@synap-core/cli 1.12.2 → 1.13.1-next.20261102.246dc73

package/dist/commands/market.js

@@ -32,13 +32,15 @@ import { renderNextSteps, FLOW } from "../lib/next-steps.js";
 import { getStoredToken, isTokenLocallyExpired } from "../lib/auth.js";
 import prompts from "prompts";
 import { fetchPublicBrowseRows, fetchMyRows, fetchAvailableSlugs, fetchRetiredWorkspaceSlugs, fetchPackageDefinition, fetchPackageRecord, hydrateMineCategories, } from "../lib/cp-packages.js";
-import { fetchInstalledSlugs, fetchInstalledTemplates, fetchInstalledInventory, fetchInstalledInventoryStrict, installedRowsToTemplates, fetchWorkspaceAttachments, fetchWorkspaceAttachmentsStrict, verifyStampLanded, INSTALLED_KINDS } from "../lib/installed.js";
+import { fetchInstalledSlugs, fetchInstalledTemplates, fetchInstalledInventory, installedRowsToTemplates, fetchWorkspaceAttachments, fetchWorkspaceAttachmentsStrict, verifyStampLanded, INSTALLED_KINDS } from "../lib/installed.js";
 import { isSuite } from "../lib/suite.js";
 import { TEMPLATE_STEP_LABELS, classifyTemplateStep, proposalsDoor, stepFromApplyState, templateStepGlyph, templateStepPhrase, } from "../lib/template-steps.js";
 import { capabilityAdd } from "./capability.js";
 import { bundledTemplatesVersion } from "../lib/bundle-version.js";
 import { HubNetworkError } from "../lib/hub-client.js";
-import { parseDataChanges, dataChangesFromRefusal, consentNeedsPerson, dataChangeRefusalMessage, printDataChanges, parseAcceptList, decideConsent, consentRerunCommand, consentRefusalLines, lifecycleNotice, overlayNotice, overlayNeedsAttention, } from "../lib/template-lifecycle.js";
+import { checksFromStandings, fetchPackageStandings, StandingsUnavailableError, } from "../lib/package-updates.js";
+import { podAdminOrigin } from "../lib/safe-open.js";
+import { parseDataChanges, printDataChanges, parseAcceptList, decideConsent, consentRerunCommand, lifecycleNotice, overlayNotice, overlayNeedsAttention, } from "../lib/template-lifecycle.js";
 // Same longer budget launch uses — an apply writes profiles/views/entities.
 const APPLY_TIMEOUT_MS = 120_000;
 /** `--timeout <seconds>` → ms, falling back to `APPLY_TIMEOUT_MS` when unset/invalid. */
@@ -167,8 +169,8 @@ const KIND_HEADINGS = {
     // (`GET /installed`) calls the same thing `automation`. Both tokens reach
     // `kindHeading()` — `market --list` speaks CP, `market installed` speaks pod —
     // so both are mapped, to the ONE plural the registry says.
-    workflow: "Rules",
-    automation: "Rules",
+    workflow: "Automations",
+    automation: "Automations",
     view: "Views",
     cell: "Cards",
     workspace: "Spaces",
@@ -383,8 +385,8 @@ function printSeedOutcomes(dependencies, seedSummary) {
         log.hint(`${d.slug}: failed${d.seedOutcome.error ? ` (${d.seedOutcome.error})` : ""}`);
     }
 }
-// ── Apply-outcome honesty — shared by `marketInstall` + `applyOnePackage` ───
-// Both hit the same `/packages/apply` door and must render the SAME honest
+// ── Apply-outcome honesty — `marketInstall`'s reading of `/packages/apply` ───
+// Every install reads the same `/packages/apply` answer and must render the SAME honest
 // verdict from its response: a partial capability-seed failure, a version
 // stamp that silently didn't take, or a compose-overlay result are never a
 // plain "✓ success" — in the human text OR in `--json`.
@@ -437,8 +439,8 @@ export function podApplyState(res) {
     return null;
 }
 /**
- * The verdict of one `/packages/apply` response — the ONE reader both
- * `marketInstall` and `applyOnePackage` call. Layer 2's outcome comes from the
+ * The verdict of one `/packages/apply` response — the ONE reader
+ * `marketInstall` calls. Layer 2's outcome comes from the
  * pod's own state (`podApplyState`): an apply the pod says is unfinished is
  * never "updated", and never a stamp contradiction (the pod held the version
  * on purpose — redeploying fixes nothing).
@@ -457,12 +459,11 @@ export function classifyApplyResponse(entry, res, ctx) {
     return classifyApplyResult(entry, res.workspace, res.dependencies, res.seedSummary, ctx);
 }
 /**
- * Classify one `/packages/apply` response into the honest verdict both
- * `marketInstall` and `applyOnePackage` print (and both put in `--json`).
