primitive-admin 1.1.0-alpha.65 → 1.1.0-alpha.67

package/dist/src/commands/sync.js

@@ -14,10 +14,12 @@ import { createSnapshot, listSnapshots, resolveSnapshot, restoreSnapshot, pruneS
 import { validateWorkflowToml, collectWorkflowTomlNotes, formatWorkflowTomlErrors, validateWorkflowExpressionsToml, validateWorkflowExpressionsRawToml, } from "../lib/workflow-toml-validator.js";
 import { expandWorkflowTomlData } from "../lib/workflow-fragments.js";
 import { parseConfigToml, stringifyConfigToml } from "../lib/config-toml.js";
+import { canonicalizeIntegrationRequestConfig } from "../lib/integration-request-config.js";
+import { canonicalizeServerTextFields } from "../lib/server-text-normalization.js";
 import { canonicalJsonStringify } from "../lib/canonical-json.js";
 import { reconcileWorkflowIncludes } from "../lib/workflow-include-preserve.js";
-import { serializeSection, parseTomlToAppSettings, } from "../lib/app-settings-descriptor.js";
-import { collectAppSettingsPushErrors, writePulledAppSettings, diffAppSettings, } from "./sync-app-settings.js";
+import { serializeSection, parseTomlToAppSettings, buildAppSettingsPayload, } from "../lib/app-settings-descriptor.js";
+import { collectAppSettingsPushErrors, writePulledAppSettings, diffAppSettings, appSettingsFieldDiffs, appSettingsNameExcluded, appSettingsNameExcludedForState, hashAppSettingsForDiff, } from "./sync-app-settings.js";
 import { applyWorkflowBody, legacyDraftSlotWarning } from "../lib/workflow-apply.js";
 // #2645 — named config bodies live in `workflows/<key>.configs/<name>.toml`.
 import { workflowConfigsDir, serializeWorkflowConfigSidecar, parseWorkflowConfigSidecar, readWorkflowConfigSidecars, } from "../lib/workflow-config-sidecar.js";
@@ -27,11 +29,12 @@ import { buildWorkflowPayloadFromToml, parseWorkflowExpressionsToml, } from "../
 // payload builder so the diff normalizer and the wire cannot disagree.
 import { WORKFLOW_MODEL_DEFAULTS } from "../lib/workflow-defaults.js";
 // #2644 — the one definition per configuration object, vendored from the server.
-import { BLOB_BUCKET_TABLE, COLLECTION_TYPE_CONFIG_TABLE, CRON_TRIGGER_TABLE, DATABASE_TYPE_TABLE, EMAIL_TEMPLATE_TABLE, GROUP_TYPE_CONFIG_TABLE, INTEGRATION_TABLE, METADATA_CATEGORY_CONFIG_TABLE, PROMPT_CONFIG_TABLE, PROMPT_TABLE, RULE_SET_TABLE, TEST_CASE_SURFACE, TEST_CASE_TABLE, WEBHOOK_TABLE, WORKFLOW_TABLE, findMisshapenTables, findUnknownDocumentKeys, findUnknownServerKeys, findUnknownTomlKeys, misshapenTableMessage, retiredConfigKey, unrecognizedPullKeysMessage, unrecognizedPushKeysMessage, unrecognizedPushTablesMessage, warnUnrecognizedServerKeys, } from "../lib/config-surface.js";
+import { BLOB_BUCKET_TABLE, COLLECTION_TYPE_CONFIG_TABLE, CRON_TRIGGER_TABLE, DATABASE_TYPE_TABLE, EMAIL_TEMPLATE_TABLE, GROUP_TYPE_CONFIG_TABLE, INTEGRATION_TABLE, METADATA_CATEGORY_CONFIG_TABLE, PROMPT_CONFIG_TABLE, PROMPT_TABLE, RULE_SET_TABLE, TEST_CASE_SURFACE, TEST_CASE_TABLE, WEBHOOK_TABLE, WORKFLOW_TABLE, configDeclaredTypeErrors, findMisshapenTables, findUnknownDocumentKeys, findUnknownServerKeys, findUnknownTomlKeys, misshapenTableMessage, retiredConfigKey, spellsDecimalNumber, unrecognizedPullKeysMessage, unrecognizedPushKeysMessage, unrecognizedPushTablesMessage, warnUnrecognizedServerKeys, } from "../lib/config-surface.js";
 import { buildPayloadFromToml, projectEntityToPayload, projectRecordToToml, tomlOwned, } from "../lib/config-payload.js";
 import { CONFIG_SURFACES, isEmptyForEmit, } from "../lib/generated-config-surfaces.js";
 import { detectLayout, migrateLegacyToV2 } from "../lib/block-layout.js";
-import { ABSENT_FROM_EXPORT, LOCAL_ONLY_ABSENT, LOCAL_ONLY_NEW, PUSH_PRUNE_SPECS, REMOTE_ONLY_UNMANAGED, REMOTE_ONLY_WILL_DELETE, SYNC_RESOURCE_TYPES, applyPrune, attachmentWritePath, attemptFetch, classifyLocalOnly, classifyPruneDeleteFailure, classifyRemoteOnly, collectPushPruneCandidates, decidePushPruneCandidate, formatPrunePlan, hasUncommittedChanges, isSafeAttachmentFilename, isSafeSyncFilename, planPrune, preserveUnwrittenEntries, removePrunedSidecar, ruleSetFileKey, } from "../lib/sync-resource-types.js";
+import { ABSENT_FROM_EXPORT, LOCAL_ONLY_ABSENT, LOCAL_ONLY_NEW, PUSH_PRUNE_SPECS, REMOTE_ONLY_UNMANAGED, REMOTE_ONLY_WILL_DELETE, SYNC_RESOURCE_TYPES, VALIDATION_ERROR, applyPrune, attachmentWritePath, attemptFetch, classifyLocalOnly, classifyPruneDeleteFailure, classifyRemoteOnly, collectPushPruneCandidates, decidePushPruneCandidate, formatPrunePlan, hasUncommittedChanges, isSafeAttachmentFilename, isSafeSyncFilename, planPrune, preserveUnwrittenEntries, removePrunedSidecar, ruleSetFileKey, } from "../lib/sync-resource-types.js";
+import { normalizeTestCaseKey, testCaseKeyError, } from "../lib/test-case-keys.js";
 import { success, error, printApiError, info, warn, keyValue, json, divider, } from "../lib/output.js";
 import { filterFilesBySelection, parseSyncSelectors, SelectorError, selectionIncludesKey, selectionIncludesType, selectionIncludesApp, selectionIncludesAnyVar, unmatchedSelectors, } from "../lib/sync-selectors.js";
 import { confirmPrompt, ConfirmPromptError } from "../lib/confirm-prompt.js";
@@ -1076,6 +1079,41 @@ export function archivedTombstoneEntries(items, select, managedKeys) {
     }
     return entries;
 }
+/**
+ * Fold one type's tombstone entries into the sync state this pull is building
+ * (#2803, corrected by #2887).
+ *
+ * Two rules, and the second one is the fix. A tombstone is recorded only for a
+ * key this pull did NOT export (an exported key is a live row and its own
+ * record) and only when the selection covers it. And a recorded key is marked
+ * as MATCHED: archived rows are dropped before `selectPull` runs, so the
+ * selector that named one never reached the set that decides whether the pull
+ * found what it was asked for. `config pull --only workflow/<key>` against an
+ * archived managed row therefore removed the file, saved the tombstone, and
+ * then exited 1 saying "the server has no workflow/<key>" — a failure report
+ * about a mutation that had already succeeded, which is the worst thing an
+ * automation can be told. The fix is generic, so integrations and webhooks
+ * (which had the bug first) get it too.
+ *
+ * Mutates `built` and `matchedSelectors` and returns the keys it recorded, so
+ * the caller can report each one. Pure otherwise, and unit-testable.
+ */
+export function recordArchivedTombstones(built, tombstones, context) {
+    const recorded = [];
+    for (const [key, entry] of Object.entries(tombstones)) {
+        if (key in built)
+            continue;
+        if (!selectionIncludesKey(context.selection, context.label, key))
+            continue;
+        built[key] = entry;
+        // Only under a selection: without one there is nothing to report against.
+        if (context.selection) {
+            context.matchedSelectors.add(`${context.label}/${key}`);
+        }
+        recorded.push(key);
+    }
+    return recorded;
+}
 /**
  * The `config diff` annotation for an object an operator took out of service
  * (issue #2645, criterion 9; #2803).
