@synap-core/cli 1.13.1-next.20261102.ec3d166 → 1.13.1-next.20261102.f2ce919

package/dist/commands/market.js

@@ -40,7 +40,7 @@ import { bundledTemplatesVersion } from "../lib/bundle-version.js";
 import { HubNetworkError } from "../lib/hub-client.js";
 import { checksFromStandings, fetchPackageStandings, StandingsUnavailableError, } from "../lib/package-updates.js";
 import { podAdminOrigin } from "../lib/safe-open.js";
-import { parseDataChanges, dataChangesFromRefusal, consentNeedsPerson, dataChangeRefusalMessage, printDataChanges, parseAcceptList, decideConsent, consentRerunCommand, consentRefusalLines, lifecycleNotice, overlayNotice, overlayNeedsAttention, } from "../lib/template-lifecycle.js";
+import { parseDataChanges, printDataChanges, parseAcceptList, decideConsent, consentRerunCommand, lifecycleNotice, overlayNotice, overlayNeedsAttention, } from "../lib/template-lifecycle.js";
 // Same longer budget launch uses — an apply writes profiles/views/entities.
 const APPLY_TIMEOUT_MS = 120_000;
 /** `--timeout <seconds>` → ms, falling back to `APPLY_TIMEOUT_MS` when unset/invalid. */
@@ -385,8 +385,8 @@ function printSeedOutcomes(dependencies, seedSummary) {
         log.hint(`${d.slug}: failed${d.seedOutcome.error ? ` (${d.seedOutcome.error})` : ""}`);
     }
 }
-// ── Apply-outcome honesty — shared by `marketInstall` + `applyOnePackage` ───
-// Both hit the same `/packages/apply` door and must render the SAME honest
+// ── Apply-outcome honesty — `marketInstall`'s reading of `/packages/apply` ───
+// Every install reads the same `/packages/apply` answer and must render the SAME honest
 // verdict from its response: a partial capability-seed failure, a version
 // stamp that silently didn't take, or a compose-overlay result are never a
 // plain "✓ success" — in the human text OR in `--json`.
@@ -439,8 +439,8 @@ export function podApplyState(res) {
     return null;
 }
 /**
- * The verdict of one `/packages/apply` response — the ONE reader both
- * `marketInstall` and `applyOnePackage` call. Layer 2's outcome comes from the
+ * The verdict of one `/packages/apply` response — the ONE reader
+ * `marketInstall` calls. Layer 2's outcome comes from the
  * pod's own state (`podApplyState`): an apply the pod says is unfinished is
  * never "updated", and never a stamp contradiction (the pod held the version
  * on purpose — redeploying fixes nothing).
@@ -459,12 +459,11 @@ export function classifyApplyResponse(entry, res, ctx) {
     return classifyApplyResult(entry, res.workspace, res.dependencies, res.seedSummary, ctx);
 }
 /**
- * Classify one `/packages/apply` response into the honest verdict both
- * `marketInstall` and `applyOnePackage` print (and both put in `--json`).
+ * Classify one `/packages/apply` response into the honest verdict
+ * `marketInstall` prints (and puts in `--json`).
  * `wasUnstamped` = the slug was already installed with no recorded version
  * BEFORE this call (only `marketInstall` can detect this today — see its
- * `fetchInstalledTemplates` call; `applyOnePackage` only ever re-applies
- * already-versioned slugs, so it always passes `false`).
+ * `fetchInstalledTemplates` call).
  */
 export function classifyApplyResult(entry, ws, dependencies, seedSummary, ctx) {
     // A post-workspace LAYER failure counts the same as a seed failure: the
@@ -519,7 +518,7 @@ export function deferredPlacementLines(res) {
 export function heldVersionLine(res) {
     return typeof res.templateApplyWarning === "string" ? res.templateApplyWarning : null;
 }
-/** Render a `classifyApplyResult` verdict — the ONE honest-text door for both `marketInstall` and `applyOnePackage`. */
+/** Render a `classifyApplyResult` verdict — the ONE honest-text door of `marketInstall`. */
 export function printApplyVerdict(entry, verdict) {
     switch (verdict.status) {
         case "installed":
@@ -1263,24 +1262,49 @@ function stampVersion(pkg, slug, version) {
     return { ...pkg, _meta: { ...meta, slug, ...(version ? { version } : {}) } };
 }
 /**
- * The slugs with an update that `synap market update <slug>` can apply (a
- * kind with a CLI updater). Next-step suggestions use it, so they never offer
- * a command that would only refuse.
