@frontera-sdk/cli 1.52.39 → 1.52.40

package/src/commands/local/dev.ts

@@ -1,13 +1,20 @@
 import { type ChildProcess, spawn } from 'node:child_process'
-import { existsSync, lstatSync, readFileSync, rmSync, watch, writeFileSync } from 'node:fs'
-import { join, sep } from 'node:path'
+import { existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, rmSync, watch, writeFileSync } from 'node:fs'
+import { join, posix, sep } from 'node:path'
 
-import { CliError } from '../../errors'
-import { adaptationOf, contentHash, loadBuild, loadHashes, oneLine, pruneBuild, recordBuild, recordSettingsDifferences, saveHashes, type BuildEntry } from '../../local/local-applied'
-import { deployActions, ensureActionDraft, localActionCalls, prepareActions, retireActions, staleActions, unpublishedActions, type ActionBuild } from '../../local/local-actions'
-import { agentIdentity, syncAgentName } from '../../local/local-agent-name'
+import { parse as parseYaml } from 'yaml'
+
+import { CliError, UsageError } from '../../errors'
+import { ensureProjectBunfig } from '../../local/local-scaffold'
+import { llmParameterNotes } from '../../local/local-model-parameters'
+import { findOrphans, orphanCalls, restoreIfArchived, retireDeleted, reviveFunction, runtimeItems } from '../../local/local-orphans'
+import { adaptationOf, contentHash, refOfTarget, failureCodeAndHint, isEnvironmentNote, loadBuild, loadHashes, oneLine, promotedVersionOf, pruneBuild, recordBuild, recordSettingsDifferences, saveHashes, type BuildEntry } from '../../local/local-applied'
+import { INHERITED_FROM_PULL } from '../../blueprint/action-rules'
+import { actionsNotRunning, deployActions, ensureActionDraft, liveActionStates, localActionCalls, prepareActions, retireActions, staleActions, unpublishedActions, type ActionBuild } from '../../local/local-actions'
+import { agentIdentity, hasAgentDraft, syncAgentName } from '../../local/local-agent-name'
+import { agentFileErrors, agentFileWarnings, approvalBindingNotes, boundTools, isApprovalNote, procedureToolProblems } from '../../local/local-agent-checks'
 import { classify, itemNeeds, type BuiltInKind } from '../../local/local-portability'
-import { localProfileName } from '../../local/local-control'
+import { localProfileName, rebindCopiedProject } from '../../local/local-control'
 import {
   allTargets,
   blueprintObjectTypes,
@@ -17,32 +24,52 @@ import {
   describeTarget,
   followUpsFor,
   targetFor,
+  unappliedFiles,
+  unappliedReason,
   type SyncProfiles,
   type SyncTarget,
 } from '../../local/local-dev-sync'
-import { applyBindings, applyKnowledge, applyPlugin, blueprintWithout, editableSets, localDirectory, promoteWorkflow, resolveBlueprint, resolveTarget, type ObjectBuild } from '../../local/local-dev-references'
+import { applyBindings, applyKnowledge, applyPlugin, blueprintWithout, editableSets, embeddingsDiffer, localDirectory, mediaCatalogDatasetReason, pointMediaTypesAt, promoteWorkflow, resolveBlueprint, resolveTarget, type ObjectBuild, type ResolvedBlueprint } from '../../local/local-dev-references'
 import { applyObjectSets, namesObjectSet, objectSetCalls } from '../../local/local-object-sets'
 import { applyTheme, themeCalls } from '../../local/local-themes'
-import { ensureMediaSets } from '../../local/local-media-sets'
-import { applyChatApp } from '../../local/local-chat-apps'
+import { ensureMediaSets, mediaUpload } from '../../local/local-media-sets'
+import { fillPlaceholderMedia } from '../../local/local-media-placeholders'
+import { applyChatApp, keyCalls } from '../../local/local-chat-apps'
 import { applyLessons } from '../../local/local-lessons'
 import { applyStandIn, platformOnlyNames, readStandIn, standInNames } from '../../local/local-stand-ins'
 import { projectProvides } from '../../local/local-adapt'
 import { applyOperatingConfig } from '../../local/local-operating'
+import { localEmbeddingsReachable } from '../../local/local-keys'
 import { mirrorOrgSettings, settingsCalls } from '../../local/local-org-settings'
-import { readSnapshot } from '../../local/local-sync-snapshot'
-import { functionSlugOf, mirrorFunctionState } from '../../local/local-function-state'
-import { functionSecretNames, missingSecretLines, readProjectDoc, readProjectText, workflowSecretNames } from '../../local/local-secrets'
-import { decideStepNotes, mirrorWorkflowState } from '../../local/local-workflow-state'
+import { directoryOf, readSnapshot } from '../../local/local-sync-snapshot'
+import { BUNDLE_ID_MAP_ENV, bundleIdMap, functionCodeFiles, hardCodedIdLine, hardCodedObjectTypeIds, platformObjectTypeIds } from '../../local/local-function-ids'
+import { checkRunnable, functionSlugOf, mirrorFunctionState } from '../../local/local-function-state'
+import { functionSecretNames, localSecretPresence, missingSecretLines, readProjectDoc, readProjectText, workflowSecretNames } from '../../local/local-secrets'
+import { seedPersonas } from '../../local/local-personas'
+import { PROJECT_SECRETS_FILE, projectSecretLines } from '../../local/local-project-secrets'
+import { decideStepNotes, keepLiveCurrent, mirrorWorkflowState } from '../../local/local-workflow-state'
 import type { Directory } from '../../local/local-sync-refs'
 import { localProject, type LocalProject } from '../../local/local-project'
-import { isAlive, readState, recordApplied } from '../../local/local-state'
+import { isAlive, readState, recordApplied, recordApplying, type LocalCredentials } from '../../local/local-state'
 import { applyErrorText } from '../../local/local-apply-error'
+import { applyFailures, inheritedApplyLine, splitApplyFailures } from '../../local/local-apply-summary'
+import { unchangedSincePull } from '../../local/local-check-inherited'
+import { readWorkspaceGrants } from '../../local/local-workspace-grants'
+import { ApplyWatchdog, stoppedReapplyingLine } from '../../local/local-apply-watchdog'
+import { hasGeneratedSampleData, pulledSampleData, pulledSampleDataNote, remakeLines, remakeReason, remakeSampleData } from '../../local/local-sample-remake'
+import { appsAwayByRestore } from '../../local/local-app-restore'
+import { BASELINE_RECORD, readBaseline } from '../../local/local-db-snapshot'
+import { canChangeRuntime, filesChangedTrigger, recordApply } from '../../local/local-apply-history'
+import { failedForRuntime, RUNTIME_DOWN_ERROR, RUNTIME_STOPPED_LINE, runtimeAnswering } from '../../local/local-runtime-health'
+import { noticeLines, projectNotices } from '../../local/local-project-notices'
+import { refreshVendoredSdk, vendoredSdkState } from '../../local/local-vendored-sdk'
 import { flagBool, type Command, type CommandContext } from '../types'
 import { isSharedFunctionFile } from '../../local/local-function-shared'
 import { applyApp } from '../../local/local-apps'
 import { applyBrand, brandUpload } from '../../local/local-brand'
 import { applyLibrary } from '../../local/local-library'
+import { projectFileChecks } from '../../local/local-file-checks'
+import { actionFailureLines, dedupeLines, hasIndexedPaths, nameIndexedPaths, refusedArtifact, refusedByRules, sourceSystemHint } from '../../local/local-blueprint-errors'
 
 /**
  * `frontera local dev`: the inner loop. Applies the whole project to the
@@ -55,6 +82,9 @@ import { applyLibrary } from '../../local/local-library'
 
 const DEBOUNCE_MS = 300
 
+/** How many Blueprint artifacts one apply may leave off for the runtime's refusals before it says the Blueprint failed. */
+const MAX_REFUSED = 12
+
 interface RunResult {
   ok: boolean
   output: string
@@ -62,11 +92,19 @@ interface RunResult {
   missing?: string[]
   unnamedActions?: number
   /** The Blueprint: how the runtime holds each object type and governed Action. */
-  blueprint?: { objects: Record<string, ObjectBuild>; actions: Record<string, ActionBuild>; objectSets?: string[] }
+  blueprint?: { objects: Record<string, ObjectBuild>; actions: Record<string, ActionBuild>; objectSets?: string[]; objectSetIds?: Record<string, string>; parts?: Record<string, { reason: string; refused: boolean }> }
   /** Saved object sets made again here under a new id: what names them is applied again. */
   objectSetsAgain?: string[]
   /** Governed Actions authored again under new ids: what names them is applied again. */
   authoredAgain?: string[]
+  /** The failure in full, one line each, when every line is a thing to fix (each Action that didn't deploy, each failed check). */
+  failureLines?: string[]
+  /** A dataset got a new revision: the Blueprint is applied again so its object types read it. */
+  datasetRevised?: boolean
+  /** A workflow: the version the push stored its file as. */
+  version?: number
+  /** Output `warning:` lines that are the platform's findings on the files (an Agent's behavior settings): they hold wherever it runs. */
+  validationWarnings?: string[]
 }
 
 /** The commands running now, so stopping `local dev` stops them too. */
@@ -97,7 +135,7 @@ function withLocalAuth(args: string[], auth: LocalAuth | undefined): { args: str
 }
 
 /** Run this CLI once more, at low priority, in the solution folder. */
-function runCli(project: LocalProject, command: string[], auth?: LocalAuth): Promise<RunResult> {
+function runCli(project: LocalProject, command: string[], auth?: LocalAuth, extraEnv: Record<string, string> = {}): Promise<RunResult> {
   const compiled = Bun.main.startsWith('/$bunfs') || Bun.main.startsWith('B:\\~BUN')
   const self = compiled ? [process.execPath] : [process.execPath, Bun.main]
   const { args, env } = withLocalAuth(command, auth)
@@ -105,7 +143,7 @@ function runCli(project: LocalProject, command: string[], auth?: LocalAuth): Pro
     const child = spawn('nice', ['-n', '10', ...self, ...args], {
       cwd: project.root,
       stdio: ['ignore', 'pipe', 'pipe'],
-      env: { ...process.env, ...env, NO_COLOR: '1' },
+      env: { ...process.env, ...env, ...extraEnv, NO_COLOR: '1' },
     })
     children.add(child)
     let output = ''
@@ -125,6 +163,8 @@ interface ApplyOptions {
   publish: boolean
   workspaceId: string
   serviceUrl: string
+  /** A line said now, while an apply waits (a Function registering). */
+  note?: (line: string) => void
 }
 
