
+    if (!opts.json)
+        for (const w of warnings)
+            log.warn(`${c.slug} — ${w}`);
+    if (updated.length > 0 || owned.length > 0) {
+        // Every field it could advance did; a field you edited stays yours (warned above).
+        const status = updated.length > 0 ? "updated" : "unchanged";
+        if (!opts.json)
+            log.success(`${c.slug} — ${status}`);
+        return { slug: c.slug, outcome: status, status, warnings };
+    }
+    // Skipped (cache miss, unresolved definition…) or not reported at all: NOT updated — never "current".
+    const error = mine(r.skipped).map((e) => `${e.name}: ${e.reason}`).join("; ") || "the pod's reconcile did not report this package";
+    if (!opts.json)
+        log.warn(`${c.slug} was not updated — ${error}`);
+    return { slug: c.slug, outcome: "not-updated", status: "not-updated", warnings, error };
+}
 export async function marketUpdate(slugsArg, opts) {
     const applyTimeoutMs = parseApplyTimeoutMs(opts.timeout);
-    const [installedTemplates, cat] = await Promise.all([fetchInstalledTemplates(), buildMarketCatalog()]);
+    // STRICT fetch: distinguish "pod unreachable" (transient — don't claim the
+    // pod is empty, that reads as data loss) from "genuinely nothing installed".
+    const cat = await buildMarketCatalog();
+    let installedTemplates;
+    // Whether the pod answered from the ONE read door (`GET /installed`, all six
+    // kinds) or is old enough that only workspace packages were visible. An old
+    // pod is not an empty pod — say which, rather than letting a narrower list
+    // read as the whole truth.
+    let degraded = false;
+    try {
+        const inv = await fetchInstalledInventoryStrict();
+        installedTemplates = installedRowsToTemplates(inv.rows);
+        degraded = inv.degraded;
+    }
+    catch (e) {
+        // Unreachable ≠ success — a script checking `$?` (or `&&`-chaining) must see
+        // failure, not exit 0, even though the JSON payload also carries the reason.
+        process.exitCode = 1;
+        if (opts.json) {
+            console.log(JSON.stringify({ checks: [], loggedIn: cat.loggedIn, error: "pod-unreachable" }, null, 2));
+            return;
+        }
+        log.error("Couldn't reach your pod to read what's installed — not saying it's empty.");
+        renderHubError(e);
+        log.hint("Check the pod is up / you're on the right --pod, then retry.");
+        return;
+    }
+    const degradedNote = degraded
+        ? "This pod does not serve GET /api/hub/installed — only workspace packages were checked. Capability / view / skill / automation / card installs were NOT (upgrade the pod to include them)."
+        : undefined;
     if (installedTemplates.length === 0) {
         if (opts.json) {
-            console.log(JSON.stringify({ checks: [], loggedIn: cat.loggedIn }, null, 2));
+            console.log(JSON.stringify({ checks: [], loggedIn: cat.loggedIn, degraded, ...(degradedNote ? { degradedNote } : {}) }, null, 2));
             return;
         }
         log.warn("No installed packages found on this pod.");
+        if (degradedNote)
+            log.dim(degradedNote);
         log.hint("Install one: synap market install <slug>");
         return;
     }
-    let checks = computeUpdates(installedTemplates, cat);
+    // ONE ROW PER SLUG. `GET /installed` reports one row per installed OBJECT —
+    // a views pack that installed four views is four rows — and an update is
+    // applied per PACKAGE, not per object. Without this the preview listed
+    // `task-views-pack` four times and the "N up to date" tally counted it four
+    // times. `market installed` has always deduped the same way.
+    let checks = dedupeBySlug(computeUpdates(installedTemplates, cat));
     const entryBySlug = new Map(cat.entries.map((e) => [e.slug, e]));
     const explicitSlugs = !!slugsArg && slugsArg.length > 0;
     let unknownSlugs = [];
@@ -970,7 +1577,26 @@ export async function marketUpdate(slugsArg, opts) {
         }
         checks = checks.filter((c) => validSlugs.includes(c.slug));
     }
-    const withUpdates = checks.filter((c) => c.updateAvailable);
+    // ── Template lifecycle (retired / unlisted / unknown) ──
+    // Read from the pod's template health (Hub `/workspaces`). A FAILED read is
+    // said out loud and never folded into "every template is current".
+    const lifecycleBySlug = new Map();
+    let lifecycleReadFailed = false;
+    try {
+        for (const a of await fetchWorkspaceAttachmentsStrict(await resolveHubConfig(opts))) {
+            if (a.packageSlug && a.lifecycle && !lifecycleBySlug.has(a.packageSlug))
+                lifecycleBySlug.set(a.packageSlug, a.lifecycle);
+        }
+    }
+    catch {
+        lifecycleReadFailed = true;
+    }
+    const leaving = checks
+        .map((c) => ({ slug: c.slug, info: lifecycleBySlug.get(c.slug) }))
+        .filter((r) => !!r.info && r.info.lifecycle !== "current");
+    const retiredSlugs = new Set(leaving.filter((r) => r.info.lifecycle === "retired").map((r) => r.slug));
+    // A retired template is never re-applied: its data moves to the replacement instead.
+    const withUpdates = checks.filter((c) => c.updateAvailable && !retiredSlugs.has(c.slug));
     const noVersionInfo = checks.filter((c) => c.noVersionInfo);
     // Private templates resolve only via the authed CP path — an update check
     // that found NOTHING while logged out is ambiguous (could be genuinely
@@ -980,24 +1606,86 @@ export async function marketUpdate(slugsArg, opts) {
         log.dim("Not logged in — private template updates aren't visible. Run: synap login");
     }
     // --dry-run is a NAMED alias for the "no --yes" preview path — forces the
-    // preview even when --yes or explicit slugs would otherwise trigger apply.
-    const shouldApply = !opts.dryRun && (explicitSlugs || opts.yes);
+    // preview even when --yes / `all` or explicit slugs would otherwise trigger apply.
+    const shouldApply = !opts.dryRun && (explicitSlugs || opts.yes || opts.all);
+    // ── Data changes each update would run (contract C) ──
+    // Asked of the pod's write-free preview door BEFORE anything is shown, so the
+    // person reads what will happen to their data before the template diff.
+    let cfg;
+    const previews = new Map();
+    if (withUpdates.length > 0) {
+        try {
+            cfg = await resolveHubConfig(opts);
+        }
+        catch (e) {
+            renderHubError(e);
+            process.exit(1);
+        }
+        for (const c of withUpdates) {
+            // The data-change preview is the workspace door's (`/packages/preflight`).
+            if (updateDoorFor(c.kind) !== "packages-apply")
+                continue;
+            const entry = entryBySlug.get(c.slug);
+            if (entry)
+                previews.set(c.slug, await previewDataChanges(entry, cat, cfg));
+        }
+    }
     if (!opts.json) {
+        const withChanges = withUpdates.filter((c) => (previews.get(c.slug)?.changes?.length ?? 0) > 0);
+        if (withChanges.length > 0) {
+            log.heading("  Data changes");
+            log.blank();
+            for (const c of withChanges)
+                printDataChanges(c.slug, previews.get(c.slug).changes);
+            log.blank();
+        }
+        const unread = withUpdates.filter((c) => previews.get(c.slug)?.error);
+        for (const c of unread) {
+            log.warn(`Couldn't check ${c.slug} for data changes (${previews.get(c.slug).error}). The pod still refuses an update whose data changes you have not agreed to.`);
+        }
+        if (leaving.length > 0) {
+            log.heading("  Catalog status");
+            log.blank();
+            for (const r of leaving) {
+                const n = lifecycleNotice(r.slug, r.info);
+                const tone = r.info.lifecycle === "unknown" ? chalk.dim : chalk.yellow;
+                console.log("    " + tone(`⚠ ${n.label}`));
+                // The pod's warning already carries the reason; print it only on the fallback wording.
+                if (r.info.retiredReason && !r.info.warning)
+                    console.log("      " + chalk.dim(r.info.retiredReason));
+                if (n.action)
+                    console.log("      " + chalk.dim(`Move its data: ${n.action}`));
+            }
+            log.blank();
+        }
+        if (lifecycleReadFailed) {
+            log.dim("Couldn't read which templates are retired from the pod — retired templates are not flagged above.");
+        }
         log.heading("  Installed packages");
         log.blank();
         for (const c of checks) {
-            const label = c.noVersionInfo
-                ? noVersionLabel(entryBySlug.get(c.slug)?.isPrivate ?? false, cat.loggedIn)
-                : c.updateAvailable
-                    ? chalk.yellow(`update available  `) + chalk.dim(c.installedVersion) + " → " + c.latestVersion
-                    : chalk.green("up to date");
+            // ONE label door. This was a hand-rolled second copy that diverged from
+            // `installedStatusLabel` in two ways that both LIED: it had no cache-cold
+            // branch (so a pod with no catalog version to compare against printed a
+            // green "up to date" nothing had verified) and no hash-version branch (so
+            // a content change read as "update available").
+            // A retired template is not "behind": its next step is the move, said above.