+ * The slugs with an update that `synap market update <slug>` can apply. Every
+ * installed kind (space, capability, view, skill, automation) updates through
+ * the pod's ONE update door (`POST /package-updates/{slug}/apply`), so every
+ * slug with an update is offered; what only the person can do is said by the
+ * pod at apply time (`NEEDS_PERSON`), never guessed here. Next-step
+ * suggestions use it.
  */
 export function cliUpdatableSlugs(checks) {
-    return checks.filter((c) => c.updateAvailable && updateDoorFor(c.kind) !== null).map((c) => c.slug);
+    return checks.filter((c) => c.updateAvailable).map((c) => c.slug);
 }
-export function updateDoorFor(kind) {
-    switch (kind ?? "workspace") {
-        case "workspace":
-            return "packages-apply";
-        case "view":
-        case "skill":
-        case "automation":
-            return "configs-reconcile";
-        default:
-            return null;
+/** The status of an update left for the person to apply in pod admin (not a failure). */
+export const APPLY_IN_POD_ADMIN = "apply-in-pod-admin";
+/**
+ * Where the person finishes ONE package's update: pod admin's review page for
+ * it (`/marketplace/updates/<slug>`), when the pod-admin origin derives from
+ * the pod's; else the pod's own link (`reviewUrl`, pod-relative
+ * `/open/update/<slug>`, which the pod sends on to pod admin); else the
+ * Updates tab's words.
+ */
+export function packageReviewLink(podUrl, slug, reviewUrl) {
+    const admin = podAdminOrigin(podUrl);
+    if (admin)
+        return `${admin}/marketplace/updates/${encodeURIComponent(slug)}`;
+    if (typeof reviewUrl === "string" && reviewUrl.startsWith("/"))
+        return `${podUrl.replace(/\/+$/, "")}${reviewUrl}`;
+    if (typeof reviewUrl === "string" && /^https?:\/\//.test(reviewUrl))
+        return reviewUrl;
+    return undefined;
+}
+/** The one row for an update only the person can finish: on pod admin, not a failure. */
+function applyInPodAdminResult(c, podUrl, json, pod = {}) {
+    const link = podUrl ? packageReviewLink(podUrl, c.slug, pod.reviewUrl) : undefined;
+    if (!json) {
+        log.warn(`${c.slug} is a ${c.kind ?? "workspace"} — to apply in pod admin${pod.why ? `: ${pod.why}` : "."} Nothing was written.`);
+        log.hint(link ? `Apply it yourself: ${link}` : podUrl ? marketUpdatesDoor(podUrl) : "Apply it yourself from pod admin → Marketplace → Updates.");
     }
+    return {
+        slug: c.slug,
+        outcome: APPLY_IN_POD_ADMIN,
+        status: APPLY_IN_POD_ADMIN,
+        warnings: [],
+        ...(link ? { reviewUrl: link } : {}),
+    };
 }
 /**
  * Per-installed-slug drift check. SERVER-FIRST: when the pod runs the
@@ -1345,124 +1369,111 @@ export function dedupeBySlug(checks) {
     const seen = new Set();
     return checks.filter((c) => (seen.has(c.slug) ? false : (seen.add(c.slug), true)));
 }
+/** The pod's typed refusals of an update (`services/package-updates/refusals.ts`). */
+const NEEDS_THE_PERSON = new Set(["NEEDS_PERSON", "CHOICES_NEEDED"]);
 /**
- * Apply one package via the SAME door `marketInstall` uses
- * (`POST /packages/apply`) — for an already-installed slug this re-runs the
- * pod's idempotent-create path, which reconciles when the pod build supports
- * it (see the `applyOnePackage` caveat below for what "created" means here).
+ * Apply ONE installed package's update through the pod's ONE update door,
+ * `POST /package-updates/{slug}/apply`, whatever its kind (space, capability,
+ * view, skill, automation) and whoever holds the key. The pod applies the
+ * rule (backend `services/package-updates/`): a person's apply lands; an
+ * agent key's is filed for the person's approval (`proposed`) and lands when
+ * they approve it; what only the person can do (agree to changes to existing
+ * records, choose for a field both sides changed, change a view) is
+ * `NEEDS_PERSON` / `CHOICES_NEEDED` with that package's review page. An
+ * older pod that refuses an agent here (403, no `reasonCode`) keeps today's
+ * line: to apply in pod admin.