 async function apply(project: LocalProject, target: SyncTarget, opts: ApplyOptions): Promise<RunResult> {
@@ -133,12 +173,25 @@ async function apply(project: LocalProject, target: SyncTarget, opts: ApplyOptio
   // Names in the file (`function/refund-eligibility`) become this runtime's ids in a resolved copy.
   let directory: Promise<Directory> | null = null
   const lookup = () => (directory ??= creds ? localDirectory(opts.serviceUrl, creds) : Promise.resolve({}))
+  // What the Agent's files say that would apply in silence and fail in a chat (`local-agent-checks.ts`).
+  const agent = agentChecks(project, target)
+  // A Chat App, knowledge base or skill against its format: a key the platform drops is said, a wrong shape refused.
+  const formats = projectFileChecks(project.root, target as { kind: string; file?: string })
+  const checked = { errors: [...agent.errors, ...formats.errors], warnings: [...agent.warnings, ...formats.warnings] }
+  if (checked.errors.length) return { ok: false, output: [`error [USAGE]: ${describeTarget(target)} can't be applied as written`, ...checked.errors.map((e) => `  ${e}`), ...checked.warnings].join('\n') }
   const resolved = await resolveTarget(project, target, lookup, creds?.workspaceId, creds?.organizationId)
   // The project's own file, before a resolved copy takes its place.
   const original = target as Extract<SyncTarget, { file: string }>
   if (!resolved.ok) return { ok: false, output: resolved.output, missing: resolved.missing, unnamedActions: resolved.unnamedActions }
-  let notes = resolved.output
+  let notes = [...checked.warnings, resolved.output].filter(Boolean).join('\n')
   const withNotes = (r: RunResult): RunResult => (notes ? { ...r, output: `${notes}\n${r.output}`.trim() } : r)
+  // An Agent or workflow archived here (its file was deleted and is back, or it was archived by hand): restored first,
+  // so the file reaches an item in service (`local-orphans.ts`).
+  if ((target.kind === 'agent' || target.kind === 'workflow') && creds) {
+    const call = orphanCalls(opts.serviceUrl, creds)
+    const line = call ? await restoreIfArchived(project, creds.organizationId, call, target.kind, target.slug) : null
+    if (line) notes = [notes, line].filter(Boolean).join('\n')
+  }
   if (target.kind === 'operating') {
     // Read fresh: the owner session is renewed on every runtime start.
     if (!creds) return { ok: false, output: 'error [LOCAL_NOT_SEEDED]: the runtime is not seeded yet' }
@@ -146,9 +199,9 @@ async function apply(project: LocalProject, target: SyncTarget, opts: ApplyOptio
   }
   if (target.kind === 'bindings') {
     if (!creds) return { ok: false, output: 'error [LOCAL_NOT_SEEDED]: the runtime is not seeded yet' }
-    return applyBindings(project, target, opts.serviceUrl, creds)
+    return withNotes(await applyBindings(project, target, opts.serviceUrl, creds))
   }
-  if (target.kind === 'knowledge') return applyKnowledge(project, target, profiles, (args) => runCli(project, args, opts.auth), creds ? { serviceUrl: opts.serviceUrl, creds } : undefined)
+  if (target.kind === 'knowledge') return withNotes(await applyKnowledge(project, target, profiles, (args) => runCli(project, args, opts.auth), creds ? { serviceUrl: opts.serviceUrl, creds } : undefined))
   if (target.kind === 'theme') {
     if (!creds?.session) return { ok: false, output: 'error [LOCAL_NOT_SEEDED]: the runtime is not seeded yet' }
     return applyTheme(project.root, target.name, themeCalls(opts.serviceUrl, creds))
@@ -156,7 +209,8 @@ async function apply(project: LocalProject, target: SyncTarget, opts: ApplyOptio
   if (target.kind === 'chat-app') {
     if (!creds?.session) return { ok: false, output: 'error [LOCAL_NOT_SEEDED]: the runtime is not seeded yet' }
     // The owner's session, as the platform's Chat App editor writes; the roster's Agents by this runtime's ids.
-    return applyChatApp(project.root, target.name, themeCalls(opts.serviceUrl, creds), lookup, projectProvides(project, creds.organizationId))
+    // The workspace key's draft too, so `frontera chat-app get` (which reads the key's own draft) shows what was applied.
+    return withNotes(await applyChatApp(project.root, target.name, themeCalls(opts.serviceUrl, creds), lookup, projectProvides(project, creds.organizationId), creds.workspaceKey ? keyCalls(opts.serviceUrl, creds) : undefined))
   }
   if (target.kind === 'app') {
     if (!creds?.session) return { ok: false, output: 'error [LOCAL_NOT_SEEDED]: the runtime is not seeded yet' }
@@ -177,49 +231,135 @@ async function apply(project: LocalProject, target: SyncTarget, opts: ApplyOptio
   }
   if (target.kind === 'plugin' && (target.file.endsWith('.stand-in.json') || target.file.endsWith('.platform.json'))) return applyStandIn(project, target.name, profiles.workspace, (args) => runCli(project, args, opts.auth))
   if (target.kind === 'plugin') return applyPlugin(project, target, profiles, (args) => runCli(project, args, opts.auth), creds ? { serviceUrl: opts.serviceUrl, creds } : undefined)
+  // A Media Set's catalog: a sample CSV can't publish into it, so the file is skipped, said (sample data makes none).
+  if (target.kind === 'dataset') {
+    const media = mediaCatalogDatasetReason(project.root, target.apiName)
+    if (media) return { ok: true, output: `  warning: dataset ${target.apiName} is skipped here: ${media}` }
+  }
   if (resolved.file) target = { ...target, file: resolved.file } as SyncTarget
-  let command = commandFor(target, profiles)
+  // A Function whose code hard-codes the workspace's object type ids (a pulled one): said, and its
+  // bundle here built with this runtime's ids in their place; the files keep the workspace's.
+  let bundleEnv: Record<string, string> = {}
+  if (target.kind === 'function') {
+    const hits = hardCodedObjectTypeIds(functionCodeFiles(project.root, target.file, target.key.endsWith('/')), platformObjectTypeIds(directoryOf(readSnapshot(project.root))))
+    if (hits.length) {
+      const map = bundleIdMap(hits, creds ? ((await lookup()) as Directory).objectType : undefined)
+      if (Object.keys(map).length) bundleEnv = { [BUNDLE_ID_MAP_ENV]: JSON.stringify(map) }
+      notes = [notes, ...hits.map((h) => `  warning: ${hardCodedIdLine(h, !!map[h.id.toLowerCase()])}`)].filter(Boolean).join('\n')
+    }
+  }
+  const plain = commandFor(target, profiles)
+  let command = plain
   // Where the applied Blueprint lives: the runtime's copy when it needed one.
   let blueprintRoot = project.root
-  const blueprint = target.kind === 'blueprint' ? resolveBlueprint(project) : null
+  let blueprint: ResolvedBlueprint | null = null
   // Governed Actions are deployed on this runtime only (D3): calls to it, with the project's own keys.
-  const actionCalls = blueprint?.actions.length && creds && opts.publish ? localActionCalls(opts.serviceUrl, creds) : null
-  if (blueprint) {
-    // The Blueprint as this runtime can hold it; see `resolveBlueprint`.
-    if (blueprint.dir) {
-      command = [...command, '--dir', join(project.root, blueprint.dir)]
-      blueprintRoot = join(project.root, blueprint.dir, '..')
-    }
-    notes = [notes, ...blueprint.warnings].filter(Boolean).join('\n')
-    // A media-backed type over a set's catalog binds to an empty Media Set of that name, made first.
-    if (blueprint.mediaSets) {
-      if (!creds?.session) return { ok: false, output: 'error [LOCAL_NOT_SEEDED]: the runtime is not seeded yet' }
-      const why = await ensureMediaSets(blueprint.mediaSets, themeCalls(opts.serviceUrl, creds))
-      if (why) return { ok: false, output: `error [BLUEPRINT_MEDIA]: ${why}` }
-    }
-    if (actionCalls) {
-      // A draft on the first schema cannot hold Actions.
-      const draft = await ensureActionDraft(actionCalls)
-      if (!draft.ok) return { ok: false, output: `error [BLUEPRINT_ACTIONS]: ${draft.note}` }
-      if (draft.note) notes = [notes, `  warning: ${draft.note}`].filter(Boolean).join('\n')
-    }
-  }
-  let result = withNotes(await runCli(project, command, opts.auth))
+  let actionCalls: ReturnType<typeof localActionCalls> | null = null
+  // What the runtime refused of the Blueprint, one artifact at a time: each is left off and the
+  // rest applied again, so one type the runtime cannot hold never keeps the others off it.
+  const refused = new Map<string, string>()
+  const notesBefore = notes
+  let result: RunResult
+  for (;;) {
+    command = plain
+    blueprintRoot = project.root
+    notes = notesBefore
+    blueprint = target.kind === 'blueprint' ? resolveBlueprint(project, refused) : null
+    actionCalls = blueprint?.actions.length && creds && opts.publish ? localActionCalls(opts.serviceUrl, creds) : null
+    if (blueprint) {
+      // The Blueprint as this runtime can hold it; see `resolveBlueprint`.
+      if (blueprint.dir) {
+        command = [...command, '--dir', join(project.root, blueprint.dir)]
+        blueprintRoot = join(project.root, blueprint.dir, '..')
+      }
+      notes = [notes, ...blueprint.warnings].filter(Boolean).join('\n')
+      // A media-backed type over a set's catalog binds to an empty Media Set of that name, made first,
+      // and reads the dataset that set's catalog is here.
+      if (blueprint.mediaSets) {
+        if (!creds?.session) return { ok: false, output: 'error [LOCAL_NOT_SEEDED]: the runtime is not seeded yet' }
+        // This is the project's own runtime: each stand-in set is granted to its workspace.
+        const media = await ensureMediaSets(blueprint.mediaSets, themeCalls(opts.serviceUrl, creds), creds.workspaceId)
+        if (media.why) return { ok: false, output: `error [BLUEPRINT_MEDIA]: ${media.why}` }
+        if (media.warnings.length) notes = [notes, ...media.warnings.map((w) => `  warning: ${w}`)].filter(Boolean).join('\n')
+        pointMediaTypesAt(project, blueprint, media.catalogs)
+        // An empty stand-in set gets a few generated placeholder files, so the type's rows, links and file reads can be tried.
+        if (blueprint.mediaTypes) {
+          const placed = await fillPlaceholderMedia(project.root, blueprint.mediaTypes, themeCalls(opts.serviceUrl, creds), mediaUpload(opts.serviceUrl, creds))
+          if (placed.length) notes = [notes, ...placed].filter(Boolean).join('\n')
+        }
+      }
+      if (actionCalls) {
+        // A draft on the first schema cannot hold Actions.
+        const draft = await ensureActionDraft(actionCalls)
+        if (!draft.ok) return { ok: false, output: `error [BLUEPRINT_ACTIONS]: ${draft.note}` }
+        if (draft.note) notes = [notes, `  warning: ${draft.note}`].filter(Boolean).join('\n')
+      }
+    }
+    result = withNotes(await runCli(project, command, opts.auth, bundleEnv))
+    if (blueprint && !result.ok && refused.size < MAX_REFUSED) {
+      const stop = refusedArtifact(result.output)
+      if (stop && !refused.has(stop.key)) {
+        refused.set(stop.key, stop.reason)
+        continue
+      }
+      // Refused before any write, for a rule an Action or metric file breaks: each such file is left off.
+      const broken = refusedByRules(result.output).filter((r) => !refused.has(r.key))
+      if (broken.length) {
+        for (const r of broken) refused.set(r.key, r.reason)
+        continue
+      }
+    }
+    break
+  }
   const fallback = fallbackFor(target, profiles, project.root)
   if (!result.ok && fallback?.when.test(result.output)) {
     // An empty fallback means there was nothing more to do.
     result = { ok: true, output: '' }
     for (const args of fallback.then) {
       result = await runCli(project, args, opts.auth)
-      if (!result.ok) return result
+      if (!result.ok) break
+    }
+    // What the resolved copy was applied with (a model swapped, a Plugin it went without) is said
+    // when the item is made here too, not only when it is applied again.
+    result = withNotes(result)
+    // A dataset whose definition changed (a column added, one now nullable): the CSV no longer
+    // fits its revision, so the definition becomes the dataset's next revision.
+    if (!result.ok && target.kind === 'dataset' && /requires a new revision/i.test(result.output)) {
+      const revised = await runCli(project, ['dataset', 'revise', '-f', target.file, '--profile', profiles.organization], opts.auth)
+      if (!revised.ok) return { ...revised, output: [result.output.trim(), revised.output.trim()].join('\n') }
+      // Each object type reading it is bound to the new revision (a binding is pinned to the revision it was made on).
+      const rebound = await rebindReaders(project, target.apiName, profiles, (args) => runCli(project, args, opts.auth))
+      if (!rebound.ok) return rebound
+      return { ok: true, output: [`  cut a new revision of dataset ${target.apiName}: its CSV has empty values the last one refused`, rebound.output].filter(Boolean).join('\n'), datasetRevised: true }
+    }
+  }
+  // Plugins this runtime doesn't have (a newer platform's): the Agent is applied without them, said once.
+  if (!result.ok && target.kind === 'agent') {
+    const without = withoutPlugins(project, target.file, result.output)
+    if (without) {
+      notes = [notes, `  warning: ${original.file} names the Plugin${without.names.length === 1 ? '' : 's'} ${without.names.join(', ')}, which this runtime doesn’t have; the Agent is applied without ${without.names.length === 1 ? 'it' : 'them'}`].filter(Boolean).join('\n')
+      target = { ...target, file: without.file }
+      result = withNotes(await runCli(project, commandFor(target, profiles), opts.auth))
     }
   }
+  // A Function whose build cannot find a file it imports from beside its folder: said as that, first.
+  if (!result.ok && target.kind === 'function') result = { ...result, output: missingImportsOutput(project, original.file, result.output) }
   if (!result.ok) return result
+  if (target.kind === 'workflow') {
+    // The version this push stored the file as: what its tests run, and what a promotion makes live.
+    const version = pushedVersionOf(result.output)
+    if (version) result = { ...result, version }
+  }
   if (target.kind === 'workflow' && creds) {
     // Live in the workspace: live here too, with its triggers as they are there where that is safe.
+    const mirrored = await mirrorWorkflowState(project, target.slug, original.file, opts.serviceUrl, creds, result.version)
     const lines = [
-      ...(await mirrorWorkflowState(project, target.slug, original.file, opts.serviceUrl, creds)),
+      ...mirrored,
+      // Not live in the workspace, but live here (an Agent's binding promoted it): live follows the file.
+      ...(mirrored.some((l) => /promoted workflow/.test(l)) ? [] : await keepLiveCurrent(opts.serviceUrl, creds, target.slug, result.version)),
       ...decideStepNotes(project, original.file, creds),
+      // An llm node's `temperature` its model refuses: said now, not when the first run fails at it.
+      ...llmParameterNotes(project.root, target.file, ((await lookup()) as Directory).model),
       // The secrets its HTTP steps and webhook name: placeholders until set on this computer.
       ...(await missingSecretLines(workflowSecretNames(readProjectDoc(project, original.file)), `workflow ${target.slug}`, opts.serviceUrl, creds)),
     ]
@@ -228,8 +368,19 @@ async function apply(project: LocalProject, target: SyncTarget, opts: ApplyOptio
   if (target.kind === 'function' && creds) {
     // Switched off in the workspace: off here too; and the secrets it is granted, until set here.
     const source = readProjectText(project, original.file)
+    // Switched off here when its file was deleted, and the file is back: switched on, before the workspace's state is mirrored.
+    const call = orphanCalls(opts.serviceUrl, creds)
+    const revived = call && functionSlugOf(target.key) ? await reviveFunction(project, creds.organizationId, call, functionSlugOf(target.key)!) : null
+    const mirrored = await mirrorFunctionState(project, target.key, opts.serviceUrl, creds)
+    // Not "applied" until the job engine can run it: a workflow started right after would not find it.
+    const runnable = await checkRunnable(opts.serviceUrl, creds, functionSlugOf(target.key) ?? original.file, { note: opts.note, ...runnerAt(project) })
+    // A runner registered it, so one is alive: the deploy's "no runner has polled for Ns" (a poll time a
+    // restored database or a wait between polls makes old) is not true here, and is not kept.
+    if (runnable.runnable === true) result = { ...result, output: result.output.split('\n').filter((l) => !isEnvironmentNote(l)).join('\n') }
     const lines = [
-      ...(await mirrorFunctionState(project, target.key, opts.serviceUrl, creds)),
+      ...(revived ? [revived] : []),
+      ...mirrored,
+      ...runnable.lines,
       ...(await missingSecretLines(functionSecretNames(source), `Function ${functionSlugOf(target.key) ?? original.file}`, opts.serviceUrl, creds)),
     ]
     if (lines.length) result = { ...result, output: `${result.output}\n${lines.join('\n')}`.trim() }
@@ -240,6 +391,8 @@ async function apply(project: LocalProject, target: SyncTarget, opts: ApplyOptio
     if (named) result = { ...result, output: `${result.output}\n${named}`.trim() }
   }
   let authoredAgain: string[] = []
+  // Object types whose editable fields were declared for their Actions below.
+  const editableDone = new Set<string>()
   if (actionCalls && blueprint) {
     const names = blueprint.actions.map((a) => a.apiName)
     // A decision pins the Action's contract, its object type's fields included, and a first
@@ -252,6 +405,7 @@ async function apply(project: LocalProject, target: SyncTarget, opts: ApplyOptio
     const appliedDir = blueprint.dir ? join(project.root, blueprint.dir) : join(project.root, 'blueprint')
     const subjects = new Set(blueprint.actions.flatMap((a) => (a.fit.subject ? [a.fit.subject] : [])))
     for (const [type, props] of editableSets(appliedDir, subjects)) {
+      editableDone.add(type)
       const set = await runCli(project, ['blueprint', 'editable', type, '--set', props.join(','), '--profile', profiles.organization], opts.auth)
       if (!set.ok && !/no change|already|unchanged/i.test(set.output)) notes = [notes, `  warning: ${type}'s editable fields (${props.join(', ')}) could not be declared: ${oneLine(applyErrorText(set.output))}`].filter(Boolean).join('\n')
     }
@@ -278,47 +432,251 @@ async function apply(project: LocalProject, target: SyncTarget, opts: ApplyOptio
     const refused = await prepareActions(actionCalls, names, new Set(authoredAgain))
     if (refused.size) return { ok: false, output: `error [BLUEPRINT_ACTIONS]: governed Action ${[...refused].map(([name, why]) => `${name}: ${why}`).join('; ')}` }
   }
+  // Every other type's `backing.editable` too, before the publish: an editable type's rows carry
+  // their record version, which an Action on it (one to come, or an App's) submits.
+  if (blueprint && opts.publish) {
+    const appliedDir = blueprint.dir ? join(project.root, blueprint.dir) : join(project.root, 'blueprint')
+    for (const [type, props] of editableSets(appliedDir, null)) {
+      if (editableDone.has(type)) continue
+      const set = await runCli(project, ['blueprint', 'editable', type, '--set', props.join(','), '--profile', profiles.organization], opts.auth)
+      if (!set.ok && !/no change|already|unchanged/i.test(set.output)) result = { ...result, output: `${result.output}\n  warning: ${type}'s editable fields (${props.join(', ')}) could not be declared: ${oneLine(applyErrorText(set.output))}` }
+    }
+  }
   const objectTypes = target.kind === 'blueprint' ? blueprintObjectTypes(blueprintRoot) : []
-  for (const step of followUpsFor(target, profiles, { publish: opts.publish, workspaceId: opts.workspaceId, objectTypes })) {
+  // The workspace's grants beyond read (`blueprint/workspace-grants.yaml`); a file that is wrong fails the Blueprint, said by line.
+  const workspaceGrants = target.kind === 'blueprint' ? readWorkspaceGrants(project.root) : null
+  if (workspaceGrants?.problems.length) return { ok: false, output: workspaceGrants.problems.map((p) => `error [WORKSPACE_GRANTS]: ${p}`).join('\n') }
+  const unknownTypes = (workspaceGrants?.grants ?? []).filter((g) => !objectTypes.includes(g.objectType)).map((g) => g.objectType)
+  if (unknownTypes.length) result = { ...result, output: `${result.output}\n  warning: blueprint/workspace-grants.yaml names ${unknownTypes.join(', ')}, which the project's Blueprint doesn't hold here` }
+  for (const step of followUpsFor(target, profiles, { publish: opts.publish, workspaceId: opts.workspaceId, objectTypes, grants: workspaceGrants?.grants ?? [] })) {
     const done = await runCli(project, step.args, opts.auth)
     if (!done.ok && !step.alreadyDone?.test(done.output)) return done
   }
   if (blueprint) {
     // After the publish: what writes only the Blueprint's records runs here; the rest stays switched off.
     const actions: Record<string, ActionBuild> = actionCalls ? await deployActions(actionCalls, blueprint.actions) : {}
-    for (const [name, why] of Object.entries(blueprint.leftOffActions)) actions[name] = { status: 'left-off', reason: why }
+    for (const [name, why] of Object.entries(blueprint.leftOffActions)) actions[name] = { status: 'left-off', reason: why, ...(blueprint.refusedActions?.includes(name) ? { refused: true } : {}) }
+    // Deployed as the workspace runs it, with what its owner fixes there: the apply said it (a `warning:`
+    // line naming the file), and it is kept on its build for `local status` and `local check`.
+    for (const [name, lines] of Object.entries(blueprint.inheritedWarnings ?? {})) {
+      const a = actions[name]
+      if (a && a.status !== 'left-off') actions[name] = { ...a, inherited: lines }
+    }
     for (const [name, a] of Object.entries(actions)) {
       if (a.status === 'runs') result = { ...result, output: `${result.output}\n  governed Action ${name} runs on this runtime` }
-      else if (a.status !== 'left-off') result = { ...result, output: `${result.output}\n  warning: governed Action ${name} ${a.status === 'failed' ? 'didn’t deploy' : 'is switched off here'}: ${a.reason}` }
+      // A failed deploy is not a warning: it fails the Blueprint below, so nothing later meets it as ACTION_FORBIDDEN first.
+      else if (a.status === 'switched-off') result = { ...result, output: `${result.output}\n  warning: governed Action ${name} is switched off here: ${a.reason}` }
     }
     // Saved object sets, once the object types they read are published here.
     let objectSets: string[] = []
     let objectSetsAgain: string[] = []
+    let objectSetIds: Record<string, string> = {}
     if (creds && opts.publish) {
       const leftOff = new Set(Object.entries(blueprint.objects).flatMap(([name, o]) => (o.status === 'left-off' ? [name] : [])))
       const sets = await applyObjectSets(project.root, objectSetCalls(opts.serviceUrl, creds), leftOff)
       if (sets.lines.length || sets.warnings.length) result = { ...result, output: [result.output, ...sets.lines, ...sets.warnings].join('\n').trim() }
       objectSets = sets.warnings.map(adaptationOf)
       objectSetsAgain = sets.recreated
+      objectSetIds = sets.ids
     }
     result = {
       ...result,
-      blueprint: { objects: blueprint.objects, actions, ...(objectSets.length ? { objectSets } : {}) },
+      blueprint: { objects: blueprint.objects, actions, ...(objectSets.length ? { objectSets } : {}), ...(Object.keys(objectSetIds).length ? { objectSetIds } : {}), ...(blueprint.parts ? { parts: blueprint.parts } : {}) },
       ...(authoredAgain.length ? { authoredAgain } : {}),
       ...(objectSetsAgain.length ? { objectSetsAgain } : {}),
     }
+    // A governed Action that should run here and did not deploy fails the Blueprint: the object
+    // types are published, but what names the Action would only meet ACTION_FORBIDDEN later.
+    const undeployed = actionFailureLines(actions, project.root)
+    if (undeployed.length) {
+      const n = Object.values(actions).filter((a) => a.status === 'failed').length
+      const failureLines = [`error [LOCAL_ACTION_NOT_DEPLOYED]: ${n} governed Action${n === 1 ? '' : 's'} didn’t deploy on the local runtime`, ...undeployed]
+      result = { ...result, ok: false, failureLines, output: [...failureLines, result.output].join('\n').trim() }
+    }
   }
   return result
 }
 
