primitive-admin 1.1.0-alpha.64 → 1.1.0-alpha.65

package/dist/src/commands/sync.js

@@ -27,7 +27,7 @@ import { buildWorkflowPayloadFromToml, parseWorkflowExpressionsToml, } from "../
 // payload builder so the diff normalizer and the wire cannot disagree.
 import { WORKFLOW_MODEL_DEFAULTS } from "../lib/workflow-defaults.js";
 // #2644 — the one definition per configuration object, vendored from the server.
-import { BLOB_BUCKET_TABLE, COLLECTION_TYPE_CONFIG_TABLE, CRON_TRIGGER_TABLE, DATABASE_TYPE_TABLE, EMAIL_TEMPLATE_TABLE, GROUP_TYPE_CONFIG_TABLE, INTEGRATION_TABLE, METADATA_CATEGORY_CONFIG_TABLE, PROMPT_CONFIG_TABLE, PROMPT_TABLE, RULE_SET_TABLE, TEST_CASE_SURFACE, TEST_CASE_TABLE, WEBHOOK_TABLE, WORKFLOW_TABLE, findMisshapenTables, findUnknownDocumentKeys, findUnknownServerKeys, findUnknownTomlKeys, misshapenTableMessage, unrecognizedPullKeysMessage, unrecognizedPushKeysMessage, unrecognizedPushTablesMessage, warnUnrecognizedServerKeys, } from "../lib/config-surface.js";
+import { BLOB_BUCKET_TABLE, COLLECTION_TYPE_CONFIG_TABLE, CRON_TRIGGER_TABLE, DATABASE_TYPE_TABLE, EMAIL_TEMPLATE_TABLE, GROUP_TYPE_CONFIG_TABLE, INTEGRATION_TABLE, METADATA_CATEGORY_CONFIG_TABLE, PROMPT_CONFIG_TABLE, PROMPT_TABLE, RULE_SET_TABLE, TEST_CASE_SURFACE, TEST_CASE_TABLE, WEBHOOK_TABLE, WORKFLOW_TABLE, findMisshapenTables, findUnknownDocumentKeys, findUnknownServerKeys, findUnknownTomlKeys, misshapenTableMessage, retiredConfigKey, unrecognizedPullKeysMessage, unrecognizedPushKeysMessage, unrecognizedPushTablesMessage, warnUnrecognizedServerKeys, } from "../lib/config-surface.js";
 import { buildPayloadFromToml, projectEntityToPayload, projectRecordToToml, tomlOwned, } from "../lib/config-payload.js";
 import { CONFIG_SURFACES, isEmptyForEmit, } from "../lib/generated-config-surfaces.js";
 import { detectLayout, migrateLegacyToV2 } from "../lib/block-layout.js";
@@ -151,7 +151,7 @@ export function shouldPushExpandedFile(parsed, storedHash) {
  * value that pushes successfully hashes equal to its read-back — see
  * `normalizeWorkflowTomlDefaults`.
  */
-const WORKFLOW_LOWERCASED_FIELDS = ["status", "dequeueOrder"];
+const WORKFLOW_LOWERCASED_FIELDS = ["dequeueOrder"];
 const WORKFLOW_FLOORED_FIELDS = [
     "perUserMaxRunning",
     "perUserMaxQueued",
@@ -221,15 +221,15 @@ export function resolveActiveWorkflowConfig(workflow, configs) {
  *      server's accepted-value canonicalization
  *      (`src/workflows/config/workflow-field-handlers.ts`). A value the server
  *      would REJECT is left alone: push fails loudly for those, so there is
- *      nothing to preview. #2743 — without this, `status = "ACTIVE"` or
+ *      nothing to preview. #2743 — without this, `dequeueOrder = "LIFO"` or
  *      `perUserMaxRunning = 4.9` pushes fine and then reports Modified forever.
  *   4. Fill the model defaults (`WORKFLOW_MODEL_DEFAULTS`) for what the file
  *      omits. `perAppMax*` / `queueTtlSeconds` joined that list in #1177: once
  *      the pull serializer emitted them (a GET always returns them, they carry
  *      a non-null model default), an unchanged workflow hashed unequal to a
  *      local TOML that omits them — a false `modified` that made `config pull`
- *      rewrite the file just to inject defaults. `status` joined it in #2743,
- *      when push began sending `draft` for an omitted status.
+ *      rewrite the file just to inject defaults. (`status` was on this list
+ *      until #2803 took availability off the config wire entirely.)
  *   5. Fill `activeConfigName` with the name the server itself creates
  *      (`default`), so a hand-authored file that never named a config compares
  *      equal to the workflow that pushing it produces (#2743). This is the
@@ -1016,7 +1016,7 @@ export function workflowActiveConfigNameUnresolvable(configDir, key, localParsed
  * repeats forever because no push changes it. But the repo does not describe
  * which configuration is live, and only `config pull` records it, so the fact is
  * carried as a hint on the Synced row — the same way an operational disable is
- * (`operationalDisableHint`). The server-created `default` is the shape a
+ * (`outOfServiceHint`). The server-created `default` is the shape a
  * hand-authored file already means, so it is silent.
  *
  * Pure and non-throwing, like every other diff predicate. Returns the existing
@@ -1032,16 +1032,70 @@ export function unmanagedActiveConfigHint(localParsed, workflow, configs, existi
         `it alone — run \`config pull\` to record it in [workflow].activeConfigName`;
     return existingHint ? `${existingHint}; ${note}` : note;
 }
+/**
+ * Drop the archived rows from a pull listing (#2803).