+            const label = retiredSlugs.has(c.slug)
+                ? chalk.yellow("retired") + chalk.dim(` · synap templates retire ${c.slug}`)
+                : installedStatusLabel(c, entryBySlug.get(c.slug)?.isPrivate ?? false, cat.loggedIn);
             console.log("    " + chalk.cyan(c.slug.padEnd(28)) + label);
         }
         log.blank();
         if (noVersionInfo.length > 0) {
             log.dim(`${noVersionInfo.length} installed without a version stamp — can't check ${noVersionInfo.length === 1 ? "it" : "them"} for updates.`);
         }
+        if (degradedNote)
+            log.dim(degradedNote);
     }
+    // What the JSON carries for the new facts: per slug, the pod's data changes
+    // (`null` = this pod sent none: an older pod) and the template lifecycle.
+    const dataChangesJson = Object.fromEntries([...previews].map(([slug, pv]) => [slug, pv.error ? { error: pv.error } : pv.changes ?? null]));
+    const lifecycleJson = Object.fromEntries(leaving.map((r) => [r.slug, r.info]));
     if (withUpdates.length === 0) {
         // "Nothing to update" is only honest when every installed row was
         // actually CHECKED. Rows the pod can't version-check are "couldn't be
@@ -1011,6 +1699,7 @@ export async function marketUpdate(slugsArg, opts) {
                 applied: [],
                 status: noVersionInfo.length > 0 ? "partial" : "clean",
                 uncheckable: noVersionInfo.map((c) => c.slug),
+                templateLifecycle: lifecycleJson,
             }, null, 2));
         }
         else if (noVersionInfo.length > 0) {
@@ -1019,44 +1708,118 @@ export async function marketUpdate(slugsArg, opts) {
                 chalk.yellow(`⚠ ${upToDate} up to date · ${noVersionInfo.length} couldn't be checked`));
             log.hint("Run 'synap market installed' for why — unstamped install (reinstall to fix) or a private template while logged out (synap login).");
         }
+        else if (leaving.length > 0) {
+            log.info("No updates to apply.");
+        }
         else {
             log.success("Nothing to update.");
+            // `market update` only checks TEMPLATE-ATTACHED workspaces — a hand-built
+            // one (no packageSlug) can't be "behind" a template, so it's silently
+            // absent here. Point at the fuller home so "nothing to update" never reads
+            // as "nothing to do" when an unattached workspace is waiting to be linked.
+            log.hint("See every workspace's template status (incl. unattached): synap templates");
         }
         return;
     }
     if (!shouldApply) {
         const steps = FLOW.afterMarketUpdateCheck(withUpdates.map((c) => c.slug));
         if (opts.json) {
-            console.log(JSON.stringify({ checks, loggedIn: cat.loggedIn, unknownSlugs, applied: [], nextSteps: steps }, null, 2));
+            console.log(JSON.stringify({
+                checks,
+                loggedIn: cat.loggedIn,
+                unknownSlugs,
+                applied: [],
+                nextSteps: steps,
+                dataChanges: dataChangesJson,
+                templateLifecycle: lifecycleJson,
+            }, null, 2));
             return;
         }
         log.info(`${withUpdates.length} package${withUpdates.length === 1 ? "" : "s"} have updates.`);
+        if ([...previews.values()].some((pv) => (pv.changes?.length ?? 0) > 0)) {
+            log.hint("Updates with data changes ask before they run. To agree up front: --accept-data-changes <opKey,…>  (or --yes for all listed)");
+        }
         renderNextSteps(steps);
         return;
     }
-    let cfg;
-    try {
-        cfg = await resolveHubConfig(opts);
-    }
-    catch (e) {
-        renderHubError(e);
-        process.exit(1);
-    }
+    const acceptList = parseAcceptList(opts.acceptDataChanges);
     const results = [];
+    // One pod-wide reconcile serves every view/skill/automation update — run it
+    // at most once, lazily, and read each slug's outcome from its report.
+    let configsReport;
     for (const c of withUpdates) {
-        const entry = cat.entries.find((e) => e.slug === c.slug);
+        const door = updateDoorFor(c.kind);
+        if (door === null) {
+            if (!opts.json)
+                log.warn(`${c.slug} is a ${c.kind} — the pod has no per-package update for this kind, so it was not updated. Nothing was written.`);
+            results.push({ slug: c.slug, outcome: "no-updater", status: "no-updater", warnings: [] });
+            continue;
+        }
+        if (door === "configs-reconcile") {
+            configsReport ??= hubPost("/configs/reconcile", {}, cfg, applyTimeoutMs);
+            results.push(await reconcileOutcome(c, configsReport, { json: opts.json }));
+            continue;
+        }
+        const entry = entryBySlug.get(c.slug);
         if (!entry) {
+            // Absent from the catalog THIS CLI read — not proof it left the catalog
+            // (that is the pod's `unlisted`, shown above, and only after a complete sync).
             if (!opts.json)
-                log.warn(`"${c.slug}" is no longer in the catalog — skipping.`);
+                log.warn(`Couldn't find "${c.slug}" in the catalog read just now — skipping.`);
             results.push({ slug: c.slug, outcome: "not-in-catalog", status: "not-in-catalog", warnings: [] });
             continue;
         }
-        results.push(await applyOnePackage(entry, cat, cfg, { json: opts.json }, applyTimeoutMs));
+        const pv = previews.get(c.slug);
+        const pending = pv?.changes ?? [];
+        let accepted = [];
+        if (pending.length > 0) {
+            const decision = decideConsent(pending, { yes: opts.yes, acceptList });
+            accepted = decision.accepted;
+            let missing = decision.missing;
+            if (decision.refusedOperatorSteps.length > 0 && !opts.json) {
+                log.warn(`Not agreed here: ${decision.refusedOperatorSteps.join(", ")} retire${decision.refusedOperatorSteps.length === 1 ? "s" : ""} old data, so an operator runs ${decision.refusedOperatorSteps.length === 1 ? "it" : "them"} (see Operator steps above).`);
+            }
+            if (missing.length > 0 && !opts.json && process.stdin.isTTY) {
+                const answer = await prompts({
+                    type: "confirm",
+                    name: "ok",
+                    message: `Run ${missing.length === 1 ? "this data change" : `these ${missing.length} data changes`} with the ${c.slug} update? (${missing.map((d) => d.opKey).join(", ")})`,
+                    initial: false,
+                });
+                if (answer.ok === true) {
+                    accepted = [...accepted, ...missing.map((d) => d.opKey)];
+                    missing = [];
+                }
+            }
+            if (missing.length > 0) {
+                if (!opts.json) {
+                    log.warn(`${entry.name} not updated: you have not agreed to its data changes. Nothing was written.`);
+                    log.hint(`To agree and update: ${consentRerunCommand(c.slug, missing)}`);
+                }
+                results.push({ slug: c.slug, outcome: "needs-consent", status: "needs-consent", warnings: [], pendingDataChanges: missing });
+                continue;
+            }
+        }
+        results.push(await applyOnePackage(entry, cat, cfg, { json: opts.json }, applyTimeoutMs, {
+            payload: pv?.payload,
+            acceptDataChanges: accepted,
+        }));
     }
+    if (results.some((r) => r.status === "needs-consent"))
+        process.exitCode = 1;
     const summary = summarizeApplyResults(results);
     const steps = FLOW.afterMarketUpdateApply();
     if (opts.json) {
-        console.log(JSON.stringify({ checks, loggedIn: cat.loggedIn, unknownSlugs, applied: results, summary, nextSteps: steps }, null, 2));
+        console.log(JSON.stringify({
+            checks,
+            loggedIn: cat.loggedIn,
+            unknownSlugs,
+            applied: results,
+            summary,
+            nextSteps: steps,
+            dataChanges: dataChangesJson,
+            templateLifecycle: lifecycleJson,
+        }, null, 2));
         return;
     }
     log.blank();
@@ -1075,12 +1838,14 @@ export async function marketUpdate(slugsArg, opts) {
  * else (locked/proposed/fetch-failed/not-in-catalog/no-workspace/unknown)
  * rolls into "failed".
  */
-function summarizeApplyResults(results) {
+export function summarizeApplyResults(results) {
     let updated = 0;
     let unchanged = 0;
     let withFailures = 0;
     let timedOut = 0;
     let failed = 0;
+    let proposed = 0;
+    let needsConsent = 0;
     for (const r of results) {
         switch (r.status) {
             case "installed":
@@ -1092,35 +1857,60 @@ function summarizeApplyResults(results) {
             case "unchanged":
                 unchanged++;
                 break;
+            // A governed write queued for review — SUCCESS, not a failure. Counting
+            // this as `failed` (the old `default` fall-through) was dishonest: the
+            // whole point of governance is "proposed ≠ error". It just isn't LIVE yet.
+            case "proposed":
+            // Layer 2 filed proposals and nothing failed: same bucket, same reason.
+            case "awaiting-approval":
+                proposed++;
+                break;
             case "installed-with-failures":
             case "updated-with-failures":
             case "composed-with-failures":
+            case "not-finished":
             case "stamp-contradiction":
                 withFailures++;
                 break;
             case "timed-out":
                 timedOut++;
                 break;
+            // Held back on purpose: data changes the person has not agreed to.