@@ -1325,15 +1363,26 @@ export function buildWebhookPushPayload(key, tomlData, { mode = "update" } = {})
             },
         }),
     };
-    // Handle JSON fields
-    if (tomlData?.allowedIps?.cidrs) {
-        payload.allowedIpCidrs = JSON.stringify(tomlData.allowedIps.cidrs);
-    }
-    if (tomlData?.inputMapping) {
-        payload.inputMapping = JSON.stringify(tomlData.inputMapping);
-    }
-    if (tomlData?.metadata) {
-        payload.metadata = JSON.stringify(tomlData.metadata);
+    // The three JSON-carrying tables. TOML-owned like `description` above
+    // (#1567), so on an UPDATE each is sent as value-or-`null`: sending nothing
+    // for an absent table left the stored value in place, which the shared
+    // comparison then reported as a difference forever — push planned the same
+    // update on every run, the server changed nothing, and deleting a
+    // `[inputMapping]` section could not be made to take effect. The server
+    // stores an explicit `null` (`updates.<key> = payload.<key>`).
+    //
+    // A CREATE sends only what the file has: there is nothing to clear, and the
+    // create handlers read an absent key as "no value" already.
+    const jsonTables = [
+        ["allowedIpCidrs", tomlData?.allowedIps?.cidrs],
+        ["inputMapping", tomlData?.inputMapping],
+        ["metadata", tomlData?.metadata],
+    ];
+    for (const [key, value] of jsonTables) {
+        if (value)
+            payload[key] = JSON.stringify(value);
+        else if (mode === "update")
+            payload[key] = null;
     }
     // Forward the declared `[verification.<scheme>]` table so scheme
     // configuration reaches the server. Without this the table is silently
@@ -1425,12 +1474,24 @@ export function buildCronTriggerPushPayload(key, tomlData, { mode = "update" } =
             },
         }),
     };
-    // Handle JSON fields
-    if (tomlData?.rootInput) {
-        payload.rootInput = JSON.stringify(tomlData.rootInput);
-    }
-    if (tomlData?.inputMapping) {
-        payload.inputMapping = JSON.stringify(tomlData.inputMapping);
+    // The two JSON-carrying tables, TOML-owned like `description` (#1567): an
+    // UPDATE sends value-or-`null`, so deleting a `[rootInput]` section clears it
+    // instead of leaving a value the shared comparison reports as a difference
+    // on every run that push cannot clear. The controller takes an explicit
+    // `null` as the clear and validates anything else as JSON.
+    //
+    // A CREATE sends only what the file has: the create leg rejects a `null` as
+    // invalid JSON, and there is nothing to clear on a trigger that does not
+    // exist yet.
+    const jsonTables = [
+        ["rootInput", tomlData?.rootInput],
+        ["inputMapping", tomlData?.inputMapping],
+    ];
+    for (const [key, value] of jsonTables) {
+        if (value)
+            payload[key] = JSON.stringify(value);
+        else if (mode === "update")
+            payload[key] = null;
     }
     return payload;
 }
@@ -1979,6 +2040,114 @@ export function unknownKeyPreflightTargets() {
     }
     return targets;
 }
+/**
+ * The diff row a per-entity config file belongs to (#2880 criterion 1).
+ *
+ * `config diff` pairs a local file with a server entity by a key each type
+ * derives its own way — the `[table].key` the file states, its identity field,
+ * or the file name standing in for either. The validation reporter has to land
+ * its message on THAT row, so the derivation lives here once rather than being
+ * inferred from the file name and quietly missing a renamed file.
+ */
+function localConfigRowKey(label, tomlData, file) {
+    const fallback = basename(file, ".toml");
+    const stated = (table, key) => tomlData?.[table]?.[key] || fallback;
+    switch (label) {
+        case "integration":
+            return stated("integration", "key");
+        case "webhook":
+            return stated("webhook", "key");
+        case "cron-trigger":
+            return stated("cronTrigger", "key");
+        case "blob-bucket":
+            return stated("bucket", "key");
+        case "prompt":
+            return stated("prompt", "key");
+        case "workflow":
+            return stated("workflow", "key");
+        case "email-template":
+            return stated("template", "emailType");
+        case "database-type-config":
+            return stated("type", "databaseType");
+        case "group-type-config":
+            return stated("groupTypeConfig", "groupType");
+        case "collection-type-config":
+            return stated("collectionTypeConfig", "collectionType");
+        case "metadata-category-config": {
+            const section = tomlData?.metadataCategoryConfig || {};
+            if (section.resourceType && section.category) {
+                return `${section.resourceType}#${section.category}`;
+            }
+            // `resourceType.category.toml`, the filename fallback push and diff share.
+            const dot = fallback.indexOf(".");
+            return dot > 0
+                ? `${fallback.slice(0, dot)}#${fallback.slice(dot + 1)}`
+                : fallback;
+        }
+        // Rule sets are keyed by FILE NAME on both sides — a renamed `ruleSet.name`
+        // still updates the same entity, so the row is the file's.
+        default:
+            return fallback;
+    }
+}
+/**
+ * Every per-entity config file whose TOML `config push` would refuse (#2880
+ * criterion 1, symmetry).
+ *
+ * One collector, two commands. Push aborts on the messages before issuing a
+ * request; `config diff` renders them as their own rows, because the failure
+ * this closes is a file diff calls Synced and push then rejects — the state the
+ * issue's reporter hit after #2803 retired `[prompt].status`, where a local key
+ * with no server counterpart is invisible to a comparison and fatal to a push.
+ *
+ * Three checks, all definition-driven: the document's table shape, keys no
+ * definition declares (retired keys among them), and — since #2880 — values
+ * whose spelling is not the declared type. A file that does not parse is left
+ * to the per-type loop that reads it, which names the parse error itself.
+ */
+export function collectConfigFileValidationErrors(configDir) {
+    const found = [];
+    for (const { dir, surface, tables } of unknownKeyPreflightTargets()) {
+        const typeDir = join(configDir, dir);
+        if (!existsSync(typeDir))
+            continue;
+        for (const file of readdirSync(typeDir).filter((f) => f.endsWith(".toml"))) {
+            const filePath = join(typeDir, file);
+            let tomlData;
+            try {
+                tomlData = parseTomlFile(filePath);
+            }
+            catch {
+                continue;
+            }
+            const messages = [];
+            // The document's own shape first: an unrecognized top-level table makes
+            // every per-table check below read an absent table, so its silence would
+            // be misleading.
+            messages.push(...configDocumentShapeErrors(filePath, tomlData, surface));
+            for (const table of tables) {
+                const unknownKeyError = configUnknownKeyError(filePath, tomlData, table);
+                if (unknownKeyError)
+                    messages.push(unknownKeyError);
+            }
+            // Declared types run over EVERY table of the surface, workflows included
+            // — `tables` above is pruned for workflows because `validateWorkflowToml`
+            // owns their unrecognized-key message, which is a different check.
+            for (const table of surface.tables) {
+                messages.push(...configDeclaredTypeErrors(filePath, tomlData, table));
+            }
+            if (messages.length === 0)
+                continue;
+            found.push({
+                type: surface.label,
+                key: localConfigRowKey(surface.label, tomlData, file),
+                filePath,
+                messages,
+            });
+        }
+    }
+    return found;
+}
 /**
  * Every `<key>.tests/*.toml` sidecar under a config directory.
  *
@@ -2822,16 +2991,25 @@ function normalizeRuleSetRefForDiff(entity, ruleSetNameToId, label) {
  * A field's value as the comparison reads it — the VALUE, not its spelling
  * (#2869).
  *
- * Only a declared `number` needs this, and only because the server genuinely
- * accepts both spellings: `temperature` and `topP` are `StringField`s on the
+ * Only a declared `number` the DEFINITION marks `dualEncoded` needs this
+ * (#2880), and only because the server genuinely accepts both spellings:
+ * `temperature` and `topP` are `StringField`s on the
  * model, stored as strings and returned parsed, so a file authored
  * `temperature = "0.2"` and a server holding `0.2` describe one value. Compared
  * as spellings it is a `Modified` no push can clear — push sends the string,
  * the server stores it, pull writes the number back, and the difference
  * returns — so the operator's only remedy is to overwrite the local file.
  *
- * A string that is not a number is left exactly as it is: `temperature =
- * "warm"` is a real difference from `0.2`, and one the server will reject.
+ * Every OTHER declared number is strictly numeric: `maxTokens = "1024"` is not
+ * the number the server holds, and normalizing it here would have both
+ * commands agree on a value the author never wrote. It is a validation error
+ * both commands report instead (`configDeclaredTypeErrors`), which is why the
+ * carve-out is read from the definition rather than from `type === "number"`.
+ *
+ * A string that is not a number never reaches here: `temperature = "warm"` is
+ * a field-named validation error from both commands (`spellsDecimalNumber` is
+ * the grammar the declared-type validator admits a dual encoding by, so what
+ * preflight accepts is exactly what this can equate).