+/**
+ * A Function's build output, led by what it imports that the project lacks:
+ * a relative import the bundler could not resolve, named by its project path
+ * (`functions/shared/eligibility`). A pull writes such a file only when the
+ * Function's source in the workspace holds it; one deployed before deploys
+ * kept them does not, so the next step is said. The output as it is when no
+ * import is unresolved.
+ */
+export function missingImportsOutput(project: LocalProject, entry: string, output: string): string {
+  const specs = [...new Set([...output.matchAll(/Could not resolve: "(\.{1,2}\/[^"]+)"/g)].map((m) => m[1]!))]
+  if (!specs.length) return output
+  const from = entry.split(sep).join('/')
+  const at = from.startsWith('.frontera/local/resolved/') ? from.slice('.frontera/local/resolved/'.length) : from
+  const paths = specs.map((s) => posix.normalize(posix.join(posix.dirname(at), s))).filter((p) => !existsSync(join(project.root, p)) && !['.ts', '.tsx', '.js', '/index.ts'].some((ext) => existsSync(join(project.root, `${p}${ext}`))))
+  if (!paths.length) return output
+  const named = paths.length === 1 ? paths[0]! : `${paths.slice(0, -1).join(', ')} and ${paths[paths.length - 1]}`
+  return [
+    `error [FUNCTION_IMPORT_MISSING]: imports ${named}, which ${paths.length === 1 ? 'isn’t' : 'aren’t'} in the project (from ${at})`,
+    `  hint: a pull brings what a Function imports from beside its folder when its source in the workspace holds it. If it doesn’t (deployed before deploys kept those files), deploy the Function again from its source with a current CLI and pull it, or add ${paths.length === 1 ? 'the file' : 'the files'} here`,
+    output,
+  ].join('\n')
+}
+
+/**
+ * An Agent's file without the Plugins the runtime refused (`invalid_plugins:
+ * decision`), as a copy under `.frontera/local/resolved/`: the names and the
+ * copy's path, or null when the refusal is not that, or names none the file has.
+ */
+export function withoutPlugins(project: LocalProject, file: string, output: string): { names: string[]; file: string } | null {
+  const m = /invalid_plugins: ([^\n]+)/.exec(output)
+  if (!m) return null
+  const refused = new Set(m[1]!.split(',').map((n) => n.trim()).filter(Boolean))
+  let doc: { config?: { plugins?: unknown } }
+  try {
+    doc = JSON.parse(readFileSync(join(project.root, file), 'utf8'))
+  } catch {
+    return null
+  }
+  const plugins = Array.isArray(doc.config?.plugins) ? (doc.config!.plugins as unknown[]) : []
+  const names = plugins.filter((p): p is string => typeof p === 'string' && refused.has(p))
+  if (!names.length) return null
+  doc.config!.plugins = plugins.filter((p) => !(typeof p === 'string' && refused.has(p)))
+  const copy = file.startsWith(join('.frontera', 'local', 'resolved')) ? file : join('.frontera', 'local', 'resolved', file)
+  mkdirSync(join(project.root, copy, '..'), { recursive: true })
+  writeFileSync(join(project.root, copy), `${JSON.stringify(doc, null, 2)}\n`)
+  return { names, file: copy }
+}
+
+/** A warning the workflow service's validation gave about a step (`node "ask": …`) or the output (`output: …`), as `workflow push` prints it. */
+export function isValidationWarning(line: string): boolean {
+  return /^\s*warning: (node "[^"]+"|output):/.test(line)
+}
+
+/**
+ * The lines of an apply's output `local dev` says: each warning, and each
+ * promotion of a workflow. Indented or not: an output put together from
+ * several commands is trimmed, which takes the indent off its first line (a
+ * push's first validation warning, before its "pushed draft" line).
+ */
+export function saidLines(output: string): string[] {
+  // `note:` says what an apply did that is not an adaptation (documents being chunked again).
+  return output.split('\n').filter((line) => /^\s*(warning: |note: |promoted workflow )/.test(line)).map((line) => `  ${line.trim()}`)
+}
+
+/** `hello: pushed draft v3` → 3: the version a `workflow push` stored. */
+export function pushedVersionOf(output: string): number | undefined {
+  const m = /:\s+pushed draft v(\d+)\b/.exec(output)
+  return m ? Number(m[1]) : undefined
+}
+
+/**
+ * Bind every object type that reads a dataset to the dataset's current
+ * revision, with the mapping in its file: after `dataset revise`, the types
+ * still read the revision their binding was made on. The binding's tree write
+ * goes to a folder that holds no object types, so the project's files stay
+ * as they are.
+ */
+async function rebindReaders(project: LocalProject, dataset: string, profiles: SyncProfiles, run: (args: string[]) => Promise<RunResult>): Promise<RunResult> {
+  const dir = join(project.root, 'blueprint', 'object-types')
+  const scratch = join(project.root, '.frontera', 'local', 'resolved', 'rebind')
+  const lines: string[] = []
+  let names: string[] = []
+  try {
+    names = readdirSync(dir).filter((f) => /\.(ya?ml|json)$/.test(f) && !f.startsWith('.'))
+  } catch {
+    return { ok: true, output: '' }
+  }
+  for (const file of names.sort()) {
+    let doc: { apiName?: unknown; backing?: { dataset?: unknown; mapping?: unknown } } | null
+    try {
+      doc = parseYaml(readFileSync(join(dir, file), 'utf8')) as typeof doc
+    } catch {
+      continue
+    }
+    if (typeof doc?.apiName !== 'string' || doc.backing?.dataset !== dataset || !doc.backing.mapping || typeof doc.backing.mapping !== 'object') continue
+    mkdirSync(scratch, { recursive: true })
+    const mappingFile = join(scratch, `${doc.apiName}.json`)
+    writeFileSync(mappingFile, `${JSON.stringify({ mapping: doc.backing.mapping }, null, 2)}\n`)
+    const bound = await run(['blueprint', 'bind', doc.apiName, '--dataset', dataset, '--file', mappingFile, '--accept-contract-change', '--dir', join(scratch, 'tree'), '--profile', profiles.organization])
+    if (!bound.ok) return { ...bound, output: `error [BLUEPRINT_REBIND]: ${doc.apiName} could not be bound to the new revision of ${dataset}\n${bound.output.trim()}` }
+    lines.push(`  bound ${doc.apiName} to the new revision of ${dataset}`)
+  }
+  return { ok: true, output: lines.join('\n') }
+}
+
+/** The local runner's loopback address, to ask it to sync a deploy at once. */
+function runnerAt(project: LocalProject): { runnerUrl?: string } {
+  const port = readState(project)?.ports.runner
+  return port ? { runnerUrl: `http://127.0.0.1:${port}` } : {}
+}
+
+/** The governed Actions the project's Blueprint deploys here that the runtime does not run, read live. */
+async function unchangedActionsDown(project: LocalProject, serviceUrl: string, creds: LocalCredentials, organizationId: string): Promise<Array<{ apiName: string; why: string }>> {
+  // An Action the runtime refused from these same files stays off however often the Blueprint is
+  // applied again: only a change to the files can bring it up, so it is not a reason to apply.
+  const recorded = loadBuild(project, organizationId).blueprint
+  const sameFiles = recorded?.hash !== undefined && recorded.hash === contentHash(project, { kind: 'blueprint', key: 'blueprint' })
+  const refusedHere = new Set(sameFiles ? Object.entries(recorded?.actions ?? {}).filter(([, a]) => a.status === 'left-off' || a.status === 'failed').map(([name]) => name) : [])
+  const expected = resolveBlueprint(project).actions.filter((a) => a.fit.runsLocally && !refusedHere.has(a.apiName)).map((a) => a.apiName)
+  if (!expected.length) return []
+  try {
+    return actionsNotRunning(expected, await liveActionStates(localActionCalls(serviceUrl, creds)))
+  } catch {
+    // Not readable now: the files decide, as before.
+    return []
+  }
+}
+
+/** The checks on an Agent's own files before they are applied: errors refuse the file, warnings travel with it. */
+function agentChecks(project: LocalProject, target: SyncTarget): { errors: string[]; warnings: string[] } {
+  if (target.kind !== 'agent' && target.kind !== 'operating' && target.kind !== 'bindings') return { errors: [], warnings: [] }
+  let doc: unknown
+  try {
+    doc = JSON.parse(readFileSync(join(project.root, target.file), 'utf8'))
+  } catch {
+    // Unreadable: the apply says so with the file's own error.
+    return { errors: [], warnings: [] }
+  }
+  if (target.kind === 'agent') return { errors: agentFileErrors(doc, target.slug), warnings: agentFileWarnings(doc, target.slug) }
+  if (target.kind === 'bindings') return { errors: [], warnings: approvalBindingNotes(project.root, target.slug, doc) }
+  return procedureToolProblems(doc, target.slug, boundTools(project.root, target.slug))
+}
+
+/**
+ * A failed Blueprint's output against the project's files: each indexed path
+ * (`actions.1.concurrency.strategy`) named by its file, read from the draft the
+ * runtime holds, and each issue said once.
+ */
+async function blueprintFailureOutput(project: LocalProject, output: string, serviceUrl: string): Promise<string> {
+  let text = output
+  const creds = readState(project)?.credentials
+  if (creds && hasIndexedPaths(text)) {
+    try {
+      const lifecycle = await localActionCalls(serviceUrl, creds)('org', 'GET', '/v1/blueprint/lifecycle')
+      const body = lifecycle.body as { data?: { draft?: { definition?: unknown } }; draft?: { definition?: unknown } } | null
+      const definition = body?.data?.draft?.definition ?? body?.draft?.definition
+      if (lifecycle.status < 300 && definition) text = nameIndexedPaths(text, definition, project.root)
+    } catch {
+      // Unnamed paths are still the runtime's words.
+    }
+  }
+  const lines = dedupeLines(text.split('\n'))
+  // Source systems have no file: say the one name an Action on the Blueprint's records gives.
+  const hint = sourceSystemHint(text)
+  if (hint && !text.includes(hint)) lines.push(`hint: ${hint}`)
+  return lines.join('\n')
+}
+
 /**
  * What a target was applied with, in words: the warnings the apply printed
  * (a Plugin it went without, a model swapped) and what it needs that the
  * runtime gives it differently (no computer; a governed Action switched off
  * here, as the last Blueprint build left it).
  */
-function adaptationsFor(project: LocalProject, target: SyncTarget, output: string, organizationId: string): { adaptations: string[]; stubbed: boolean } {
-  const fromOutput = output.split('\n').filter((l) => /^\s*warning: /.test(l)).map(adaptationOf)
+function adaptationsFor(project: LocalProject, target: SyncTarget, output: string, organizationId: string, validationWarnings: string[] = []): { adaptations: string[]; stubbed: boolean } {
+  // A workflow's validation warnings (`node "ask": …`, from the push) and the platform's findings on
+  // an Agent's behavior settings are said, but they hold wherever it runs: not adaptations to this runtime.
+  const validation = new Set(validationWarnings.map((l) => l.trim()))
+  // An Action's warning inherited from the workspace holds there too: the Action's, not an adaptation here.
+  const fromOutput = output.split('\n').filter((l) => /^\s*warning: /.test(l) && !(target.kind === 'workflow' && isValidationWarning(l)) && !validation.has(l.trim()) && !isApprovalNote(l) && !l.includes(INHERITED_FROM_PULL)).map(adaptationOf)
   if (target.kind === 'blueprint' || target.kind === 'dataset') return { adaptations: [...new Set(fromOutput)], stubbed: false }
   let files: Record<string, string> = {}
   try {
@@ -340,11 +698,20 @@ function adaptationsFor(project: LocalProject, target: SyncTarget, output: strin
     ...[...platformOnly].map((n) => [n, 'analytics'] as const),
   ])
   const portability = classify(itemNeeds(kind, files, new Set([...standIns, ...platformOnly]), builtIns), { actions, titles })
-  const judged = portability.adaptations.map((a) => a.charAt(0).toUpperCase() + a.slice(1))
+  // A Chat App that published here (its Agents were published) is no longer the owner's draft.
+  const published = target.kind === 'chat-app' && /^\s+published Chat App /m.test(output)
+  const judged = portability.adaptations
+    .map((a) => (a.charAt(0).toUpperCase() + a.slice(1)).replace('/apps/<slug>', target.kind === 'chat-app' ? `/apps/${target.name}` : '/apps/<slug>'))
+    .filter((a) => !(published && /^Saved as the owner’s draft/.test(a)))
   const stubbed = portability.class === 'stubbed' || (target.kind === 'plugin' && target.file.endsWith('.stand-in.json') && readStandIn(project.root, target.name)?.serves !== 'documentation')
   return { adaptations: [...new Set([...judged, ...fromOutput])], stubbed }
 }
 