  */
-export async function applyOnePackage(entry, cat, cfg, opts, applyTimeoutMs = APPLY_TIMEOUT_MS, extra = {}) {
-    if (cat.lockedSlugs.has(entry.slug)) {
-        const tier = cat.tierBySlug.get(entry.slug)?.requiredTier;
+export async function applyUpdateThroughDoor(c, cfg, opts, applyTimeoutMs = APPLY_TIMEOUT_MS, acceptDataChanges = []) {
+    if (!c.latestVersion) {
+        const error = "the pod named no catalog version to update to";
         if (!opts.json)
-            log.warn(`"${entry.name}" requires the ${tier ?? "a higher"} tier — skipping.`);
-        return { slug: entry.slug, outcome: "locked", status: "locked", warnings: [] };
-    }
-    const cpToken = getStoredToken()?.token;
-    // Same honest payload as `marketInstall` (see `resolveInstallPayload`).
-    const payload = extra.payload !== undefined ? extra.payload : await resolveInstallPayload(entry.slug, cat, cpToken);
-    if (!payload) {
-        if (!opts.json) {
-            log.error(`Couldn't fetch "${entry.name}"'s definition from the control plane.`);
-            if (!cat.loggedIn)
-                log.hint("It may be private — try: synap login");
-        }
-        return { slug: entry.slug, outcome: "fetch-failed", status: "fetch-failed", warnings: [] };
+            log.error(`${c.slug} not updated — ${error}.`);
+        return { slug: c.slug, outcome: "failed", status: "failed", warnings: [], error };
     }
-    const pkg = extra.acceptDataChanges && extra.acceptDataChanges.length > 0
-        ? { ...payload.pkg, acceptDataChanges: extra.acceptDataChanges }
-        : payload.pkg;
-    const s = opts.json ? null : ora(`Updating ${entry.name}…`).start();
+    const body = {
+        expectedVersion: c.latestVersion,
+        choices: {},
+        ...(acceptDataChanges.length > 0 ? { acceptDataChanges } : {}),
+    };
+    const s = opts.json ? null : ora(`Updating ${c.slug}…`).start();
     try {
-        const res = (await hubPost("/packages/apply", pkg, cfg, applyTimeoutMs));
+        const res = (await hubPost(`/package-updates/${encodeURIComponent(c.slug)}/apply`, body, cfg, applyTimeoutMs));
         s?.stop();
-        // A key that may not apply a workspace package on its own (a computer
-        // key's grant leaves out `workspace.update`) files the update for the
-        // person's approval: 202 `{status:"proposed", proposalId, reviewUrl}`.
-        // Waiting, never failed — it applies when the person approves it.
-        if (writeGovernance(res) === "proposed") {
-            const proposalId = res.proposalId ? String(res.proposalId) : undefined;
-            const reviewUrl = approvalLink(cfg.podUrl, proposalId, res.reviewUrl);
+        if (res?.status === "proposed") {
+            const proposalIds = Array.isArray(res.proposalIds) ? res.proposalIds.map(String) : [];
+            const links = proposalIds.map((id) => approvalLink(cfg.podUrl, id, undefined) ?? `${cfg.podUrl.replace(/\/+$/, "")}/open/${encodeURIComponent(id)}`);
             if (!opts.json) {
-                log.info(`${entry.name} — update filed for your approval (not applied yet).`);
-                if (reviewUrl)
-                    log.hint(`Approve it: ${reviewUrl}`);
-                else if (proposalId)
-                    log.hint(`Approve it: synap open proposal ${proposalId}`);
+                log.info(`${c.slug} — update filed for your approval (not applied yet).`);
+                for (const link of links)
+                    log.hint(`Approve it: ${link}`);
             }
             return {
-                slug: entry.slug,
+                slug: c.slug,
                 outcome: "proposed",
                 status: "proposed",
                 warnings: [],
-                ...(proposalId ? { proposalId } : {}),
-                ...(reviewUrl ? { reviewUrl } : {}),
+                ...(proposalIds[0] ? { proposalId: proposalIds[0], proposalIds } : {}),
+                ...(links[0] ? { reviewUrl: links[0] } : {}),
             };
         }
-        const ws = res.workspace;
-        const dependencies = res.dependencies;
-        const seedSummary = res.seedSummary;
-        // `wasUnstamped: false` — `applyOnePackage` is only ever reached (from
-        // `marketUpdate`) for a slug that already had `updateAvailable: true`,
-        // which by construction means it already carried a recorded version. The
-        // stamp-contradiction check is therefore a no-op here by design; it's
-        // `marketInstall`'s job to catch it on a first-time/unstamped install.