+            // Not a failure of the pod, not a success either.
+            case "needs-consent":
+                needsConsent++;
+                break;
             default:
                 failed++;
         }
     }
     const parts = [`${updated} updated`, `${unchanged} already current`];
+    if (proposed > 0)
+        parts.push(`${proposed} proposed (awaiting review)`);
+    // The vocabulary's `unfinished` ("Not finished"): one state, one name on
+    // every surface — never "completed with failures" (review2 UX §1 #2).
     if (withFailures > 0)
-        parts.push(`${withFailures} completed with failures`);
+        parts.push(`${withFailures} ${templateStepPhrase("unfinished")}`);
     if (failed > 0)
         parts.push(`${failed} failed`);
     if (timedOut > 0)
         parts.push(`${timedOut} timed out`);
-    const clean = withFailures === 0 && failed === 0 && timedOut === 0;
-    const color = clean ? chalk.green : chalk.yellow;
+    if (needsConsent > 0)
+        parts.push(`${needsConsent} waiting for your agreement to data changes`);
+    const clean = withFailures === 0 && failed === 0 && timedOut === 0 && needsConsent === 0;
+    // Proposed isn't a failure (never ⚠) but isn't live yet (not a bare ✓) —
+    // a distinct "→ awaiting review" marker keeps the summary honest.
+    const marker = !clean ? "⚠" : proposed > 0 ? "→" : "✓";
+    const color = !clean ? chalk.yellow : proposed > 0 ? chalk.cyan : chalk.green;
     return {
         updated,
         unchanged,
         withFailures,
         failed,
         timedOut,
-        line: color(`${clean ? "✓" : "⚠"} ${parts.join(" · ")}`),
+        proposed,
+        needsConsent,
+        line: color(`${marker} ${parts.join(" · ")}`),
     };
 }
 // ── `synap market installed [--json] [--outdated]` — pure-read inventory ────
@@ -1137,21 +1927,33 @@ function truncateVersion(v) {
 function noVersionLabel(isPrivate, loggedIn) {
     return isPrivate && !loggedIn
         ? chalk.dim("connect to the Control Plane to check/update — run: synap login")
-        : chalk.dim("version unknown — reinstall to enable update checks");
+        : chalk.dim("version unknown — run `synap market attach <workspace>` to stamp it");
 }
 /**
  * Human status cell for one installed row — distinguishes hash drift (no
  * ordering, just "changed") from semver drift ("update available").
  */
-function installedStatusLabel(c, isPrivate, loggedIn) {
+export function installedStatusLabel(c, isPrivate, loggedIn) {
+    // No version recorded BUT the pod says it drifted: the last install did not
+    // finish (it waits on an approval, or part of it failed) — the pod holds the
+    // version until it does. Not "version unknown": the fix is to finish it.
+    if (c.noVersionInfo && c.updateAvailable)
+        return chalk.yellow(templateStepPhrase("unfinished")) + chalk.dim(` — run synap templates update ${c.slug}`);
     if (c.noVersionInfo)
         return noVersionLabel(isPrivate, loggedIn);
-    if (!c.updateAvailable)
-        return chalk.green("up to date");
+    if (!c.updateAvailable) {
+        // Cache-cold honesty: stamped + no drift reported, but the catalog has no
+        // version to compare against (a freshly-deployed pod before its first sync,
+        // or a private/removed slug). Don't assert a green "up to date" we never
+        // actually verified — say we couldn't check (ArgoCD's Unknown ≠ Synced).
+        if (c.latestVersion == null && c.installedVersion)
+            return chalk.dim("can't check — catalog version unknown");
+        return chalk.green(templateStepPhrase("current"));
+    }
     const installed = truncateVersion(c.installedVersion);
     const latest = c.latestVersion ? truncateVersion(c.latestVersion) : "?";
     const hashPair = isHashVersion(c.installedVersion) || isHashVersion(c.latestVersion ?? "");
-    const label = hashPair ? "content changed" : "update available";
+    const label = hashPair ? "content changed" : templateStepPhrase("update");
     return chalk.yellow(`${label}  `) + chalk.dim(installed) + " → " + latest;
 }
 // ── Composition engine — the ONE traversal door ─────────────────────────────
@@ -1210,9 +2012,21 @@ async function buildEdgesOf(seeds, cat, cpToken) {
     // safe either way since it's the same bundled-only lookup as the default.
     return (slug) => cache.get(slug) ?? bundledEdgesOf(slug);
 }
-/** `CompositionInstalledEntry[]` from the Hub's installed-templates rows — the shape both `--tree` and `--layers` feed the engine. */
+/**
+ * `CompositionInstalledEntry[]` from the Hub's installed-templates rows — the
+ * shape both `--tree` and `--layers` feed the engine.
+ *
+ * POD-GLOBAL rows (`workspaceId: null` — a capability/cell/skill installed with
+ * no owning workspace) are dropped: `CompositionInstalledEntry` is
+ * workspace-keyed by construction, and the composition views answer "which
+ * workspace does this template land in", which a pod-wide row has no answer to.
+ * They are still listed by the flat `market installed` table, which is where
+ * they belong.
+ */
 function toInstalledEntries(installedTemplates) {
-    return installedTemplates.map((t) => ({
+    return installedTemplates
+        .filter((t) => t.workspaceId != null)
+        .map((t) => ({
         slug: t.slug,
         workspaceId: t.workspaceId,
         workspaceName: t.workspaceName,
@@ -1284,7 +2098,7 @@ export async function buildCompositionTrees(rows, cat, installedTemplates, works
             relation: edge.relation,
             depKind: edge.depKind,
             installed: !!installedInfo,
-            workspaceId: installedInfo?.workspaceId,
+            workspaceId: installedInfo?.workspaceId ?? undefined,
             workspaceName: installedInfo?.workspaceName,
             installedVersion: check?.installedVersion,
             latestVersion: check?.latestVersion ?? null,
@@ -1319,10 +2133,10 @@ function nodeStatusLabel(node) {
     if (node.noVersionInfo)
         return chalk.dim("can't check");
     if (!node.updateAvailable)
-        return chalk.green("up to date");
+        return chalk.green(templateStepPhrase("current"));
     const installed = node.installedVersion ? truncateVersion(node.installedVersion) : "?";
     const latest = node.latestVersion ? truncateVersion(node.latestVersion) : "?";
-    return chalk.yellow("update available  ") + chalk.dim(installed) + " → " + latest;
+    return chalk.yellow(`${templateStepPhrase("update")}  `) + chalk.dim(installed) + " → " + latest;
 }
 function printDependencyNode(node, prefix, isLast) {
     const branch = isLast ? "└─ " : "├─ ";
@@ -1352,8 +2166,8 @@ export function printCompositionTree(pkg) {
         (pkg.noVersionInfo
             ? chalk.dim("can't check — reinstall")
             : pkg.updateAvailable
-                ? chalk.yellow("update available")
-                : chalk.green("up to date")) +
+                ? chalk.yellow(templateStepPhrase("update"))
+                : chalk.green(templateStepPhrase("current"))) +
         suiteTag);
     pkg.children.forEach((child, i) => printDependencyNode(child, "", i === pkg.children.length - 1));
     log.blank();
@@ -1416,10 +2230,10 @@ function layerNodeStatus(node, isPrivate, loggedIn) {
     if (node.noVersionInfo)
         return noVersionLabel(isPrivate, loggedIn);
     if (!node.updateAvailable)
-        return chalk.green("up to date");
+        return chalk.green(templateStepPhrase("current"));
     const installed = node.installedVersion ? truncateVersion(node.installedVersion) : "?";
     const latest = node.latestVersion ? truncateVersion(node.latestVersion) : "?";
-    return chalk.yellow("update available  ") + chalk.dim(installed) + " → " + latest;
+    return chalk.yellow(`${templateStepPhrase("update")}  `) + chalk.dim(installed) + " → " + latest;
 }
 /**
  * Render the layered DAG bottom-up: bedrock (the highest layer index, most
@@ -1479,25 +2293,90 @@ function printLayersGraph(graph, cat) {
  * (`market update`'s own drift check), never writes anything. Pairs with
  * `market update` to apply what this surfaces.
  */
+/** Fan-out bucket for a POD-GLOBAL row — a row with no owning workspace. */
+const POD_WIDE = "\u0000pod-wide";
+/**
+ * "3 workspaces" / "pod-wide" / "2 workspaces · pod-wide" — where a slug landed.
+ *
+ * Counts DISTINCT placements, not rows. Since `GET /installed` reports one row
+ * per installed OBJECT (four `task-views-pack` views across two workspaces is
+ * four rows), tallying rows would have printed "4 workspaces" for two. The
+ * workspace-kind rows this replaced are one-per-workspace either way, so their
+ * output is unchanged.
