My recent work for bug 7335, bug 4771 and others cleaned up the process of
installing when the preferred publisher was out of whack.

Recently I was alerted to another situation-- a zone which was connected to the
'release' repo, detached, and then attached to (the same) system which had been
image-updated and along the way reconfigured to talk to the dev repo.  As a
result, 'pkg' couldn't find a place to get the "entire" incorporation it needed
in this logic in attach:

gz_entire=`pkg -R / list -Hv entire| nawk '{print $1}'`
if [ $? -ne 0 ]; then
        /usr/sbin/umount $zoneroot
        fail_fatal $f_nogzinc
fi
printf "$m_gzinc\n" $gz_entire

ngz_entire=`pkg -R $zoneroot list -Hv entire| nawk '{print $1}'`
if [ $? -ne 0 ]; then
        /usr/sbin/umount $zoneroot
        fail_fatal $f_nozinc
fi
printf "$m_zinc\n" $ngz_entire

if [ "$gz_entire" = "$ngz_entire" ]; then
        printf "$m_insync\n" $zonename $gz_entire
        echo $m_complete
        /usr/sbin/umount $zoneroot || fail_fatal "$f_umount"
        exit $ZONE_SUBPROC_OK
fi

In the short term, we need to make this a little more flexible, and
probably we can commonize in some code from pkgcreatezone to do so.

Longer term, I think we need to make a policy decision about how attach should
behave when it encounters this case.  More generally, there is a "mating up"
problem between a zone's set of publishers and the global zone's set of
publishers.