-        const verdict = classifyApplyResponse(entry, res, {
-            remoteVersionSent: payload.catalogVersion,
-            wasUnstamped: false,
-        });
-        if (!opts.json) {
-            printApplyVerdict(entry, verdict);
-            printSeedOutcomes(dependencies, seedSummary);
-            printLayerOutcomes(ws?.layers);
-            for (const line of deferredPlacementLines(res))
-                log.info(line);
+        if (res?.status === "applied") {
+            const warning = typeof res.warning === "string" && res.warning ? res.warning : undefined;
+            const receipt = res.receipt;
+            // A field update whose every field stayed yours changed nothing.
+            const unchanged = !!receipt && Array.isArray(receipt.changes) && receipt.changes.length === 0;
+            const status = warning ? "updated-with-failures" : unchanged ? "unchanged" : "updated";
+            if (!opts.json) {
+                if (warning)
+                    log.warn(`${c.slug} — updated, not finished: ${warning}`);
+                else
+                    log.success(`${c.slug} — ${status}`);
+            }
+            return { slug: c.slug, outcome: status, status, warnings: warning ? [warning] : [] };
         }
-        return {
-            slug: entry.slug,
-            outcome: ws?.outcome ?? ws?.status ?? "unknown",
-            status: verdict.status,
-            warnings: verdict.warnings,
-            dependencies,
-            seedSummary,
-        };
+        const error = "the pod answered with a result this CLI can't read — not assuming it updated";
+        if (!opts.json)
+            log.error(`${c.slug} — ${error}`);
+        return { slug: c.slug, outcome: "failed", status: "failed", warnings: [], error };
     }
     catch (e) {
         s?.stop();
-        // The pod refused: data changes are owed that the person has not agreed to.
-        // Nothing was written. Show the list and the exact command that agrees.
-        const owed = dataChangesFromRefusal(e);
-        if (owed) {
+        const refusal = e instanceof HubError ? (e.body ?? {}) : {};
+        const reasonCode = typeof refusal.reasonCode === "string" ? refusal.reasonCode : undefined;
+        const said = e instanceof HubError ? (e.detail ?? e.message) : e instanceof Error ? e.message : String(e);
+        if (reasonCode && NEEDS_THE_PERSON.has(reasonCode)) {
+            return applyInPodAdminResult(c, cfg.podUrl, opts.json, { why: said, reviewUrl: refusal.reviewUrl });
+        }
+        // An older pod refuses an agent's space or capability update here: today's line.
+        if (e instanceof HubError && e.status === 403 && !reasonCode && /\bagent\b/i.test(said)) {
+            return applyInPodAdminResult(c, cfg.podUrl, opts.json);
+        }
+        if (reasonCode === "INVALID_CATALOG_DEFINITION") {
+            const fieldErrors = (refusal.fieldErrors ?? undefined);
             if (!opts.json) {
-                const said = consentRefusalLines(entry.name, entry.slug, owed, consentNeedsPerson(e));
-                log.warn(said.warn);
-                printDataChanges(entry.slug, owed);
-                for (const hint of said.hints)
-                    log.hint(hint);
+                log.error(`${c.slug} not updated — ${said}`);
+                for (const [field, messages] of Object.entries(fieldErrors ?? {}))
+                    log.dim(`  ${field || "(the definition)"}: ${messages.join("; ")}`);
             }
             return {
-                slug: entry.slug,
-                outcome: "needs-consent",
-                status: "needs-consent",
+                slug: c.slug,
+                outcome: "failed",
+                status: "failed",
                 warnings: [],
-                pendingDataChanges: owed,
+                error: said,
+                ...(fieldErrors ? { fieldErrors } : {}),
             };
         }
         const timedOut = e instanceof HubNetworkError && e.code === "TIMEOUT";
-        const refusal = dataChangeRefusalMessage(e);
         if (!opts.json) {
-            log.error(`${entry.name} update failed`);
-            if (refusal)
-                log.warn(refusal);
-            else