+ * Classify one `/packages/apply` response into the honest verdict
+ * `marketInstall` prints (and puts in `--json`).
  * `wasUnstamped` = the slug was already installed with no recorded version
  * BEFORE this call (only `marketInstall` can detect this today — see its
- * `fetchInstalledTemplates` call; `applyOnePackage` only ever re-applies
- * already-versioned slugs, so it always passes `false`).
+ * `fetchInstalledTemplates` call).
  */
 export function classifyApplyResult(entry, ws, dependencies, seedSummary, ctx) {
     // A post-workspace LAYER failure counts the same as a seed failure: the
@@ -517,7 +518,7 @@ export function deferredPlacementLines(res) {
 export function heldVersionLine(res) {
     return typeof res.templateApplyWarning === "string" ? res.templateApplyWarning : null;
 }
-/** Render a `classifyApplyResult` verdict — the ONE honest-text door for both `marketInstall` and `applyOnePackage`. */
+/** Render a `classifyApplyResult` verdict — the ONE honest-text door of `marketInstall`. */
 export function printApplyVerdict(entry, verdict) {
     switch (verdict.status) {
         case "installed":
@@ -1260,17 +1261,50 @@ function stampVersion(pkg, slug, version) {
     const meta = pkg._meta ?? {};
     return { ...pkg, _meta: { ...meta, slug, ...(version ? { version } : {}) } };
 }
-export function updateDoorFor(kind) {
-    switch (kind ?? "workspace") {
-        case "workspace":
-            return "packages-apply";
-        case "view":
-        case "skill":
-        case "automation":
-            return "configs-reconcile";
-        default:
-            return null;
+/**
+ * The slugs with an update that `synap market update <slug>` can apply. Every
+ * installed kind (space, capability, view, skill, automation) updates through
+ * the pod's ONE update door (`POST /package-updates/{slug}/apply`), so every
+ * slug with an update is offered; what only the person can do is said by the
+ * pod at apply time (`NEEDS_PERSON`), never guessed here. Next-step
+ * suggestions use it.
+ */
+export function cliUpdatableSlugs(checks) {
+    return checks.filter((c) => c.updateAvailable).map((c) => c.slug);
+}
+/** The status of an update left for the person to apply in pod admin (not a failure). */
+export const APPLY_IN_POD_ADMIN = "apply-in-pod-admin";
+/**
+ * Where the person finishes ONE package's update: pod admin's review page for
+ * it (`/marketplace/updates/<slug>`), when the pod-admin origin derives from
+ * the pod's; else the pod's own link (`reviewUrl`, pod-relative
+ * `/open/update/<slug>`, which the pod sends on to pod admin); else the
+ * Updates tab's words.
+ */
+export function packageReviewLink(podUrl, slug, reviewUrl) {
+    const admin = podAdminOrigin(podUrl);
+    if (admin)
+        return `${admin}/marketplace/updates/${encodeURIComponent(slug)}`;
+    if (typeof reviewUrl === "string" && reviewUrl.startsWith("/"))
+        return `${podUrl.replace(/\/+$/, "")}${reviewUrl}`;
+    if (typeof reviewUrl === "string" && /^https?:\/\//.test(reviewUrl))
+        return reviewUrl;
+    return undefined;
+}
+/** The one row for an update only the person can finish: on pod admin, not a failure. */
+function applyInPodAdminResult(c, podUrl, json, pod = {}) {
+    const link = podUrl ? packageReviewLink(podUrl, c.slug, pod.reviewUrl) : undefined;
+    if (!json) {
+        log.warn(`${c.slug} is a ${c.kind ?? "workspace"} — to apply in pod admin${pod.why ? `: ${pod.why}` : "."} Nothing was written.`);
+        log.hint(link ? `Apply it yourself: ${link}` : podUrl ? marketUpdatesDoor(podUrl) : "Apply it yourself from pod admin → Marketplace → Updates.");
     }
+    return {
+        slug: c.slug,
+        outcome: APPLY_IN_POD_ADMIN,
+        status: APPLY_IN_POD_ADMIN,
+        warnings: [],
+        ...(link ? { reviewUrl: link } : {}),
+    };
 }
 /**
  * Per-installed-slug drift check. SERVER-FIRST: when the pod runs the
@@ -1335,113 +1369,137 @@ export function dedupeBySlug(checks) {
     const seen = new Set();
     return checks.filter((c) => (seen.has(c.slug) ? false : (seen.add(c.slug), true)));
 }
+/** The pod's typed refusals of an update (`services/package-updates/refusals.ts`). */
+const NEEDS_THE_PERSON = new Set(["NEEDS_PERSON", "CHOICES_NEEDED"]);
 /**
- * Apply one package via the SAME door `marketInstall` uses
- * (`POST /packages/apply`) — for an already-installed slug this re-runs the
- * pod's idempotent-create path, which reconciles when the pod build supports
- * it (see the `applyOnePackage` caveat below for what "created" means here).
