@montytools/cli 0.5.0 → 0.5.2

package/bin/monty.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // monty — the Monty platform CLI. Output is agent-shaped: structured
 // single-line events, no spinners, instruction-shaped errors, and a
-// deterministic final line (`deployed: …` / `error: …`).
+// deterministic final line (`saved: …` / `error: …`).
 
 import { spawn, spawnSync } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
@@ -63,10 +63,30 @@ function flag(name) {
 }
 
 function fail(code, fix) {
+  // A failing save narrates itself to the desktop chip before exiting.
+  saveFailNote?.(code, fix);
+  saveFailNote = null;
   console.error(`error: [MontyError ${code}] Fix: ${fix}`);
   process.exit(1);
 }
 
+// Set by deploy() while a save runs; fail() and the exit hook route the
+// error instruction into .monty/save.json so the chip shows it.
+let saveFailNote = null;
+
+// The save state file the desktop tails: .monty/save.json narrates every
+// save — agent-run saves in their own terminal included — so the chip can
+// show Saving…/Saved/"Couldn't save" without parsing any output.
+function writeSaveJson(appDir, state) {
+  try {
+    mkdirSync(join(appDir, ".monty"), { recursive: true });
+    writeFileSync(
+      join(appDir, ".monty", "save.json"),
+      JSON.stringify({ ...state, at: Date.now() }, null, 2) + "\n",
+    );
+  } catch { /* advisory — the chip just misses this save */ }
+}
+
 // ── Profiles & the .montyrc directory pin ──────────────────────────────────
 // One key PER HOST (like kubectl contexts): logging into the local platform
 // host never clobbers the prod key. Which host a command targets resolves,
@@ -257,6 +277,22 @@ function readMarker(path) {
   }
 }
 
+// True when the installed marker is BEHIND this CLI. Ordering matters: two
+// CLI versions share one machine (repo link vs npm global, bundle vs
+// global), and an equality check makes them overwrite each other's skills
+// on every alternating run — the older one must never win.
+function markerOutdated(marker) {
+  if (!marker) return true;
+  const a = marker.split(".").map(Number);
+  const b = CLI_VERSION.split(".").map(Number);
+  if (a.some(Number.isNaN) || b.some(Number.isNaN)) return marker !== CLI_VERSION;
+  for (let i = 0; i < 3; i++) {
+    if ((a[i] || 0) < (b[i] || 0)) return true;
+    if ((a[i] || 0) > (b[i] || 0)) return false;
+  }
+  return false;
+}
+
 function skillsCliAdd({ global = false, cwd = undefined } = {}) {
   const args = ["-y", "skills", "add", SKILLS_SRC, "-y", "--copy", ...(global ? ["-g"] : []), ...SKILL_AGENTS];
   const res = spawnSync("npx", args, { cwd, stdio: "ignore", timeout: 120_000 });
@@ -285,7 +321,7 @@ function installSkills({ appDir = null, silent = true, force = false } = {}) {
   if (process.env.MONTY_NO_SKILLS) return;
   try {
     let changed = false;
-    if (force || readMarker(GLOBAL_SKILLS_MARKER) !== CLI_VERSION) {
+    if (force || markerOutdated(readMarker(GLOBAL_SKILLS_MARKER))) {
       if (!skillsCliAdd({ global: true })) manualInstall(null);
       mkdirSync(CONFIG_DIR, { recursive: true });
       writeFileSync(GLOBAL_SKILLS_MARKER, CLI_VERSION + "\n");
@@ -293,7 +329,7 @@ function installSkills({ appDir = null, silent = true, force = false } = {}) {
     }
     if (appDir) {
       const marker = join(appDir, ".agents", "skills", "monty-build", "VERSION");
-      if (force || readMarker(marker) !== CLI_VERSION) {
+      if (force || markerOutdated(readMarker(marker))) {
         if (!skillsCliAdd({ cwd: appDir })) manualInstall(appDir);
         mkdirSync(dirname(marker), { recursive: true });
         writeFileSync(marker, CLI_VERSION + "\n");
@@ -310,17 +346,42 @@ function installSkills({ appDir = null, silent = true, force = false } = {}) {
 // ── monty current / select / apps ───────────────────────────────────────────
 // Folder management users never think about: every app lives in ~/Monty,
 // `current` says where you are, `select` prints the folder for cd $(...).
+// The app-root marker is the IDENTITY STAMP (.monty/app.json — written by
+// create and pull) or, for older folders, monty.config.ts.
+function isAppRoot(dir) {
+  return existsSync(join(dir, ".monty", "app.json")) || existsSync(join(dir, "monty.config.ts"));
+}
+
 function findAppRoot(start) {
   let d = start;
   for (;;) {
-    if (existsSync(join(d, "monty.config.ts"))) return d;
+    if (isAppRoot(d)) return d;
     const parent = dirname(d);
     if (parent === d) return null;
     d = parent;
   }
 }
 
+// The identity stamp: { id, slug, name, icon, registryOwned? } — the app's
+// durable identity on this machine, independent of the config file.
+function readAppJson(dir) {
+  try {
+    return JSON.parse(readFileSync(join(dir, ".monty", "app.json"), "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+function writeAppJson(dir, patch) {
+  mkdirSync(join(dir, ".monty"), { recursive: true });
+  const next = { ...(readAppJson(dir) ?? {}), ...patch };
+  writeFileSync(join(dir, ".monty", "app.json"), JSON.stringify(next, null, 2) + "\n");
+  return next;
+}
+
 function readSlugFromConfig(dir) {
+  const stamped = readAppJson(dir)?.slug;
+  if (typeof stamped === "string" && stamped) return stamped;
   try {
     return /slug:\s*"([^"]+)"/.exec(readFileSync(join(dir, "monty.config.ts"), "utf8"))?.[1] ?? null;
   } catch {
@@ -329,6 +390,8 @@ function readSlugFromConfig(dir) {
 }
 
 function readIdFromConfig(dir) {
+  const stamped = readAppJson(dir)?.id;
+  if (typeof stamped === "string" && stamped) return stamped;
   try {
     return /^[ \t]*id:\s*"([^"]+)"/m.exec(readFileSync(join(dir, "monty.config.ts"), "utf8"))?.[1] ?? null;
   } catch {
@@ -340,7 +403,7 @@ function scanAppsHome(root) {
   if (!existsSync(root)) return [];
   return readdirSync(root)
     .map((name) => join(root, name))
-    .filter((p) => existsSync(join(p, "monty.config.ts")))
+    .filter((p) => isAppRoot(p))
     .map((p) => ({ path: p, slug: readSlugFromConfig(p) ?? basename(p), id: readIdFromConfig(p) }));
 }
 
@@ -391,11 +454,10 @@ function apps() {
 }
 
 // Pack the app's source tree (node_modules/dist/.monty/.git excluded) into a
-// tar.gz buffer + its sha256 — the snapshot unit `monty commit` and deploys
-// both upload. gzip runs with -n (no embedded timestamp) so an UNCHANGED
-// tree packs to identical bytes — that's what makes "nothing to commit"
-// detectable by hash. Returns null when packing fails; { tooLarge } past
-// the 10MB cap.
+// tar.gz buffer + its sha256 — the snapshot unit every `monty save`
+// uploads. gzip runs with -n (no embedded timestamp) so an UNCHANGED tree
+// packs to identical bytes — the hash doubles as the change detector.
+// Returns null when packing fails; { tooLarge } past the 10MB cap.
 function packSource(appDir) {
   mkdirSync(join(appDir, ".monty"), { recursive: true });
   const srcTar = join(appDir, ".monty", "source-upload.tar.gz");
@@ -417,60 +479,12 @@ function packSource(appDir) {
 }
 
 function readSlug(appDir) {
-  try {
-    return /slug:\s*"([^"]+)"/.exec(readFileSync(join(appDir, "monty.config.ts"), "utf8"))?.[1] ?? null;
-  } catch {
-    return null;
-  }
-}
-
-// ── monty commit ───────────────────────────────────────────────────────────
-// Version the app's source WITHOUT publishing: pack the tree, upload it as
-// one line of history. Git commit with everything stripped except "track
-// versions" — no branches, no diffs, no local repo; history lives in the
-// workspace and survives this folder.
-async function commit() {
-  const appDir = requireAppDir("commit");
-  const slug = readSlug(appDir);
-  if (!slug) fail("NO_SLUG", "monty.config.ts has no slug — fix the config, then retry.");
-  const { host, key } = loadConfig();
-  if (!key) fail("NOT_LOGGED_IN", "Committing stores the snapshot in your workspace. Run `monty login` first.");
-  const mIdx = rest.indexOf("-m");
-  const message = flag("message") ?? (mIdx >= 0 ? rest[mIdx + 1] : undefined) ?? "checkpoint";
-  const packed = packSource(appDir);
-  if (packed === null) fail("PACK_FAILED", "Packing the source failed (tar error). Retry; check the folder is readable.");
-  if (packed.tooLarge) fail("SOURCE_TOO_LARGE", "The source tree exceeds 10 MB (node_modules/dist excluded). Remove large assets, then retry.");
-  try {
-    const stamp = JSON.parse(readFileSync(join(appDir, ".monty", "source.json"), "utf8"));
-    if (stamp.hash === packed.hash) {
-      console.log(`nothing to commit — source unchanged since ${packed.hash.slice(0, 7)}`);
-      return;
-    }
-  } catch {
-    /* no stamp yet — first commit from this folder */
-  }
-  const form = new FormData();
-  form.set("monty", JSON.stringify({ slug, hash: packed.hash, message }));
-  form.set("source", new Blob([packed.buf]), "source.tar.gz");
-  const res = await fetch(`${host}/api/source`, {
-    method: "POST",
-    headers: { authorization: `Bearer ${key}` },
-    body: form,
-  });
-  const body = await res.json().catch(() => null);
-  if (!res.ok || !body?.ok) {
-    fail(body?.code ?? `HTTP_${res.status}`, body?.fix ?? "Uploading the snapshot failed — check the connection and retry.");
-  }
-  writeFileSync(
-    join(appDir, ".monty", "source.json"),
-    JSON.stringify({ hash: packed.hash, syncedAt: Date.now() }) + "\n",
-  );
-  console.log(`committed: ${packed.hash.slice(0, 7)} "${message}" (${(packed.buf.byteLength / 1024).toFixed(0)} KB)`);
+  return readSlugFromConfig(appDir);
 }
 