+ *
+ * A tombstone is retired, not configuration. Exporting one wrote a file the
+ * repo then claimed to describe — and, once `status` left the TOML surface, a
+ * file whose very next push would fail on the `status` line it carried.
+ * `config push --prune` is the path that reclaims an archived row; pull's job
+ * is to describe what is configured.
+ */
+export function skipArchivedForPull(items) {
+    return (items || []).filter((item) => String(item?.status ?? "").toLowerCase() !== "archived");
+}
+/**
+ * The sync-state entries a pull keeps for the archived rows it did NOT export
+ * (#2803).
+ *
+ * Pull removes a tombstone's file, and prune candidates come only from prior
+ * sync state — so dropping the state entry with the file would strand the row:
+ * no file to delete, no managed key to prune, and (for webhooks and cron
+ * triggers) a cap slot and a reserved key nothing could ever reclaim, which is
+ * the exact failure #2232 fixed. So the pull records the tombstone instead: no
+ * file, but a managed entry carrying the archived row's CURRENT `modifiedAt`,
+ * so the next opt-in, confirmed `config push --prune` point-reads it, finds it
+ * unchanged, and hard-deletes it — the reclamation path the model promises.
+ *
+ * Only keys the config tree already managed are recorded. A row archived
+ * server-side that this repo never described is not this repo's to delete.
+ *
+ * Pure, so it is unit-testable without a live server.
+ */
+export function archivedTombstoneEntries(items, select, managedKeys) {
+    const managed = new Set(managedKeys);
+    const entries = {};
+    for (const item of items || []) {
+        if (String(item?.status ?? "").toLowerCase() !== "archived")
+            continue;
+        const key = select.keyOf(item);
+        const id = select.idOf(item);
+        if (!key || !id || !managed.has(key))
+            continue;
+        entries[key] = { id, modifiedAt: item.modifiedAt || "" };
+    }
+    return entries;
+}
 /**
  * The `config diff` annotation for an object an operator took out of service
- * (issue #2645, criterion 9).
+ * (issue #2645, criterion 9; #2803).
+ *
+ * Availability is deliberately not a TOML key, so an object that is out of
+ * service is NOT drift — the committed configuration still describes it
+ * exactly. Saying so out loud is the point: the reason the control exists is
+ * that an out-of-band write used to make `config diff` report a difference
+ * nobody intentionally created (#1976). Reporting it as a hint on an
+ * otherwise-`Synced` row is what keeps that promise visible instead of merely
+ * true.
+ *
+ * Reads either spelling: the canonical `status: "inactive"` for a type that has
+ * cut over to #2803's single control, and the superseded
+ * `operationallyDisabled` boolean for one that has not yet.
  *
- * `operationallyDisabled` is deliberately not a TOML key, so a disabled object
- * is NOT drift — the committed configuration still describes it exactly. Saying
- * so out loud is the point: the reason the toggle exists is that an out-of-band
- * write used to make `config diff` report a difference nobody intentionally
- * created (#1976). Reporting it as a hint on an otherwise-`Synced` row is what
- * keeps that promise visible instead of merely true.
+ * An ARCHIVED row gets its own annotation. `config pull` no longer exports
+ * tombstones, so without one an archived webhook or integration whose file is
+ * still in the tree read as plain `Synced` — the one status where "the server
+ * has exactly what the file says" is most misleading.
  *
  * When the row already carries a hint — a real content difference — the toggle
  * is APPENDED rather than substituted: the drift is the part that needs acting
@@ -1049,12 +1103,19 @@ export function unmanagedActiveConfigHint(localParsed, workflow, configs, existi
  *
  * Pure, so it is unit-testable without a live server.
  */
-export function operationalDisableHint(remote, existingHint) {
-    if (remote?.operationallyDisabled !== true)
+export function outOfServiceHint(remote, existingHint) {
+    const stored = String(remote?.status ?? "").toLowerCase();
+    if (stored === "archived") {
+        return existingHint
+            ? `${existingHint}; archived`
+            : "archived; `config push --prune` reclaims it";
+    }
+    const outOfService = remote?.operationallyDisabled === true || stored === "inactive";
+    if (!outOfService)
         return existingHint;
     return existingHint
-        ? `${existingHint}; operationally disabled`
-        : "operationally disabled; configuration unchanged";
+        ? `${existingHint}; inactive`
+        : "inactive; configuration unchanged";
 }
 /**
  * Serialize an integration DETAIL response to its `integrations/<key>.toml`.
@@ -1829,23 +1890,6 @@ export function rewriteWorkflowSchemasToNative(rawToml, workflowKey = "", log =
  * are checked one by one and the unknown keys reported together, so a typo in
  * the third `[[configs]]` block is as loud as one in the first.
  */
-/**
- * Keys deliberately RETIRED from a table's TOML surface (#2645), each with the
- * guidance the generic unrecognized-key hint would get wrong: "upgrade the
- * CLI" is exactly backwards for a key this CLI removed on purpose. Every
- * pre-#2645 pull wrote a `state` line into cron-trigger files, so existing
- * repos hit this on their first push after upgrading — the failure is
- * deliberate (sponsor decision at the approval gate, 2026-08-15): the line has
- * to be removed, not silently ignored, so the file never claims a pause state
- * push does not apply.