+ * Apply ONE installed package's update through the pod's ONE update door,
+ * `POST /package-updates/{slug}/apply`, whatever its kind (space, capability,
+ * view, skill, automation) and whoever holds the key. The pod applies the
+ * rule (backend `services/package-updates/`): a person's apply lands; an
+ * agent key's is filed for the person's approval (`proposed`) and lands when
+ * they approve it; what only the person can do (agree to changes to existing
+ * records, choose for a field both sides changed, change a view) is
+ * `NEEDS_PERSON` / `CHOICES_NEEDED` with that package's review page. An
+ * older pod that refuses an agent here (403, no `reasonCode`) keeps today's
+ * line: to apply in pod admin.
  */
-async function applyOnePackage(entry, cat, cfg, opts, applyTimeoutMs = APPLY_TIMEOUT_MS, extra = {}) {
-    if (cat.lockedSlugs.has(entry.slug)) {
-        const tier = cat.tierBySlug.get(entry.slug)?.requiredTier;
+export async function applyUpdateThroughDoor(c, cfg, opts, applyTimeoutMs = APPLY_TIMEOUT_MS, acceptDataChanges = []) {
+    if (!c.latestVersion) {
+        const error = "the pod named no catalog version to update to";
         if (!opts.json)
-            log.warn(`"${entry.name}" requires the ${tier ?? "a higher"} tier — skipping.`);
-        return { slug: entry.slug, outcome: "locked", status: "locked", warnings: [] };
-    }
-    const cpToken = getStoredToken()?.token;
-    // Same honest payload as `marketInstall` (see `resolveInstallPayload`).
-    const payload = extra.payload !== undefined ? extra.payload : await resolveInstallPayload(entry.slug, cat, cpToken);
-    if (!payload) {
-        if (!opts.json) {
-            log.error(`Couldn't fetch "${entry.name}"'s definition from the control plane.`);
-            if (!cat.loggedIn)
-                log.hint("It may be private — try: synap login");
-        }
-        return { slug: entry.slug, outcome: "fetch-failed", status: "fetch-failed", warnings: [] };
+            log.error(`${c.slug} not updated — ${error}.`);
+        return { slug: c.slug, outcome: "failed", status: "failed", warnings: [], error };
     }
-    const pkg = extra.acceptDataChanges && extra.acceptDataChanges.length > 0
-        ? { ...payload.pkg, acceptDataChanges: extra.acceptDataChanges }
-        : payload.pkg;
-    const s = opts.json ? null : ora(`Updating ${entry.name}…`).start();
+    const body = {
+        expectedVersion: c.latestVersion,
+        choices: {},
+        ...(acceptDataChanges.length > 0 ? { acceptDataChanges } : {}),
+    };
+    const s = opts.json ? null : ora(`Updating ${c.slug}…`).start();
     try {
-        const res = (await hubPost("/packages/apply", pkg, cfg, applyTimeoutMs));
+        const res = (await hubPost(`/package-updates/${encodeURIComponent(c.slug)}/apply`, body, cfg, applyTimeoutMs));
         s?.stop();
-        if (writeGovernance(res) === "proposed") {
-            const proposalId = res.proposalId ? String(res.proposalId) : undefined;
+        if (res?.status === "proposed") {
+            const proposalIds = Array.isArray(res.proposalIds) ? res.proposalIds.map(String) : [];
+            const links = proposalIds.map((id) => approvalLink(cfg.podUrl, id, undefined) ?? `${cfg.podUrl.replace(/\/+$/, "")}/open/${encodeURIComponent(id)}`);
             if (!opts.json) {
-                log.info(`${entry.name} — update proposed (under review, not live yet).`);
-                if (proposalId)
-                    log.hint(`Review and approve: synap open proposal ${proposalId}`);
+                log.info(`${c.slug} — update filed for your approval (not applied yet).`);
+                for (const link of links)
+                    log.hint(`Approve it: ${link}`);
             }
-            return { slug: entry.slug, outcome: "proposed", status: "proposed", warnings: [] };
+            return {
+                slug: c.slug,
+                outcome: "proposed",
+                status: "proposed",
+                warnings: [],
+                ...(proposalIds[0] ? { proposalId: proposalIds[0], proposalIds } : {}),
+                ...(links[0] ? { reviewUrl: links[0] } : {}),
+            };
         }
-        const ws = res.workspace;
-        const dependencies = res.dependencies;
-        const seedSummary = res.seedSummary;
-        // `wasUnstamped: false` — `applyOnePackage` is only ever reached (from
-        // `marketUpdate`) for a slug that already had `updateAvailable: true`,
-        // which by construction means it already carried a recorded version. The
-        // stamp-contradiction check is therefore a no-op here by design; it's
-        // `marketInstall`'s job to catch it on a first-time/unstamped install.