 // ── monty log ──────────────────────────────────────────────────────────────
-// The app's version history, newest first. Commits and publishes share one
-// timeline. (Not `monty logs` — that tails the dev shell.)
+// The app's version history, newest first — one row per `monty save`.
+// (Not `monty logs` — that tails the dev shell.)
 async function versionsLog() {
   const slug = rest.find((a) => !a.startsWith("-")) ?? readSlug(process.cwd());
   if (!slug) fail("NO_SLUG", "Usage: monty log [slug] — or run it inside an app folder.");
@@ -484,19 +498,19 @@ async function versionsLog() {
     fail(body?.code ?? `HTTP_${res.status}`, body?.fix ?? "Could not list versions — check the connection and `monty login`.");
   }
   if (body.versions.length === 0) {
-    console.log(`no versions of "${slug}" yet — \`monty commit\` or a publish creates the first one.`);
+    console.log(`no versions of "${slug}" yet — \`monty save\` creates the first one.`);
     return;
   }
   for (const v of body.versions) {
     const when = new Date(v.createdAt).toISOString().slice(0, 16).replace("T", " ");
-    console.log(`${v.hash.slice(0, 7)}  ${when}  ${v.published ? "[published] " : ""}${v.message}`);
+    console.log(`${v.hash.slice(0, 7)}  ${when}  ${v.message}`);
   }
   console.log(`\nrestore one: monty pull ${slug} --version <hash> [--force]`);
 }
 
 // ── monty pull ─────────────────────────────────────────────────────────────
-// Restore an app's published source snapshot onto this machine. Every
-// `monty deploy`/publish uploads the source tree beside the bundle; pull is
+// Restore an app's saved source snapshot onto this machine. Every
+// `monty save` uploads the source tree beside the bundle; pull is
 // how a second machine (or one that lost the folder) gets the code back.
 // Refuses to touch an existing folder without --force — it may hold
 // unpublished work the snapshot would destroy.
@@ -541,11 +555,11 @@ async function pull() {
     expectedHash = matches[0].hash;
     downloadUrl = `${host}/api/source?slug=${slug}&hash=${expectedHash}`;
   } else if (!app.sourceHash) {
-    fail("NO_SOURCE", `"${slug}" has no source snapshot yet — snapshots ride each publish and \`monty commit\`. Run either once from the machine that has the source, then pull works everywhere.`);
+    fail("NO_SOURCE", `"${slug}" has no source snapshot yet — snapshots ride each \`monty save\`. Run it once from the machine that has the source, then pull works everywhere.`);
   }
   const target = app.id ? join(MONTY_HOME, app.id) : join(LEGACY_MONTY_HOME, slug);
   if (existsSync(target) && !rest.includes("--force")) {
-    fail("DIR_EXISTS", `${target} already exists and may hold unpublished work. Compare it with the published version first; re-run with --force to REPLACE it with the snapshot.`);
+    fail("DIR_EXISTS", `${target} already exists and may hold unsaved work. Compare it with the saved version first; re-run with --force to REPLACE it with the snapshot.`);
   }
 
   console.log(`pull: ${slug}${versionFlag ? ` @ ${expectedHash.slice(0, 7)}` : ""} <- ${host}`);
@@ -559,7 +573,7 @@ async function pull() {
   const buf = Buffer.from(await res.arrayBuffer());
   const hash = createHash("sha256").update(buf).digest("hex");
   if (hash !== expectedHash) {
-    fail("SOURCE_CORRUPT", "The downloaded snapshot failed verification — retry; if it persists, republish the app from a machine that has the source.");
+    fail("SOURCE_CORRUPT", "The downloaded snapshot failed verification — retry; if it persists, run `monty save` again from a machine that has the source.");
   }
 
   // Extract into a staging folder, then move into place — a failed extract
@@ -573,7 +587,7 @@ async function pull() {
   rmSync(tarFile, { force: true });
   if (untar.status !== 0) {
     rmSync(staging, { recursive: true, force: true });
-    fail("EXTRACT_FAILED", "Unpacking the snapshot failed. Retry; if it persists, republish the app.");
+    fail("EXTRACT_FAILED", "Unpacking the snapshot failed. Retry; if it persists, run `monty save` again from a machine that has the source.");
   }
   if (existsSync(target)) rmSync(target, { recursive: true, force: true });
   renameSync(staging, target);
@@ -593,6 +607,14 @@ async function pull() {
     join(target, ".monty", "source.json"),
     JSON.stringify({ hash, syncedAt: Date.now() }) + "\n",
   );
+  // Re-stamp identity (the snapshot excludes .monty/): the workspace row is
+  // the authority for id/name/icon.
+  writeAppJson(target, {
+    ...(app.id ? { id: app.id } : {}),
+    slug,
+    ...(app.name ? { name: app.name } : {}),
+    ...(app.icon ? { icon: app.icon } : {}),
+  });
   console.log(`pulled: ${target}`);
   console.log("next: `monty install`, then `monty dev`.");
 }
@@ -605,20 +627,56 @@ function isConfigOnlyApp(appDir) {
   return !existsSync(join(appDir, "index.html"));
 }
 
+// Literal read of the config's `schedule` block ({ fn: "cron expr" }) —
+// the same light-touch parse the SDK's vite plugin uses for publicFns.
+// Registry-owned sessions read it this way so the cron ticker works
+// without a config compile.
+function readScheduleLiteral(appDir) {
+  try {
+    const src = readFileSync(join(appDir, "monty.config.ts"), "utf8");
+    const block = /schedule:\s*{([^}]*)}/m.exec(src)?.[1];
+    if (!block) return undefined;
+    const out = {};
+    for (const m of block.matchAll(/["']?([a-zA-Z][a-zA-Z0-9_]*)["']?\s*:\s*"([^"]+)"/g)) {
+      out[m[1]] = m[2];
+    }
+    return Object.keys(out).length > 0 ? out : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+// The code half's custom pages, by file convention: every TOP-LEVEL route
+// file in src/routes/ is a page (nested routes — dot-separated names — are a
+// page's inner paths). `__root`/`index` are the SPA's own plumbing, never
+// pages. Saves register these as fnsJson.pages; a running session serves
+// every declared page directly.
+function discoverPages(appDir) {
+  const routesDir = join(appDir, "src", "routes");
+  if (!existsSync(routesDir)) return [];
+  return readdirSync(routesDir)
+    .filter((f) => /\.(tsx|jsx)$/.test(f))
+    .map((f) => f.replace(/\.(tsx|jsx)$/, ""))
+    .filter((name) => /^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/.test(name) && name !== "index")
+    .sort()
+    .map((name) => ({ name, path: `/${name}` }));
+}
+
 const CONFIG_ONLY_AGENTS_MD = `# This is a CONFIG-ONLY Monty app
 
-The entire app is \`monty.config.ts\`: tables (zod), derived fields
-(\`rollup\`/\`lookup\`/\`formula\`), \`metrics\`, \`settings\`, and \`pages\`.
-The Monty platform renders it — there is no src/, no React, no build.
+The app is rendered by the Monty platform from its WORKSPACE manifest —
+tables (zod), derived fields (\`rollup\`/\`lookup\`/\`formula\`), \`metrics\`,
+\`settings\`, and \`pages\`. There is no src/, no React, no build.
 
-- Edit monty.config.ts, save; a running \`monty dev\` pushes the change to the
-  Studio within seconds (watch the terminal for instruction-shaped errors).
+- The schema lives in the workspace, and its door is the schema API:
+  read it with \`monty schema\`, change it with \`monty schema set <file|->\`
+  (validated, CAS-guarded, live within seconds). monty.config.ts edits do
+  NOT change a workspace-owned app's schema.
 - Formulas are strings in the Monty expression grammar, e.g.
   \`formula(montyMoney(), "monthlySales * commissionRate")\` — fields declared
   ABOVE the formula and \`metrics.<name>\` are in scope.
-- \`monty deploy\` publishes the config to the workspace (no bundle).
-- Need a bespoke page later? \`monty add page\` upgrades this app with a SPA
-  scaffold; the config keeps working unchanged.
+- Need a bespoke page later? \`monty add page\` declares it and upgrades this
+  app with a SPA scaffold; \`monty save\` ships the code.
 `;
 
 function writeConfigOnlyScaffold(target, { appId, slug, name, icon }) {
@@ -718,6 +776,9 @@ async function create() {
   if (!rest.includes("--spa")) {
     console.log(`create: ${slug} -> ${target} (config-only)`);
     writeConfigOnlyScaffold(target, { appId, slug, name, icon });
+    // The identity stamp is the app-root marker and identity source from
+    // here on — the config file is just code.
+    writeAppJson(target, { id: appId, slug, name, icon });
     // The user's brief lands at the top of AGENTS.md, same as SPA creates.
     const brief = flag("description");
     if (brief?.trim()) {
@@ -777,7 +838,7 @@ async function create() {
   // hard-excludes the real name from tarballs); the in-repo template has the
   // real file. Normalize, and backfill for bundles that carried neither —
   // without a .gitignore, tailwind v4's content scan includes .monty/ and
-  // full-reloads Studio on every dev.json touch.
+  // full-reloads the session on every dev.json touch.
   const gitignorePath = join(target, ".gitignore");
   if (existsSync(join(target, "gitignore"))) {
     renameSync(join(target, "gitignore"), gitignorePath);
@@ -805,6 +866,9 @@ async function create() {
     htmlPath,
     readFileSync(htmlPath, "utf8").replace(/<title>[^<]*<\/title>/, `<title>${name}</title>`),
   );
+  // The identity stamp is the app-root marker and identity source from
+  // here on — the config file is just code the bundle imports.
+  writeAppJson(target, { id: appId, slug, name, icon });
 
   // The user's brief (--description, e.g. from the desktop's create dialog)
   // goes to the TOP of AGENTS.md — agent harnesses can't be handed an initial
@@ -920,7 +984,7 @@ async function freePort(start) {
 // Apps pin @montytools/sdk at scaffold time and go stale — the CLI knows the
 // minimum SDK its workflows need (e.g. tunnel-host allowlisting lives in the
 // SDK's vite plugin) and upgrades the app automatically before dev/deploy.
-const MIN_SDK = "0.2.0";
+const MIN_SDK = "0.2.2";
 const SDK_VITE_CACHE_STAMP = "sdk-vite-cache-version";
 
 function installedSdkVersion(appDir) {
@@ -1200,12 +1264,12 @@ function printAttach(appDir, s) {
       const beat = typeof s.lastHeartbeatAt === "number" ? Math.round((Date.now() - s.lastHeartbeatAt) / 1000) : null;
       console.log(
         beat !== null && beat > Math.round(DEV_JSON_STALE_MS / 1000)
-          ? `state: online (no heartbeat for ${beat}s — Studio may show offline)`
+          ? `state: online (no heartbeat for ${beat}s — the workspace may show the session offline)`
           : `state: online (heartbeat ${beat ?? "?"}s ago)`,
       );
-      if (s.studioUrl) console.log(`studio: ${s.studioUrl} — your app runs there while this is up; click Publish to go Live`);
+      if (s.host && s.slug) console.log(`app: ${s.host}/apps/${s.slug} — your app runs there while this is up`);
     } else {
-      console.log("state: ready (registering with the workspace — the Studio link appears on the first successful heartbeat)");
+      console.log("state: ready (registering with the workspace — the app link appears on the first successful heartbeat)");
     }
   }
   console.log("logs: `monty logs -f` follows output; `monty logs -n 100` shows recent lines");
@@ -1327,11 +1391,11 @@ async function sweepOrphans(s) {
 }
 