  *
  * "Is a number" is decided by the grammar the SERVER reads the string with —
  * `parseFloat`, on the way back out — not by JavaScript's `Number`, which is
@@ -2841,15 +3019,14 @@ function normalizeRuleSetRefForDiff(entity, ruleSetNameToId, label) {
  * So only what `parseFloat` consumes WHOLE — sign, digits, one dot, an
  * exponent — normalizes; anything else stays the string it is.
  */
-const DECIMAL_NUMBER = /^[+-]?(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?$/;
-function comparableFieldValue(type, value) {
-    if (type !== "number" || typeof value !== "string")
+function comparableFieldValue(field, value) {
+    if (field.type !== "number" || typeof value !== "string")
         return value;
-    const trimmed = value.trim();
-    if (!DECIMAL_NUMBER.test(trimmed))
+    if (field.dualEncoded === undefined)
         return value;
-    const asNumber = Number(trimmed);
-    return Number.isFinite(asNumber) ? asNumber : value;
+    if (!spellsDecimalNumber(value))
+        return value;
+    return Number(value.trim());
 }
 /**
  * `config diff`'s hash for one configuration object, over the field set its
@@ -2872,7 +3049,16 @@ function comparableFieldValue(type, value) {
 export function projectConfigForComparison(table, entity, extras = {}) {
     const projected = {};
     for (const field of table.fields) {
-        const value = comparableFieldValue(field.type, entity?.[field.field]);
+        const raw = entity?.[field.field];
+        // #2880 DSO-002 — a key the file does not carry describes the value the
+        // SERVER materializes for it, so that is what the comparison reads. Both
+        // sides run through here, and the server side always carries the value
+        // already, so this only ever fills the absent side in. Without it a
+        // hand-authored file that omits an optional defaulted field reports
+        // `Modified` on every run against a server that agrees with it.
+        const value = comparableFieldValue(field, raw === undefined && field.serverDefault !== undefined
+            ? field.serverDefault
+            : raw);
         if (value === undefined)
             continue;
         // #2731 — `emit: "whenSet"` says pull OMITS the key when the value is
@@ -3025,6 +3211,25 @@ function jsonFieldsForDiff(table, entity) {
     }
     return projected;
 }
+/**
+ * One test-case reference as the comparison reads it (#2880 behavior 17).
+ *
+ * A reference reaches the projection in one of three states, and all three
+ * describe the same thing on both sides once this is applied:
+ *
+ *  - a portable NAME (`configName = "default"`), which a test file carries so
+ *    it survives a move between apps;
+ *  - a legacy ID that RESOLVES, which becomes that same name — otherwise a file
+ *    pinned by id would differ forever from the file pull writes for it;
+ *  - a legacy ID that does NOT resolve, which stays the id, because pull writes
+ *    an unresolvable id straight back and comparing it away would hide a pin
+ *    the next push still sends.
+ */
+function testCaseReference(value, idToName) {
+    if (typeof value !== "string" || value === "")
+        return undefined;
+    return idToName?.get(value) ?? value;
+}
 const CONFIG_DIFF_SPECS = {
     "rule-set": {
         label: "rule-set",
@@ -3099,6 +3304,16 @@ const CONFIG_DIFF_SPECS = {
         // exactly as push derives it from the file name.
         parse: (doc) => buildWebhookPushPayload(doc?.webhook?.key ?? "", doc),
         serialize: (record) => serializeWebhook(record),
+        // The text the create/update handlers rewrite on the way in (DSO-003):
+        // `displayName` and `workflowKey` are trimmed, a blank description is
+        // stored as none, and a signing secret is stored as the canonical
+        // `{{secrets.KEY}}` form — so an authored `"{{ secrets.KEY }}"` is the same
+        // reference the server returns rather than a row push re-applies forever.
+        canonicalize: (entity) => canonicalizeServerTextFields(entity, {
+            trimmed: ["displayName", "workflowKey"],
+            optional: ["description"],
+            secretReference: ["signingSecret"],
+        }),
         extras: (entity) => ({
             // The four structural tables a webhook file also carries, compared as the
             // values they encode rather than as their transport spellings.
@@ -3111,6 +3326,21 @@ const CONFIG_DIFF_SPECS = {
             // webhook that holds none.
             config: entity.config ?? null,
         }),
+        // The two present-only fields, matching what `buildWebhookPushPayload`
+        // sends: a file with no `[verification]` section does not manage the stored
+        // scheme configuration (a bare `[verification]` table is how such a file
+        // clears it), and a file with no `signingSecret` line does not manage the
+        // secret reference — pushing `null` for either would revoke verification
+        // the file never mentioned. Compared as differences they were rows push
+        // could never clear.
+        unmanaged: (doc) => {
+            const keys = [];
+            if (doc?.verification === undefined)
+                keys.push("config");
+            if (doc?.webhook?.signingSecret === undefined)
+                keys.push("signingSecret");
+            return keys;
+        },
         describe: (entity) => `webhook "${entity?.webhookKey}"`,
     },
     // #2748 — prompts join the registry comparator, the third type to arrive by
@@ -3163,6 +3393,148 @@ const CONFIG_DIFF_SPECS = {
         }),
         describe: (entity) => `prompt "${entity?.displayName}"`,
     },
+    // #2880 — integrations join the registry comparator, the last of the flat
+    // per-entity types to arrive by the route email templates (#2731 B2),
+    // webhooks (#2757) and prompts (#2748) took: `config diff` reported key
+    // existence only, so an edited `accessRule` or upstream `[requestConfig]`
+    // read as Synced while push applied it from the file's byte hash.
+    "integration": {
+        label: "integration",
+        table: INTEGRATION_TABLE,
+        // The wire shape push sends. `integrationKey` is not part of the compared
+        // surface — the two sides are paired on it before the comparison runs —
+        // but the TOML spelling (`[integration].key`) is read here because it is
+        // what `displayName` falls back to.
+        parse: (doc) => buildIntegrationPushPayload(doc?.integration?.key ?? "", doc),
+        serialize: (record) => serializeIntegration(record),
+        // The upstream request definition is a top-level table the definition
+        // classifies structural, so it is hashed beside the fields — as the value
+        // the SERVER would store, not as the text the file holds (DSO-003).
+        canonicalize: (entity) => {
+            entity.requestConfig = canonicalizeIntegrationRequestConfig(entity.requestConfig ?? {});
+            // The scalars the handler rewrites beside it: `displayName` is trimmed
+            // and a blank `description` is stored as none.
+            canonicalizeServerTextFields(entity, {
+                trimmed: ["displayName"],
+                optional: ["description"],
+            });
+        },
+        extras: (entity) => ({ requestConfig: entity.requestConfig ?? {} }),
+        describe: (entity) => `integration "${entity?.integrationKey}"`,
+    },
+    // #2880 — cron triggers, on the same route. `status` is server-owned
+    // (#2645/#2803) and therefore absent from the table, so an operator's pause
+    // is not drift the configuration can push away; `[rootInput]` and
+    // `[inputMapping]` are structural tables stored as JSON strings, compared as
+    // the values they encode.
+    "cron-trigger": {
+        label: "cron-trigger",
+        table: CRON_TRIGGER_TABLE,
+        parse: (doc) => buildCronTriggerPushPayload(doc?.cronTrigger?.key ?? "", doc),
+        serialize: (record) => serializeCronTrigger(record),
+        // `displayName` is trimmed on the way in and a blank description is stored
+        // as none (DSO-003), so neither is a difference push could never settle.
+        canonicalize: (entity) => canonicalizeServerTextFields(entity, {
+            trimmed: ["displayName"],
+            optional: ["description"],
+        }),
+        extras: (entity) => ({
+            rootInput: jsonBlobForDiff(entity.rootInput),
+            inputMapping: jsonBlobForDiff(entity.inputMapping),
+        }),
+        describe: (entity) => `cron trigger "${entity?.triggerKey}"`,
+    },
+    // #2880 — blob buckets. The parse is CREATE-mode on purpose: `ttlTier` is
+    // `writableOn: ["create"]`, and a field left out of the projection cannot be
+    // NAMED as the immutable difference it is — the update would PATCH
+    // "successfully", change nothing, and re-report forever.
+    "blob-bucket": {
+        label: "blob-bucket",
+        table: BLOB_BUCKET_TABLE,
+        parse: (doc) => {
+            const bucket = { ...(doc?.bucket ?? {}) };
+            // #1020 — `accessPolicy` is the pre-`preset` spelling, still accepted on
+            // the wire and still authored in unmigrated files. Both spellings mean
+            // the same access model, so they project the same way; without this an
+            // unmigrated file reports a difference no push can clear (push sends the
+            // legacy key and the server answers with `preset`).