+ */
+export function fanOutLabel(placements) {
+    const podWide = placements.has(POD_WIDE);
+    const wsCount = placements.size - (podWide ? 1 : 0);
+    const parts = [];
+    if (wsCount > 0)
+        parts.push(`${wsCount} workspace${wsCount === 1 ? "" : "s"}`);
+    if (podWide)
+        parts.push("pod-wide");
+    return parts.join(" · ");
+}
+/** Dedupe the not-package-linked rows by `kind + templateKey` (falling back to the row name). */
+export function collectUnlinked(rows) {
+    const byKey = new Map();
+    for (const r of rows) {
+        if (r.packageSlug)
+            continue;
+        const key = `${r.kind}::${r.templateKey ?? r.name}`;
+        const existing = byKey.get(key);
+        const placement = r.workspaceId ?? POD_WIDE;
+        if (existing) {
+            existing.placements.add(placement);
+            continue;
+        }
+        byKey.set(key, {
+            kind: r.kind,
+            templateKey: r.templateKey,
+            name: r.templateKey ?? r.name,
+            placements: new Set([placement]),
+            ...(r.note ? { note: r.note } : {}),
+        });
+    }
+    return [...byKey.values()];
+}
 export async function marketInstalled(opts) {
-    const [installedTemplates, cat] = await Promise.all([fetchInstalledTemplates(), buildMarketCatalog()]);
-    if (installedTemplates.length === 0) {
+    // THE ONE READ DOOR. `GET /api/hub/installed` unions all four install
+    // ledgers; before this, `market installed` asked `GET /workspaces` and so
+    // reported workspace packages ONLY — a pod-wide capability, cell, skill or
+    // view install was invisible here, to `market update`, and to every drift
+    // marker. On a pod too old to serve it, `fetchInstalledInventory` degrades to
+    // exactly the old workspace-only behaviour and says so (`degraded`).
+    const [inv, cat] = await Promise.all([fetchInstalledInventory(), buildMarketCatalog()]);
+    const installedTemplates = installedRowsToTemplates(inv.rows);
+    const unlinked = collectUnlinked(inv.rows);
+    const degradedNote = inv.degraded
+        ? "This pod does not serve GET /api/hub/installed — showing workspace packages only. Capability / view / skill / automation / card installs are NOT listed (upgrade the pod to see them)."
+        : undefined;
+    if (installedTemplates.length === 0 && unlinked.length === 0) {
         if (opts.json) {
-            console.log(JSON.stringify({ rows: [], loggedIn: cat.loggedIn }, null, 2));
+            console.log(JSON.stringify({ rows: [], unlinked: [], loggedIn: cat.loggedIn, degraded: inv.degraded, degradedNote }, null, 2));
             return;
         }
         log.warn("No installed packages found on this pod.");
+        if (degradedNote)
+            log.dim(degradedNote);
         log.hint("Browse what's available: synap market --list");
         return;
     }
     const checks = computeUpdates(installedTemplates, cat);
     // Multiple workspaces can install the same slug (a template composed onto
-    // several bases, or the same additive pack in >1 workspace) — one row per
-    // DISTINCT slug, with `workspaceCount` carrying the fan-out.
-    const workspaceCountBySlug = new Map();
+    // several bases, the same additive pack in >1 workspace, a views pack whose
+    // views span workspaces) — one row per DISTINCT slug, with the fan-out
+    // carried as the set of PLACEMENTS it landed in.
+    const placementsBySlug = new Map();
+    const kindBySlug = new Map();
     for (const t of installedTemplates) {
-        workspaceCountBySlug.set(t.slug, (workspaceCountBySlug.get(t.slug) ?? 0) + 1);
+        const set = placementsBySlug.get(t.slug) ?? new Set();
+        set.add(t.workspaceId ?? POD_WIDE);
+        placementsBySlug.set(t.slug, set);
+        if (!kindBySlug.has(t.slug))
+            kindBySlug.set(t.slug, t.kind ?? "workspace");
     }
+    const workspaceCountBySlug = new Map([...placementsBySlug].map(([slug, set]) => [slug, set.size]));
+    const placementLabel = (slug) => fanOutLabel(placementsBySlug.get(slug) ?? new Set());
     const seen = new Set();
     let rows = checks.filter((c) => {
         if (seen.has(c.slug))
@@ -1518,6 +2397,7 @@ export async function marketInstalled(opts) {
                 layers: graph.layers.map((bucket) => bucket.map((n) => n.slug)),
                 cycles: graph.cycles,
                 loggedIn: cat.loggedIn,
+                degraded: inv.degraded,
                 nextSteps: steps,
             }, null, 2));
             return;
@@ -1527,6 +2407,8 @@ export async function marketInstalled(opts) {
             return;
         }
         printLayersGraph(graph, cat);
+        if (degradedNote)
+            log.dim(degradedNote);
         if (!cat.loggedIn)
             log.dim("Not logged in — private template updates aren't visible. Run: synap login");
         renderNextSteps(steps);
@@ -1552,6 +2434,7 @@ export async function marketInstalled(opts) {
                     };
                 }),
                 loggedIn: cat.loggedIn,
+                degraded: inv.degraded,
                 nextSteps: steps,
             }, null, 2));
             return;
@@ -1574,7 +2457,6 @@ export async function marketInstalled(opts) {
                 const entry = entryBySlug.get(c.slug);
                 const name = entry?.name ?? c.slug;
                 const priv = entry?.isPrivate ? chalk.yellow("private") : "";
-                const wsCount = workspaceCountBySlug.get(c.slug) ?? 0;
                 console.log("    " +
                     chalk.bold(name.padEnd(nameW)) +
                     chalk.cyan(c.slug.padEnd(slugW)) +
@@ -1582,10 +2464,12 @@ export async function marketInstalled(opts) {
                     "  " +
                     priv +
                     (priv ? "  " : "") +
-                    chalk.dim(`${wsCount} workspace${wsCount === 1 ? "" : "s"}`));
+                    chalk.dim(placementLabel(c.slug)));
             }
             log.blank();
         }
+        if (degradedNote)
+            log.dim(degradedNote);
         if (!cat.loggedIn)
             log.dim("Not logged in — private template updates aren't visible. Run: synap login");
         renderNextSteps(steps);
@@ -1598,6 +2482,9 @@ export async function marketInstalled(opts) {
                 const entry = entryBySlug.get(c.slug);
                 return {
                     slug: c.slug,
+                    // Which install ledger this row came from. Absent kinds mean the
+                    // pod is older than `GET /installed` — see `degraded`.
+                    kind: kindBySlug.get(c.slug) ?? "workspace",
                     name: entry?.name ?? c.slug,
                     installedVersion: c.installedVersion,
                     latestVersion: c.latestVersion ?? null,
@@ -1606,38 +2493,807 @@ export async function marketInstalled(opts) {
                     isPrivate: entry?.isPrivate ?? false,
                     isHashVersion: isHashVersion(c.installedVersion) || isHashVersion(c.latestVersion ?? ""),
                     workspaceCount: workspaceCountBySlug.get(c.slug) ?? 0,
+                    placement: placementLabel(c.slug),
                 };
             }),
+            // Installed but not package-source-linked: no slug, so no update
+            // path. `drift` is NOT COMPUTED for these — never reported as clean.
+            unlinked: opts.outdated
+                ? []
+                : unlinked.map((u) => ({
+                    kind: u.kind,
+                    templateKey: u.templateKey,
+                    name: u.name,
+                    driftComputed: false,
+                    placement: fanOutLabel(u.placements),
+                    ...(u.note ? { note: u.note } : {}),
+                })),
             loggedIn: cat.loggedIn,
+            degraded: inv.degraded,
+            ...(degradedNote ? { degradedNote } : {}),
             nextSteps: steps,
         }, null, 2));
         return;
     }
-    if (rows.length === 0) {
+    if (rows.length === 0 && (opts.outdated || unlinked.length === 0)) {
         log.success(opts.outdated ? "Nothing outdated." : "Nothing installed.");
+        if (degradedNote)
+            log.dim(degradedNote);
         return;
     }
     log.heading("  Installed packages");
+    // Widths are computed across ALL rows (and the unlinked block below) so the
+    // per-kind groups stay in one column grid rather than each re-aligning.
+    //
+    // CAPPED: some CP catalog entries carry a sentence where a name belongs (the
+    // view packs' `name` is their whole description), which uncapped pushed the
+    // status column ~90 columns right and wrapped every line. The cap truncates
+    // the label; it never truncates the SLUG, which is the identifier a user
+    // retypes into `market update`.
+    const displayName = (raw) => raw.length > NAME_COL_MAX ? raw.slice(0, NAME_COL_MAX - 1) + "…" : raw;
+    const labelLengths = [
+        ...rows.map((c) => displayName(entryBySlug.get(c.slug)?.name ?? c.slug).length),
+        ...unlinked.map((u) => displayName(u.name).length),
+    ];
+    const nameW = Math.max(4, ...labelLengths) + 2;
+    const slugW = Math.max(4, ...rows.map((c) => c.slug.length), ...unlinked.map((u) => u.name.length)) + 2;
+    // Grouped by the kind its ledger reports, in the canonical kind order, with
+    // headings from the pinned `KIND_HEADINGS` vocabulary (Card, never "cell";
+    // Automations, never "Workflow").
