primitive-admin 1.0.55 → 1.0.57

package/dist/src/commands/sync.js

@@ -7,20 +7,21 @@ import { buildDatabaseTypeTomlData, detectExistingOperationForms, normalizeOpera
 import { canEmitNative } from "../lib/toml-native-form.js";
 import { parseMetadataCategoryToml, validateMetadataCategoryConfig, serializeMetadataCategoryConfig, parseDeclaredAccessManifestToml, validateDeclaredAccessManifest, serializeDeclaredAccessManifest, } from "../lib/toml-metadata-config.js";
 import { validateOperations, formatIssue, } from "../lib/toml-params-validator.js";
+import { isPlatformOwnedWorkflow, isPlatformOwnedWorkflowKey, } from "../lib/platform-owned.js";
 import { getServerUrl, resolveAppId } from "../lib/config.js";
 import { resolveSyncDir, resolveSnapshotsRoot, isAutoResolvedSyncDir, checkLegacySyncMigration, } from "../lib/sync-paths.js";
 import { createSnapshot, listSnapshots, resolveSnapshot, restoreSnapshot, pruneSnapshots, } from "../lib/snapshots.js";
-import { validateWorkflowToml, formatWorkflowTomlErrors, } from "../lib/workflow-toml-validator.js";
+import { validateWorkflowToml, formatWorkflowTomlErrors, validateWorkflowExpressionsToml, validateWorkflowExpressionsRawToml, } from "../lib/workflow-toml-validator.js";
 import { expandWorkflowTomlData } from "../lib/workflow-fragments.js";
 import { parseConfigToml, stringifyConfigToml } from "../lib/config-toml.js";
 import { serializeSection, parseTomlToAppSettings, } from "../lib/app-settings-descriptor.js";
 import { serializeAppSettings, collectAppSettingsPushErrors, } from "./sync-app-settings.js";
 import { applyWorkflowBody } from "../lib/workflow-apply.js";
-import { buildWorkflowPayloadFromToml } from "../lib/workflow-payload.js";
+import { buildWorkflowPayloadFromToml, parseWorkflowExpressionsToml, } from "../lib/workflow-payload.js";
 import { detectLayout, migrateLegacyToV2 } from "../lib/block-layout.js";
-import { ABSENT_FROM_EXPORT, LOCAL_ONLY_ABSENT, LOCAL_ONLY_NEW, SYNC_RESOURCE_TYPES, applyPrune, attemptFetch, classifyLocalOnly, hasUncommittedChanges, planPrune, preserveUnwrittenEntries, ruleSetFileKey, } from "../lib/sync-resource-types.js";
+import { ABSENT_FROM_EXPORT, LOCAL_ONLY_ABSENT, LOCAL_ONLY_NEW, PUSH_PRUNE_SPECS, REMOTE_ONLY_UNMANAGED, REMOTE_ONLY_WILL_DELETE, SYNC_RESOURCE_TYPES, applyPrune, attemptFetch, classifyLocalOnly, classifyRemoteOnly, collectPushPruneCandidates, decidePushPruneCandidate, hasUncommittedChanges, planPrune, preserveUnwrittenEntries, removePrunedSidecar, ruleSetFileKey, } from "../lib/sync-resource-types.js";
 import { success, error, printApiError, info, warn, keyValue, json, divider, } from "../lib/output.js";
-import { confirmPrompt } from "../lib/confirm-prompt.js";
+import { confirmPrompt, ConfirmPromptError } from "../lib/confirm-prompt.js";
 import chalk from "chalk";
 function ensureDir(dirPath) {
     if (!existsSync(dirPath)) {
@@ -711,12 +712,13 @@ function serializeBlobBucket(bucket) {
  * Build the PATCH payload for a blob-bucket update from local TOML.
  *
  * EXACT extraction of the inline builder shared by the existing-update and
- * 409-adopt branches — do NOT "clean up" the truthiness checks. The server
- * treats `preset` and `accessPolicy` as mutually exclusive, only clears
- * `ruleSetId` when a preset/accessPolicy is also present, and nulls
- * `description` only when the key is explicitly present with a falsy value.
- * `bucketKey` and `ttlTier` are immutable and never sent. Both call sites
- * must go through this helper so their field sets never drift.
+ * 409-adopt branches — do NOT "clean up" the truthiness checks on the access
+ * model. The server treats `preset` and `accessPolicy` as mutually exclusive,
+ * only clears `ruleSetId` when a preset/accessPolicy is also present, and
+ * refuses to leave a bucket with no access model or a blank name — so those
+ * fields are not clearable. `bucketKey` and `ttlTier` are immutable and never
+ * sent. Both call sites must go through this helper so their field sets never
+ * drift.
  */
 function buildBlobBucketUpdatePayload(bucket) {
     const updatePayload = {};
@@ -728,8 +730,11 @@ function buildBlobBucketUpdatePayload(bucket) {
         updatePayload.ruleSetId = bucket.ruleSetId;
     if (bucket.name)
         updatePayload.name = bucket.name;
-    if (bucket.description !== undefined)
-        updatePayload.description = bucket.description || null;
+    // Issue #1567: `description` is TOML-owned — always send it as value-or-`null`
+    // so removing the line from the TOML clears it server-side (the server nulls
+    // `description` on an explicit `null`). Previously it was only sent when the
+    // key was present, so an omitted description preserved the stale value.
+    updatePayload.description = bucket.description ?? null;
     return updatePayload;
 }
 function serializePrompt(prompt) {
@@ -856,7 +861,17 @@ export function serializeWorkflow(workflow, draft, configs, logger) {
     // Determine which steps to use (prefer config steps if non-empty, else draft steps)
     const configSteps = activeConfig?.steps;
     const draftSteps = draft?.steps;
-    const steps = (configSteps && configSteps.length > 0) ? configSteps : (draftSteps || []);
+    const useConfigSteps = configSteps && configSteps.length > 0;
+    const steps = useConfigSteps ? configSteps : (draftSteps || []);
+    // #1614 — the named `expr.*` definitions travel with the steps payload, so
+    // pull emits them from the same source (config vs draft) the steps came from,
+    // as a top-level `[expr.cel]` table for the semantic round-trip.
+    const selectedExpressions = useConfigSteps
+        ? activeConfig?.expressions
+        : draft?.expressions;
+    const expressionsCel = selectedExpressions?.cel && typeof selectedExpressions.cel === "object"
+        ? selectedExpressions.cel
+        : undefined;
     const data = {
         workflow: {
             key: workflow.workflowKey,
@@ -912,6 +927,11 @@ export function serializeWorkflow(workflow, draft, configs, logger) {
         // `secrets`, merged the same way the collection/database type configs do so
         // a workflow's `md`/`secrets` declarations round-trip through pull → push.
         ...serializeDeclaredAccessManifest(workflow.metadataManifest),
+        // #1614 — emit `[expr.cel]` named-guard definitions (only when present) so a
+        // pull → push cycle round-trips them semantically.
+        ...(expressionsCel && Object.keys(expressionsCel).length > 0
+            ? { expr: { cel: expressionsCel } }
+            : {}),
     };
     return stringifyConfigToml(data);
 }
@@ -952,7 +972,7 @@ function serializeEmailTemplate(template) {
     }
     return stringifyConfigToml(data);
 }
-function serializeRuleSet(ruleSet) {
+export function serializeRuleSet(ruleSet) {
     const data = {
         ruleSet: {
             name: ruleSet.name,
@@ -997,6 +1017,83 @@ function serializeCollectionTypeConfig(config, ruleSetIdToName) {
     };
     return stringifyConfigToml(data);
 }
+/**
+ * Issue #1567 — the TOML-owned scalar fields of a database-type config.
+ *
+ * These are fields the `database-types/*.toml` file OWNS: the local file is the
+ * source of truth, so removing one from the TOML must clear it server-side
+ * (config-as-code), not silently preserve the stale value. `schema` is NOT in
+ * this list — it keeps its own `hasSchema` prior-state discriminator, since a
+ * schema is a large sub-tree, not a scalar.
+ */
+export const DB_TYPE_OWNED_SCALARS = [
+    "ruleSetId",
+    "triggers",
+    "metadataAccess",
+    "defaultAccess",
+    "autoPopulatedFields",
+    "timestamps",
+    "metadataManifest",
+];
+// User-facing TOML key names for the "Cleared <field>" push output. The wire
+// field differs from the key the user writes for two of them.
+const DB_TYPE_FIELD_LABELS = {
+    metadataAccess: "celContextAccess",
+    ruleSetId: "ruleSetName",
+};
+/** The user-facing TOML key for a wire field (for push output). */
+export function dbTypeFieldLabel(key) {
+    return DB_TYPE_FIELD_LABELS[key] || key;
+}
+/**
+ * True when a value carries real content. null/undefined, blank/whitespace
+ * strings, and empty objects/arrays all count as "no value" — the same
+ * normalization the server applies (`value || null`) when it decides whether a
+ * field is set.
+ */
+export function hasMeaningfulValue(v) {
+    if (v === null || v === undefined)
+        return false;
+    if (typeof v === "string")
+        return v.trim().length > 0;
+    if (Array.isArray(v))
+        return v.length > 0;
+    if (typeof v === "object")
+        return Object.keys(v).length > 0;
+    return true;
+}
+/**
+ * Issue #1567 — always-send owned db-type scalars as value-or-`null`.
+ *
+ * The server PATCH endpoint distinguishes an omitted key (preserve) from an
+ * explicit `null` (clear), so sending every owned scalar as `value ?? null`
+ * converges the server to the local TOML: a field removed from the file lands
+ * as `null` and is cleared. Matches the always-send pattern the sibling
+ * `collection-type-config` push already uses.
+ */
+export function buildOwnedScalarUpdate(typeConfig) {
+    const u = {};
+    for (const key of DB_TYPE_OWNED_SCALARS) {
+        u[key] = typeConfig[key] ?? null;
+    }
+    return u;
+}
+/**
+ * Issue #1567 — the owned scalars this push genuinely clears: the outgoing
+ * value is empty but the server currently holds a real value (a non-null →
+ * null transition). Used for the "Cleared <field>" report so removing an
+ * access gate is never silent, and to decide whether an otherwise
+ * type-field-less push still needs a type-config PATCH. Returns wire field
+ * names (map with `dbTypeFieldLabel` for output). `serverConfig` is the live
+ * GET; without it (fresh type or a failed fetch) nothing is reported cleared.
+ */
+export function ownedScalarsBeingCleared(updateData, serverConfig) {
+    if (!serverConfig)
+        return [];
+    return DB_TYPE_OWNED_SCALARS.filter((key) => key in updateData &&
+        !hasMeaningfulValue(updateData[key]) &&
+        hasMeaningfulValue(serverConfig[key]));
+}
 export function parseDatabaseTypeToml(tomlData) {
     const typeSection = tomlData.type || {};
     const typeConfig = {
@@ -1010,11 +1107,14 @@ export function parseDatabaseTypeToml(tomlData) {
         typeConfig.ruleSetId = typeSection.ruleSetId;
     }
     // Accept both `celContextAccess` (new user-facing key) and `metadataAccess`
-    // (legacy). The newer key wins when both appear.
-    if (typeSection.celContextAccess) {
+    // (legacy). The newer key wins when both appear. Issue #1567: use a
+    // defined-check, not a truthy guard, so `celContextAccess = ""` is honored as
+    // an explicit clear (empty string → server nulls it) rather than falling
+    // through to the legacy key or being dropped.
+    if (typeSection.celContextAccess !== undefined) {
         typeConfig.metadataAccess = typeSection.celContextAccess;
     }
-    else if (typeSection.metadataAccess) {
+    else if (typeSection.metadataAccess !== undefined) {
         typeConfig.metadataAccess = typeSection.metadataAccess;
     }
     if (typeSection.defaultAccess !== undefined) {
@@ -1081,7 +1181,7 @@ export function parseDatabaseTypeToml(tomlData) {
     const subscriptions = (tomlData.subscriptions || []).map((sub) => normalizeSubscriptionFromToml(sub));
     return { typeConfig, operations, subscriptions };
 }
-function parseRuleSetToml(tomlData) {
+export function parseRuleSetToml(tomlData) {
     const ruleSetSection = tomlData.ruleSet || {};
     return {
         name: ruleSetSection.name,
@@ -1141,6 +1241,102 @@ export function parseCollectionTypeConfigToml(tomlData) {
     }
     return result;
 }
+// ── Content-aware `sync diff` for the five database-config resource types ──
+// (issue #1485)
+//
+// database-types, rule-sets, group-type-configs, collection-type-configs and
+// metadata-category-configs were absent from `sync diff` entirely, so an edit
+// to any of them read as "nothing differs" until `sync push` applied it. These
+// helpers give diff the same content-aware comparison the workflow and
+// transform blocks already have: the server entity is run through the SAME pull
+// serializer that writes the local file, and BOTH sides are then parsed with
+// the SAME push parser before hashing.
+//
+// Parsing through the push parser — rather than hashing the raw parsed TOML —
+// is what makes the comparison encoding-independent, and is why the four known
+// false-diff traps do not fire: a legacy JSON-string operation and the native
+// `[operations.definition]` table the server emits normalize to one shape
+// (`normalizeOperationFromToml`); a `ruleSetName` reference and its legacy
+// `ruleSetId` resolve to the same id (`normalizeRuleSetRefForDiff`); an omitted
+// `autoAddCreator` picks up the same default the server serializes
+// (`parseGroupTypeConfigToml`); and a metadata-category's identity is read from
+// the parsed `[metadataCategoryConfig]` content, not the filename. Hashing raw
+// parsed TOML would show a false `Modified` for each of those equivalent forms.
+/**
+ * Resolve a parsed entity's rule-set reference to a stable id for hashing.
+ * `parseGroupTypeConfigToml` / `parseCollectionTypeConfigToml` /
+ * `parseDatabaseTypeToml` leave either `_ruleSetName` (key-based) or a legacy
+ * `ruleSetId` on the entity; collapsing both to `ruleSetId` here means the two
+ * encodings of the same reference hash equal. `throwOnMissing: false` so an
+ * unresolvable name degrades gracefully rather than aborting the diff.
+ *
+ * When the name does NOT resolve — a typo, or a rule set added locally in the
+ * same tree but not yet on the server — `resolveRuleSetReference` deletes
+ * `_ruleSetName` WITHOUT setting `ruleSetId`, leaving the entity with no
+ * reference at all. If the remote config also currently has no rule set the two
+ * hashes would then be equal and diff would report `Synced`, silently hiding a
+ * real pending change (push will either reject the typo or create the rule set
+ * and update the config). So we preserve the unresolved name in the hashed
+ * value under a distinct key, ensuring the pending change surfaces as
+ * `Modified` instead of `Synced`.
+ */
+function normalizeRuleSetRefForDiff(entity, ruleSetNameToId, label) {
+    const referencedName = entity._ruleSetName;
+    const wasResolvable = referencedName !== undefined && ruleSetNameToId.has(referencedName);
+    resolveRuleSetReference(entity, ruleSetNameToId, label, {
+        throwOnMissing: false,
+    });
+    if (referencedName !== undefined && !wasResolvable) {
+        entity._unresolvedRuleSetName = referencedName;
+    }
+}
+export function hashLocalRuleSetForDiff(parsedToml) {
+    return computeExpandedContentHash(parseRuleSetToml(parsedToml));
+}
+export function hashRemoteRuleSetForDiff(ruleSet) {
+    return computeExpandedContentHash(parseRuleSetToml(parseConfigToml(serializeRuleSet(ruleSet))));
+}
+export function hashLocalGroupTypeConfigForDiff(parsedToml, ruleSetNameToId) {
+    const entity = parseGroupTypeConfigToml(parsedToml);
+    normalizeRuleSetRefForDiff(entity, ruleSetNameToId, `group type config "${entity.groupType}"`);
+    return computeExpandedContentHash(entity);
+}
+export function hashRemoteGroupTypeConfigForDiff(config, ruleSetIdToName, ruleSetNameToId) {
+    const entity = parseGroupTypeConfigToml(parseConfigToml(serializeGroupTypeConfig(config, ruleSetIdToName)));
+    normalizeRuleSetRefForDiff(entity, ruleSetNameToId, `group type config "${entity.groupType}"`);
+    return computeExpandedContentHash(entity);
+}
+export function hashLocalCollectionTypeConfigForDiff(parsedToml, ruleSetNameToId) {
+    const entity = parseCollectionTypeConfigToml(parsedToml);
+    normalizeRuleSetRefForDiff(entity, ruleSetNameToId, `collection type config "${entity.collectionType}"`);
+    return computeExpandedContentHash(entity);
+}
+export function hashRemoteCollectionTypeConfigForDiff(config, ruleSetIdToName, ruleSetNameToId) {
+    const entity = parseCollectionTypeConfigToml(parseConfigToml(serializeCollectionTypeConfig(config, ruleSetIdToName)));
+    normalizeRuleSetRefForDiff(entity, ruleSetNameToId, `collection type config "${entity.collectionType}"`);
+    return computeExpandedContentHash(entity);
+}
+export function hashLocalDatabaseTypeForDiff(parsedToml, ruleSetNameToId) {
+    const { typeConfig, operations, subscriptions } = parseDatabaseTypeToml(parsedToml);
+    normalizeRuleSetRefForDiff(typeConfig, ruleSetNameToId, `database type "${typeConfig.databaseType}"`);
+    return computeExpandedContentHash({ typeConfig, operations, subscriptions });
+}
+export function hashRemoteDatabaseTypeForDiff(typeConfig, operations, subscriptions, ruleSetIdToName, ruleSetNameToId) {
+    const serialized = serializeDatabaseType(typeConfig, operations, ruleSetIdToName, { defaultForm: "native", subscriptions });
+    const parsed = parseDatabaseTypeToml(parseConfigToml(serialized));
+    normalizeRuleSetRefForDiff(parsed.typeConfig, ruleSetNameToId, `database type "${parsed.typeConfig.databaseType}"`);
+    return computeExpandedContentHash({
+        typeConfig: parsed.typeConfig,
+        operations: parsed.operations,
+        subscriptions: parsed.subscriptions,
+    });
+}
+export function hashLocalMetadataCategoryForDiff(parsedToml) {
+    return computeExpandedContentHash(parseMetadataCategoryToml(parsedToml));
+}
+export function hashRemoteMetadataCategoryForDiff(config) {
+    return computeExpandedContentHash(parseMetadataCategoryToml(parseConfigToml(serializeMetadataCategoryConfig(config))));
+}
 // Parsing helpers
 //
 // All 20+ TOML parse sites in this file route through `parseTomlFile()`.