+            if (bucket.preset === undefined && bucket.accessPolicy !== undefined) {
+                bucket.preset = bucket.accessPolicy;
+            }
+            return {
+                bucketKey: doc?.bucket?.key ?? "",
+                ...buildPayloadFromToml(BLOB_BUCKET_TABLE, bucket, {
+                    mode: "create",
+                    values: {
+                        name: (value) => value || doc?.bucket?.key || "",
+                        description: tomlOwned,
+                    },
+                }),
+            };
+        },
+        serialize: (record) => serializeBlobBucket(record),
+        // `name` is trimmed on the way in and a blank description is stored as
+        // none (DSO-003).
+        canonicalize: (entity) => canonicalizeServerTextFields(entity, {
+            trimmed: ["name"],
+            optional: ["description"],
+        }),
+        // The three fields a bucket file leaves alone by omitting them, matching
+        // what `buildBlobBucketUpdatePayload` sends (#2880 criterion 3). The server
+        // refuses to leave a bucket nameless or without an access model, so none of
+        // them is clearable and the update omits an absent key rather than nulling
+        // it. Compared anyway, a bucket whose live name differs from its key — or
+        // one whose access model the file does not state — is a `Modified` row and
+        // an update that cannot carry the difference it reports, planned again on
+        // every run. `ttlTier` is deliberately NOT here: it is immutable rather
+        // than unmanaged, and naming it is the whole point of the create-mode parse
+        // above.
+        unmanaged: (doc) => {
+            const bucket = doc?.bucket ?? {};
+            const keys = [];
+            if (!bucket.name)
+                keys.push("name");
+            if (!bucket.preset && !bucket.accessPolicy)
+                keys.push("preset");
+            if (!bucket.ruleSetId)
+                keys.push("ruleSetId");
+            return keys;
+        },
+        describe: (entity) => `blob bucket "${entity?.bucketKey}"`,
+    },
+    // #2880 — test cases. Their sidecars were compared by SLUG PRESENCE, so an
+    // edited expectation read as Synced while push applied it from the file's
+    // byte hash.
+    //
+    // The type's own difficulty is that a reference has two legal spellings — the
+    // portable `configName` a test file carries so it survives a move between
+    // apps, and the legacy `configId` pull still writes back when the name cannot
+    // be resolved. They name the same thing, so they project the same way; the
+    // `extra` context is what makes that possible (the id→name lookups are not in
+    // the document).
+    "test-case": {
+        label: "test-case",
+        table: TEST_CASE_TABLE,
+        parse: (doc) => parseTestCaseToml(doc),
+        serialize: (record, _maps, extra) => serializeTestCase(record, extra?.lookupMaps),
+        // The server trims a test-case name on write (`src/admin-api.ts`), so a
+        // padded one in the file is not a difference — it is what the server will
+        // store (#2880 DSO-003).
+        canonicalize: (entity) => {
+            if (typeof entity.name === "string")
+                entity.name = entity.name.trim();
+        },
+        extras: (entity, _doc, extra) => ({
+            // These three OVERRIDE the definition's fields of the same name: the
+            // value compared is the thing referred to, not the spelling that referred
+            // to it. Precedence matches the push path exactly — a file carrying both
+            // an id and a name is pushed on the id, so it is compared on the id.
+            configId: testCaseReference(entity.configId ?? entity._configName, extra?.lookupMaps?.configIdToName),
+            evaluatorPromptId: testCaseReference(entity.evaluatorPromptId ?? entity._evaluatorPromptKey, extra?.lookupMaps?.promptIdToKey),
+            evaluatorConfigId: testCaseReference(entity.evaluatorConfigId ?? entity._evaluatorConfigName, extra?.lookupMaps?.configIdToName),
+        }),
+        describe: (entity) => `test case "${entity?.name}"`,
+    },
     "database-type-config": {
         label: "database-type-config",
         table: DATABASE_TYPE_TABLE,
@@ -3194,9 +3566,10 @@ const CONFIG_DIFF_SPECS = {
 };
 /**
  * Every type the shared comparator serves — the types `config diff` compares
- * field-for-field, and that `config push` gates on the same projection wherever
- * it has adopted the shared gate (#2731 B1/B2; webhooks joined the comparator
- * in #2757 while push keeps its own byte-hash gate).
+ * field-for-field, and that `config push` gates on the same projection
+ * (#2731 B1/B2; webhooks joined the comparator in #2757 and their push joined
+ * the same gate in #2880, so no registered type answers "changed?" from the
+ * file's bytes any more).
  *
  * Published so the round-trip acceptance bar (#2731 B9) can require a fixture
  * per type instead of listing them a second time by hand: converting a type is
@@ -3219,20 +3592,82 @@ export function configDiffSpec(label) {
  * a push that needs to SAY what differs and a diff that only needs to know THAT
  * something differs read the same projection.
  */
-export function projectLocalConfig(spec, parsedToml, maps) {
-    const entity = spec.parse(parsedToml);
+export function projectLocalConfig(spec, parsedToml, maps, extra) {
+    const entity = spec.parse(parsedToml, extra);
     if (spec.ruleSetRef) {
         normalizeRuleSetRefForDiff(entity, maps.ruleSetNameToId, spec.describe(entity));
     }
-    return projectConfigForComparison(spec.table, entity, spec.extras?.(entity, parsedToml));
+    // #2880 DSO-003 — before anything is hashed, so the extras below read the
+    // canonical values too.
+    spec.canonicalize?.(entity);
+    return projectConfigForComparison(spec.table, entity, spec.extras?.(entity, parsedToml, extra));
 }
 /** The same projection for a SERVER entity — see `hashRemoteConfigForDiff`. */
 export function projectRemoteConfig(spec, record, maps, extra) {
-    return projectLocalConfig(spec, parseConfigToml(spec.serialize(record, maps, extra)), maps);
+    return projectLocalConfig(spec, parseConfigToml(spec.serialize(record, maps, extra)), maps, extra);
+}
+/**
+ * BOTH sides of one comparison, with the file's unmanaged keys reconciled
+ * (#2880) — the one place `spec.unmanaged` is honored, so `config diff` and
+ * `config push` cannot read the same file differently.
+ */
+export function projectConfigPair(spec, localParsed, remoteRecord, maps, extra, localExtra) {
+    const local = projectLocalConfig(spec, localParsed, maps, localExtra);
+    const remote = projectRemoteConfig(spec, remoteRecord, maps, extra);
+    for (const key of spec.unmanaged?.(localParsed) ?? []) {
+        // Key-for-key, so an unmanaged field the server does not hold either is
+        // absent on both sides rather than present-and-undefined on one.
+        if (key in remote)
+            local[key] = remote[key];
+        else
+            delete local[key];
+    }
+    return { local, remote };
+}
+/**
+ * One `config diff` row's content verdict for a registered type (#2880).
+ *
+ * The three outcomes the per-type blocks were each spelling out by hand:
+ * equal (`exists`), different (`modified`, framed as a preview of
+ * `config pull`), and "could not tell" — a missing record or a comparison that
+ * threw, which degrades THIS row and never the whole diff. Written once so a
+ * type joining the comparator cannot accidentally report a fourth thing.
+ *
+ * The two `extra` arguments are the same split `decidePushForConfig` makes:
+ * `extra` carries what only the SERVER side has (a database type's operation
+ * rows), while `localExtra` is context BOTH sides read a value through — a test
+ * case's id→name lookups. Giving the local side nothing was a silent
+ * mistranslation: a sidecar pinned by a resolvable `configId` projected the id
+ * while the server's projection resolved it to the name, so an untouched file
+ * reported Modified in diff and drifted in push.
+ */
+export function compareLocalToRemote(spec, localParsed, remoteRecord, maps = {
+    ruleSetIdToName: new Map(),
+    ruleSetNameToId: new Map(),
+}, extra, localExtra) {
+    if (!localParsed || !remoteRecord) {
+        return { status: "exists", hint: "content not compared (fetch failed)" };
+    }
+    try {
+        const pair = projectConfigPair(spec, localParsed, remoteRecord, maps, extra ?? localExtra, localExtra);
+        const remoteHash = computeExpandedContentHash(pair.remote);
+        const localHash = computeExpandedContentHash(pair.local);
+        if (remoteHash === localHash)
+            return { status: "exists" };
+        return {
+            status: "modified",
+            hint: "run `config pull` to rewrite the local TOML to match running state",
+        };
+    }
+    catch {
+        // A file the comparison cannot read is reported as not compared rather
+        // than aborting the diff; `config push` names the fault precisely.