-                renderHubError(e, { personDoor: marketUpdatesDoor(cfg.podUrl) });
+            log.error(`${c.slug} update failed`);
+            renderHubError(e, { personDoor: marketUpdatesDoor(cfg.podUrl) });
         }
         return {
-            slug: entry.slug,
+            slug: c.slug,
             outcome: timedOut ? "timed-out" : "failed",
             status: timedOut ? "timed-out" : "failed",
             warnings: [],
-            error: e instanceof Error ? e.message : String(e),
+            error: said,
         };
     }
 }
@@ -1506,54 +1517,6 @@ async function previewDataChanges(entry, cat, cfg) {
         return { payload, error: `the pod's preview failed: ${status}` };
     }
 }
-/** One slug's outcome out of the shared pod-wide config reconcile. */
-async function reconcileOutcome(c, report, opts) {
-    let r;
-    try {
-        r = await report;
-    }
-    catch (e) {
-        if (!opts.json) {
-            log.error(`${c.slug} update failed`);
-            renderHubError(e);
-        }
-        return { slug: c.slug, outcome: "failed", status: "failed", warnings: [], error: e instanceof Error ? e.message : String(e) };
-    }
-    // A report this CLI cannot read is a FAILED read — never "up to date".
-    const lists = [r?.updated, r?.ownerOwnedSkipped, r?.skipped, r?.conflicts];
-    if (!lists.some(Array.isArray) || lists.some((l) => l !== undefined && !Array.isArray(l))) {
-        const error = "the pod's reconcile answered with a report this CLI can't read — not assuming it updated";
-        if (!opts.json)
-            log.error(`${c.slug} — ${error}`);
-        return { slug: c.slug, outcome: "failed", status: "failed", warnings: [], error };
-    }
-    const mine = (rows) => (rows ?? []).filter((e) => e.packageSlug === c.slug);
-    const conflicts = mine(r.conflicts);
-    const owned = mine(r.ownerOwnedSkipped);
-    const updated = mine(r.updated);
-    const warnings = owned.map((e) => `${e.name}: kept your edits — ${e.reason}`);
-    if (conflicts.length > 0) {
-        const error = conflicts.map((e) => `${e.name}: ${e.reason}`).join("; ");
-        if (!opts.json)
-            log.error(`${c.slug} update failed — ${error}`);
-        return { slug: c.slug, outcome: "failed", status: updated.length > 0 ? "updated-with-failures" : "failed", warnings, error };
-    }
-    if (!opts.json)
-        for (const w of warnings)
-            log.warn(`${c.slug} — ${w}`);
-    if (updated.length > 0 || owned.length > 0) {
-        // Every field it could advance did; a field you edited stays yours (warned above).
-        const status = updated.length > 0 ? "updated" : "unchanged";
-        if (!opts.json)
-            log.success(`${c.slug} — ${status}`);
-        return { slug: c.slug, outcome: status, status, warnings };
-    }
-    // Skipped (cache miss, unresolved definition…) or not reported at all: NOT updated — never "current".
-    const error = mine(r.skipped).map((e) => `${e.name}: ${e.reason}`).join("; ") || "the pod's reconcile did not report this package";
-    if (!opts.json)
-        log.warn(`${c.slug} was not updated — ${error}`);
-    return { slug: c.slug, outcome: "not-updated", status: "not-updated", warnings, error };
-}
 export async function marketUpdate(slugsArg, opts) {
     const applyTimeoutMs = parseApplyTimeoutMs(opts.timeout);
     const cat = await buildMarketCatalog();
@@ -1666,8 +1629,9 @@ export async function marketUpdate(slugsArg, opts) {
             process.exit(1);
         }
         for (const c of withUpdates) {
-            // The data-change preview is the workspace door's (`/packages/preflight`).
-            if (updateDoorFor(c.kind) !== "packages-apply")
+            // Only a space's update changes existing records: the preview of its
+            // data changes is the template door's (`/packages/preflight`).
+            if ((c.kind ?? "workspace") !== "workspace")
                 continue;
             const entry = entryBySlug.get(c.slug);
             if (entry)
@@ -1707,6 +1671,8 @@ export async function marketUpdate(slugsArg, opts) {
         }
         log.heading("  Installed packages");
         log.blank();
+        // The slug column fits the longest slug (capped), with at least 2 spaces after it.