@@ -1148,7 +1344,7 @@ export function parseCollectionTypeConfigToml(tomlData) {
 // prompts, tests, etc.) gets it for free. For non-workflow TOMLs the
 // expander is a no-op: if the parsed result has no `include` key, it returns
 // the original object untouched.
-function parseTomlFile(filePath) {
+export function parseTomlFile(filePath) {
     const content = readFileSync(filePath, "utf-8");
     const parsed = parseConfigToml(content);
     return expandWorkflowTomlData(parsed, filePath);
@@ -1170,6 +1366,83 @@ export async function fetchAll(listFn, pageSize = 100, maxPages = 100) {
     } while (cursor);
     return all;
 }
+/**
+ * Issue #976 / #1006: shared 409 → adopt-by-key recovery for `sync push`
+ * create paths. When a CREATE hits a per-app unique-key constraint, the resource
+ * is already on the server but missing from local sync state: orphaned by a
+ * prior push that aborted before recording it, a mid-apply crash, or an
+ * out-of-band create with the same key. Rather than hard-fail forever, this
+ * helper looks the resource up by its unique key and hands the matched item
+ * back so the caller can re-issue the create as an UPDATE and converge.
+ *
+ * The conflict surfaces inconsistently across create routes, so detection is
+ * deliberately broad (see `isConflict` below):
+ *   - a 409 status (webhooks, cron triggers, the standard case);
+ *   - an "already exists" message — some routes surface the 409 as HTTP 400,
+ *     e.g. workflows;
+ *   - a "must be unique" message — routes with no explicit conflict catch let
+ *     dynamo-bao's per-app unique-constraint error propagate verbatim (e.g. rule
+ *     sets, whose create route has no 409 translation). This matches the
+ *     server's own admin-api convention (`src/admin-api.ts`), which treats
+ *     "must be unique" as a duplicate-key conflict.
+ * Any other error is NOT a conflict and re-throws unchanged (see below).
+ *
+ * Safety (load-bearing): exact-key match only. The `lookup` is app-scoped, so a
+ * key match is also an ownership match — an unrelated resource is never
+ * overwritten. The three non-adopt outcomes each surface a clear error and do
+ * NOT touch the server:
+ *   - a non-409 create error is re-wrapped via `wrapEntityError` and re-thrown
+ *     (no lookup is attempted);
+ *   - a lookup failure throws a clear "already exists but could not be adopted
+ *     (lookup failed: …)";
+ *   - a 409 with no matching key re-throws the ORIGINAL create error rather
+ *     than silently proceeding.
+ *
+ * Pagination is the caller's concern: `lookup` must return the COMPLETE
+ * candidate set. For cursor-based lists (webhooks, integrations, prompts,
+ * workflows) wrap the list call in `fetchAll`; the cron-triggers route already
+ * drains every page server-side (#1668) so its flat `{ items }` is complete.
+ * The UPDATE re-issue and sync-state stamping stay with the caller because they
+ * differ per entity.
+ *
+ * @returns the matched existing item (guaranteed non-null on return).
+ */
+export async function adoptByKeyOnCreate409(opts) {
+    const { err, kind, key, lookup, matchKey } = opts;
+    const msg = String(err?.message ?? err);
+    // A per-app unique-key conflict, surfaced any of the ways create routes report
+    // it (409 status / "already exists" / dynamo-bao's "must be unique"). Anything
+    // else is a genuine create failure and must not trigger an adopt.
+    const isConflict = err?.statusCode === 409 ||
+        msg.includes("already exists") ||
+        msg.includes("must be unique");
+    if (!isConflict) {
+        // Not an adoptable conflict — surface the original create failure.
+        throw wrapEntityError(err, "create", kind, key);
+    }
+    const label = kind.charAt(0).toUpperCase() + kind.slice(1);
+    info(`  ${label} already exists on server, adopting by key: ${key}`);
+    let items;
+    try {
+        items = await lookup();
+    }
+    catch (lookupErr) {
+        // A lookup failure after a 409 means we cannot adopt — surface it clearly
+        // rather than swallowing it (a bare throw or silent catch loops
+        // create→409 on every subsequent push).
+        throw wrapEntityError(new Error(`${kind} "${key}" already exists but could not be adopted (lookup failed: ${String(lookupErr?.message || lookupErr)})`), "create", kind, key);
+    }
+    // Exact-key match only. The list endpoint is app-scoped, so a key match is
+    // also an ownership match — require exact equality and never overwrite an
+    // unrelated resource.
+    const existing = (items || []).find((item) => matchKey(item));
+    if (!existing) {
+        // 409 but no matching key found on the server — surface the original
+        // create error rather than silently overwriting an unrelated resource.
+        throw wrapEntityError(err, "create", kind, key);
+    }
+    return existing;
+}
 /**
  * Resolve a key-based rule set name reference to an ID.
  * Throws if the name cannot be resolved and throwOnMissing is true.
@@ -1799,10 +2072,19 @@ Directory Structure:
             const emailTemplatesResult = emailTemplatesOutcome.ok
                 ? emailTemplatesOutcome.value
                 : { templates: [] };
+            // #1660 — drop platform-owned workflows (the reserved `__internal.*`
+            // namespace) BEFORE the per-item detail fetch below. They are not app
+            // config: the platform creates and owns them, their exported TOML is
+            // hollow and doesn't round-trip, and `sync push` would abort trying to
+            // activate a configuration-less workflow. Filtering here means pull
+            // writes no file for them and wastes no `getWorkflow`/`getWorkflowConfig`
+            // call. Prefers the server's `platformOwned` flag, falls back to the key
+            // prefix for older servers (edge case 1).
+            const appWorkflowItems = workflowItems.filter((w) => !isPlatformOwnedWorkflow(w));
             // Fetch details for each entity
             const integrations = await Promise.all(integrationItems.map((i) => client.getIntegration(resolvedAppId, i.integrationId)));
             const prompts = await Promise.all(promptItems.map((p) => client.getPrompt(resolvedAppId, p.promptId)));
-            const workflows = await Promise.all(workflowItems.map(async (w) => {
+            const workflows = await Promise.all(appWorkflowItems.map(async (w) => {
                 const workflowData = await client.getWorkflow(resolvedAppId, w.workflowId);
                 // Fetch active config with steps if available
                 const activeConfigId = workflowData.workflow?.activeConfigId;
@@ -2084,6 +2366,33 @@ Directory Structure:
                 };
                 info(`  Wrote workflows/${filename}`);
             }
+            // #1660 — remove any pre-fix stray `workflows/__internal.*.toml` a prior
+            // (buggy) pull exported. Match on the RESOLVED `[workflow].key`, never on
+            // filename alone, so an app-authored file is never touched even if it is
+            // coincidentally named oddly (edge case 4). We don't write these files
+            // anymore, so a leftover would otherwise show as permanent "Remote only"
+            // diff noise (#1659) and re-abort `sync push`.
+            const workflowsPullDir = join(configDir, "workflows");
+            if (existsSync(workflowsPullDir)) {
+                for (const file of readdirSync(workflowsPullDir).filter((f) => f.endsWith(".toml"))) {
+                    const strayPath = join(workflowsPullDir, file);
+                    let resolvedKey;
+                    try {
+                        const parsed = parseTomlFile(strayPath);
+                        resolvedKey = parsed.workflow?.key || basename(file, ".toml");
+                    }
+                    catch {
+                        // Unparseable file — fall back to the filename stem so a hollow
+                        // `__internal.*.toml` is still recognized and cleaned up.
+                        resolvedKey = basename(file, ".toml");
+                    }
+                    if (isPlatformOwnedWorkflowKey(resolvedKey)) {
+                        unlinkSync(strayPath);
+                        delete workflowEntities[resolvedKey];
+                        info(`  Removed workflows/${file} — platform-owned workflow "${resolvedKey}" (managed by the platform)`);
+                    }
+                }
+            }
             // Pull transforms (Rhai scripts) — issue #892, slice 7 + codex
             // follow-up on PR #893. Mirrors the prompts pull pattern: list
             // server-side `Script` rows, write each body to
@@ -2305,7 +2614,10 @@ Directory Structure:
                 integrations: { ok: true, serverKeys: integrationItems.map((i) => i.integrationKey) },
                 webhooks: { ok: true, serverKeys: webhookItems.map((w) => w.webhookKey) },
                 prompts: { ok: true, serverKeys: promptItems.map((p) => p.promptKey) },
-                workflows: { ok: true, serverKeys: workflowItems.map((w) => w.workflowKey) },
+                // #1660 — use the platform-owned-filtered set so prune reconciliation
+                // never treats a platform-owned workflow as a server key that a local
+                // file should exist for (we intentionally write none).
+                workflows: { ok: true, serverKeys: appWorkflowItems.map((w) => w.workflowKey) },
                 cronTriggers: cronTriggersOutcome.ok
                     ? { ok: true, serverKeys: cronTriggerItems.map((t) => t.triggerKey) }
                     : { ok: false },
@@ -2522,6 +2834,8 @@ Directory Structure:
         .option("--dir <path>", "Config directory (overrides the auto-resolved per-env path)")
         .option("--dry-run", "Show what would be changed without applying")
         .option("--force", "Overwrite remote even if modified since last pull")
+        .option("--prune", "Delete remote entities whose local TOML was removed since the last sync (issue #1655)")
+        .option("-y, --yes", "Skip the interactive confirmation before pruning (for CI / automation)")
         .option("--accept-warnings", "Commit schema diffs that have operations with dynamic refs (issue #666 SCHEMA_HAS_UNCHECKABLE_OPS escape hatch)")
         .action(async (appId, options) => {
         const resolvedAppId = resolveAppId(appId, options);
@@ -2628,6 +2942,13 @@ Directory Structure:
                             }
                         }
                     }
+                    // #1767: the "convergence trap" — this gate checks the operations
+                    // as currently registered, and a push that changes an operation and
+                    // its schema together skips both, so fixing the operation locally
+                    // isn't enough. Spell out the two-step recovery.
+                    info(`If you also changed these operations in this push, their updates were skipped along with the schema. ` +
+                        `Push the operation fix first: temporarily remove the ${chalk.cyan("[models.*]")} block for this type, ` +
+                        `run ${chalk.cyan("sync")} (the operation updates apply), then restore the schema block and sync again.`);
                     console.log();
                 }
                 if (schemaErrors.uncheckableOps.length > 0) {
@@ -2710,6 +3031,19 @@ Directory Structure:
                     const filePath = join(preflightWorkflowsDir, file);
                     try {
                         const tomlData = parseTomlFile(filePath);
+                        // #1660 — skip platform-owned workflows (the reserved
+                        // `__internal.*` namespace) BEFORE validating, mirroring the
+                        // apply loop below. `sync push` validates every workflow TOML
+                        // here, up-front, before reaching that skip — so without this
+                        // second skip a stale/hollow `__internal.*.toml` with an invalid
+                        // `steps` shape would abort the whole push in preflight. Resolve
+                        // the key the same way the apply loop does (`[workflow].key`,
+                        // falling back to the filename) and match on the resolved key,
+                        // never the filename alone, so a renamed file is still caught.
+                        const platformOwnedKey = tomlData.workflow?.key || basename(file, ".toml");
+                        if (isPlatformOwnedWorkflowKey(platformOwnedKey)) {
+                            continue;
+                        }
                         const tomlErrors = validateWorkflowToml(tomlData);
                         if (tomlErrors.length > 0) {
                             preflightValidationErrors.push(formatWorkflowTomlErrors(filePath, tomlErrors));
@@ -2756,6 +3090,21 @@ Directory Structure:
                     for (const e of validation.errors) {
                         preflightValidationErrors.push(`  ${formatIssue(e)}`);
                     }
+                    // Issue #1422: non-fatal deprecation notice. A `celContextAccess`
+                    // / `metadataAccess` gate on a database type config is a single CEL
+                    // expression that gates BOTH read and update of the database CEL
+                    // context — granting read implicitly grants update. Steer operators
+                    // to resource metadata categories (separate readRule/writeRule).
+                    // This is advisory only: the push continues and the runtime gate is
+                    // unchanged. It fires only when the deprecated key is actually
+                    // present, so metadata-category-only configs never trip it.
+                    const typeSection = tomlData.type || {};
+                    if (typeSection.celContextAccess || typeSection.metadataAccess) {
+                        const usedKey = typeSection.celContextAccess
+                            ? "celContextAccess"
+                            : "metadataAccess";
+                        warn(`  ${file}: \`${usedKey}\` is deprecated — it gates database CEL context READ and WRITE with one expression (read implies update). Prefer a resource metadata category with separate readRule/writeRule (issue #1420). Sync will continue; the runtime gate is unchanged.`);
+                    }
                 }
             }
             // Validate app.toml settings up-front (issue #1033). A hand-added
@@ -3080,31 +3429,74 @@ Directory Structure:
                         // Create new rule set
                         changes.push({ type: "rule-set", action: "create", key: fileKey });
                         if (!options.dryRun) {
-                            let created;
+                            let ruleSetId;
+                            let ruleSetModifiedAt;
                             try {
-                                created = await client.createRuleSet(resolvedAppId, {
+                                const created = await client.createRuleSet(resolvedAppId, {
                                     name: ruleSetData.name,
                                     resourceType: ruleSetData.resourceType,
                                     rules: ruleSetData.rules,
                                     description: ruleSetData.description,
                                 });
+                                info(`  Created rule set: ${fileKey}`);
+                                ruleSetId = created.ruleSetId;
+                                ruleSetModifiedAt = created.modifiedAt || new Date().toISOString();
                             }
                             catch (err) {
-                                throw wrapEntityError(err, "create", "rule set", fileKey);
+                                // #1006: idempotent create — adopt-by-key on 409. A rule set
+                                // can be orphaned on the server (a prior push aborted before
+                                // recording it in sync state, or an out-of-band create). On
+                                // retry this CREATE hits the `ruleSetNamePerApp` unique
+                                // constraint, so adoption matches on the server key `name`
+                                // (NOT the sync-state fileKey). `listRuleSets` returns a raw
+                                // array on the app-scoped app-API route (no `{ items }`, no
+                                // cursor), so a name match is also an ownership match. Non-409
+                                // errors, lookup failures, and no-match 409s all throw (see
+                                // adoptByKeyOnCreate409). `key` stays `fileKey` so non-409
+                                // errors wrap identically to before; `matchKey` does the real
+                                // name match.
+                                const existing = await adoptByKeyOnCreate409({
+                                    err,
+                                    kind: "rule set",
+                                    key: fileKey,
+                                    lookup: async () => await client.listRuleSets(resolvedAppId),
+                                    matchKey: (rs) => rs?.name === ruleSetData.name,
+                                });
+                                // resourceType is immutable and cannot be reconciled by an
+                                // UPDATE (updateRuleSet's payload has no resourceType field).
+                                // Adoption matches only on `name`, so a same-name rule set on
+                                // a different resource type would be silently stamped as
+                                // synced while the server stays on the old type. Fail loudly
+                                // instead — mirrors the blob-bucket ttlTier-immutability guard.