-        const verdict = classifyApplyResponse(entry, res, {
-            remoteVersionSent: payload.catalogVersion,
-            wasUnstamped: false,
-        });
-        if (!opts.json) {
-            printApplyVerdict(entry, verdict);
-            printSeedOutcomes(dependencies, seedSummary);
-            printLayerOutcomes(ws?.layers);
-            for (const line of deferredPlacementLines(res))
-                log.info(line);
+        if (res?.status === "applied") {
+            const warning = typeof res.warning === "string" && res.warning ? res.warning : undefined;
+            const receipt = res.receipt;
+            // A field update whose every field stayed yours changed nothing.
+            const unchanged = !!receipt && Array.isArray(receipt.changes) && receipt.changes.length === 0;
+            const status = warning ? "updated-with-failures" : unchanged ? "unchanged" : "updated";
+            if (!opts.json) {
+                if (warning)
+                    log.warn(`${c.slug} — updated, not finished: ${warning}`);
+                else
+                    log.success(`${c.slug} — ${status}`);
+            }
+            return { slug: c.slug, outcome: status, status, warnings: warning ? [warning] : [] };
         }
-        return {
-            slug: entry.slug,
-            outcome: ws?.outcome ?? ws?.status ?? "unknown",
-            status: verdict.status,
-            warnings: verdict.warnings,
-            dependencies,
-            seedSummary,
-        };
+        const error = "the pod answered with a result this CLI can't read — not assuming it updated";
+        if (!opts.json)
+            log.error(`${c.slug} — ${error}`);
+        return { slug: c.slug, outcome: "failed", status: "failed", warnings: [], error };
     }
     catch (e) {
         s?.stop();
-        // The pod refused: data changes are owed that the person has not agreed to.
-        // Nothing was written. Show the list and the exact command that agrees.
-        const owed = dataChangesFromRefusal(e);
-        if (owed) {
+        const refusal = e instanceof HubError ? (e.body ?? {}) : {};
+        const reasonCode = typeof refusal.reasonCode === "string" ? refusal.reasonCode : undefined;
+        const said = e instanceof HubError ? (e.detail ?? e.message) : e instanceof Error ? e.message : String(e);
+        if (reasonCode && NEEDS_THE_PERSON.has(reasonCode)) {
+            return applyInPodAdminResult(c, cfg.podUrl, opts.json, { why: said, reviewUrl: refusal.reviewUrl });
+        }
+        // An older pod refuses an agent's space or capability update here: today's line.
+        if (e instanceof HubError && e.status === 403 && !reasonCode && /\bagent\b/i.test(said)) {
+            return applyInPodAdminResult(c, cfg.podUrl, opts.json);
+        }
+        if (reasonCode === "INVALID_CATALOG_DEFINITION") {
+            const fieldErrors = (refusal.fieldErrors ?? undefined);
             if (!opts.json) {
-                const said = consentRefusalLines(entry.name, entry.slug, owed, consentNeedsPerson(e));
-                log.warn(said.warn);
-                printDataChanges(entry.slug, owed);
-                for (const hint of said.hints)
-                    log.hint(hint);
+                log.error(`${c.slug} not updated — ${said}`);
+                for (const [field, messages] of Object.entries(fieldErrors ?? {}))
+                    log.dim(`  ${field || "(the definition)"}: ${messages.join("; ")}`);
             }
             return {
-                slug: entry.slug,
-                outcome: "needs-consent",
-                status: "needs-consent",
+                slug: c.slug,
+                outcome: "failed",
+                status: "failed",
                 warnings: [],
-                pendingDataChanges: owed,
+                error: said,
+                ...(fieldErrors ? { fieldErrors } : {}),
             };
         }
         const timedOut = e instanceof HubNetworkError && e.code === "TIMEOUT";
-        const refusal = dataChangeRefusalMessage(e);
         if (!opts.json) {
-            log.error(`${entry.name} update failed`);
-            if (refusal)
-                log.warn(refusal);
-            else
-                renderHubError(e);
+            log.error(`${c.slug} update failed`);
+            renderHubError(e, { personDoor: marketUpdatesDoor(cfg.podUrl) });
         }
         return {
-            slug: entry.slug,
+            slug: c.slug,
             outcome: timedOut ? "timed-out" : "failed",
             status: timedOut ? "timed-out" : "failed",
             warnings: [],
-            error: e instanceof Error ? e.message : String(e),
+            error: said,
         };
     }
 }
+/**
+ * Where the person approves a filed update: pod admin's proposal page, the
+ * approval door (`/proposal/<id>`), when the pod-admin origin derives from the
+ * pod's; else the link the pod sent (`reviewUrl`); else nothing.
