Function managed_block 

pub fn managed_block() -> String

Public for dodot transform show-hook (future) and for the onboarding prompt in commands::up to surface what would be installed. Includes the guard lines so callers can grep-detect the block in arbitrary contexts.

The block runs two commands:

1. dodot refresh --quiet — touch source mtimes for any deployed-side edits so git’s stat-cache invalidates. Without this, the clean filter (R6) wouldn’t fire on the upcoming commit, and the commit could include stale template content.
2. dodot transform check --strict — run the 4-state matrix and refuse the commit on any finding (Conflict, missing, unresolved markers, NeedsRebaseline). Patched outcomes don’t refuse — burgertocow’s auto-merge already produced a clean unified patch and rewrote the source; the user git adds and commits the follow-up if they want a clean history.

Each step short-circuits with || exit 1; a failure in either aborts the commit (with exit code 1 — the inner command’s exit status is intentionally not preserved, since for git’s purposes “any non-zero” is what blocks the commit).