+    for (const kind of INSTALLED_KINDS) {
+        const group = rows.filter((c) => (kindBySlug.get(c.slug) ?? "workspace") === kind);
+        if (group.length === 0)
+            continue;
+        log.heading(`  ${kindHeading(kind)}`);
+        for (const c of group) {
+            const entry = entryBySlug.get(c.slug);
+            const name = displayName(entry?.name ?? c.slug);
+            const priv = entry?.isPrivate ? chalk.yellow("private") : "";
+            console.log("    " +
+                chalk.bold(name.padEnd(nameW)) +
+                chalk.cyan(c.slug.padEnd(slugW)) +
+                installedStatusLabel(c, entry?.isPrivate ?? false, cat.loggedIn) +
+                "  " +
+                priv +
+                (priv ? "  " : "") +
+                chalk.dim(placementLabel(c.slug)));
+        }
+        log.blank();
+    }
+    // Installed, but with no package slug to update THROUGH — listed so they are
+    // not invisible, kept out of the table above so nothing offers `market update
+    // <templateKey>`, which the catalog would miss.
+    if (!opts.outdated && unlinked.length > 0) {
+        log.heading("  Installed, not from a package");
+        log.dim("    source-linked to a Control-Plane template, not a catalog slug — `market update` can't act on these");
+        for (const kind of INSTALLED_KINDS) {
+            const group = unlinked.filter((u) => u.kind === kind);
+            if (group.length === 0)
+                continue;
+            log.blank();
+            log.heading(`  ${kindHeading(kind)}`);
+            for (const u of group) {
+                console.log("    " +
+                    chalk.bold(displayName(u.name).padEnd(nameW)) +
+                    // No slug column value: there IS no package slug for these rows,
+                    // and printing the template key twice (it is already the label)
+                    // invites pasting it into `market update`, which would miss.
+                    chalk.dim("—".padEnd(slugW)) +
+                    chalk.dim("drift not computed") +
+                    "  " +
+                    chalk.dim(fanOutLabel(u.placements)) +
+                    // The pod's own explanation of WHY drift is unknown for this row —
+                    // "not computed" without the reason is where a user gives up and
+                    // assumes it means clean.
+                    (u.note ? chalk.dim(`  ${u.note}`) : ""));
+            }
+        }
+        log.blank();
+    }
+    if (degradedNote)
+        log.dim(degradedNote);
+    if (!cat.loggedIn)
+        log.dim("Not logged in — private template updates aren't visible. Run: synap login");
+    renderNextSteps(FLOW.afterMarketInstalledCheck(rows.filter((c) => c.updateAvailable).map((c) => c.slug)));
+}
+/** Classify one workspace's attachment, reusing `computeUpdates`' drift verdict for the stamped case. */
+function classifyAttachment(ws, check) {
+    if (!ws.packageSlug)
+        return { kind: "unattached" };
+    if (!ws.packageVersion && ws.drifted === true)
+        return { kind: "unfinished", slug: ws.packageSlug };
+    if (!ws.packageVersion || check?.noVersionInfo)
+        return { kind: "no-version", slug: ws.packageSlug };
+    return {
+        kind: "attached",
+        slug: ws.packageSlug,
+        version: ws.packageVersion,
+        updateAvailable: check?.updateAvailable ?? false,
+        latestVersion: check?.latestVersion,
+    };
+}
+/** Human status cell for one workspace row — the same vocabulary as `market installed`, keyed on attachment. */
+export function attachmentStatusLabel(s) {
+    switch (s.kind) {
+        case "unattached":
+            return chalk.yellow("⚠ not attached to a template");
+        case "unfinished":
+            return chalk.yellow("⚠ ") + chalk.cyan(s.slug) + chalk.yellow(` · ${templateStepPhrase("unfinished")}`);
+        case "no-version":
+            return (chalk.yellow("⚠ attached to ") +
+                chalk.cyan(s.slug) +
+                chalk.yellow(" · no version stamp — reattach to enable updates"));
+        case "attached": {
+            if (!s.updateAvailable) {
+                // Cache-cold: stamped but the catalog has no version to compare against
+                // → show the stamp without a green "up to date" claim we never verified.
+                if (s.latestVersion == null)
+                    return chalk.cyan(s.slug) + chalk.dim(` @ ${truncateVersion(s.version)} · can't check`);
+                return chalk.green("✓ ") + chalk.cyan(s.slug) + chalk.dim(` @ ${truncateVersion(s.version)}`);
+            }
+            const latest = s.latestVersion ? truncateVersion(s.latestVersion) : "?";
+            return (chalk.cyan(s.slug) +
+                chalk.dim(` @ ${truncateVersion(s.version)} → ${latest}  `) +
+                chalk.yellow(templateStepPhrase("update")));
+        }
+    }
+}
+/**
+ * Pure-read discovery surface — every workspace on the pod with its template-
+ * attachment status. Sources the linkage from the SAME Hub `GET /workspaces`
+ * call `market installed` uses (`fetchWorkspaceAttachments`), and reuses
+ * `computeUpdates` for the stamped-drift verdict. Never writes.
+ */
+export async function marketWorkspaces(opts) {
+    const [attachments, cat] = await Promise.all([fetchWorkspaceAttachments(), buildMarketCatalog()]);
+    if (attachments.length === 0) {
+        if (opts.json) {
+            console.log(JSON.stringify({ workspaces: [], loggedIn: cat.loggedIn }, null, 2));
+            return;
+        }
+        log.warn("No workspaces found on this pod.");
+        log.hint("Stand one up: synap launch  ·  or install a template: synap market --list");
+        return;
+    }
+    // Reuse the exact drift check `market installed`/`update` use. Only the
+    // STAMPED workspaces need it; `computeUpdates` preserves input order, so the
+    // result is index-aligned with `stamped` for a clean zip-back by workspace.
+    const stamped = attachments.filter((a) => a.packageSlug);
+    const stampedChecks = computeUpdates(stamped.map((a) => ({
+        slug: a.packageSlug,
+        version: a.packageVersion ?? undefined,
+        workspaceId: a.workspaceId,
+        workspaceName: a.workspaceName,
+        latestVersion: a.latestVersion,
+        drifted: a.drifted,
+    })), cat);
+    const checkByWorkspace = new Map();
+    stamped.forEach((a, i) => checkByWorkspace.set(a.workspaceId, stampedChecks[i]));
+    let rows = attachments.map((ws) => ({
+        ws,
+        status: classifyAttachment(ws, checkByWorkspace.get(ws.workspaceId)),
+    }));
+    if (opts.unattached) {
+        rows = rows.filter((r) => r.status.kind !== "attached" && r.status.kind !== "unfinished");
+    }
+    if (opts.json) {
+        console.log(JSON.stringify({
+            workspaces: rows.map((r) => ({
+                id: r.ws.workspaceId,
+                name: r.ws.workspaceName,
+                domain: r.ws.domain,
+                packageSlug: r.ws.packageSlug,
+                packageVersion: r.ws.packageVersion,
+                attachment: r.status.kind,
+                ...(r.status.kind === "attached"
+                    ? { updateAvailable: r.status.updateAvailable, latestVersion: r.status.latestVersion ?? null }
+                    : {}),
+            })),
+            loggedIn: cat.loggedIn,
+        }, null, 2));
+        return;
+    }
+    if (rows.length === 0) {
+        log.success("Every workspace is attached to a template.");
+        return;
+    }
+    log.heading(opts.unattached ? "  Workspaces needing attention" : "  Your workspaces");
     log.blank();
-    const nameW = Math.max(4, ...rows.map((c) => (entryBySlug.get(c.slug)?.name ?? c.slug).length)) + 2;
-    const slugW = Math.max(4, ...rows.map((c) => c.slug.length)) + 2;
-    for (const c of rows) {
-        const entry = entryBySlug.get(c.slug);
-        const name = entry?.name ?? c.slug;
-        const priv = entry?.isPrivate ? chalk.yellow("private") : "";
-        const wsCount = workspaceCountBySlug.get(c.slug) ?? 0;
+    const nameW = Math.max(4, ...rows.map((r) => r.ws.workspaceName.length)) + 2;
+    for (const { ws, status } of rows) {
+        const domain = ws.domain ? chalk.dim(String(ws.domain)) : chalk.dim("—");
         console.log("    " +
-            chalk.bold(name.padEnd(nameW)) +
-            chalk.cyan(c.slug.padEnd(slugW)) +
-            installedStatusLabel(c, entry?.isPrivate ?? false, cat.loggedIn) +
+            chalk.bold(ws.workspaceName.padEnd(nameW)) +
+            chalk.dim(ws.workspaceId) +
             "  " +
-            priv +
-            (priv ? "  " : "") +
-            chalk.dim(`${wsCount} workspace${wsCount === 1 ? "" : "s"}`));
+            domain +
+            "\n      " +
+            attachmentStatusLabel(status));
     }
     log.blank();
+    const needsAttach = rows.filter((r) => r.status.kind !== "attached" && r.status.kind !== "unfinished");
+    if (needsAttach.length > 0) {
+        log.hint(`Attach a template to a workspace: synap market attach <workspaceId> [--slug <slug>]`);
+        log.dim("This is how you relink a workspace that was installed before the marketplace existed.");
+    }
     if (!cat.loggedIn)
         log.dim("Not logged in — private template updates aren't visible. Run: synap login");
-    renderNextSteps(FLOW.afterMarketInstalledCheck(rows.filter((c) => c.updateAvailable).map((c) => c.slug)));
+}
+// ── `synap market attach <workspaceId>` — ergonomic reattach/relink ──────────
+//
+// A friendly wrapper over `market install <slug> --onto <workspaceId>`: it
+// resolves WHICH template to reconcile onto the workspace (from `--slug`, the
+// workspace's existing `packageSlug`, or an unambiguous domain match), then
+// hands off to `marketInstall` so the reconcile + version-stamp path is shared,
+// never duplicated. `market install --onto` reconciles ADDITIVELY and stamps —
+// this command just makes it discoverable per-workspace.
