primitive-admin 1.1.0-alpha.65 → 1.1.0-alpha.66

package/dist/src/commands/sync.js

@@ -14,10 +14,12 @@ import { createSnapshot, listSnapshots, resolveSnapshot, restoreSnapshot, pruneS
 import { validateWorkflowToml, collectWorkflowTomlNotes, formatWorkflowTomlErrors, validateWorkflowExpressionsToml, validateWorkflowExpressionsRawToml, } from "../lib/workflow-toml-validator.js";
 import { expandWorkflowTomlData } from "../lib/workflow-fragments.js";
 import { parseConfigToml, stringifyConfigToml } from "../lib/config-toml.js";
+import { canonicalizeIntegrationRequestConfig } from "../lib/integration-request-config.js";
+import { canonicalizeServerTextFields } from "../lib/server-text-normalization.js";
 import { canonicalJsonStringify } from "../lib/canonical-json.js";
 import { reconcileWorkflowIncludes } from "../lib/workflow-include-preserve.js";
-import { serializeSection, parseTomlToAppSettings, } from "../lib/app-settings-descriptor.js";
-import { collectAppSettingsPushErrors, writePulledAppSettings, diffAppSettings, } from "./sync-app-settings.js";
+import { serializeSection, parseTomlToAppSettings, buildAppSettingsPayload, } from "../lib/app-settings-descriptor.js";
+import { collectAppSettingsPushErrors, writePulledAppSettings, diffAppSettings, appSettingsFieldDiffs, appSettingsNameExcluded, appSettingsNameExcludedForState, hashAppSettingsForDiff, } from "./sync-app-settings.js";
 import { applyWorkflowBody, legacyDraftSlotWarning } from "../lib/workflow-apply.js";
 // #2645 — named config bodies live in `workflows/<key>.configs/<name>.toml`.
 import { workflowConfigsDir, serializeWorkflowConfigSidecar, parseWorkflowConfigSidecar, readWorkflowConfigSidecars, } from "../lib/workflow-config-sidecar.js";
@@ -27,11 +29,11 @@ import { buildWorkflowPayloadFromToml, parseWorkflowExpressionsToml, } from "../
 // payload builder so the diff normalizer and the wire cannot disagree.
 import { WORKFLOW_MODEL_DEFAULTS } from "../lib/workflow-defaults.js";
 // #2644 — the one definition per configuration object, vendored from the server.
-import { BLOB_BUCKET_TABLE, COLLECTION_TYPE_CONFIG_TABLE, CRON_TRIGGER_TABLE, DATABASE_TYPE_TABLE, EMAIL_TEMPLATE_TABLE, GROUP_TYPE_CONFIG_TABLE, INTEGRATION_TABLE, METADATA_CATEGORY_CONFIG_TABLE, PROMPT_CONFIG_TABLE, PROMPT_TABLE, RULE_SET_TABLE, TEST_CASE_SURFACE, TEST_CASE_TABLE, WEBHOOK_TABLE, WORKFLOW_TABLE, findMisshapenTables, findUnknownDocumentKeys, findUnknownServerKeys, findUnknownTomlKeys, misshapenTableMessage, retiredConfigKey, unrecognizedPullKeysMessage, unrecognizedPushKeysMessage, unrecognizedPushTablesMessage, warnUnrecognizedServerKeys, } from "../lib/config-surface.js";
+import { BLOB_BUCKET_TABLE, COLLECTION_TYPE_CONFIG_TABLE, CRON_TRIGGER_TABLE, DATABASE_TYPE_TABLE, EMAIL_TEMPLATE_TABLE, GROUP_TYPE_CONFIG_TABLE, INTEGRATION_TABLE, METADATA_CATEGORY_CONFIG_TABLE, PROMPT_CONFIG_TABLE, PROMPT_TABLE, RULE_SET_TABLE, TEST_CASE_SURFACE, TEST_CASE_TABLE, WEBHOOK_TABLE, WORKFLOW_TABLE, configDeclaredTypeErrors, findMisshapenTables, findUnknownDocumentKeys, findUnknownServerKeys, findUnknownTomlKeys, misshapenTableMessage, retiredConfigKey, spellsDecimalNumber, unrecognizedPullKeysMessage, unrecognizedPushKeysMessage, unrecognizedPushTablesMessage, warnUnrecognizedServerKeys, } from "../lib/config-surface.js";
 import { buildPayloadFromToml, projectEntityToPayload, projectRecordToToml, tomlOwned, } from "../lib/config-payload.js";
 import { CONFIG_SURFACES, isEmptyForEmit, } from "../lib/generated-config-surfaces.js";
 import { detectLayout, migrateLegacyToV2 } from "../lib/block-layout.js";
-import { ABSENT_FROM_EXPORT, LOCAL_ONLY_ABSENT, LOCAL_ONLY_NEW, PUSH_PRUNE_SPECS, REMOTE_ONLY_UNMANAGED, REMOTE_ONLY_WILL_DELETE, SYNC_RESOURCE_TYPES, applyPrune, attachmentWritePath, attemptFetch, classifyLocalOnly, classifyPruneDeleteFailure, classifyRemoteOnly, collectPushPruneCandidates, decidePushPruneCandidate, formatPrunePlan, hasUncommittedChanges, isSafeAttachmentFilename, isSafeSyncFilename, planPrune, preserveUnwrittenEntries, removePrunedSidecar, ruleSetFileKey, } from "../lib/sync-resource-types.js";
+import { ABSENT_FROM_EXPORT, LOCAL_ONLY_ABSENT, LOCAL_ONLY_NEW, PUSH_PRUNE_SPECS, REMOTE_ONLY_UNMANAGED, REMOTE_ONLY_WILL_DELETE, SYNC_RESOURCE_TYPES, VALIDATION_ERROR, applyPrune, attachmentWritePath, attemptFetch, classifyLocalOnly, classifyPruneDeleteFailure, classifyRemoteOnly, collectPushPruneCandidates, decidePushPruneCandidate, formatPrunePlan, hasUncommittedChanges, isSafeAttachmentFilename, isSafeSyncFilename, planPrune, preserveUnwrittenEntries, removePrunedSidecar, ruleSetFileKey, } from "../lib/sync-resource-types.js";
 import { success, error, printApiError, info, warn, keyValue, json, divider, } from "../lib/output.js";
 import { filterFilesBySelection, parseSyncSelectors, SelectorError, selectionIncludesKey, selectionIncludesType, selectionIncludesApp, selectionIncludesAnyVar, unmatchedSelectors, } from "../lib/sync-selectors.js";
 import { confirmPrompt, ConfirmPromptError } from "../lib/confirm-prompt.js";
@@ -1325,15 +1327,26 @@ export function buildWebhookPushPayload(key, tomlData, { mode = "update" } = {})
             },
         }),
     };
-    // Handle JSON fields
-    if (tomlData?.allowedIps?.cidrs) {
-        payload.allowedIpCidrs = JSON.stringify(tomlData.allowedIps.cidrs);
-    }
-    if (tomlData?.inputMapping) {
-        payload.inputMapping = JSON.stringify(tomlData.inputMapping);
-    }
-    if (tomlData?.metadata) {
-        payload.metadata = JSON.stringify(tomlData.metadata);
+    // The three JSON-carrying tables. TOML-owned like `description` above
+    // (#1567), so on an UPDATE each is sent as value-or-`null`: sending nothing
+    // for an absent table left the stored value in place, which the shared
+    // comparison then reported as a difference forever — push planned the same
+    // update on every run, the server changed nothing, and deleting a
+    // `[inputMapping]` section could not be made to take effect. The server
+    // stores an explicit `null` (`updates.<key> = payload.<key>`).
+    //
+    // A CREATE sends only what the file has: there is nothing to clear, and the
+    // create handlers read an absent key as "no value" already.
+    const jsonTables = [
+        ["allowedIpCidrs", tomlData?.allowedIps?.cidrs],
+        ["inputMapping", tomlData?.inputMapping],
+        ["metadata", tomlData?.metadata],
+    ];
+    for (const [key, value] of jsonTables) {
+        if (value)
+            payload[key] = JSON.stringify(value);
+        else if (mode === "update")
+            payload[key] = null;
     }
     // Forward the declared `[verification.<scheme>]` table so scheme
     // configuration reaches the server. Without this the table is silently
@@ -1425,12 +1438,24 @@ export function buildCronTriggerPushPayload(key, tomlData, { mode = "update" } =
             },
         }),
     };
-    // Handle JSON fields
-    if (tomlData?.rootInput) {
-        payload.rootInput = JSON.stringify(tomlData.rootInput);
-    }
-    if (tomlData?.inputMapping) {
-        payload.inputMapping = JSON.stringify(tomlData.inputMapping);
+    // The two JSON-carrying tables, TOML-owned like `description` (#1567): an
+    // UPDATE sends value-or-`null`, so deleting a `[rootInput]` section clears it
+    // instead of leaving a value the shared comparison reports as a difference
+    // on every run that push cannot clear. The controller takes an explicit
+    // `null` as the clear and validates anything else as JSON.
+    //
+    // A CREATE sends only what the file has: the create leg rejects a `null` as
+    // invalid JSON, and there is nothing to clear on a trigger that does not
+    // exist yet.
+    const jsonTables = [
+        ["rootInput", tomlData?.rootInput],
+        ["inputMapping", tomlData?.inputMapping],
+    ];
+    for (const [key, value] of jsonTables) {
+        if (value)
+            payload[key] = JSON.stringify(value);
+        else if (mode === "update")
+            payload[key] = null;
     }
     return payload;
 }
@@ -1979,6 +2004,114 @@ export function unknownKeyPreflightTargets() {
     }
     return targets;
 }
+/**
+ * The diff row a per-entity config file belongs to (#2880 criterion 1).
+ *
+ * `config diff` pairs a local file with a server entity by a key each type
+ * derives its own way — the `[table].key` the file states, its identity field,
+ * or the file name standing in for either. The validation reporter has to land
+ * its message on THAT row, so the derivation lives here once rather than being
+ * inferred from the file name and quietly missing a renamed file.
+ */
+function localConfigRowKey(label, tomlData, file) {
+    const fallback = basename(file, ".toml");
+    const stated = (table, key) => tomlData?.[table]?.[key] || fallback;
+    switch (label) {
+        case "integration":
+            return stated("integration", "key");
+        case "webhook":
+            return stated("webhook", "key");
+        case "cron-trigger":
+            return stated("cronTrigger", "key");
+        case "blob-bucket":
+            return stated("bucket", "key");
+        case "prompt":
+            return stated("prompt", "key");
+        case "workflow":
+            return stated("workflow", "key");
+        case "email-template":
+            return stated("template", "emailType");
+        case "database-type-config":
+            return stated("type", "databaseType");
+        case "group-type-config":
+            return stated("groupTypeConfig", "groupType");
+        case "collection-type-config":
+            return stated("collectionTypeConfig", "collectionType");
+        case "metadata-category-config": {
+            const section = tomlData?.metadataCategoryConfig || {};
+            if (section.resourceType && section.category) {
+                return `${section.resourceType}#${section.category}`;
+            }
+            // `resourceType.category.toml`, the filename fallback push and diff share.
+            const dot = fallback.indexOf(".");
+            return dot > 0
+                ? `${fallback.slice(0, dot)}#${fallback.slice(dot + 1)}`
+                : fallback;
+        }
+        // Rule sets are keyed by FILE NAME on both sides — a renamed `ruleSet.name`
+        // still updates the same entity, so the row is the file's.
+        default:
+            return fallback;
+    }
+}
+/**
+ * Every per-entity config file whose TOML `config push` would refuse (#2880
+ * criterion 1, symmetry).
+ *
+ * One collector, two commands. Push aborts on the messages before issuing a
+ * request; `config diff` renders them as their own rows, because the failure
+ * this closes is a file diff calls Synced and push then rejects — the state the
+ * issue's reporter hit after #2803 retired `[prompt].status`, where a local key
+ * with no server counterpart is invisible to a comparison and fatal to a push.
+ *
+ * Three checks, all definition-driven: the document's table shape, keys no
+ * definition declares (retired keys among them), and — since #2880 — values
+ * whose spelling is not the declared type. A file that does not parse is left
+ * to the per-type loop that reads it, which names the parse error itself.
+ */
+export function collectConfigFileValidationErrors(configDir) {
+    const found = [];
+    for (const { dir, surface, tables } of unknownKeyPreflightTargets()) {
+        const typeDir = join(configDir, dir);
+        if (!existsSync(typeDir))
+            continue;
+        for (const file of readdirSync(typeDir).filter((f) => f.endsWith(".toml"))) {
+            const filePath = join(typeDir, file);
+            let tomlData;
+            try {
+                tomlData = parseTomlFile(filePath);
+            }
+            catch {
+                continue;
+            }
+            const messages = [];
+            // The document's own shape first: an unrecognized top-level table makes
+            // every per-table check below read an absent table, so its silence would
+            // be misleading.
+            messages.push(...configDocumentShapeErrors(filePath, tomlData, surface));
+            for (const table of tables) {
+                const unknownKeyError = configUnknownKeyError(filePath, tomlData, table);
+                if (unknownKeyError)
+                    messages.push(unknownKeyError);
+            }
+            // Declared types run over EVERY table of the surface, workflows included
+            // — `tables` above is pruned for workflows because `validateWorkflowToml`
+            // owns their unrecognized-key message, which is a different check.
+            for (const table of surface.tables) {
+                messages.push(...configDeclaredTypeErrors(filePath, tomlData, table));
+            }
+            if (messages.length === 0)
+                continue;
+            found.push({
+                type: surface.label,
+                key: localConfigRowKey(surface.label, tomlData, file),
+                filePath,
+                messages,
+            });
+        }
+    }
+    return found;
+}
 /**
  * Every `<key>.tests/*.toml` sidecar under a config directory.
  *
@@ -2822,16 +2955,25 @@ function normalizeRuleSetRefForDiff(entity, ruleSetNameToId, label) {
  * A field's value as the comparison reads it — the VALUE, not its spelling
  * (#2869).
  *
- * Only a declared `number` needs this, and only because the server genuinely
- * accepts both spellings: `temperature` and `topP` are `StringField`s on the
+ * Only a declared `number` the DEFINITION marks `dualEncoded` needs this
+ * (#2880), and only because the server genuinely accepts both spellings:
+ * `temperature` and `topP` are `StringField`s on the
  * model, stored as strings and returned parsed, so a file authored
  * `temperature = "0.2"` and a server holding `0.2` describe one value. Compared
  * as spellings it is a `Modified` no push can clear — push sends the string,
  * the server stores it, pull writes the number back, and the difference
  * returns — so the operator's only remedy is to overwrite the local file.
  *
- * A string that is not a number is left exactly as it is: `temperature =
- * "warm"` is a real difference from `0.2`, and one the server will reject.
+ * Every OTHER declared number is strictly numeric: `maxTokens = "1024"` is not
+ * the number the server holds, and normalizing it here would have both
+ * commands agree on a value the author never wrote. It is a validation error
+ * both commands report instead (`configDeclaredTypeErrors`), which is why the
+ * carve-out is read from the definition rather than from `type === "number"`.
+ *
+ * A string that is not a number never reaches here: `temperature = "warm"` is
+ * a field-named validation error from both commands (`spellsDecimalNumber` is
+ * the grammar the declared-type validator admits a dual encoding by, so what
+ * preflight accepts is exactly what this can equate).
  *
  * "Is a number" is decided by the grammar the SERVER reads the string with —
  * `parseFloat`, on the way back out — not by JavaScript's `Number`, which is
@@ -2841,15 +2983,14 @@ function normalizeRuleSetRefForDiff(entity, ruleSetNameToId, label) {
  * So only what `parseFloat` consumes WHOLE — sign, digits, one dot, an
  * exponent — normalizes; anything else stays the string it is.
  */
-const DECIMAL_NUMBER = /^[+-]?(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?$/;
-function comparableFieldValue(type, value) {
-    if (type !== "number" || typeof value !== "string")
+function comparableFieldValue(field, value) {
+    if (field.type !== "number" || typeof value !== "string")
+        return value;
+    if (field.dualEncoded === undefined)
         return value;
-    const trimmed = value.trim();
-    if (!DECIMAL_NUMBER.test(trimmed))
+    if (!spellsDecimalNumber(value))
         return value;
-    const asNumber = Number(trimmed);
-    return Number.isFinite(asNumber) ? asNumber : value;
+    return Number(value.trim());
 }
 /**
  * `config diff`'s hash for one configuration object, over the field set its
@@ -2872,7 +3013,16 @@ function comparableFieldValue(type, value) {
 export function projectConfigForComparison(table, entity, extras = {}) {
     const projected = {};
     for (const field of table.fields) {
-        const value = comparableFieldValue(field.type, entity?.[field.field]);
+        const raw = entity?.[field.field];
+        // #2880 DSO-002 — a key the file does not carry describes the value the
+        // SERVER materializes for it, so that is what the comparison reads. Both
+        // sides run through here, and the server side always carries the value
+        // already, so this only ever fills the absent side in. Without it a
+        // hand-authored file that omits an optional defaulted field reports
+        // `Modified` on every run against a server that agrees with it.
+        const value = comparableFieldValue(field, raw === undefined && field.serverDefault !== undefined
+            ? field.serverDefault
+            : raw);
         if (value === undefined)
             continue;
         // #2731 — `emit: "whenSet"` says pull OMITS the key when the value is
@@ -3025,6 +3175,25 @@ function jsonFieldsForDiff(table, entity) {
     }
     return projected;
 }
+/**
+ * One test-case reference as the comparison reads it (#2880 behavior 17).
+ *
+ * A reference reaches the projection in one of three states, and all three
+ * describe the same thing on both sides once this is applied:
+ *
+ *  - a portable NAME (`configName = "default"`), which a test file carries so
+ *    it survives a move between apps;
+ *  - a legacy ID that RESOLVES, which becomes that same name — otherwise a file
+ *    pinned by id would differ forever from the file pull writes for it;
+ *  - a legacy ID that does NOT resolve, which stays the id, because pull writes
+ *    an unresolvable id straight back and comparing it away would hide a pin
+ *    the next push still sends.