+                                if (ruleSetData.resourceType &&
+                                    existing.resourceType &&
+                                    ruleSetData.resourceType !== existing.resourceType) {
+                                    throw wrapEntityError(new Error(`rule set "${fileKey}" resourceType mismatch: local TOML has "${ruleSetData.resourceType}" but the server rule set "${ruleSetData.name}" has "${existing.resourceType}". resourceType is immutable; align the TOML with the server (or rename/recreate the rule set) before pushing.`), "update", "rule set", fileKey);
+                                }
+                                const updated = await client.updateRuleSet(resolvedAppId, existing.ruleSetId, {
+                                    name: ruleSetData.name,
+                                    description: ruleSetData.description,
+                                    rules: ruleSetData.rules,
+                                });
+                                info(`  Adopted + updated rule set: ${fileKey}`);
+                                ruleSetId = existing.ruleSetId;
+                                ruleSetModifiedAt =
+                                    updated?.modifiedAt ||
+                                        existing.modifiedAt ||
+                                        new Date().toISOString();
                             }
-                            info(`  Created rule set: ${fileKey}`);
-                            if (syncState && created?.ruleSetId) {
+                            if (syncState && ruleSetId) {
                                 if (!syncState.entities.ruleSets) {
                                     syncState.entities.ruleSets = {};
                                 }
                                 syncState.entities.ruleSets[fileKey] = {
-                                    id: created.ruleSetId,
-                                    modifiedAt: created.modifiedAt || new Date().toISOString(),
+                                    id: ruleSetId,
+                                    modifiedAt: ruleSetModifiedAt,
                                     contentHash: computeFileHash(filePath),
                                 };
                             }
                             // Track name→ID for cross-reference resolution
-                            ruleSetNameToId.set(ruleSetData.name, created.ruleSetId);
+                            ruleSetNameToId.set(ruleSetData.name, ruleSetId);
                         }
                         else {
                             // In dry-run mode, use a placeholder so dependent entities can resolve
@@ -3131,7 +3523,14 @@ Directory Structure:
                     const payload = {
                         integrationKey: key,
                         displayName: integration.displayName || key,
-                        description: integration.description,
+                        // Issue #1567: `description` is TOML-owned — send `?? null` so
+                        // removing it from the TOML clears it server-side (the server
+                        // nulls `description` on an explicit `null`). A bare
+                        // `integration.description` is `undefined` on absence and dropped
+                        // by `JSON.stringify`, so the server kept the stale value.
+                        // (`timeoutMs`/`status` are defaulted/enum server-side — `null` is
+                        // not a valid clear for them, so they stay as-is.)
+                        description: integration.description ?? null,
                         requestConfig: tomlData.requestConfig || {},
                         timeoutMs: integration.timeoutMs,
                         status: integration.status,
@@ -3185,7 +3584,35 @@ Directory Structure:
                                 }
                             }
                             catch (err) {
-                                throw wrapEntityError(err, "create", "integration", key);
+                                // #1006: idempotent create — adopt-by-key on 409. An
+                                // integration orphaned on the server (a prior push aborted
+                                // before recording it, or an out-of-band create) hits the
+                                // `integrationKeyPerApp` unique constraint on retry. Adopt by
+                                // `integrationKey` and re-issue as an UPDATE so the push
+                                // converges. `listIntegrations` is cursor-paginated → drain
+                                // fully with fetchAll. Non-409 errors, lookup failures, and
+                                // no-match 409s all throw (see adoptByKeyOnCreate409).
+                                const existing = await adoptByKeyOnCreate409({
+                                    err,
+                                    kind: "integration",
+                                    key,
+                                    lookup: () => fetchAll((p) => client.listIntegrations(resolvedAppId, p)),
+                                    matchKey: (i) => i?.integrationKey === key,
+                                });
+                                const updated = await client.updateIntegration(resolvedAppId, existing.integrationId, payload);
+                                info(`  Adopted + updated integration: ${key}`);
+                                if (syncState) {
+                                    if (!syncState.entities.integrations) {
+                                        syncState.entities.integrations = {};
+                                    }
+                                    syncState.entities.integrations[key] = {
+                                        id: existing.integrationId,
+                                        modifiedAt: updated?.modifiedAt ||
+                                            existing.modifiedAt ||
+                                            new Date().toISOString(),
+                                        contentHash: computeFileHash(filePath),
+                                    };
+                                }
                             }
                         }
                     }
@@ -3209,7 +3636,12 @@ Directory Structure:
                     const payload = {
                         webhookKey: key,
                         displayName: webhook.displayName || key,
-                        description: webhook.description,
+                        // Issue #1567: `description` is TOML-owned — send `?? null` so
+                        // removing it from the TOML clears it on the server (the PATCH
+                        // nulls `description` on an explicit `null`). A bare
+                        // `webhook.description` is `undefined` on absence and dropped by
+                        // JSON.stringify, so the stale value would otherwise persist.
+                        description: webhook.description ?? null,
                         workflowKey: webhook.workflowKey,
                         verificationScheme: webhook.verificationScheme,
                         status: webhook.status,
@@ -3283,7 +3715,35 @@ Directory Structure:
                                 }
                             }
                             catch (err) {
-                                throw wrapEntityError(err, "create", "webhook", key);
+                                // #1006: idempotent create — adopt-by-key on 409. A webhook
+                                // orphaned on the server (a prior push aborted before
+                                // recording it, or an out-of-band create) hits the
+                                // `webhookKeyPerApp` unique constraint on retry. Adopt by
+                                // `webhookKey` and re-issue as an UPDATE so the push
+                                // converges. `listWebhooks` is cursor-paginated → drain fully
+                                // with fetchAll. Non-409 errors, lookup failures, and no-match
+                                // 409s all throw (see adoptByKeyOnCreate409).
+                                const existing = await adoptByKeyOnCreate409({
+                                    err,
+                                    kind: "webhook",
+                                    key,
+                                    lookup: () => fetchAll((p) => client.listWebhooks(resolvedAppId, p)),
+                                    matchKey: (w) => w?.webhookKey === key,
+                                });
+                                const updated = await client.updateWebhook(resolvedAppId, existing.webhookId, payload);
+                                info(`  Adopted + updated webhook: ${key}`);
+                                if (syncState) {
+                                    if (!syncState.entities.webhooks) {
+                                        syncState.entities.webhooks = {};
+                                    }
+                                    syncState.entities.webhooks[key] = {
+                                        id: existing.webhookId,
+                                        modifiedAt: updated?.modifiedAt ||
+                                            existing.modifiedAt ||
+                                            new Date().toISOString(),
+                                        contentHash: computeFileHash(filePath),
+                                    };
+                                }
                             }
                         }
                     }
@@ -3307,7 +3767,14 @@ Directory Structure:
                     const payload = {
                         triggerKey: key,
                         displayName: cronTrigger.displayName || key,
-                        description: cronTrigger.description,
+                        // Issue #1567: `description` is TOML-owned — send `?? null` so
+                        // removing it from the TOML clears it server-side (the server
+                        // nulls `description` on an explicit `null`). A bare
+                        // `cronTrigger.description` is `undefined` on absence and dropped
+                        // by `JSON.stringify`, so the server kept the stale value.
+                        // (`timezone`/`overlapPolicy`/`state` are defaulted/enum
+                        // server-side — `null` is not a valid clear for them.)
+                        description: cronTrigger.description ?? null,
                         cron: cronTrigger.cron,
                         timezone: cronTrigger.timezone,
                         workflowKey: cronTrigger.workflowKey,
@@ -3355,57 +3822,38 @@ Directory Structure:
                                 }
                             }
                             catch (err) {
-                                // Issue #976 (fix B): idempotent create — adopt-by-key on 409.
-                                // A cron trigger can be orphaned on the server (created by a
-                                // prior push that aborted before recording it in sync state,
-                                // a mid-apply crash, or an out-of-band create with the same
-                                // key). On retry this CREATE path then hits the
-                                // `triggerKeyPerApp` unique constraint and the server returns
-                                // 409 "A cron trigger with this key already exists". Rather
-                                // than hard-fail forever, look up the existing trigger by key
-                                // (the list endpoint is app-scoped, so every item is owned by
-                                // this app), verify the SAME triggerKey, adopt its id into
-                                // sync state, and re-issue as an UPDATE so the push converges.
-                                const msg = String(err?.message || err);
-                                const is409 = err?.statusCode === 409 || msg.includes("already exists");
-                                if (is409) {
-                                    info(`  Cron trigger already exists on server, adopting by key: ${key}`);
-                                    let adoptedId;
-                                    try {
-                                        const { items } = await client.listCronTriggers(resolvedAppId);
-                                        // Verify same key + app ownership: the list endpoint only
-                                        // returns triggers for `resolvedAppId`, so a triggerKey
-                                        // match is also an ownership match. Never overwrite an
-                                        // unrelated resource — require an exact key equality.
-                                        const existing = (items || []).find((t) => t?.triggerKey === key);
-                                        if (existing?.triggerId) {
-                                            adoptedId = existing.triggerId;
-                                        }
-                                    }
-                                    catch (lookupErr) {
-                                        throw wrapEntityError(new Error(`cron trigger "${key}" already exists but could not be adopted (lookup failed: ${String(lookupErr?.message || lookupErr)})`), "create", "cron trigger", key);
-                                    }
-                                    if (!adoptedId) {
-                                        // 409 but no matching key found on the server — surface
-                                        // the original error rather than silently overwriting.
-                                        throw wrapEntityError(err, "create", "cron trigger", key);
-                                    }
-                                    // Switch to UPDATE on the adopted trigger.
-                                    const updated = await client.updateCronTrigger(resolvedAppId, adoptedId, payload);
-                                    info(`  Adopted + updated cron trigger: ${key}`);
-                                    if (syncState) {
-                                        if (!syncState.entities.cronTriggers) {
-                                            syncState.entities.cronTriggers = {};
-                                        }
-                                        syncState.entities.cronTriggers[key] = {
-                                            id: adoptedId,
-                                            modifiedAt: updated?.modifiedAt || new Date().toISOString(),
-                                            contentHash: computeFileHash(filePath),
-                                        };
+                                // Issue #976 (fix B) / #1006: idempotent create — adopt-by-key
+                                // on 409. A cron trigger can be orphaned on the server (a prior
+                                // push that aborted before recording it in sync state, a
+                                // mid-apply crash, or an out-of-band create with the same key).
+                                // On retry this CREATE hits the `triggerKeyPerApp` unique
+                                // constraint and the server returns 409 "already exists". The
+                                // shared helper looks the trigger up by key, verifies exact-key
+                                // (== owned, since the list is app-scoped) ownership, and hands
+                                // it back; we then re-issue as an UPDATE so the push converges.
+                                // Non-409 errors, lookup failures, and no-match 409s all throw
+                                // (see adoptByKeyOnCreate409). listCronTriggers drains every
+                                // page server-side (#1668), so its flat items list is complete.
+                                const existing = await adoptByKeyOnCreate409({
+                                    err,
+                                    kind: "cron trigger",
+                                    key,
+                                    lookup: async () => (await client.listCronTriggers(resolvedAppId)).items || [],
+                                    matchKey: (t) => t?.triggerKey === key,
+                                });
+                                const adoptedId = existing.triggerId;
+                                // Switch to UPDATE on the adopted trigger.
+                                const updated = await client.updateCronTrigger(resolvedAppId, adoptedId, payload);
+                                info(`  Adopted + updated cron trigger: ${key}`);
+                                if (syncState) {
+                                    if (!syncState.entities.cronTriggers) {
+                                        syncState.entities.cronTriggers = {};
                                     }
-                                }
-                                else {
-                                    throw wrapEntityError(err, "create", "cron trigger", key);
+                                    syncState.entities.cronTriggers[key] = {
+                                        id: adoptedId,
+                                        modifiedAt: updated?.modifiedAt || new Date().toISOString(),
+                                        contentHash: computeFileHash(filePath),
+                                    };
                                 }
                             }
                         }
@@ -3483,92 +3931,73 @@ Directory Structure:
                                 }
                             }
                             catch (err) {
-                                const msg = String(err?.message || err);
-                                if (msg.includes("already exists") || err.statusCode === 409) {
-                                    // #1459: adopt-by-key on 409. A blob bucket can already
-                                    // exist on the server (an out-of-band create, or a prior
-                                    // push that aborted before recording it in sync state). The
-                                    // old handler stamped the LOCAL file's contentHash WITHOUT
-                                    // applying the local config, so a divergent bucket was
-                                    // silently marked in-sync and never reconciled. Mirror the
-                                    // cron/workflow adopt paths: look up the bucket by key,
-                                    // re-issue the local payload as an UPDATE, and stamp the
-                                    // hash ONLY after the update succeeds.
-                                    info(`  Blob bucket already exists on server, adopting by key: ${key}`);
-                                    let existing;
+                                // #1006: adopt-by-key on 409 via the shared
+                                // `adoptByKeyOnCreate409` helper (Phase 3 — blob buckets onto
+                                // the shared core). A blob bucket can already exist on the
+                                // server (an out-of-band create, or a prior push that aborted
+                                // before recording it in sync state). The helper detects the
+                                // conflict (409 or an "already exists" message), lists the
+                                // app's buckets, and returns the one whose `bucketKey` matches
+                                // exactly — so an unrelated bucket is never adopted. Its three
+                                // non-adopt outcomes each surface a clear error and never
+                                // touch the server: a non-409 create error re-wraps via
+                                // `wrapEntityError` (no lookup); a lookup failure throws
+                                // "already exists but could not be adopted (lookup failed: …)"
+                                // (no longer swallowed as the pre-#1459 code did); a 409 with
+                                // no matching key re-throws the ORIGINAL create error.
+                                //
+                                // Matching by `bucketKey` through `listBlobBuckets` (not
+                                // `getBlobBucket`, which resolves the identifier by `bucketId`
+                                // BEFORE `bucketKey`) also removes the id-collision hazard the
+                                // old inline handler had to guard against: a ULID-shaped local
+                                // key can no longer resolve to an unrelated bucket's id,
+                                // because adoption only ever matches on `bucketKey`.
+                                const existing = await adoptByKeyOnCreate409({
+                                    err,
+                                    kind: "blob bucket",
+                                    key,
+                                    lookup: async () => (await client.listBlobBuckets(resolvedAppId)).items || [],
+                                    matchKey: (b) => b?.bucketKey === key,
+                                });
+                                // ttlTier is immutable and cannot be reconciled by an UPDATE.
+                                // A local TOML whose retention tier diverges from the server
+                                // must fail loudly (sponsor decision) rather than be silently
+                                // blessed while the cosmetic fields converge.
+                                if (bucket.ttlTier &&
+                                    existing.ttlTier &&
+                                    bucket.ttlTier !== existing.ttlTier) {
+                                    throw wrapEntityError(new Error(`blob bucket "${key}" ttlTier mismatch: local TOML has "${bucket.ttlTier}" but the server bucket has "${existing.ttlTier}". ttlTier is immutable; align the TOML with the server (or recreate the bucket) before pushing.`), "update", "blob bucket", key);
+                                }
+                                const updatePayload = buildBlobBucketUpdatePayload(bucket);
+                                let updated;
+                                if (Object.keys(updatePayload).length > 0) {
+                                    // Surface an update failure via wrapEntityError (no stamp) —
+                                    // matches the cron/workflow adopt paths.
                                     try {
-                                        existing = await client.getBlobBucket(resolvedAppId, key);
-                                    }
-                                    catch (lookupErr) {
-                                        // A lookup failure after a 409 means we cannot adopt —
-                                        // surface it instead of swallowing it (the old silent
-                                        // `catch {}` left no sync-state entry, looping
-                                        // create→409 on every push).
-                                        throw wrapEntityError(new Error(`blob bucket "${key}" already exists but could not be adopted (lookup failed: ${String(lookupErr?.message || lookupErr)})`), "create", "blob bucket", key);
-                                    }
-                                    if (!existing?.bucketId) {
-                                        // 409 but no matching bucket found — surface the original
-                                        // create error rather than silently proceeding.
-                                        throw wrapEntityError(err, "create", "blob bucket", key);
-                                    }
-                                    // Verify the resolved bucket is actually the one we asked
-                                    // for. `getBlobBucket` resolves the identifier by primary id
-                                    // (appId, bucketId) BEFORE bucketKey, and a bucketKey may be
-                                    // a ULID-shaped string (the key regex permits it). If the
-                                    // local key collides with an unrelated bucket's bucketId,
-                                    // the lookup returns that unrelated bucket — patching and
-                                    // stamping it would overwrite the wrong resource. Require an
-                                    // exact key match, matching the cron/workflow adopt paths'
-                                    // exact-key equality (they list + filter by key for the same
-                                    // reason). Surface the mismatch via wrapEntityError; do NOT
-                                    // patch or stamp.
-                                    if (existing.bucketKey !== key) {
-                                        throw wrapEntityError(new Error(`blob bucket "${key}" already exists, but the server resolved a different bucket (bucketKey "${existing.bucketKey}", bucketId "${existing.bucketId}"); refusing to adopt. This happens when the local key collides with an unrelated bucket's id — rename the local bucket key so it does not match an existing bucket id.`), "create", "blob bucket", key);
+                                        updated = await client.updateBlobBucket(resolvedAppId, existing.bucketId, updatePayload);
                                     }
-                                    // ttlTier is immutable and cannot be reconciled by an
-                                    // UPDATE. A local TOML whose retention tier diverges from
-                                    // the server must fail loudly (sponsor decision) rather
-                                    // than be silently blessed while the cosmetic fields
-                                    // converge.
-                                    if (bucket.ttlTier &&
-                                        existing.ttlTier &&
-                                        bucket.ttlTier !== existing.ttlTier) {
-                                        throw wrapEntityError(new Error(`blob bucket "${key}" ttlTier mismatch: local TOML has "${bucket.ttlTier}" but the server bucket has "${existing.ttlTier}". ttlTier is immutable; align the TOML with the server (or recreate the bucket) before pushing.`), "update", "blob bucket", key);
-                                    }
-                                    const updatePayload = buildBlobBucketUpdatePayload(bucket);
-                                    let updated;
-                                    if (Object.keys(updatePayload).length > 0) {
-                                        // Surface an update failure via wrapEntityError (no
-                                        // stamp) — matches the cron adopt path.