+        return { status: "exists", hint: "content not compared (comparison failed)" };
+    }
 }
 /** Hash a LOCAL config file's definition-projected field set (#2644). */
-export function hashLocalConfigForDiff(spec, parsedToml, maps) {
-    return computeExpandedContentHash(projectLocalConfig(spec, parsedToml, maps));
+export function hashLocalConfigForDiff(spec, parsedToml, maps, extra) {
+    return computeExpandedContentHash(projectLocalConfig(spec, parsedToml, maps, extra));
 }
 /**
  * Hash a SERVER entity the same way, by serializing it into the file `sync
@@ -3244,32 +3679,24 @@ export function hashLocalConfigForDiff(spec, parsedToml, maps) {
  * operations and subscriptions, which the list response does not include.
  */
 export function hashRemoteConfigForDiff(spec, record, maps, extra) {
-    return hashLocalConfigForDiff(spec, parseConfigToml(spec.serialize(record, maps, extra)), maps);
+    return hashLocalConfigForDiff(spec, parseConfigToml(spec.serialize(record, maps, extra)), maps, extra);
+}
+export function decideDegradedPush(input) {
+    if (input.force)
+        return { action: "send" };
+    if (input.storedContentHash === undefined) {
+        return { action: "decline", reason: "no-baseline" };
+    }
+    return input.storedContentHash === input.currentFileHash
+        ? { action: "skip" }
+        : { action: "send" };
 }
-/**
- * `config push`'s change decision for one configuration file (#2731 B1/B3/B4/B8).
- *
- * This replaces `shouldPushFile` for the converted types. The differences that
- * matter, in order:
- *
- *  - the comparison is `config diff`'s — the definition-projected field set on
- *    both sides — so "skip as unchanged" and "Synced" cannot disagree, and a
- *    comment-only or formatting-only edit is not a change;
- *  - the right-hand side is the LIVE entity, not the manifest, so out-of-band
- *    server drift is visible instead of being overwritten;
- *  - the manifest becomes a baseline that answers WHICH side moved, so a
- *    difference is attributed rather than assumed to be a local edit.
- *
- * Declining is a first-class outcome here. `drift`, `conflict` and `immutable`
- * each carry the field diff their report prints, and nothing is applied.
- */
 export function decidePushForConfig(input) {
-    const { spec, maps, localParsed, live, entry, localFileHash, force } = input;
+    const { spec, maps, localParsed, live, entry, localFileHash, localExtra, force } = input;
     if (!live?.record)
         return { action: "create" };
-    const localProjected = projectLocalConfig(spec, localParsed, maps);
+    const { local: localProjected, remote: remoteProjected } = projectConfigPair(spec, localParsed, live.record, maps, live.extra ?? localExtra, localExtra);
     const localHash = computeExpandedContentHash(localProjected);
-    const remoteProjected = projectRemoteConfig(spec, live.record, maps, live.extra);
     const remoteHash = computeExpandedContentHash(remoteProjected);
     const fields = diffProjectedRecords(localProjected, remoteProjected);
     // A difference in a field UPDATE does not accept would PATCH "successfully"
@@ -3312,6 +3739,37 @@ export function decidePushForConfig(input) {
                 entry.modifiedAt === live.modifiedAt,
         },
     });
+    // #2909 — the adopt, for a type whose push path adopts by key. `entry` is
+    // read for ANY of its three signals, not just the baseline: a row carrying
+    // only a legacy signal has been synced, and its unattributable difference is
+    // the conflict below. This is the never-reconciled file alone.
+    //
+    // Deliberately the SIGNALS and not the row's existence: an `id`-only row is
+    // what the 409 recovery seeds before its update lands (and a failed push
+    // still saves), so it names the object an adopt found without recording that
+    // any content was ever reconciled. There is nothing there to attribute a
+    // move with, and refusing it would wedge that half-adopted slot in a
+    // conflict no `config push` can clear — this same regression, one step in.
+    const untracked = entry?.semanticHash === undefined &&
+        entry?.contentHash === undefined &&
+        entry?.modifiedAt === undefined;
+    if (direction === "unknown-direction" &&
+        input.adoptsUntrackedByKey &&
+        untracked) {
+        if (immutableFields.length > 0)
+            return immutable;
+        return {
+            action: "update",
+            direction: "adopt-untracked",
+            localHash,
+            remoteHash,
+            // As for `local-edited`: the LIVE timestamp closes the window between the
+            // reconcile's read and this write. The 409 path omits it because it never
+            // read the record it adopts; this one just did.
+            expectedModifiedAt: live.modifiedAt,
+            fields,
+        };
+    }
     switch (direction) {
         case "unchanged":
             return { action: "skip", localHash, remoteHash };
@@ -3842,17 +4300,27 @@ export function slugifyTestCaseName(name) {
         .replace(/^-+|-+$/g, "")
         || "test";
 }
-export function resolveSlugCollisions(slug, usedSlugs) {
-    if (!usedSlugs.has(slug)) {
-        usedSlugs.add(slug);
+/**
+ * The name to use for `slug`, given the names already taken.
+ *
+ * `occupy` decides what "already taken" means, and `usedSlugs` holds names in
+ * that form (#2896): a file name is occupied CASE-INSENSITIVELY on the
+ * filesystems most of these trees live on, so `Foo` and `foo` are one file even
+ * though they are two strings. The returned name keeps its own casing — only
+ * the occupancy check is normalized.
+ */
+export function resolveSlugCollisions(slug, usedSlugs, occupy = (name) => name) {
+    const taken = (candidate) => usedSlugs.has(occupy(candidate));
+    if (!taken(slug)) {
+        usedSlugs.add(occupy(slug));
         return slug;
     }
     let counter = 2;
-    while (usedSlugs.has(`${slug}-${counter}`)) {
+    while (taken(`${slug}-${counter}`)) {
         counter++;
     }
     const resolved = `${slug}-${counter}`;
-    usedSlugs.add(resolved);
+    usedSlugs.add(occupy(resolved));
     return resolved;
 }
 export function getTestsDir(configDir, blockType, blockKey) {
@@ -4180,11 +4648,17 @@ export async function pullTestCasesForBlock(params) {
         return { ok: true, count: 0 };
     if (testCases.length > 0)
         ensureDir(testsDir);
-    const usedSlugs = new Set();
     const pulledSlugs = new Set();
+    // #2896 — a keyed case is written to the file its key names, so pull stops
+    // renaming what push authored: the repro's `full-refresh-takes-all-history`
+    // came back as the slug of its NAME, and the tree never converged. An
+    // unkeyed (pre-#2896) case keeps the slug naming it has always had.
+    const fileNames = testCaseFileBasenames(testCases, (live, reason) => warn(`  Test case "${live?.name ?? ""}" on ${blockKey}: ${reason} — writing it under its name instead`), 
+    // The key is server data becoming a path: the containment check an
+    // attachment's filename gets, so nothing lands outside the sidecar dir.
+    (name) => attachmentWritePath(testsDir, `${name}.toml`) !== null);
     for (const tc of testCases) {
-        const baseSlug = slugifyTestCaseName(tc.name || "unnamed");
-        const slug = resolveSlugCollisions(baseSlug, usedSlugs);
+        const slug = fileNames.get(tc);
         pulledSlugs.add(slug);
         // Write test case TOML
         const tomlPath = join(testsDir, `${slug}.toml`);
@@ -4273,6 +4747,14 @@ export async function pullTestCasesForBlock(params) {
             modifiedAt: tc.modifiedAt || tc.createdAt || new Date().toISOString(),
             attachments,
             contentHash: computeFileHash(tomlPath),
+            // #2880 — the file and the server agree right now, so this is the
+            // baseline the next push attributes a difference against.
+            semanticHash: remoteSemanticBaseline({
+                spec: configDiffSpec("test-case"),
+                maps: { ruleSetIdToName: new Map(), ruleSetNameToId: new Map() },
+                returned: tc,
+                extra: { lookupMaps },
+            }),
         };
     }
     // Clean up local files for remotely-deleted test cases
@@ -4352,7 +4834,7 @@ const TEN_MB = 10 * 1024 * 1024;
  * content hashes (#2769). A name the guard rejects is dropped here, before it
  * can be turned into an upload.
  */
-function readLocalAttachments(attachDir, onUnsafe) {
+function readLocalAttachments(attachDir, onUnsafe = () => { }) {
     if (!existsSync(attachDir))
         return [];
     const files = [];
@@ -4416,6 +4898,39 @@ export function planAttachmentPush(params) {
         removedRemotely: recordedAttachmentNames(params.recorded).filter((filename) => !localNames.has(filename)),
     };
 }
+/** Whether a server rejected a body key it does not recognize (#2644's 400). */
+function rejectsUnknownRequestKey(error, key) {
+    const message = String(error?.message ?? error ?? "");
+    return (/unrecognized request body key/i.test(message) &&
+        new RegExp(`\\b${key}\\b`).test(message));
+}
+/**
+ * Create a test case carrying the identity its file name asserts (#2896).