+ */
+function testCaseReference(value, idToName) {
+    if (typeof value !== "string" || value === "")
+        return undefined;
+    return idToName?.get(value) ?? value;
+}
 const CONFIG_DIFF_SPECS = {
     "rule-set": {
         label: "rule-set",
@@ -3099,6 +3268,16 @@ const CONFIG_DIFF_SPECS = {
         // exactly as push derives it from the file name.
         parse: (doc) => buildWebhookPushPayload(doc?.webhook?.key ?? "", doc),
         serialize: (record) => serializeWebhook(record),
+        // The text the create/update handlers rewrite on the way in (DSO-003):
+        // `displayName` and `workflowKey` are trimmed, a blank description is
+        // stored as none, and a signing secret is stored as the canonical
+        // `{{secrets.KEY}}` form — so an authored `"{{ secrets.KEY }}"` is the same
+        // reference the server returns rather than a row push re-applies forever.
+        canonicalize: (entity) => canonicalizeServerTextFields(entity, {
+            trimmed: ["displayName", "workflowKey"],
+            optional: ["description"],
+            secretReference: ["signingSecret"],
+        }),
         extras: (entity) => ({
             // The four structural tables a webhook file also carries, compared as the
             // values they encode rather than as their transport spellings.
@@ -3111,6 +3290,21 @@ const CONFIG_DIFF_SPECS = {
             // webhook that holds none.
             config: entity.config ?? null,
         }),
+        // The two present-only fields, matching what `buildWebhookPushPayload`
+        // sends: a file with no `[verification]` section does not manage the stored
+        // scheme configuration (a bare `[verification]` table is how such a file
+        // clears it), and a file with no `signingSecret` line does not manage the
+        // secret reference — pushing `null` for either would revoke verification
+        // the file never mentioned. Compared as differences they were rows push
+        // could never clear.
+        unmanaged: (doc) => {
+            const keys = [];
+            if (doc?.verification === undefined)
+                keys.push("config");
+            if (doc?.webhook?.signingSecret === undefined)
+                keys.push("signingSecret");
+            return keys;
+        },
         describe: (entity) => `webhook "${entity?.webhookKey}"`,
     },
     // #2748 — prompts join the registry comparator, the third type to arrive by
@@ -3163,6 +3357,148 @@ const CONFIG_DIFF_SPECS = {
         }),
         describe: (entity) => `prompt "${entity?.displayName}"`,
     },
+    // #2880 — integrations join the registry comparator, the last of the flat
+    // per-entity types to arrive by the route email templates (#2731 B2),
+    // webhooks (#2757) and prompts (#2748) took: `config diff` reported key
+    // existence only, so an edited `accessRule` or upstream `[requestConfig]`
+    // read as Synced while push applied it from the file's byte hash.
+    "integration": {
+        label: "integration",
+        table: INTEGRATION_TABLE,
+        // The wire shape push sends. `integrationKey` is not part of the compared
+        // surface — the two sides are paired on it before the comparison runs —
+        // but the TOML spelling (`[integration].key`) is read here because it is
+        // what `displayName` falls back to.
+        parse: (doc) => buildIntegrationPushPayload(doc?.integration?.key ?? "", doc),
+        serialize: (record) => serializeIntegration(record),
+        // The upstream request definition is a top-level table the definition
+        // classifies structural, so it is hashed beside the fields — as the value
+        // the SERVER would store, not as the text the file holds (DSO-003).
+        canonicalize: (entity) => {
+            entity.requestConfig = canonicalizeIntegrationRequestConfig(entity.requestConfig ?? {});
+            // The scalars the handler rewrites beside it: `displayName` is trimmed
+            // and a blank `description` is stored as none.
+            canonicalizeServerTextFields(entity, {
+                trimmed: ["displayName"],
+                optional: ["description"],
+            });
+        },
+        extras: (entity) => ({ requestConfig: entity.requestConfig ?? {} }),
+        describe: (entity) => `integration "${entity?.integrationKey}"`,
+    },
+    // #2880 — cron triggers, on the same route. `status` is server-owned
+    // (#2645/#2803) and therefore absent from the table, so an operator's pause
+    // is not drift the configuration can push away; `[rootInput]` and
+    // `[inputMapping]` are structural tables stored as JSON strings, compared as
+    // the values they encode.
+    "cron-trigger": {
+        label: "cron-trigger",
+        table: CRON_TRIGGER_TABLE,
+        parse: (doc) => buildCronTriggerPushPayload(doc?.cronTrigger?.key ?? "", doc),
+        serialize: (record) => serializeCronTrigger(record),
+        // `displayName` is trimmed on the way in and a blank description is stored
+        // as none (DSO-003), so neither is a difference push could never settle.
+        canonicalize: (entity) => canonicalizeServerTextFields(entity, {
+            trimmed: ["displayName"],
+            optional: ["description"],
+        }),
+        extras: (entity) => ({
+            rootInput: jsonBlobForDiff(entity.rootInput),
+            inputMapping: jsonBlobForDiff(entity.inputMapping),
+        }),
+        describe: (entity) => `cron trigger "${entity?.triggerKey}"`,
+    },
+    // #2880 — blob buckets. The parse is CREATE-mode on purpose: `ttlTier` is
+    // `writableOn: ["create"]`, and a field left out of the projection cannot be
+    // NAMED as the immutable difference it is — the update would PATCH
+    // "successfully", change nothing, and re-report forever.
+    "blob-bucket": {
+        label: "blob-bucket",
+        table: BLOB_BUCKET_TABLE,
+        parse: (doc) => {
+            const bucket = { ...(doc?.bucket ?? {}) };
+            // #1020 — `accessPolicy` is the pre-`preset` spelling, still accepted on
+            // the wire and still authored in unmigrated files. Both spellings mean
+            // the same access model, so they project the same way; without this an
+            // unmigrated file reports a difference no push can clear (push sends the
+            // legacy key and the server answers with `preset`).
+            if (bucket.preset === undefined && bucket.accessPolicy !== undefined) {
+                bucket.preset = bucket.accessPolicy;
+            }
+            return {
+                bucketKey: doc?.bucket?.key ?? "",
+                ...buildPayloadFromToml(BLOB_BUCKET_TABLE, bucket, {
+                    mode: "create",
+                    values: {
+                        name: (value) => value || doc?.bucket?.key || "",
+                        description: tomlOwned,
+                    },
+                }),
+            };
+        },
+        serialize: (record) => serializeBlobBucket(record),
+        // `name` is trimmed on the way in and a blank description is stored as
+        // none (DSO-003).
+        canonicalize: (entity) => canonicalizeServerTextFields(entity, {
+            trimmed: ["name"],
+            optional: ["description"],
+        }),
+        // The three fields a bucket file leaves alone by omitting them, matching
+        // what `buildBlobBucketUpdatePayload` sends (#2880 criterion 3). The server
+        // refuses to leave a bucket nameless or without an access model, so none of
+        // them is clearable and the update omits an absent key rather than nulling
+        // it. Compared anyway, a bucket whose live name differs from its key — or
+        // one whose access model the file does not state — is a `Modified` row and
+        // an update that cannot carry the difference it reports, planned again on
+        // every run. `ttlTier` is deliberately NOT here: it is immutable rather
+        // than unmanaged, and naming it is the whole point of the create-mode parse
+        // above.
+        unmanaged: (doc) => {
+            const bucket = doc?.bucket ?? {};
+            const keys = [];
+            if (!bucket.name)
+                keys.push("name");
+            if (!bucket.preset && !bucket.accessPolicy)
+                keys.push("preset");
+            if (!bucket.ruleSetId)
+                keys.push("ruleSetId");
+            return keys;
+        },
+        describe: (entity) => `blob bucket "${entity?.bucketKey}"`,
+    },
+    // #2880 — test cases. Their sidecars were compared by SLUG PRESENCE, so an
+    // edited expectation read as Synced while push applied it from the file's
+    // byte hash.
+    //
+    // The type's own difficulty is that a reference has two legal spellings — the
+    // portable `configName` a test file carries so it survives a move between
+    // apps, and the legacy `configId` pull still writes back when the name cannot
+    // be resolved. They name the same thing, so they project the same way; the
+    // `extra` context is what makes that possible (the id→name lookups are not in
+    // the document).
+    "test-case": {
+        label: "test-case",
+        table: TEST_CASE_TABLE,
+        parse: (doc) => parseTestCaseToml(doc),
+        serialize: (record, _maps, extra) => serializeTestCase(record, extra?.lookupMaps),
+        // The server trims a test-case name on write (`src/admin-api.ts`), so a
+        // padded one in the file is not a difference — it is what the server will
+        // store (#2880 DSO-003).
+        canonicalize: (entity) => {
+            if (typeof entity.name === "string")
+                entity.name = entity.name.trim();
+        },
+        extras: (entity, _doc, extra) => ({
+            // These three OVERRIDE the definition's fields of the same name: the
+            // value compared is the thing referred to, not the spelling that referred
+            // to it. Precedence matches the push path exactly — a file carrying both
+            // an id and a name is pushed on the id, so it is compared on the id.
+            configId: testCaseReference(entity.configId ?? entity._configName, extra?.lookupMaps?.configIdToName),
+            evaluatorPromptId: testCaseReference(entity.evaluatorPromptId ?? entity._evaluatorPromptKey, extra?.lookupMaps?.promptIdToKey),
+            evaluatorConfigId: testCaseReference(entity.evaluatorConfigId ?? entity._evaluatorConfigName, extra?.lookupMaps?.configIdToName),
+        }),
+        describe: (entity) => `test case "${entity?.name}"`,
+    },
     "database-type-config": {
         label: "database-type-config",
         table: DATABASE_TYPE_TABLE,
@@ -3194,9 +3530,10 @@ const CONFIG_DIFF_SPECS = {
 };
 /**
  * Every type the shared comparator serves — the types `config diff` compares
- * field-for-field, and that `config push` gates on the same projection wherever
- * it has adopted the shared gate (#2731 B1/B2; webhooks joined the comparator
- * in #2757 while push keeps its own byte-hash gate).
+ * field-for-field, and that `config push` gates on the same projection
+ * (#2731 B1/B2; webhooks joined the comparator in #2757 and their push joined
+ * the same gate in #2880, so no registered type answers "changed?" from the
+ * file's bytes any more).
  *
  * Published so the round-trip acceptance bar (#2731 B9) can require a fixture
  * per type instead of listing them a second time by hand: converting a type is
@@ -3219,20 +3556,82 @@ export function configDiffSpec(label) {
  * a push that needs to SAY what differs and a diff that only needs to know THAT
  * something differs read the same projection.
  */
-export function projectLocalConfig(spec, parsedToml, maps) {
-    const entity = spec.parse(parsedToml);
+export function projectLocalConfig(spec, parsedToml, maps, extra) {
+    const entity = spec.parse(parsedToml, extra);
     if (spec.ruleSetRef) {
         normalizeRuleSetRefForDiff(entity, maps.ruleSetNameToId, spec.describe(entity));
     }
-    return projectConfigForComparison(spec.table, entity, spec.extras?.(entity, parsedToml));
+    // #2880 DSO-003 — before anything is hashed, so the extras below read the
+    // canonical values too.
+    spec.canonicalize?.(entity);
+    return projectConfigForComparison(spec.table, entity, spec.extras?.(entity, parsedToml, extra));
 }
 /** The same projection for a SERVER entity — see `hashRemoteConfigForDiff`. */
 export function projectRemoteConfig(spec, record, maps, extra) {
-    return projectLocalConfig(spec, parseConfigToml(spec.serialize(record, maps, extra)), maps);
+    return projectLocalConfig(spec, parseConfigToml(spec.serialize(record, maps, extra)), maps, extra);
+}
+/**
+ * BOTH sides of one comparison, with the file's unmanaged keys reconciled
+ * (#2880) — the one place `spec.unmanaged` is honored, so `config diff` and
+ * `config push` cannot read the same file differently.
+ */
+export function projectConfigPair(spec, localParsed, remoteRecord, maps, extra, localExtra) {
+    const local = projectLocalConfig(spec, localParsed, maps, localExtra);
+    const remote = projectRemoteConfig(spec, remoteRecord, maps, extra);
+    for (const key of spec.unmanaged?.(localParsed) ?? []) {
+        // Key-for-key, so an unmanaged field the server does not hold either is
+        // absent on both sides rather than present-and-undefined on one.
+        if (key in remote)
+            local[key] = remote[key];
+        else
+            delete local[key];
+    }
+    return { local, remote };
+}
+/**
+ * One `config diff` row's content verdict for a registered type (#2880).
+ *
+ * The three outcomes the per-type blocks were each spelling out by hand:
+ * equal (`exists`), different (`modified`, framed as a preview of
+ * `config pull`), and "could not tell" — a missing record or a comparison that
+ * threw, which degrades THIS row and never the whole diff. Written once so a
+ * type joining the comparator cannot accidentally report a fourth thing.
+ *
+ * The two `extra` arguments are the same split `decidePushForConfig` makes:
+ * `extra` carries what only the SERVER side has (a database type's operation
+ * rows), while `localExtra` is context BOTH sides read a value through — a test
+ * case's id→name lookups. Giving the local side nothing was a silent
+ * mistranslation: a sidecar pinned by a resolvable `configId` projected the id
+ * while the server's projection resolved it to the name, so an untouched file
+ * reported Modified in diff and drifted in push.
+ */
+export function compareLocalToRemote(spec, localParsed, remoteRecord, maps = {
+    ruleSetIdToName: new Map(),
+    ruleSetNameToId: new Map(),
+}, extra, localExtra) {
+    if (!localParsed || !remoteRecord) {
+        return { status: "exists", hint: "content not compared (fetch failed)" };
+    }
+    try {
+        const pair = projectConfigPair(spec, localParsed, remoteRecord, maps, extra ?? localExtra, localExtra);
+        const remoteHash = computeExpandedContentHash(pair.remote);
+        const localHash = computeExpandedContentHash(pair.local);
+        if (remoteHash === localHash)
+            return { status: "exists" };
+        return {
+            status: "modified",
+            hint: "run `config pull` to rewrite the local TOML to match running state",
+        };
+    }
+    catch {
+        // A file the comparison cannot read is reported as not compared rather
+        // than aborting the diff; `config push` names the fault precisely.
+        return { status: "exists", hint: "content not compared (comparison failed)" };
+    }
 }
 /** Hash a LOCAL config file's definition-projected field set (#2644). */
-export function hashLocalConfigForDiff(spec, parsedToml, maps) {
-    return computeExpandedContentHash(projectLocalConfig(spec, parsedToml, maps));
+export function hashLocalConfigForDiff(spec, parsedToml, maps, extra) {
+    return computeExpandedContentHash(projectLocalConfig(spec, parsedToml, maps, extra));
 }
 /**
  * Hash a SERVER entity the same way, by serializing it into the file `sync
@@ -3244,32 +3643,24 @@ export function hashLocalConfigForDiff(spec, parsedToml, maps) {
  * operations and subscriptions, which the list response does not include.
  */
 export function hashRemoteConfigForDiff(spec, record, maps, extra) {
-    return hashLocalConfigForDiff(spec, parseConfigToml(spec.serialize(record, maps, extra)), maps);
+    return hashLocalConfigForDiff(spec, parseConfigToml(spec.serialize(record, maps, extra)), maps, extra);
+}
+export function decideDegradedPush(input) {
+    if (input.force)
+        return { action: "send" };
+    if (input.storedContentHash === undefined) {
+        return { action: "decline", reason: "no-baseline" };
+    }
+    return input.storedContentHash === input.currentFileHash
+        ? { action: "skip" }
+        : { action: "send" };
 }
-/**
- * `config push`'s change decision for one configuration file (#2731 B1/B3/B4/B8).
- *
- * This replaces `shouldPushFile` for the converted types. The differences that
- * matter, in order:
- *
- *  - the comparison is `config diff`'s — the definition-projected field set on
- *    both sides — so "skip as unchanged" and "Synced" cannot disagree, and a
- *    comment-only or formatting-only edit is not a change;
- *  - the right-hand side is the LIVE entity, not the manifest, so out-of-band
- *    server drift is visible instead of being overwritten;
- *  - the manifest becomes a baseline that answers WHICH side moved, so a
- *    difference is attributed rather than assumed to be a local edit.
- *
- * Declining is a first-class outcome here. `drift`, `conflict` and `immutable`
- * each carry the field diff their report prints, and nothing is applied.
- */
 export function decidePushForConfig(input) {
-    const { spec, maps, localParsed, live, entry, localFileHash, force } = input;
+    const { spec, maps, localParsed, live, entry, localFileHash, localExtra, force } = input;
     if (!live?.record)
         return { action: "create" };
-    const localProjected = projectLocalConfig(spec, localParsed, maps);
+    const { local: localProjected, remote: remoteProjected } = projectConfigPair(spec, localParsed, live.record, maps, live.extra ?? localExtra, localExtra);
     const localHash = computeExpandedContentHash(localProjected);
-    const remoteProjected = projectRemoteConfig(spec, live.record, maps, live.extra);
     const remoteHash = computeExpandedContentHash(remoteProjected);
     const fields = diffProjectedRecords(localProjected, remoteProjected);
     // A difference in a field UPDATE does not accept would PATCH "successfully"
@@ -3312,6 +3703,37 @@ export function decidePushForConfig(input) {
                 entry.modifiedAt === live.modifiedAt,
         },
     });
+    // #2909 — the adopt, for a type whose push path adopts by key. `entry` is
+    // read for ANY of its three signals, not just the baseline: a row carrying
+    // only a legacy signal has been synced, and its unattributable difference is
+    // the conflict below. This is the never-reconciled file alone.
+    //
+    // Deliberately the SIGNALS and not the row's existence: an `id`-only row is
+    // what the 409 recovery seeds before its update lands (and a failed push
+    // still saves), so it names the object an adopt found without recording that
+    // any content was ever reconciled. There is nothing there to attribute a
+    // move with, and refusing it would wedge that half-adopted slot in a
+    // conflict no `config push` can clear — this same regression, one step in.