-                                        try {
-                                            updated = await client.updateBlobBucket(resolvedAppId, existing.bucketId, updatePayload);
-                                        }
-                                        catch (updateErr) {
-                                            throw wrapEntityError(updateErr, "update", "blob bucket", key);
-                                        }
-                                        info(`  Adopted + updated blob bucket: ${key}`);
-                                    }
-                                    else {
-                                        // No mutable fields in the local TOML — the server
-                                        // rejects an empty update (400). Adopt the existing
-                                        // bucket without a PATCH.
-                                        info(`  Adopted blob bucket (no updatable fields): ${key}`);
-                                    }
-                                    if (syncState) {
-                                        if (!syncState.entities.blobBuckets) {
-                                            syncState.entities.blobBuckets = {};
-                                        }
-                                        syncState.entities.blobBuckets[key] = {
-                                            id: existing.bucketId,
-                                            modifiedAt: updated?.modifiedAt ||
-                                                existing.modifiedAt ||
-                                                new Date().toISOString(),
-                                            contentHash: computeFileHash(filePath),
-                                        };
+                                    catch (updateErr) {
+                                        throw wrapEntityError(updateErr, "update", "blob bucket", key);
                                     }
+                                    info(`  Adopted + updated blob bucket: ${key}`);
                                 }
                                 else {
-                                    throw wrapEntityError(err, "create", "blob bucket", key);
+                                    // No mutable fields in the local TOML — the server rejects
+                                    // an empty update (400). Adopt the existing bucket without a
+                                    // PATCH.
+                                    info(`  Adopted blob bucket (no updatable fields): ${key}`);
+                                }
+                                if (syncState) {
+                                    if (!syncState.entities.blobBuckets) {
+                                        syncState.entities.blobBuckets = {};
+                                    }
+                                    syncState.entities.blobBuckets[key] = {
+                                        id: existing.bucketId,
+                                        modifiedAt: updated?.modifiedAt ||
+                                            existing.modifiedAt ||
+                                            new Date().toISOString(),
+                                        contentHash: computeFileHash(filePath),
+                                    };
                                 }
                             }
                         }
@@ -3602,6 +4031,88 @@ Directory Structure:
                         }
                         continue;
                     }
+                    // Shared update body for both the in-manifest update branch and the
+                    // adopt-by-key recovery branch (#1006). Re-issues the prompt as an
+                    // UPDATE and syncs its configs (update existing by name, create
+                    // missing) so the post-create prompt-config creation still runs
+                    // after adoption. Both call sites MUST run it identically, so it
+                    // lives here as a single closure rather than being duplicated
+                    // (mirrors `applyWorkflowUpdate`). The adopt branch seeds the
+                    // sync-state entity record before calling this so the stamp lands.
+                    const applyPromptUpdate = async (promptId, expectedModifiedAt) => {
+                        const updated = await client.updatePrompt(resolvedAppId, promptId, {
+                            displayName: prompt.displayName,
+                            // Issue #1567: `description` and `inputSchema` are TOML-owned
+                            // — send `?? null` so removing either from the TOML clears it
+                            // server-side (the server nulls both on an explicit `null`).
+                            // Bare values are `undefined` on absence and dropped by
+                            // `JSON.stringify`, so the server kept the stale values.
+                            // (`status` is a defaulted enum — not clearable via `null`.)
+                            description: prompt.description ?? null,
+                            inputSchema: prompt.inputSchema ?? null,
+                            status: prompt.status,
+                        }, expectedModifiedAt);
+                        info(`  Updated prompt: ${key}`);
+                        // Update sync state with new modifiedAt
+                        if (syncState?.entities?.prompts?.[key] && updated?.modifiedAt) {
+                            syncState.entities.prompts[key].modifiedAt = updated.modifiedAt;
+                            syncState.entities.prompts[key].contentHash = computeFileHash(filePath);
+                        }
+                        // Fetch full prompt to get config name→ID mappings
+                        // (updatePrompt response doesn't include configs)
+                        const fullPrompt = await client.getPrompt(resolvedAppId, promptId);
+                        if (fullPrompt?.configs) {
+                            for (const config of fullPrompt.configs) {
+                                promptConfigNameToId.set(`${key}#${config.configName}`, config.configId);
+                            }
+                        }
+                        // Update existing prompt configs with TOML values
+                        if (fullPrompt?.configs && configs.length > 0) {
+                            for (const tomlConfig of configs) {
+                                const configName = tomlConfig.name;
+                                if (!configName)
+                                    continue;
+                                const serverConfig = fullPrompt.configs.find((c) => c.configName === configName);
+                                if (serverConfig) {
+                                    // Update existing config
+                                    await client.updatePromptConfig(resolvedAppId, promptId, serverConfig.configId, {
+                                        // Issue #1567: `description` is TOML-owned — send
+                                        // `?? null` so removing it from a `[[config]]` block
+                                        // clears it on the server (the PATCH nulls `description`
+                                        // on an explicit `null`, preserves on omit). A bare
+                                        // `tomlConfig.description` is `undefined` on absence and
+                                        // dropped by JSON.stringify, so the stale value persists.
+                                        description: tomlConfig.description ?? null,
+                                        provider: tomlConfig.provider,
+                                        model: tomlConfig.model,
+                                        systemPrompt: tomlConfig.systemPrompt,
+                                        userPromptTemplate: tomlConfig.userPromptTemplate,
+                                        temperature: tomlConfig.temperature,
+                                        maxTokens: tomlConfig.maxTokens,
+                                        outputFormat: tomlConfig.outputFormat,
+                                    });
+                                }
+                                else {
+                                    // Create new config that doesn't exist on server yet
+                                    const newConfig = await client.createPromptConfig(resolvedAppId, promptId, {
+                                        configName,
+                                        description: tomlConfig.description,
+                                        provider: tomlConfig.provider || "openrouter",
+                                        model: tomlConfig.model || "google/gemini-2.0-flash-001",
+                                        systemPrompt: tomlConfig.systemPrompt,
+                                        userPromptTemplate: tomlConfig.userPromptTemplate,
+                                        temperature: tomlConfig.temperature,
+                                        maxTokens: tomlConfig.maxTokens,
+                                        outputFormat: tomlConfig.outputFormat,
+                                    });
+                                    if (newConfig?.configId) {
+                                        promptConfigNameToId.set(`${key}#${configName}`, newConfig.configId);
+                                    }
+                                }
+                            }
+                            info(`    Synced ${configs.length} config(s) for prompt: ${key}`);
+                        }
+                    };
                     if (existingId) {
                         // Update existing prompt
                         changes.push({ type: "prompt", action: "update", key });
@@ -3611,66 +4122,7 @@ Directory Structure:
                                 ? undefined
                                 : syncState?.entities?.prompts?.[key]?.modifiedAt;
                             try {
-                                const updated = await client.updatePrompt(resolvedAppId, existingId, {
-                                    displayName: prompt.displayName,
-                                    description: prompt.description,
-                                    inputSchema: prompt.inputSchema,
-                                    status: prompt.status,
-                                }, expectedModifiedAt);
-                                info(`  Updated prompt: ${key}`);
-                                // Update sync state with new modifiedAt
-                                if (syncState?.entities?.prompts?.[key] && updated?.modifiedAt) {
-                                    syncState.entities.prompts[key].modifiedAt = updated.modifiedAt;
-                                    syncState.entities.prompts[key].contentHash = computeFileHash(filePath);
-                                }
-                                // Fetch full prompt to get config name→ID mappings
-                                // (updatePrompt response doesn't include configs)
-                                const fullPrompt = await client.getPrompt(resolvedAppId, existingId);
-                                if (fullPrompt?.configs) {
-                                    for (const config of fullPrompt.configs) {
-                                        promptConfigNameToId.set(`${key}#${config.configName}`, config.configId);
-                                    }
-                                }
-                                // Update existing prompt configs with TOML values
-                                if (fullPrompt?.configs && configs.length > 0) {
-                                    for (const tomlConfig of configs) {
-                                        const configName = tomlConfig.name;
-                                        if (!configName)
-                                            continue;
-                                        const serverConfig = fullPrompt.configs.find((c) => c.configName === configName);
-                                        if (serverConfig) {
-                                            // Update existing config
-                                            await client.updatePromptConfig(resolvedAppId, existingId, serverConfig.configId, {
-                                                description: tomlConfig.description,
-                                                provider: tomlConfig.provider,
-                                                model: tomlConfig.model,
-                                                systemPrompt: tomlConfig.systemPrompt,
-                                                userPromptTemplate: tomlConfig.userPromptTemplate,
-                                                temperature: tomlConfig.temperature,
-                                                maxTokens: tomlConfig.maxTokens,
-                                                outputFormat: tomlConfig.outputFormat,
-                                            });
-                                        }
-                                        else {
-                                            // Create new config that doesn't exist on server yet
-                                            const newConfig = await client.createPromptConfig(resolvedAppId, existingId, {
-                                                configName,
-                                                description: tomlConfig.description,
-                                                provider: tomlConfig.provider || "openrouter",
-                                                model: tomlConfig.model || "google/gemini-2.0-flash-001",
-                                                systemPrompt: tomlConfig.systemPrompt,
-                                                userPromptTemplate: tomlConfig.userPromptTemplate,
-                                                temperature: tomlConfig.temperature,
-                                                maxTokens: tomlConfig.maxTokens,
-                                                outputFormat: tomlConfig.outputFormat,
-                                            });
-                                            if (newConfig?.configId) {
-                                                promptConfigNameToId.set(`${key}#${configName}`, newConfig.configId);
-                                            }
-                                        }
-                                    }
-                                    info(`    Synced ${configs.length} config(s) for prompt: ${key}`);
-                                }
+                                await applyPromptUpdate(existingId, expectedModifiedAt);
                             }
                             catch (err) {
                                 if (err instanceof ConflictError) {
@@ -3692,8 +4144,19 @@ Directory Structure:
                         const firstConfig = configs[0] || {};
                         changes.push({ type: "prompt", action: "create", key });
                         if (!options.dryRun) {
+                            // The adopt-by-key recovery must cover ONLY the createPrompt
+                            // call. If createPrompt succeeds and a SUBSEQUENT step (an
+                            // extra prompt-config create, or an activation) returns a
+                            // 409/"must be unique" — e.g. duplicate `[[configs]]` names —
+                            // that is a genuine invalid-config error, NOT a prompt-create
+                            // conflict. Adopting on it would find the just-created prompt,
+                            // run the update path, and stamp the file hash, swallowing the
+                            // real error. So the post-create config work runs OUTSIDE the
+                            // catch and its errors surface unchanged.
+                            let created = null;
+                            let adopted = false;
                             try {
-                                const created = await client.createPrompt(resolvedAppId, {
+                                created = await client.createPrompt(resolvedAppId, {
                                     promptKey: key,
                                     displayName: prompt.displayName || key,
                                     description: prompt.description,
@@ -3707,17 +4170,73 @@ Directory Structure:
                                     inputSchema: prompt.inputSchema,
                                 });
                                 info(`  Created prompt: ${key}`);
-                                // Add new entity to sync state
-                                if (syncState && created?.promptId && created?.modifiedAt) {
+                            }
+                            catch (err) {
+                                // #1006: idempotent create — adopt-by-key on 409. A prompt
+                                // orphaned on the server (a prior push aborted before
+                                // recording it, or an out-of-band create) hits the
+                                // `promptKeyPerApp` unique constraint on retry. Adopt by
+                                // `promptKey` and re-issue as an UPDATE via the shared
+                                // `applyPromptUpdate` so the base fields AND the configs
+                                // (the post-create prompt-config creation) still land after
+                                // adoption. `listPrompts` is cursor-paginated → drain fully
+                                // with fetchAll. Non-409 errors, lookup failures, and no-match
+                                // 409s all throw (see adoptByKeyOnCreate409).
+                                const existing = await adoptByKeyOnCreate409({
+                                    err,
+                                    kind: "prompt",
+                                    key,
+                                    lookup: () => fetchAll((p) => client.listPrompts(resolvedAppId, p)),
+                                    matchKey: (p) => p?.promptKey === key,
+                                });
+                                adopted = true;
+                                const adoptedId = existing.promptId;
+                                // Seed the sync-state entity record so the shared update body
+                                // can stamp modifiedAt/contentHash into it (sync state has no
+                                // entry for an orphaned prompt), and track the key→ID map.
+                                if (syncState) {
                                     if (!syncState.entities.prompts) {
                                         syncState.entities.prompts = {};
                                     }
-                                    syncState.entities.prompts[key] = {
-                                        id: created.promptId,
-                                        modifiedAt: created.modifiedAt,
-                                        contentHash: computeFileHash(filePath),
-                                    };
+                                    if (!syncState.entities.prompts[key]) {
+                                        syncState.entities.prompts[key] = { id: adoptedId };
+                                    }
+                                    else {
+                                        syncState.entities.prompts[key].id = adoptedId;
+                                    }
                                 }
+                                promptKeyToId.set(key, adoptedId);
+                                // First adopt has no stored modifiedAt → omit
+                                // expectedModifiedAt to force the update (matches the cron +
+                                // workflow adopt paths). A ConflictError here is still
+                                // adoptable-resilience scope, so collect it; other errors
+                                // surface. `applyPromptUpdate` reconciles ALL configs on the
+                                // adopt path, so the create-path extra-config loop below is
+                                // intentionally skipped when `adopted`.
+                                try {
+                                    await applyPromptUpdate(adoptedId, undefined);
+                                    info(`  Adopted + updated prompt: ${key}`);
+                                }
+                                catch (updErr) {
+                                    if (updErr instanceof ConflictError) {
+                                        conflicts.push({
+                                            type: "prompt",
+                                            key,
+                                            serverModifiedAt: updErr.serverModifiedAt,
+                                            localModifiedAt: "unknown",
+                                        });
+                                    }
+                                    else {
+                                        throw wrapEntityError(updErr, "update", "prompt", key);
+                                    }
+                                }
+                            }
+                            // Post-create config work — runs ONLY for a real create, never
+                            // for an adopt. A 409/"must be unique" from an extra config
+                            // create or activation here is NOT wrapped by the adopt
+                            // recovery above, so a genuine invalid-config error surfaces
+                            // unchanged instead of being mis-treated as a prompt conflict.
+                            if (!adopted && created) {
                                 // Track prompt key→ID and config name→ID
                                 if (created?.promptId) {
                                     promptKeyToId.set(key, created.promptId);
@@ -3753,9 +4272,22 @@ Directory Structure:
                                     }
                                     info(`    Created ${configs.length - 1} additional config(s) for prompt: ${key}`);
                                 }
-                            }
-                            catch (err) {
-                                throw wrapEntityError(err, "create", "prompt", key);
+                                // Stamp sync state ONLY after all create work (base prompt +
+                                // every extra config) succeeded. If an extra-config create
+                                // above threw, we never reach here, so the file hash is not
+                                // recorded and the save-on-failure path leaves the entity
+                                // unstamped — a future push retries instead of skipping the
+                                // unresolved divergence.
+                                if (syncState && created?.promptId && created?.modifiedAt) {
+                                    if (!syncState.entities.prompts) {
+                                        syncState.entities.prompts = {};
+                                    }
+                                    syncState.entities.prompts[key] = {
+                                        id: created.promptId,
+                                        modifiedAt: created.modifiedAt,
+                                        contentHash: computeFileHash(filePath),
+                                    };
+                                }
                             }
                         }
                     }
@@ -3900,6 +4432,19 @@ Directory Structure:
                 for (const file of files) {
                     const filePath = join(workflowsDir, file);
                     const tomlData = parseTomlFile(filePath);
+                    // #1660 — skip platform-owned workflows (the reserved `__internal.*`
+                    // namespace). Resolve the key FIRST and skip BEFORE the workflow
+                    // TOML validation below, so a hollow exported `__internal.*.toml`
+                    // (steps = [], no active config) is skipped, not failed by
+                    // `validateWorkflowToml`, and does not abort the whole push trying
+                    // to activate a configuration-less workflow. Match on the resolved
+                    // `[workflow].key` (not filename) so a renamed file is still caught
+                    // (edge case 2).
+                    const platformOwnedKey = tomlData.workflow?.key || basename(file, ".toml");
+                    if (isPlatformOwnedWorkflowKey(platformOwnedKey)) {
+                        info(`  Skipped workflows/${file} — platform-owned workflow "${platformOwnedKey}" (managed by the platform)`);
+                        continue;
+                    }
                     // Issue #685: reject misnested headers (e.g.
                     // [steps.<id>.request]) before pushing. The runtime silently
                     // ignores fields outside the allowlist, so this is the only
@@ -3931,13 +4476,39 @@ Directory Structure:
                         throw new Error(`${filePath}: ${workflowManifestError}`);
                     }
                     workflow.metadataManifest = workflowManifest;
+                    // #1614 — parse the top-level `[expr.cel]` named-guard definitions
+                    // (structural, like steps/metadataManifest) and validate them
+                    // client-side (parse / undeclared / cycle) before pushing, so a bad
+                    // definition fails fast with the same diagnostics the server returns.