- */
-const RETIRED_TOML_KEYS = {
-    cronTrigger: {
-        state: "`state` is no longer authored in TOML (#2645). Pausing is " +
-            "`primitive cron-triggers pause|resume`, and the remaining lifecycle " +
-            "values are server-owned. Delete the line and push again.",
-    },
-};
 export function configUnknownKeyError(filePath, tomlData, table) {
     const at = table.tomlPath.reduce((node, segment) => (node == null ? node : node[segment]), tomlData);
     const entries = table.repeated
@@ -1860,13 +1904,20 @@ export function configUnknownKeyError(filePath, tomlData, table) {
     }
     if (unknown.size === 0)
         return null;
+    // #2645/#2803 — a key this CLI removed on purpose gets the guidance stated
+    // once beside the definitions (`src/config-surface/retired-keys.ts`), not the
+    // generic "check the spelling, or upgrade the CLI" hint, which is exactly
+    // backwards for it. The server's create/update handlers read the same table.
     const prefix = table.tomlPath.join(".");
-    const retired = RETIRED_TOML_KEYS[prefix] ?? {};
-    const retiredHere = [...unknown].filter((k) => k in retired).sort();
-    const trulyUnknown = [...unknown].filter((k) => !(k in retired)).sort();
+    const retiredHere = [...unknown]
+        .filter((k) => retiredConfigKey(prefix, k))
+        .sort();
+    const trulyUnknown = [...unknown]
+        .filter((k) => !retiredConfigKey(prefix, k))
+        .sort();
     const messages = [];
     for (const key of retiredHere) {
-        messages.push(`${filePath}: ${prefix}.${key} — ${retired[key]}`);
+        messages.push(`${filePath}: ${prefix}.${key} — ${retiredConfigKey(prefix, key).toml}`);
     }
     if (trulyUnknown.length > 0) {
         messages.push(unrecognizedPushKeysMessage(filePath, table.tomlPath, trulyUnknown));
@@ -2096,7 +2147,7 @@ export function serializeWorkflow(workflow, draft, configs, logger) {
     // `key` and `activeConfigName` are authored keys that are NOT part of the
     // write field surface — declared in the definition's `tomlOnlyKeys`, with the
     // reason there. They keep their historical positions (first, and right after
-    // `status`) so migrating to the definition does not reshuffle existing files.
+    // `description`) so migrating to the definition does not reshuffle files.
     const workflowTable = { key: workflow.workflowKey };
     for (const field of WORKFLOW_TABLE.fields) {
         const produce = PULL_VALUE[field.field];
@@ -2116,7 +2167,10 @@ export function serializeWorkflow(workflow, draft, configs, logger) {
                             ? undefined
                             : value;
         }
-        if (field.field === "status") {
+        // #2803 — this used to hang off `status`, which has left the field surface
+        // (availability is server-owned). `description` is now the key it follows,
+        // which keeps `activeConfigName` in the same place in existing files.
+        if (field.field === "description") {
             workflowTable.activeConfigName = activeConfigName;
         }
     }
@@ -2764,6 +2818,39 @@ function normalizeRuleSetRefForDiff(entity, ruleSetNameToId, label) {
         entity._unresolvedRuleSetName = referencedName;
     }
 }
+/**
+ * A field's value as the comparison reads it — the VALUE, not its spelling
+ * (#2869).
+ *
+ * Only a declared `number` needs this, and only because the server genuinely
+ * accepts both spellings: `temperature` and `topP` are `StringField`s on the
+ * model, stored as strings and returned parsed, so a file authored
+ * `temperature = "0.2"` and a server holding `0.2` describe one value. Compared
+ * as spellings it is a `Modified` no push can clear — push sends the string,
+ * the server stores it, pull writes the number back, and the difference
+ * returns — so the operator's only remedy is to overwrite the local file.
+ *
+ * A string that is not a number is left exactly as it is: `temperature =
+ * "warm"` is a real difference from `0.2`, and one the server will reject.
+ *
+ * "Is a number" is decided by the grammar the SERVER reads the string with —
+ * `parseFloat`, on the way back out — not by JavaScript's `Number`, which is
+ * wider: `Number("0x1")` is 1 where `parseFloat("0x1")` is 0, so treating that
+ * file as equal to a server holding 1 would skip a push whose payload means
+ * something else, re-creating in a corner the very silence this issue is about.
+ * So only what `parseFloat` consumes WHOLE — sign, digits, one dot, an
+ * exponent — normalizes; anything else stays the string it is.
+ */
+const DECIMAL_NUMBER = /^[+-]?(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?$/;
+function comparableFieldValue(type, value) {
+    if (type !== "number" || typeof value !== "string")
+        return value;
+    const trimmed = value.trim();
+    if (!DECIMAL_NUMBER.test(trimmed))
+        return value;
+    const asNumber = Number(trimmed);
+    return Number.isFinite(asNumber) ? asNumber : value;
+}
 /**
  * `config diff`'s hash for one configuration object, over the field set its
  * DEFINITION declares (#2644 criterion 8).
@@ -2785,7 +2872,7 @@ function normalizeRuleSetRefForDiff(entity, ruleSetNameToId, label) {
 export function projectConfigForComparison(table, entity, extras = {}) {
     const projected = {};
     for (const field of table.fields) {
-        const value = entity?.[field.field];
+        const value = comparableFieldValue(field.type, entity?.[field.field]);
         if (value === undefined)
             continue;
         // #2731 — `emit: "whenSet"` says pull OMITS the key when the value is
@@ -4955,6 +5042,9 @@ export function registerConfigSyncCommands(sync) {
         }
         info(`Pulling configuration for app ${resolvedAppId}...`);
         try {
+            // The unfiltered listings, kept so the archived rows this pull declines
+            // to export can still be recorded as tombstones in sync state (#2803).