+    const untracked = entry?.semanticHash === undefined &&
+        entry?.contentHash === undefined &&
+        entry?.modifiedAt === undefined;
+    if (direction === "unknown-direction" &&
+        input.adoptsUntrackedByKey &&
+        untracked) {
+        if (immutableFields.length > 0)
+            return immutable;
+        return {
+            action: "update",
+            direction: "adopt-untracked",
+            localHash,
+            remoteHash,
+            // As for `local-edited`: the LIVE timestamp closes the window between the
+            // reconcile's read and this write. The 409 path omits it because it never
+            // read the record it adopts; this one just did.
+            expectedModifiedAt: live.modifiedAt,
+            fields,
+        };
+    }
     switch (direction) {
         case "unchanged":
             return { action: "skip", localHash, remoteHash };
@@ -4273,6 +4695,14 @@ export async function pullTestCasesForBlock(params) {
             modifiedAt: tc.modifiedAt || tc.createdAt || new Date().toISOString(),
             attachments,
             contentHash: computeFileHash(tomlPath),
+            // #2880 — the file and the server agree right now, so this is the
+            // baseline the next push attributes a difference against.
+            semanticHash: remoteSemanticBaseline({
+                spec: configDiffSpec("test-case"),
+                maps: { ruleSetIdToName: new Map(), ruleSetNameToId: new Map() },
+                returned: tc,
+                extra: { lookupMaps },
+            }),
         };
     }
     // Clean up local files for remotely-deleted test cases
@@ -4352,7 +4782,7 @@ const TEN_MB = 10 * 1024 * 1024;
  * content hashes (#2769). A name the guard rejects is dropped here, before it
  * can be turned into an upload.
  */
-function readLocalAttachments(attachDir, onUnsafe) {
+function readLocalAttachments(attachDir, onUnsafe = () => { }) {
     if (!existsSync(attachDir))
         return [];
     const files = [];
@@ -4432,6 +4862,25 @@ export async function pushTestCasesForBlock(params) {
     const files = readdirSync(testsDir).filter((f) => f.endsWith(".toml"));
     if (files.length === 0)
         return { skipped };
+    // #2880 — the block's live cases, read once. They are what `config diff`
+    // compares against and what `config pull` writes from, so push deciding from
+    // anything else is how the two commands came to disagree. A failed listing
+    // degrades this block to the byte-hash gate, named, rather than sending every
+    // sidecar down the create path.
+    const testCaseSpec = configDiffSpec("test-case");
+    const testCaseExtra = { lookupMaps: params.lookupMaps };
+    const listed = await listAllTestCases(client, appId, blockType, blockId);
+    const liveOk = listed.ok;
+    if (!liveOk) {
+        warn(`  ${blockKey} test cases: live state unavailable — falling back to last-sync content hashes`);
+    }
+    const paired = pairTestCases({
+        blockType,
+        blockKey,
+        localSlugs: files.map((f) => basename(f, ".toml")),
+        liveCases: liveOk ? listed.items : [],
+        managed: syncState?.entities?.testCases,
+    });
     for (const file of files) {
         const slug = basename(file, ".toml");
         const filePath = join(testsDir, file);
@@ -4514,15 +4963,89 @@ export async function pushTestCasesForBlock(params) {
             local: localAttachments,
             recorded: existingEntry,
         });
-        // Skip if file hasn't changed since last sync and no attachment bytes moved.
-        if (!params.options?.force &&
-            existingEntry?.id &&
-            !shouldPushFile(filePath, existingEntry.contentHash) &&
-            attachmentPlan.upload.length === 0) {
-            skipped++;
-            continue;
+        // #2880 — the change decision is the comparison `config diff` makes,
+        // against the case the server holds NOW. The old gate asked the manifest
+        // whether the file's BYTES had moved, so a comment planned an update diff
+        // called synced and server drift was skipped however far it had gone.
+        //
+        // An attachment still pending upload is a change whatever the text says:
+        // the sidecar and its fixtures are one resource to push.
+        const liveCase = paired.bySlug.get(slug);
+        let gate;
+        // The reference resolution above is what loads this block's configs, so the
+        // lookups the comparison reads through are re-derived from it first.
+        params.refreshLookupMaps?.();
+        if (liveOk && liveCase) {
+            gate = decidePushForConfig({
+                spec: testCaseSpec,
+                maps: { ruleSetIdToName: new Map(), ruleSetNameToId: new Map() },
+                localParsed: tomlData,
+                live: { record: liveCase, modifiedAt: liveCase.modifiedAt },
+                entry: existingEntry,
+                localFileHash: computeFileHash(filePath),
+                localExtra: testCaseExtra,
+                force: params.options?.force,
+            });
+            if (gate.action === "skip" && attachmentPlan.upload.length === 0) {
+                skipped++;
+                // A skip decided against live state refreshes the row, so the next run
+                // classifies against a baseline rather than inferring from timestamps.
+                //
+                // CREATING the row when it is missing is the point: the case this skip
+                // agreed with may have been adopted by slug, and identity is the
+                // manifest id first. Recording only rows that already existed left an
+                // adopted case unmanaged, so the next rename lost its id and paired as
+                // local-only beside remote-only — the duplicate create this pairing
+                // exists to prevent.
+                if (syncState) {
+                    if (!syncState.entities.testCases)
+                        syncState.entities.testCases = {};
+                    const entry = (syncState.entities.testCases[stateKey] ??= {
+                        blockType,
+                        blockId,
+                        blockKey,
+                        slug,
+                    });
+                    entry.id = liveCase.testCaseId;
+                    entry.contentHash = computeFileHash(filePath);
+                    entry.semanticHash = gate.remoteHash;
+                    if (liveCase.modifiedAt)
+                        entry.modifiedAt = liveCase.modifiedAt;
+                }
+                continue;
+            }
+            if (gate.action === "drift" ||
+                gate.action === "conflict" ||
+                gate.action === "immutable") {
+                params.declined?.("test-case", `${blockKey}/${slug}`, gate, existingEntry?.modifiedAt);
+                continue;
+            }
+        }
+        else if (!liveOk) {
+            // Degraded: the byte gate this section has always fallen back to, and a
+            // decline when there is no hash to gate on (#2880 criterion 7).
+            const degraded = decideDegradedPush({
+                force: params.options?.force,
+                storedContentHash: existingEntry?.contentHash,
+                currentFileHash: computeFileHash(filePath),
+            });
+            if (degraded.action === "skip" && attachmentPlan.upload.length === 0) {
+                skipped++;
+                continue;
+            }
+            if (degraded.action === "decline") {
+                params.declined?.("test-case", `${blockKey}/${slug}`, { action: "live-unavailable" }, existingEntry?.modifiedAt);
+                continue;
+            }
         }
-        if (existingEntry?.id) {
+        // Live state decides create-vs-update: a case the manifest never recorded
+        // but the server has is adopted rather than duplicated (#2896's half of
+        // this), and one the manifest names that the server no longer has is
+        // re-created.
+        const existingId = liveOk
+            ? liveCase?.testCaseId
+            : existingEntry?.id;
+        if (existingId) {
             // Update existing test case. The body is FULL STATE: the handler only
             // touches keys it receives, so an omitted key retains its old value and
             // blanking a field in the file would never reach the server (#2769).
@@ -4542,11 +5065,30 @@ export async function pushTestCasesForBlock(params) {
             }
             else {
                 try {
-                    await client.updateTestCase(appId, blockType, blockId, existingEntry.id, updatePayload);
+                    const updated = await client.updateTestCase(appId, blockType, blockId, existingId, updatePayload);
                     changes.push({ type: "test-case", action: "update", key: `${blockKey}/${slug}` });
                     info(`  Updated test case: ${blockKey}/${slug}`);
-                    if (syncState?.entities?.testCases?.[stateKey]) {
-                        syncState.entities.testCases[stateKey].contentHash = computeFileHash(filePath);
+                    if (syncState) {
+                        if (!syncState.entities.testCases)
+                            syncState.entities.testCases = {};
+                        const entry = (syncState.entities.testCases[stateKey] ??= {
+                            blockType,
+                            blockId,
+                            blockKey,
+                            slug,
+                        });
+                        entry.id = existingId;
+                        entry.contentHash = computeFileHash(filePath);
+                        if (updated?.modifiedAt)
+                            entry.modifiedAt = updated.modifiedAt;
+                        // #2880 — the baseline, from the record the server stored (it trims
+                        // the name on write), so the next run can attribute a difference.
+                        entry.semanticHash = remoteSemanticBaseline({
+                            spec: testCaseSpec,
+                            maps: { ruleSetIdToName: new Map(), ruleSetNameToId: new Map() },
+                            returned: updated ?? { ...liveCase, ...updatePayload },
+                            extra: testCaseExtra,
+                        });
                     }
                 }
                 catch (err) {
@@ -4586,6 +5128,15 @@ export async function pushTestCasesForBlock(params) {
                             slug,
                             modifiedAt: created.modifiedAt || created.createdAt || new Date().toISOString(),
                             contentHash: computeFileHash(filePath),
+                            // #2880 — a create records its baseline too, from the stored
+                            // record: the handler trims the name, so a baseline taken from
+                            // the file would read that trim as a difference on the next run.
+                            semanticHash: remoteSemanticBaseline({
+                                spec: testCaseSpec,
+                                maps: { ruleSetIdToName: new Map(), ruleSetNameToId: new Map() },
+                                returned: created,
+                                extra: testCaseExtra,
+                            }),
                         };
                     }
                 }
@@ -4602,7 +5153,7 @@ export async function pushTestCasesForBlock(params) {
         // plain push (sponsor ruling, 2026-08-18).
         if (dryRun)
             continue;
-        const testCaseId = existingEntry?.id || syncState?.entities?.testCases?.[stateKey]?.id;
+        const testCaseId = existingId || syncState?.entities?.testCases?.[stateKey]?.id;
         if (!testCaseId)
             continue;
         for (const filename of attachmentPlan.upload) {
@@ -4647,32 +5198,101 @@ export async function pushTestCasesForBlock(params) {
     return { skipped };
 }
 /**
- * Classify one block's sidecar against the server's test-case names (#2769).
+ * Which live test case each sidecar manages (#2880 behavior 16).
+ *
+ * The manifest id comes FIRST. A test case's slug is derived from its name, so
+ * matching on the slug alone made a rename — in either direction — read as a
+ * new local file plus a removable remote case: diff showed two rows for one
+ * case, and push created a duplicate. `entities.testCases[stateKey].id` is
+ * stable across every rename, so it is the identity, and the slug is only how
+ * a sidecar the manifest has never seen is ADOPTED.
  *
- * Remote slugs are derived exactly the way pull writes them — same slugify,
- * same collision suffixes, same order — because a `<slug>-2.toml` on disk IS
- * the second colliding name and must not read as an unpushed local file.
+ * Adoption derives its slugs exactly the way pull writes them — same slugify,
+ * same collision suffixes, same listing order — so a `<slug>-2.toml` on disk IS
+ * the second colliding name and is paired with it.
+ *
+ * One function for both commands, because a diff row and a push decision that
+ * pair differently are two answers to the same question.
  */
-export function classifyTestCaseSidecarDiff(params) {
+export function pairTestCases(input) {
+    const bySlug = new Map();
+    // Claimed by RECORD rather than by id: a row the server returned without one
+    // still has to be paired or reported, never silently dropped from both sides.
+    const claimed = new Set();
+    const byId = new Map();
+    for (const live of input.liveCases) {
+        if (live?.testCaseId)
+            byId.set(live.testCaseId, live);
+    }
+    const unpaired = [];
+    for (const slug of input.localSlugs) {
+        const managedId = input.managed?.[`${input.blockType}/${input.blockKey}/${slug}`]?.id;
+        const live = managedId ? byId.get(managedId) : undefined;
+        if (live) {
+            bySlug.set(slug, live);
+            claimed.add(live);
+        }
+        else {
+            unpaired.push(slug);
+        }
+    }
+    // The slug pull would write for each live case, in listing order, so the
+    // collision suffixes line up with the files on disk.
     const usedSlugs = new Set();
-    const remoteSlugs = new Set(params.remoteNames.map((name) => resolveSlugCollisions(slugifyTestCaseName(name || "unnamed"), usedSlugs)));
-    const rows = [];
-    const local = new Set(params.localSlugs);
-    for (const slug of local) {
-        rows.push({ slug, status: remoteSlugs.has(slug) ? "exists" : LOCAL_ONLY_NEW });
+    const slugOf = new Map();
+    for (const live of input.liveCases) {
+        slugOf.set(live, resolveSlugCollisions(slugifyTestCaseName(live?.name || "unnamed"), usedSlugs));
     }
-    for (const slug of remoteSlugs) {
-        if (!local.has(slug))
-            rows.push({ slug, status: "remote only" });
+    const localOnly = [];
+    for (const slug of unpaired) {
+        const adopted = input.liveCases.find((live) => !claimed.has(live) && slugOf.get(live) === slug);
+        if (adopted) {
+            bySlug.set(slug, adopted);
+            claimed.add(adopted);
+        }
+        else {
+            localOnly.push(slug);
+        }
     }
-    return rows;
+    return {
+        bySlug,
+        localOnly,
+        remoteOnly: input.liveCases.filter((live) => !claimed.has(live)),
+    };
 }
 /**
- * `config diff` for one block's test-case sidecar (#2769). A failed listing is
- * an OUTCOME the caller reports as "not compared" — the old helper returned
- * silently, so a block whose tests could not be fetched simply disappeared from
- * a report that still read as exhaustive.
+ * This block's own `configId`→`configName` pairs, for the comparison (#2880).
+ *
+ * A sidecar pins the config it exercises by NAME so it survives a move between
+ * apps; the server answers with the id. Only the block's configs can equate the
+ * two, and `config diff` reads them from the detail its per-type loops already
+ * fetch — which covers prompts and nothing else. Without this, every script,
+ * integration and workflow sidecar pinned to a config reported Modified
+ * forever, and push read the same pair as server drift.
+ *
+ * One listing per block that has sidecars, and a failed one is silent: an
+ * unresolved reference compares as the id both sides carry, which is the same
+ * degradation `serializeTestCase` already applies.
  */
+async function fillBlockConfigNames(client, appId, blockType, blockId, configIdToName) {
+    try {
+        const configs = blockType === "prompt"
+            ? ((await client.getPrompt(appId, blockId))?.configs ?? [])
+            : blockType === "workflow"
+                ? ((await client.getWorkflow(appId, blockId))?.configs ?? [])
+                : blockType === "script"
+                    ? (await client.listScriptConfigs(appId, blockId)).items
+                    : (await client.listIntegrationConfigs(appId, blockId)).items;
+        for (const config of configs) {
+            if (config?.configId && config?.configName) {
+                configIdToName.set(config.configId, config.configName);
+            }
+        }
+    }
+    catch {
+        // Non-fatal — see above.
+    }
+}
 export async function compareTestCasesForBlock(params) {
     const listed = await listAllTestCases(params.client, params.appId, params.blockType, params.blockId);
     if (!listed.ok)
@@ -4683,17 +5303,97 @@ export async function compareTestCasesForBlock(params) {
             .filter((f) => f.endsWith(".toml"))
             .map((f) => basename(f, ".toml"))
         : [];
-    return {
-        ok: true,
-        rows: classifyTestCaseSidecarDiff({
-            remoteNames: listed.items.map((tc) => tc.name),
-            localSlugs,
-        }).map((row) => ({
-            blockType: params.blockType,
-            blockKey: params.blockKey,
-            ...row,
-        })),
-    };
+    // #2880 — identity is the manifest id, so a rename is one Modified row rather
+    // than a local-only file beside a remote-only case.
+    const managed = params.syncState?.entities?.testCases;
+    const paired = pairTestCases({
+        blockType: params.blockType,
+        blockKey: params.blockKey,
+        localSlugs,
+        liveCases: listed.items,
+        managed,
+    });
+    const spec = configDiffSpec("test-case");
+    const extra = { lookupMaps: params.lookupMaps };
+    const rows = [];
+    const base = { blockType: params.blockType, blockKey: params.blockKey };
+    // The configs this block's sidecars pin by name (see `fillBlockConfigNames`).
+    if (localSlugs.length > 0 && params.lookupMaps) {
+        await fillBlockConfigNames(params.client, params.appId, params.blockType, params.blockId, params.lookupMaps.configIdToName);
+    }
+    for (const slug of localSlugs) {
+        const live = paired.bySlug.get(slug);
+        if (!live) {
+            rows.push({ ...base, slug, status: LOCAL_ONLY_NEW });
+            continue;
+        }
+        const filePath = join(testsDir, `${slug}.toml`);
+        let row;
+        try {
+            const tomlData = parseTomlFile(filePath);
+            // #2880 criterion 1 — a sidecar push's preflight would reject is not one
+            // this command calls synced, and the message is the same one. The WHOLE
+            // preflight, not just the sidecar's own rules: an unknown key or a
+            // mistyped value aborts push too.
+            const errors = testCaseSidecarPreflightErrors(filePath, tomlData);
+            if (errors.length > 0) {
+                row = {
+                    ...base,
+                    slug,
+                    status: VALIDATION_ERROR,
+                    hint: errors.join("; "),
+                };
+            }
+            else {
+                const verdict = compareLocalToRemote(spec, tomlData, live, { ruleSetIdToName: new Map(), ruleSetNameToId: new Map() }, extra, 
+                // Both sides read a reference through the same lookups — see
+                // `compareLocalToRemote`.
+                extra);
+                row = { ...base, slug, ...verdict };
+            }
+        }
+        catch (err) {
+            row = {
+                ...base,
+                slug,
+                status: VALIDATION_ERROR,
+                hint: `${filePath}: ${err?.message || String(err)}`,
+            };
+        }
+        // #2880 behavior 19 — attachments are part of what push would do, read
+        // from the SAME plan push executes. A sidecar whose text compares clean but
+        // whose fixtures have not been uploaded is not Synced.