 // ── monty dev ──────────────────────────────────────────────────────────────
-// Puts the app in Studio: vite locally + a Cloudflare quick tunnel registered
-// as the app's STUDIO channel, so workspace admins see the app (HMR included)
-// at usemonty.dev while it runs. Data is #dev-sandboxed automatically (vite
-// dev build). The heartbeat doubles as the publish poll: when an owner
-// clicks Publish in the workspace, this process builds + uploads to Live.
+// Runs the app's session: vite locally + a Cloudflare quick tunnel
+// registered as the app's session channel, so workspace admins see the
+// app (HMR included) at usemonty.dev while it runs. One data namespace:
+// the session reads and writes the app's REAL records — editing is the
+// change going live. `monty save` ships code.
 async function dev() {
   const appDir = requireAppDir("dev");
 
@@ -1380,11 +1444,21 @@ async function dev() {
 
   installSkills({ appDir });
   ensureSdk(appDir);
-  const meta = await compileConfig(appDir);
+  // Registry-owned apps (stamped on the first configIgnored beat): the
+  // platform reads NOTHING from the config compile — identity comes from
+  // the stamp and the compile is skipped entirely. The config file is just
+  // code the bundle imports; `schedule` (a code-door declaration the
+  // session cron ticker needs) is read literally, the same way the vite
+  // plugin reads `publicFns`.
+  const stamp = readAppJson(appDir);
+  const registryOwned = stamp?.registryOwned === true && typeof stamp?.slug === "string";
+  const meta = registryOwned
+    ? { slug: stamp.slug, name: stamp.name, icon: stamp.icon, schedule: readScheduleLiteral(appDir) }
+    : await compileConfig(appDir);
   const cfg = loadConfig();
   const host = cfg?.host ?? DEFAULT_HOST;
   // CONFIG-ONLY apps run no vite and no tunnel: `monty dev` is watch +
-  // compile + push — the platform shell renders the Studio channel.
+  // compile + push — the platform shell renders the app.
   const configOnly = isConfigOnlyApp(appDir);
   // Auto-pick a free port (agents run several apps side by side); an
   // explicit --port is honored strictly.
@@ -1407,23 +1481,30 @@ async function dev() {
   }
 
   let tunnelChild = null;
-  let pubChild = null;
   let hbTimer = null;
   let touchTimer = null;
   let cronTimer = null;
-  let publishing = false;
   let ended = false;
   let registeredOnce = false;
+  // Held-config warnings print once per drift episode, not every beat.
+  let driftAnnounced = false;
+  // The registry-owned notice prints once per session.
+  let configIgnoredAnnounced = false;
   const devStartedAt = Date.now();
   const sessionId = `dev_${randomBytes(16).toString("hex")}`;
   const buildFile = join(appDir, ".monty", "build");
   const buildId = existsSync(buildFile) ? readFileSync(buildFile, "utf8").trim() : undefined;
-  // The STUDIO schema channel: heartbeats carry the compiled schema, and
-  // edits to monty.config.ts are re-compiled (softly) so schema changes reach
-  // the platform within one heartbeat. Publish owns the LIVE schema.
+  // The session schema channel (manifest-less apps): heartbeats carry the
+  // compiled schema, and edits to monty.config.ts are re-compiled (softly)
+  // so schema changes reach the platform within one heartbeat.
+  // Registry-owned apps skip all of it — their schema lives behind the
+  // doors, and the local config copy follows the registry (auto-pull below).
   let currentMeta = meta;
+  // Once per registry change: the manifest hash we last tried to sync the
+  // local config copy to (successful or refused — never loop on dirty).
+  let syncAttemptedHash = null;
   const configPath = join(appDir, "monty.config.ts");
-  let configMtime = statSync(configPath).mtimeMs;
+  let configMtime = existsSync(configPath) ? statSync(configPath).mtimeMs : 0;
 
   // Advertise this session. The touch timer (not the platform heartbeat,
   // which starts minutes late or never when logged out) keeps updatedAt
@@ -1445,9 +1526,9 @@ async function dev() {
     loggedIn,
     appUrl: configOnly ? null : `http://localhost:${port}`,
     tunnelUrl: null,
-    studioUrl: loggedIn ? `${host}/studio/${meta.slug}` : null,
+    // Field names are wire contract (the desktop reads them).
     previewUrl: loggedIn && !configOnly
-      ? `${host}/studio/${meta.slug}?dev=${encodeURIComponent(`http://localhost:${port}`)}`
+      ? `${host}/apps/${meta.slug}?dev=${encodeURIComponent(`http://localhost:${port}`)}`
       : null,
     publishing: false,
     lastHeartbeatAt: null,
@@ -1456,7 +1537,7 @@ async function dev() {
   });
   touchTimer = setInterval(() => sf.write({}), DEV_JSON_TOUCH_MS);
 
-  // The STUDIO cron runner: the Live counterpart is a real Cloudflare Cron
+  // The session cron runner: the Live counterpart is a real Cloudflare Cron
   // Trigger on the app's fn-worker; here the CLI matches monty.config.ts
   // `schedule` entries against the UTC clock once per minute and invokes the
   // fn through the same /__monty/fn runtime (x-monty-schedule marks the
@@ -1492,6 +1573,7 @@ async function dev() {
   cronTimer = setInterval(cronTick, 20_000);
 
   async function refreshSchemaIfChanged() {
+    if (registryOwned) return; // the doors own the schema; nothing to push
     try {
       const m = statSync(configPath).mtimeMs;
       if (m === configMtime) return;
@@ -1500,7 +1582,7 @@ async function dev() {
       if (fresh) {
         currentMeta = fresh;
         console.log(
-          `schema: monty.config.ts changed — Studio schema updated (${Object.keys(fresh.schemaJson.tables).length} tables)`,
+          `schema: monty.config.ts changed — session schema updated (${Object.keys(fresh.schemaJson.tables).length} tables)`,
         );
       }
     } catch { /* transient fs hiccup — next beat retries */ }
@@ -1525,7 +1607,6 @@ async function dev() {
     if (hbTimer) clearInterval(hbTimer);
     if (touchTimer) clearInterval(touchTimer);
     if (cronTimer) clearInterval(cronTimer);
-    try { pubChild?.kill(); } catch { /* already gone */ }
     try { tunnelChild?.kill(); } catch { /* already gone */ }
     // vite is a direct child (no npx wrapper), so this actually kills it —
     // a bare SIGTERM from the desktop must never orphan vite on the port.
@@ -1541,7 +1622,6 @@ async function dev() {
     if (hbTimer) clearInterval(hbTimer);
     if (touchTimer) clearInterval(touchTimer);
     if (cronTimer) clearInterval(cronTimer);
-    try { pubChild?.kill(); } catch { /* already gone */ }
     try { tunnelChild?.kill(); } catch { /* already gone */ }
     try { child?.kill(); } catch { /* already gone */ }
     console.log(`dev-session: superseded — ${fix}`);
@@ -1577,14 +1657,18 @@ async function dev() {
           buildId,
           schemaJson: currentMeta.schemaJson,
           // App Manifest v2 (docs/manifest-v2.md) — present only for V2
-          // configs; the host forwards it to devManifestJson (Stage 3 wiring).
+          // configs; lands only for manifest-less apps (the doors own the
+          // rest).
           manifest: currentMeta.manifest,
-          // The CAS base for the Studio channel (see `monty schema pull`).
+          // The CAS base for the manifest-less landing (see `monty schema
+          // pull`).
           baseManifestHash:
             currentMeta.manifest !== undefined ? readSchemaState(appDir)?.hash : undefined,
           // The expose block rides the same compile as the schema — the dev
-          // visitor preview is gated on it (devExposureJson).
+          // visitor preview of a manifest-less app is gated on it.
           exposure: currentMeta.exposure,
+          // Rules ride the same channel (manifest-less apps only).
+          rules: currentMeta.rules,
         }),
         signal: AbortSignal.timeout(DEV_SESSION_REQUEST_TIMEOUT_MS),
       });
@@ -1608,9 +1692,17 @@ async function dev() {
         }
         return false;
       }
-      if (currentMeta.manifest !== undefined) {
-        // This beat's manifest is now the stored Studio manifest — the new
-        // CAS base for both channels' future pushes.
+      if (data?.manifestDrift) {
+        // The session registered, but the config push was HELD: the stored
+        // schema changed since this checkout last synced (another editor).
+        if (!driftAnnounced) {
+          driftAnnounced = true;
+          console.log(`schema drift (remote changes):${data.manifestDrift.summary ? `\n${data.manifestDrift.summary}` : ""}`);
+          console.log(`config push held: ${data.manifestDrift.fix ?? "Run `monty schema pull`, merge, then save again."}`);
+        }
+      } else if (currentMeta.manifest !== undefined) {
+        driftAnnounced = false;
+        // This beat's manifest landed LIVE — the new CAS base.
         try { writeSchemaState(appDir, manifestHash(currentMeta.manifest)); } catch { /* state is advisory */ }
       }
       if (!registeredOnce) {
@@ -1619,37 +1711,58 @@ async function dev() {
       } else {
         sf.write({ loggedIn: true, lastHeartbeatAt: Date.now() });
       }
-      if (data?.publishRequested && !publishing && !ended) {
-        publishing = true;
-        sf.write({ publishing: true });
-        console.log("publish: requested from the workspace — building & uploading…");
-        const pubTee = logSink.source();
-        await new Promise((resolve) => {
-          pubChild = spawn(process.execPath, [fileURLToPath(import.meta.url), "deploy", "--from-dev"], {
-            cwd: appDir,
-            stdio: ["ignore", "pipe", "pipe"],
+      if (data?.configIgnored && !configIgnoredAnnounced) {
+        configIgnoredAnnounced = true;
+        console.log("schema: this app's data schema lives in the workspace — monty.config.ts edits do NOT change it. Read it: `monty schema`; change it: `monty schema set <file>`.");
+        // Stamp registry ownership: from the next session on, the config
+        // compile is skipped entirely.
+        try {
+          writeAppJson(appDir, {
+            registryOwned: true,
+            slug: meta.slug,
+            ...(currentMeta.name ? { name: currentMeta.name } : {}),
+            ...(currentMeta.icon ? { icon: currentMeta.icon } : {}),
           });
-          pubChild.stdout.on("data", (c) => {
-            process.stdout.write(c);
-            pubTee(c);
-          });
-          pubChild.stderr.on("data", (c) => {
-            process.stderr.write(c);
-            pubTee(c);
-          });
-          pubChild.on("exit", (code) => {
-            pubChild = null;
-            pubTee.flush();
-            console.log(
-              code === 0
-                ? "publish: done — the app is Live for the workspace (Studio session continues)"
-                : "publish: FAILED — fix the errors above, then click Publish again",
-            );
-            resolve(undefined);
-          });
-        });
-        publishing = false;
-        sf.write({ publishing: false });
+        } catch { /* the stamp is a convenience; the beat decided */ }
+      }
+      // The local config copy follows the registry: when the stored manifest
+      // moved (another editor, the schema door) and the local file is clean,
+      // regenerate it in place — the sync of the mechanical copy is
+      // automatic. Dirty or uncompilable files are left alone with the fix.
+      if (
+        typeof data?.manifestHash === "string" &&
+        existsSync(configPath) &&
+        data.manifestHash !== readSchemaState(appDir)?.hash &&
+        data.manifestHash !== syncAttemptedHash
+      ) {
+        syncAttemptedHash = data.manifestHash;
+        try {
+          // Already in sync (fresh checkout, no state file yet)? Stamp the
+          // base and leave the file alone — regenerate only on real drift.
+          let alreadySynced = false;
+          try {
+            const compiled = await compileAppConfig(appDir);
+            if (compiled.manifest && manifestHash(compiled.manifest) === data.manifestHash) {
+              writeSchemaState(appDir, data.manifestHash);
+              alreadySynced = true;
+            }
+          } catch { /* uncompilable — let schemaPull's dirty check narrate */ }
+          if (!alreadySynced) {
+            await schemaPull({
+              appDir,
+              host,
+              key: loadConfig()?.key ?? cfg.key,
+              slug: meta.slug,
+              force: false,
+              compileAppConfig,
+              fail: (code, fix) => {
+                throw new Error(`${code} — ${fix}`);
+              },
+            });
+          }
+        } catch (e) {
+          console.log(`schema: the workspace manifest changed but the local copy was NOT regenerated (${String(e?.message ?? e).slice(0, 240)})`);
+        }
       }
       return true;
     } catch {
@@ -1660,7 +1773,7 @@ async function dev() {
 