+export async function marketAttach(workspaceId, opts) {
+    let cfg;
+    try {
+        cfg = await resolveHubConfig(opts);
+    }
+    catch (e) {
+        renderHubError(e);
+        process.exit(1);
+    }
+    const attachments = await fetchWorkspaceAttachments(cfg);
+    const ws = attachments.find((a) => a.workspaceId === workspaceId);
+    if (!ws) {
+        log.error(`No workspace "${workspaceId}" found on this pod.`);
+        log.hint("List your workspaces: synap market workspaces");
+        process.exit(1);
+    }
+    // Resolve the slug to reconcile. Priority: explicit --slug > the workspace's
+    // own recorded packageSlug (the reattach case) > the SHARED `suggestTemplateFor`
+    // inference (same algorithm `synap templates attach` uses — domain/name match
+    // with the generic-domain guard) so the two attach doors never disagree on the
+    // same workspace. This non-interactive door only auto-uses a STRONG (exact
+    // domain) match; a weak/none guess is never silently written — it asks for --slug.
+    let slug = opts.slug;
+    let inferredFrom;
+    if (!slug && ws.packageSlug) {
+        slug = ws.packageSlug;
+        inferredFrom = "the workspace's existing attachment";
+    }
+    if (!slug) {
+        const cat = await buildMarketCatalog();
+        const suggestion = suggestTemplateFor(ws, cat.entries);
+        if (suggestion && suggestion.confidence === "strong") {
+            slug = suggestion.slug;
+            inferredFrom = `its domain "${ws.domain}"`;
+        }
+        else {
+            log.error(`Couldn't confidently infer which template to attach to "${ws.workspaceName}".`);
+            if (suggestion)
+                log.hint(`Best guess: ${chalk.cyan(suggestion.slug)} (${suggestion.confidence}) — confirm it with --slug ${suggestion.slug}`);
+            const templates = cat.entries.filter((e) => typeOf(e) === "workspace").slice(0, 12);
+            if (templates.length > 0) {
+                log.hint("Available workspace templates:");
+                for (const e of templates) {
+                    console.log("    " + chalk.cyan(e.slug.padEnd(28)) + chalk.dim(e.name));
+                }
+            }
+            log.hint(`Re-run with the one you want: synap market attach ${workspaceId} --slug <slug>`);
+            log.hint(`Or use the name-friendly door: synap templates attach "${ws.workspaceName}"`);
+            process.exit(1);
+        }
+    }
+    if (!opts.json && inferredFrom) {
+        log.info(`Attaching ${chalk.cyan(slug)} — inferred from ${inferredFrom}.`);
+    }
+    // Hand off to the SAME reconcile+stamp door `market install --onto` uses. It
+    // prints the honest "Reconciled <slug> onto <workspace>" verdict, surfaces a
+    // governed proposal's review link when the write is queued, and stamps the
+    // version — none of which we re-implement here.
+    await marketInstall(slug, {
+        onto: workspaceId,
+        project: opts.project,
+        timeout: opts.timeout,
+        json: opts.json,
+        podUrl: opts.podUrl,
+        apiKey: opts.apiKey,
+    });
+}
+/** Best template guess for an unattached workspace: exact domain match wins; else the name containing a template slug. Null when nothing fits — we never invent a link. */
+export function suggestTemplateFor(ws, entries) {
+    const templates = entries.filter((e) => typeOf(e) === "workspace");
+    const norm = (s) => s.toLowerCase().replace(/[^a-z0-9]/g, "");
+    const wsDomain = ws.domain ? norm(String(ws.domain)) : "";
+    const wsName = norm(ws.workspaceName);
+    // Generic/default domains carry NO subject signal — `personal` is the default
+    // `workspaceType` for any hand-built or system workspace (Pod Admin, "New
+    // Workspace"). Matching those to a same-named base template is a false positive
+    // on every unconfigured workspace, so we never suggest from them.
+    // `personal` is the CONFIRMED default `workspaceType` (backend schema default);
+    // `general`/`foundation` are precautionary — not observed as real subtypes, but
+    // if a base template ever used one, matching it would be the same false positive.
+    const GENERIC_DOMAINS = new Set(["personal", "general", "foundation"]);
+    // STRONG: a SPECIFIC domain IS a template slug (or that template's domain).
+    if (wsDomain && !GENERIC_DOMAINS.has(wsDomain)) {
+        for (const e of templates) {
+            if (norm(e.slug) === wsDomain || norm(e.domain ?? "") === wsDomain) {
+                return { slug: e.slug, name: e.name, confidence: "strong" };
+            }
+        }
+    }
+    // WEAK: the workspace name contains a template's slug token (≥3 chars to avoid
+    // noise), skipping the generic base templates a name would falsely brush.
+    for (const e of templates) {
+        const s = norm(e.slug);
+        if (GENERIC_DOMAINS.has(s))
+            continue;
+        if (s.length >= 3 && wsName.includes(s)) {
+            return { slug: e.slug, name: e.name, confidence: "weak" };
+        }
+    }
+    return null;
+}
+/** Resolve a user-typed workspace reference — exact id, else exact (case-insensitive) name, else a UNIQUE substring name match. No silent pick when >1 fits. */
+export function resolveWorkspaceQuery(query, attachments) {
+    const byId = attachments.find((a) => a.workspaceId === query);
+    if (byId)
+        return { kind: "found", ws: byId };
+    const q = query.toLowerCase().trim();
+    const exact = attachments.filter((a) => a.workspaceName.toLowerCase() === q);
+    if (exact.length === 1)
+        return { kind: "found", ws: exact[0] };
+    if (exact.length > 1)
+        return { kind: "ambiguous", matches: exact };
+    const partial = attachments.filter((a) => a.workspaceName.toLowerCase().includes(q));
+    if (partial.length === 1)
+        return { kind: "found", ws: partial[0] };
+    if (partial.length > 1)
+        return { kind: "ambiguous", matches: partial };
+    return { kind: "none" };
+}
+/** Sort one workspace into the action-ranked home: drifted / unstamped / (unattached-with-suggestion) → attention; current → ok; unattached-no-match → unlinked. */
+export function classifyTemplateRow(ws, check, entries) {
+    const status = classifyAttachment(ws, check);
+    let suggestion = null;
+    let group = "ok";
+    let action = null;
+    switch (status.kind) {
+        case "attached":
+            if (status.updateAvailable) {
+                group = "attention";
+                action = `synap templates update ${status.slug}`;
+            }
+            break;
+        case "unfinished":
+            group = "attention";
+            action = `synap templates update ${status.slug}`;
+            break;
+        case "no-version":
+            group = "attention";
+            action = `synap templates attach "${ws.workspaceName}"`;
+            break;
+        case "unattached":
+            suggestion = suggestTemplateFor(ws, entries);
+            if (suggestion) {
+                group = "attention";
+                action = `synap templates attach "${ws.workspaceName}"`;
+            }
+            else {
+                group = "unlinked";
+            }
+            break;
+    }
+    // Lifecycle outranks drift: updating a retired template is the wrong move,
+    // moving its data into the replacement is the right one. `unknown` is only
+    // a note — an incomplete catalog read never claims the template is gone.
+    const notice = ws.packageSlug && ws.lifecycle ? lifecycleNotice(ws.packageSlug, ws.lifecycle) : null;
+    if (notice && ws.lifecycle.lifecycle !== "unknown") {
+        group = "attention";
+        action = notice.action;
+    }
+    // An overlay retired with its replacement absent from the space needs the
+    // person too; it never takes the row's action (an overlay is not a space).
+    if ((ws.overlays ?? []).some(overlayNeedsAttention))
+        group = "attention";
+    const overlayNotices = (ws.overlays ?? []).map((o) => ({
+        slug: o.slug,
+        label: overlayNotice(o)?.label ?? null,
+        lifecycle: o.info.lifecycle,
+    }));
+    // Why the last update did not finish — the POD's sentence, printed as is.
+    // Waiting on the person's approval (live, by the pod): the update cannot
+    // finish before it, so the next step is opening the proposal.
+    const waiting = ws.awaitingApproval ?? [];
+    const dataChanges = ws.pendingDataChanges ?? null;
+    const updateProposalId = ws.updateProposal?.id ?? null;
+    // The space's ONE step, by the shared rule and precedence (unfinished >
+    // needs-consent > agent-asked > awaiting-approval > update): the mark and
+    // the door the desktop and the catalog draw for the same row.