+        const stateKey = `${params.blockType}/${params.blockKey}/${slug}`;
+        const plan = planAttachmentPush({
+            local: readLocalAttachments(join(testsDir, slug)),
+            recorded: managed?.[stateKey],
+        });
+        if (plan.upload.length > 0) {
+            row.attachmentUploads = plan.upload;
+            if (row.status === "exists") {
+                row.status = "modified";
+                row.hint = `${plan.upload.length} attachment(s) to upload`;
+            }
+        }
+        if (plan.removedRemotely.length > 0) {
+            row.attachmentDeletions = plan.removedRemotely;
+            row.hint = [
+                row.hint,
+                `${plan.removedRemotely.length} attachment(s) deleted locally — \`push --prune\` removes them server-side`,
+            ]
+                .filter(Boolean)
+                .join("; ");
+        }
+        rows.push(row);
+    }
+    for (const live of paired.remoteOnly) {
+        rows.push({
+            ...base,
+            slug: slugifyTestCaseName(live?.name || "unnamed"),
+            status: "remote only",
+        });
+    }
+    return { ok: true, rows };
 }
 /**
  * Shape errors in an authored test-case sidecar, for the push preflight
@@ -4730,6 +5430,29 @@ export function testCaseSidecarErrors(filePath, tomlData) {
     }
     return errors;
 }
+/**
+ * EVERY reason `config push` refuses one test-case sidecar (#2880 criterion 1).
+ *
+ * The four checks the push preflight ran inline: the document's shape, the keys
+ * the definition recognizes, the declared type of each value, and the sidecar's
+ * own authoring rules (#2769). Collected in one place because `config diff`
+ * runs the identical list — it used to run only the last of the four, so a
+ * sidecar with an unknown key or a mistyped ordinary field was reported Synced
+ * by the command whose whole promise is that a Synced file pushes.
+ */
+export function testCaseSidecarPreflightErrors(filePath, tomlData) {
+    const errors = [
+        // The document's own shape first: an unrecognized top-level table makes
+        // every per-table check below read an absent table, so its silence would
+        // be misleading.
+        ...configDocumentShapeErrors(filePath, tomlData, TEST_CASE_SURFACE),
+    ];
+    const unknownKeyError = configUnknownKeyError(filePath, tomlData, TEST_CASE_TABLE);
+    if (unknownKeyError)
+        errors.push(unknownKeyError);
+    errors.push(...configDeclaredTypeErrors(filePath, tomlData, TEST_CASE_TABLE), ...testCaseSidecarErrors(filePath, tomlData));
+    return errors;
+}
 /** Whether a block's own authored file is still in the tree. */
 function blockFileExists(configDir, blockType, blockKey) {
     const resourceType = SYNC_RESOURCE_TYPES.find((t) => t.testBlockType === blockType);
@@ -5249,14 +5972,10 @@ export function registerConfigSyncCommands(sync) {
                 warn(`  ${message}`);
             }
             if (settings && pullsApp) {
-                // Write and warn in one place: a googleClientSecret the server
-                // withheld is not in the file, so pull time is where an operator
-                // finds out — a legacy literal from before reference-only still signs
-                // in (#2256), a malformed reference does not, and either one makes a
-                // push of this file fail.
-                writePulledAppSettings(configDir, settings, {
-                    subject: "  app.toml: googleClientSecret",
-                });
+                // Every writable setting round-trips as of #2891 — the server
+                // withholds nothing — so the pulled file is complete and pushable as
+                // written, with no accompanying note about what it could not carry.
+                writePulledAppSettings(configDir, settings);
                 info("  Wrote app.toml");
             }
             // Write config vars (issue #1423). A single flat vars.toml at the
@@ -5318,6 +6037,12 @@ export function registerConfigSyncCommands(sync) {
             }
             // Write integrations
             const integrationEntities = {};
+            // As for webhooks: no rule-set reference, and the pull-wide maps are
+            // not filled until the rule-set leg, well after this one.
+            const integrationPullMaps = {
+                ruleSetIdToName: new Map(),
+                ruleSetNameToId: new Map(),
+            };
             for (const integration of integrations) {
                 const filename = `${integration.integrationKey}.toml`;
                 const filePath = join(configDir, "integrations", filename);
@@ -5326,6 +6051,9 @@ export function registerConfigSyncCommands(sync) {
                     id: integration.integrationId,
                     modifiedAt: integration.modifiedAt || new Date().toISOString(),
                     contentHash: computeFileHash(filePath),
+                    // #2880 — the two sides agree right now, so this is the baseline
+                    // the next push classifies direction against.
+                    semanticHash: configSemanticHash("integration", filePath, integrationPullMaps),
                 };
                 info(`  Wrote integrations/${filename}`);
             }
@@ -5341,6 +6069,14 @@ export function registerConfigSyncCommands(sync) {
             const webhooksDir = join(configDir, "webhooks");
             mkdirSync(webhooksDir, { recursive: true });
             const webhookEntities = {};
+            // Webhooks carry no rule-set reference, so the shared projection's
+            // resolution maps are inert for this type — the same empty pair the
+            // diff path passes (the pull-wide maps are not filled until the
+            // rule-set leg runs, well after this one).
+            const webhookPullMaps = {
+                ruleSetIdToName: new Map(),
+                ruleSetNameToId: new Map(),
+            };
             for (const webhook of webhooks) {
                 const filename = `${webhook.webhookKey}.toml`;
                 const filePath = join(webhooksDir, filename);
@@ -5349,6 +6085,9 @@ export function registerConfigSyncCommands(sync) {
                     id: webhook.webhookId,
                     modifiedAt: webhook.modifiedAt || new Date().toISOString(),
                     contentHash: computeFileHash(filePath),
+                    // #2880 — the file and the server agree right now, so this is the
+                    // baseline the next push classifies direction against.
+                    semanticHash: configSemanticHash("webhook", filePath, webhookPullMaps),
                 };
                 // A stored value that is not a reference is never written to TOML, so
                 // pull time is where an operator finds out: a legacy literal from
@@ -5389,6 +6128,12 @@ export function registerConfigSyncCommands(sync) {
             const cronTriggersDir = join(configDir, "cron-triggers");
             mkdirSync(cronTriggersDir, { recursive: true });
             const cronTriggerEntities = {};
+            // No rule-set reference on either type, and the pull-wide maps are not
+            // filled until the rule-set leg — see the webhook block above.
+            const keylessPullMaps = {
+                ruleSetIdToName: new Map(),
+                ruleSetNameToId: new Map(),
+            };
             for (const trigger of cronTriggerItems) {
                 const filename = `${trigger.triggerKey}.toml`;
                 const filePath = join(cronTriggersDir, filename);
@@ -5397,6 +6142,8 @@ export function registerConfigSyncCommands(sync) {
                     id: trigger.triggerId,
                     modifiedAt: trigger.modifiedAt || new Date().toISOString(),
                     contentHash: computeFileHash(filePath),
+                    // #2880 — the baseline the next push classifies direction against.
+                    semanticHash: configSemanticHash("cron-trigger", filePath, keylessPullMaps),
                 };
             }
             info(`  Pulled ${cronTriggerItems.length} cron trigger(s)`);
@@ -5414,6 +6161,8 @@ export function registerConfigSyncCommands(sync) {
                     id: bucket.bucketId,
                     modifiedAt: bucket.modifiedAt || new Date().toISOString(),
                     contentHash: computeFileHash(filePath),
+                    // #2880 — as for cron triggers.
+                    semanticHash: configSemanticHash("blob-bucket", filePath, keylessPullMaps),
                 };
             }
             info(`  Pulled ${blobBucketItems.length} blob bucket(s)`);
@@ -6072,6 +6821,12 @@ export function registerConfigSyncCommands(sync) {
                         ? {
                             modifiedAt: new Date().toISOString(),
                             contentHash: computeFileHash(join(configDir, "app.toml")),
+                            // #2880 — the file was just written FROM these settings, so
+                            // this is the state both sides agree on: the baseline the
+                            // next push classifies against. A pull also ends any
+                            // cross-app name exclusion, because the file it just wrote
+                            // states the target's own name.
+                            semanticHash: hashAppSettingsForDiff(settings),
                         }
                         : pullSelection
                             ? priorEntities.app
@@ -6428,6 +7183,22 @@ export function registerConfigSyncCommands(sync) {
                     drifted.push({ type, key });
                     return;
                 }
+                // #2880 criterion 7 — neither side's state is known, so nothing is
+                // written. Named as a failure rather than a skip: the file was NOT
+                // pushed, and a run that reported it as skipped-unchanged would be
+                // claiming a comparison it never made.
+                if (outcome.action === "live-unavailable") {
+                    applyFailures.push({
+                        type,
+                        key,
+                        message: "live state could not be read and the manifest holds no " +
+                            "last-sync content hash for this file, so push cannot tell " +
+                            "which side moved. Nothing was written. Run `config pull` to " +
+                            "take the server's state, or `config push --force` to " +
+                            "overwrite it.",
+                    });
+                    return;
+                }
                 if (outcome.action === "immutable") {
                     applyFailures.push({
                         type,
@@ -6551,6 +7322,37 @@ export function registerConfigSyncCommands(sync) {
             const promptKeyToId = new Map();
             const promptConfigNameToId = new Map(); // key: "promptKey#configName"
             const workflowConfigNameToId = new Map(); // key: "workflowKey#configName"
+            const scriptConfigNameToId = new Map(); // "scriptName#configName" → configId
+            const integrationConfigNameToId = new Map(); // "integrationKey#configName" → configId
+            /**
+             * The id→name direction the test-case comparison reads a reference
+             * through (#2880). Filled from the name→id maps above before the
+             * test-case legs run, and REFILLED as each block's configs are resolved:
+             * the four maps are populated lazily, per block, as a case names one, so
+             * a single fill before the legs start would leave every script and
+             * integration reference — and every prompt this push had no reason to
+             * visit — unresolved, which the comparison reads as server drift on a
+             * file nobody touched.
+             */
+            const pushTestCaseLookupMaps = {
+                configIdToName: new Map(),
+                promptIdToKey: new Map(),
+            };
+            const fillTestCaseLookupMaps = () => {
+                for (const [key, id] of promptKeyToId) {
+                    pushTestCaseLookupMaps.promptIdToKey.set(id, key);
+                }
+                for (const [scoped, id] of [
+                    ...promptConfigNameToId,
+                    ...workflowConfigNameToId,
+                    ...scriptConfigNameToId,
+                    ...integrationConfigNameToId,
+                ]) {
+                    // The map is keyed `<blockKey>#<configName>`; the comparison names
+                    // the config, not the block.
+                    pushTestCaseLookupMaps.configIdToName.set(id, scoped.slice(scoped.indexOf("#") + 1));
+                }
+            };
             // ── Issue #976 (fix A): front-load ALL client-side TOML validation
             // before the first mutating call. Push is apply-as-you-go and processes
             // entities in a fixed sequence (cron triggers are created *before*
@@ -6698,7 +7500,13 @@ export function registerConfigSyncCommands(sync) {
                 try {
                     const parsedApp = parseTomlFile(preflightAppTomlPath);
                     const appErrors = collectAppSettingsPushErrors(parsedApp, {
-                        isCrossAppPush,
+                        // #2880 DSO-001 — the same exclusion the apply block computes, so
+                        // the preflight validates the body that will actually be sent.
+                        excludeName: appSettingsNameExcluded({
+                            isCrossAppPush: !!isCrossAppPush,
+                            recordedExcludedName: syncState?.entities?.app?.excludedName,
+                            fileName: parsedApp?.app?.name,
+                        }),
                     });
                     for (const e of appErrors) {
                         preflightValidationErrors.push(`  app.toml: ${e}`);
@@ -6741,38 +7549,18 @@ export function registerConfigSyncCommands(sync) {
             // preflight pass, so nothing is applied and no request is issued —
             // rather than being dropped on the way to the server and reading as a
             // successful push that changed nothing.
-            for (const { dir, surface, tables } of unknownKeyPreflightTargets()) {
-                const typeDir = join(configDir, dir);
-                if (!existsSync(typeDir))
-                    continue;
-                for (const file of readdirSync(typeDir).filter((f) => f.endsWith(".toml"))) {
-                    const filePath = join(typeDir, file);
-                    let tomlData;
-                    try {
-                        tomlData = parseTomlFile(filePath);
-                    }
-                    catch {
-                        // A file that does not parse is reported by the per-type loop
-                        // with its own message; nothing to add here.
-                        continue;
-                    }
-                    // The document's own shape first: an unrecognized top-level table
-                    // makes every per-table check below read an absent table, so its
-                    // silence would be misleading.
-                    for (const shapeError of configDocumentShapeErrors(filePath, tomlData, surface)) {
-                        preflightValidationErrors.push(`  ${shapeError}`);
-                    }
-                    for (const table of tables) {
-                        const unknownKeyError = configUnknownKeyError(filePath, tomlData, table);
-                        if (unknownKeyError) {
-                            preflightValidationErrors.push(`  ${unknownKeyError}`);
-                        }
-                    }
+            // #2880 — the same collector `config diff` runs, so the two commands
+            // cannot disagree about which files are pushable.
+            for (const rejected of collectConfigFileValidationErrors(configDir)) {
+                for (const message of rejected.messages) {
+                    preflightValidationErrors.push(`  ${message}`);
                 }
             }
             // The `<key>.tests/*.toml` sidecars, which sit beside the block they
             // test rather than in a type directory of their own. Same posture,
-            // reached through the registry's `test-case` surface.
+            // reached through the registry's `test-case` surface — and through the
+            // same collector `config diff` runs per sidecar (#2880), so neither
+            // command can refuse a file the other calls Synced.
             for (const filePath of testCaseTomlFiles(configDir)) {
                 let tomlData;
                 try {
@@ -6782,18 +7570,8 @@ export function registerConfigSyncCommands(sync) {
                     // Reported by the per-block test-case loop with its own message.
                     continue;
                 }
-                for (const shapeError of configDocumentShapeErrors(filePath, tomlData, TEST_CASE_SURFACE)) {
-                    preflightValidationErrors.push(`  ${shapeError}`);
-                }
-                const unknownKeyError = configUnknownKeyError(filePath, tomlData, TEST_CASE_TABLE);
-                if (unknownKeyError) {
-                    preflightValidationErrors.push(`  ${unknownKeyError}`);
-                }
-                // #2769 — with TOML the only authoring path, a sidecar the server
-                // would reject (no `name`) or whose JSON text does not parse fails
-                // here, before any test case is created or updated.
-                for (const shapeError of testCaseSidecarErrors(filePath, tomlData)) {
-                    preflightValidationErrors.push(`  ${shapeError}`);
+                for (const message of testCaseSidecarPreflightErrors(filePath, tomlData)) {
+                    preflightValidationErrors.push(`  ${message}`);
                 }
             }
             if (preflightValidationErrors.length > 0) {
@@ -6938,36 +7716,188 @@ export function registerConfigSyncCommands(sync) {
             // else in the slot (issue #2645): a full push applies it, and
             // `--only app` applies it alone. The separate `settings push` command
             // that used to own this is gone.
+            //
+            // #2880 behaviors 10, 11 and 14 — this block used to answer "changed?"
+            // from the file's BYTES and then PATCH only the keys the file spelled.
+            // Both are gone. The comparison is the one `config diff` reports, over
+            // the full writable descriptor set, and the payload is the whole file:
+            // a key the file no longer carries is the clear (or the declared
+            // default) push applies, exactly as it is for every other type (#1567).
             const appTomlPath = join(configDir, "app.toml");
             if (existsSync(appTomlPath) && (!pushSelection || pushSelection.app)) {
-                const appChanged = options.force || !syncState?.entities?.app?.contentHash ||
-                    shouldPushFile(appTomlPath, syncState.entities.app.contentHash);
-                if (!appChanged) {
-                    skippedCount++;
-                    info("  Skipped app settings (unchanged)");
+                const tomlData = parseTomlFile(appTomlPath);
+                const appEntry = syncState?.entities?.app;
+                const appFileHash = computeFileHash(appTomlPath);
+                const appFileName = tomlData?.app?.name;
+                const recordedExcludedName = appEntry?.excludedName;
+                // DSO-001, the cross-app rule in three parts.
+                //
+                // `payloadExcludesName` — is `[app].name` out of the body? A
+                // cross-app push never renames its target, and neither does a later
+                // push of a file still stating the name that push left behind.
+                //
+                // `compareExcludesName` — are the two hashes computed without it?
+                // While an exclusion RECORD exists they must be, because that is how
+                // the baseline was stamped, and `classifyPushChange` can only answer
+                // `local-edited` when the remote hash equals the baseline.
+                //
+                // `appNameEdited` — the file has moved away from the recorded name.
+                // That is a local rename BY CONSTRUCTION, not by comparison: no
+                // baseline hashed without `name` can ever attribute it.
+                const payloadExcludesName = appSettingsNameExcluded({
+                    isCrossAppPush: !!isCrossAppPush,
+                    recordedExcludedName,
+                    fileName: appFileName,
+                });
+                const compareExcludesName = !!isCrossAppPush || recordedExcludedName !== undefined;
+                const appNameEdited = !isCrossAppPush &&
+                    recordedExcludedName !== undefined &&
+                    !payloadExcludesName;
+                // The whole-truth body. Errors (an unrecognized or retired key, a
+                // type mismatch, a missing required key) already aborted the push in
+                // the preflight pass above, so only warnings remain here.