+            const integrationTombstoneCandidates = [];
             // Fetch all data. Issue #1659: prune decides whether a local file's
             // entity still exists server-side, so every fetch that establishes
             // presence must report success or failure explicitly — an error that
@@ -4965,7 +5055,14 @@ export function registerConfigSyncCommands(sync) {
             // an explicit outcome instead.
             const [settings, integrationItems, promptItems, workflowItems, emailTemplatesOutcome] = await Promise.all([
                 client.getAppSettings(resolvedAppId).catch(() => null),
-                fetchAll((p) => client.listIntegrations(resolvedAppId, p)),
+                // #2803 — an archived integration is retired, not configuration, so
+                // pull does not export it (same rule as webhooks). Its tombstone is
+                // recorded in sync state (see `archivedTombstoneEntries`) so
+                // `--prune` can still reclaim it.
+                fetchAll((p) => client.listIntegrations(resolvedAppId, p)).then((items) => {
+                    integrationTombstoneCandidates.push(...items);
+                    return skipArchivedForPull(items);
+                }),
                 fetchAll((p) => client.listPrompts(resolvedAppId, p)),
                 fetchAll((p) => client.listWorkflows(resolvedAppId, p)),
                 attemptFetch(() => client.listEmailTemplates(resolvedAppId)),
@@ -5232,8 +5329,14 @@ export function registerConfigSyncCommands(sync) {
                 };
                 info(`  Wrote integrations/${filename}`);
             }
-            // Pull webhooks
-            const webhookItems = await fetchAll((p) => client.listWebhooks(resolvedAppId, p));
+            // Pull webhooks. #2803 — an ARCHIVED webhook is retired, not
+            // configuration, so it is not exported: writing a tombstone into the
+            // config tree produced a file whose own next push would fail (status
+            // is no longer authorable), and left the archived row looking like
+            // something the repo still describes. `--prune` is what reclaims it —
+            // which is why the tombstone still gets a sync-state entry below.
+            const webhookTombstoneCandidates = await fetchAll((p) => client.listWebhooks(resolvedAppId, p));
+            const webhookItems = skipArchivedForPull(webhookTombstoneCandidates);
             const webhooks = selectPull("webhook", await Promise.all(webhookItems.map((w) => client.getWebhook(resolvedAppId, w.webhookId))), (w) => w.webhookKey);
             const webhooksDir = join(configDir, "webhooks");
             mkdirSync(webhooksDir, { recursive: true });
@@ -5872,6 +5975,73 @@ export function registerConfigSyncCommands(sync) {
                     }
                 }
             }
+            // #2803 — the tombstones. This pull exported no file for an archived
+            // webhook or integration and (above) removed the one a prior pull had
+            // written, so without an entry here the row would drop out of managed
+            // state entirely: `config push --prune` collects its candidates from
+            // this map, and a row it cannot see is a row nothing can reclaim. The
+            // entry carries the archived row's CURRENT `modifiedAt` so the prune
+            // point-read reads "unchanged" rather than "edited out-of-band".
+            for (const [slot, tombstones] of [
+                [
+                    "integrations",
+                    archivedTombstoneEntries(integrationTombstoneCandidates, {
+                        keyOf: (i) => i.integrationKey,
+                        idOf: (i) => i.integrationId,
+                    }, Object.keys(priorEntities.integrations ?? {})),
+                ],
+                [
+                    "webhooks",
+                    archivedTombstoneEntries(webhookTombstoneCandidates, {
+                        keyOf: (w) => w.webhookKey,
+                        idOf: (w) => w.webhookId,
+                    }, Object.keys(priorEntities.webhooks ?? {})),
+                ],
+            ]) {
+                const built = entitiesBySlot[slot];
+                const resourceType = SYNC_RESOURCE_TYPES.find((rt) => rt.stateSlot === slot);
+                if (!built || !resourceType)
+                    continue;
+                for (const [key, entry] of Object.entries(tombstones)) {
+                    if (key in built)
+                        continue;
+                    if (!selectionIncludesKey(pullSelection, resourceType.label, key)) {
+                        continue;
+                    }
+                    built[key] = entry;
+                    info(`  No ${resourceType.dir}/${resourceType.fileFromKey(key)} — ` +
+                        "the entity is archived; `config push --prune` reclaims it");
+                }
+            }
+            // Cron triggers reach the same place by a different road: the app-API
+            // listing filters archived rows server-side, so pull cannot see a
+            // tombstone in the list at all. The managed keys the listing dropped are
+            // point-read by id instead — a row that still answers is archived (a
+            // real delete 404s), and gets the same tombstone entry.
+            if (cronTriggersOutcome.ok) {
+                const listedCronKeys = new Set(cronTriggerItems.map((t) => t.triggerKey));
+                for (const [key, prior] of Object.entries((priorEntities.cronTriggers ?? {}))) {
+                    if (listedCronKeys.has(key))
+                        continue;
+                    if (key in finalCronTriggerEntities)
+                        continue;
+                    if (!prior?.id)
+                        continue;
+                    if (!selectionIncludesKey(pullSelection, "cron-trigger", key)) {
+                        continue;
+                    }
+                    const detail = await attemptFetch(() => client.getCronTrigger(resolvedAppId, prior.id));
+                    const row = detail.ok ? detail.value : null;
+                    if (String(row?.status ?? "").toLowerCase() !== "archived")
+                        continue;
+                    finalCronTriggerEntities[key] = {
+                        id: prior.id,
+                        modifiedAt: row.modifiedAt || "",
+                    };
+                    info(`  No cron-triggers/${key}.toml — the trigger is archived; ` +
+                        "`config push --prune` reclaims it");
+                }
+            }
             // Under `--only`, every object this pull did not look at keeps its
             // prior state entry. Its file was left exactly as it was, so dropping
             // the record would make the next pull treat a managed file as
@@ -7605,11 +7775,59 @@ export function registerConfigSyncCommands(sync) {
             const promptsDir = join(configDir, "prompts");
             if (existsSync(promptsDir)) {
                 const files = selectFiles("prompt", promptsDir, readdirSync(promptsDir).filter((f) => f.endsWith(".toml")));
+                // #2869 — prompts join the live-state reconcile (#2731 B3). #2748
+                // gave the type diff's comparator and left push on the manifest byte
+                // hash, so the two commands answered "changed?" from different
+                // sources and disagreed in both directions: a comment moved the bytes
+                // and push planned an update diff read as Synced, and a file whose
+                // bytes had not moved was skipped however far its CONTENT had drifted
+                // from the server, so a reported `Modified` could never be pushed
+                // away. Both are the same fix — push decides from the projection diff
+                // compares, against the entity diff compares it to.