+    const step = classifyTemplateStep(ws);
+    // A held update's sentence ("…waits for you to agree…") is what the data
+    // changes block says, door and all: print it once. Any unfinished state's
+    // sentence wins over it at the pod, so it is kept then.
+    const applyNotice = dataChanges && !stepFromApplyState(ws.state, waiting) ? null : ws.applyWarning ?? null;
+    if (applyNotice || (step && step !== "update"))
+        group = "attention";
+    // The door of the leading step. Finishing and agreeing to data changes are
+    // both `templates update` (its prompt lists the changes with their keys; the
+    // health row carries none). An agent's ask: approving it beats a second
+    // update beside it. Proposals the last apply waits on: the one proposal, or
+    // the review queue for several — never no door. `update` keeps the action
+    // above (lifecycle outranks drift).
+    if (ws.packageSlug && (step === "unfinished" || step === "needs-consent")) {
+        action = `synap templates update ${ws.packageSlug}`;
+    }
+    else if (step === "agent-asked" && updateProposalId) {
+        action = `synap open proposal ${updateProposalId}`;
+    }
+    else if (step === "awaiting-approval" || (!ws.state && waiting.length > 0)) {
+        // (An older pod sends no `state`: its live pending list is the signal.)
+        action = proposalsDoor(waiting);
+    }
+    if (!ws.state && waiting.length > 0)
+        group = "attention";
+    return {
+        ws,
+        status,
+        suggestion,
+        group,
+        action,
+        lifecycleNotice: notice,
+        overlayNotices,
+        applyNotice,
+        step,
+        dataChanges,
+        updateProposalId,
+    };
+}
+function templateRowToJson(r) {
+    return {
+        workspaceId: r.ws.workspaceId,
+        name: r.ws.workspaceName,
+        domain: r.ws.domain,
+        status: r.status.kind,
+        slug: r.ws.packageSlug,
+        version: r.ws.packageVersion,
+        latestVersion: r.status.kind === "attached" ? r.status.latestVersion ?? null : null,
+        updateAvailable: r.status.kind === "attached" ? r.status.updateAvailable : false,
+        suggestedSlug: r.suggestion?.slug ?? null,
+        action: r.action,
+        awaitingApproval: r.ws.awaitingApproval ?? [],
+        applyWarning: r.ws.applyWarning ?? null,
+        state: r.ws.state ?? null,
+        step: r.step,
+        pendingDataChanges: r.dataChanges,
+        updateProposal: r.updateProposalId ? { id: r.updateProposalId } : null,
+        stepWarnings: r.ws.stepWarnings ?? [],
+        lifecycle: r.ws.lifecycle?.lifecycle ?? null,
+        replacedBy: r.ws.lifecycle?.replacedBy ?? null,
+        retiredReason: r.ws.lifecycle?.retiredReason ?? null,
+        ...(r.ws.overlays
+            ? {
+                overlays: r.ws.overlays.map((o) => ({
+                    slug: o.slug,
+                    lifecycle: o.info.lifecycle,
+                    replacedBy: o.info.replacedBy,
+                    retiredReason: o.info.retiredReason,
+                    warning: o.info.warning,
+                    replacementHere: o.replacementHere,
+                })),
+            }
+            : {}),
+    };
+}
+/** "2 data changes to existing records" — the count the pod sends, or that it could not tell. */
+function dataChangesCountPhrase(d) {
+    if (d.unreadable && d.count === 0)
+        return "this update changes existing data";
+    return `${d.count} ${d.count === 1 ? "data change" : "data changes"} to existing records`;
+}
+export function renderTemplateRow(r) {
+    const raw = r.ws.workspaceName;
+    const name = raw.length > 34 ? raw.slice(0, 33) + "…" : raw;
+    let label = attachmentStatusLabel(r.status);
+    if (r.status.kind === "unattached" && r.suggestion) {
+        label =
+            chalk.yellow("⚠ not attached") +
+                chalk.dim(" · looks like → ") +
+                chalk.cyan(r.suggestion.slug);
+    }
+    // The pod's apply state outranks the stamp-based cell: a stamped space whose
+    // last update failed is not "update available", and one waiting on live
+    // proposals is waiting, not unfinished.
+    if (r.step && r.step !== "update" && r.ws.packageSlug) {
+        const glyph = templateStepGlyph(r.step);
+        const tone = r.step === "awaiting-approval" || r.step === "agent-asked" ? chalk.cyan : chalk.yellow;
+        label = tone(`${glyph} `) + chalk.cyan(r.ws.packageSlug) + tone(` · ${templateStepPhrase(r.step)}`);
+    }
+    const indent = "    " + " ".repeat(36);
+    console.log("    " + chalk.bold(name.padEnd(36)) + label);
+    if (r.lifecycleNotice) {
+        const tone = r.ws.lifecycle?.lifecycle === "unknown" ? chalk.dim : chalk.yellow;
+        console.log("    " + " ".repeat(36) + tone(`⚠ ${r.lifecycleNotice.label}`));
+        if (r.ws.lifecycle?.retiredReason && !r.ws.lifecycle.warning)
+            console.log("    " + " ".repeat(36) + chalk.dim(r.ws.lifecycle.retiredReason));
+    }
+    if (r.applyNotice) {
+        // ⏳ only while the space waits on someone's decision (live pending
+        // proposals — an older pod sends no `state`); anything else is the
+        // reader's to act on.
+        const waiting = r.step === "awaiting-approval" || (r.ws.awaitingApproval ?? []).length > 0;
+        console.log(indent + (waiting ? chalk.cyan(`⏳ ${r.applyNotice}`) : chalk.yellow(`⚠ ${r.applyNotice}`)));
+    }
+    if (r.dataChanges) {
+        // Leading, the mark above already says "needs your OK"; behind another
+        // step (a failed apply that also holds data changes) the block names itself.
+        const what = dataChangesCountPhrase(r.dataChanges);
+        console.log(indent +
+            chalk.yellow(r.step === "needs-consent" ? `${what}:` : `⚠ ${TEMPLATE_STEP_LABELS["needs-consent"]}: ${what}`));
+        for (const sentence of r.dataChanges.sentences)
+            console.log(indent + "  • " + sentence);
+        if (r.dataChanges.needsPodAdmin)
+            console.log(indent + "  " + chalk.dim("Only a pod owner or admin can agree to them."));
+    }
+    for (const w of r.ws.stepWarnings ?? [])
+        console.log(indent + chalk.dim(w));
+    // An agent's ask behind another step keeps its own door on its own line;
+    // leading, the mark says it and the action line below is its door.
+    const agentDoor = r.updateProposalId && r.step !== "agent-asked" ? `synap open proposal ${r.updateProposalId}` : null;
+    if (agentDoor)
+        console.log(indent + chalk.cyan(`→ ${TEMPLATE_STEP_LABELS["agent-asked"]}`) + chalk.dim(` · ${agentDoor}`));
+    if (r.action && r.action !== agentDoor)
+        console.log(indent + chalk.dim(r.action));
+    for (const o of r.overlayNotices) {
+        console.log("    " + " ".repeat(36) + chalk.dim(`↳ overlay ${o.slug}`));
+        if (o.label) {
+            const tone = o.lifecycle === "unknown" ? chalk.dim : chalk.yellow;
+            console.log("    " + " ".repeat(38) + tone(`⚠ ${o.label}`));
+        }
+    }
+}
+/**
+ * `synap templates` — grouped, action-ranked view of every workspace's template
+ * link. Default surfaces "Needs attention" first (drifted + unattached-with-
+ * suggestion + unstamped), then up-to-date, then unlinked. `--needs-attention`
+ * shows only the first group; `--json` for scripts. Pure read.
+ */
+export async function marketTemplates(opts) {
+    let cfg;
+    try {
+        cfg = await resolveHubConfig(opts);
+    }
+    catch (e) {
+        renderHubError(e);
+        process.exit(1);
+    }
+    const cat = await buildMarketCatalog();
+    // STRICT: this is the consolidated home — "pod unreachable" must never render
+    // as "No workspaces found · stand one up", the exact false-empty lie the
+    // strict fetchers exist to prevent.
+    let attachments;
+    try {
+        attachments = await fetchWorkspaceAttachmentsStrict(cfg);
+    }
+    catch (e) {
+        process.exitCode = 1;
+        if (opts.json) {
+            console.log(JSON.stringify({ needsAttention: [], upToDate: [], unlinked: [], loggedIn: cat.loggedIn, error: "pod-unreachable" }, null, 2));
+            return;
+        }
+        log.error("Couldn't reach your pod to read its workspaces — not saying it's empty.");
+        renderHubError(e);
+        log.hint("Check the pod is up / you're on the right --pod, then retry.");
+        return;
+    }
+    if (attachments.length === 0) {
+        if (opts.json) {
+            console.log(JSON.stringify({ needsAttention: [], upToDate: [], unlinked: [], loggedIn: cat.loggedIn }, null, 2));
+            return;
+        }
+        log.warn("No workspaces found on this pod.");
+        log.hint("Stand one up: synap launch  ·  browse templates: synap market --list");
+        return;
+    }
+    // Drift for the stamped rows via the server-first `computeUpdates`.
