[braghettos]

Fixes #26.

The bug

• What happened: a Repo whose push had landed got stuck permanently on krateo.io/external-create-pending.
• Why: the status write after the push lost an optimistic-concurrency race, and Create returned that 409. provider-runtime requeues a conflict from Create without recording an outcome (reconciler.go:997-1008), so the resource stays stuck.
• Where it was seen: krateo-057 on 0.15.4, on the first publish of a blueprint, 14 ms after a successful push.

The fix

• Retried status writes: both status writes in SyncRepos (the committed path and the already-up-to-date path) now go through updateStatusWithRetry. It retries on conflict, re-reads the object, and keeps both the status the sync produced and the external name it set. This is the LocalResource fix from LocalResource wedges on external-create-pending under fan-out: concurrent pushes to one branch + a lost status-write race #16, which Repo never got.
• External name kept: a status-subresource write returns the server's object, whose annotations replace the local copy's. So the helper sets the external name again after the write. The runtime persists it as the create's critical annotation.
• Observe fallback: Observe reads the target commit from the external name when status.targetCommitId is empty, so a Repo whose status write was lost converges.

Tests

• Real-conflict test: a concurrent write makes the reconciler's resourceVersion stale, then the test checks that:
  • the status lands;
  • the concurrent write survives;
  • the external name survives.
  • Mutation check: with the re-read removed, it fails.
• Source guard: no bare Status().Update may exist outside the helper, as fix: a concurrent push must not wedge a LocalResource forever (#16) #17 does for LocalResource.
• Checks: go test -race ./... and go vet pass.
• Not unit-tested: the Observe fallback, which needs a git remote; it's covered by the live check after rollout.

Not in scope

Repos that got stuck before this release (#22). Resolving an existing pending annotation needs the runtime-side confirm-the-negative.

🤖 Generated with Claude Code

https://claude.ai/code/session_016V8EVEvyty3XvXMHUWJvPg