+ */
+export function approvalLink(podUrl, proposalId, reviewUrl) {
+    const admin = podAdminOrigin(podUrl);
+    if (admin && proposalId)
+        return `${admin}/proposal/${encodeURIComponent(proposalId)}`;
+    return typeof reviewUrl === "string" && reviewUrl.length > 0 ? reviewUrl : undefined;
+}
+/**
+ * Where the person applies a package update a limited key may not apply
+ * (a computer key's grant leaves out `workspace.update`, by design: applying a
+ * workspace package is the person's act). Pod admin's Marketplace, Updates
+ * tab, named by URL when the pod-admin origin derives from the pod's.
+ */
+export function marketUpdatesDoor(podUrl) {
+    const admin = podAdminOrigin(podUrl);
+    return admin
+        ? `Apply it yourself from pod admin → Marketplace → Updates: ${admin}/marketplace/updates`
+        : "Apply it yourself from pod admin → Marketplace → Updates.";
+}
 /**
  * Ask the pod's write-free preview door (`POST /packages/preflight`, the same
  * body `/packages/apply` takes) which data changes an update would run.
@@ -1459,76 +1517,30 @@ async function previewDataChanges(entry, cat, cfg) {
         return { payload, error: `the pod's preview failed: ${status}` };
     }
 }
-/** One slug's outcome out of the shared pod-wide config reconcile. */
-async function reconcileOutcome(c, report, opts) {
-    let r;
-    try {
-        r = await report;
-    }
-    catch (e) {
-        if (!opts.json) {
-            log.error(`${c.slug} update failed`);
-            renderHubError(e);
-        }
-        return { slug: c.slug, outcome: "failed", status: "failed", warnings: [], error: e instanceof Error ? e.message : String(e) };
-    }
-    // A report this CLI cannot read is a FAILED read — never "up to date".
-    const lists = [r?.updated, r?.ownerOwnedSkipped, r?.skipped, r?.conflicts];
-    if (!lists.some(Array.isArray) || lists.some((l) => l !== undefined && !Array.isArray(l))) {
-        const error = "the pod's reconcile answered with a report this CLI can't read — not assuming it updated";
-        if (!opts.json)
-            log.error(`${c.slug} — ${error}`);
-        return { slug: c.slug, outcome: "failed", status: "failed", warnings: [], error };
-    }
-    const mine = (rows) => (rows ?? []).filter((e) => e.packageSlug === c.slug);
-    const conflicts = mine(r.conflicts);
-    const owned = mine(r.ownerOwnedSkipped);
-    const updated = mine(r.updated);
-    const warnings = owned.map((e) => `${e.name}: kept your edits — ${e.reason}`);
-    if (conflicts.length > 0) {
-        const error = conflicts.map((e) => `${e.name}: ${e.reason}`).join("; ");
-        if (!opts.json)
-            log.error(`${c.slug} update failed — ${error}`);
-        return { slug: c.slug, outcome: "failed", status: updated.length > 0 ? "updated-with-failures" : "failed", warnings, error };
-    }
-    if (!opts.json)
-        for (const w of warnings)
-            log.warn(`${c.slug} — ${w}`);
-    if (updated.length > 0 || owned.length > 0) {
-        // Every field it could advance did; a field you edited stays yours (warned above).
-        const status = updated.length > 0 ? "updated" : "unchanged";
-        if (!opts.json)
-            log.success(`${c.slug} — ${status}`);
-        return { slug: c.slug, outcome: status, status, warnings };
-    }
-    // Skipped (cache miss, unresolved definition…) or not reported at all: NOT updated — never "current".
-    const error = mine(r.skipped).map((e) => `${e.name}: ${e.reason}`).join("; ") || "the pod's reconcile did not report this package";
-    if (!opts.json)
-        log.warn(`${c.slug} was not updated — ${error}`);
-    return { slug: c.slug, outcome: "not-updated", status: "not-updated", warnings, error };
-}
 export async function marketUpdate(slugsArg, opts) {
     const applyTimeoutMs = parseApplyTimeoutMs(opts.timeout);
-    // STRICT fetch: distinguish "pod unreachable" (transient — don't claim the
-    // pod is empty, that reads as data loss) from "genuinely nothing installed".
     const cat = await buildMarketCatalog();
-    let installedTemplates;
-    // Whether the pod answered from the ONE read door (`GET /installed`, all six
-    // kinds) or is old enough that only workspace packages were visible. An old
-    // pod is not an empty pod — say which, rather than letting a narrower list
-    // read as the whole truth.
-    let degraded = false;
+    // THE POD'S ANSWER, never the CLI's: which installed package has an update
+    // is derived once on the pod, for every kind, with one rule (Hub
+    // `GET /package-updates` → `installed[]`), and pod admin's Updates tab reads
+    // the same list. A pod that cannot answer is said out loud, never replaced
+    // by a verdict computed here (that fork is how the CLI said "content
+    // changed" while pod admin said nothing, 2 Nov 2026).