+                    const workflowExpressions = parseWorkflowExpressionsToml(tomlData);
+                    // #1614 — validate the RAW `[expr.cel]` table shape first, so a
+                    // non-string body (e.g. `ready = true`) fails fast instead of being
+                    // silently dropped by parseWorkflowExpressionsToml.
+                    const exprErrors = [
+                        ...validateWorkflowExpressionsRawToml(tomlData),
+                        ...validateWorkflowExpressionsToml(steps, workflowExpressions),
+                    ];
+                    if (exprErrors.length > 0) {
+                        throw new Error(`${filePath}: workflow expressions are invalid:\n  - ${exprErrors.join("\n  - ")}`);
+                    }
+                    workflow.expressions = workflowExpressions;
                     const existingId = syncState?.entities?.workflows?.[key]?.id;
                     const existingActiveConfigId = syncState?.entities?.workflows?.[key]?.activeConfigId;
                     // Skip if file hasn't changed since last sync. Use the expanded
                     // content hash (post fragment splice) so that edits to included
                     // `workflow-fragments/*.toml` files invalidate the push-skip cache
                     // for any workflow that references them. See `computeExpandedContentHash`.
-                    if (!options.force && existingId && !shouldPushExpandedFile(tomlData, syncState?.entities?.workflows?.[key]?.contentHash)) {
+                    //
+                    // #1684: hash a FRESH `parseTomlFile(filePath)` here, not the
+                    // in-scope `tomlData`. The `metadataManifest` injection above
+                    // (#1304) mutated `tomlData.workflow`, so hashing `tomlData` would
+                    // include the injected `metadataManifest` key and never match the
+                    // stored hash — the workflow would re-push on every `sync push`.
+                    // Pull stores the hash of the pristine parse
+                    // (`computeExpandedContentHash(parseTomlFile(filePath))`, see the
+                    // pull path), so re-parsing the same file keeps push symmetric with
+                    // pull and lets the content-hash round-trip.
+                    if (!options.force && existingId && !shouldPushExpandedFile(parseTomlFile(filePath), syncState?.entities?.workflows?.[key]?.contentHash)) {
                         skippedCount++;
                         // Only fetch config name→ID mappings if test cases exist for this workflow
                         const workflowTestsDir = getTestsDir(configDir, "workflow", key);
@@ -3980,7 +4551,15 @@ Directory Structure:
                         // the entry exists for both call sites.
                         if (syncState?.entities?.workflows?.[key] && latestModifiedAt) {
                             syncState.entities.workflows[key].modifiedAt = latestModifiedAt;
-                            syncState.entities.workflows[key].contentHash = computeExpandedContentHash(tomlData);
+                            // #1684: store the hash of the pristine `parseTomlFile(filePath)`,
+                            // not the in-scope `tomlData`. The `metadataManifest` injection
+                            // (#1304) mutated `tomlData.workflow`, so hashing `tomlData` here
+                            // would persist the mutated hash while the push-skip check (above)
+                            // and pull-store (:2502) both hash the pristine parse — the
+                            // workflow would then re-push on every subsequent `sync push`
+                            // until the next `sync pull`. Re-parsing keeps store symmetric
+                            // with skip and pull so the content-hash round-trips.
+                            syncState.entities.workflows[key].contentHash = computeExpandedContentHash(parseTomlFile(filePath));
                         }
                         // `applyWorkflowBody` already fetched the full workflow; reuse it
                         // for the config name→ID mappings (the PATCH response omits configs).
@@ -4039,6 +4618,8 @@ Directory Structure:
                                     // #1304 (P-C): declared-access manifest (absent → undefined,
                                     // server default null).
                                     metadataManifest: workflow.metadataManifest ?? undefined,
+                                    // #1614 — named `expr.*` definitions (absent → undefined).
+                                    expressions: workflow.expressions ?? undefined,
                                 });
                                 info(`  Created workflow: ${key}`);
                                 // Add new entity to sync state (including activeConfigId)
@@ -4050,7 +4631,11 @@ Directory Structure:
                                         id: created.workflow.workflowId,
                                         modifiedAt: created.workflow.modifiedAt,
                                         activeConfigId: created.workflow.activeConfigId,
-                                        contentHash: computeExpandedContentHash(tomlData),
+                                        // #1684: hash the pristine `parseTomlFile(filePath)`, not the
+                                        // `metadataManifest`-mutated `tomlData` (see the update-store
+                                        // note above), so a just-created workflow is skipped on the
+                                        // next `sync push` instead of re-pushing every time.
+                                        contentHash: computeExpandedContentHash(parseTomlFile(filePath)),
                                     };
                                 }
                                 // Track config name→ID mappings
@@ -4069,6 +4654,11 @@ Directory Structure:
                                             configName: extraConfig.name || `config-${i + 1}`,
                                             description: extraConfig.description,
                                             steps,
+                                            // #1614 — the extra configs reuse the same
+                                            // guard-referencing `steps`, so forward the workflow's
+                                            // named `expr.*` definitions too; otherwise the server
+                                            // 400s on the undeclared `expr.<name>` mid-push.
+                                            expressions: workflow.expressions ?? undefined,
                                         });
                                         if (extraCreated?.configId) {
                                             const configName = extraConfig.name || `config-${i + 1}`;
@@ -4087,49 +4677,31 @@ Directory Structure:
                                 }
                             }
                             catch (err) {
-                                // Issue #1174: idempotent create — adopt-by-key on conflict.
-                                // A workflow can exist on the server but be absent from local
+                                // Issue #1174 / #1006: idempotent create — adopt-by-key on
+                                // conflict, via the shared `adoptByKeyOnCreate409` helper. A
+                                // workflow can exist on the server but be absent from local
                                 // sync state — e.g. created out-of-band via the admin API
                                 // (#971), or orphaned by a prior push that aborted before
                                 // recording it. On retry this CREATE path hits the
-                                // `workflowKeyPerApp` unique constraint and the server
-                                // returns "workflowKey already exists" (HTTP 400; cron uses
-                                // 409). Rather than abort the whole push, look up the
-                                // existing workflow by key (the list endpoint is app-scoped,
-                                // so every item is owned by this app), verify the SAME key,
-                                // adopt its id into sync state, and re-issue as an UPDATE so
-                                // the push converges. Mirrors the cron-trigger recovery at
-                                // ~sync.ts:2627. Unexpected errors still surface via
-                                // `wrapEntityError`, matching the db-type precedent.
-                                const msg = String(err?.message || err);
-                                const isConflict = err?.statusCode === 409 || msg.includes("already exists");
-                                if (!isConflict) {
-                                    throw wrapEntityError(err, "create", "workflow", key);
-                                }
-                                info(`  Workflow already exists on server, adopting by key: ${key}`);
-                                let adoptedId;
-                                try {
-                                    // Use fetchAll — listWorkflows is paginated, so a single
-                                    // page could miss the by-key match on a large app.
-                                    const items = await fetchAll((p) => client.listWorkflows(resolvedAppId, p));
-                                    // Verify same key + app ownership: the list endpoint only
-                                    // returns workflows for `resolvedAppId`, so a workflowKey
-                                    // match is also an ownership match. Never overwrite an
-                                    // unrelated resource — require exact key equality.
-                                    const existing = (items || []).find((w) => w?.workflowKey === key);
-                                    if (existing?.workflowId) {
-                                        adoptedId = existing.workflowId;
-                                    }
-                                }
-                                catch (lookupErr) {
-                                    throw wrapEntityError(new Error(`workflow "${key}" already exists but could not be adopted (lookup failed: ${String(lookupErr?.message || lookupErr)})`), "create", "workflow", key);
-                                }
-                                if (!adoptedId) {
-                                    // "already exists" but no matching key found on the server —
-                                    // surface the original error rather than silently
-                                    // overwriting an unrelated workflow.
-                                    throw wrapEntityError(err, "create", "workflow", key);
-                                }
+                                // `workflowKeyPerApp` unique constraint and the server returns
+                                // "workflowKey already exists" (HTTP 400; cron uses 409).
+                                // Rather than abort the whole push, look up the existing
+                                // workflow by key (the list endpoint is app-scoped, so a
+                                // workflowKey match is also an ownership match — never
+                                // overwrite an unrelated resource), adopt its id into sync
+                                // state, and re-issue as an UPDATE so the push converges.
+                                // `listWorkflows` is paginated → drain fully with fetchAll.
+                                // Non-409 errors, lookup failures, and no-match 409s all throw
+                                // (see adoptByKeyOnCreate409). Mirrors the cron-trigger
+                                // recovery at ~sync.ts:2627.
+                                const existing = await adoptByKeyOnCreate409({
+                                    err,
+                                    kind: "workflow",
+                                    key,
+                                    lookup: () => fetchAll((p) => client.listWorkflows(resolvedAppId, p)),
+                                    matchKey: (w) => w?.workflowKey === key,
+                                });
+                                const adoptedId = existing.workflowId;
                                 // Out-of-manifest adopt: warn (info-level), matching the cron
                                 // adopt line, and seed the sync-state entity record so the
                                 // shared update body can write modifiedAt/contentHash into it.
@@ -4288,30 +4860,19 @@ Directory Structure:
                     // Build the type-level `updateData` (same logic as the apply path
                     // below) so the validate pass and the apply pass agree on whether
                     // a schema PATCH would run and what it carries.
+                    //
+                    // Issue #1567: the owned scalar fields are now ALWAYS sent as
+                    // value-or-`null` (via `buildOwnedScalarUpdate`) rather than only
+                    // when the TOML declares them. The server preserves a field only
+                    // when the key is absent from the PATCH body, so the previous
+                    // `if ("x" in typeConfig)` guards meant a field removed from the
+                    // TOML silently kept its stale server value. Always-send converges
+                    // the server to the local file (config-as-code): a removed field
+                    // lands as `null` and is cleared. `schema` keeps its own
+                    // `hasSchema` prior-state discriminator (it is a sub-tree, not a
+                    // scalar).
                     const computeTypeUpdateData = () => {
-                        const u = {};
-                        if ("ruleSetId" in typeConfig)
-                            u.ruleSetId = typeConfig.ruleSetId || null;
-                        if ("triggers" in typeConfig)
-                            u.triggers = typeConfig.triggers || null;
-                        if ("metadataAccess" in typeConfig)
-                            u.metadataAccess = typeConfig.metadataAccess || null;
-                        if ("defaultAccess" in typeConfig)
-                            u.defaultAccess = typeConfig.defaultAccess || null;
-                        if ("autoPopulatedFields" in typeConfig) {
-                            u.autoPopulatedFields = typeConfig.autoPopulatedFields || null;
-                        }
-                        if ("timestamps" in typeConfig) {
-                            u.timestamps = typeConfig.timestamps || null;
-                        }
-                        // Issue #1304 (P-C): declared-access manifest. `parseDatabaseTypeToml`
-                        // only sets `metadataManifest` when the TOML declares a `[metadata]`
-                        // / `secrets` block, so this forwards a set/update; clearing a
-                        // manifest by removing the block is a follow-on (mirrors the
-                        // schema-deletion tracking).
-                        if ("metadataManifest" in typeConfig) {
-                            u.metadataManifest = typeConfig.metadataManifest || null;
-                        }
+                        const u = buildOwnedScalarUpdate(typeConfig);
                         const localHasSchema = typeof typeConfig.schema === "string" &&
                             typeConfig.schema.trim().length > 0;
                         if (localHasSchema) {
@@ -4322,6 +4883,43 @@ Directory Structure:
                         }
                         return u;
                     };
+                    // Issue #1567: fetch the live server config once per changed
+                    // existing type. Sync state stores no scalar VALUES (only hashes /
+                    // modifiedAt), so a genuine non-null → null clear can only be
+                    // detected against live state. We use it for two things: (a) report
+                    // "Cleared <field>" only on real transitions (never for every
+                    // `null` sent — that noise would bury the access-gate line), and
+                    // (b) decide whether a push whose only type-level effect is a clear
+                    // still needs the type-config PATCH. A fresh type has nothing to
+                    // clear; a failed fetch degrades to "report nothing cleared".
+                    let serverTypeConfig = null;
+                    if (existingEntry) {
+                        try {
+                            serverTypeConfig = await client.getDatabaseTypeConfig(resolvedAppId, dbType);
+                        }
+                        catch {
+                            serverTypeConfig = null;
+                        }
+                    }
+                    // The owned scalars this push clears (non-null server → null local).
+                    const clearedOwnedFields = ownedScalarsBeingCleared(buildOwnedScalarUpdate(typeConfig), serverTypeConfig);
+                    // Does this push change any TYPE-LEVEL field? True when the TOML
+                    // declares an owned scalar (matches the pre-#1567 PATCH trigger), a
+                    // schema set/delete is in the payload, or an owned scalar is being
+                    // cleared. When false, the type-config PATCH is skipped entirely so
+                    // an operations-only edit does not spuriously report the type as
+                    // "Updated" (issue #369 regression) and no idle clear-report fires.
+                    const declaresOwnedField = DB_TYPE_OWNED_SCALARS.some((k) => k in typeConfig);
+                    const schemaInUpdateData = "schema" in computeTypeUpdateData();
+                    const typeLevelChange = declaresOwnedField ||
+                        schemaInUpdateData ||
+                        clearedOwnedFields.length > 0;
+                    // Emit one "Cleared <field> on <type>" line per genuine clear.
+                    const reportClearedFields = (prefix) => {
+                        for (const key of clearedOwnedFields) {
+                            info(`  ${prefix}${dbTypeFieldLabel(key)} on ${dbType}`);
+                        }
+                    };
                     // Validate-first pass (decision 4a): run every gate for this type
                     // BEFORE issuing any mutating call. If a gate fails, the whole
                     // type's mutating calls (op creates/updates/deletes AND the schema
@@ -4341,11 +4939,16 @@ Directory Structure:
                     try {
                         // 1. Schema-edit gate (type-config PATCH dry-run) — only when the
                         //    type already exists on the server and we'd actually PATCH a
-                        //    schema-relevant field. A fresh type (no existingEntry) has no
+                        //    type-level field. A fresh type (no existingEntry) has no
                         //    ops to break, so there's nothing to gate yet.
-                        if (existingEntry) {
+                        //    Issue #1567: `computeTypeUpdateData` now always returns the
+                        //    owned scalars, so gate on `typeLevelChange` (a genuine
+                        //    declared/schema/clear change) rather than "payload
+                        //    non-empty" — an operations-only edit must not run the
+                        //    type-config dry-run at all.
+                        if (existingEntry && typeLevelChange) {
                             const validateUpdateData = computeTypeUpdateData();
-                            if (Object.keys(validateUpdateData).length > 0) {
+                            {
                                 await client.updateDatabaseTypeConfig(resolvedAppId, dbType, pendingOpDeletes.length > 0
                                     ? { ...validateUpdateData, pendingOpDeletes, finalOpNames }
                                     : validateUpdateData, validateExpectedModifiedAt, {
@@ -4548,15 +5151,11 @@ Directory Structure:
                     // labels (so dry-run still shows what WOULD change) but skip ALL
                     // mutating calls for this type.
                     if (typeGateBlocked) {
-                        const wouldUpdate = "ruleSetId" in typeConfig ||
-                            "triggers" in typeConfig ||
-                            "metadataAccess" in typeConfig ||
-                            "defaultAccess" in typeConfig ||
-                            "autoPopulatedFields" in typeConfig ||
-                            "timestamps" in typeConfig ||
-                            "schema" in typeConfig;
                         if (existingEntry) {
-                            if (wouldUpdate) {
+                            // Issue #1567: a genuine type-level change (declared field,
+                            // schema set/delete, or an owned-scalar clear) — same predicate
+                            // the apply path gates the PATCH on.
+                            if (typeLevelChange) {
                                 changes.push({ type: "database-type", action: "update", key: dbType });
                             }
                         }
@@ -4577,10 +5176,15 @@ Directory Structure:
                         continue;
                     }
                     if (existingEntry) {
-                        // Update existing type config — only if there are type-level fields to update.
-                        // Operations are handled separately below, so skipping the PATCH here when
-                        // updateData is empty avoids sending an empty body (which the server rejects
-                        // with HTTP 400).
+                        // Update existing type config — only when there is a genuine
+                        // type-level change. Operations are handled separately below.
+                        // Issue #369: skipping the PATCH on an operations-only edit avoids
+                        // sending an empty body (which the server rejects with HTTP 400)
+                        // and a spurious "Updated database type". Issue #1567: the owned
+                        // scalars are always in `updateData` now (value-or-`null`), so the
+                        // skip decision moved from "payload non-empty" to the
+                        // `typeLevelChange` predicate (a declared field, a schema
+                        // set/delete, or an owned-scalar clear).
                         if (!options.dryRun) {
                             const expectedModifiedAt = options.force
                                 ? undefined
@@ -4590,11 +5194,8 @@ Directory Structure:
                                 // one (a set/update), OR when the server had one at last
                                 // sync and the local file no longer does (a deletion —
                                 // `schema: null` clears it server-side; codex review gap on
-                                // PR #766). When the type never had a schema and still
-                                // doesn't, omit it so an operations-only edit doesn't
-                                // register as an empty type-level update (issue #369). Built
-                                // by the shared helper so the validate pass and apply pass
-                                // agree (issue #813).