   async function startDevSession() {
     if (!cfg?.key) {
-      console.log("dev: not logged in — workspace Studio disabled (run `monty login`)");
+      console.log("dev: not logged in — workspace session disabled (run `monty login`)");
       return;
     }
     await clearDevSession();
@@ -1682,17 +1795,17 @@ async function dev() {
       if (ended || version !== tunnelVersion) return "superseded";
       if (!dnsLive) {
         if (initial) {
-          console.log("tunnel: DNS never propagated — Studio registered on localhost (visible on this machine's browser only)");
+          console.log("tunnel: DNS never propagated — session registered on localhost (visible on this machine's browser only)");
         } else {
-          console.log("tunnel: DNS never propagated for the new URL — keeping Studio offline until the next tunnel URL");
+          console.log("tunnel: DNS never propagated for the new URL — keeping the session offline until the next tunnel URL");
         }
         return "failed";
       }
       originUrl = url;
       sf.write({ tunnelUrl: url });
-      console.log(initial ? "tunnel: DNS live" : "tunnel: DNS live; Studio URL updated");
+      console.log(initial ? "tunnel: DNS live" : "tunnel: DNS live; session URL updated");
       if (!initial && !(await heartbeat(originUrl))) {
-        console.log("dev-session: Studio still has no registered tunnel; the next heartbeat will retry");
+        console.log("dev-session: the session still has no registered tunnel; the next heartbeat will retry");
       }
       return "activated";
     }
@@ -1716,34 +1829,40 @@ async function dev() {
         console.log(`tunnel: ${t.url}`);
         await activateTunnelUrl(t.url, { initial: true });
       } else {
-        console.log("tunnel: unavailable — Studio registered on localhost (visible on this machine's browser only)");
+        console.log("tunnel: unavailable — session registered on localhost (visible in this machine's browser only)");
       }
     }
     const registered = await heartbeat(originUrl, { claim: true });
     console.log(
       registered
-        ? `studio: ${host}/studio/${meta.slug} — your app runs there while this is up; click Publish to go Live`
-        : `studio: waiting for ${host}/api/dev-session — leave this running; the next heartbeat will retry`,
+        ? `preview: ${host}/apps/${meta.slug} — the app surface follows this session while it runs; \`monty save\` updates the cloud copy`
+        : `preview: waiting for ${host}/api/dev-session — leave this running; the next heartbeat will retry`,
     );
     hbTimer = setInterval(() => void heartbeat(originUrl), DEV_SESSION_HEARTBEAT_MS);
   }
 
   if (configOnly) {
     sf.write({ state: "ready" });
-    console.log(`data: sandboxed to "${meta.slug}#dev" (Studio sandbox; Live records untouched)`);
-    console.log("ready: config-only — the Studio renders this app; edits push on save");
+    console.log(
+      registryOwned
+        ? "ready: config-only — the workspace owns this app's schema; edit it with `monty schema` / `monty schema set`"
+        : "ready: config-only — saves land LIVE; the workspace renders them within seconds",
+    );
     void startDevSession();
-    // Config edits should reach the Studio in seconds, not a heartbeat:
-    // watch the mtime and trigger an early beat (which recompiles + pushes).
-    const cfgWatch = setInterval(() => {
-      try {
-        if (statSync(configPath).mtimeMs !== configMtime) void heartbeat(undefined);
-      } catch { /* transient fs hiccup */ }
-    }, 2000);
-    const stopWatch = () => clearInterval(cfgWatch);
-    process.on("SIGINT", stopWatch);
-    process.on("SIGTERM", stopWatch);
-    process.on("SIGHUP", stopWatch);
+    if (!registryOwned) {
+      // Manifest-less apps only: config edits should land in seconds, not a
+      // heartbeat — watch the mtime and trigger an early beat (which
+      // recompiles + pushes). Registry-owned apps have nothing to push.
+      const cfgWatch = setInterval(() => {
+        try {
+          if (statSync(configPath).mtimeMs !== configMtime) void heartbeat(undefined);
+        } catch { /* transient fs hiccup */ }
+      }, 2000);
+      const stopWatch = () => clearInterval(cfgWatch);
+      process.on("SIGINT", stopWatch);
+      process.on("SIGTERM", stopWatch);
+      process.on("SIGHUP", stopWatch);
+    }
   }
 
   let announced = false;
@@ -1759,7 +1878,7 @@ async function dev() {
     if (!announced && /localhost:\d+/.test(text.replace(ANSI_RE, ""))) {
       announced = true;
       sf.write({ state: "ready" });
-      console.log(`data: sandboxed to "${meta.slug}#dev" (Studio sandbox; Live records untouched)`);
+      console.log(`data: live — this session reads and writes the app\'s real records`);
       console.log(`ready: http://localhost:${port}`);
       void startDevSession();
     }
@@ -1949,7 +2068,7 @@ async function waitForDns(hostname) {
 
 // Cloudflare quick tunnel via the cloudflared npm wrapper (downloads the
 // binary on first use). Resolves with the public URL, or null on failure —
-// Studio then falls back to localhost-only registration. onOutput receives
+// the session then falls back to localhost-only registration. onOutput receives
 // every chunk (both fds) for the dev.log tee.
 function startTunnel(port, onUrlChange, onOutput) {
   return new Promise((resolve) => {
@@ -2027,10 +2146,55 @@ function resolveComponent(name) {
 // ── monty add page <name> ──────────────────────────────────────────────────
 // Upgrades an app with a bespoke (custom) page: scaffolds the SPA on first
 // use (config-only apps gain src/ + vite from the template — their
-// monty.config.ts and AGENTS.md stay untouched), writes the page route, and
-// registers `pages.<name> = { kind: "custom", path: "/<name>" }` so the
-// platform shell mounts it. The Shopify model: system pages stay
-// shell-rendered; only this page is the app's own code.
+// monty.config.ts and AGENTS.md stay untouched), declares
+// `pages.<name> = { kind: "custom", path: "/<name>" }`, and writes the page
+// route. DECLARE-FIRST: on a workspace-owned app the entry lands through
+// the schema door BEFORE the code exists — a save carrying an undeclared
+// route refuses (DEPLOY_UNDECLARED_PAGE). The Shopify model: system pages
+// stay shell-rendered; only this page is the app's own code.
+
+// Declare the page through the schema door. Returns "declared" | "already"
+// (workspace-owned app) or "config" (manifest-less: the config file is
+// still that app's editor, the caller registers the entry there).
+async function declarePageThroughDoor(appDir, pageName) {
+  const slug = readSlug(appDir);
+  const { host, key } = loadConfig();
+  if (!slug || !key) return "config";
+  const read = await fetch(`${host}/api/schema?slug=${slug}`, {
+    headers: { authorization: `Bearer ${key}` },
+  }).catch(() => null);
+  const readBody = await read?.json().catch(() => null);
+  if (!read?.ok || !readBody?.ok || readBody.manifest === null) return "config";
+  const manifest = readBody.manifest;
+  const keyOf = (n) => n.toLowerCase().replace(/[^a-z0-9]/g, "");
+  const declared = Object.keys(manifest.pages ?? {}).find((n) => keyOf(n) === keyOf(pageName));
+  if (declared) {
+    const kind = manifest.pages[declared]?.kind;
+    if (kind !== "custom") {
+      fail("PAGE_KIND", `"${declared}" is a ${kind} page in the app's manifest — custom code can't replace it. Pick another page name.`);
+    }
+    return "already";
+  }
+  // An empty pages block means default view pages derive from the tables;
+  // materialize them first so declaring one custom page can't hide the rest.
+  const pages =
+    manifest.pages && Object.keys(manifest.pages).length > 0
+      ? { ...manifest.pages }
+      : Object.fromEntries(Object.keys(manifest.tables ?? {}).map((t) => [t, { kind: "view", table: t }]));
+  pages[pageName] = { kind: "custom", path: `/${pageName}` };
+  const res = await fetch(`${host}/api/schema`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${key}`, "content-type": "application/json" },
+    body: JSON.stringify({ slug, manifest: { ...manifest, pages }, baseHash: readBody.hash }),
+  });
+  const body = await res.json().catch(() => null);
+  if (!res.ok || !body?.ok) {
+    fail(body?.code ?? `HTTP_${res.status}`, body?.fix ?? "Declaring the page through the schema door failed — check the connection and retry.");
+  }
+  try { writeSchemaState(appDir, body.hash); } catch { /* state is advisory */ }
+  return "declared";
+}
+
 async function addPage(appDir, pageName) {
   if (!pageName || !/^[a-z0-9]+(-[a-z0-9]+)*$/.test(pageName) || pageName.length > 32) {
     fail("INVALID_PAGE", 'Usage: monty add page <name> — lowercase letters/digits with single hyphens, max 32 chars (e.g. "reports").');
@@ -2048,6 +2212,15 @@ async function addPage(appDir, pageName) {
   if (config.includes(`"/${pageName}"`) || new RegExp(`^\\s*${pageName}:`, "m").test(config)) {
     console.log(`note: "${pageName}" may already be declared in monty.config.ts — check its pages block after this.`);
   }
+  // Declare BEFORE any code exists: if the door refuses, nothing to clean up.
+  const declared = await declarePageThroughDoor(appDir, pageName);
+  if (declared !== "config") {
+    console.log(
+      declared === "declared"
+        ? `declared: pages.${pageName} through the schema door — live in the workspace now`
+        : `declared: pages.${pageName} already in the workspace manifest`,
+    );
+  }
 