+                const promptSpec = configDiffSpec("prompt");
+                // The list says WHICH prompts the server has (and under which id);
+                // the `[[configs]]` the comparison needs are only on the detail, so
+                // that is fetched inside the loop for the selected file that needs
+                // it. A `--only` push therefore reads only what it was asked to push.
+                //
+                // A failed list is NOT an empty list: treating it as one would send
+                // every prompt down the create path. It degrades the section to the
+                // manifest byte-hash gate with the type named, like every other
+                // converted type.
+                const livePromptIds = new Map();
+                let promptsLiveOk = true;
+                if (files.length > 0) {
+                    try {
+                        const listed = await fetchAll((p) => client.listPrompts(resolvedAppId, p));
+                        for (const p of listed) {
+                            if (p?.promptKey)
+                                livePromptIds.set(p.promptKey, p.promptId);
+                        }
+                    }
+                    catch (err) {
+                        promptsLiveOk = false;
+                        warnLiveUnavailable("prompts", err);
+                    }
+                }
+                /** One prompt as the server holds it NOW — the baseline after an
+                 * apply, and the record a late 409 is reported against. The DETAIL,
+                 * because the list carries no `[[configs]]`. */
+                const refetchLivePrompt = async (promptId) => {
+                    const full = await client.getPrompt(resolvedAppId, promptId);
+                    return full ? { record: full } : null;
+                };
                 for (const file of files) {
                     const filePath = join(promptsDir, file);
                     const tomlData = parseTomlFile(filePath);
-                    const prompt = tomlData.prompt || {};
-                    const key = prompt.key || basename(file, ".toml");
+                    const key = tomlData.prompt?.key || basename(file, ".toml");
+                    // The gate re-parses the DOCUMENT, so the key the file left to its
+                    // name has to be in it (see `withDerivedIdentity`): `displayName`
+                    // falls back to the key, so a file stating neither would otherwise
+                    // project an empty name against the derived one the server holds —
+                    // an update no push can clear, since the update writes that same
+                    // derived name back. Diff injects the same value before it hashes.
+                    withDerivedIdentity(tomlData, "prompt", { key });
+                    const prompt = tomlData.prompt;
                     const configs = tomlData.configs || [];
                     // #2645 — resolve the `active = true` marker BEFORE anything is
                     // written. Two marked entries is a file-level mistake, and finding
@@ -7633,16 +7851,89 @@ export function registerConfigSyncCommands(sync) {
                     });
                     if (promptRuleWarning)
                         warn(`  ${promptRuleWarning}`);
-                    const existingId = syncState?.entities?.prompts?.[key]?.id;
-                    // Skip if file hasn't changed since last sync
-                    if (!options.force && existingId && !shouldPushFile(filePath, syncState?.entities?.prompts?.[key]?.contentHash)) {
+                    const existingEntry = syncState?.entities?.prompts?.[key];
+                    const livePromptId = livePromptIds.get(key);
+                    // A detail read that fails degrades THIS prompt to the byte-hash
+                    // gate, never the section — its neighbours still reconcile.
+                    let promptLiveOk = promptsLiveOk;
+                    let livePrompt = undefined;
+                    if (promptLiveOk && livePromptId) {
+                        try {
+                            livePrompt = await client.getPrompt(resolvedAppId, livePromptId);
+                        }
+                        catch (err) {
+                            promptLiveOk = false;
+                            warnLiveUnavailable(`prompt ${key}`, err);
+                        }
+                    }
+                    let gate;
+                    if (promptLiveOk) {
+                        gate = decidePushForConfig({
+                            spec: promptSpec,
+                            // Prompts carry no rule-set reference, so these maps are inert
+                            // for this type — shared with `stampRemoteSemanticHash` so the
+                            // gate and the baseline it compares against cannot diverge.
+                            maps: pushDiffMaps,
+                            localParsed: tomlData,
+                            live: livePrompt
+                                ? { record: livePrompt, modifiedAt: livePrompt.modifiedAt }
+                                : null,
+                            entry: existingEntry,
+                            localFileHash: computeFileHash(filePath),
+                            force: options.force,
+                        });
+                        if (gate.action === "skip") {
+                            skippedCount++;
+                            // The config name→ID mappings a test case may need are fetched
+                            // by the test legs' `loadBlockConfigs`, on the first case that
+                            // names one — a read that no longer depends on this file being
+                            // pushed.
+                            if (livePromptId)
+                                promptKeyToId.set(key, livePromptId);
+                            // A skip decided against live state always HAS a live prompt
+                            // (there is nothing to compare against otherwise), so the row
+                            // records the server's own id.