+                const { settings: appPayload, warnings: appWarnings } = buildAppSettingsPayload(tomlData, {
+                    excludeName: payloadExcludesName,
+                });
+                for (const w of appWarnings) {
+                    warn(`  ${w}`);
+                }
+                let appLiveOk = true;
+                let liveSettings;
+                try {
+                    liveSettings = await client.getAppSettings(resolvedAppId);
+                }
+                catch (err) {
+                    appLiveOk = false;
+                    warnLiveUnavailable("app-settings", err);
+                }
+                /** Record the state both sides are now known to be in. */
+                const stampAppEntry = (baselineSettings, options) => {
+                    if (!syncState)
+                        return;
+                    syncState.entities.app = {
+                        modifiedAt: baselineSettings?.modifiedAt ||
+                            appEntry?.modifiedAt ||
+                            new Date().toISOString(),
+                        contentHash: appFileHash,
+                        semanticHash: hashAppSettingsForDiff(baselineSettings, {
+                            excludeName: options.recordExclusion !== undefined ||
+                                (options.keepExclusion && compareExcludesName),
+                        }),
+                        ...(options.recordExclusion !== undefined
+                            ? { excludedName: options.recordExclusion }
+                            : options.keepExclusion && recordedExcludedName !== undefined
+                                ? { excludedName: recordedExcludedName }
+                                : {}),
+                    };
+                };
+                let applyAppSettings = true;
+                if (appLiveOk) {
+                    const compareOptions = { excludeName: compareExcludesName };
+                    const localHash = hashAppSettingsForDiff(appPayload, compareOptions);
+                    const remoteHash = hashAppSettingsForDiff(liveSettings ?? {}, compareOptions);
+                    if (options.force) {
+                        // `--force` is the operator saying "local wins": no direction
+                        // check, exactly as it is for every other type.
+                    }
+                    else if (isCrossAppPush) {
+                        // The target's settings are not this slot's history: there is no
+                        // baseline and none is inferable, and applying the source's
+                        // configuration is the whole point of the push. `name` is already
+                        // out of the body, so the one thing that could not be recovered
+                        // by a later `config pull` is not at risk.
+                    }
+                    else {
+                        const direction = classifyPushChange({
+                            localHash,
+                            remoteHash,
+                            baselineHash: appEntry?.semanticHash,
+                            legacy: {
+                                localBytesMatchStoredContentHash: appEntry?.contentHash !== undefined &&
+                                    appEntry.contentHash === appFileHash,
+                                // Deliberately never true: `entities.app.modifiedAt` is
+                                // stamped from the LOCAL clock, so it proves nothing about
+                                // the server. A pre-upgrade manifest whose bytes have also
+                                // moved is therefore `unknown-direction` — a conflict, not a
+                                // blind overwrite of state nobody compared.
+                                liveModifiedAtMatchesStored: false,
+                            },
+                        });
+                        const fields = appSettingsFieldDiffs(appPayload, liveSettings ?? {}, compareOptions).map((d) => ({
+                            field: `[${d.section}].${d.key}`,
+                            local: d.local,
+                            server: d.remote,
+                        }));
+                        if (direction === "unchanged") {
+                            // A rename still has to go out: the comparison above cannot
+                            // see `name` while the exclusion record stands.
+                            if (!appNameEdited) {
+                                skippedCount++;
+                                info("  Skipped app settings (unchanged)");
+                                stampAppEntry(liveSettings, { keepExclusion: true });
+                                applyAppSettings = false;
+                            }
+                        }
+                        else if (direction === "server-drifted") {
+                            recordDeclined("app-settings", "app.toml", { action: "drift", localHash, remoteHash, fields }, appEntry?.modifiedAt);
+                            applyAppSettings = false;
+                        }
+                        else if (direction === "both-changed" ||
+                            direction === "unknown-direction") {
+                            recordDeclined("app-settings", "app.toml", {
+                                action: "conflict",
+                                direction,
+                                localHash,
+                                remoteHash,
+                                fields,
+                                serverModifiedAt: liveSettings?.modifiedAt,
+                            }, appEntry?.modifiedAt);
+                            applyAppSettings = false;
+                        }
+                    }
                 }
                 else {
-                    const tomlData = parseTomlFile(appTomlPath);
-                    // Definition-driven parse of every section ([app]/[auth]/[cors]/
-                    // [invitations]) — issue #1033, projected from the vendored
-                    // `app-settings` surface since #2644. `name` is stripped on
-                    // cross-app push. Errors (an unrecognized key or table, a type
-                    // mismatch) already aborted the push in the preflight pass above,
-                    // so only warnings remain here.
-                    const { settings, warnings: appWarnings } = parseTomlToAppSettings(tomlData, { isCrossAppPush });
-                    for (const w of appWarnings) {
-                        warn(`  ${w}`);
+                    const degraded = decideDegradedPush({
+                        force: options.force,
+                        storedContentHash: appEntry?.contentHash,
+                        currentFileHash: appFileHash,
+                    });
+                    if (degraded.action === "skip") {
+                        skippedCount++;
+                        info("  Skipped app settings (unchanged)");
+                        applyAppSettings = false;
                     }
+                    else if (degraded.action === "decline") {
+                        recordDeclined("app-settings", "app.toml", { action: "live-unavailable" }, appEntry?.modifiedAt);
+                        applyAppSettings = false;
+                    }
+                }
+                if (applyAppSettings) {
                     changes.push({ type: "app", action: "update", key: "settings" });
                     if (!options.dryRun) {
-                        await client.updateAppSettings(resolvedAppId, settings);
+                        const updated = await client.updateAppSettings(resolvedAppId, appPayload);
                         info("  Updated app settings");
-                        // Store content hash after successful push
-                        if (syncState) {
-                            if (!syncState.entities.app) {
-                                syncState.entities.app = { modifiedAt: new Date().toISOString() };
-                            }
-                            syncState.entities.app.contentHash = computeFileHash(appTomlPath);
+                        // Stamped from what the server RETURNED, not from the body sent:
+                        // `PUT /settings` normalizes (a trailing slash off `baseUrl`, a
+                        // lower-cased test-account email), so the payload is not what the
+                        // next comparison will read. The PUT echoes the full settings; if
+                        // a server ever answers with something else, re-read rather than
+                        // record a state nobody observed.
+                        const baselineSettings = updated && typeof updated === "object" && "mode" in updated
+                            ? updated
+                            : await client
+                                .getAppSettings(resolvedAppId)
+                                .catch(() => undefined);
+                        if (baselineSettings) {
+                            stampAppEntry(baselineSettings, {
+                                keepExclusion: false,
+                                // A cross-app apply is what CREATES the exclusion: the
+                                // target keeps its own name, and the file's name is recorded
+                                // so a later edit to that line reads as the rename it is.
+                                ...(isCrossAppPush && appFileName !== undefined
+                                    ? { recordExclusion: String(appFileName) }
+                                    : {}),
+                            });
                         }
                     }
                 }
@@ -7190,13 +8120,26 @@ export function registerConfigSyncCommands(sync) {
                             continue;
                         }
                     }
-                    else if (!options.force &&
-                        existingId &&
-                        !shouldPushFile(filePath, entry?.contentHash)) {
-                        // Fallback gate: the manifest byte hash, exactly as before.
-                        skippedCount++;
-                        ruleSetNameToId.set(ruleSetData.name, existingId);
-                        continue;
+                    else {
+                        // Fallback gate: the manifest byte hash, and — since #2880 — a
+                        // decline rather than a blind write when there is no hash.
+                        const degraded = decideDegradedPush({
+                            force: options.force,
+                            storedContentHash: entry?.contentHash,
+                            currentFileHash: computeFileHash(filePath),
+                        });
+                        if (degraded.action === "skip") {
+                            skippedCount++;
+                            if (existingId)
+                                ruleSetNameToId.set(ruleSetData.name, existingId);
+                            continue;
+                        }
+                        if (degraded.action === "decline") {
+                            recordDeclined("rule-set", fileKey, { action: "live-unavailable" }, entry?.modifiedAt);
+                            if (existingId)
+                                ruleSetNameToId.set(ruleSetData.name, existingId);
+                            continue;
+                        }
                     }
                     if (existingId) {
                         // Update existing rule set
@@ -7337,17 +8280,112 @@ export function registerConfigSyncCommands(sync) {
             const integrationsDir = join(configDir, "integrations");
             if (existsSync(integrationsDir)) {
                 const files = selectFiles("integration", integrationsDir, readdirSync(integrationsDir).filter((f) => f.endsWith(".toml")));
+                // #2880 — integrations join the live-state reconcile (#2731 B3), for
+                // the reason webhooks did: diff compared presence while push gated on
+                // the file's bytes, so a field edit was invisible to one command and
+                // applied by the other, and a comment was a change to the other and
+                // not the one.
+                const integrationSpec = configDiffSpec("integration");
+                const liveIntegrations = new Map();
+                let integrationsLiveOk = true;
+                if (files.length > 0) {
+                    try {
+                        const listed = await fetchAll((p) => client.listIntegrations(resolvedAppId, p));
+                        for (const i of listed) {
+                            if (i?.integrationKey)
+                                liveIntegrations.set(i.integrationKey, i);
+                        }
+                    }
+                    catch (err) {
+                        integrationsLiveOk = false;
+                        warnLiveUnavailable("integrations", err);
+                    }
+                }
+                /** The detail — `accessRule` and `requestConfig` are not on the list. */
+                const refetchLiveIntegration = async (integrationId) => {
+                    const full = await client.getIntegration(resolvedAppId, integrationId);
+                    return full ? { record: full } : null;
+                };
                 for (const file of files) {
                     const filePath = join(integrationsDir, file);
                     const tomlData = parseTomlFile(filePath);
-                    const integration = tomlData.integration || {};
-                    const key = integration.key || basename(file, ".toml");
-                    const existingId = syncState?.entities?.integrations?.[key]?.id;
-                    // Skip if file hasn't changed since last sync
-                    if (!options.force && existingId && !shouldPushFile(filePath, syncState?.entities?.integrations?.[key]?.contentHash)) {
-                        skippedCount++;
-                        continue;
-                    }
+                    const key = tomlData.integration?.key || basename(file, ".toml");
+                    // The gate re-parses the DOCUMENT, so the key the file left to its
+                    // name has to be in it (see `withDerivedIdentity`).
+                    withDerivedIdentity(tomlData, "integration", { key });
+                    const existingEntry = syncState?.entities?.integrations?.[key];
+                    const liveListed = liveIntegrations.get(key);
+                    let integrationLiveOk = integrationsLiveOk;
+                    let liveIntegration = undefined;
+                    if (integrationLiveOk && liveListed?.integrationId) {
+                        try {
+                            liveIntegration = await client.getIntegration(resolvedAppId, liveListed.integrationId);
+                        }
+                        catch (err) {
+                            integrationLiveOk = false;
+                            warnLiveUnavailable(`integration ${key}`, err);
+                        }
+                    }
+                    let gate;
+                    if (integrationLiveOk) {
+                        gate = decidePushForConfig({
+                            spec: integrationSpec,
+                            maps: pushDiffMaps,
+                            localParsed: tomlData,
+                            live: liveIntegration
+                                ? {
+                                    record: liveIntegration,
+                                    modifiedAt: liveIntegration.modifiedAt,
+                                }
+                                : null,
+                            entry: existingEntry,
+                            localFileHash: computeFileHash(filePath),
+                            force: options.force,
+                        });
+                        if (gate.action === "skip") {
+                            skippedCount++;
+                            if (syncState && liveIntegration?.integrationId) {
+                                if (!syncState.entities.integrations) {
+                                    syncState.entities.integrations = {};
+                                }
+                                syncState.entities.integrations[key] = {
+                                    id: liveIntegration.integrationId,
+                                    modifiedAt: liveIntegration.modifiedAt ||
+                                        existingEntry?.modifiedAt ||
+                                        new Date().toISOString(),
+                                    contentHash: computeFileHash(filePath),
+                                    semanticHash: gate.remoteHash,
+                                };
+                            }
+                            continue;
+                        }
+                        if (gate.action === "drift" ||
+                            gate.action === "conflict" ||
+                            gate.action === "immutable") {
+                            recordDeclined("integration", key, gate, existingEntry?.modifiedAt);
+                            continue;
+                        }
+                    }
+                    else {
+                        const degraded = decideDegradedPush({
+                            force: options.force,
+                            storedContentHash: existingEntry?.contentHash,
+                            currentFileHash: computeFileHash(filePath),
+                        });
+                        if (degraded.action === "skip") {
+                            skippedCount++;
+                            continue;
+                        }
+                        if (degraded.action === "decline") {
+                            recordDeclined("integration", key, { action: "live-unavailable" }, existingEntry?.modifiedAt);
+                            continue;
+                        }
+                    }
+                    const existingId = resolveExistingId({
+                        liveOk: integrationLiveOk,
+                        liveId: liveListed?.integrationId,
+                        manifestId: existingEntry?.id,
+                    });
                     // Same body on the create, update, and adopt-then-update paths.
                     const payload = buildIntegrationPushPayload(key, tomlData);
                     // #2631 — `accessRule` is TOML-owned, so a file with no rule pushes
@@ -7361,26 +8399,36 @@ export function registerConfigSyncCommands(sync) {
                     if (existingId) {
                         changes.push({ type: "integration", action: "update", key });
                         if (!options.dryRun) {
+                            // #2731 B4 — the guard is the LIVE timestamp the reconcile just
+                            // read (the gate carries it), not the manifest's.
                             const expectedModifiedAt = options.force
                                 ? undefined
-                                : syncState?.entities?.integrations?.[key]?.modifiedAt;
+                                : gate?.action === "update"
+                                    ? gate.expectedModifiedAt
+                                    : existingEntry?.modifiedAt;
                             try {
                                 const updated = await client.updateIntegration(resolvedAppId, existingId, payload, expectedModifiedAt);
                                 info(`  Updated integration: ${key}`);
-                                // Update sync state with new modifiedAt
-                                if (syncState?.entities?.integrations?.[key] && updated?.modifiedAt) {
-                                    syncState.entities.integrations[key].modifiedAt = updated.modifiedAt;
-                                    syncState.entities.integrations[key].contentHash = computeFileHash(filePath);
+                                if (syncState) {
+                                    if (!syncState.entities.integrations) {
+                                        syncState.entities.integrations = {};
+                                    }
+                                    syncState.entities.integrations[key] = {
+                                        id: existingId,
+                                        modifiedAt: updated?.modifiedAt ||
+                                            existingEntry?.modifiedAt ||
+                                            new Date().toISOString(),
+                                        contentHash: computeFileHash(filePath),
+                                        // From the entity the SERVER returned: the handler
+                                        // canonicalizes `requestConfig`, so the payload sent is
+                                        // not what the next comparison will see.
+                                        semanticHash: await stampRemoteSemanticHash(integrationSpec, updated, () => refetchLiveIntegration(existingId)),
+                                    };
                                 }
                             }
                             catch (err) {
                                 if (err instanceof ConflictError) {
-                                    conflicts.push({
-                                        type: "integration",
-                                        key,
-                                        serverModifiedAt: err.serverModifiedAt,
-                                        localModifiedAt: expectedModifiedAt || "unknown",
-                                    });
+                                    conflicts.push(await lateConflict("integration", key, err, expectedModifiedAt, () => refetchLiveIntegration(existingId), integrationSpec, tomlData));
                                 }
                                 else {
                                     throw wrapEntityError(err, "update", "integration", key);
@@ -7403,6 +8451,12 @@ export function registerConfigSyncCommands(sync) {
                                         id: created.integrationId,
                                         modifiedAt: created.modifiedAt,
                                         contentHash: computeFileHash(filePath),
+                                        // #2880 — a create records its baseline too, read from
+                                        // the stored entity: the handler materializes the
+                                        // defaults and canonicalizes `requestConfig`, so a
+                                        // baseline taken from the file would read those as a
+                                        // difference on the very next run.
+                                        semanticHash: await stampRemoteSemanticHash(integrationSpec, created, () => refetchLiveIntegration(created.integrationId)),
                                     };
                                 }
                             }
@@ -7434,6 +8488,9 @@ export function registerConfigSyncCommands(sync) {
                                             existing.modifiedAt ||
                                             new Date().toISOString(),
                                         contentHash: computeFileHash(filePath),
+                                        // #2880 — an adoption converges here, so it stamps the
+                                        // baseline the next run classifies against.
+                                        semanticHash: await stampRemoteSemanticHash(integrationSpec, updated, () => refetchLiveIntegration(existing.integrationId)),
                                     };
                                 }
                             }
@@ -7445,42 +8502,175 @@ export function registerConfigSyncCommands(sync) {
             const webhooksDir = join(configDir, "webhooks");
             if (existsSync(webhooksDir)) {
                 const files = selectFiles("webhook", webhooksDir, readdirSync(webhooksDir).filter((f) => f.endsWith(".toml")));
+                // #2880 — webhooks join the live-state reconcile (#2731 B3). #2757
+                // gave the type diff's comparator and left push on the manifest byte
+                // hash, so the two commands answered "changed?" from different
+                // sources and disagreed in both directions: a comment moved the bytes
+                // and push planned an update diff read as Synced, and a file whose
+                // bytes had not moved was skipped however far its CONTENT had drifted
+                // from the server, so a reported `Modified` could never be pushed
+                // away. Both are the same fix — push decides from the projection diff
+                // compares, against the entity diff compares it to.
+                //
+                // It also retires `modifiedAt` as a CONTENT signal wherever a
+                // baseline exists, which is what stops a delivery (whose
+                // `lastTriggeredAt` bumps `modifiedAt`) from reading as a permanent
+                // conflict on an unedited file (#2894).
+                const webhookSpec = configDiffSpec("webhook");
+                // The list says WHICH webhooks the server has and under which id; the
+                // detail is what `config pull` serializes from, so the comparison
+                // fetches it per selected file. A failed list is NOT an empty list —
+                // treating it as one would send every webhook down the create path —
+                // so it degrades the section to the byte-hash gate, type named.
+                const liveWebhooks = new Map();
+                let webhooksLiveOk = true;
+                if (files.length > 0) {
+                    try {
+                        const listed = await fetchAll((p) => client.listWebhooks(resolvedAppId, p));
+                        for (const w of listed) {
+                            if (w?.webhookKey)
+                                liveWebhooks.set(w.webhookKey, w);
+                        }
+                    }
+                    catch (err) {
+                        webhooksLiveOk = false;
+                        warnLiveUnavailable("webhooks", err);
+                    }
+                }
+                /** One webhook as the server holds it NOW — the post-apply baseline. */
+                const refetchLiveWebhook = async (webhookId) => {
+                    const full = await client.getWebhook(resolvedAppId, webhookId);
+                    return full ? { record: full } : null;
+                };
                 for (const file of files) {
                     const filePath = join(webhooksDir, file);
                     const tomlData = parseTomlFile(filePath);
-                    const webhook = tomlData.webhook || {};
-                    const key = webhook.key || basename(file, ".toml");
-                    const existingId = syncState?.entities?.webhooks?.[key]?.id;
-                    if (!options.force && existingId &&
-                        !shouldPushFile(filePath, syncState?.entities?.webhooks?.[key]?.contentHash)) {
-                        skippedCount++;
-                        continue;
+                    const key = tomlData.webhook?.key || basename(file, ".toml");
+                    // The gate re-parses the DOCUMENT, so the key the file left to its
+                    // name has to be in it (see `withDerivedIdentity`): `displayName`
+                    // falls back to the key, so a file stating neither would otherwise
+                    // project an empty name against the derived one the server holds.