   // First custom page on a config-only app: bring in the SPA scaffold.
   if (isConfigOnlyApp(appDir)) {
@@ -2083,6 +2256,9 @@ async function addPage(appDir, pageName) {
     pkg.scripts = { ...tplPkg.scripts, ...pkg.scripts };
     pkg.dependencies = { ...tplPkg.dependencies, ...pkg.dependencies };
     pkg.devDependencies = { ...tplPkg.devDependencies, ...pkg.devDependencies };
+    // vite.config.ts imports the ESM-only sdk plugin — without the
+    // template's module type the config loads as CJS and fails to resolve it.
+    if (tplPkg.type && !pkg.type) pkg.type = tplPkg.type;
     // The published template pins the sdk; a workspace app may carry
     // workspace:* — the merge above keeps the app's existing pin either way.
     writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + "\n");
@@ -2108,13 +2284,31 @@ async function addPage(appDir, pageName) {
     if (existsSync(starter)) rmSync(starter);
     appendFileSync(
       join(appDir, "AGENTS.md"),
-      `\n---\n\n## Custom pages\n\nThis app now has a SPA half (src/) serving CUSTOM pages inside the\nplatform shell. Each page = a route in src/routes/ + a\n\`pages.<name>: { kind: "custom", path: "/<name>" }\` entry in\nmonty.config.ts. System pages (views, dashboards) stay config-rendered —\nonly build bespoke UI here. \`monty dev\` serves both; \`monty deploy\`\npublishes both.\n`,
+      `\n---\n\n## Custom pages\n\nThis app now has a SPA half (src/) serving CUSTOM pages inside the\nplatform shell. Each page = a route in src/routes/ + a\n\`pages.<name>: { kind: "custom", path: "/<name>" }\` declaration.\nDECLARE-FIRST: \`monty add page <name>\` declares the entry (through the\nschema door on workspace-owned apps) before writing the route — a save\ncarrying an undeclared route refuses. System pages (table views) stay\nshell-rendered — only build bespoke UI here. \`monty dev\` serves both.\nAfter every meaningful change verified in dev, run\n\`monty save "<what changed>"\` — it pushes the work to the cloud copy,\nlike \`git push main\`.\n\nEvery custom page opens with \`PageHeader\` from \`@montytools/sdk/ui\` —\nthe same bar the shell renders on system pages (page actions go in it as\n\`PageHeaderButton\`s, \`primary\` for the one main action). Also there:\n\`FloatingBar\`/\`FloatingBarButton\` and the Lyra table classes\n\`SURFACE\`/\`THEAD\`/\`TH\`/\`ROW\`/\`CHIP\`.\n`,
     );
   }
 
+  // The generated route imports @montytools/sdk/ui, whose Tailwind classes
+  // only compile if the app's CSS scans the sdk dist — older scaffolds
+  // predate the @source line.
+  const cssPath = join(appDir, "src", "index.css");
+  if (existsSync(cssPath)) {
+    const css = readFileSync(cssPath, "utf8");
+    if (!css.includes("@montytools/sdk/dist/ui.js")) {
+      const lines = css.split("\n");
+      let lastImport = -1;
+      lines.forEach((l, i) => { if (/^@import\s/.test(l)) lastImport = i; });
+      lines.splice(lastImport + 1, 0, '@source "../node_modules/@montytools/sdk/dist/ui.js";');
+      writeFileSync(cssPath, lines.join("\n"));
+      console.log("config: src/index.css now scans @montytools/sdk/ui (Tailwind @source)");
+    }
+  }
+
   // The page route: a real, working start — SDK data hooks, shell-aware.
   mkdirSync(dirname(routeFile), { recursive: true });
+  const pageTitle = (pageName[0].toUpperCase() + pageName.slice(1)).replace(/-/g, " ");
   writeFileSync(routeFile, `import { createFileRoute } from "@tanstack/react-router";
+import { PageHeader } from "@montytools/sdk/ui";
 
 export const Route = createFileRoute("/${pageName}")({
   component: ${pageComponentName(pageName)},
@@ -2122,41 +2316,49 @@ export const Route = createFileRoute("/${pageName}")({
 
 // A CUSTOM page: bespoke UI mounted inside the platform shell at
 // /apps/<slug>/${pageName}. Data comes from @montytools/sdk hooks
-// (useList/useInsert/…) against the same tables the shell renders.
+// (useList/useInsert/…) against the same tables the shell renders. The
+// PageHeader bar is the same chrome system pages wear — keep it first, put
+// page actions in it (PageHeaderButton).
 function ${pageComponentName(pageName)}() {
   return (
-    <main className="p-6">
-      <h1 className="text-lg font-semibold">${appName} — ${pageName}</h1>
-      <p className="mt-2 text-sm text-muted-foreground">
-        Build this page. It ships with the app on the next \`monty deploy\`.
-      </p>
-    </main>
+    <div className="flex h-full min-h-dvh flex-col">
+      <PageHeader title="${pageTitle}" />
+      <main className="min-h-0 flex-1 overflow-auto p-6">
+        <p className="text-sm text-muted-foreground">
+          Build this page. It ships with the app on the next \`monty save\`.
+        </p>
+      </main>
+    </div>
   );
 }
 `);
   console.log(`page: src/routes/${pageName}.tsx`);
 
-  // Register the page in the config's pages block (insert or create).
-  const entry = `    ${JSON.stringify(pageName).includes("-") ? JSON.stringify(pageName) : pageName}: { kind: "custom", path: "/${pageName}" },`;
-  let next = null;
-  if (/^(\s*)pages:\s*{/m.test(config)) {
-    next = config.replace(/^(\s*)pages:\s*{/m, (m) => `${m}\n${entry}`);
-  } else {
-    // No pages block: add one right before the config's closing `});`.
-    const close = config.lastIndexOf("});");
-    if (close !== -1) {
-      next = config.slice(0, close) + `  pages: {\n${entry}\n  },\n` + config.slice(close);
+  // Manifest-less apps only: the config file is still their editor, so the
+  // entry registers there (workspace-owned apps declared through the door
+  // above — a config edit would be inert).
+  if (declared === "config") {
+    const entry = `    ${JSON.stringify(pageName).includes("-") ? JSON.stringify(pageName) : pageName}: { kind: "custom", path: "/${pageName}" },`;
+    let next = null;
+    if (/^(\s*)pages:\s*{/m.test(config)) {
+      next = config.replace(/^(\s*)pages:\s*{/m, (m) => `${m}\n${entry}`);
+    } else {
+      // No pages block: add one right before the config's closing `});`.
+      const close = config.lastIndexOf("});");
+      if (close !== -1) {
+        next = config.slice(0, close) + `  pages: {\n${entry}\n  },\n` + config.slice(close);
+      }
+    }
+    if (next) {
+      writeFileSync(configPath, next);
+      console.log(`config: pages.${pageName} registered in monty.config.ts`);
+    } else {
+      console.log(`config: could not auto-edit monty.config.ts — add this to defineApp yourself:\n  pages: { ${pageName}: { kind: "custom", path: "/${pageName}" } }`);
     }
-  }
-  if (next) {
-    writeFileSync(configPath, next);
-    console.log(`config: pages.${pageName} registered in monty.config.ts`);
-  } else {
-    console.log(`config: could not auto-edit monty.config.ts — add this to defineApp yourself:\n  pages: { ${pageName}: { kind: "custom", path: "/${pageName}" } }`);
   }
 
   console.log(`added: custom page "${pageName}"`);
-  console.log(`next: monty install && monty dev — the shell mounts /${pageName} live; \`monty deploy\` publishes it.`);
+  console.log(`next: monty install && monty dev — the shell mounts /${pageName} live; \`monty save\` pushes it to the cloud copy.`);
 }
 
 function pageComponentName(pageName) {
@@ -2246,7 +2448,12 @@ async function docs() {
 // readable back. Read from the arg, then a TTY prompt, then stdin (piping).
 async function secret() {
   const appDir = requireAppDir("secret");
-  const meta = await compileConfig(appDir);
+  // Identity comes from the stamp when it exists — no config compile for
+  // one slug read.
+  const stamped = readAppJson(appDir);
+  const meta = typeof stamped?.slug === "string" && stamped.slug
+    ? { slug: stamped.slug }
+    : await compileConfig(appDir);
   const config = loadConfig();
   if (!config?.key) fail("NOT_LOGGED_IN", "Run `monty login` first.");
   const [sub, name] = rest.filter((a) => !a.startsWith("-"));
@@ -2283,13 +2490,25 @@ async function secret() {
   console.log(del ? `secret: removed ${name} from ${meta.slug}` : `secret: set ${name} on ${meta.slug} (write-only; not readable back)`);
 }
 