+        const slugW = Math.min(Math.max(28, ...checks.map((c) => c.slug.length + 2)), 46);
         for (const c of checks) {
             // ONE label door. This was a hand-rolled second copy that diverged from
             // `installedStatusLabel` in two ways that both LIED: it had no cache-cold
@@ -1717,7 +1683,7 @@ export async function marketUpdate(slugsArg, opts) {
             const label = retiredSlugs.has(c.slug)
                 ? chalk.yellow("retired") + chalk.dim(` · synap templates retire ${c.slug}`)
                 : installedStatusLabel(c, entryBySlug.get(c.slug)?.isPrivate ?? false, cat.loggedIn);
-            console.log("    " + chalk.cyan(c.slug.padEnd(28)) + label);
+            console.log("    " + chalk.cyan(clip(c.slug, slugW - 2).padEnd(slugW)) + label);
         }
         log.blank();
         if (noVersionInfo.length > 0) {
@@ -1764,10 +1730,9 @@ export async function marketUpdate(slugsArg, opts) {
         return;
     }
     if (!shouldApply) {
-        // Next steps offer only what this command can run: a capability update
-        // (no CLI updater) is the person's act in pod admin, named once below.
+        // Every update applies through the pod's one update door, so every one
+        // is offered; what only the person can do is said when it is applied.
         const steps = FLOW.afterMarketUpdateCheck(cliUpdatableSlugs(withUpdates));
-        const personApplies = withUpdates.filter((c) => updateDoorFor(c.kind) === null).map((c) => c.slug);
         if (opts.json) {
             console.log(JSON.stringify({
                 checks,
@@ -1775,9 +1740,6 @@ export async function marketUpdate(slugsArg, opts) {
                 unknownSlugs,
                 applied: [],
                 nextSteps: steps,
-                ...(personApplies.length > 0
-                    ? { appliedInPodAdmin: { slugs: personApplies, where: marketUpdatesDoor(cfg.podUrl) } }
-                    : {}),
                 dataChanges: dataChangesJson,
                 templateLifecycle: lifecycleJson,
             }, null, 2));
@@ -1787,44 +1749,12 @@ export async function marketUpdate(slugsArg, opts) {
         if ([...previews.values()].some((pv) => (pv.changes?.length ?? 0) > 0)) {
             log.hint("Updates with data changes ask before they run. To agree up front: --accept-data-changes <opKey,…>  (or --yes for all listed)");
         }
-        if (personApplies.length > 0) {
-            log.hint(`${personApplies.join(", ")}: not updated by this command. ${marketUpdatesDoor(cfg.podUrl)}`);
-        }
         renderNextSteps(steps);
         return;
     }
     const acceptList = parseAcceptList(opts.acceptDataChanges);
     const results = [];
-    // One pod-wide reconcile serves every view/skill/automation update — run it
-    // at most once, lazily, and read each slug's outcome from its report.
-    let configsReport;
     for (const c of withUpdates) {
-        const door = updateDoorFor(c.kind);
-        if (door === null) {
-            if (!opts.json) {
-                // A capability update is a person's act on pod admin (the pod refuses
-                // an agent key there); any other kind here has no updater at all.
-                log.warn(c.kind === "capability"
-                    ? `${c.slug} is a capability — it was not updated here. Nothing was written. ${marketUpdatesDoor(cfg.podUrl)}`
-                    : `${c.slug} is a ${c.kind} — the pod has no per-package update for this kind, so it was not updated. Nothing was written.`);
-            }
-            results.push({ slug: c.slug, outcome: "no-updater", status: "no-updater", warnings: [] });
-            continue;
-        }
-        if (door === "configs-reconcile") {
-            configsReport ??= hubPost("/configs/reconcile", {}, cfg, applyTimeoutMs);
-            results.push(await reconcileOutcome(c, configsReport, { json: opts.json }));
-            continue;
-        }
-        const entry = entryBySlug.get(c.slug);
-        if (!entry) {
-            // Absent from the catalog THIS CLI read — not proof it left the catalog
-            // (that is the pod's `unlisted`, shown above, and only after a complete sync).
