ConfigSources

Return why the managed layer is absent from merged, if it is.

Every reader here gates on user.status.usable and then merges. None inspected the managed status, so an unreadable managed layer merged as {} and the user's own values applied unopposed — with a warning about the user's file and nothing about the policy that vanished. The startup gate normally prevents an unusable managed snapshot from being observed, so this covers the gate-exempt commands and any future entry point that forgets it.

Return a deep merge where managed leaves outrank user leaves.

Lists at UNION_PATHS accumulate instead of being replaced. A managed scalar replaces a colliding user table whatever its depth, but only when the value matches the type the manifest declares; a wrong-typed managed value leaves the user value in place.