-// ── monty deploy ───────────────────────────────────────────────────────────
+// ── monty save ─────────────────────────────────────────────────────────────
+// Push the working copy to the cloud copy, like `git push main`. `deploy` is
+// the compat alias; both run the same pipeline (build + typecheck gate every
+// save, then one multipart POST). The optional message rides the deploy meta
+// so the platform can narrate the save later.
 async function deploy() {
-  const appDir = requireAppDir("deploy");
+  const appDir = requireAppDir(command);
   ensureSdk(appDir);
-  if (!rest.includes("--from-dev")) {
-    console.log("note: direct deploy ships straight to Live, skipping workspace review — the usual flow is `monty dev` (Studio) + the Publish button in the workspace.");
-  }
+  const message = rest.find((a) => !a.startsWith("-")) ?? null;
+  const saveJson = (state) => writeSaveJson(appDir, { message, ...state });
+  saveJson({ status: "saving" });
+  saveFailNote = (code, fix) => saveJson({ status: "error", detail: fix });
+  process.on("exit", (exitCode) => {
+    // A crash that never reached fail() (network throw, unhandled rejection)
+    // must not leave the chip on "Saving…" forever.
+    if (exitCode !== 0 && saveFailNote) {
+      saveJson({ status: "error", detail: "The save stopped before finishing. Run `monty save` again." });
+    }
+  });
   const config = loadConfig();
   if (!config?.key) {
     fail("NOT_LOGGED_IN", "Run `monty login` first (create a key at /cli-auth in the Monty host).");
@@ -2300,6 +2519,21 @@ async function deploy() {
   console.log("compile: monty.config.ts");
   const meta = await compileConfig(appDir);
   console.log(`compile: ok (app "${meta.slug}", ${Object.keys(meta.schemaJson.tables).length} tables)`);
+  // `monty save "what changed"` — the message rides the meta for the
+  // platform to render as this save's Activity row.
+  if (message) meta.message = message;
+
+  // Registry-owned apps ship IMPLEMENTATION ONLY: manifest, schema, rules,
+  // and exposure are door-owned (the server holds them regardless — not
+  // sending them keeps the wire honest). Code-door declarations
+  // (publicFns, schedule, pages, functions) still ride.
+  const registryOwned = readAppJson(appDir)?.registryOwned === true;
+  if (registryOwned) {
+    delete meta.schemaJson;
+    delete meta.manifest;
+    delete meta.exposure;
+    delete meta.rules;
+  }
 
   // CONFIG-ONLY apps publish the manifest alone: no vite build, no bundle —
   // the platform shell renders the app.
@@ -2310,8 +2544,8 @@ async function deploy() {
     run(appDir, "build", ["npx", "vite", "build"],
       "The production build failed. Read the vite error above; it names the file to fix.");
     run(appDir, "typecheck", ["npx", "tsc", "--noEmit"],
-      "TypeScript errors above. Fix them in the listed files; `monty deploy` never uploads code that does not compile.");
-  } else if (!meta.manifest) {
+      "TypeScript errors above. Fix them in the listed files; `monty save` never uploads code that does not compile.");
+  } else if (!registryOwned && !meta.manifest) {
     fail("MANIFEST_MISSING",
       "This config-only app compiled without a manifest — that should be impossible (forceManifest). Re-run `monty install` to refresh the SDK, then retry.");
   }
@@ -2347,9 +2581,15 @@ async function deploy() {
           `schedule targets "${name}" but server/index.ts exports no such function. Export it (e.g. \`export async function ${name}(args, ctx) {…}\`) or remove the entry from monty.config.ts.`);
       }
     }
-    meta.fns = serverBundle.fns;
+    // Wire compat: meta.fns stays the UNION (older hosts gate dispatch on
+    // it); meta.datasets is the additive split newer hosts classify with.
+    meta.fns = [...serverBundle.fns, ...serverBundle.datasets];
+    if (serverBundle.datasets.length > 0) meta.datasets = serverBundle.datasets;
     form.set("server-worker", new Blob([serverBundle.code]), "server-worker.mjs");
-    console.log(`fns: bundled ${serverBundle.fns.length} server function(s) (${serverBundle.fns.join(", ")})`);
+    const bundled = [];
+    if (serverBundle.fns.length > 0) bundled.push(`${serverBundle.fns.length} function(s) (${serverBundle.fns.join(", ")})`);
+    if (serverBundle.datasets.length > 0) bundled.push(`${serverBundle.datasets.length} dataset(s) (${serverBundle.datasets.join(", ")})`);
+    console.log(`fns: bundled ${bundled.join(" + ")}`);
     if (publicFns.length > 0) {
       console.log(`public: ${publicFns.map((f) => `/__monty/public/${f}`).join(", ")} — open to the internet; verify signatures in the function`);
     }
@@ -2357,6 +2597,16 @@ async function deploy() {
       console.log(`schedule: ${scheduleEntries.map(([f, c]) => `${f} @ "${c}"`).join(", ")} (UTC; Live cron changes can take ~15 min to propagate)`);
     }
   }
+  // 3a½) Custom pages, by route-file convention (top-level src/routes/
+  // files) — registered as fnsJson.pages so the shell's nav knows what this
+  // bundle ships without a manifest entry.
+  if (!configOnly) {
+    const pages = discoverPages(appDir);
+    if (pages.length > 0) {
+      meta.pages = pages;
+      console.log(`pages: ${pages.map((p) => p.name).join(", ")}`);
+    }
+  }
   // 3b) SOURCE snapshot rides every publish. Without it the platform keeps
   // only the minified bundle and the sole copy of the app's code is this
   // folder — delete it and the source is gone forever. The snapshot is what
@@ -2366,14 +2616,14 @@ async function deploy() {
   {
     const packed = packSource(appDir);
     if (packed === null) {
-      console.log("source: WARNING — could not pack a snapshot (tar failed); `monty pull` will not work for this publish.");
+      console.log("source: WARNING — could not pack a snapshot (tar failed); `monty pull` will not work for this save.");
     } else if (packed.tooLarge) {
       console.log("source: WARNING — snapshot exceeds 10 MB, skipped; `monty pull` will not work for this app. Remove large assets from the app folder.");
     } else {
       sourceHash = packed.hash;
       meta.sourceHash = sourceHash;
       form.set("source", new Blob([packed.buf]), "source.tar.gz");
-      console.log(`source: ${(packed.buf.byteLength / 1024).toFixed(0)} KB snapshot rides this publish (restore anywhere: monty pull ${meta.slug})`);
+      console.log(`source: ${(packed.buf.byteLength / 1024).toFixed(0)} KB snapshot rides this save (restore anywhere: monty pull ${meta.slug})`);
     }
   }
   // V2 schema CAS: prove which stored manifest this checkout last synced,
@@ -2409,9 +2659,14 @@ async function deploy() {
     fail(body?.code ?? `HTTP_${res.status}`, body?.fix ?? "Unexpected server response — is the Monty host reachable?");
   }
   console.log(`origin: ${body.origin}`);
-  console.log(`deployed: ${body.url} (version ${body.version})`);
-  // The manifest just published IS the new CAS base.
-  if (meta.manifest !== undefined) {
+  console.log(`saved: ${body.url} (version ${body.version})`);
+  if (body.manifestDrift) {
+    // The code shipped; the config was HELD — the stored schema changed
+    // since this checkout last synced (another editor).
+    console.log(`schema drift (remote changes):${body.manifestDrift.summary ? `\n${body.manifestDrift.summary}` : ""}`);
+    console.log(`config push held: ${body.manifestDrift.fix ?? "Run `monty schema pull`, merge, then deploy again."}`);
+  } else if (meta.manifest !== undefined) {
+    // The manifest just published IS the new CAS base.
     writeSchemaState(appDir, manifestHash(meta.manifest));
   }
   // Stamp what was published — pull uses this to tell "unchanged since last
@@ -2422,15 +2677,22 @@ async function deploy() {
       JSON.stringify({ hash: sourceHash, syncedAt: Date.now() }) + "\n",
     );
   }
+  saveFailNote = null;
+  saveJson({ status: "saved" });
 }
 
-// Bundle server/index.ts (if present) into ONE Worker script: a generated
-// entry wraps the app's exports with @montytools/sdk/fn-worker's makeFnWorker,
-// esbuild bundles it for workerd. node: imports are rejected at compile time
-// — Live runs on Cloudflare Workers, not Node. Returns { code, fns } or null.
+// Bundle the app's server code (if present) into ONE Worker script: server/
+// index.ts (functions — custom code) and datasets/index.ts (defineDataset
+// table feeds) merge into a generated entry wrapped with @montytools/sdk/
+// fn-worker's makeFnWorker; esbuild bundles it for workerd. node: imports are
+// rejected at compile time — Live runs on Cloudflare Workers, not Node.
+// Returns { code, fns, datasets } (per-folder export names) or null.
 async function bundleServerFns(appDir, schedule) {
   const serverEntry = join(appDir, "server", "index.ts");
-  if (!existsSync(serverEntry)) return null;
+  const datasetsEntry = join(appDir, "datasets", "index.ts");
+  const hasServer = existsSync(serverEntry);
+  const hasDatasets = existsSync(datasetsEntry);
+  if (!hasServer && !hasDatasets) return null;
   const { build } = await import("esbuild");
   const tmpDir = join(appDir, ".monty");
   mkdirSync(tmpDir, { recursive: true });
@@ -2440,9 +2702,10 @@ async function bundleServerFns(appDir, schedule) {
   // hands back only the matching cron expression, so the worker needs the
   // expression→fn mapping at runtime.
   writeFileSync(entry, [
-    `import * as appFns from "../server/index";`,
+    hasServer ? `import * as appFns from "../server/index";` : `const appFns = {};`,
+    hasDatasets ? `import * as appDatasets from "../datasets/index";` : `const appDatasets = {};`,
     `import { makeFnWorker } from "@montytools/sdk/fn-worker";`,
-    `export default makeFnWorker(appFns, { schedule: ${JSON.stringify(schedule ?? {})} });`,
+    `export default makeFnWorker({ ...appFns, ...appDatasets }, { schedule: ${JSON.stringify(schedule ?? {})} });`,
   ].join("\n"));
   // Fail the deploy if server code reaches for Node built-ins — a Worker
   // can't run them, and a silent runtime crash on Live is the worst outcome.
@@ -2471,15 +2734,20 @@ async function bundleServerFns(appDir, schedule) {
       logLevel: "silent",
       plugins: [banPlatformImports],
     });
-    fns = discoverFnExports(serverEntry);
-    if (fns.length === 0) {
-      fail("NO_FN_EXPORTS", "server/index.ts exists but exports no async functions. Export named functions like `export async function score(args, ctx) {…}`, or remove the folder.");
+    fns = hasServer ? discoverFnExports(serverEntry) : [];
+    const datasets = hasDatasets ? discoverFnExports(datasetsEntry) : [];
+    const dup = fns.filter((f) => datasets.includes(f));
+    if (dup.length > 0) {
+      fail("DUPLICATE_EXPORT", `"${dup[0]}" is exported from both server/index.ts and datasets/index.ts — one name, one home. Remove one of the two exports.`);
     }
-    return { code: readFileSync(out, "utf8"), fns };
+    if (fns.length === 0 && datasets.length === 0) {
+      fail("NO_FN_EXPORTS", "server/index.ts / datasets/index.ts exist but export no functions. Export named functions like `export async function score(args, ctx) {…}`, or remove the folder.");
+    }
+    return { code: readFileSync(out, "utf8"), fns, datasets };
   } catch (e) {
-    if (e?.code === "NO_FN_EXPORTS") throw e; // fail() already exited; guard for safety
+    if (e?.code === "NO_FN_EXPORTS" || e?.code === "DUPLICATE_EXPORT") throw e; // fail() already exited; guard for safety
     const msg = e?.errors?.[0]?.text ?? e?.message ?? String(e);
-    fail("FN_BUNDLE_FAILED", `Could not bundle server/index.ts: ${msg}`);
+    fail("FN_BUNDLE_FAILED", `Could not bundle the app's server code: ${msg}`);
   } finally {
     rmSync(entry, { force: true });
     rmSync(out, { force: true });
@@ -2503,7 +2771,7 @@ function discoverFnExports(serverEntry) {
 }
 