+/** What the build record keeps of a Blueprint apply: each type, Action and left-off part, and the saved sets' ids. */
+function blueprintRecord(b: NonNullable<RunResult['blueprint']>): Pick<BuildEntry, 'objects' | 'actions' | 'objectSetIds' | 'parts'> {
+  return { objects: b.objects, actions: b.actions, ...(b.objectSetIds ? { objectSetIds: b.objectSetIds } : {}), ...(b.parts ? { parts: b.parts } : {}) }
+}
+
 /** The Blueprint's own adaptations, one line each: what is left off, and the Actions that do not run here. */
 function blueprintAdaptations(b: NonNullable<RunResult['blueprint']>): string[] {
   const out: string[] = []
@@ -355,10 +722,34 @@ function blueprintAdaptations(b: NonNullable<RunResult['blueprint']>): string[]
     if (a.status === 'failed') out.push(`Governed Action ${name} didn’t deploy: ${a.reason}`)
     if (a.status === 'left-off') out.push(`Governed Action ${name} is left off: ${a.reason}`)
   }
+  for (const [ref, p] of Object.entries(b.parts ?? {})) out.push(`${ref.replace('/', ' ').replace(/^linkType /, 'Link type ').replace(/^metric /, 'Metric ').replace(/^semanticType /, 'Semantic type ').replace(/^sharedField /, 'Shared field ')} is left off: ${p.reason}`)
   out.push(...(b.objectSets ?? []))
   return out
 }
 