+                    withDerivedIdentity(tomlData, "webhook", { key });
+                    const existingEntry = syncState?.entities?.webhooks?.[key];
+                    const liveListed = liveWebhooks.get(key);
+                    // A detail read that fails degrades THIS webhook to the byte-hash
+                    // gate, never the section — its neighbours still reconcile.
+                    let webhookLiveOk = webhooksLiveOk;
+                    let liveWebhook = undefined;
+                    if (webhookLiveOk && liveListed?.webhookId) {
+                        try {
+                            liveWebhook = await client.getWebhook(resolvedAppId, liveListed.webhookId);
+                        }
+                        catch (err) {
+                            webhookLiveOk = false;
+                            warnLiveUnavailable(`webhook ${key}`, err);
+                        }
                     }
+                    let gate;
+                    if (webhookLiveOk) {
+                        gate = decidePushForConfig({
+                            spec: webhookSpec,
+                            // Webhooks carry no rule-set reference, so these maps are inert
+                            // for this type — shared with `stampRemoteSemanticHash` so the
+                            // gate and the baseline it compares against cannot diverge.
+                            maps: pushDiffMaps,
+                            localParsed: tomlData,
+                            live: liveWebhook
+                                ? { record: liveWebhook, modifiedAt: liveWebhook.modifiedAt }
+                                : null,
+                            entry: existingEntry,
+                            localFileHash: computeFileHash(filePath),
+                            force: options.force,
+                        });
+                        if (gate.action === "skip") {
+                            skippedCount++;
+                            if (syncState && liveWebhook?.webhookId) {
+                                if (!syncState.entities.webhooks)
+                                    syncState.entities.webhooks = {};
+                                syncState.entities.webhooks[key] = {
+                                    id: liveWebhook.webhookId,
+                                    modifiedAt: liveWebhook.modifiedAt ||
+                                        existingEntry?.modifiedAt ||
+                                        new Date().toISOString(),
+                                    contentHash: computeFileHash(filePath),
+                                    // The two sides agree HERE, so this is the baseline the
+                                    // next run classifies against — which is what stops a
+                                    // comment-only edit from re-reporting forever.
+                                    semanticHash: gate.remoteHash,
+                                };
+                            }
+                            continue;
+                        }
+                        if (gate.action === "drift" ||
+                            gate.action === "conflict" ||
+                            gate.action === "immutable") {
+                            recordDeclined("webhook", key, gate, existingEntry?.modifiedAt);
+                            continue;
+                        }
+                    }
+                    else {
+                        const degraded = decideDegradedPush({
+                            force: options.force,
+                            storedContentHash: existingEntry?.contentHash,
+                            currentFileHash: computeFileHash(filePath),
+                        });
+                        if (degraded.action === "skip") {
+                            skippedCount++;
+                            continue;
+                        }
+                        if (degraded.action === "decline") {
+                            recordDeclined("webhook", key, { action: "live-unavailable" }, existingEntry?.modifiedAt);
+                            continue;
+                        }
+                    }
+                    // Live state decides create-vs-update: a webhook the manifest never
+                    // recorded is adopted, and one the manifest still names but the
+                    // server no longer has goes to the create path (#1659).
+                    const existingId = resolveExistingId({
+                        liveOk: webhookLiveOk,
+                        liveId: liveListed?.webhookId,
+                        manifestId: existingEntry?.id,
+                    });
                     // Same body on the create, update, and adopt-then-update paths,
                     // built from the vendored definition (#2644).
                     const payload = buildWebhookPushPayload(key, tomlData);
                     if (existingId) {
                         changes.push({ type: "webhook", action: "update", key });
                         if (!options.dryRun) {
+                            // #2731 B4 — the guard is the LIVE timestamp the reconcile
+                            // fetch just read (the gate carries it), not the manifest's:
+                            // that closes the window between the read and this write
+                            // rather than re-reporting a difference we just looked at.
                             const expectedModifiedAt = options.force
                                 ? undefined
-                                : syncState?.entities?.webhooks?.[key]?.modifiedAt;
+                                : gate?.action === "update"
+                                    ? gate.expectedModifiedAt
+                                    : existingEntry?.modifiedAt;
                             try {
                                 const updated = await client.updateWebhook(resolvedAppId, existingId, payload, expectedModifiedAt);
                                 info(`  Updated webhook: ${key}`);
-                                if (syncState?.entities?.webhooks?.[key] && updated?.modifiedAt) {
-                                    syncState.entities.webhooks[key].modifiedAt = updated.modifiedAt;
-                                    syncState.entities.webhooks[key].contentHash = computeFileHash(filePath);
+                                if (syncState) {
+                                    if (!syncState.entities.webhooks)
+                                        syncState.entities.webhooks = {};
+                                    syncState.entities.webhooks[key] = {
+                                        id: existingId,
+                                        modifiedAt: updated?.modifiedAt ||
+                                            existingEntry?.modifiedAt ||
+                                            new Date().toISOString(),
+                                        contentHash: computeFileHash(filePath),
+                                        // Stamped from the RETURNED entity, not the payload sent:
+                                        // the handler normalizes, so the payload is not what the
+                                        // next comparison will see.
+                                        semanticHash: await stampRemoteSemanticHash(webhookSpec, updated, () => refetchLiveWebhook(existingId)),
+                                    };
                                 }
                             }
                             catch (err) {
                                 if (err instanceof ConflictError) {
-                                    conflicts.push({
-                                        type: "webhook",
-                                        key,
-                                        serverModifiedAt: err.serverModifiedAt,
-                                        localModifiedAt: expectedModifiedAt || "unknown",
-                                    });
+                                    // A late 409: the server moved between the reconcile fetch
+                                    // and this write, so the gate's field diff describes a state
+                                    // that is gone. Recompute against the current record.
+                                    conflicts.push(await lateConflict("webhook", key, err, expectedModifiedAt, () => refetchLiveWebhook(existingId), webhookSpec, tomlData));
                                 }
                                 else {
                                     throw wrapEntityError(err, "update", "webhook", key);
@@ -7502,6 +8692,10 @@ export function registerConfigSyncCommands(sync) {
                                         id: created.webhookId,
                                         modifiedAt: created.modifiedAt,
                                         contentHash: computeFileHash(filePath),
+                                        // #2880 — the baseline the next run classifies against,
+                                        // read from what the server stored rather than what was
+                                        // sent (the handler normalizes).
+                                        semanticHash: await stampRemoteSemanticHash(webhookSpec, created, () => refetchLiveWebhook(created.webhookId)),
                                     };
                                 }
                             }
@@ -7533,6 +8727,10 @@ export function registerConfigSyncCommands(sync) {
                                             existing.modifiedAt ||
                                             new Date().toISOString(),
                                         contentHash: computeFileHash(filePath),
+                                        // #2880 — an adoption converges here, so it stamps the
+                                        // baseline too; without it the next run has no direction
+                                        // signal for a row this one just reconciled.
+                                        semanticHash: await stampRemoteSemanticHash(webhookSpec, updated, () => refetchLiveWebhook(existing.webhookId)),
                                     };
                                 }
                             }
@@ -7544,17 +8742,96 @@ export function registerConfigSyncCommands(sync) {
             const cronTriggersDir = join(configDir, "cron-triggers");
             if (existsSync(cronTriggersDir)) {
                 const files = selectFiles("cron-trigger", cronTriggersDir, readdirSync(cronTriggersDir).filter((f) => f.endsWith(".toml")));
+                // #2880 — cron triggers join the live-state reconcile. The LIST row is
+                // the whole record for this type (it is what `config pull`
+                // serializes from), so the section needs no per-entity detail read.
+                // The update endpoint takes no `expectedModifiedAt`, which is exactly
+                // why the read-time direction classification matters here: it is the
+                // only protection this type has ever had, and it was comparing bytes.
+                const cronSpec = configDiffSpec("cron-trigger");
+                const liveCronTriggers = new Map();
+                let cronLiveOk = true;
+                if (files.length > 0) {
+                    try {
+                        const listed = await client.listCronTriggers(resolvedAppId);
+                        for (const t of (listed?.items ?? [])) {
+                            if (t?.triggerKey)
+                                liveCronTriggers.set(t.triggerKey, t);
+                        }
+                    }
+                    catch (err) {
+                        cronLiveOk = false;
+                        warnLiveUnavailable("cron-triggers", err);
+                    }
+                }
+                const refetchLiveCronTrigger = async (triggerId) => {
+                    const full = await client.getCronTrigger(resolvedAppId, triggerId);
+                    return full ? { record: full } : null;
+                };
                 for (const file of files) {
                     const filePath = join(cronTriggersDir, file);
                     const tomlData = parseTomlFile(filePath);
-                    const cronTrigger = tomlData.cronTrigger || {};
-                    const key = cronTrigger.key || basename(file, ".toml");
-                    const existingId = syncState?.entities?.cronTriggers?.[key]?.id;
-                    if (!options.force && existingId &&
-                        !shouldPushFile(filePath, syncState?.entities?.cronTriggers?.[key]?.contentHash)) {
-                        skippedCount++;
-                        continue;
+                    const key = tomlData.cronTrigger?.key || basename(file, ".toml");
+                    withDerivedIdentity(tomlData, "cronTrigger", { key });
+                    const existingEntry = syncState?.entities?.cronTriggers?.[key];
+                    const liveCron = liveCronTriggers.get(key);
+                    let gate;
+                    if (cronLiveOk) {
+                        gate = decidePushForConfig({
+                            spec: cronSpec,
+                            maps: pushDiffMaps,
+                            localParsed: tomlData,
+                            live: liveCron
+                                ? { record: liveCron, modifiedAt: liveCron.modifiedAt }
+                                : null,
+                            entry: existingEntry,
+                            localFileHash: computeFileHash(filePath),
+                            force: options.force,
+                        });
+                        if (gate.action === "skip") {
+                            skippedCount++;
+                            if (syncState && liveCron?.triggerId) {
+                                if (!syncState.entities.cronTriggers) {
+                                    syncState.entities.cronTriggers = {};
+                                }
+                                syncState.entities.cronTriggers[key] = {
+                                    id: liveCron.triggerId,
+                                    modifiedAt: liveCron.modifiedAt ||
+                                        existingEntry?.modifiedAt ||
+                                        new Date().toISOString(),
+                                    contentHash: computeFileHash(filePath),
+                                    semanticHash: gate.remoteHash,
+                                };
+                            }
+                            continue;
+                        }
+                        if (gate.action === "drift" ||
+                            gate.action === "conflict" ||
+                            gate.action === "immutable") {
+                            recordDeclined("cron-trigger", key, gate, existingEntry?.modifiedAt);
+                            continue;
+                        }
+                    }
+                    else {
+                        const degraded = decideDegradedPush({
+                            force: options.force,
+                            storedContentHash: existingEntry?.contentHash,
+                            currentFileHash: computeFileHash(filePath),
+                        });
+                        if (degraded.action === "skip") {
+                            skippedCount++;
+                            continue;
+                        }
+                        if (degraded.action === "decline") {
+                            recordDeclined("cron-trigger", key, { action: "live-unavailable" }, existingEntry?.modifiedAt);
+                            continue;
+                        }
                     }
+                    const existingId = resolveExistingId({
+                        liveOk: cronLiveOk,
+                        liveId: liveCron?.triggerId,
+                        manifestId: existingEntry?.id,
+                    });
                     // Built from the vendored definition (#2644). The create body
                     // omits `state` — the handler assigns it — which is what the
                     // definition's `writableOn` records.
@@ -7570,9 +8847,20 @@ export function registerConfigSyncCommands(sync) {
                             try {
                                 const updated = await client.updateCronTrigger(resolvedAppId, existingId, updatePayload);
                                 info(`  Updated cron trigger: ${key}`);
-                                if (syncState?.entities?.cronTriggers?.[key] && updated?.modifiedAt) {
-                                    syncState.entities.cronTriggers[key].modifiedAt = updated.modifiedAt;
-                                    syncState.entities.cronTriggers[key].contentHash = computeFileHash(filePath);
+                                if (syncState) {
+                                    if (!syncState.entities.cronTriggers) {
+                                        syncState.entities.cronTriggers = {};
+                                    }
+                                    syncState.entities.cronTriggers[key] = {
+                                        id: existingId,
+                                        modifiedAt: updated?.modifiedAt ||
+                                            existingEntry?.modifiedAt ||
+                                            new Date().toISOString(),
+                                        contentHash: computeFileHash(filePath),
+                                        // #2880 — from the entity the server returned: the
+                                        // handler materializes `timezone`/`overlapPolicy`.
+                                        semanticHash: await stampRemoteSemanticHash(cronSpec, updated, () => refetchLiveCronTrigger(existingId)),
+                                    };
                                 }
                             }
                             catch (err) {
@@ -7594,6 +8882,7 @@ export function registerConfigSyncCommands(sync) {
                                         id: created.triggerId,
                                         modifiedAt: created.modifiedAt,
                                         contentHash: computeFileHash(filePath),
+                                        semanticHash: await stampRemoteSemanticHash(cronSpec, created, () => refetchLiveCronTrigger(created.triggerId)),
                                     };
                                 }
                             }
@@ -7629,6 +8918,7 @@ export function registerConfigSyncCommands(sync) {
                                         id: adoptedId,
                                         modifiedAt: updated?.modifiedAt || new Date().toISOString(),
                                         contentHash: computeFileHash(filePath),
+                                        semanticHash: await stampRemoteSemanticHash(cronSpec, updated, () => refetchLiveCronTrigger(adoptedId)),
                                     };
                                 }
                             }
@@ -7640,17 +8930,97 @@ export function registerConfigSyncCommands(sync) {
             const blobBucketsPushDir = join(configDir, "blob-buckets");
             if (existsSync(blobBucketsPushDir)) {
                 const files = selectFiles("blob-bucket", blobBucketsPushDir, readdirSync(blobBucketsPushDir).filter((f) => f.endsWith(".toml")));
+                // #2880 — blob buckets join the live-state reconcile. As for cron
+                // triggers the list row IS the record, and the update takes no
+                // concurrency token, so read-time classification is the protection.
+                // `ttlTier` is create-only, so a local change to it surfaces as the
+                // `immutable` outcome — named with its remedy instead of PATCHed into
+                // a success that changes nothing — including under `--force`.
+                const bucketSpec = configDiffSpec("blob-bucket");
+                const liveBuckets = new Map();
+                let bucketsLiveOk = true;
+                if (files.length > 0) {
+                    try {
+                        const listed = await client.listBlobBuckets(resolvedAppId);
+                        for (const b of (listed?.items ?? [])) {
+                            if (b?.bucketKey)
+                                liveBuckets.set(b.bucketKey, b);
+                        }
+                    }
+                    catch (err) {
+                        bucketsLiveOk = false;
+                        warnLiveUnavailable("blob-buckets", err);
+                    }
+                }
+                const refetchLiveBucket = async (bucketId) => {
+                    const full = await client.getBlobBucket(resolvedAppId, bucketId);
+                    return full ? { record: full } : null;
+                };
                 for (const file of files) {
                     const filePath = join(blobBucketsPushDir, file);
                     const tomlData = parseTomlFile(filePath);
+                    const key = tomlData.bucket?.key || basename(file, ".toml");
+                    withDerivedIdentity(tomlData, "bucket", { key });
                     const bucket = tomlData.bucket || {};
-                    const key = bucket.key || basename(file, ".toml");
-                    const existingId = syncState?.entities?.blobBuckets?.[key]?.id;
-                    if (!options.force && existingId &&
-                        !shouldPushFile(filePath, syncState?.entities?.blobBuckets?.[key]?.contentHash)) {
-                        skippedCount++;
-                        continue;
+                    const existingEntry = syncState?.entities?.blobBuckets?.[key];
+                    const liveBucket = liveBuckets.get(key);
+                    let gate;
+                    if (bucketsLiveOk) {
+                        gate = decidePushForConfig({
+                            spec: bucketSpec,
+                            maps: pushDiffMaps,
+                            localParsed: tomlData,
+                            live: liveBucket
+                                ? { record: liveBucket, modifiedAt: liveBucket.modifiedAt }
+                                : null,
+                            entry: existingEntry,
+                            localFileHash: computeFileHash(filePath),
+                            force: options.force,
+                        });
+                        if (gate.action === "skip") {
+                            skippedCount++;
+                            if (syncState && liveBucket?.bucketId) {
+                                if (!syncState.entities.blobBuckets) {
+                                    syncState.entities.blobBuckets = {};
+                                }
+                                syncState.entities.blobBuckets[key] = {
+                                    id: liveBucket.bucketId,
+                                    modifiedAt: liveBucket.modifiedAt ||
+                                        existingEntry?.modifiedAt ||
+                                        new Date().toISOString(),
+                                    contentHash: computeFileHash(filePath),
+                                    semanticHash: gate.remoteHash,
+                                };
+                            }
+                            continue;
+                        }
+                        if (gate.action === "drift" ||
+                            gate.action === "conflict" ||
+                            gate.action === "immutable") {
+                            recordDeclined("blob-bucket", key, gate, existingEntry?.modifiedAt);
+                            continue;
+                        }
                     }
+                    else {
+                        const degraded = decideDegradedPush({
+                            force: options.force,
+                            storedContentHash: existingEntry?.contentHash,
+                            currentFileHash: computeFileHash(filePath),
+                        });
+                        if (degraded.action === "skip") {
+                            skippedCount++;
+                            continue;
+                        }
+                        if (degraded.action === "decline") {
+                            recordDeclined("blob-bucket", key, { action: "live-unavailable" }, existingEntry?.modifiedAt);
+                            continue;
+                        }
+                    }
+                    const existingId = resolveExistingId({
+                        liveOk: bucketsLiveOk,
+                        liveId: liveBucket?.bucketId,
+                        manifestId: existingEntry?.id,
+                    });
                     if (existingId) {
                         // #1020 (D8): idempotently apply preset/ruleSet/name/description
                         // changes via PATCH. bucketKey/ttlTier are immutable and not sent.