+ *
+ * The one case protocol detection cannot answer is a create into an EMPTY
+ * block: there is no listed record to read `key` off. Push is optimistic there,
+ * and an older server's 400 is the answer — retried once without the key, and
+ * named, because a case created without one will duplicate on the next clone.
+ */
+export async function createTestCaseWithIdentity(params) {
+    const { client, appId, blockType, blockId, payload, key } = params;
+    if (key === undefined) {
+        return client.createTestCase(appId, blockType, blockId, payload);
+    }
+    try {
+        return await client.createTestCase(appId, blockType, blockId, {
+            ...payload,
+            key,
+        });
+    }
+    catch (err) {
+        if (!rejectsUnknownRequestKey(err, "key"))
+            throw err;
+        (params.logger ?? warn)("  test cases on this server have no identity key — a fresh clone " +
+            "cannot reconcile them; upgrade the server");
+        return client.createTestCase(appId, blockType, blockId, payload);
+    }
+}
 /**
  * Push one block's authored test-case sidecar. Exported so the unit tests can
  * drive it against a stubbed client on a temp directory.
@@ -4432,9 +4947,75 @@ export async function pushTestCasesForBlock(params) {
     const files = readdirSync(testsDir).filter((f) => f.endsWith(".toml"));
     if (files.length === 0)
         return { skipped };
+    // #2880 — the block's live cases, read once. They are what `config diff`
+    // compares against and what `config pull` writes from, so push deciding from
+    // anything else is how the two commands came to disagree. A failed listing
+    // degrades this block to the byte-hash gate, named, rather than sending every
+    // sidecar down the create path.
+    const testCaseSpec = configDiffSpec("test-case");
+    const testCaseExtra = { lookupMaps: params.lookupMaps };
+    const listed = await listAllTestCases(client, appId, blockType, blockId);
+    const liveOk = listed.ok;
+    if (!liveOk) {
+        warn(`  ${blockKey} test cases: live state unavailable — falling back to last-sync content hashes`);
+    }
+    // #2896 — whether this server carries identity keys at all. Every record a
+    // key-supporting server lists has the property (null included), so its
+    // presence is the protocol signal. An EMPTY listing cannot answer, and
+    // "unknown" is a third answer rather than a guess: push is optimistic with
+    // the key it sends, but it must not REFUSE a file over a rule only a keyed
+    // server has, since against a pre-key server that file has always pushed.
+    const keySupport = !liveOk
+        ? "no"
+        : listed.items.some((live) => live && typeof live === "object" && "key" in live)
+            ? "yes"
+            : listed.items.length === 0
+                ? "unknown"
+                : "no";
+    const serverSupportsKeys = keySupport === "yes";
+    params.refreshLookupMaps?.();
+    const paired = pairTestCases({
+        blockType,
+        blockKey,
+        localSlugs: files.map((f) => basename(f, ".toml")),
+        liveCases: liveOk ? listed.items : [],
+        managed: syncState?.entities?.testCases,
+        serverSupportsKeys,
+        contentMatches: testCaseContentMatcher({
+            testsDir,
+            spec: testCaseSpec,
+            extra: testCaseExtra,
+        }),
+    });
+    // #2896 AC8 — an unpaired file in a block that still holds unclaimed UNKEYED
+    // cases could be any one of them under another name, and creating it is how
+    // this issue's duplicates were made. Refusing is the same posture
+    // `decideDegradedPush` takes when neither side's state is known.
+    const unmatchedLegacy = serverSupportsKeys && paired.remoteOnly.some((live) => !live?.key);
     for (const file of files) {
         const slug = basename(file, ".toml");
         const filePath = join(testsDir, file);
+        // #2896 AC6 — on a server that has keys, a basename that cannot BE one
+        // would be pushed without any identity and duplicate itself on every fresh
+        // clone from then on. So this file's push fails here, named and before any
+        // server call for it, rather than half-succeeding. Against a pre-key server
+        // there is no key to violate and the file pushes exactly as it always did —
+        // which is why an UNDETERMINED server (an empty block) does not refuse the
+        // file: the create carries the key optimistically and the server's answer
+        // decides, either the unknown-key retry or the rename instruction below.
+        const keyError = keySupport === "no" ? null : testCaseKeyError(slug);
+        if (keyError && keySupport === "yes") {
+            const message = `${keyError} — rename ${file} to a path-safe file name`;
+            warn(`  Failed to push test case ${blockKey}/${slug}: ${message}`);
+            failures.push({ type: "test-case", key: `${blockKey}/${slug}`, message });
+            continue;
+        }
+        const refusal = paired.refused.get(slug);
+        if (refusal) {
+            warn(`  Failed to push test case ${blockKey}/${slug}: ${refusal}`);
+            failures.push({ type: "test-case", key: `${blockKey}/${slug}`, message: refusal });
+            continue;
+        }
         const tomlData = parseTomlFile(filePath);
         const testPayload = parseTestCaseToml(tomlData);
         // Resolve key-based references to IDs. An authored name that does not
@@ -4508,21 +5089,182 @@ export async function pushTestCasesForBlock(params) {
         }
         const stateKey = `${blockType}/${blockKey}/${slug}`;
         const existingEntry = syncState?.entities?.testCases?.[stateKey];
+        // #2896 — the row a rename left behind under the file's OLD name. It is
+        // THIS case's row, and what it records about attachments is what the server
+        // holds for this test case id — bookkeeping that follows the case, not the
+        // file name. Reading it here is what lets `--prune` still see a fixture the
+        // operator deleted in the same breath as the rename.
+        const staleStateKey = paired.renamedFrom.get(slug);
+        const renamedFromEntry = staleStateKey && staleStateKey !== stateKey
+            ? syncState?.entities?.testCases?.[staleStateKey]
+            : undefined;
         const attachDir = join(testsDir, slug);
         const localAttachments = readLocalAttachments(attachDir, (filename) => warn(`  Skipping attachment ${blockKey}/${slug}/${filename}: unsafe filename`));
         const attachmentPlan = planAttachmentPush({
             local: localAttachments,
-            recorded: existingEntry,
+            recorded: existingEntry ?? renamedFromEntry,
         });
-        // Skip if file hasn't changed since last sync and no attachment bytes moved.
-        if (!params.options?.force &&
-            existingEntry?.id &&
-            !shouldPushFile(filePath, existingEntry.contentHash) &&
-            attachmentPlan.upload.length === 0) {
-            skipped++;
-            continue;
+        // #2880 — the change decision is the comparison `config diff` makes,
+        // against the case the server holds NOW. The old gate asked the manifest
+        // whether the file's BYTES had moved, so a comment planned an update diff
+        // called synced and server drift was skipped however far it had gone.
+        //
+        // An attachment still pending upload is a change whatever the text says:
+        // the sidecar and its fixtures are one resource to push.
+        const liveCase = paired.bySlug.get(slug);
+        // #2896 — the identity this file's basename asserts, when the server can
+        // carry one and this case does not already have exactly it. A null key is
+        // the legacy case being stamped; a different key is a file that was renamed.
+        const pendingKey = serverSupportsKeys && liveOk && liveCase && liveCase.key !== slug
+            ? slug
+            : undefined;
+        /** Record this file's manifest row, retiring the one a rename left behind. */
+        const recordTestCaseEntry = (record) => {
+            if (!syncState)
+                return;
+            if (!syncState.entities.testCases)
+                syncState.entities.testCases = {};
+            const entry = (syncState.entities.testCases[stateKey] ??= {
+                blockType,
+                blockId,
+                blockKey,
+                slug,
+            });
+            entry.id = record.id;
+            entry.contentHash = computeFileHash(filePath);
+            if (record.semanticHash !== undefined) {
+                entry.semanticHash = record.semanticHash;
+            }
+            if (record.modifiedAt)
+                entry.modifiedAt = record.modifiedAt;
+            // A rename carries its attachment bookkeeping across: it records which
+            // files the SERVER holds for this case, so dropping it would leave a
+            // fixture the operator deleted invisible to every later `--prune`.
+            if (renamedFromEntry && entry.attachments === undefined) {
+                if (renamedFromEntry.attachments !== undefined) {
+                    entry.attachments = renamedFromEntry.attachments;
+                }
+                if (renamedFromEntry.attachmentFilenames !== undefined) {
+                    entry.attachmentFilenames = renamedFromEntry.attachmentFilenames;
+                }
+            }
+            // The row a rename left under the old file name names THIS case, so a
+            // later `--prune` reading it would delete the case this push just
+            // updated. Clearing it is bookkeeping — nothing is deleted server-side.
+            if (staleStateKey && staleStateKey !== stateKey) {
+                delete syncState.entities.testCases[staleStateKey];
+            }
+        };
+        let gate;
+        // The reference resolution above is what loads this block's configs, so the
+        // lookups the comparison reads through are re-derived from it first.