 // Thin wrapper over the shared pipeline (lib/compile.mjs): `soft` keeps the
-// Studio heartbeat's last good schema through transient config breakage.
+// the session heartbeat's last good schema through transient config breakage.
 async function compileConfig(appDir, { soft = false } = {}) {
   try {
     // Config-only apps (no SPA) always compile a manifest: the platform
@@ -2542,7 +2810,7 @@ function walk(dir) {
   return out;
 }
 
-// ── cron matching (the Studio ticker in `monty dev`) ──────────────────────
+// ── cron matching (the session's cron ticker in `monty dev`) ─────────────
 // UTC, 5 fields, standard syntax: *  a,b  a-b  */n  a-b/n  plus month/day
 // names (JAN, MON). Deliberately forgiving: an unparsable field simply never
 // matches locally — Cloudflare is the syntax authority at deploy, so a bad
@@ -2603,15 +2871,14 @@ function cronFieldMatches(field, value, [lo, hi], idx) {
 // terminal — no browser, no dev session. Auth is the mk_ key exchanged at
 // /api/dev-token for a 5-minute workspace token (member lane, org_id from
 // the verified JWT), then the 6 public records functions over Convex's HTTP
-// API. `app` picks the records namespace: the plain slug is Live; --studio
-// targets "{slug}#dev" (the Studio sandbox — same wire literal the dev
-// shell uses). Results are ONE JSON document on stdout so agents can pipe.
+// API. `app` is the plain slug — every app has ONE set of records.
+// Results are ONE JSON document on stdout so agents can pipe.
 
-const DATA_VALUE_FLAGS = new Set(["app", "filter", "order", "limit", "cursor", "data", "key", "unset", "host"]);
+const DATA_VALUE_FLAGS = new Set(["app", "filter", "order", "limit", "cursor", "data", "key", "unset", "host", "name", "type", "out", "table", "record", "field"]);
 
 // rest, minus flags AND their values — `monty data list leads --app crm`
-// must not read "crm" as a positional. Boolean flags (--studio) have no
-// value and are skipped alone.
+// must not read "crm" as a positional. Boolean flags have no value and
+// are skipped alone.
 function dataPositionals() {
   const out = [];
   for (let i = 0; i < rest.length; i++) {
@@ -2645,7 +2912,10 @@ function resolveDataApp() {
   if (!slug) {
     fail("NO_APP", "Say which app: pass --app <slug>, or run inside an app folder. `monty apps` lists local apps.");
   }
-  return rest.includes("--studio") ? `${slug}#dev` : slug;
+  if (rest.includes("--studio")) {
+    fail("STUDIO_REMOVED", "The session sandbox is gone — every app has one set of records, and data verbs always target it. Drop --studio.");
+  }
+  return slug;
 }
 
 // mk_ key → { convexUrl, token }. The token is workspace-scoped and expires
@@ -2666,7 +2936,7 @@ async function dataAuth() {
   if (!r.ok || !body?.token) {
     fail(body?.code ?? `HTTP_${r.status}`, body?.fix ?? "Minting a workspace token failed. Run `monty login`, then retry.");
   }
-  return { convexUrl, token: body.token };
+  return { host, convexUrl, token: body.token };
 }
 
 // One records function over Convex's public HTTP API (plain-JSON format —
@@ -2712,7 +2982,7 @@ function flattenRow(doc) {
 }
 
 function dataUsage() {
-  console.log("usage: monty data <verb> [table] [flags]     read/write an app's Live records (add --studio for the Studio sandbox)");
+  console.log("usage: monty data <verb> [table] [flags]     read/write an app's records");
   console.log("  schema  [table]                             the app's table shapes (from local monty.config.ts — `monty pull` first if needed)");
   console.log("  list    <table> [--filter '{\"k\":\"v\"}'] [--order asc|desc] [--limit N] [--cursor C]");
   console.log("  get     <table> <id>");
@@ -2720,10 +2990,57 @@ function dataUsage() {
   console.log("  update  <table> <id> --data '<json>' [--unset field,field]");
   console.log("  upsert  <table> --key <field[,field]> --data '<json|[json,…]>'   find-or-create matched on the key fields (idempotent)");
   console.log("  remove  <table> <id>");
-  console.log("target: --app <slug> (or run inside the app folder); default is LIVE data — --studio targets the sandbox");
+  console.log("  upload  <path> [--name N] [--type mime]     store a file (10MB cap); prints the descriptor to put in a `file` field");
+  console.log("          [--table <t> --record <id> --field <f>]   …and set that row's field in the same command");
+  console.log("  download <file-id> [--out path]             fetch a stored file's bytes (id from a row's file field)");
+  console.log("target: --app <slug> (or run inside the app folder)");
   process.exit(1);
 }
 
+// Uploads without --type get the MIME their extension implies; unknown
+// extensions stay application/octet-stream (the server stores, never sniffs).
+const MIME_BY_EXT = {
+  png: "image/png", jpg: "image/jpeg", jpeg: "image/jpeg", gif: "image/gif",
+  webp: "image/webp", svg: "image/svg+xml", ico: "image/x-icon",
+  pdf: "application/pdf", json: "application/json", csv: "text/csv",
+  txt: "text/plain", md: "text/markdown", html: "text/html",
+  zip: "application/zip", mp3: "audio/mpeg", wav: "audio/wav",
+  mp4: "video/mp4", webm: "video/webm",
+};
+
+function inferContentType(name) {
+  const ext = /\.([a-z0-9]+)$/i.exec(name)?.[1]?.toLowerCase();
+  return (ext && MIME_BY_EXT[ext]) || "application/octet-stream";
+}
+
+const DATA_MAX_FILE_BYTES = 10 * 1024 * 1024;
+
+// POST/GET on the host's /api/files — the same rail the SDK file helpers
+// ride, authorized with the invocation's 5-minute workspace token.
+async function callFiles(method, params, auth, app, opts = {}) {
+  const url = new URL("/api/files", auth.host);
+  for (const [k, v] of Object.entries(params)) url.searchParams.set(k, v);
+  let r;
+  try {
+    r = await fetch(url, {
+      method,
+      headers: {
+        authorization: `Bearer ${auth.token}`,
+        "x-monty-app": app,
+        ...(opts.contentType ? { "content-type": opts.contentType } : {}),
+      },
+      ...(opts.body !== undefined ? { body: opts.body } : {}),
+    });
+  } catch {
+    fail("HOST_UNREACHABLE", `The file endpoint at ${auth.host} did not answer — check the network and retry.`);
+  }
+  if (!r.ok) {
+    const err = await r.json().catch(() => null);
+    fail(err?.code ?? `HTTP_${r.status}`, err?.fix ?? "The file request failed. Retry; if it persists, report it.");
+  }
+  return r;
+}
+
 async function data() {
   const [verb, table, id] = dataPositionals();
 
@@ -2758,6 +3075,82 @@ async function data() {
     return;
   }
 
+  if (verb === "upload") {
+    // The positional is a file PATH, not a table — the descriptor this
+    // prints is what a `file`-typed field stores; --table/--record/--field
+    // set it on an existing row in the same command.
+    const path = table;
+    if (!path) fail("MISSING_PATH", "Usage: monty data upload <path> [--name N] [--type mime] [--table <t> --record <id> --field <f>].");
+    const attachTable = flag("table");
+    const attachRecord = flag("record");
+    const attachField = flag("field");
+    const attachFlags = [attachTable, attachRecord, attachField].filter((f) => f !== undefined);
+    if (attachFlags.length > 0 && attachFlags.length < 3) {
+      fail("BAD_ATTACH", "Attaching needs all three of --table, --record, and --field — or none (then put the printed descriptor in a file field yourself).");
+    }
+    let bytes;
+    try {
+      bytes = readFileSync(path);
+    } catch {
+      fail("NO_SUCH_FILE", `Could not read "${path}" — check the path.`);
+    }
+    if (bytes.byteLength === 0) fail("EMPTY_FILE", `"${path}" is empty — nothing to upload.`);
+    if (bytes.byteLength > DATA_MAX_FILE_BYTES) {
+      fail("FILE_TOO_LARGE", `Files are limited to ${DATA_MAX_FILE_BYTES} bytes; "${path}" is ${bytes.byteLength}. Compress it first.`);
+    }
+    const name = flag("name") ?? basename(path);
+    const contentType = flag("type") ?? inferContentType(name);
+    const app = resolveDataApp();
+    const auth = await dataAuth();
+    if (attachFlags.length === 3) {
+      // Prove the target row exists BEFORE storing bytes — a failed attach
+      // after the upload would orphan the file.
+      const row = await callRecords("query", "get", { app, table: attachTable, id: attachRecord }, auth);
+      if (!row) fail("NOT_FOUND", `No record "${attachRecord}" in table "${attachTable}" — ids come from \`monty data list ${attachTable}\`.`);
+    }
+    const res = await callFiles("POST", { name }, auth, app, { body: bytes, contentType });
+    const file = await res.json();
+    if (attachFlags.length === 3) {
+      await callRecords("mutation", "update", {
+        app,
+        table: attachTable,
+        id: attachRecord,
+        data: { [attachField]: file },
+      }, auth);
+      printJson({ ok: true, id: attachRecord, field: attachField, file });
+    } else {
+      printJson({ file });
+    }
+    return;
+  }
+
+  if (verb === "download") {
+    // The positional is the file id (a row's file-field descriptor carries
+    // it), not a table.
+    const fileId = table;
+    if (!fileId) fail("MISSING_ID", "Usage: monty data download <file-id> [--out path] — ids come from a row's file field (its `id` key).");
+    const app = resolveDataApp();
+    const auth = await dataAuth();
+    const res = await callFiles("GET", { id: fileId }, auth, app);
+    const disposition = res.headers.get("content-disposition") ?? "";
+    const remoteName = /filename="([^"]+)"/.exec(disposition)?.[1] ?? fileId;
+    const out = flag("out") ?? remoteName;
+    const body = Buffer.from(await res.arrayBuffer());
+    try {
+      writeFileSync(out, body);
+    } catch {
+      fail("WRITE_FAILED", `Could not write to "${out}" — check the path and permissions.`);
+    }
+    printJson({
+      ok: true,
+      path: out,
+      name: remoteName,
+      contentType: res.headers.get("content-type") ?? "application/octet-stream",
+      size: body.byteLength,
+    });
+    return;
+  }
+
   const VERBS = new Set(["list", "get", "insert", "update", "upsert", "remove"]);
   if (!verb || !VERBS.has(verb)) dataUsage();
   if (!table) fail("MISSING_TABLE", `\`monty data ${verb}\` needs a table name: monty data ${verb} <table> … (\`monty data schema\` lists tables).`);
@@ -2866,34 +3259,99 @@ if (command !== "dev" && command !== "logs") {
   installSkills({ appDir: findAppRoot(process.cwd()) });
 }
 