@@ -7664,9 +9034,18 @@ export function registerConfigSyncCommands(sync) {
                                 // update, and only when this is not a dry run. A failed
                                 // update (or a dry run) must leave the file pending rather
                                 // than mark it in-sync and suppress it on the next push.
-                                if (syncState?.entities?.blobBuckets?.[key]) {
-                                    syncState.entities.blobBuckets[key].contentHash =
-                                        computeFileHash(filePath);
+                                if (syncState) {
+                                    if (!syncState.entities.blobBuckets) {
+                                        syncState.entities.blobBuckets = {};
+                                    }
+                                    syncState.entities.blobBuckets[key] = {
+                                        id: existingId,
+                                        modifiedAt: existingEntry?.modifiedAt || new Date().toISOString(),
+                                        contentHash: computeFileHash(filePath),
+                                        // #2880 — the baseline, refetched because the PATCH
+                                        // response is not the stored record for this type.
+                                        semanticHash: await stampRemoteSemanticHash(bucketSpec, undefined, () => refetchLiveBucket(existingId)),
+                                    };
                                 }
                             }
                             catch (err) {
@@ -7694,6 +9073,7 @@ export function registerConfigSyncCommands(sync) {
                                         id: created.bucketId,
                                         modifiedAt: created.modifiedAt || new Date().toISOString(),
                                         contentHash: computeFileHash(filePath),
+                                        semanticHash: await stampRemoteSemanticHash(bucketSpec, created, () => refetchLiveBucket(created.bucketId)),
                                     };
                                 }
                             }
@@ -7764,6 +9144,9 @@ export function registerConfigSyncCommands(sync) {
                                             existing.modifiedAt ||
                                             new Date().toISOString(),
                                         contentHash: computeFileHash(filePath),
+                                        // #2880 — an adoption converges, so it stamps the
+                                        // baseline the next run classifies against.
+                                        semanticHash: await stampRemoteSemanticHash(bucketSpec, updated, () => refetchLiveBucket(existing.bucketId)),
                                     };
                                 }
                             }
@@ -7881,6 +9264,15 @@ export function registerConfigSyncCommands(sync) {
                             entry: existingEntry,
                             localFileHash: computeFileHash(filePath),
                             force: options.force,
+                            // #2909 — the prompt create path adopts an existing prompt by
+                            // `promptKey` on a 409 (#1006), so a prompt the manifest has
+                            // never recorded is that same adopt, reached one step earlier
+                            // because the reconcile above already read the server. Refusing
+                            // it here made the documented adopt unreachable: the CREATE the
+                            // guard recovers from is never sent when live state names the
+                            // prompt, so the push reported a conflict no `config push`
+                            // could clear.
+                            adoptsUntrackedByKey: true,
                         });
                         if (gate.action === "skip") {
                             skippedCount++;
@@ -7917,14 +9309,26 @@ export function registerConfigSyncCommands(sync) {
                             continue;
                         }
                     }
-                    else if (!options.force &&
-                        existingEntry?.id &&
-                        !shouldPushFile(filePath, existingEntry.contentHash)) {
+                    else {
                         // Degraded: the manifest byte-hash gate this section has always
-                        // fallen back to when the server cannot be read.
-                        skippedCount++;
-                        promptKeyToId.set(key, existingEntry.id);
-                        continue;
+                        // fallen back to when the server cannot be read — and, since
+                        // #2880, a decline when there is no baseline to gate on rather
+                        // than an unconditional write over unread server state.
+                        const degraded = decideDegradedPush({
+                            force: options.force,
+                            storedContentHash: existingEntry?.contentHash,
+                            currentFileHash: computeFileHash(filePath),
+                        });
+                        if (degraded.action === "skip") {
+                            skippedCount++;
+                            if (existingEntry?.id)
+                                promptKeyToId.set(key, existingEntry.id);
+                            continue;
+                        }
+                        if (degraded.action === "decline") {
+                            recordDeclined("prompt", key, { action: "live-unavailable" }, existingEntry?.modifiedAt);
+                            continue;
+                        }
                     }
                     // Live state decides create-vs-update: a prompt the manifest never
                     // recorded is adopted, and one the manifest still names but the
@@ -8074,6 +9478,13 @@ export function registerConfigSyncCommands(sync) {
                         changes.push({ type: "prompt", action: "update", key });
                         promptKeyToId.set(key, existingId);
                         if (!options.dryRun) {
+                            // Say so when this update is an ADOPT (#2909): the operator
+                            // never recorded this prompt, so a bare "Updated prompt" would
+                            // not tell them the push took over an object it found on the
+                            // server. Same sentence the 409 recovery prints.
+                            if (gate?.action === "update" && gate.direction === "adopt-untracked") {
+                                info(`  Prompt already exists on server, adopting by key: ${key}`);
+                            }
                             // A prompt adopted from live state has no manifest row yet, and
                             // `applyPromptUpdate` stamps INTO that row — without it the
                             // push would apply and record nothing, and the next run would
@@ -8466,16 +9877,25 @@ export function registerConfigSyncCommands(sync) {
                                 }
                                 : undefined;
                         }
-                        else if (!options.force) {
+                        else {
                             // Fallback gate: the manifest byte hash. A script with no
                             // recorded hash has no baseline at all and its apply is a blind
                             // overwrite, so it FAILS CLOSED rather than pushing on a guess.
-                            if (scriptEntry?.contentHash === undefined) {
-                                warn(`  transform ${name}: no last-sync content hash — skipped (run \`config pull\` to establish one, or --force to push anyway)`);
+                            // #2880 — through the shared decision, so every type declines
+                            // for the same reason in the same words.
+                            const degraded = decideDegradedPush({
+                                force: options.force,
+                                storedContentHash: scriptEntry?.contentHash,
+                                currentFileHash: computeFileHash(filePath),
+                            });
+                            if (degraded.action === "skip") {
+                                skippedCount++;
                                 continue;
                             }
-                            if (!shouldPushFile(filePath, scriptEntry.contentHash)) {
-                                skippedCount++;
+                            if (degraded.action === "decline") {
+                                recordDeclined("transform", name, {
+                                    action: "live-unavailable",
+                                });
                                 continue;
                             }
                         }
@@ -9225,13 +10645,22 @@ export function registerConfigSyncCommands(sync) {
                             }
                         }
                     }
-                    // Fallback gate: the manifest byte hash, unchanged from before.
-                    if (!dbTypeGate &&
-                        !options.force &&
-                        existingEntry &&
-                        !shouldPushFile(filePath, existingEntry.contentHash)) {
-                        skippedCount++;
-                        continue;
+                    // Fallback gate: the manifest byte hash — and, since #2880, a
+                    // decline when there is no hash to gate on.
+                    if (!dbTypeGate) {
+                        const degraded = decideDegradedPush({
+                            force: options.force,
+                            storedContentHash: existingEntry?.contentHash,
+                            currentFileHash: computeFileHash(filePath),
+                        });
+                        if (degraded.action === "skip") {
+                            skippedCount++;
+                            continue;
+                        }
+                        if (degraded.action === "decline") {
+                            recordDeclined("database-type-config", dbType, { action: "live-unavailable" }, existingEntry?.modifiedAt);
+                            continue;
+                        }
                     }
                     // ── Issues #813 / #1336 / #2732: state what this push's operation
                     // set will BE, then run a validate-first pass before any mutating
@@ -10379,9 +11808,22 @@ export function registerConfigSyncCommands(sync) {
                             continue;
                         }
                     }
-                    else if (!options.force && existingEntry && !shouldPushFile(filePath, existingEntry.contentHash)) {
-                        skippedCount++;
-                        continue;
+                    else {
+                        // Fallback gate: the manifest byte hash — and, since #2880, a
+                        // decline rather than a blind write when there is no hash.
+                        const degraded = decideDegradedPush({
+                            force: options.force,
+                            storedContentHash: existingEntry?.contentHash,
+                            currentFileHash: computeFileHash(filePath),
+                        });
+                        if (degraded.action === "skip") {
+                            skippedCount++;
+                            continue;
+                        }
+                        if (degraded.action === "decline") {
+                            recordDeclined("group-type-config", groupType, { action: "live-unavailable" }, existingEntry?.modifiedAt);
+                            continue;
+                        }
                     }
                     // Live state decides create-vs-update: a config the manifest never
                     // recorded is adopted, and one the manifest still names but the
@@ -10576,9 +12018,22 @@ export function registerConfigSyncCommands(sync) {
                             continue;
                         }
                     }
-                    else if (!options.force && existingEntry && !shouldPushFile(filePath, existingEntry.contentHash)) {
-                        skippedCount++;
-                        continue;
+                    else {
+                        // Fallback gate: the manifest byte hash — and, since #2880, a
+                        // decline rather than a blind write when there is no hash.
+                        const degraded = decideDegradedPush({
+                            force: options.force,
+                            storedContentHash: existingEntry?.contentHash,
+                            currentFileHash: computeFileHash(filePath),
+                        });
+                        if (degraded.action === "skip") {
+                            skippedCount++;
+                            continue;
+                        }
+                        if (degraded.action === "decline") {
+                            recordDeclined("collection-type-config", collectionType, { action: "live-unavailable" }, existingEntry?.modifiedAt);
+                            continue;
+                        }
                     }
                     // Live state decides create-vs-update; see the group-type section.
                     if (resolveExistingId({
@@ -10763,9 +12218,22 @@ export function registerConfigSyncCommands(sync) {
                             continue;
                         }
                     }
-                    else if (!options.force && existingEntry && !shouldPushFile(filePath, existingEntry.contentHash)) {
-                        skippedCount++;
-                        continue;
+                    else {
+                        // Fallback gate: the manifest byte hash — and, since #2880, a
+                        // decline rather than a blind write when there is no hash.
+                        const degraded = decideDegradedPush({
+                            force: options.force,
+                            storedContentHash: existingEntry?.contentHash,
+                            currentFileHash: computeFileHash(filePath),
+                        });
+                        if (degraded.action === "skip") {
+                            skippedCount++;
+                            continue;
+                        }
+                        if (degraded.action === "decline") {
+                            recordDeclined("metadata-category-config", entityKey, { action: "live-unavailable" }, existingEntry?.modifiedAt);
+                            continue;
+                        }
                     }
                     const isCreate = !resolveExistingId({
                         liveOk: metadataCategoryLiveOk,
@@ -10903,17 +12371,23 @@ export function registerConfigSyncCommands(sync) {
                             continue;
                         }
                     }
-                    else if (!options.force) {
+                    else {
                         // Fallback: the byte-hash gate. A legacy entry has no
                         // `contentHash` to compare against, and this type's apply is a
                         // blind overwrite of whatever the server holds — so it FAILS
-                        // CLOSED (warned and skipped) rather than upserting on a guess.
-                        if (!existingEntry?.contentHash) {
-                            warn(`  email-template ${emailType}: no last-sync content hash — skipped (run \`config pull\` to establish one, or --force to push anyway)`);
+                        // CLOSED rather than upserting on a guess (#2880: through the
+                        // shared decision, in the same words as every other type).
+                        const degraded = decideDegradedPush({
+                            force: options.force,
+                            storedContentHash: existingEntry?.contentHash,
+                            currentFileHash: computeFileHash(filePath),
+                        });
+                        if (degraded.action === "skip") {
+                            skippedCount++;
                             continue;
                         }
-                        if (!shouldPushFile(filePath, existingEntry.contentHash)) {
-                            skippedCount++;
+                        if (degraded.action === "decline") {
+                            recordDeclined("email-template", emailType, { action: "live-unavailable" }, existingEntry?.modifiedAt);
                             continue;
                         }
                     }
@@ -10995,8 +12469,12 @@ export function registerConfigSyncCommands(sync) {
             }
             // Push test cases for every test-bearing block (#2769: integrations
             // joined the three that already had a sidecar).
-            const scriptConfigNameToId = new Map(); // "scriptName#configName" → configId
-            const integrationConfigNameToId = new Map(); // "integrationKey#configName" → configId
+            //
+            // #2880 — every block that could name a config has been pushed by now,
+            // so the id→name direction the comparison reads references through has
+            // everything this push learned. It is refilled per case as the lazy
+            // per-block config lookups below resolve more of it.
+            fillTestCaseLookupMaps();
             /** The id the last sync recorded for a block, whatever this push selected. */
             const recordedBlockId = (blockType, blockKey) => {
                 const slot = blockType === "prompt"
@@ -11092,6 +12570,8 @@ export function registerConfigSyncCommands(sync) {
                             client, appId: resolvedAppId, blockType: "prompt", blockId,
                             blockKey: promptKey, configDir, syncState,
                             dryRun: options.dryRun, changes, failures: applyFailures,
+                            declined: recordDeclined, lookupMaps: pushTestCaseLookupMaps,
+                            refreshLookupMaps: fillTestCaseLookupMaps,
                             resolutionMaps: pushMaps, options: { force: options.force },
                         })).skipped;
                     }
@@ -11108,6 +12588,8 @@ export function registerConfigSyncCommands(sync) {
                             client, appId: resolvedAppId, blockType: "workflow", blockId,
                             blockKey: workflowKey, configDir, syncState,
                             dryRun: options.dryRun, changes, failures: applyFailures,
+                            declined: recordDeclined, lookupMaps: pushTestCaseLookupMaps,
+                            refreshLookupMaps: fillTestCaseLookupMaps,
                             resolutionMaps: pushMaps, options: { force: options.force },
                         })).skipped;
                     }
@@ -11134,6 +12616,8 @@ export function registerConfigSyncCommands(sync) {
                         client, appId: resolvedAppId, blockType: "script", blockId,
                         blockKey: scriptName, configDir, syncState,
                         dryRun: options.dryRun, changes, failures: applyFailures,
+                        declined: recordDeclined, lookupMaps: pushTestCaseLookupMaps,
+                        refreshLookupMaps: fillTestCaseLookupMaps,
                         resolutionMaps: pushMaps, options: { force: options.force },
                     })).skipped;
                 }
@@ -11156,6 +12640,8 @@ export function registerConfigSyncCommands(sync) {
                         client, appId: resolvedAppId, blockType: "integration", blockId,
                         blockKey: integrationKey, configDir, syncState,
                         dryRun: options.dryRun, changes, failures: applyFailures,
+                        declined: recordDeclined, lookupMaps: pushTestCaseLookupMaps,
+                        refreshLookupMaps: fillTestCaseLookupMaps,
                         resolutionMaps: pushMaps, options: { force: options.force },
                     })).skipped;
                 }
@@ -11681,6 +13167,10 @@ export function registerConfigSyncCommands(sync) {
             const localEmailTemplatesParsed = new Map();
             // #2757 — the same, for webhooks.
             const localWebhooksParsed = new Map();
+            // #2880 — the same, for integrations, cron triggers and blob buckets.
+            const localIntegrationsParsed = new Map();
+            const localCronTriggersParsed = new Map();
+            const localBlobBucketsParsed = new Map();
             // #2748 — the same, for prompts.
             const localPromptsParsed = new Map();
             // Parsed local TOML per key for the five content-aware config types.
@@ -11695,6 +13185,16 @@ export function registerConfigSyncCommands(sync) {
                     const tomlData = parseTomlFile(join(integrationsDir, file));
                     const key = tomlData.integration?.key || basename(file, ".toml");
                     localIntegrations.add(key);
+                    // #2880 — the parsed file is kept so the row can be COMPARED. The
+                    // resolved key is injected back the way webhooks and prompts inject
+                    // theirs: `[integration].key` is optional (push falls back to the
+                    // file name) and the comparison reads it as `displayName`'s
+                    // fallback, so a file that omits it would otherwise report Modified
+                    // forever — even right after a successful push.
+                    if (!tomlData.integration)
+                        tomlData.integration = {};
+                    tomlData.integration.key = key;
+                    localIntegrationsParsed.set(key, tomlData);
                 }
             }
             const webhooksDirPath = join(configDir, "webhooks");
@@ -11721,6 +13221,12 @@ export function registerConfigSyncCommands(sync) {
                     const tomlData = parseTomlFile(join(cronTriggersDirPath, file));
                     const key = tomlData.cronTrigger?.key || basename(file, ".toml");
                     localCronTriggers.add(key);
+                    // #2880 — kept parsed so the row can be COMPARED, with the resolved
+                    // key injected back the way every other type injects its identity.
+                    if (!tomlData.cronTrigger)
+                        tomlData.cronTrigger = {};
+                    tomlData.cronTrigger.key = key;
+                    localCronTriggersParsed.set(key, tomlData);
                 }
             }
             const blobBucketsDiffDir = join(configDir, "blob-buckets");
@@ -11729,6 +13235,11 @@ export function registerConfigSyncCommands(sync) {
                     const tomlData = parseTomlFile(join(blobBucketsDiffDir, file));
                     const key = tomlData.bucket?.key || basename(file, ".toml");
                     localBlobBuckets.add(key);
+                    // #2880 — as above.
+                    if (!tomlData.bucket)
+                        tomlData.bucket = {};
+                    tomlData.bucket.key = key;
+                    localBlobBucketsParsed.set(key, tomlData);
                 }
             }
             const promptsDir = join(configDir, "prompts");
@@ -11923,22 +13434,57 @@ export function registerConfigSyncCommands(sync) {
             // left alone. Prior sync state is the discriminator, mirroring the
             // local-only split above.
             const remoteOnlyStatus = (slot, key) => classifyRemoteOnly(syncState?.entities, slot, key);
-            // Integrations
+            // Integrations — #2880: content-aware, mirroring the webhook block.