+        params.refreshLookupMaps?.();
+        if (liveOk && liveCase) {
+            gate = decidePushForConfig({
+                spec: testCaseSpec,
+                maps: { ruleSetIdToName: new Map(), ruleSetNameToId: new Map() },
+                localParsed: tomlData,
+                live: { record: liveCase, modifiedAt: liveCase.modifiedAt },
+                entry: existingEntry,
+                localFileHash: computeFileHash(filePath),
+                localExtra: testCaseExtra,
+                force: params.options?.force,
+            });
+            if (gate.action === "skip" && attachmentPlan.upload.length === 0) {
+                // #2896 — a content skip is not a reason to leave identity unrecorded.
+                // A legacy case (key null) or one whose file was renamed still needs
+                // the key stamped, so the skip becomes a KEY-ONLY update: without it,
+                // `push` on an already-synced legacy tree converged on nothing and the
+                // next fresh clone duplicated it all over again.
+                if (pendingKey !== undefined) {
+                    if (dryRun) {
+                        changes.push({
+                            type: "test-case",
+                            action: "update",
+                            key: `${blockKey}/${slug}`,
+                        });
+                        continue;
+                    }
+                    try {
+                        const stamped = await client.updateTestCase(appId, blockType, blockId, liveCase.testCaseId, { key: pendingKey });
+                        changes.push({
+                            type: "test-case",
+                            action: "update",
+                            key: `${blockKey}/${slug}`,
+                        });
+                        info(`  Recorded test-case identity: ${blockKey}/${slug}`);
+                        recordTestCaseEntry({
+                            id: liveCase.testCaseId,
+                            modifiedAt: stamped?.modifiedAt || liveCase.modifiedAt,
+                            semanticHash: gate.remoteHash,
+                        });
+                    }
+                    catch (err) {
+                        const message = err?.message || String(err);
+                        warn(`  Failed to update test case ${blockKey}/${slug}: ${message}`);
+                        failures.push({
+                            type: "test-case",
+                            key: `${blockKey}/${slug}`,
+                            message,
+                        });
+                    }
+                    continue;
+                }
+                skipped++;
+                // A skip decided against live state refreshes the row, so the next run
+                // classifies against a baseline rather than inferring from timestamps.
+                //
+                // CREATING the row when it is missing is the point: the case this skip
+                // agreed with may have been adopted by slug, and identity is the
+                // manifest id first. Recording only rows that already existed left an
+                // adopted case unmanaged, so the next rename lost its id and paired as
+                // local-only beside remote-only — the duplicate create this pairing
+                // exists to prevent.
+                //
+                // Through the same recorder as every other outcome (#2896): a rename
+                // another machine already pushed arrives here with the content ALREADY
+                // synced, and its stale row has to be retired even so — two rows for
+                // one case would later attach a new file reusing the old name to this
+                // very case instead of creating the one the operator asked for.
+                recordTestCaseEntry({
+                    id: liveCase.testCaseId,
+                    modifiedAt: liveCase.modifiedAt,
+                    semanticHash: gate.remoteHash,
+                });
+                continue;
+            }
+            if (gate.action === "drift" ||
+                gate.action === "conflict" ||
+                gate.action === "immutable") {
+                params.declined?.("test-case", `${blockKey}/${slug}`, gate, existingEntry?.modifiedAt);
+                continue;
+            }
+        }
+        else if (!liveOk) {
+            // Degraded: the byte gate this section has always fallen back to, and a
+            // decline when there is no hash to gate on (#2880 criterion 7).
+            const degraded = decideDegradedPush({
+                force: params.options?.force,
+                storedContentHash: existingEntry?.contentHash,
+                currentFileHash: computeFileHash(filePath),
+            });
+            if (degraded.action === "skip" && attachmentPlan.upload.length === 0) {
+                skipped++;
+                continue;
+            }
+            if (degraded.action === "decline") {
+                params.declined?.("test-case", `${blockKey}/${slug}`, { action: "live-unavailable" }, existingEntry?.modifiedAt);
+                continue;
+            }
         }
-        if (existingEntry?.id) {
+        // Live state decides create-vs-update: a case the manifest never recorded
+        // but the server has is adopted rather than duplicated (#2896's half of
+        // this), and one the manifest names that the server no longer has is
+        // re-created.
+        const existingId = liveOk
+            ? liveCase?.testCaseId
+            : existingEntry?.id;
+        if (existingId) {
             // Update existing test case. The body is FULL STATE: the handler only
             // touches keys it receives, so an omitted key retains its old value and
             // blanking a field in the file would never reach the server (#2769).
@@ -4537,17 +5279,30 @@ export async function pushTestCasesForBlock(params) {
                 evaluatorPromptId: testPayload.evaluatorPromptId ?? null,
                 evaluatorConfigId: testPayload.evaluatorConfigId ?? null,
             };
+            // #2896 — the identity travels with the content: this is the lazy
+            // migration of a legacy case and the second half of a rename.
+            if (pendingKey !== undefined)
+                updatePayload.key = pendingKey;
             if (dryRun) {
                 changes.push({ type: "test-case", action: "update", key: `${blockKey}/${slug}` });
             }
             else {
                 try {
-                    await client.updateTestCase(appId, blockType, blockId, existingEntry.id, updatePayload);
+                    const updated = await client.updateTestCase(appId, blockType, blockId, existingId, updatePayload);
                     changes.push({ type: "test-case", action: "update", key: `${blockKey}/${slug}` });
                     info(`  Updated test case: ${blockKey}/${slug}`);
-                    if (syncState?.entities?.testCases?.[stateKey]) {
-                        syncState.entities.testCases[stateKey].contentHash = computeFileHash(filePath);
-                    }
+                    recordTestCaseEntry({
+                        id: existingId,
+                        modifiedAt: updated?.modifiedAt,
+                        // #2880 — the baseline, from the record the server stored (it trims
+                        // the name on write), so the next run can attribute a difference.
+                        semanticHash: remoteSemanticBaseline({
+                            spec: testCaseSpec,
+                            maps: { ruleSetIdToName: new Map(), ruleSetNameToId: new Map() },
+                            returned: updated ?? { ...liveCase, ...updatePayload },
+                            extra: testCaseExtra,
+                        }),
+                    });
                 }
                 catch (err) {
                     const message = err?.message || String(err);
@@ -4565,12 +5320,32 @@ export async function pushTestCasesForBlock(params) {
                 failures.push({ type: "test-case", key: `${blockKey}/${slug}`, message });
                 continue;
             }
+            // #2896 AC8 — the refusal that replaces this issue's duplicates: while
+            // the block still holds unkeyed cases no local file could be matched to,
+            // this file may BE one of them under another name.
+            if (unmatchedLegacy) {
+                const message = "unkeyed cases exist on the server that no local file could be " +
+                    "matched to — push once from a machine with sync state, or run " +
+                    "`config pull` first";
+                warn(`  Refused to create test case ${blockKey}/${slug}: ${message}`);
+                failures.push({ type: "test-case", key: `${blockKey}/${slug}`, message });
+                continue;
+            }
             if (dryRun) {
                 changes.push({ type: "test-case", action: "create", key: `${blockKey}/${slug}` });
             }
             else {
                 try {
-                    const created = await client.createTestCase(appId, blockType, blockId, testPayload);
+                    // The basename IS the identity, so it travels with the create — that
+                    // is what makes the next clone of this tree reconcile.
+                    const created = await createTestCaseWithIdentity({
+                        client,
+                        appId,
+                        blockType,
+                        blockId,
+                        payload: testPayload,
+                        key: keySupport === "no" ? undefined : slug,
+                    });
                     changes.push({ type: "test-case", action: "create", key: `${blockKey}/${slug}` });
                     info(`  Created test case: ${blockKey}/${slug}`);
                     // Record in sync state
@@ -4586,11 +5361,25 @@ export async function pushTestCasesForBlock(params) {
                             slug,
                             modifiedAt: created.modifiedAt || created.createdAt || new Date().toISOString(),
                             contentHash: computeFileHash(filePath),
+                            // #2880 — a create records its baseline too, from the stored
+                            // record: the handler trims the name, so a baseline taken from
+                            // the file would read that trim as a difference on the next run.
+                            semanticHash: remoteSemanticBaseline({
+                                spec: testCaseSpec,
+                                maps: { ruleSetIdToName: new Map(), ruleSetNameToId: new Map() },
+                                returned: created,
+                                extra: testCaseExtra,
+                            }),
                         };
                     }
                 }
                 catch (err) {
-                    const message = err?.message || String(err);
+                    // A key the server rejected on a block that could not be probed is
+                    // the preflight above, answered late: say the same thing it would.