+                            if (syncState && livePromptId) {
+                                if (!syncState.entities.prompts)
+                                    syncState.entities.prompts = {};
+                                syncState.entities.prompts[key] = {
+                                    id: livePromptId,
+                                    modifiedAt: livePrompt?.modifiedAt ||
+                                        existingEntry?.modifiedAt ||
+                                        new Date().toISOString(),
+                                    contentHash: computeFileHash(filePath),
+                                    // The two sides agree HERE, so this is the baseline the
+                                    // next run classifies against — which is what stops a
+                                    // comment-only edit from re-reporting forever.
+                                    semanticHash: gate.remoteHash,
+                                };
+                            }
+                            continue;
+                        }
+                        if (gate.action === "drift" ||
+                            gate.action === "conflict" ||
+                            gate.action === "immutable") {
+                            recordDeclined("prompt", key, gate, existingEntry?.modifiedAt);
+                            continue;
+                        }
+                    }
+                    else if (!options.force &&
+                        existingEntry?.id &&
+                        !shouldPushFile(filePath, existingEntry.contentHash)) {
+                        // Degraded: the manifest byte-hash gate this section has always
+                        // fallen back to when the server cannot be read.
                         skippedCount++;
-                        promptKeyToId.set(key, existingId);
-                        // The config name→ID mappings a test case may need are fetched by
-                        // the test legs' `loadBlockConfigs`, on the first case that names
-                        // one — a read that no longer depends on this file being pushed.
+                        promptKeyToId.set(key, existingEntry.id);
                         continue;
                     }
+                    // Live state decides create-vs-update: a prompt the manifest never
+                    // recorded is adopted, and one the manifest still names but the
+                    // server no longer has goes to the create path (#1659).
+                    const existingId = resolveExistingId({
+                        liveOk: promptLiveOk,
+                        liveId: livePromptId,
+                        manifestId: existingEntry?.id,
+                    });
                     // Shared update body for both the in-manifest update branch and the
                     // adopt-by-key recovery branch (#1006). Re-issues the prompt as an
                     // UPDATE and syncs its configs (update existing by name, create
@@ -7663,66 +7954,119 @@ export function registerConfigSyncCommands(sync) {
                         if (syncState?.entities?.prompts?.[key] && updated?.modifiedAt) {
                             syncState.entities.prompts[key].modifiedAt = updated.modifiedAt;
                         }
-                        // Fetch full prompt to get config name→ID mappings
-                        // (updatePrompt response doesn't include configs)
-                        const fullPrompt = await client.getPrompt(resolvedAppId, promptId);
-                        if (fullPrompt?.configs) {
-                            for (const config of fullPrompt.configs) {
-                                promptConfigNameToId.set(`${key}#${config.configName}`, config.configId);
-                            }
-                        }
-                        // Update existing prompt configs with TOML values
-                        if (fullPrompt?.configs && configs.length > 0) {
-                            for (const tomlConfig of configs) {
-                                const configName = tomlConfig.name;
-                                if (!configName)
-                                    continue;
-                                const serverConfig = fullPrompt.configs.find((c) => c.configName === configName);
-                                if (serverConfig) {
-                                    // Update existing config
-                                    await client.updatePromptConfig(resolvedAppId, promptId, serverConfig.configId, buildPromptConfigPayload(tomlConfig, { mode: "update" }));
+                        // #2869 — a prompt is applied by SEVERAL requests: the prompt,
+                        // then each `[[configs]]` entry, then the activation. A failure
+                        // among them leaves the server holding PART of the file, so the
+                        // baseline has to follow it that far. Left at the pre-push state
+                        // it would say "both sides moved" on the retry, and an operator
+                        // would have to `--force` past a half-applied push of this run's
+                        // own making. The content hash still waits for the whole apply,
+                        // so the retry still has an edit to send.
+                        try {
+                            // Fetch full prompt to get config name→ID mappings
+                            // (updatePrompt response doesn't include configs)
+                            const fullPrompt = await client.getPrompt(resolvedAppId, promptId);
+                            if (fullPrompt?.configs) {
+                                for (const config of fullPrompt.configs) {
+                                    promptConfigNameToId.set(`${key}#${config.configName}`, config.configId);
                                 }
-                                else {
-                                    // Create new config that doesn't exist on server yet
-                                    const newConfig = await client.createPromptConfig(resolvedAppId, promptId, buildPromptConfigPayload(tomlConfig, { mode: "create" }));
-                                    if (newConfig?.configId) {
-                                        promptConfigNameToId.set(`${key}#${configName}`, newConfig.configId);
+                            }
+                            // Update existing prompt configs with TOML values
+                            if (fullPrompt?.configs && configs.length > 0) {
+                                for (const tomlConfig of configs) {
+                                    const configName = tomlConfig.name;
+                                    if (!configName)
+                                        continue;
+                                    const serverConfig = fullPrompt.configs.find((c) => c.configName === configName);
+                                    if (serverConfig) {
+                                        // Update existing config
+                                        await client.updatePromptConfig(resolvedAppId, promptId, serverConfig.configId, buildPromptConfigPayload(tomlConfig, { mode: "update" }));
+                                    }
+                                    else {
+                                        // Create new config that doesn't exist on server yet
+                                        const newConfig = await client.createPromptConfig(resolvedAppId, promptId, buildPromptConfigPayload(tomlConfig, { mode: "create" }));
+                                        if (newConfig?.configId) {
+                                            promptConfigNameToId.set(`${key}#${configName}`, newConfig.configId);
+                                        }
                                     }
                                 }
+                                info(`    Synced ${configs.length} config(s) for prompt: ${key}`);
                             }
-                            info(`    Synced ${configs.length} config(s) for prompt: ${key}`);
-                        }
-                        // #2645 — the `active = true` marker is authoritative on update
-                        // too, not only on create. Without this the file could name a live
-                        // config that was not live, which is the drift the marker exists
-                        // to make visible in the first place.