+/**
+ * Sample data an older generator made (`remakeReason`), made again before the
+ * first apply, so each dataset applies once, as made now. The lines to say;
+ * none when there is nothing to remake, or `--keep-sample-data`. A pulled
+ * project's sample data that the pull wrote (`pulledSampleData`) is not made
+ * again unasked: a tracked file a first apply changes is a change nobody
+ * made. One line says newer rules exist, with the command that makes it
+ * again (`--remake-sample-data`, `asked`).
+ */
+export async function remakeStaleSampleData(root: string, keep: boolean, asked = false): Promise<string[]> {
+  if (keep) return []
+  const why = remakeReason(root, false)
+  if (!why) return []
+  if (!asked && pulledSampleData(root)) return hasGeneratedSampleData(root) ? [pulledSampleDataNote(root)] : []
+  try {
+    const remade = await remakeSampleData(root, why)
+    return remade ? remakeLines(remade) : []
+  } catch (err) {
+    // The datasets apply as they are; the remake is said, never a reason to stop.
+    return [`  warning: sample data wasn’t made again (${why}): ${(err as Error).message}`]
+  }
+}
+
 /**
  * The bindings an Agent could not get because the Function, workflow or
  * object type (its Context and data) is not on the runtime yet.
@@ -367,12 +758,22 @@ export function missingFromBindings(output: string): string[] {
   return [...new Set([...output.matchAll(/^\s+((?:function|workflow|objectType)\/[A-Za-z0-9._-]+): (?:404|.*(?:not found|no live version|does not exist|not on the runtime yet))/gim)].map((m) => m[1]!))]
 }
 
+/** How the runtime's embeddings stood against the workspace's, in words, for the line that applies a knowledge base again. */
+function embeddingWords(e: NonNullable<BuildEntry['embeddings']>): string {
+  return e === 'keyless' ? 'the keyless local embeddings' : e === 'same' ? 'the workspace’s model' : e === 'workspace' ? 'another model than the workspace’s' : 'another model than the platform’s default'
+}
+
 async function dev(ctx: CommandContext) {
+  // `--strict` decides what one apply exits with; a watcher has no exit to decide.
+  if (flagBool(ctx, 'strict') && !flagBool(ctx, 'once')) throw new UsageError('--strict needs --once', 'frontera local dev --once --strict')
   const project = localProject(ctx.cwd)
   const state = readState(project)
   if (!state || state.phase !== 'ready' || !state.supervisorPid || !isAlive(state.supervisorPid)) {
     throw new CliError('the local runtime is not running', { code: 'LOCAL_NOT_RUNNING', hint: 'run `frontera local start` first' })
   }
+  // A copy of a project carries the binding it was made under: bound here to this runtime instead (`copiedLocalBinding`).
+  const rebound = rebindCopiedProject(project)
+  if (rebound) ctx.output.note(rebound)
   // The profile was registered when the runtime started; applying needs only the keys in the project's state.
   const workspace = localProfileName(project)
   const profiles: SyncProfiles = { workspace, organization: `${workspace}-org`.slice(0, 64) }
@@ -387,6 +788,7 @@ async function dev(ctx: CommandContext) {
     publish: !flagBool(ctx, 'no-publish'),
     workspaceId: state.credentials!.workspaceId,
     serviceUrl,
+    note: (line) => ctx.output.note(line),
   }
 
   const organizationId = state.credentials!.organizationId
@@ -402,7 +804,7 @@ async function dev(ctx: CommandContext) {
     const seen = JSON.stringify(synced)
     if (seen === settingsSeen) return
     settingsSeen = seen
-    const mirrored = await mirrorOrgSettings(synced, settingsCalls(serviceUrl, creds)).catch(() => null)
+    const mirrored = await mirrorOrgSettings(synced, settingsCalls(serviceUrl, creds), { localEmbeddings: localEmbeddingsReachable() }).catch(() => null)
     if (mirrored) {
       for (const line of mirrored.lines) ctx.output.note(line)
       for (const d of mirrored.differences) ctx.output.note(`  differs from the workspace: ${d}`)
@@ -418,36 +820,82 @@ async function dev(ctx: CommandContext) {
   const promoteAfter = new Set<string>()
   // Agents whose row name was checked against their file in this session.
   const named = new Set<string>()
-  let failures = 0
+  // What is failing now, by target, for `--once --json`: the item and its error.
+  const failing = new Map<string, { item: string; error: string }>()
+  // What each item's last apply warned, by target, for `--once --json` (and the MCP `apply`): the item and its lines.
+  const warned = new Map<string, { item: string; warnings: string[] }>()
   // Whether anything applied since the failed targets were last tried.
   let progressed = false
   let busy = false
   let stopping = false
   let timer: ReturnType<typeof setTimeout> | null = null
+  // An item applied again and again with no change to its files is a bug: stopped, and said (`ApplyWatchdog`).
+  const watchdog = new ApplyWatchdog()
+  let drains = 0
+  // Items that failed because the runtime wasn't answering: applied again once it answers.
+  const waiting = new Map<string, SyncTarget>()
+  // Set by an apply that found the runtime down: the drain stops, and what is queued waits for it.
+  let runtimeDown = false
+  // What starts the next round of applies, for Activity: the files queued since the last one, or a reason of its own.
+  const changedFiles = new Set<string>()
+  let nextTrigger: string | null = null
+  /**
+   * The round under way, once it applies something: a round that finds every
+   * queued item unchanged applies nothing, so it never says "Applying" and is
+   * never recorded as an apply.
+   */
+  let round: { since: string | null; trigger: string; applied: number; failed: number } = { since: null, trigger: '', applied: 0, failed: 0 }
+  const markApplying = () => {
+    if (round.since) return
+    round.since = new Date().toISOString()
+    // Forge and Studio say "Applying…" until the queue is done, not a half-made count as the result.
+    recordApplying(project, { since: round.since, queued: pending.size + 1, pid: process.pid, trigger: round.trigger })
+  }
 