-            if (!opts.json)
-                log.warn(`Couldn't find "${c.slug}" in the catalog read just now — skipping.`);
-            results.push({ slug: c.slug, outcome: "not-in-catalog", status: "not-in-catalog", warnings: [] });
-            continue;
-        }
         const pv = previews.get(c.slug);
         const pending = pv?.changes ?? [];
         let accepted = [];
@@ -1849,17 +1779,14 @@ export async function marketUpdate(slugsArg, opts) {
             }
             if (missing.length > 0) {
                 if (!opts.json) {
-                    log.warn(`${entry.name} not updated: you have not agreed to its data changes. Nothing was written.`);
+                    log.warn(`${c.slug} not updated: you have not agreed to its data changes. Nothing was written.`);
                     log.hint(`To agree and update: ${consentRerunCommand(c.slug, missing)}`);
                 }
                 results.push({ slug: c.slug, outcome: "needs-consent", status: "needs-consent", warnings: [], pendingDataChanges: missing });
                 continue;
             }
         }
-        results.push(await applyOnePackage(entry, cat, cfg, { json: opts.json }, applyTimeoutMs, {
-            payload: pv?.payload,
-            acceptDataChanges: accepted,
-        }));
+        results.push(await applyUpdateThroughDoor(c, cfg, { json: opts.json }, applyTimeoutMs, accepted));
     }
     if (results.some((r) => r.status === "needs-consent"))
         process.exitCode = 1;
@@ -1883,8 +1810,8 @@ export async function marketUpdate(slugsArg, opts) {
     renderNextSteps(steps);
 }
 /**
- * One-line rollup over a batch of `applyOnePackage` outcomes — computed from
- * the SAME per-item `status` (`classifyApplyResult`'s honest verdict) the
+ * One-line rollup over a batch of update outcomes (`applyUpdateThroughDoor`) — computed from
+ * the SAME per-item `status` the
  * loop already collects, not a separate tally. `"installed"`/`"updated"`/
  * `"composed"`/`"legacy-unknown"` count as a clean update, `"unchanged"` as
  * already-current, the `*-with-failures` and `"stamp-contradiction"` statuses
@@ -1904,6 +1831,7 @@ export function summarizeApplyResults(results) {
     let failed = 0;
     let proposed = 0;
     let needsConsent = 0;
+    let toApplyInPodAdmin = 0;
     for (const r of results) {
         switch (r.status) {
             case "installed":
@@ -1938,6 +1866,10 @@ export function summarizeApplyResults(results) {
             case "needs-consent":
                 needsConsent++;
                 break;
+            // The person's act (pod admin → Marketplace → Updates): nothing failed.
+            case APPLY_IN_POD_ADMIN:
+                toApplyInPodAdmin++;
+                break;
             default:
                 failed++;
         }
@@ -1949,6 +1881,8 @@ export function summarizeApplyResults(results) {
     // every surface — never "completed with failures" (review2 UX §1 #2).
     if (withFailures > 0)
         parts.push(`${withFailures} ${templateStepPhrase("unfinished")}`);
+    if (toApplyInPodAdmin > 0)
+        parts.push(`${toApplyInPodAdmin} to apply in pod admin`);
     if (failed > 0)
         parts.push(`${failed} failed`);
     if (timedOut > 0)
@@ -1958,8 +1892,8 @@ export function summarizeApplyResults(results) {
     const clean = withFailures === 0 && failed === 0 && timedOut === 0 && needsConsent === 0;
     // Proposed isn't a failure (never ⚠) but isn't live yet (not a bare ✓) —
     // a distinct "→ waiting for your approval" marker keeps the summary honest.
-    const marker = !clean ? "⚠" : proposed > 0 ? "→" : "✓";
-    const color = !clean ? chalk.yellow : proposed > 0 ? chalk.cyan : chalk.green;
+    const marker = !clean ? "⚠" : proposed > 0 || toApplyInPodAdmin > 0 ? "→" : "✓";
+    const color = !clean ? chalk.yellow : proposed > 0 || toApplyInPodAdmin > 0 ? chalk.cyan : chalk.green;
     return {
         updated,
         unchanged,
@@ -1968,6 +1902,7 @@ export function summarizeApplyResults(results) {
         timedOut,
         proposed,
         needsConsent,
+        toApplyInPodAdmin,
         line: color(`${marker} ${parts.join(" · ")}`),
     };
 }