-                        const activeName = activeConfigNameForPrompt;
-                        let activated = false;
-                        if (activeName) {
-                            const targetId = promptConfigNameToId.get(`${key}#${activeName}`);
-                            if (!targetId) {
-                                throw new Error(`${filePath}: active = true names configuration "${activeName}", ` +
-                                    `which has no [[configs]] entry on the server.`);
+                            // #2645 — the `active = true` marker is authoritative on update
+                            // too, not only on create. Without this the file could name a live
+                            // config that was not live, which is the drift the marker exists
+                            // to make visible in the first place.
+                            const activeName = activeConfigNameForPrompt;
+                            let activated = false;
+                            if (activeName) {
+                                const targetId = promptConfigNameToId.get(`${key}#${activeName}`);
+                                if (!targetId) {
+                                    throw new Error(`${filePath}: active = true names configuration "${activeName}", ` +
+                                        `which has no [[configs]] entry on the server.`);
+                                }
+                                if (targetId !== fullPrompt?.activeConfigId) {
+                                    await client.activatePromptConfig(resolvedAppId, promptId, targetId);
+                                    info(`    Activated config "${activeName}" for prompt: ${key}`);
+                                    activated = true;
+                                }
                             }
-                            if (targetId !== fullPrompt?.activeConfigId) {
-                                await client.activatePromptConfig(resolvedAppId, promptId, targetId);
-                                info(`    Activated config "${activeName}" for prompt: ${key}`);
-                                activated = true;
+                            // Everything this push owed the server has landed, so the file is
+                            // now applied. Activation writes the prompt record itself, so its
+                            // `modifiedAt` has moved again since the PATCH above — re-read it
+                            // rather than leave the next push to conflict on a stale token.
+                            const promptEntity = syncState?.entities?.prompts?.[key];
+                            if (promptEntity) {
+                                if (activated) {
+                                    const refreshed = await client.getPrompt(resolvedAppId, promptId);
+                                    if (refreshed?.modifiedAt) {
+                                        promptEntity.modifiedAt = refreshed.modifiedAt;
+                                    }
+                                }
+                                promptEntity.contentHash = computeFileHash(filePath);
+                                // #2869 B4 — the baseline reads back what the server now holds,
+                                // prompt and configs together. The PATCH response carries no
+                                // `[[configs]]`, and the entries were applied by their own
+                                // requests after it, so only a re-read describes the state both
+                                // sides now agree on; a baseline taken from the local file
+                                // would stamp values the handlers normalized and make the next
+                                // legitimate edit read as a conflict this push created.
+                                let applied = null;
+                                promptEntity.semanticHash = await stampRemoteSemanticHash(promptSpec, undefined, async () => {
+                                    const current = await refetchLivePrompt(promptId);
+                                    applied = current?.record ?? null;
+                                    return current;
+                                });
+                                // #2869 — that same read says whether the update actually
+                                // CLOSED the difference. Push updates and creates the
+                                // `[[configs]]` the file lists; it deletes none and clears no
+                                // activation, so a file omitting an entry the server holds
+                                // (or naming no active config) is a difference the update
+                                // cannot apply. Reported as a clean update it becomes the
+                                // disagreement this issue is about one level down: push says
+                                // it applied the file, and the next `config diff` reports the
+                                // same row again. So name what survived the push.
+                                if (applied) {
+                                    const residual = diffProjectedRecords(projectLocalConfig(promptSpec, tomlData, pushDiffMaps), projectRemoteConfig(promptSpec, applied, pushDiffMaps)).map((d) => d.field);
+                                    if (residual.length > 0) {
+                                        warn(`    Prompt ${key} still differs from the server after this push ` +
+                                            `(${residual.join(", ")}) — push does not delete a [[configs]] entry ` +
+                                            `the file omits, or clear an activation, so config diff keeps ` +
+                                            `reporting it. Run primitive config pull to take the server's ` +
+                                            `version, or remove the configuration server-side.`);
+                                    }
+                                }
                             }
                         }
-                        // Everything this push owed the server has landed, so the file is
-                        // now applied. Activation writes the prompt record itself, so its
-                        // `modifiedAt` has moved again since the PATCH above — re-read it
-                        // rather than leave the next push to conflict on a stale token.
-                        const promptEntity = syncState?.entities?.prompts?.[key];
-                        if (promptEntity) {
-                            if (activated) {
-                                const refreshed = await client.getPrompt(resolvedAppId, promptId);
-                                if (refreshed?.modifiedAt) {
-                                    promptEntity.modifiedAt = refreshed.modifiedAt;
-                                }
+                        catch (err) {
+                            const partialEntity = syncState?.entities?.prompts?.[key];
+                            if (partialEntity) {
+                                const partial = await stampRemoteSemanticHash(promptSpec, undefined, () => refetchLivePrompt(promptId));
+                                // A baseline that cannot be read is left alone rather than
+                                // cleared: the legacy signals are a better answer than none.
+                                if (partial)
+                                    partialEntity.semanticHash = partial;
                             }
-                            promptEntity.contentHash = computeFileHash(filePath);
+                            throw err;
                         }
                     };
                     if (existingId) {
@@ -7730,9 +8074,29 @@ export function registerConfigSyncCommands(sync) {
                         changes.push({ type: "prompt", action: "update", key });
                         promptKeyToId.set(key, existingId);
                         if (!options.dryRun) {
+                            // A prompt adopted from live state has no manifest row yet, and
+                            // `applyPromptUpdate` stamps INTO that row — without it the
+                            // push would apply and record nothing, and the next run would
+                            // re-decide from no baseline at all.