+                                // PR #766). Built by the shared helper so the validate pass
+                                // and apply pass agree (issue #813).
                                 const updateData = computeTypeUpdateData();
                                 // Issue #813 (2B): forward the ops being deleted in this push
                                 // so the schema-edit / OPS_EXIST gates evaluate against the
@@ -4608,13 +5209,17 @@ Directory Structure:
                                     // exclusion (see derivation above).
                                     updateData.finalOpNames = finalOpNames;
                                 }
-                                if (Object.keys(updateData).filter((k) => k !== "pendingOpDeletes" && k !== "finalOpNames").length > 0) {
+                                if (typeLevelChange) {
                                     changes.push({ type: "database-type", action: "update", key: dbType });
                                     const updated = await client.updateDatabaseTypeConfig(resolvedAppId, dbType, updateData, expectedModifiedAt, {
                                         dryRun: false,
                                         acceptWarnings: !!options.acceptWarnings,
                                     });
                                     info(`  Updated database type: ${dbType}`);
+                                    // Issue #1567: name each owned scalar this push cleared, so
+                                    // removing an access gate (celContextAccess / defaultAccess)
+                                    // is never silent.
+                                    reportClearedFields("Cleared ");
                                     printStaleInstanceWarning(updated);
                                     if (syncState?.entities?.databaseTypes?.[dbType] && updated?.modifiedAt) {
                                         syncState.entities.databaseTypes[dbType].modifiedAt = updated.modifiedAt;
@@ -4674,17 +5279,12 @@ Directory Structure:
                             }
                         }
                         else {
-                            // In dry-run mode, still report the change iff we would actually PATCH.
-                            const wouldUpdate = "ruleSetId" in typeConfig ||
-                                "triggers" in typeConfig ||
-                                "metadataAccess" in typeConfig ||
-                                "defaultAccess" in typeConfig ||
-                                "autoPopulatedFields" in typeConfig ||
-                                "timestamps" in typeConfig ||
-                                "schema" in typeConfig ||
-                                "metadataManifest" in typeConfig;
-                            if (wouldUpdate) {
+                            // In dry-run mode, still report the change iff we would
+                            // actually PATCH (issue #1567: the same `typeLevelChange`
+                            // predicate the apply path uses), and preview the clears.
+                            if (typeLevelChange) {
                                 changes.push({ type: "database-type", action: "update", key: dbType });
+                                reportClearedFields("Would clear ");
                             }
                         }
                     }
@@ -5172,7 +5772,15 @@ Directory Structure:
                                 : existingEntry.modifiedAt;
                             try {
                                 const updated = await client.updateGroupTypeConfig(resolvedAppId, groupType, {
-                                    ruleSetId: configData.ruleSetId,
+                                    // Issue #1567: send `?? null`, not a bare
+                                    // `configData.ruleSetId`. When the TOML drops the rule-set
+                                    // reference the parse leaves `ruleSetId` undefined, which
+                                    // `JSON.stringify` omits from the body — so the server saw
+                                    // no key and preserved the stale rule set. `null` sends an
+                                    // explicit clear (server: `"ruleSetId" in body` → null).
+                                    ruleSetId: configData.ruleSetId ?? null,
+                                    // `autoAddCreator` already converges: the parse defaults it
+                                    // to `true` when absent, so it is always sent explicitly.
                                     autoAddCreator: configData.autoAddCreator,
                                     // Issue #1350: null clears the manifest server-side when
                                     // the TOML drops the `[metadata]` block (matches the
@@ -5225,7 +5833,53 @@ Directory Structure:
                                 }
                             }
                             catch (err) {
-                                throw wrapEntityError(err, "create", "group type config", groupType);
+                                // #1851: idempotent create — adopt-by-key on 409, matching the
+                                // seven other synced types (rule sets, integrations, webhooks,
+                                // cron triggers, blob buckets, prompts, workflows). A group
+                                // type config can already exist on the server (created
+                                // out-of-band via the console or an ad-hoc CLI call, or a prior
+                                // push that aborted before recording it in sync state). Without
+                                // this, that CREATE re-hits the server's 409 "Config for this
+                                // group type already exists"
+                                // (group-type-config-controller.ts) on every subsequent push
+                                // and the operator has to hand-edit `.primitive-sync.json` to
+                                // recover. The shared helper detects the conflict (409 status /
+                                // "already exists" message), lists the app's configs — the list
+                                // route drains every page server-side (#1668), so the candidate
+                                // set is complete — and returns the one whose `groupType`
+                                // matches EXACTLY (the app-scoped list means a key match is an
+                                // ownership match; an unrelated config is never adopted). Its
+                                // non-adopt outcomes each throw a clear error and never touch
+                                // the server. Unlike blob buckets (ttlTier), a group type
+                                // config has no immutable field, so a plain adopt-and-update
+                                // converges. We re-issue as an UPDATE with the same `?? null`
+                                // clear semantics as the existing-update branch above, so the
+                                // adopted config converges to the local TOML.
+                                await adoptByKeyOnCreate409({
+                                    err,
+                                    kind: "group type config",
+                                    key: groupType,
+                                    lookup: async () => await client.listGroupTypeConfigs(resolvedAppId),
+                                    matchKey: (c) => c?.groupType === groupType,
+                                });
+                                // No expectedModifiedAt: the config was not in sync state, so
+                                // there is no baseline to guard against — mirror the `--force`
+                                // update path, which also omits it.
+                                const updated = await client.updateGroupTypeConfig(resolvedAppId, groupType, {
+                                    ruleSetId: configData.ruleSetId ?? null,
+                                    autoAddCreator: configData.autoAddCreator,
+                                    metadataManifest: configData.metadataManifest ?? null,
+                                });
+                                info(`  Adopted + updated group type config: ${groupType}`);
+                                if (syncState) {
+                                    if (!syncState.entities.groupTypeConfigs) {
+                                        syncState.entities.groupTypeConfigs = {};
+                                    }
+                                    syncState.entities.groupTypeConfigs[groupType] = {
+                                        modifiedAt: updated?.modifiedAt || new Date().toISOString(),
+                                        contentHash: computeFileHash(filePath),
+                                    };
+                                }
                             }
                         }
                     }
@@ -5305,7 +5959,41 @@ Directory Structure:
                                 }
                             }
                             catch (err) {
-                                throw wrapEntityError(err, "create", "collection type config", collectionType);
+                                // #1851: idempotent create — adopt-by-key on 409, the same
+                                // pattern as group type configs above. The server returns 409
+                                // "Config for this collection type already exists"
+                                // (collection-type-config-controller.ts) when a config for this
+                                // type already exists (out-of-band create, or a prior push that
+                                // aborted before recording it in sync state). The shared helper
+                                // lists the app's configs (complete — the list route drains all
+                                // pages, #1668) and returns the exact `collectionType` match; an
+                                // unrelated config is never adopted. Collection type configs
+                                // have no immutable field, so a plain adopt-and-update
+                                // converges. Re-issue as an UPDATE with the `?? null` clear
+                                // semantics of the existing-update branch.
+                                await adoptByKeyOnCreate409({
+                                    err,
+                                    kind: "collection type config",
+                                    key: collectionType,
+                                    lookup: async () => await client.listCollectionTypeConfigs(resolvedAppId),
+                                    matchKey: (c) => c?.collectionType === collectionType,
+                                });
+                                // No expectedModifiedAt — the config was not in sync state, so
+                                // there is no baseline to guard against (mirrors `--force`).
+                                const updated = await client.updateCollectionTypeConfig(resolvedAppId, collectionType, {
+                                    ruleSetId: configData.ruleSetId ?? null,
+                                    metadataManifest: configData.metadataManifest ?? null,
+                                });
+                                info(`  Adopted + updated collection type config: ${collectionType}`);
+                                if (syncState) {
+                                    if (!syncState.entities.collectionTypeConfigs) {
+                                        syncState.entities.collectionTypeConfigs = {};
+                                    }
+                                    syncState.entities.collectionTypeConfigs[collectionType] = {
+                                        modifiedAt: updated?.modifiedAt || new Date().toISOString(),
+                                        contentHash: computeFileHash(filePath),
+                                    };
+                                }
                             }
                         }
                     }
@@ -5467,6 +6155,189 @@ Directory Structure:
                     skippedCount += await pushTestCasesForBlock(client, resolvedAppId, "script", blockId, scriptName, configDir, syncState, options.dryRun, changes, pushMaps, { force: options.force });
                 }
             }
+            // ------------------------------------------------------------------
+            // Prune pass — server-side deletion of managed entities whose local
+            // TOML the operator removed since the last sync (issue #1655). Opt-in:
+            // a push WITHOUT `--prune` deletes nothing and makes no extra server
+            // calls. Each candidate is confirmed by a point read (detail-fetch by
+            // id/key, immune to listing truncation) that also carries a drift check
+            // — delete only when the live `modifiedAt` matches the one recorded at
+            // last sync, unless `--force`. One batch confirmation gates the deletes.
+            // ------------------------------------------------------------------
+            if (options.prune) {
+                const dropPruneState = (spec, key) => {
+                    if (!syncState?.entities)
+                        return;
+                    const slot = syncState.entities[spec.resourceType.stateSlot];
+                    if (slot)
+                        delete slot[key];
+                    if (spec.resourceType.testBlockType) {
+                        removePrunedSidecar({
+                            configDir,
+                            resourceType: spec.resourceType,
+                            key,
+                            testCaseEntities: syncState.entities.testCases,
+                            logger: (m) => info(m),
+                        });
+                    }
+                };
+                const toDelete = [];
+                const alreadyAbsent = [];
+                const skipped = [];
+                for (const spec of PUSH_PRUNE_SPECS) {
+                    const priorEntities = syncState?.entities?.[spec.resourceType.stateSlot];
+                    const candidates = collectPushPruneCandidates({
+                        spec,
+                        configDir,
+                        priorEntities,
+                    });
+                    for (const { key, entry } of candidates) {
+                        const address = spec.addressOf(key, entry);
+                        // Behavior 4: skip the point read for a candidate we could not
+                        // delete anyway (no id in state, or no delete surface yet #1426).
+                        if (!address || !spec.deleteEntity) {
+                            const decision = decidePushPruneCandidate({
+                                spec,
+                                address,
+                                priorModifiedAt: entry?.modifiedAt,
+                                fetch: { ok: false },
+                                force: !!options.force,
+                            });
+                            skipped.push({ spec, key, entry, address, decision });
+                            continue;
+                        }
+                        // Point read: confirm live presence + drift. Fail closed — any
+                        // non-404 error leaves the entity and its state slot untouched.
+                        let fetchOutcome;
+                        try {
+                            const detail = await spec.fetchDetail(client, resolvedAppId, address);
+                            fetchOutcome = { ok: true, detail };
+                        }
+                        catch (err) {
+                            if (err instanceof ApiError && err.statusCode === 404) {
+                                fetchOutcome = { ok: false, status: 404 };
+                            }
+                            else {
+                                fetchOutcome = { ok: false };
+                            }
+                        }
+                        const decision = decidePushPruneCandidate({
+                            spec,
+                            address,
+                            priorModifiedAt: entry?.modifiedAt,
+                            fetch: fetchOutcome,
+                            force: !!options.force,
+                        });
+                        const item = { spec, key, entry, address, decision };
+                        if (decision.action === "delete")
+                            toDelete.push(item);
+                        else if (decision.action === "drop-state")
+                            alreadyAbsent.push(item);
+                        else
+                            skipped.push(item);
+                    }
+                }
+                const totalPlanned = toDelete.length + alreadyAbsent.length + skipped.length;
+                if (totalPlanned > 0) {
+                    console.log();
+                    info("Prune plan (local TOML removed since last sync):");
+                    for (const item of toDelete) {
+                        console.log(`  ${chalk.red("will delete")} ${item.spec.resourceType.label}: ${item.key}`);
+                    }
+                    for (const item of alreadyAbsent) {
+                        console.log(`  ${chalk.dim("already absent")} ${item.spec.resourceType.label}: ${item.key}`);
+                    }
+                    for (const item of skipped) {
+                        const reason = item.decision.action === "skip" ? item.decision.reason : "skip";
+                        const label = reason === "drift"
+                            ? "skipped — modified on server since last sync (use --force)"
+                            : reason === "unconfirmed"
+                                ? "skipped — could not confirm (fetch failed)"
+                                : reason === "no-id"
+                                    ? "skipped — no id in sync state"
+                                    : reason === "unsupported"
+                                        ? "skipped — no delete surface yet (#1426)"
+                                        : "skipped";
+                        console.log(`  ${chalk.yellow(label)} ${item.spec.resourceType.label}: ${item.key}`);
+                    }
+                }
+                if (options.dryRun) {
+                    // Behavior 6: report the plan, mutate nothing (no delete calls, no
+                    // state or filesystem change — not even the already-absent cleanup).
+                    for (const item of toDelete) {
+                        changes.push({
+                            type: item.spec.resourceType.label,
+                            action: "delete",
+                            key: item.key,
+                        });
+                    }
+                }
+                else {
+                    // Behavior 5: one batch confirmation for the destructive deletes.
+                    // No deletes to confirm → apply the already-absent bookkeeping only.
+                    let proceed = true;
+                    if (toDelete.length > 0 && !options.yes) {
+                        try {
+                            proceed = await confirmPrompt(`Delete ${toDelete.length} remote entity(ies)? This cannot be undone.`);
+                        }
+                        catch (err) {
+                            if (err instanceof ConfirmPromptError) {
+                                error(err.message);
+                                process.exit(1);
+                            }
+                            throw err;
+                        }
+                    }
+                    if (!proceed) {
+                        // Declining leaves every entity AND every prior-state slot intact.
+                        info("Prune cancelled — no entities were deleted.");
+                    }
+                    else {
+                        let prunedCount = 0;
+                        let blockedCount = 0;
+                        // Entities already gone server-side: drop their stale state (2).
+                        for (const item of alreadyAbsent) {
+                            dropPruneState(item.spec, item.key);
+                            info(`  ${item.spec.resourceType.label} ${item.key} already absent — cleared from sync state`);
+                        }
+                        for (const item of toDelete) {
+                            try {
+                                await item.spec.deleteEntity(client, resolvedAppId, item.address);
+                                dropPruneState(item.spec, item.key);
+                                changes.push({
+                                    type: item.spec.resourceType.label,
+                                    action: "delete",
+                                    key: item.key,
+                                });
+                                prunedCount++;
+                                info(`  Deleted ${item.spec.resourceType.label}: ${item.key}`);
+                            }
+                            catch (err) {
+                                if (err instanceof ConflictError ||
+                                    (err instanceof ApiError && err.statusCode === 409)) {
+                                    // Behavior 8: still referenced — report, keep state, and
+                                    // continue deleting the rest (partial success + re-run).
+                                    blockedCount++;
+                                    warn(`  Blocked — ${item.spec.resourceType.label} ${item.key} is still referenced: ${err instanceof Error ? err.message : String(err)}`);
+                                }
+                                else if (err instanceof ApiError && err.statusCode === 404) {
+                                    // Raced to 404 between the point read and the delete: the
+                                    // desired (deleted) state is met — treat as success.
+                                    dropPruneState(item.spec, item.key);
+                                    info(`  ${item.spec.resourceType.label} ${item.key} already absent (nothing to delete)`);
+                                }
+                                else {
+                                    blockedCount++;
+                                    warn(`  Skipped — could not delete ${item.spec.resourceType.label} ${item.key}: ${err instanceof Error ? err.message : String(err)}`);
+                                }
+                            }
+                        }
+                        if (totalPlanned > 0) {
+                            info(`Prune: ${prunedCount} deleted, ${alreadyAbsent.length} already absent, ${skipped.length + blockedCount} skipped.`);
+                        }
+                    }
+                }
+            }
             divider();
             // Issue #813: a gate failure surfaced by the validate-first pass (which
             // also runs in dry-run mode via the server's dry-run gate endpoints).
@@ -5585,33 +6456,106 @@ Directory Structure:
         const syncState = loadSyncState(configDir);
         info(`Comparing local configuration with app ${resolvedAppId}...`);
         try {
-            // Fetch remote state
-            const [integrationItems, promptItems, workflowItems, emailTemplatesResult] = await Promise.all([
-                fetchAll((p) => client.listIntegrations(resolvedAppId, p)),
-                fetchAll((p) => client.listPrompts(resolvedAppId, p)),
-                fetchAll((p) => client.listWorkflows(resolvedAppId, p)),
-                client.listEmailTemplates(resolvedAppId).catch(() => ({ templates: [] })),
+            // Fetch remote state. Every list flows through the same ok/error gate
+            // (issue #1485): a failed fetch must NOT be read as "the app has none of
+            // these" — that would print false `local only` rows and let the summary
+            // read as exhaustive while a whole type went uncompared. A failed type
+            // is recorded in `notCompared`, skipped entirely (no local reads, no
+            // rows), and surfaced as an explicit `not compared:` summary line so the
+            // roll-up can never be misread. This replaces the older mix of
+            // `.catch(() => [])` (silent empty) and un-caught `fetchAll` (whole-diff
+            // abort) with one uniform, honest degradation.
