Release 2.1.89 (2026-06-30)

Bug fixes

• report the real pull error instead of guessing '(offline?)' (#1985) When the base-image pull fails during the staleness probe, resolve_base_digest now surfaces the pull's actual cause (the last non-empty stderr line — denied, unauthorized, manifest unknown, a network error — or a timeout) instead of the static '(offline?)' guess. The misleading text sent a real incident toward a stale-cache / publishing theory when the cause was a stale ghcr.io credential. Behavior is unchanged; only the diagnostic improves. Ref #1981.

• fail hard on base-pull failure instead of silent stale fallback (#1986) When the base-image pull failed during the staleness probe, resolve_base_digest fell back to the local base's digest and continued with only a soft '(offline?)' warning (added in #1973). In practice this let a host validate against a stale local base for an unknown length of time — the exact ansible-lint failure that motivated #1973 — a silent failure that surfaces later as a confusing wrong result.

A failed base pull is now a hard error by default: resolve_base_digest raises a RuntimeError naming the real pull error (stderr / timeout / exit code) and the stale-cache risk. The local-base degradation is retained as an explicit opt-in via VRG_ALLOW_STALE_BASE (or allow_stale=True), which warns and returns verified=False. The no-local-copy and pull-succeeds paths are unchanged.

The hard-error and no-image messages now report the actual pull failure cause instead of guessing '(offline?)'.

Amends the #1973 staleness design spec with a superseding note.

Chores

• point plugin marketplace at main (single released channel, #45) (#1983)