   /** What one apply came to, for the build record Forge and Studio read (design §9). */
   const buildEntry = (target: SyncTarget, hash: string | null, result: RunResult): BuildEntry => {
-    const base = { what: describeTarget(target), hash, at: new Date().toISOString() }
+    // A workflow: the version its last promotion here made live, this apply's or the one before.
+    const live = target.kind === 'workflow' ? (result.ok ? promotedVersionOf(result.output, target.slug) : undefined) ?? loadBuild(project, organizationId)[target.key]?.live : undefined
+    const base = { what: describeTarget(target), hash, at: new Date().toISOString(), ...(result.ok && result.version ? { version: result.version } : {}), ...(live ? { live } : {}) }
     if (result.ok) {
       // A Blueprint with a media-backed type over an empty Media Set is Stubbed, as an item with a stand-in is.
-      const { adaptations, stubbed } = result.blueprint ? { adaptations: [...new Set([...blueprintAdaptations(result.blueprint)])], stubbed: Object.values(result.blueprint.objects).some((o) => o.status === 'stubbed') } : adaptationsFor(project, target, result.output, organizationId)
+      const { adaptations, stubbed } = result.blueprint ? { adaptations: [...new Set([...blueprintAdaptations(result.blueprint)])], stubbed: Object.values(result.blueprint.objects).some((o) => o.status === 'stubbed') } : adaptationsFor(project, target, result.output, organizationId, result.validationWarnings)
       return {
         ...base,
         status: stubbed ? 'stubbed' : adaptations.length ? 'adapted' : 'built',
         ...(adaptations.length ? { adaptations } : {}),
-        ...(result.blueprint ? { objects: result.blueprint.objects, actions: result.blueprint.actions } : {}),
+        ...(result.blueprint ? blueprintRecord(result.blueprint) : {}),
       }
     }
     const missing = result.missing?.length ? result.missing : target.kind === 'bindings' ? missingFromBindings(result.output) : []
     if (missing.length || result.unnamedActions) return { ...base, status: 'blocked', needs: missing, ...(result.unnamedActions ? { unnamedActions: result.unnamedActions } : {}) }
-    return { ...base, status: 'failed', error: oneLine(applyErrorText(result.output)) }
+    // A Blueprint published with an Action that didn't deploy keeps how each type and Action came out.
+    return { ...base, status: 'failed', error: oneLine(applyErrorText(result.output)), ...failureCodeAndHint(result.output), ...(result.blueprint ? blueprintRecord(result.blueprint) : {}) }
   }
 
   const runOne = async (target: SyncTarget) => {
     if (stopping) return
     if (target.kind !== 'blueprint' && !existsSync(join(project.root, target.file))) return
     const hash = contentHash(project, target)
-    if (hash && applied.get(target.key) === hash) {
+    // Unchanged files, but the runtime lost the Agent's draft (it was published): the draft is
+    // what its test cases and Studio's Draft chat run, so it is staged again from the files.
+    const draftGone = hash && applied.get(target.key) === hash && target.kind === 'agent' && (await hasAgentDraft({ slug: target.slug, serviceUrl, creds })) === false
+    if (draftGone) ctx.output.note(`  ${describeTarget(target)} has no draft on the runtime (it was published): staging it again from ${target.file}`)
+    // Unchanged files, but a governed Action that should run here does not (a failed apply left it
+    // switched off, or its deployment no longer matches its contract): the Blueprint is applied again.
+    const actionsDown = hash && applied.get(target.key) === hash && target.kind === 'blueprint' && options.publish ? await unchangedActionsDown(project, serviceUrl, creds, organizationId) : []
+    for (const a of actionsDown) ctx.output.note(`  governed Action ${a.apiName} doesn’t run on the runtime (${a.why}): applying the Blueprint again`)
+    // Unchanged, but applied before the build recorded which version the file was pushed as:
+    // pushed once more, so its tests run exactly that version (never a stale draft).
+    const recorded = loadBuild(project, organizationId)[target.key]
+    const versionUnknown = hash && applied.get(target.key) === hash && target.kind === 'workflow' && (!recorded || (recorded.status !== 'failed' && recorded.status !== 'blocked' && recorded.version === undefined))
+    if (versionUnknown) ctx.output.note(`  ${describeTarget(target)}: pushing ${target.file} again to record the version it runs as`)
+    // A knowledge base's threshold follows the runtime's embeddings (`knowledgeSettings`): when they changed since
+    // it was applied (a key set, the keyless local embeddings in its place), it is applied again with unchanged files.
+    const embeddings = target.kind === 'knowledge' ? ((await embeddingsDiffer(project.root, { serviceUrl, creds }).catch((): false => false)) || ('same' as const)) : undefined
+    const embeddingsMoved = !!embeddings && !!hash && applied.get(target.key) === hash && (recorded?.embeddings ?? 'same') !== embeddings
+    if (embeddingsMoved) ctx.output.note(`  ${describeTarget(target)}: the runtime’s embeddings changed since it was applied (${embeddingWords(recorded?.embeddings ?? 'same')} then, ${embeddingWords(embeddings!)} now): applying it again so its threshold follows`)
+    if (hash && applied.get(target.key) === hash && !draftGone && !actionsDown.length && !versionUnknown && !embeddingsMoved) {
       unchanged += 1
       // An Agent applied before names were set from its file still reads its slug: set it once.
       if (target.kind === 'agent' && !named.has(target.slug)) {
@@ -461,26 +909,89 @@ async function dev(ctx: CommandContext) {
       if (!loadBuild(project, organizationId)[target.key]) recordBuild(project, organizationId, target.key, { what: describeTarget(target), status: 'built', hash, at: new Date().toISOString() })
       return
     }
+    const verdict = watchdog.before(target.key, hash, drains)
+    if (verdict !== 'apply') {
+      if (verdict === 'stop') {
+        const line = stoppedReapplyingLine(describeTarget(target), watchdog.applyLimit)
+        ctx.output.note(`  ✕ ${line}`)
+        recordBuild(project, organizationId, target.key, { what: describeTarget(target), status: 'blocked', needs: [], error: line, hash, at: new Date().toISOString() })
+        failing.set(target.key, { item: describeTarget(target), error: line })
+      }
+      return
+    }
     const started = Date.now()
-    const result = await apply(project, target, options)
+    markApplying()
+    let result = await apply(project, target, options)
+    watchdog.after(target.key, result.ok)
+    if (result.ok) round.applied += 1
+    else round.failed += 1
     if (stopping) return
+    // A failure while the runtime wasn't answering (stopped, restarting, its database going down
+    // or being restored) is not the files': said as that, and applied again when it answers.
+    if (!result.ok && (await failedForRuntime(project, result.output))) {
+      runtimeDown = true
+      if (applied.delete(target.key)) saveHashes(project, organizationId, applied)
+      waiting.set(target.key, target)
+      failing.set(target.key, { item: describeTarget(target), error: RUNTIME_DOWN_ERROR })
+      recordBuild(project, organizationId, target.key, { what: describeTarget(target), status: 'failed', error: RUNTIME_DOWN_ERROR, hash, at: new Date().toISOString() })
+      ctx.output.note(`  ✕ ${describeTarget(target)}: ${RUNTIME_STOPPED_LINE}`)
+      return
+    }
+    if (!result.ok && target.kind === 'blueprint') result = { ...result, output: await blueprintFailureOutput(project, result.output, serviceUrl) }
     const ms = Date.now() - started
     recordApplied(project, { at: new Date().toISOString(), what: describeTarget(target), ok: result.ok })
-    recordBuild(project, organizationId, target.key, buildEntry(target, hash, result))
+    recordBuild(project, organizationId, target.key, { ...buildEntry(target, hash, result), ...(embeddings ? { embeddings } : {}) })
     if (result.ok) {
       // A draft-only Blueprint is not what a plain `local dev` would leave, so it is not recorded as applied.
       if (target.kind === 'blueprint' && !options.publish) applied.delete(target.key)
       else applied.set(target.key, hash)
       saveHashes(project, organizationId, applied)
       failed.delete(target.key)
+      failing.delete(target.key)
       ctx.output.note(`  ✓ ${describeTarget(target)} applied (${ms} ms)`)
+      if (target.kind === 'blueprint') personasDue = true
       if (target.kind === 'workflow' && promoteAfter.delete(target.key)) {
-        const promoted = await promoteWorkflow(serviceUrl, creds, target.slug)
-        if (promoted) ctx.output.note(`  promoted workflow ${target.slug} v${promoted}: its live version ran the Action's old id`)
+        const promoted = await promoteWorkflow(serviceUrl, creds, target.slug, result.version)
+        if (promoted) {
+          ctx.output.note(`  promoted workflow ${target.slug} v${promoted}: its live version ran the Action's old id`)
+          const entry = loadBuild(project, organizationId)[target.key]
+          if (entry) recordBuild(project, organizationId, target.key, { ...entry, live: promoted })
+        }
       }
       // What it was applied without, or with instead (a missing model), said once here.
-      for (const line of result.output.split('\n')) if (/^\s+warning: /.test(line)) ctx.output.note(`  ${line.trim()}`)
+      // A promotion is said too: what Agents and webhooks start changed.
+      const warnings = saidLines(result.output).filter((line) => /^\s*warning: /.test(line)).map((line) => line.trim().replace(/^warning: /, ''))
+      if (warnings.length) warned.set(target.key, { item: describeTarget(target), warnings })
+      else warned.delete(target.key)
+      for (const line of saidLines(result.output)) {
+        ctx.output.note(line)
+        const secret = /Needs a value for ([A-Z][A-Z0-9_]*)/.exec(line)?.[1]
+        if (secret) secretsSaid.add(secret)
+      }
+      if (result.datasetRevised) {
+        ctx.output.note(result.output.trim().replace(/^/, '  '))
+        // The object types reading it move to the new revision when the Blueprint is applied again.
+        applied.delete('blueprint')
+        pending.set('blueprint', { kind: 'blueprint', key: 'blueprint' })
+      }
       progressed = true
+      // An Agent applied without this Function while it did not build gets it now.
+      const built = target.kind === 'function' ? functionSlugOf(target.key) : null
+      if (built) {
+        const record = loadBuild(project, organizationId)
+        for (const t of allTargets(project.root)) {
+          if (t.kind !== 'bindings' || record[t.key]?.status === 'built' || pending.has(t.key)) continue
+          let text = ''
+          try {
+            text = readFileSync(join(project.root, t.file), 'utf8')
+          } catch {
+            continue
+          }
+          if (!text.includes(`function/${built}"`)) continue
+          applied.delete(t.key)
+          pending.set(t.key, t)
+        }
+      }
       // Workflows and Agents hold the runtime's id of each Action they run: a new id means applying them again.
       if (result.authoredAgain?.length || result.objectSetsAgain?.length) {
         const names = result.authoredAgain ?? []
@@ -500,17 +1011,65 @@ async function dev(ctx: CommandContext) {
         }
       }
     } else {
+      // A failed apply may have changed the runtime (an Action retired, switched off): the file is not
+      // "unchanged" afterwards, even when it is restored to what last applied.
+      if (applied.delete(target.key)) saveHashes(project, organizationId, applied)
       failed.set(target.key, target)
-      // A retry that fails the same way is not said (or counted) again in the same round of changes.
-      const text = applyErrorText(result.output)
+      // A retry that fails the same way is not said again in the same round of changes.
+      // A governed Action's checks are each a line to fix: shown whole, not cut to the first seven lines.
+      const text = result.failureLines ? result.failureLines.map((l, i) => (i ? `      ${l}` : l)).join('\n') : applyErrorText(result.output)
+      failing.set(target.key, { item: describeTarget(target), error: result.failureLines?.join('\n') ?? applyErrorText(result.output).replace(/\n\s+/g, '\n') })
       if (said.get(target.key) !== text) {
-        failures += 1
         said.set(target.key, text)
         ctx.output.note(`  ✕ ${describeTarget(target)}: ${text}`)
       }
     }
   }
 