+            const notCompared = [];
+            const gateReason = (err) => err && err.statusCode === 404
+                ? "server does not support"
+                : "remote fetch failed";
+            const gate = (outcome, label, empty) => {
+                if (outcome.ok)
+                    return outcome.value;
+                notCompared.push({ type: label, reason: gateReason(outcome.error) });
+                return empty;
+            };
+            const [integrationsOutcome, promptsOutcome, workflowsOutcome, emailTemplatesOutcomeDiff, webhooksOutcome, cronTriggersOutcomeDiff, blobBucketsOutcomeDiff, scriptsOutcomeDiff, varsOutcomeDiff, databaseTypeConfigsOutcomeDiff, ruleSetsOutcomeDiff, groupTypeConfigsOutcomeDiff, collectionTypeConfigsOutcomeDiff, metadataCategoryConfigsOutcomeDiff,] = await Promise.all([
+                attemptFetch(() => fetchAll((p) => client.listIntegrations(resolvedAppId, p))),
+                attemptFetch(() => fetchAll((p) => client.listPrompts(resolvedAppId, p))),
+                attemptFetch(() => fetchAll((p) => client.listWorkflows(resolvedAppId, p))),
+                attemptFetch(() => client.listEmailTemplates(resolvedAppId)),
+                attemptFetch(() => fetchAll((p) => client.listWebhooks(resolvedAppId, p))),
+                attemptFetch(() => client.listCronTriggers(resolvedAppId)),
+                attemptFetch(() => client.listBlobBuckets(resolvedAppId)),
+                attemptFetch(() => client.listScripts(resolvedAppId)),
+                attemptFetch(() => client.listAppConfigVars(resolvedAppId)),
+                attemptFetch(() => client.listDatabaseTypeConfigs(resolvedAppId)),
+                attemptFetch(() => client.listRuleSets(resolvedAppId)),
+                attemptFetch(() => client.listGroupTypeConfigs(resolvedAppId)),
+                attemptFetch(() => client.listCollectionTypeConfigs(resolvedAppId)),
+                attemptFetch(() => client.listMetadataCategoryConfigs(resolvedAppId)),
             ]);
-            const webhookItems = await fetchAll((p) => client.listWebhooks(resolvedAppId, p));
-            let cronTriggerItemsDiff = [];
-            try {
-                const cronResult = await client.listCronTriggers(resolvedAppId);
-                cronTriggerItemsDiff = cronResult.items || [];
-            }
-            catch {
-                // Cron triggers may not be available on older servers
-            }
-            const blobBucketsDiffResult = await client.listBlobBuckets(resolvedAppId).catch(() => ({ items: [] }));
+            const integrationItems = gate(integrationsOutcome, "integrations", []);
+            const promptItems = gate(promptsOutcome, "prompts", []);
+            const workflowItems = gate(workflowsOutcome, "workflows", []);
+            const emailTemplatesResult = gate(emailTemplatesOutcomeDiff, "email-templates", { templates: [] });
+            const webhookItems = gate(webhooksOutcome, "webhooks", []);
+            const cronTriggerItemsDiff = gate(cronTriggersOutcomeDiff, "cron-triggers", { items: [] }).items || [];
+            const blobBucketsDiffResult = gate(blobBucketsOutcomeDiff, "blob-buckets", { items: [] });
+            const scriptItemsDiff = gate(scriptsOutcomeDiff, "transforms", { items: [] }).items || [];
+            const remoteVarItemsDiff = gate(varsOutcomeDiff, "vars", []);
+            const databaseTypeConfigsDiff = gate(databaseTypeConfigsOutcomeDiff, "database-types", []);
+            const ruleSetsDiff = gate(ruleSetsOutcomeDiff, "rule-sets", []);
+            const groupTypeConfigsDiff = gate(groupTypeConfigsOutcomeDiff, "group-type-configs", []);
+            const collectionTypeConfigsDiff = gate(collectionTypeConfigsOutcomeDiff, "collection-type-configs", []);
+            const metadataCategoryConfigsDiff = gate(metadataCategoryConfigsOutcomeDiff, "metadata-category-configs", []);
+            // ruleSetId ⇄ name maps, built once from the rule-set listing, drive the
+            // content-aware comparison of the three rule-set-referencing types
+            // (database-types, group/collection-type-configs). If the rule-set list
+            // itself failed, the maps are empty and those types degrade to
+            // "content not compared" rather than risk a false `Modified` from an
+            // unresolvable reference (see `ruleSetsOk` below).
+            const ruleSetsArr = Array.isArray(ruleSetsDiff) ? ruleSetsDiff : [];
+            const ruleSetIdToNameDiff = new Map();
+            const ruleSetNameToIdDiff = new Map();
+            for (const rs of ruleSetsArr) {
+                ruleSetIdToNameDiff.set(rs.ruleSetId, rs.name);
+                ruleSetNameToIdDiff.set(rs.name, rs.ruleSetId);
+            }
+            const ruleSetsOk = ruleSetsOutcomeDiff.ok;
             const remoteIntegrations = new Set(integrationItems.map((i) => i.integrationKey));
             const remoteWebhooks = new Set(webhookItems.map((w) => w.webhookKey));
             const remoteCronTriggers = new Set(cronTriggerItemsDiff.map((t) => t.triggerKey));
             const remoteBlobBuckets = new Set((blobBucketsDiffResult.items || []).map((b) => b.bucketKey));
             const remotePrompts = new Set(promptItems.map((p) => p.promptKey));
-            const remoteWorkflows = new Set(workflowItems.map((w) => w.workflowKey));
+            // #1660 — exclude platform-owned workflows (reserved `__internal.*`)
+            // from the remote set so `diff` never reports them (they are not app
+            // config). The local-file set below applies the same exclusion, so a
+            // platform-owned workflow appears in none of synced/modified/remote-only/
+            // local-only. Prefers the server flag, falls back to the key prefix.
+            const remoteWorkflows = new Set(workflowItems
+                .filter((w) => !isPlatformOwnedWorkflow(w))
+                .map((w) => w.workflowKey));
             const remoteEmailTemplates = new Set((emailTemplatesResult.templates || [])
                 .filter((t) => t.hasOverride)
                 .map((t) => t.emailType));
-            // Get local files
+            // Remote maps keyed the SAME way the sync-state slot is (so local-only /
+            // remote-only classification lines up), value = the server entity for
+            // content comparison.
+            const remoteDatabaseTypes = new Map((Array.isArray(databaseTypeConfigsDiff) ? databaseTypeConfigsDiff : [])
+                .filter((c) => c?.databaseType)
+                .map((c) => [c.databaseType, c]));
+            const remoteRuleSets = new Map(ruleSetsArr
+                .filter((rs) => rs?.name || rs?.ruleSetId)
+                .map((rs) => [ruleSetFileKey(rs), rs]));
+            const remoteGroupTypeConfigs = new Map((Array.isArray(groupTypeConfigsDiff) ? groupTypeConfigsDiff : [])
+                .filter((c) => c?.groupType)
+                .map((c) => [c.groupType, c]));
+            const remoteCollectionTypeConfigs = new Map((Array.isArray(collectionTypeConfigsDiff) ? collectionTypeConfigsDiff : [])
+                .filter((c) => c?.collectionType)
+                .map((c) => [c.collectionType, c]));
+            const remoteMetadataCategoryConfigs = new Map((Array.isArray(metadataCategoryConfigsDiff) ? metadataCategoryConfigsDiff : [])
+                .filter((c) => c?.resourceType && c?.category)
+                .map((c) => [`${c.resourceType}#${c.category}`, c]));
+            // Get local files. Each read is guarded by its type's fetch outcome: a
+            // type whose remote fetch failed is not read locally at all, so it never
+            // produces `local only` rows — it is reported once under `not compared:`.
             const localIntegrations = new Set();
             const localWebhooks = new Set();
             const localCronTriggers = new Set();
@@ -5619,8 +6563,14 @@ Directory Structure:
             const localPrompts = new Set();
             const localWorkflows = new Set();
             const localEmailTemplates = new Set();
+            // Parsed local TOML per key for the five content-aware config types.
+            const localDatabaseTypesParsed = new Map();
+            const localRuleSetsParsed = new Map();
+            const localGroupTypeConfigsParsed = new Map();
+            const localCollectionTypeConfigsParsed = new Map();
+            const localMetadataCategoryParsed = new Map();
             const integrationsDir = join(configDir, "integrations");
-            if (existsSync(integrationsDir)) {
+            if (integrationsOutcome.ok && existsSync(integrationsDir)) {
                 for (const file of readdirSync(integrationsDir).filter((f) => f.endsWith(".toml"))) {
                     const tomlData = parseTomlFile(join(integrationsDir, file));
                     const key = tomlData.integration?.key || basename(file, ".toml");
@@ -5628,7 +6578,7 @@ Directory Structure:
                 }
             }
             const webhooksDirPath = join(configDir, "webhooks");
-            if (existsSync(webhooksDirPath)) {
+            if (webhooksOutcome.ok && existsSync(webhooksDirPath)) {
                 for (const file of readdirSync(webhooksDirPath).filter((f) => f.endsWith(".toml"))) {
                     const tomlData = parseTomlFile(join(webhooksDirPath, file));
                     const key = tomlData.webhook?.key || basename(file, ".toml");
@@ -5636,7 +6586,7 @@ Directory Structure:
                 }
             }
             const cronTriggersDirPath = join(configDir, "cron-triggers");
-            if (existsSync(cronTriggersDirPath)) {
+            if (cronTriggersOutcomeDiff.ok && existsSync(cronTriggersDirPath)) {
                 for (const file of readdirSync(cronTriggersDirPath).filter((f) => f.endsWith(".toml"))) {
                     const tomlData = parseTomlFile(join(cronTriggersDirPath, file));
                     const key = tomlData.cronTrigger?.key || basename(file, ".toml");
@@ -5644,7 +6594,7 @@ Directory Structure:
                 }
             }
             const blobBucketsDiffDir = join(configDir, "blob-buckets");
-            if (existsSync(blobBucketsDiffDir)) {
+            if (blobBucketsOutcomeDiff.ok && existsSync(blobBucketsDiffDir)) {
                 for (const file of readdirSync(blobBucketsDiffDir).filter((f) => f.endsWith(".toml"))) {
                     const tomlData = parseTomlFile(join(blobBucketsDiffDir, file));
                     const key = tomlData.bucket?.key || basename(file, ".toml");
@@ -5652,77 +6602,163 @@ Directory Structure:
                 }
             }
             const promptsDir = join(configDir, "prompts");
-            if (existsSync(promptsDir)) {
+            if (promptsOutcome.ok && existsSync(promptsDir)) {
                 for (const file of readdirSync(promptsDir).filter((f) => f.endsWith(".toml"))) {
                     const tomlData = parseTomlFile(join(promptsDir, file));
                     const key = tomlData.prompt?.key || basename(file, ".toml");
                     localPrompts.add(key);
                 }
             }
+            // Database-config types (issue #1485). Read each type's local dir only
+            // when its remote fetch succeeded, and capture the parsed TOML per key
+            // so the content comparison below can hash it without a second read.
+            //
+            // When the identity field is omitted and derived from the filename
+            // (the fallback `sync push` supports — see ~sync.ts:5196 for
+            // database-types, :6176 group, :6267 collection, :6358 metadata), the
+            // derived identity is injected back into the parsed TOML BEFORE it is
+            // stored. Otherwise the content hash would carry `databaseType: undefined`
+            // (etc.) while the remote entity carries the real identity, and diff would
+            // report `Modified` forever — even right after a successful push.
+            const databaseTypesDir = join(configDir, "database-types");
+            if (databaseTypeConfigsOutcomeDiff.ok && existsSync(databaseTypesDir)) {
+                for (const file of readdirSync(databaseTypesDir).filter((f) => f.endsWith(".toml"))) {
+                    const tomlData = parseTomlFile(join(databaseTypesDir, file));
+                    const key = tomlData.type?.databaseType || basename(file, ".toml");
+                    if (!tomlData.type)
+                        tomlData.type = {};
+                    tomlData.type.databaseType = key;
+                    localDatabaseTypesParsed.set(key, tomlData);
+                }
+            }
+            const ruleSetsDir = join(configDir, "rule-sets");
+            if (ruleSetsOutcomeDiff.ok && existsSync(ruleSetsDir)) {
+                for (const file of readdirSync(ruleSetsDir).filter((f) => f.endsWith(".toml"))) {
+                    const tomlData = parseTomlFile(join(ruleSetsDir, file));
+                    // Key by the FILENAME, exactly as `sync push` does (it looks the
+                    // sync-state entry up by `basename(file)` and PATCHes that id). If
+                    // an existing pulled rule set is renamed by editing `ruleSet.name`
+                    // without renaming the file, push still updates the same entity, so
+                    // diff must match it to the same remote entity — one Modified row —
+                    // rather than rekey by the new `name` (which would read as a new
+                    // local rule set PLUS a prunable remote one). The renamed `name`
+                    // still differs in the hashed content, so the row is `Modified`.
+                    const key = basename(file, ".toml");
+                    localRuleSetsParsed.set(key, tomlData);
+                }
+            }
+            const groupTypeConfigsDir = join(configDir, "group-type-configs");
+            if (groupTypeConfigsOutcomeDiff.ok && existsSync(groupTypeConfigsDir)) {
+                for (const file of readdirSync(groupTypeConfigsDir).filter((f) => f.endsWith(".toml"))) {
+                    const tomlData = parseTomlFile(join(groupTypeConfigsDir, file));
+                    const key = tomlData.groupTypeConfig?.groupType || basename(file, ".toml");
+                    if (!tomlData.groupTypeConfig)
+                        tomlData.groupTypeConfig = {};
+                    tomlData.groupTypeConfig.groupType = key;
+                    localGroupTypeConfigsParsed.set(key, tomlData);
+                }
+            }
+            const collectionTypeConfigsDir = join(configDir, "collection-type-configs");
+            if (collectionTypeConfigsOutcomeDiff.ok && existsSync(collectionTypeConfigsDir)) {
+                for (const file of readdirSync(collectionTypeConfigsDir).filter((f) => f.endsWith(".toml"))) {
+                    const tomlData = parseTomlFile(join(collectionTypeConfigsDir, file));
+                    const key = tomlData.collectionTypeConfig?.collectionType || basename(file, ".toml");
+                    if (!tomlData.collectionTypeConfig)
+                        tomlData.collectionTypeConfig = {};
+                    tomlData.collectionTypeConfig.collectionType = key;
+                    localCollectionTypeConfigsParsed.set(key, tomlData);
+                }
+            }
+            // metadata-category key is the `resourceType#category` pair read from the
+            // parsed `[metadataCategoryConfig]` content (matching push), NOT the
+            // filename — a renamed file still matches its server entity.
+            const metadataCategoryConfigsDir = join(configDir, "metadata-category-configs");
+            if (metadataCategoryConfigsOutcomeDiff.ok && existsSync(metadataCategoryConfigsDir)) {
+                for (const file of readdirSync(metadataCategoryConfigsDir).filter((f) => f.endsWith(".toml"))) {
+                    const tomlData = parseTomlFile(join(metadataCategoryConfigsDir, file));
+                    const section = tomlData.metadataCategoryConfig || {};
+                    let key;
+                    if (section.resourceType && section.category) {
+                        key = `${section.resourceType}#${section.category}`;
+                    }
+                    else {
+                        // Derive the `resourceType#category` identity from the filename
+                        // (`resourceType.category.toml`) and inject it back into the
+                        // parsed section — matching push's fallback (~sync.ts:6358) — so
+                        // the content hash carries the identity instead of `undefined`
+                        // and does not report `Modified` after a successful push.
+                        const base = basename(file, ".toml");
+                        const dot = base.indexOf(".");
+                        if (dot > 0) {
+                            const resourceType = base.slice(0, dot);
+                            const category = base.slice(dot + 1);
+                            key = `${resourceType}#${category}`;
+                            if (!tomlData.metadataCategoryConfig) {
+                                tomlData.metadataCategoryConfig = {};
+                            }
+                            tomlData.metadataCategoryConfig.resourceType =
+                                section.resourceType || resourceType;
+                            tomlData.metadataCategoryConfig.category =
+                                section.category || category;
+                        }
+                        else {
+                            key = base;
+                        }
+                    }
+                    localMetadataCategoryParsed.set(key, tomlData);
+                }
+            }
             // #1175: capture the parsed (fragment-expanded) local workflow TOML
             // per key so the content-aware comparison below can hash it without a
             // second read.
             const localWorkflowParsed = new Map();
             const workflowsDir = join(configDir, "workflows");
-            if (existsSync(workflowsDir)) {
+            if (workflowsOutcome.ok && existsSync(workflowsDir)) {
                 for (const file of readdirSync(workflowsDir).filter((f) => f.endsWith(".toml"))) {
                     const tomlData = parseTomlFile(join(workflowsDir, file));
                     const key = tomlData.workflow?.key || basename(file, ".toml");
+                    // #1660 — a stray local `__internal.*.toml` is platform-owned, not
+                    // app config; keep it out of the local set (matched on resolved key,
+                    // edge case 2) so `diff` reports it in no set. `sync pull` cleans up
+                    // the file; `sync push` skips it.