+    let standings;
     try {
-        const inv = await fetchInstalledInventoryStrict();
-        installedTemplates = installedRowsToTemplates(inv.rows);
-        degraded = inv.degraded;
+        standings = await fetchPackageStandings(await resolveHubConfig(opts));
     }
     catch (e) {
         // Unreachable ≠ success — a script checking `$?` (or `&&`-chaining) must see
         // failure, not exit 0, even though the JSON payload also carries the reason.
         process.exitCode = 1;
+        const unavailable = e instanceof StandingsUnavailableError ? e.reason : null;
         if (opts.json) {
-            console.log(JSON.stringify({ checks: [], loggedIn: cat.loggedIn, error: "pod-unreachable" }, null, 2));
+            console.log(JSON.stringify({ checks: [], loggedIn: cat.loggedIn, error: unavailable ?? "pod-unreachable" }, null, 2));
+            return;
+        }
+        if (e instanceof StandingsUnavailableError) {
+            log.error(e.message);
             return;
         }
         log.error("Couldn't reach your pod to read what's installed — not saying it's empty.");
@@ -1536,26 +1548,21 @@ export async function marketUpdate(slugsArg, opts) {
         log.hint("Check the pod is up / you're on the right --pod, then retry.");
         return;
     }
-    const degradedNote = degraded
-        ? "This pod does not serve GET /api/hub/installed — only workspace packages were checked. Capability / view / skill / automation / card installs were NOT (upgrade the pod to include them)."
-        : undefined;
-    if (installedTemplates.length === 0) {
+    // Kept in the JSON for readers of the older shape: the pod's list covers
+    // every kind, so it is never the workspace-only view of an old pod.
+    const degraded = false;
+    if (standings.length === 0) {
         if (opts.json) {
-            console.log(JSON.stringify({ checks: [], loggedIn: cat.loggedIn, degraded, ...(degradedNote ? { degradedNote } : {}) }, null, 2));
+            console.log(JSON.stringify({ checks: [], loggedIn: cat.loggedIn, degraded }, null, 2));
             return;
         }
         log.warn("No installed packages found on this pod.");
-        if (degradedNote)
-            log.dim(degradedNote);
         log.hint("Install one: synap market install <slug>");
         return;
     }
-    // ONE ROW PER SLUG. `GET /installed` reports one row per installed OBJECT —
-    // a views pack that installed four views is four rows — and an update is
-    // applied per PACKAGE, not per object. Without this the preview listed
-    // `task-views-pack` four times and the "N up to date" tally counted it four
-    // times. `market installed` has always deduped the same way.
-    let checks = dedupeBySlug(computeUpdates(installedTemplates, cat));
+    // One check per slug: the pod answers per package (slug + kind); a slug
+    // installed as two kinds is updated per kind by its own door, but listed once.
+    let checks = dedupeBySlug(checksFromStandings(standings));
     const entryBySlug = new Map(cat.entries.map((e) => [e.slug, e]));
     const explicitSlugs = !!slugsArg && slugsArg.length > 0;
     let unknownSlugs = [];
@@ -1622,8 +1629,9 @@ export async function marketUpdate(slugsArg, opts) {
             process.exit(1);
         }
         for (const c of withUpdates) {
-            // The data-change preview is the workspace door's (`/packages/preflight`).
-            if (updateDoorFor(c.kind) !== "packages-apply")
+            // Only a space's update changes existing records: the preview of its
+            // data changes is the template door's (`/packages/preflight`).
+            if ((c.kind ?? "workspace") !== "workspace")
                 continue;
             const entry = entryBySlug.get(c.slug);
             if (entry)
@@ -1663,6 +1671,8 @@ export async function marketUpdate(slugsArg, opts) {
         }
         log.heading("  Installed packages");
         log.blank();
+        // The slug column fits the longest slug (capped), with at least 2 spaces after it.
+        const slugW = Math.min(Math.max(28, ...checks.map((c) => c.slug.length + 2)), 46);
         for (const c of checks) {
             // ONE label door. This was a hand-rolled second copy that diverged from
             // `installedStatusLabel` in two ways that both LIED: it had no cache-cold
@@ -1673,14 +1683,12 @@ export async function marketUpdate(slugsArg, opts) {
             const label = retiredSlugs.has(c.slug)
                 ? chalk.yellow("retired") + chalk.dim(` · synap templates retire ${c.slug}`)
                 : installedStatusLabel(c, entryBySlug.get(c.slug)?.isPrivate ?? false, cat.loggedIn);
-            console.log("    " + chalk.cyan(c.slug.padEnd(28)) + label);
+            console.log("    " + chalk.cyan(clip(c.slug, slugW - 2).padEnd(slugW)) + label);
         }
         log.blank();
         if (noVersionInfo.length > 0) {
             log.dim(`${noVersionInfo.length} installed without a version stamp — can't check ${noVersionInfo.length === 1 ? "it" : "them"} for updates.`);
         }
-        if (degradedNote)
-            log.dim(degradedNote);
     }
     // What the JSON carries for the new facts: per slug, the pod's data changes
     // (`null` = this pod sent none: an older pod) and the template lifecycle.