+  /** Whether the local personas are to be seeded after this drain: at the start, and after each Blueprint apply. */
+  let personasDue = true
+  /** Whether the project's secrets are to be said after this drain: after a database restore. */
+  let secretsDue = false
+  /** Whether to deploy again the Custom Apps a database restore took away (`local-app-restore.ts`): at the start, and after a restore. */
+  let appsDue = true
+
+  /**
+   * A Custom App deployed after the baseline a restore went back to is not on
+   * the runtime: deployed again from its folder (`frontera app deploy
+   * --build`), as it was. A failure keeps the mark: status says so, with the fix.
+   */
+  const redeployRestoredApps = async () => {
+    for (const app of appsAwayByRestore(project.root)) {
+      if (stopping) return
+      ctx.output.note(`  App ${app.name}'s deployment ${app.deployment} went with the database restore: deploying it again (\`frontera app deploy --build\` in ${app.dir})`)
+      const result = await runCli(project, ['app', 'deploy', '--build', '--dir', join(project.root, app.dir), '--profile', profiles.workspace], options.auth)
+      ctx.output.note(result.ok ? `  ✓ App ${app.name} deployed again` : `  ✕ App ${app.name} wasn't deployed again: ${oneLine(applyErrorText(result.output))} — \`frontera app deploy\` in ${app.dir}`)
+    }
+  }
+
+  /** Secrets an apply in this round already said need a value: not said twice. */
+  const secretsSaid = new Set<string>()
+
+  /**
+   * Each secret `secrets.json` declares or a workflow or Function names that
+   * the runtime has no value for (names and whether a value is set only; values
+   * are never read or written): said on every start and after a database
+   * restore, for unchanged items too, since a restore can leave a secret
+   * listed without its value.
+   */
+  const sayProjectSecrets = async () => {
+    const presence = await localSecretPresence(serviceUrl, creds)
+    for (const line of projectSecretLines(project.root, presence)) {
+      const secret = /Needs a value for ([A-Z][A-Z0-9_]*)/.exec(line)?.[1]
+      if (secret && secretsSaid.has(secret)) continue
+      ctx.output.note(`  ${line.trim()}`)
+    }
+    secretsSaid.clear()
+  }
+
+  /** Files already said not to be applied, so a save does not say it again. */
+  const unappliedSaid = new Set<string>()
+
   /** What each failure last said in this drain, so a retry failing the same way is said once. */
   const said = new Map<string, string>()
 
@@ -518,18 +1077,48 @@ async function dev(ctx: CommandContext) {
   const drain = async () => {
     if (busy) return
     busy = true
+    // Why this round runs; "Applying" is said only once an item actually applies (`markApplying`).
+    round = { since: null, trigger: nextTrigger ?? filesChangedTrigger(changedFiles), applied: 0, failed: 0 }
+    nextTrigger = null
+    changedFiles.clear()
     said.clear()
+    drains += 1
+    runtimeDown = false
+    let resumed = 0
     try {
       for (;;) {
-        while (pending.size && !stopping) {
+        while (pending.size && !stopping && !runtimeDown) {
           const next = [...pending.values()].sort(byApplyOrder)[0]!
           pending.delete(next.key)
           try {
             await runOne(next)
           } catch (err) {
-            ctx.output.note(`  ✕ ${describeTarget(next)}: ${(err as Error).message}`)
+            // A call before the apply (a lookup of the runtime's ids) that couldn't reach the runtime.
+            if (!stopping && !(await runtimeAnswering(project))) {
+              runtimeDown = true
+              waiting.set(next.key, next)
+              failing.set(next.key, { item: describeTarget(next), error: RUNTIME_DOWN_ERROR })
+              ctx.output.note(`  ✕ ${describeTarget(next)}: ${RUNTIME_STOPPED_LINE}`)
+            } else ctx.output.note(`  ✕ ${describeTarget(next)}: ${(err as Error).message}`)
+          }
+        }
+        if (runtimeDown) {
+          // The rest waits for the runtime too, rather than each failing the same way.
+          for (const [key, rest] of pending) {
+            waiting.set(key, rest)
+            failing.set(key, { item: describeTarget(rest), error: RUNTIME_DOWN_ERROR })
           }
+          pending.clear()
         }
+        // What failed while the runtime was down is applied again once it answers (at most twice a drain;
+        // after that, a watching `local dev` asks again every few seconds).
+        if (!stopping && waiting.size && resumed < 2 && (await runtimeAnswering(project))) {
+          resumed += 1
+          runtimeDown = false
+          resumeWaiting()
+          continue
+        }
+        if (runtimeDown) break
         // What failed is tried again once the queue is empty, and only while a round applied
         // something it may have been waiting for; otherwise it waits for its own file to change.
         if (stopping || !progressed || !failed.size) break
@@ -537,8 +1126,29 @@ async function dev(ctx: CommandContext) {
         for (const [key, retry] of failed) pending.set(key, retry)
         failed.clear()
       }
+      // Once the Actions are on the runtime: a local persona per approval step, and a submitter.
+      if (personasDue && !stopping && !runtimeDown && !failing.has('blueprint')) {
+        personasDue = false
+        for (const line of await seedPersonas(project.root, serviceUrl, creds)) ctx.output.note(line)
+      }
+      // After a restore's applies: the secrets that lost their value with it, unchanged items' included.
+      if (secretsDue && !stopping && !runtimeDown) {
+        secretsDue = false
+        await sayProjectSecrets()
+      }
+      // And the Custom Apps it took away, once what they read is applied again.
+      if (appsDue && !stopping && !runtimeDown) {
+        appsDue = false
+        await redeployRestoredApps()
+      }
     } finally {
       busy = false
+      if (round.since) {
+        recordApply(project, { since: round.since, finished: new Date().toISOString(), trigger: round.trigger, applied: round.applied, failed: round.failed })
+        recordApplying(project, null)
+      }
+      // A file saved after the queue emptied, before this round ended: its own round.
+      if (pending.size && !stopping && !runtimeDown) schedule()
     }
   }
 
@@ -547,16 +1157,88 @@ async function dev(ctx: CommandContext) {
     timer = setTimeout(() => void drain(), DEBOUNCE_MS)
   }
 
-  /** What a changed path means: one file, every Function (a helper or the SDK changed), or a moved folder. */
-  const queuePath = (rel: string) => {
-    // Forge's state and the runtime's resolved copies are written under `.frontera/`: never a reason to apply.
-    if (rel.split(sep).some((p) => p === '.frontera' || p === 'node_modules' || p === '.git')) return
+  /** What waited for the runtime, queued again: said once. */
+  const resumeWaiting = () => {
+    if (!waiting.size) return
+    ctx.output.note(`  the local runtime is answering again: applying the ${waiting.size === 1 ? 'item' : `${waiting.size} items`} it missed`)
+    nextTrigger ??= 'the runtime is answering again'
+    for (const [key, target] of waiting) {
+      pending.set(key, target)
+      failing.delete(key)
+    }
+    waiting.clear()
+  }
+
+  /** A target queued by a file event (`rel`, the changed path): whatever it re-applied before starts over (`ApplyWatchdog`). */
+  const queueFromFile = (target: SyncTarget, rel: string) => {
+    pending.set(target.key, target)
+    changedFiles.add(rel)
+    watchdog.fileEvent(target.key)
+  }
+
+  /**
+   * The database was restored to its baseline (`frontera local snapshot restore`, `local check`):
+   * the record of what is applied was put back with it, so this watcher takes it too, and applies
+   * again what it had applied since.
+   */
+  let restoreSeen = readBaseline(project, organizationId)?.restoredAt
+  const afterRestore = () => {
+    const record = readBaseline(project, organizationId)
+    if (!record?.restoredAt || record.restoredAt === restoreSeen) return
+    restoreSeen = record.restoredAt
+    const now = loadHashes(project, organizationId)
+    const changed = new Set([...applied.keys(), ...now.keys()].filter((k) => applied.get(k) !== now.get(k)))
+    applied.clear()
+    for (const [k, v] of now) applied.set(k, v)
+    // A Custom App deployed after the baseline went with it: deployed again after this round.
+    appsDue = true
+    // A restore can leave a secret listed without its value, whether or not anything applies again.
+    if (!changed.size) {
+      if (appsAwayByRestore(project.root).length) {
+        secretsDue = true
+        nextTrigger = 'the database was restored to its baseline'
+        if (!busy) schedule()
+        return
+      }
+      if (!busy) void sayProjectSecrets()
+      else secretsDue = true
+      return
+    }
+    secretsDue = true
+    nextTrigger = 'the database was restored to its baseline'
+    for (const t of allTargets(project.root)) if (changed.has(t.key)) pending.set(t.key, t)
+    ctx.output.note(`  the database was restored to its baseline: applying ${changed.size === 1 ? 'one item' : `${changed.size} items`} applied since then again`)
+    if (!busy) schedule()
+  }
+
+  /**
+   * What a changed path means: one file, every Function (a helper or the SDK changed), or a moved folder.
+   * Whether it queued anything: a path that queues nothing never starts a round.
+   */
+  const queuePath = (rel: string): boolean => {
+    // Forge's state, the coding agents' settings, screenshots and notes: never a reason to apply (`canChangeRuntime`).
+    if (!canChangeRuntime(rel)) return false
     const absolute = join(project.root, rel)
     const direct = targetFor(project.root, absolute)
     if (direct) {
-      pending.set(direct.key, direct)
-      return
+      queueFromFile(direct, rel)
+      if (direct.kind !== 'blueprint') return true
+    }
+    // A saved file that matches no kind is said once, with where it belongs.
+    if (!unappliedSaid.has(rel) && existsSync(absolute)) {
+      const why = (() => {
+        try {
+          return lstatSync(absolute).isFile() ? unappliedReason(project.root, rel) : null
+        } catch {
+          return null
+        }
+      })()
+      if (why) {
+        unappliedSaid.add(rel)
+        ctx.output.note(`  warning: ${rel} isn't applied: ${why}`)
+      }
     }
+    if (direct) return true
     const top = rel.split(sep)[0]
     const isDir = (() => {
       try {
@@ -567,13 +1249,53 @@ async function dev(ctx: CommandContext) {
     })()
     // A helper in functions/, the SDK, or a shared file a Function imports from outside functions/.
     const helper = ((top === 'functions' || top === 'vendor') && /\.ts$/.test(rel) && !rel.endsWith('.test.ts')) || isSharedFunctionFile(rel.split(sep).join('/'))
-    if (!isDir && !helper) return
+    if (!isDir && !helper) return false
+    let queued = false
     for (const target of allTargets(project.root)) {
       const path = target.kind === 'blueprint' ? 'blueprint' : target.file
-      if (helper ? target.kind === 'function' : path === rel || path.startsWith(rel + sep)) pending.set(target.key, target)
+      if (helper ? target.kind === 'function' : path === rel || path.startsWith(rel + sep)) {
+        queueFromFile(target, rel)
+        queued = true
+      }
     }
+    return queued
   }
 