+            //
+            // Existence-only comparison meant an edited `accessRule` or upstream
+            // `[requestConfig]` read as Synced while `config push` applied it from
+            // the file's byte hash. The detail is fetched per integration because
+            // `accessRule` and `requestConfig` are on the detail only, which is
+            // also what `config pull` writes from; a per-integration fetch failure
+            // degrades that ONE row to "content not compared".
+            const integrationSpec = configDiffSpec("integration");
+            // Integrations carry no rule-set reference, so the resolution maps the
+            // shared projection takes are empty for this type.
+            const integrationDiffMaps = {
+                ruleSetIdToName: new Map(),
+                ruleSetNameToId: new Map(),
+            };
             const remoteIntegrationRecords = new Map(integrationItems.map((i) => [i.integrationKey, i]));
             for (const key of localIntegrations) {
                 if (!remoteIntegrations.has(key)) {
                     differences.push({ type: "integration", key, status: localOnlyStatus("integrations", key) });
+                    continue;
+                }
+                let status = "exists";
+                let hint;
+                const localParsed = localIntegrationsParsed.get(key);
+                const integrationId = remoteIntegrationRecords.get(key)?.integrationId;
+                const detailOutcome = await attemptFetch(async () => integrationId
+                    ? await client.getIntegration(resolvedAppId, integrationId)
+                    : null);
+                if (!detailOutcome.ok || !detailOutcome.value || !localParsed) {
+                    hint = "content not compared (fetch failed)";
                 }
                 else {
-                    // #2803 — availability is operator state, not drift, and it is the
-                    // same annotation every carrying type gets.
-                    differences.push({
-                        type: "integration",
-                        key,
-                        status: "exists",
-                        hint: outOfServiceHint(remoteIntegrationRecords.get(key)),
-                    });
+                    try {
+                        const remoteHash = hashRemoteConfigForDiff(integrationSpec, detailOutcome.value, integrationDiffMaps);
+                        const localHash = hashLocalConfigForDiff(integrationSpec, localParsed, integrationDiffMaps);
+                        if (remoteHash !== localHash) {
+                            status = "modified";
+                            hint = "run `config pull` to rewrite the local TOML to match running state";
+                        }
+                    }
+                    catch {
+                        hint = "content not compared (comparison failed)";
+                    }
                 }
+                // #2803 — availability is operator state, not drift, and it is the
+                // same annotation every carrying type gets, appended to whatever the
+                // content comparison already had to say.
+                hint = outOfServiceHint(detailOutcome.ok && detailOutcome.value
+                    ? detailOutcome.value
+                    : remoteIntegrationRecords.get(key), hint);
+                differences.push({ type: "integration", key, status, hint });
             }
             for (const key of remoteIntegrations) {
                 if (!localIntegrations.has(key)) {
@@ -11980,17 +13526,11 @@ export function registerConfigSyncCommands(sync) {
                     hint = "content not compared (fetch failed)";
                 }
                 else {
-                    try {
-                        const remoteHash = hashRemoteConfigForDiff(webhookSpec, detailOutcome.value, webhookDiffMaps);
-                        const localHash = hashLocalConfigForDiff(webhookSpec, localParsed, webhookDiffMaps);
-                        if (remoteHash !== localHash) {
-                            status = "modified";
-                            hint = "run `config pull` to rewrite the local TOML to match running state";
-                        }
-                    }
-                    catch {
-                        hint = "content not compared (comparison failed)";
-                    }
+                    // Through the shared verdict, so the file's unmanaged fields are
+                    // read here exactly as the push gate reads them (#2880).
+                    const verdict = compareLocalToRemote(webhookSpec, localParsed, detailOutcome.value, webhookDiffMaps);
+                    status = verdict.status;
+                    hint = verdict.hint;
                 }
                 // #2803 — a paused/archived webhook is operator state, appended to
                 // whatever the content comparison already had to say.
@@ -12002,35 +13542,43 @@ export function registerConfigSyncCommands(sync) {
                     differences.push({ type: "webhook", key, status: remoteOnlyStatus("webhooks", key) });
                 }
             }
-            // Cron Triggers
+            // Cron Triggers — #2880: content-aware. The LIST row is the whole
+            // record for this type (it is what `config pull` serializes from), so
+            // no second fetch is needed; a comparison that throws degrades that ONE
+            // row rather than the diff.
+            const cronSpec = configDiffSpec("cron-trigger");
             const remoteCronTriggerRecords = new Map(cronTriggerItemsDiff.map((t) => [t.triggerKey, t]));
             for (const key of localCronTriggers) {
                 if (!remoteCronTriggers.has(key)) {
                     differences.push({ type: "cron-trigger", key, status: localOnlyStatus("cronTriggers", key) });
+                    continue;
                 }
-                else {
-                    // #2645 criterion 9 — a paused trigger is operator state, not drift.
-                    differences.push({
-                        type: "cron-trigger",
-                        key,
-                        status: "exists",
-                        hint: outOfServiceHint(remoteCronTriggerRecords.get(key)),
-                    });
-                }
+                const { status, hint } = compareLocalToRemote(cronSpec, localCronTriggersParsed.get(key), remoteCronTriggerRecords.get(key));
+                differences.push({
+                    type: "cron-trigger",
+                    key,
+                    status,
+                    // #2645 criterion 9 — a paused trigger is operator state, not
+                    // drift, appended to whatever the content comparison had to say.
+                    hint: outOfServiceHint(remoteCronTriggerRecords.get(key), hint),
+                });
             }
             for (const key of remoteCronTriggers) {
                 if (!localCronTriggers.has(key)) {
                     differences.push({ type: "cron-trigger", key, status: remoteOnlyStatus("cronTriggers", key) });
                 }
             }
-            // Blob Buckets
+            // Blob Buckets — #2880: the same, and the list row is the record here
+            // too.
+            const blobBucketSpec = configDiffSpec("blob-bucket");
+            const remoteBlobBucketRecords = new Map((blobBucketsDiffResult.items || []).map((b) => [b.bucketKey, b]));
             for (const key of localBlobBuckets) {
                 if (!remoteBlobBuckets.has(key)) {
                     differences.push({ type: "blob-bucket", key, status: localOnlyStatus("blobBuckets", key) });
+                    continue;
                 }
-                else {
-                    differences.push({ type: "blob-bucket", key, status: "exists" });
-                }
+                const { status, hint } = compareLocalToRemote(blobBucketSpec, localBlobBucketsParsed.get(key), remoteBlobBucketRecords.get(key));
+                differences.push({ type: "blob-bucket", key, status, hint });
             }
             for (const key of remoteBlobBuckets) {
                 if (!localBlobBuckets.has(key)) {
@@ -12048,6 +13596,22 @@ export function registerConfigSyncCommands(sync) {
             // fetches the detail `config pull` writes from. A failed fetch degrades
             // that ONE row to "content not compared", never the whole diff.
             const promptSpec = configDiffSpec("prompt");
+            /**
+             * The id→name lookups a test case's references are read through
+             * (#2880). Filled from the prompt details this loop already fetches —
+             * a second listing per block would double the diff's request count to
+             * learn what is already on the wire.
+             */
+            const diffTestCaseLookupMaps = {
+                configIdToName: new Map(),
+                promptIdToKey: new Map(),
+            };
+            for (const p of promptItems) {
+                const key = p?.promptKey;
+                const id = p?.promptId;
+                if (key && id)
+                    diffTestCaseLookupMaps.promptIdToKey.set(id, key);
+            }
             // Prompts carry no rule-set reference, so the resolution maps the shared
             // projection takes are empty for this type.
             const promptDiffMaps = {
@@ -12069,6 +13633,13 @@ export function registerConfigSyncCommands(sync) {
                     hint = "content not compared (fetch failed)";
                 }
                 else {
+                    // #2880 — the prompt's configs, for the test-case references that
+                    // name them.
+                    for (const config of detailOutcome.value.configs ?? []) {
+                        if (config?.configId && config?.configName) {
+                            diffTestCaseLookupMaps.configIdToName.set(config.configId, config.configName);
+                        }
+                    }
                     try {
                         const remoteHash = hashRemoteConfigForDiff(promptSpec, detailOutcome.value, promptDiffMaps);
                         const localHash = hashLocalConfigForDiff(promptSpec, localParsed, promptDiffMaps);
@@ -12440,6 +14011,10 @@ export function registerConfigSyncCommands(sync) {
                     blockId,
                     blockKey,
                     configDir,
+                    // #2880 — identity is the manifest id, and the attachment plan
+                    // reads the hashes the manifest recorded.
+                    syncState,
+                    lookupMaps: diffTestCaseLookupMaps,
                 });
                 if (!outcome.ok) {
                     // A block whose listing failed is REPORTED, not skipped in silence.
@@ -12482,6 +14057,96 @@ export function registerConfigSyncCommands(sync) {
                     await compareTestCases("integration", i.integrationId, key);
                 }
             }
+            // App settings — #2880 behavior 9, subsuming #2875.
+            //
+            // The whole-tree diff used not to compare `app.toml` AT ALL, so an
+            // edited file reported every count as zero: "nothing to push" printed
+            // over a push that would change the running app. `--only app` had the
+            // per-field comparison the whole time; this is that same helper, on the
+            // command an operator actually runs to ask whether anything differs.
+            //
+            // Compared over the FULL writable descriptor set, because push applies
+            // the file as the whole truth (criterion 4): a key the file omits is
+            // the clear push will send, not an absence of opinion. The settings are
+            // fetched only when there is a local file to compare and the selection
+            // asks for it, so an unselected `app.toml` costs no request.
+            const appTomlPathForDiff = join(configDir, "app.toml");
+            if (existsSync(appTomlPathForDiff) &&
+                selectionIncludesApp(diffSelection)) {
+                const appRow = (status, hint) => differences.push({
+                    type: "app-settings",
+                    key: "app.toml",
+                    status,
+                    hint,
+                });
+                let appTomlData;
+                try {
+                    appTomlData = parseTomlFile(appTomlPathForDiff);
+                }
+                catch (err) {
+                    appRow(VALIDATION_ERROR, `could not parse app.toml: ${err?.message || String(err)}`);
+                }
+                if (appTomlData) {
+                    const excludeName = appSettingsNameExcludedForState(syncState, resolvedAppId, appTomlData);
+                    // The SAME validator push's preflight runs (criterion 1): a
+                    // declared-type mismatch, an unrecognized or retired key, and a
+                    // missing required key are reported here with push's own message
+                    // rather than compared past and called Synced.
+                    const { settings: localAppSettings, errors: appErrors } = buildAppSettingsPayload(appTomlData, { excludeName });
+                    if (appErrors.length > 0) {
+                        appRow(VALIDATION_ERROR, appErrors.join("; "));
+                    }
+                    else {
+                        const settingsOutcome = await attemptFetch(() => client.getAppSettings(resolvedAppId));
+                        if (!settingsOutcome.ok) {
+                            // #1485's rule, for this type: a failed read is not "matches".
+                            notCompared.push({
+                                type: "app-settings",
+                                reason: gateReason(settingsOutcome.error),
+                            });
+                        }
+                        else {
+                            const fieldDiffs = appSettingsFieldDiffs(localAppSettings, settingsOutcome.value ?? {}, { excludeName });
+                            if (fieldDiffs.length === 0) {
+                                appRow("exists");
+                            }
+                            else {
+                                appRow("modified", `${fieldDiffs.length} field(s) differ: ` +
+                                    fieldDiffs
+                                        .map((d) => `[${d.section}].${d.key}`)
+                                        .join(", ") +
+                                    " — `config diff --only app` shows the values");
+                            }
+                        }
+                    }
+                }
+            }
+            // #2880 criterion 1 (symmetry) — a file `config push` would refuse is
+            // not a file this command calls Synced.
+            //
+            // The comparison above can only report a difference it can SEE, and a
+            // local key with no server counterpart is invisible to it: the
+            // reporter's prompts still carrying the `[prompt].status` #2803 retired
+            // compared clean field for field while push refused the whole tree. So
+            // the same preflight push runs decides these rows, and its message —
+            // verbatim, so the two commands read identically — replaces whatever
+            // the comparison had to say about the file.
+            for (const rejected of collectConfigFileValidationErrors(configDir)) {
+                const row = differences.find((d) => d.type === rejected.type && d.key === rejected.key);
+                const hint = rejected.messages.join("; ");
+                if (row) {
+                    row.status = VALIDATION_ERROR;
+                    row.hint = hint;
+                }
+                else {
+                    differences.push({
+                        type: rejected.type,
+                        key: rejected.key,
+                        status: VALIDATION_ERROR,
+                        hint,
+                    });
+                }
+            }
             // `--only` (issue #2645) reports just the objects the operator named.
             // The rows are filtered rather than the fetches: every leg keeps its own
             // failure handling, so a type whose listing failed is still reported as
@@ -12489,7 +14154,13 @@ export function registerConfigSyncCommands(sync) {
             if (diffSelection) {
                 differences = differences.filter((row) => row.type === "var"
                     ? diffSelection.varKeys.has(row.key)
-                    : selectionIncludesKey(diffSelection, row.type, row.key));
+                    : // #2880 — `app.toml` is a root singleton, outside
+                        // `SYNC_RESOURCE_TYPES`, so it has its own selection predicate
+                        // (the row is only built when this is true, but the filter is
+                        // what makes that visible where selection is decided).
+                        row.type === "app-settings"
+                            ? selectionIncludesApp(diffSelection)
+                            : selectionIncludesKey(diffSelection, row.type, row.key));
             }
             divider();
             const localOnly = differences.filter((d) => d.status === LOCAL_ONLY_NEW);
@@ -12501,6 +14172,23 @@ export function registerConfigSyncCommands(sync) {
             const remoteOnlyUnmanaged = differences.filter((d) => d.status === REMOTE_ONLY_UNMANAGED);
             const modified = differences.filter((d) => d.status === "modified");
             const existing = differences.filter((d) => d.status === "exists");
+            // #2880 — files push would refuse. Reported before anything else: no
+            // other row's status is trustworthy while a file in the tree cannot be
+            // pushed at all.
+            const invalid = differences.filter((d) => d.status === VALIDATION_ERROR);
+            // #2880 — the same messages `config push` aborts with, so a clean diff
+            // can be read as "nothing to push" and a dirty one names the fix.
+            if (invalid.length > 0) {
+                warn("Invalid — `config push` will refuse these (not compared):");
+                for (const d of invalid) {
+                    console.log(`  ${chalk.red("✗")} ${d.type}: ${d.key}`);
+                    for (const message of (d.hint ?? "").split("; ")) {
+                        if (message)
+                            console.log(`    ${message}`);
+                    }
+                }
+                console.log();
+            }
             if (localOnly.length > 0) {
                 info("Local only — new (will be created on push):");
                 for (const d of localOnly) {
@@ -12571,17 +14259,35 @@ export function registerConfigSyncCommands(sync) {
             const tcLocalOnly = testCaseDiffs.filter((d) => d.status === LOCAL_ONLY_NEW);
             const tcRemoteOnly = testCaseDiffs.filter((d) => d.status === "remote only");
             const tcSynced = testCaseDiffs.filter((d) => d.status === "exists");
-            if (tcLocalOnly.length > 0 || tcRemoteOnly.length > 0) {
+            // #2880 — sidecars whose CONTENT differs, and sidecars push would
+            // refuse. Both used to read as "= test-case: …", because the comparison
+            // stopped at whether the slug existed on both sides.
+            const tcModified = testCaseDiffs.filter((d) => d.status === "modified");
+            const tcInvalid = testCaseDiffs.filter((d) => d.status === VALIDATION_ERROR);
+            if (tcLocalOnly.length > 0 ||
+                tcRemoteOnly.length > 0 ||
+                tcModified.length > 0 ||
+                tcInvalid.length > 0) {
                 console.log();
                 info("Test Cases:");
+                for (const d of tcInvalid) {
+                    console.log(`  ${chalk.red("✗")} ${d.blockType}/${d.blockKey} test-case: ${d.slug}`);
+                    if (d.hint)
+                        console.log(`    ${d.hint}`);
+                }
                 for (const d of tcLocalOnly) {
                     console.log(`  ${chalk.green("+")} ${d.blockType}/${d.blockKey} test-case: ${d.slug}`);
                 }
                 for (const d of tcRemoteOnly) {
                     console.log(`  ${chalk.red("-")} ${d.blockType}/${d.blockKey} test-case: ${d.slug}`);
                 }
+                for (const d of tcModified) {
+                    const hint = d.hint ? ` ${chalk.dim(`(${d.hint})`)}` : "";
+                    console.log(`  ${chalk.yellow("~")} ${d.blockType}/${d.blockKey} test-case: ${d.slug}${hint}`);
+                }
                 for (const d of tcSynced) {
-                    console.log(`  ${chalk.dim("=")} ${d.blockType}/${d.blockKey} test-case: ${d.slug}`);
+                    const hint = d.hint ? ` ${chalk.dim(`(${d.hint})`)}` : "";
+                    console.log(`  ${chalk.dim("=")} ${d.blockType}/${d.blockKey} test-case: ${d.slug}${hint}`);
                 }
             }
             divider();
@@ -12591,13 +14297,20 @@ export function registerConfigSyncCommands(sync) {
             keyValue("Remote only (unmanaged, left alone)", remoteOnlyUnmanaged.length);
             keyValue("Modified", modified.length);
             keyValue("Synced", existing.length);
+            if (invalid.length > 0) {
+                keyValue("Invalid (push would refuse)", invalid.length);
+            }
             if (notCompared.length > 0) {
                 keyValue("Not compared", notCompared.map((nc) => `${nc.type} (${nc.reason})`).join(", "));
             }
             if (testCaseDiffs.length > 0) {
                 keyValue("Test Cases (local only)", tcLocalOnly.length);
                 keyValue("Test Cases (remote only)", tcRemoteOnly.length);
+                keyValue("Test Cases (modified)", tcModified.length);
                 keyValue("Test Cases (synced)", tcSynced.length);
+                if (tcInvalid.length > 0) {
+                    keyValue("Test Cases (push would refuse)", tcInvalid.length);
+                }
             }
         }
         catch (err) {