@@ -1722,7 +1730,9 @@ export async function marketUpdate(slugsArg, opts) {
         return;
     }
     if (!shouldApply) {
-        const steps = FLOW.afterMarketUpdateCheck(withUpdates.map((c) => c.slug));
+        // Every update applies through the pod's one update door, so every one
+        // is offered; what only the person can do is said when it is applied.
+        const steps = FLOW.afterMarketUpdateCheck(cliUpdatableSlugs(withUpdates));
         if (opts.json) {
             console.log(JSON.stringify({
                 checks,
@@ -1744,31 +1754,7 @@ export async function marketUpdate(slugsArg, opts) {
     }
     const acceptList = parseAcceptList(opts.acceptDataChanges);
     const results = [];
-    // One pod-wide reconcile serves every view/skill/automation update — run it
-    // at most once, lazily, and read each slug's outcome from its report.
-    let configsReport;
     for (const c of withUpdates) {
-        const door = updateDoorFor(c.kind);
-        if (door === null) {
-            if (!opts.json)
-                log.warn(`${c.slug} is a ${c.kind} — the pod has no per-package update for this kind, so it was not updated. Nothing was written.`);
-            results.push({ slug: c.slug, outcome: "no-updater", status: "no-updater", warnings: [] });
-            continue;
-        }
-        if (door === "configs-reconcile") {
-            configsReport ??= hubPost("/configs/reconcile", {}, cfg, applyTimeoutMs);
-            results.push(await reconcileOutcome(c, configsReport, { json: opts.json }));
-            continue;
-        }
-        const entry = entryBySlug.get(c.slug);
-        if (!entry) {
-            // Absent from the catalog THIS CLI read — not proof it left the catalog
-            // (that is the pod's `unlisted`, shown above, and only after a complete sync).
-            if (!opts.json)
-                log.warn(`Couldn't find "${c.slug}" in the catalog read just now — skipping.`);
-            results.push({ slug: c.slug, outcome: "not-in-catalog", status: "not-in-catalog", warnings: [] });
-            continue;
-        }
         const pv = previews.get(c.slug);
         const pending = pv?.changes ?? [];
         let accepted = [];
@@ -1793,17 +1779,14 @@ export async function marketUpdate(slugsArg, opts) {
             }
             if (missing.length > 0) {
                 if (!opts.json) {
-                    log.warn(`${entry.name} not updated: you have not agreed to its data changes. Nothing was written.`);
+                    log.warn(`${c.slug} not updated: you have not agreed to its data changes. Nothing was written.`);
                     log.hint(`To agree and update: ${consentRerunCommand(c.slug, missing)}`);
                 }
                 results.push({ slug: c.slug, outcome: "needs-consent", status: "needs-consent", warnings: [], pendingDataChanges: missing });
                 continue;
             }
         }
-        results.push(await applyOnePackage(entry, cat, cfg, { json: opts.json }, applyTimeoutMs, {
-            payload: pv?.payload,
-            acceptDataChanges: accepted,
-        }));
+        results.push(await applyUpdateThroughDoor(c, cfg, { json: opts.json }, applyTimeoutMs, accepted));
     }
     if (results.some((r) => r.status === "needs-consent"))
         process.exitCode = 1;
@@ -1827,16 +1810,18 @@ export async function marketUpdate(slugsArg, opts) {
     renderNextSteps(steps);
 }
 /**
- * One-line rollup over a batch of `applyOnePackage` outcomes — computed from
- * the SAME per-item `status` (`classifyApplyResult`'s honest verdict) the
+ * One-line rollup over a batch of update outcomes (`applyUpdateThroughDoor`) — computed from
+ * the SAME per-item `status` the
  * loop already collects, not a separate tally. `"installed"`/`"updated"`/
  * `"composed"`/`"legacy-unknown"` count as a clean update, `"unchanged"` as
  * already-current, the `*-with-failures` and `"stamp-contradiction"` statuses
  * get their OWN bucket — a partial capability-seed failure or a stamp that
  * silently didn't take is never folded into a clean "updated" count.
- * `"timed-out"` is broken out from the generic `"failed"` bucket; everything
- * else (locked/proposed/fetch-failed/not-in-catalog/no-workspace/unknown)
- * rolls into "failed".
+ * `"timed-out"` is broken out from the generic `"failed"` bucket;
+ * `"proposed"`/`"awaiting-approval"` count as waiting for the person's
+ * approval (never failed); everything else
+ * (locked/fetch-failed/not-in-catalog/no-workspace/unknown) rolls into
+ * "failed".