+                            if (syncState) {
+                                if (!syncState.entities.prompts)
+                                    syncState.entities.prompts = {};
+                                syncState.entities.prompts[key] = {
+                                    ...(existingEntry ?? {
+                                        modifiedAt: livePrompt?.modifiedAt || "",
+                                    }),
+                                    id: existingId,
+                                };
+                            }
                             const expectedModifiedAt = options.force
                                 ? undefined
-                                : syncState?.entities?.prompts?.[key]?.modifiedAt;
+                                : gate?.action === "update"
+                                    ? // The guard is the LIVE timestamp the gate read, not the
+                                        // manifest's: the reconcile just read the server, so this
+                                        // closes the window between that read and this write
+                                        // rather than conflicting on a token a prior push moved.
+                                        gate.expectedModifiedAt
+                                    : existingEntry?.modifiedAt;
                             try {
                                 await applyPromptUpdate(existingId, expectedModifiedAt);
                             }
@@ -7927,6 +8291,11 @@ export function registerConfigSyncCommands(sync) {
                                         id: created.promptId,
                                         modifiedAt,
                                         contentHash: computeFileHash(filePath),
+                                        // #2869 B4 — the SERVER's record, read back with the
+                                        // configs this create seeded and patched, so a value the
+                                        // handlers normalized is not stamped as the state both
+                                        // sides agreed on.
+                                        semanticHash: await stampRemoteSemanticHash(promptSpec, undefined, () => refetchLivePrompt(created.promptId)),
                                     };
                                 }
                             }
@@ -11555,12 +11924,20 @@ export function registerConfigSyncCommands(sync) {
             // local-only split above.
             const remoteOnlyStatus = (slot, key) => classifyRemoteOnly(syncState?.entities, slot, key);
             // Integrations
+            const remoteIntegrationRecords = new Map(integrationItems.map((i) => [i.integrationKey, i]));
             for (const key of localIntegrations) {
                 if (!remoteIntegrations.has(key)) {
                     differences.push({ type: "integration", key, status: localOnlyStatus("integrations", key) });
                 }
                 else {
-                    differences.push({ type: "integration", key, status: "exists" });
+                    // #2803 — availability is operator state, not drift, and it is the
+                    // same annotation every carrying type gets.
+                    differences.push({
+                        type: "integration",
+                        key,
+                        status: "exists",
+                        hint: outOfServiceHint(remoteIntegrationRecords.get(key)),
+                    });
                 }
             }
             for (const key of remoteIntegrations) {
@@ -11615,6 +11992,9 @@ export function registerConfigSyncCommands(sync) {
                         hint = "content not compared (comparison failed)";
                     }
                 }
+                // #2803 — a paused/archived webhook is operator state, appended to
+                // whatever the content comparison already had to say.
+                hint = outOfServiceHint(detailOutcome.ok ? detailOutcome.value : undefined, hint);
                 differences.push({ type: "webhook", key, status, hint });
             }
             for (const key of remoteWebhooks) {
@@ -11634,7 +12014,7 @@ export function registerConfigSyncCommands(sync) {
                         type: "cron-trigger",
                         key,
                         status: "exists",
-                        hint: operationalDisableHint(remoteCronTriggerRecords.get(key)),
+                        hint: outOfServiceHint(remoteCronTriggerRecords.get(key)),
                     });
                 }
             }
@@ -11704,6 +12084,9 @@ export function registerConfigSyncCommands(sync) {
                         hint = "content not compared (comparison failed)";
                     }
                 }
+                // #2803 — an inactive prompt is operator state, appended to whatever
+                // the content comparison already had to say.
+                hint = outOfServiceHint(detailOutcome.ok ? detailOutcome.value : undefined, hint);
                 differences.push({ type: "prompt", key, status, hint });
             }
             for (const key of remotePrompts) {
@@ -11737,8 +12120,8 @@ export function registerConfigSyncCommands(sync) {
             // canonicalizes on the way in. Only an explicitly-set non-default
             // server value reads as Modified.
             const remoteWorkflowIds = new Map(workflowItems.map((w) => [w.workflowKey, w.workflowId]));
-            // #2645 — the list rows carry `operationallyDisabled`, so the toggle is
-            // readable without a second fetch per workflow.
+            // #2645/#2803 — the list rows carry the canonical `status`, so
+            // availability is readable without a second fetch per workflow.
             const remoteWorkflowRecords = new Map(workflowItems.map((w) => [w.workflowKey, w]));
             for (const key of localWorkflows) {
                 if (!remoteWorkflows.has(key)) {
@@ -11823,10 +12206,10 @@ export function registerConfigSyncCommands(sync) {
                     status = "exists";
                     hint = "content not compared (fetch failed)";
                 }
-                // #2645 criterion 9 — a disabled workflow is not drift; its TOML
-                // still describes it exactly. Annotate the row so the operator state
-                // is visible without being mistaken for a difference to reconcile.
-                hint = operationalDisableHint(remoteWorkflowRecords.get(key), hint);
+                // #2645 criterion 9 / #2803 — an inactive workflow is not drift; its
+                // TOML still describes it exactly. Annotate the row so the operator
+                // state is visible without being mistaken for a difference.
+                hint = outOfServiceHint(remoteWorkflowRecords.get(key), hint);
                 differences.push({ type: "workflow", key, status, hint });
             }
             for (const key of remoteWorkflows) {