+  /**
+   * What the runtime holds that the files no longer do (`local-orphans.ts`): an Agent, workflow or
+   * Function the project applied whose file is gone is taken out of service, reversibly, and said.
+   * The runtime is asked only when an applied file is missing, so a save never costs a listing.
+   */
+  let sweeping: Promise<void> | null = null
+  const sweepOrphans = (): Promise<void> =>
+    (sweeping ??= (async () => {
+      try {
+        const known = loadHashes(project, organizationId)
+        const present = new Set(allTargets(project.root).map((t) => t.key))
+        if (![...known.keys()].some((k) => /^(agent|workflow|function):/.test(k) && !present.has(k))) return
+        const call = orphanCalls(serviceUrl, creds)
+        if (!call) return
+        const orphans = findOrphans(project.root, await runtimeItems(call, creds.workspaceId), new Set(known.keys())).filter((o) => o.deleted)
+        if (!orphans.length) return
+        const { lines, forget } = await retireDeleted(project, organizationId, call, orphans)
+        for (const line of lines) ctx.output.note(line)
+        if (forget.length) {
+          // Forgotten as applied, so the file, if it comes back unchanged, is applied again.
+          for (const key of forget) {
+            applied.delete(key)
+            known.delete(key)
+          }
+          saveHashes(project, organizationId, known)
+          // The runtime changed: Studio's lists and Forge's home read it again.
+          recordApplied(project, { at: new Date().toISOString(), what: orphans.map((o) => `${o.kind} ${o.name}`).join(', '), ok: true })
+        }
+      } catch (err) {
+        ctx.output.note(`  warning: what the runtime holds without a file couldn’t be checked: ${(err as Error).message}`)
+      } finally {
+        sweeping = null
+      }
+    })())
+
   // Watch from the start, so a save during the first sync is not missed.
   const once = flagBool(ctx, 'once')
   // One watcher per project (Forge keeps one running; a second would apply every change twice). `--once` is always allowed.
@@ -588,37 +1310,100 @@ async function dev(ctx: CommandContext) {
     }
     writeFileSync(pidFile, String(process.pid))
   }
+  // Before the watcher and the first apply: the datasets it rewrites apply once, as made now.
+  const sampleLines = await remakeStaleSampleData(project.root, flagBool(ctx, 'keep-sample-data'), flagBool(ctx, 'remake-sample-data'))
+  for (const line of sampleLines) ctx.output.note(line)
   const watcher = once
     ? null
     : watch(project.root, { recursive: true }, (_event, filename) => {
         if (!filename || stopping) return
         if (filename.toString() === join('.frontera', 'sync', 'remote.json')) void mirrorSettings()
-        queuePath(filename.toString())
-        if (!busy) schedule()
+        if (filename.toString() === PROJECT_SECRETS_FILE) void sayProjectSecrets()
+        if (filename.toString() === BASELINE_RECORD) afterRestore()
+        // An Agent's folder, a workflow's or a Function's file deleted: what the runtime holds follows.
+        if (/^(agents|workflows|functions)([\\/]|$)/.test(filename.toString()) && !existsSync(join(project.root, filename.toString()))) void sweepOrphans()
+        // Only a change that queued an item starts a round: the watcher's own writes under `.frontera/`,
+        // a screenshot, a coding agent's settings or a note in docs/ never do.
+        if (queuePath(filename.toString()) && !busy) schedule()
       })
 
   const targets = allTargets(project.root)
   // Outcomes of files that are gone are forgotten, so the home lists what the project holds.
   pruneBuild(project, organizationId, new Set(targets.map((t) => t.key)))
+  // An Agent, workflow or Function whose file was deleted is taken out of service here, as the files now say.
+  await sweepOrphans()
   ctx.output.note(targets.length ? `Applying ${targets.length} item${targets.length === 1 ? '' : 's'} to the local runtime` : 'Nothing to apply yet')
+  // Files in the applied folders that match no kind: said, not skipped in silence.
+  for (const line of unappliedFiles(project.root)) {
+    unappliedSaid.add(line.split(': ')[0]!)
+    ctx.output.note(`  warning: ${line.replace(/^([^:]+): /, "$1 isn't applied: ")}`)
+  }
+  // The vendored SDK's files the CLI wrote and nobody edited follow this CLI's copy; the rest are said below.
+  const sdk = vendoredSdkState(project.root)
+  // Never back to an older copy: one a newer CLI wrote is kept, and said below with the advice to upgrade.
+  if (!sdk.unknown && !sdk.newer && (sdk.outdated.length || sdk.missing.length)) {
+    const done = refreshVendoredSdk(project.root)
+    ctx.output.note(`  vendor/frontera/: ${done.replaced.length + done.added.length} file${done.replaced.length + done.added.length === 1 ? '' : 's'} of the Functions SDK brought to this CLI's copy (unedited since the CLI wrote them)`)
+  }
+  // An older project's root `bun test` sweeps the Apps' tests too: a bunfig.toml keeps it to functions/, written only when there is none.
+  if (ensureProjectBunfig(project.root)) ctx.output.note("  bunfig.toml: written, so `bun test` here runs only the Functions' unit tests (functions/); an App's tests run in its folder")
+  // What the project's tests and the runtime can't show: the pull's notes, sample data an older generator made, an older vendored SDK.
+  // The sample data line above already said what there is to say of it.
+  for (const line of noticeLines({ ...projectNotices(project.root), ...(sampleLines.length ? { sampleData: null } : {}) })) ctx.output.note(`  warning: ${line}`)
   for (const target of targets) pending.set(target.key, target)
+  // The first round: the runtime just started (Forge starts this watcher with it), or `local dev` was run by hand.
+  const startedAt = Date.parse(state.startedAt ?? '')
+  nextTrigger = once ? 'frontera local dev --once' : Number.isFinite(startedAt) && Date.now() - startedAt < 5 * 60_000 ? 'runtime started' : 'frontera local dev started'
   await drain()
   if (unchanged) ctx.output.note(`  ${unchanged} unchanged since the last apply (--reapply applies them again)`)
+  await sayProjectSecrets()
 
   if (once) {
-    if (failures) throw new CliError(`${failures} of ${targets.length} failed to apply`, { code: 'LOCAL_APPLY_FAILED', hint: 'fix the files above and run again' })
+    // What still fails once every retry ran: a target that failed and then applied is not a failure.
+    // And what the runtime refused inside a Blueprint that applied (a governed Action, a metric): failures
+    // here as in `local status` and `local check`, not only warnings, so all three say one number.
+    const blueprintEntry = loadBuild(project, organizationId).blueprint
+    const current = blueprintEntry && blueprintEntry.hash === contentHash(project, { kind: 'blueprint', key: 'blueprint' }) ? blueprintEntry : undefined
+    const byKey = new Map(targets.map((t) => [t.key, t]))
+    const failures = applyFailures(failing, targets.length, current, (key) => {
+      const target = byKey.get(key)
+      return target ? { ref: refOfTarget(target), ...('file' in target ? { file: target.file } : {}) } : undefined
+    })
+    // Split as `local check` splits it: a failure only in items still as the pull wrote them is the workspace's, not this change's.
+    const { made, inherited } = failures ? splitApplyFailures(failures.failed, unchangedSincePull(project.root), { strict: flagBool(ctx, 'strict') }) : { made: [], inherited: [] }
+    const inheritedField = inherited.length ? { inheritedFailures: inherited } : {}
+    if (failures && made.length) {
+      const message = inherited.length ? `${failures.message}: ${made.length} changed or added here, ${inherited.length} inherited from the pull` : failures.message
+      throw new CliError(message, { code: 'LOCAL_APPLY_FAILED', hint: 'fix the files above and run again; `frontera local status` lists each item that didn’t apply', details: { failed: made, ...inheritedField } })
+    }
     const done = targets.length - unchanged
-    return { data: { applied: done, unchanged }, text: `Applied ${done}${unchanged ? `, ${unchanged} unchanged` : ''}` }
+    if (inherited.length) {
+      const summary = inheritedApplyLine(inherited.length)
+      ctx.output.note(`  ${summary}:`)
+      for (const f of inherited) ctx.output.note(`    ${f.ref ?? f.item}: ${oneLine(f.error)}`)
+      return { data: { applied: done, unchanged, failed: 0, ...inheritedField, summary, ...(warned.size ? { warnings: [...warned.values()] } : {}) }, text: `Applied ${done}${unchanged ? `, ${unchanged} unchanged` : ''}; ${summary}` }
+    }
+    return { data: { applied: done, unchanged, ...(warned.size ? { warnings: [...warned.values()] } : {}) }, text: `Applied ${done}${unchanged ? `, ${unchanged} unchanged` : ''}` }
   }
 
   ctx.output.note('Watching datasets/, blueprint/, knowledge/, skills/, mcp/, themes/, functions/, workflows/, agents/, chat-apps/, apps/, brand/ and library.json (Ctrl+C to stop)')
   if (pending.size) schedule()
+  // What failed while the runtime was down is applied once it answers again, not when its file next changes.
+  const poller = setInterval(() => {
+    if (!waiting.size || busy || stopping) return
+    void runtimeAnswering(project).then((up) => {
+      if (!up || busy || stopping || !waiting.size) return
+      resumeWaiting()
+      schedule()
+    })
+  }, 5_000)
 
   await new Promise<void>((resolve) => {
     const stop = () => {
       stopping = true
       rmSync(pidFile, { force: true })
       if (timer) clearTimeout(timer)
+      clearInterval(poller)
       watcher?.close()
       stopChildren()
       resolve()
@@ -634,11 +1419,13 @@ export const localDev: Command = {
     noun: 'local',
     verb: 'dev',
     args: [],
-    flags: { once: 'boolean', 'no-publish': 'boolean', reapply: 'boolean' },
+    flags: { once: 'boolean', 'no-publish': 'boolean', reapply: 'boolean', 'keep-sample-data': 'boolean', 'remake-sample-data': 'boolean', strict: 'boolean' },
     summary: 'Apply the project to the local runtime, then apply each saved file',
-    examples: ['frontera local dev', 'frontera local dev --once', 'frontera local dev --no-publish', 'frontera local dev --once --reapply'],
+    details: [
+      'With --once it exits 0 when everything applied, and also when every item that failed is still as the last pull wrote it: those failures are inherited from the workspace, listed apart (`inheritedFailures` with --json), as `frontera local check` lists them. Anything changed or added here that failed exits 1. --strict counts the inherited failures too.',
+    ],
+    examples: ['frontera local dev', 'frontera local dev --once', 'frontera local dev --no-publish', 'frontera local dev --once --reapply', 'frontera local dev --once --strict'],
     offline: true,
-    internal: true,
   },
   run: dev,
 }