  */
 export function summarizeApplyResults(results) {
     let updated = 0;
@@ -1846,6 +1831,7 @@ export function summarizeApplyResults(results) {
     let failed = 0;
     let proposed = 0;
     let needsConsent = 0;
+    let toApplyInPodAdmin = 0;
     for (const r of results) {
         switch (r.status) {
             case "installed":
@@ -1880,17 +1866,23 @@ export function summarizeApplyResults(results) {
             case "needs-consent":
                 needsConsent++;
                 break;
+            // The person's act (pod admin → Marketplace → Updates): nothing failed.
+            case APPLY_IN_POD_ADMIN:
+                toApplyInPodAdmin++;
+                break;
             default:
                 failed++;
         }
     }
     const parts = [`${updated} updated`, `${unchanged} already current`];
     if (proposed > 0)
-        parts.push(`${proposed} proposed (awaiting review)`);
+        parts.push(`${proposed} waiting for your approval`);
     // The vocabulary's `unfinished` ("Not finished"): one state, one name on
     // every surface — never "completed with failures" (review2 UX §1 #2).
     if (withFailures > 0)
         parts.push(`${withFailures} ${templateStepPhrase("unfinished")}`);
+    if (toApplyInPodAdmin > 0)
+        parts.push(`${toApplyInPodAdmin} to apply in pod admin`);
     if (failed > 0)
         parts.push(`${failed} failed`);
     if (timedOut > 0)
@@ -1899,9 +1891,9 @@ export function summarizeApplyResults(results) {
         parts.push(`${needsConsent} waiting for your agreement to data changes`);
     const clean = withFailures === 0 && failed === 0 && timedOut === 0 && needsConsent === 0;
     // Proposed isn't a failure (never ⚠) but isn't live yet (not a bare ✓) —
-    // a distinct "→ awaiting review" marker keeps the summary honest.
-    const marker = !clean ? "⚠" : proposed > 0 ? "→" : "✓";
-    const color = !clean ? chalk.yellow : proposed > 0 ? chalk.cyan : chalk.green;
+    // a distinct "→ waiting for your approval" marker keeps the summary honest.
+    const marker = !clean ? "⚠" : proposed > 0 || toApplyInPodAdmin > 0 ? "→" : "✓";
+    const color = !clean ? chalk.yellow : proposed > 0 || toApplyInPodAdmin > 0 ? chalk.cyan : chalk.green;
     return {
         updated,
         unchanged,
@@ -1910,6 +1902,7 @@ export function summarizeApplyResults(results) {
         timedOut,
         proposed,
         needsConsent,
+        toApplyInPodAdmin,
         line: color(`${marker} ${parts.join(" · ")}`),
     };
 }
@@ -2389,7 +2382,7 @@ export async function marketInstalled(opts) {
     const entryBySlug = new Map(cat.entries.map((e) => [e.slug, e]));
     if (opts.layers) {
         const graph = await buildInstallationGraph(installedTemplates, cat, checks);
-        const steps = FLOW.afterMarketInstalledCheck(rows.filter((c) => c.updateAvailable).map((c) => c.slug));
+        const steps = FLOW.afterMarketInstalledCheck(cliUpdatableSlugs(rows));
         if (opts.json) {
             console.log(JSON.stringify({
                 nodes: [...graph.nodes.values()],
@@ -2416,7 +2409,7 @@ export async function marketInstalled(opts) {
     }
     if (opts.tree) {
         const { packages, leafRows } = await buildCompositionTrees(rows, cat, installedTemplates, workspaceCountBySlug);
-        const steps = FLOW.afterMarketInstalledCheck(rows.filter((c) => c.updateAvailable).map((c) => c.slug));
+        const steps = FLOW.afterMarketInstalledCheck(cliUpdatableSlugs(rows));
         if (opts.json) {
             console.log(JSON.stringify({
                 packages,
@@ -2476,7 +2469,7 @@ export async function marketInstalled(opts) {
         return;
     }
     if (opts.json) {
-        const steps = FLOW.afterMarketInstalledCheck(rows.filter((c) => c.updateAvailable).map((c) => c.slug));
+        const steps = FLOW.afterMarketInstalledCheck(cliUpdatableSlugs(rows));
         console.log(JSON.stringify({
             rows: rows.map((c) => {
                 const entry = entryBySlug.get(c.slug);
@@ -2594,7 +2587,7 @@ export async function marketInstalled(opts) {
         log.dim(degradedNote);
     if (!cat.loggedIn)
         log.dim("Not logged in — private template updates aren't visible. Run: synap login");
-    renderNextSteps(FLOW.afterMarketInstalledCheck(rows.filter((c) => c.updateAvailable).map((c) => c.slug)));
+    renderNextSteps(FLOW.afterMarketInstalledCheck(cliUpdatableSlugs(rows)));
 }
 /** Classify one workspace's attachment, reusing `computeUpdates`' drift verdict for the stamped case. */
 function classifyAttachment(ws, check) {