Hit this same bug on a worktree where the source had been registered before the origin remote was set — deriveCodeSourceId recomputed a new id from the canonicalized origin + hostname-folded path hash, didn't match the existing source id, and ensureSourceRegistered got rejected by gbrain with:

path "/Users/benjamin/gbrain" overlaps with existing source "gstack-code-gbrain-76f26696". Overlapping sources are not allowed.

Existing source id gstack-code-gbrain-76f26696 is gstack-code-<basename>-sha1(mbp.local::/Users/benjamin/gbrain).slice(0,8) — the basename fell back to gbrain because origin wasn't set when it was first registered. Then I added the GitHub remote (BenjaminDSmithy/gbrain-private) and the next /sync-gbrain started computing gstack-code-benjaminsmithy-gbrain-private-<hash> instead. The .gbrain-source pin still pointed at the correct existing source though, so honoring it (as this PR does) is the right move.

Setup specifics:

• gstack v1.48.0.0 (commit a6fb317)
• gbrain CLI v0.41.3.0 (postgres engine via local Supabase)
• macOS 14, hostname mbp.local

Independently arrived at the same fix shape (readPinnedCodeSourceId helper with the same [a-z0-9-]{1,32} regex contract + pin-first branch in runCodeImport + skip the legacy/hostname-fold migration paths when honored). Your PR is more thorough (refactors HostnameFoldMigration to a kept-existing kind + ships tests); recommending you keep it as-is rather than my variant.

Happy to test against this PR's branch on my repro if it helps move review along. The fix is the load-bearing path between a working /sync-gbrain and a permanently-broken code stage on existing installs.

Rebased onto current garrytan/main on 2026年06月04日 and resolved the test comment conflict in test/explain-level-config.test.ts. Local verification passed: bun test test/explain-level-config.test.ts test/gstack-gbrain-sync.test.ts (43 pass, 0 fail) and bun run build after installing from bun.lock. GitHub now reports the branch as MERGEABLE; no GitHub check runs are currently attached to this PR.

Rebased this branch onto current garrytan/main today and re-ran local verification. Results:

• bun install --frozen-lockfile — passed
• bun test test/explain-level-config.test.ts test/gstack-gbrain-sync.test.ts — 43 pass / 0 fail
• bun run build — passed

The branch force-push updated cleanly and the PR remains mergeable from the fork. I do not see visible GitHub check runs attached to this PR, so this is ready for maintainer review/queue from my side.