+    const stamped = attachments.filter((a) => a.packageSlug);
+    const checks = computeUpdates(stamped.map((a) => ({
+        slug: a.packageSlug,
+        version: a.packageVersion ?? undefined,
+        workspaceId: a.workspaceId,
+        workspaceName: a.workspaceName,
+        latestVersion: a.latestVersion,
+        drifted: a.drifted,
+    })), cat);
+    const checkByWs = new Map();
+    stamped.forEach((a, i) => checkByWs.set(a.workspaceId, checks[i]));
+    const rows = attachments.map((ws) => classifyTemplateRow(ws, checkByWs.get(ws.workspaceId), cat.entries));
+    const attention = rows.filter((r) => r.group === "attention");
+    const ok = rows.filter((r) => r.group === "ok");
+    const unlinked = rows.filter((r) => r.group === "unlinked");
+    if (opts.json) {
+        console.log(JSON.stringify({
+            needsAttention: attention.map(templateRowToJson),
+            upToDate: ok.map(templateRowToJson),
+            unlinked: unlinked.map(templateRowToJson),
+            loggedIn: cat.loggedIn,
+        }, null, 2));
+        return;
+    }
+    // Band — the one-line summary, most-actionable count first.
+    log.blank();
+    const bandParts = [];
+    if (attention.length)
+        bandParts.push(chalk.yellow(`${attention.length} need attention`));
+    bandParts.push(chalk.green(`${ok.length} ${templateStepPhrase("current")}`));
+    if (unlinked.length)
+        bandParts.push(chalk.dim(`${unlinked.length} without a template`));
+    console.log("  " + bandParts.join(chalk.dim(" · ")));
+    log.blank();
+    if (attention.length) {
+        log.heading("  Needs attention");
+        for (const r of attention)
+            renderTemplateRow(r);
+        log.blank();
+    }
+    else {
+        log.success("  Everything attached is up to date.");
+        log.blank();
+    }
+    if (!opts.needsAttention) {
+        if (ok.length) {
+            console.log(chalk.dim(`  ${TEMPLATE_STEP_LABELS.current}`));
+            for (const r of ok)
+                renderTemplateRow(r);
+            log.blank();
+        }
+        if (unlinked.length) {
+            console.log(chalk.dim("  No template (attach one if it should have it)"));
+            for (const r of unlinked)
+                renderTemplateRow(r);
+            log.blank();
+        }
+    }
+    // Footer — the one-glance "what can I do from here". Only surfaces verbs that
+    // actually apply to the current state, so it's never a menu of dead options.
+    const driftedCount = attention.filter((r) => (r.status.kind === "attached" && r.status.updateAvailable) ||
+        r.status.kind === "unfinished").length;
+    const attachableCount = attention.filter((r) => r.status.kind !== "attached" && r.status.kind !== "unfinished").length;
+    if (driftedCount > 0 || attachableCount > 0) {
+        log.blank();
+        if (driftedCount > 0)
+            log.hint(`Update all ${driftedCount} drifted: synap templates update all`);
+        if (attachableCount > 0)
+            log.hint(`Connect a workspace: synap templates attach "<name>"`);
+    }
+    if (!cat.loggedIn)
+        log.dim("Not logged in — private template updates aren't visible. Run: synap login");
+}
+/**
+ * `synap templates attach <workspace>` — the ONE natural connect command. Takes a
+ * workspace NAME (or id), suggests the template, confirms once. `--slug` forces a
+ * specific template; `--yes` accepts a strong suggestion non-interactively.
+ * Hands the actual reconcile+stamp to the same door `market install --onto` uses.
+ */
+export async function templatesAttach(query, opts) {
+    let cfg;
+    try {
+        cfg = await resolveHubConfig(opts);
+    }
+    catch (e) {
+        renderHubError(e);
+        process.exit(1);
+    }
+    const attachments = await fetchWorkspaceAttachments(cfg);
+    const res = resolveWorkspaceQuery(query, attachments);
+    if (res.kind === "none") {
+        if (opts.json) {
+            console.log(JSON.stringify({ error: "workspace-not-found", query }, null, 2));
+            process.exitCode = 1;
+            return;
+        }
+        log.error(`No workspace matching "${query}" on this pod.`);
+        log.hint("See them all: synap templates");
+        process.exit(1);
+    }
+    let ws;
+    if (res.kind === "ambiguous") {
+        const nonInteractive = opts.json || opts.yes || !process.stdout.isTTY;
+        if (nonInteractive) {
+            if (opts.json) {
+                console.log(JSON.stringify({ error: "ambiguous-workspace", query, matches: res.matches.map((m) => ({ workspaceId: m.workspaceId, name: m.workspaceName })) }, null, 2));
+                process.exitCode = 1;
+                return;
+            }
+            log.error(`"${query}" matches ${res.matches.length} workspaces — be more specific:`);
+            for (const m of res.matches) {
+                console.log("    " + chalk.bold(m.workspaceName) + chalk.dim(`  ${m.workspaceId}`));
+            }
+            process.exit(1);
+        }
+        const answer = await prompts({
+            type: "select",
+            name: "workspaceId",
+            message: `"${query}" matches several — which one?`,
+            choices: res.matches.map((m) => ({ title: m.workspaceName, value: m.workspaceId })),
+        });
+        if (!answer.workspaceId) {
+            log.warn("Cancelled.");
+            return;
+        }
+        ws = res.matches.find((m) => m.workspaceId === answer.workspaceId);
+    }
+    else {
+        ws = res.ws;
+    }
+    const cat = await buildMarketCatalog();
+    let slug = opts.slug;
+    let note;
+    if (!slug && ws.packageSlug) {
+        slug = ws.packageSlug;
+        note = "its existing attachment";
+    }
+    if (!slug) {
+        const suggestion = suggestTemplateFor(ws, cat.entries);
+        if (suggestion) {
+            if (opts.yes) {
+                // Script path: --yes accepts the suggestion (any confidence) — the ONLY
+                // way a suggestion attaches without an interactive confirm.
+                slug = suggestion.slug;
+                note = `it looks like a ${suggestion.slug} workspace`;
+            }
+            else if (process.stdout.isTTY && !opts.json) {
+                // Interactive: NEVER silent-attach — always confirm (a strong match just
+                // defaults the prompt to yes). Attaching reconciles a template onto a
+                // real workspace; that write must be consented to, not inferred.
+                const answer = await prompts({
+                    type: "confirm",
+                    name: "ok",
+                    message: `"${ws.workspaceName}" looks like the ${chalk.cyan(suggestion.slug)} template (${suggestion.confidence} match). Attach it?`,
+                    initial: suggestion.confidence === "strong",
+                });
+                if (!answer.ok) {
+                    log.warn(`Cancelled. Pick another: synap templates attach "${ws.workspaceName}" --slug <slug>`);
+                    return;
+                }
+                slug = suggestion.slug;
+            }
+            else {
+                // Non-interactive without --yes: don't write on a guess. Surface the
+                // suggestion + how to accept it, and fail (so a script doesn't proceed
+                // thinking it attached).
+                if (opts.json) {
+                    console.log(JSON.stringify({ error: "suggestion-needs-confirmation", workspaceId: ws.workspaceId, suggestedSlug: suggestion.slug, confidence: suggestion.confidence, hint: "re-run with --yes to accept, or --slug <slug>" }, null, 2));
+                }
+                else {
+                    log.warn(`"${ws.workspaceName}" looks like the ${chalk.cyan(suggestion.slug)} template (${suggestion.confidence}). Not attaching without confirmation.`);
+                    log.hint(`Accept it: synap templates attach "${ws.workspaceName}" --yes   ·   or pick: --slug <slug>`);
+                }
+                process.exitCode = 1;
+                return;
+            }
+        }
+    }
+    if (!slug) {
+        if (opts.json) {
+            console.log(JSON.stringify({ error: "no-template-match", workspaceId: ws.workspaceId, name: ws.workspaceName }, null, 2));
+            process.exitCode = 1;
+            return;
+        }
+        log.error(`Couldn't tell which template fits "${ws.workspaceName}".`);
+        const templates = cat.entries.filter((e) => typeOf(e) === "workspace").slice(0, 15);
+        if (templates.length > 0) {
+            log.hint("Available templates:");
+            for (const e of templates) {
+                console.log("    " + chalk.cyan(e.slug.padEnd(28)) + chalk.dim(e.name));
+            }
+        }
+        log.hint(`Re-run with: synap templates attach "${ws.workspaceName}" --slug <slug>`);
+        process.exit(1);
+    }
+    if (!opts.json && note)
+        log.info(`Attaching ${chalk.cyan(slug)} — ${note}.`);
+    await marketInstall(slug, {
+        onto: ws.workspaceId,
+        project: opts.project,
+        timeout: opts.timeout,
+        json: opts.json,
+        podUrl: opts.podUrl,
+        apiKey: opts.apiKey,
+    });
 }
 //# sourceMappingURL=market.js.map