-// ── monty schema — the schema-as-data door of the CLI ─────────────────────
-// `monty schema pull [slug] [--force]`: regenerate monty.config.ts from the
-// app's stored Live manifest (after another agent edited it via the API).
-// Distinct from `monty pull`, which restores the whole source snapshot.
+// ── monty schema — the manifest door ──────────────────────────────────────
+// The app's data half (tables, field algebra, metrics, settings, pages)
+// lives ONLY in the workspace. `monty schema [slug]` prints the stored
+// manifest as JSON (and stamps the CAS base); edit that JSON and
+// `monty schema set <file|->` writes it back through the one landing —
+// validated server-side, additive-only by default, CAS against what you
+// read. `monty schema pull` (legacy) regenerates monty.config.ts.
 async function schemaCmd() {
   const verb = rest[0];
-  if (verb !== "pull") {
-    console.log("usage: monty schema pull [slug] [--force]");
-    console.log("  pull   regenerate monty.config.ts from the app's stored manifest (.bak kept; --force discards local schema edits)");
-    process.exit(verb ? 1 : 0);
-  }
   const { host, key } = loadConfig() ?? {};
   if (!key) fail("NOT_LOGGED_IN", "Run `monty login` first.");
-  const appDir = findAppRoot(process.cwd()) ?? process.cwd();
-  let slug = rest.slice(1).find((a) => !a.startsWith("--"));
-  if (!slug) {
+  const appDir = findAppRoot(process.cwd());
+
+  if (verb === "pull") {
+    const dir = appDir ?? process.cwd();
+    let slug = rest.slice(1).find((a) => !a.startsWith("--"));
+    if (!slug) {
+      try {
+        slug = (await compileAppConfig(dir)).slug;
+      } catch {
+        fail("INVALID_SLUG", "Pass the app slug (monty schema pull <slug>) — no compilable monty.config.ts here to read it from.");
+      }
+    }
+    await schemaPull({
+      appDir: dir, host, key, slug,
+      force: rest.includes("--force"),
+      compileAppConfig,
+      fail,
+    });
+    return;
+  }
+
+  if (verb === "set") {
+    const target = rest[1];
+    if (!target) {
+      fail("SCHEMA_USAGE", "Usage: monty schema set <file.json|-> [--allow-breaking] — the JSON is a full manifest (start from `monty schema`).");
+    }
+    let raw;
     try {
-      slug = (await compileAppConfig(appDir)).slug;
+      raw = target === "-" ? readFileSync(0, "utf8") : readFileSync(target, "utf8");
     } catch {
-      fail("INVALID_SLUG", "Pass the app slug (monty schema pull <slug>) — no compilable monty.config.ts here to read it from.");
+      fail("SCHEMA_USAGE", `Could not read ${target === "-" ? "stdin" : target}. Pass a manifest JSON file, or - for stdin.`);
     }
+    let manifest;
+    try {
+      manifest = JSON.parse(raw);
+    } catch {
+      fail("BAD_MANIFEST_JSON", "That is not valid JSON. Start from `monty schema` output, edit, and set the whole document back.");
+    }
+    const slug = typeof manifest?.slug === "string" && manifest.slug ? manifest.slug : (appDir ? readSlug(appDir) : null);
+    if (!slug) fail("INVALID_SLUG", "The manifest carries no slug and this is not an app folder — set `slug` in the JSON.");
+    // CAS: prove which stored manifest this edit was based on (stamped by
+    // the last `monty schema` read in this folder). Absent = trusting push.
+    const base = appDir && readSlug(appDir) === slug ? readSchemaState(appDir)?.hash : undefined;
+    const res = await fetch(`${host}/api/schema`, {
+      method: "POST",
+      headers: { authorization: `Bearer ${key}`, "content-type": "application/json" },
+      body: JSON.stringify({
+        slug,
+        manifest,
+        ...(base ? { baseHash: base } : {}),
+        ...(rest.includes("--allow-breaking") ? { allowBreaking: true } : {}),
+      }),
+    });
+    const body = await res.json().catch(() => null);
+    if (!res.ok || !body?.ok) {
+      if (body?.code === "MANIFEST_DRIFT" && body?.summary) {
+        console.log(`schema drift (remote changes):\n${body.summary}`);
+      }
+      fail(body?.code ?? `HTTP_${res.status}`, body?.fix ?? "Setting the manifest failed — is the Monty host reachable?");
+    }
+    if (appDir && readSlug(appDir) === slug) writeSchemaState(appDir, body.hash);
+    console.log(`schema: set — "${slug}" is live now (hash ${String(body.hash).slice(0, 12)})`);
+    return;
   }
-  await schemaPull({
-    appDir, host, key, slug,
-    force: rest.includes("--force"),
-    compileAppConfig,
-    fail,
+
+  // Default: SHOW. `monty schema [slug]` — stdout is the pure manifest
+  // JSON (pipe it to a file, edit, `monty schema set` it back).
+  const slug = (verb && !verb.startsWith("-") ? verb : null) ?? (appDir ? readSlug(appDir) : null);
+  if (!slug) fail("INVALID_SLUG", "Usage: monty schema [slug] — or run it inside an app folder.");
+  const res = await fetch(`${host}/api/schema?slug=${slug}`, {
+    headers: { authorization: `Bearer ${key}` },
   });
+  const body = await res.json().catch(() => null);
+  if (!res.ok || !body?.ok) {
+    fail(body?.code ?? `HTTP_${res.status}`, body?.fix ?? "Could not read the manifest — check the connection and `monty login`.");
+  }
+  if (body.manifest === null) {
+    fail("NO_MANIFEST", `"${slug}" has no stored manifest yet — it's a code-only app. Declare one by setting a full manifest JSON: monty schema set <file>.`);
+  }
+  if (appDir && readSlug(appDir) === slug) writeSchemaState(appDir, body.hash);
+  console.error(`# ${slug} — manifest hash ${String(body.hash).slice(0, 12)}${appDir ? " (CAS base stamped for `monty schema set`)" : ""}`);
+  console.log(JSON.stringify(body.manifest, null, 2));
 }
 
 switch (command) {
@@ -2907,7 +3365,7 @@ switch (command) {
     await pull();
     break;
   case "commit":
-    await commit();
+    fail("COMMIT_REMOVED", "`monty commit` is gone — `monty save` is the one verb (every save records a history row; `monty log` lists them).");
     break;
   case "log":
   case "versions":
@@ -2939,7 +3397,7 @@ switch (command) {
     apps();
     break;
   case "skills":
-    installSkills({ appDir: findAppRoot(process.cwd()), silent: false });
+    installSkills({ appDir: findAppRoot(process.cwd()), silent: false, force: true });
     console.log("skills: up to date");
     break;
   case "install":
@@ -2951,6 +3409,7 @@ switch (command) {
   case "typecheck":
     typecheckApp();
     break;
+  case "save":
   case "deploy":
     await deploy();
     break;
@@ -2964,14 +3423,13 @@ switch (command) {
     await secret();
     break;
   default:
-    console.log("usage: monty <login|create|pull|commit|log|current|select|apps|install|dev|logs|build|typecheck|add|components|docs|deploy|data|skills>");
+    console.log("usage: monty <login|create|pull|log|current|select|apps|install|dev|logs|build|typecheck|add|components|docs|save|data|skills>");
     console.log("  login       [--host <url>] [--key <mk_...>]  sign in (opens your browser to authorize)");
     console.log("  create      <slug> [--name N] [--icon I] [--spa]  register a new app (config-only by default; --spa scaffolds the full SPA)");
     console.log("  pull        <slug> [--version H] [--force]  restore the app's source snapshot (latest, or one from `monty log`)");
-    console.log("  commit      [-m \"message\"]                  version the app's source in the workspace without publishing");
-    console.log("  log         [slug]                          the app's source version history (commits + publishes)");
-    console.log("  dev         [--port N] [--no-tunnel] [--takeover]  run the app in Studio, or attach to a running session (sandboxed data)");
-    console.log("  logs        [-n N] [-f]                     read/follow the dev shell log (vite output, browser errors, publish results)");
+    console.log("  log         [slug]                          the app's source version history (one row per save)");
+    console.log("  dev         [--port N] [--no-tunnel] [--takeover]  run the app's session, or attach to a running one (live data, auto-auth)");
+    console.log("  logs        [-n N] [-f]                     read/follow the dev shell log (vite output, browser errors, save results)");
     console.log("  add         <name...> | page <name>         install UI components, or scaffold a custom page (`monty add page reports`)");
     console.log("  components  [query]                        list the curated component catalog");
     console.log("  docs        <name>                         view a component's source before installing");
@@ -2981,9 +3439,10 @@ switch (command) {
     console.log("  install                                     install app dependencies");
     console.log("  build                                       production build (vite, via monty)");
     console.log("  typecheck                                   typecheck (builds first if needed)");
-    console.log("  deploy                                      build + upload this app straight to Live");
+    console.log("  save        [\"what changed\"]                 push the working copy to the cloud copy, like `git push main` (build + typecheck gate it)");
+    console.log("  deploy                                      alias of save");
     console.log("  data        <verb> [table] [flags]          read/write an app's records from the terminal (`monty data` for verbs)");
-    console.log("  schema      pull [slug] [--force]           regenerate monty.config.ts from the app's stored manifest (schema-as-data)");
+    console.log("  schema      [slug] | set <file|->            read the app's stored manifest (JSON on stdout) / write it back (validated, CAS)");
     console.log("  skills                                      install/refresh the agent build skill");
     process.exit(command ? 1 : 0);
 }