+                    if (isPlatformOwnedWorkflowKey(key))
+                        continue;
                     localWorkflows.add(key);
                     localWorkflowParsed.set(key, tomlData);
                 }
             }
             const emailTemplatesDirPath = join(configDir, "email-templates");
-            if (existsSync(emailTemplatesDirPath)) {
+            if (emailTemplatesOutcomeDiff.ok && existsSync(emailTemplatesDirPath)) {
                 for (const file of readdirSync(emailTemplatesDirPath).filter((f) => f.endsWith(".toml"))) {
                     const tomlData = parseTomlFile(join(emailTemplatesDirPath, file));
                     const emailType = tomlData.template?.emailType || basename(file, ".toml");
                     localEmailTemplates.add(emailType);
                 }
             }
-            // Transforms (Rhai scripts) — issue #1196. Before this, `sync diff`
-            // ignored scripts entirely, so a body that drifted between the local
-            // `.rhai` and the server's active config silently read as Synced. We
-            // list the server scripts (header only) and read the local file
-            // contents so the comparison below can hash both sides.
-            let scriptItemsDiff = [];
-            try {
-                const scriptsResult = await client.listScripts(resolvedAppId);
-                scriptItemsDiff = scriptsResult.items || [];
-            }
-            catch {
-                // Older server without the scripts route — treat as no scripts.
-            }
+            // Transforms (Rhai scripts) — issue #1196. Content-aware comparison
+            // against the server's active-config body. The server list was fetched
+            // through the ok/error gate above (`scriptItemsDiff`); the local `.rhai`
+            // dir is read only when that fetch succeeded.
             const remoteScripts = new Map(scriptItemsDiff
                 .filter((s) => s?.name)
                 .map((s) => [s.name, s]));
             const localScripts = new Map();
             const transformsDirPath = join(configDir, "transforms");
-            if (existsSync(transformsDirPath)) {
+            if (scriptsOutcomeDiff.ok && existsSync(transformsDirPath)) {
                 for (const file of readdirSync(transformsDirPath).filter((f) => f.endsWith(".rhai"))) {
                     const name = basename(file, ".rhai");
                     localScripts.set(name, readFileSync(join(transformsDirPath, file), "utf-8"));
                 }
             }
-            // Config vars — issue #1423. Before this, `sync diff` ignored vars
-            // entirely, so an add/remove/value-drift between the local `vars.toml`
-            // and the server silently read as no difference right before a push
-            // would change or unset them. Fetch the remote vars (value included —
-            // vars are non-secret) and read the local `vars.toml` so the comparison
-            // below can report added/removed/modified vars.
-            let remoteVarItemsDiff = [];
-            try {
-                remoteVarItemsDiff = await client.listAppConfigVars(resolvedAppId);
-            }
-            catch {
-                // Older server without the vars route — treat as no remote vars.
-            }
+            // Config vars — issue #1423. The remote vars were fetched through the
+            // ok/error gate above (`remoteVarItemsDiff`); the local `vars.toml` is
+            // read only when that fetch succeeded.
             const remoteVars = new Map(remoteVarItemsDiff
                 .filter((v) => typeof v?.key === "string")
                 .map((v) => [v.key, String(v.value ?? "")]));
             const localVars = new Map();
             const varsTomlPathDiff = join(configDir, "vars.toml");
-            if (existsSync(varsTomlPathDiff)) {
+            if (varsOutcomeDiff.ok && existsSync(varsTomlPathDiff)) {
                 const parsed = parseTomlFile(varsTomlPathDiff);
                 for (const [key, rawValue] of Object.entries(parsed)) {
                     if (typeof rawValue === "string")
@@ -5739,6 +6775,13 @@ Directory Structure:
             // is the point. Prior sync state is the discriminator, exactly as it is
             // for the pull-side prune.
             const localOnlyStatus = (slot, key) => classifyLocalOnly(syncState?.entities, slot, key);
+            // Issue #1655: a server entity with no local file also means two
+            // different things. If a prior pull managed the key, the operator
+            // removed its local TOML and `push --prune` will DELETE the remote
+            // entity; if it was never synced, it was authored server-side and is
+            // left alone. Prior sync state is the discriminator, mirroring the
+            // local-only split above.
+            const remoteOnlyStatus = (slot, key) => classifyRemoteOnly(syncState?.entities, slot, key);
             // Integrations
             for (const key of localIntegrations) {
                 if (!remoteIntegrations.has(key)) {
@@ -5750,7 +6793,7 @@ Directory Structure:
             }
             for (const key of remoteIntegrations) {
                 if (!localIntegrations.has(key)) {
-                    differences.push({ type: "integration", key, status: "remote only" });
+                    differences.push({ type: "integration", key, status: remoteOnlyStatus("integrations", key) });
                 }
             }
             // Webhooks
@@ -5764,7 +6807,7 @@ Directory Structure:
             }
             for (const key of remoteWebhooks) {
                 if (!localWebhooks.has(key)) {
-                    differences.push({ type: "webhook", key, status: "remote only" });
+                    differences.push({ type: "webhook", key, status: remoteOnlyStatus("webhooks", key) });
                 }
             }
             // Cron Triggers
@@ -5778,7 +6821,7 @@ Directory Structure:
             }
             for (const key of remoteCronTriggers) {
                 if (!localCronTriggers.has(key)) {
-                    differences.push({ type: "cron-trigger", key, status: "remote only" });
+                    differences.push({ type: "cron-trigger", key, status: remoteOnlyStatus("cronTriggers", key) });
                 }
             }
             // Blob Buckets
@@ -5792,7 +6835,7 @@ Directory Structure:
             }
             for (const key of remoteBlobBuckets) {
                 if (!localBlobBuckets.has(key)) {
-                    differences.push({ type: "blob-bucket", key, status: "remote only" });
+                    differences.push({ type: "blob-bucket", key, status: remoteOnlyStatus("blobBuckets", key) });
                 }
             }
             // Prompts
@@ -5806,7 +6849,7 @@ Directory Structure:
             }
             for (const key of remotePrompts) {
                 if (!localPrompts.has(key)) {
-                    differences.push({ type: "prompt", key, status: "remote only" });
+                    differences.push({ type: "prompt", key, status: remoteOnlyStatus("prompts", key) });
                 }
             }
             // Workflows — #1175: content-aware comparison.
@@ -5874,8 +6917,17 @@ Directory Structure:
                 differences.push({ type: "workflow", key, status, hint });
             }
             for (const key of remoteWorkflows) {
+                // Platform-owned internal workflows (`__internal.*`) are never part of
+                // an app's config tree, so they must not show as `remote only` (the
+                // reporter's `Remote only: 1 · __internal.reindex-instances`). Removing
+                // them from every synced surface is #1660's job; until it lands, skip
+                // the prefix here so this diff's coverage extension doesn't surface a
+                // spurious remote-only row. When #1660 lands it replaces this with its
+                // `isPlatformOwnedEntity` predicate.
+                if (key && key.startsWith("__internal."))
+                    continue;
                 if (!localWorkflows.has(key)) {
-                    differences.push({ type: "workflow", key, status: "remote only" });
+                    differences.push({ type: "workflow", key, status: remoteOnlyStatus("workflows", key) });
                 }
             }
             // Email Templates
@@ -5889,7 +6941,7 @@ Directory Structure:
             }
             for (const key of remoteEmailTemplates) {
                 if (!localEmailTemplates.has(key)) {
-                    differences.push({ type: "email-template", key, status: "remote only" });
+                    differences.push({ type: "email-template", key, status: remoteOnlyStatus("emailTemplates", key) });
                 }
             }
             // Transforms (Rhai scripts) — issue #1196. Content-aware, mirroring
@@ -5938,13 +6990,106 @@ Directory Structure:
             }
             for (const name of remoteScripts.keys()) {
                 if (!localScripts.has(name)) {
-                    differences.push({ type: "transform", key: name, status: "remote only" });
+                    differences.push({ type: "transform", key: name, status: remoteOnlyStatus("scripts", name) });
                 }
             }
             // Config vars — issue #1423 (see `diffVars`).
             for (const row of diffVars(localVars, remoteVars)) {
                 differences.push(row);
             }
+            // Database-config types (issue #1485). rule-sets, group/collection-type
+            // and metadata-category configs carry their full entity in the list
+            // response (pull serializes straight from it), so content is compared
+            // directly; database-types need a per-type ops/subscriptions fetch (see
+            // below). Content comparison is a preview of `sync pull` (pull would
+            // rewrite the local TOML to match running state), exactly like the
+            // workflow/transform blocks.
+            const compareConfigType = (typeLabel, slot, localParsed, remoteEntities, hashLocal, hashRemote, contentComparable) => {
+                for (const [key, parsed] of localParsed) {
+                    if (!remoteEntities.has(key)) {
+                        differences.push({ type: typeLabel, key, status: localOnlyStatus(slot, key) });
+                        continue;
+                    }
+                    let status = "exists";
+                    let hint;
+                    if (!contentComparable) {
+                        // Rule-set list failed, so a `ruleSetName` reference can't be
+                        // resolved on either side — decline the content comparison rather
+                        // than risk a false `Modified`.
+                        hint = "content not compared (rule sets unavailable)";
+                    }
+                    else {
+                        try {
+                            if (hashLocal(parsed) !== hashRemote(remoteEntities.get(key))) {
+                                status = "modified";
+                                hint = "run `sync pull` to rewrite the local TOML to match running state";
+                            }
+                        }
+                        catch {
+                            // A malformed local file must not abort the whole diff.
+                            hint = "content not compared (comparison failed)";
+                        }
+                    }
+                    differences.push({ type: typeLabel, key, status, hint });
+                }
+                for (const key of remoteEntities.keys()) {
+                    if (!localParsed.has(key)) {
+                        differences.push({ type: typeLabel, key, status: remoteOnlyStatus(slot, key) });
+                    }
+                }
+            };
+            compareConfigType("rule-set", "ruleSets", localRuleSetsParsed, remoteRuleSets, (p) => hashLocalRuleSetForDiff(p), (e) => hashRemoteRuleSetForDiff(e), true);
+            compareConfigType("group-type-config", "groupTypeConfigs", localGroupTypeConfigsParsed, remoteGroupTypeConfigs, (p) => hashLocalGroupTypeConfigForDiff(p, ruleSetNameToIdDiff), (e) => hashRemoteGroupTypeConfigForDiff(e, ruleSetIdToNameDiff, ruleSetNameToIdDiff), ruleSetsOk);
+            compareConfigType("collection-type-config", "collectionTypeConfigs", localCollectionTypeConfigsParsed, remoteCollectionTypeConfigs, (p) => hashLocalCollectionTypeConfigForDiff(p, ruleSetNameToIdDiff), (e) => hashRemoteCollectionTypeConfigForDiff(e, ruleSetIdToNameDiff, ruleSetNameToIdDiff), ruleSetsOk);
+            compareConfigType("metadata-category-config", "metadataCategoryConfigs", localMetadataCategoryParsed, remoteMetadataCategoryConfigs, (p) => hashLocalMetadataCategoryForDiff(p), (e) => hashRemoteMetadataCategoryForDiff(e), true);
+            // database-types: the list carries only the type header, so operations
+            // and subscriptions are fetched per type (mirroring pull) before the
+            // content comparison. A per-type fetch failure degrades that one row to
+            // "content not compared" rather than aborting the whole diff (#1485
+            // edge case). Both operations AND subscriptions are included so an
+            // op-only or subscription-only change is not falsely reported as Synced.
+            for (const [key, parsed] of localDatabaseTypesParsed) {
+                const remote = remoteDatabaseTypes.get(key);
+                if (!remote) {
+                    differences.push({ type: "database-type", key, status: localOnlyStatus("databaseTypes", key) });
+                    continue;
+                }
+                let status = "exists";
+                let hint;
+                if (!ruleSetsOk) {
+                    hint = "content not compared (rule sets unavailable)";
+                }
+                else {
+                    const [opsOutcome, subsOutcome] = await Promise.all([
+                        attemptFetch(() => client.listDatabaseTypeOperations(resolvedAppId, key)),
+                        attemptFetch(() => client.listDatabaseTypeSubscriptions(resolvedAppId, key)),
+                    ]);
+                    if (!opsOutcome.ok || !subsOutcome.ok) {
+                        hint = "content not compared (fetch failed)";
+                    }
+                    else {
+                        try {
+                            const operations = Array.isArray(opsOutcome.value) ? opsOutcome.value : [];
+                            const subscriptions = Array.isArray(subsOutcome.value) ? subsOutcome.value : [];
+                            const remoteHash = hashRemoteDatabaseTypeForDiff(remote, operations, subscriptions, ruleSetIdToNameDiff, ruleSetNameToIdDiff);
+                            const localHash = hashLocalDatabaseTypeForDiff(parsed, ruleSetNameToIdDiff);
+                            if (remoteHash !== localHash) {
+                                status = "modified";
+                                hint = "run `sync pull` to rewrite the local TOML to match running state";
+                            }
+                        }
+                        catch {
+                            hint = "content not compared (comparison failed)";
+                        }
+                    }
+                }
+                differences.push({ type: "database-type", key, status, hint });
+            }
+            for (const key of remoteDatabaseTypes.keys()) {
+                if (!localDatabaseTypesParsed.has(key)) {
+                    differences.push({ type: "database-type", key, status: remoteOnlyStatus("databaseTypes", key) });
+                }
+            }
             // Compare test cases for synced prompts and workflows
             const testCaseDiffs = [];
             // Helper to compare test cases for a block
@@ -5995,7 +7140,11 @@ Directory Structure:
             divider();
             const localOnly = differences.filter((d) => d.status === LOCAL_ONLY_NEW);
             const localOnlyAbsent = differences.filter((d) => d.status === LOCAL_ONLY_ABSENT);
-            const remoteOnly = differences.filter((d) => d.status === "remote only");
+            // #1655: a server entity with no local file, split by whether a prior
+            // pull managed it. Managed → `push --prune` will delete it; unmanaged
+            // (never synced, authored server-side) → left alone.
+            const remoteOnlyWillDelete = differences.filter((d) => d.status === REMOTE_ONLY_WILL_DELETE);
+            const remoteOnlyUnmanaged = differences.filter((d) => d.status === REMOTE_ONLY_UNMANAGED);
             const modified = differences.filter((d) => d.status === "modified");
             const existing = differences.filter((d) => d.status === "exists");
             if (localOnly.length > 0) {
@@ -6016,13 +7165,23 @@ Directory Structure:
                 }
                 console.log();
             }
-            if (remoteOnly.length > 0) {
-                warn("Remote only (not in local config):");
-                for (const d of remoteOnly) {
+            // #1655: managed entities whose local file is gone — `push --prune`
+            // deletes these (the git-committed file deletion is the intent record).
+            if (remoteOnlyWillDelete.length > 0) {
+                warn("Remote only — managed (will delete with `push --prune`):");
+                for (const d of remoteOnlyWillDelete) {
                     console.log(`  ${chalk.red("-")} ${d.type}: ${d.key}`);
                 }
                 console.log();
             }
+            // #1655: server entities that were never synced — push leaves them be.
+            if (remoteOnlyUnmanaged.length > 0) {
+                info("Remote only — unmanaged (left alone, never synced):");
+                for (const d of remoteOnlyUnmanaged) {
+                    console.log(`  ${chalk.dim("-")} ${d.type}: ${d.key}`);
+                }
+                console.log();
+            }
             // #1175: workflows whose deployed content differs from the local TOML.
             // Framed as a preview of `sync pull` — pull would rewrite these files
             // to match what's actually running (NOT "push would send").
@@ -6041,6 +7200,19 @@ Directory Structure:
                     console.log(`  ${chalk.dim("=")} ${d.type}: ${d.key}${hint}`);
                 }
             }
+            // #1485: types whose remote list could not be fetched are excluded from
+            // the comparison entirely. Printing them explicitly is what keeps the
+            // roll-up below from being misread as exhaustive — with every list
+            // fetch succeeding this section is empty and every push-handled type
+            // appears in the itemized sections or the counts; otherwise the excluded
+            // types are named here rather than silently dropped.
+            if (notCompared.length > 0) {
+                console.log();
+                warn("Not compared (excluded from the counts below):");
+                for (const nc of notCompared) {
+                    console.log(`  ${chalk.yellow("?")} ${nc.type} (${nc.reason})`);
+                }
+            }
             // Show test case differences
             const tcLocalOnly = testCaseDiffs.filter((d) => d.status === LOCAL_ONLY_NEW);
             const tcRemoteOnly = testCaseDiffs.filter((d) => d.status === "remote only");
@@ -6061,9 +7233,13 @@ Directory Structure:
             divider();
             keyValue("Local only (new)", localOnly.length);
             keyValue("Local only (absent from export)", localOnlyAbsent.length);
-            keyValue("Remote only", remoteOnly.length);
+            keyValue("Remote only (will delete with --prune)", remoteOnlyWillDelete.length);
+            keyValue("Remote only (unmanaged, left alone)", remoteOnlyUnmanaged.length);
             keyValue("Modified", modified.length);
             keyValue("Synced", existing.length);
+            if (notCompared.length > 0) {
+                keyValue("Not compared", notCompared.map((nc) => `${nc.type} (${nc.reason})`).join(", "));
+            }
             if (testCaseDiffs.length > 0) {
                 keyValue("Test Cases (local only)", tcLocalOnly.length);
                 keyValue("Test Cases (remote only)", tcRemoteOnly.length);