+                    const serverMessage = err?.message || String(err);
+                    const message = keyError && /test case key/i.test(serverMessage)
+                        ? `${keyError} — rename ${file} to a path-safe file name`
+                        : serverMessage;
                     warn(`  Failed to create test case ${blockKey}/${slug}: ${message}`);
                     failures.push({ type: "test-case", key: `${blockKey}/${slug}`, message });
                     continue;
@@ -4602,7 +5391,7 @@ export async function pushTestCasesForBlock(params) {
         // plain push (sponsor ruling, 2026-08-18).
         if (dryRun)
             continue;
-        const testCaseId = existingEntry?.id || syncState?.entities?.testCases?.[stateKey]?.id;
+        const testCaseId = existingId || syncState?.entities?.testCases?.[stateKey]?.id;
         if (!testCaseId)
             continue;
         for (const filename of attachmentPlan.upload) {
@@ -4647,32 +5436,287 @@ export async function pushTestCasesForBlock(params) {
     return { skipped };
 }
 /**
- * Classify one block's sidecar against the server's test-case names (#2769).
+ * The file name each live test case belongs in (#2896).
+ *
+ * A KEYED case is named by its key: that is what the key is — the basename the
+ * committed tree carries. An unkeyed one (created by web-admin, an older CLI or
+ * the raw API) keeps the slug-of-name naming, with the collision suffixes
+ * resolved only AFTER the keys have claimed theirs, so a slug can never take a
+ * name a key owns.
+ *
+ * One function for pull, for pairing's adoption pass and for the diff's
+ * remote-only rows, because three commands that name a case's file differently
+ * is the disagreement this issue reports.
+ *
+ * Two names that differ only by CASE are one file on a case-insensitive
+ * filesystem, so occupancy is tracked the way the server's key constraint
+ * normalizes: a keyed `Foo` and an unkeyed case named "foo" get `Foo.toml` and
+ * `foo-2.toml`, rather than one pull silently overwriting the other's sidecar.
+ */
+export function testCaseFileBasenames(liveCases, onUnusableKey, isSafeName) {
+    const used = new Set();
+    const occupy = (name) => normalizeTestCaseKey(name);
+    const names = new Map();
+    const unkeyed = [];
+    for (const live of liveCases) {
+        const key = typeof live?.key === "string" ? live.key : "";
+        if (!key) {
+            unkeyed.push(live);
+            continue;
+        }
+        // The key is SERVER data on its way to becoming a path. A server that
+        // stored one this CLI would not have sent must not be able to name a file
+        // outside the sidecar directory.
+        const reason = testCaseKeyError(key) ??
+            (isSafeName && !isSafeName(key)
+                ? `test case key "${key}" is not a safe file name here`
+                : null);
+        if (reason) {
+            onUnusableKey?.(live, reason);
+            unkeyed.push(live);
+            continue;
+        }
+        names.set(live, resolveSlugCollisions(key, used, occupy));
+    }
+    for (const live of unkeyed) {
+        names.set(live, resolveSlugCollisions(slugifyTestCaseName(live?.name || "unnamed"), used, occupy));
+    }
+    return names;
+}
+/**
+ * Whether a sidecar and a live case say the same thing (#2896).
+ *
+ * The corroboration the adoption passes below need: identity nothing states can
+ * only be inferred from content, and only when the inference is unique. It is
+ * the SAME projection `config diff` compares with, memoized per file and per
+ * record, so pairing and the change verdict can never disagree. A file that
+ * cannot be read matches nothing — an unparseable sidecar fails its own push
+ * with a message that names it.
+ */
+export function testCaseContentMatcher(params) {
+    const maps = {
+        ruleSetIdToName: new Map(),
+        ruleSetNameToId: new Map(),
+    };
+    const localHashes = new Map();
+    const remoteHashes = new Map();
+    return (localSlug, live) => {
+        if (!localHashes.has(localSlug)) {
+            let hash = null;
+            try {
+                hash = hashLocalConfigForDiff(params.spec, parseTomlFile(join(params.testsDir, `${localSlug}.toml`)), maps, params.extra);
+            }
+            catch {
+                hash = null;
+            }
+            localHashes.set(localSlug, hash);
+        }
+        const local = localHashes.get(localSlug);
+        if (!local)
+            return false;
+        if (!remoteHashes.has(live)) {
+            remoteHashes.set(live, hashRemoteConfigForDiff(params.spec, live, maps, params.extra));
+        }
+        return remoteHashes.get(live) === local;
+    };
+}
+/**
+ * Which live test case each sidecar manages (#2880 behavior 16, #2896).
+ *
+ * The manifest id comes FIRST, then the identity the COMMITTED tree carries —
+ * the file's basename, matched against the case's stored `key`. Everything
+ * after that is adoption of a case whose identity nothing states: a rename the
+ * manifest still remembers under the old name, a legacy case matched by
+ * content, and finally the slug-of-name rule #2880 shipped.
+ *
+ * The order matters because every pass consumes its claims: identity that IS
+ * recorded always wins over a guess, and a guess is only made when it is
+ * unambiguous in BOTH directions. Where it is not, the file stays unpaired and
+ * is barred from the create path — push refusing to guess is the whole point,
+ * since the failure it replaces is a silently duplicated test case.
+ *
+ * Against a server with no keys the passes that depend on them are skipped
+ * entirely, so pairing is bit-for-bit what #2880 shipped.
  *
- * Remote slugs are derived exactly the way pull writes them — same slugify,
- * same collision suffixes, same order — because a `<slug>-2.toml` on disk IS
- * the second colliding name and must not read as an unpushed local file.
+ * One function for both commands, because a diff row and a push decision that
+ * pair differently are two answers to the same question.
  */
-export function classifyTestCaseSidecarDiff(params) {
-    const usedSlugs = new Set();
-    const remoteSlugs = new Set(params.remoteNames.map((name) => resolveSlugCollisions(slugifyTestCaseName(name || "unnamed"), usedSlugs)));
-    const rows = [];
-    const local = new Set(params.localSlugs);
-    for (const slug of local) {
-        rows.push({ slug, status: remoteSlugs.has(slug) ? "exists" : LOCAL_ONLY_NEW });
+export function pairTestCases(input) {
+    const bySlug = new Map();
+    // Claimed by RECORD rather than by id: a row the server returned without one
+    // still has to be paired or reported, never silently dropped from both sides.
+    const claimed = new Set();
+    const renamedFrom = new Map();
+    const refused = new Map();
+    const byId = new Map();
+    for (const live of input.liveCases) {
+        if (live?.testCaseId)
+            byId.set(live.testCaseId, live);
+    }
+    const unpaired = [];
+    for (const slug of input.localSlugs) {
+        const managedId = input.managed?.[`${input.blockType}/${input.blockKey}/${slug}`]?.id;
+        const live = managedId ? byId.get(managedId) : undefined;
+        if (live) {
+            bySlug.set(slug, live);
+            claimed.add(live);
+        }
+        else {
+            unpaired.push(slug);
+        }
     }
-    for (const slug of remoteSlugs) {
-        if (!local.has(slug))
-            rows.push({ slug, status: "remote only" });
+    const pair = (slug, live) => {
+        bySlug.set(slug, live);
+        claimed.add(live);
+        // A later pass that CAN name this file's case unambiguously answers the
+        // question an earlier one refused to guess at.
+        refused.delete(slug);
+    };
+    const stillUnpaired = () => unpaired.filter((s) => !bySlug.has(s));
+    const unkeyed = (live) => !live?.key;
+    // The manifest rows whose file is GONE, each pointing at a live case nothing
+    // has claimed: the rename candidates, and the rows to clear once the file
+    // that succeeded them is recorded. Collected before the passes below consume
+    // them, so a rename that pass 2 resolves by key still clears its old row.
+    const staleLive = new Map();
+    const staleName = (stateKey) => input.managed?.[stateKey]?.slug ?? stateKey.split("/").slice(2).join("/");
+    {
+        const localNames = new Set(input.localSlugs);
+        for (const [stateKey, entry] of Object.entries(input.managed ?? {})) {
+            if (!stateKey.startsWith(`${input.blockType}/${input.blockKey}/`))
+                continue;
+            if (localNames.has(staleName(stateKey)))
+                continue;
+            const live = entry?.id ? byId.get(entry.id) : undefined;
+            if (live && !claimed.has(live))
+                staleLive.set(live, stateKey);
+        }
+    }
+    // Pass 2 — the identity the committed file carries, normalized the way the
+    // server's uniqueness constraint normalizes it. On a server with no keys this
+    // matches nothing at all.
+    if (input.serverSupportsKeys) {
+        for (const slug of stillUnpaired()) {
+            const live = input.liveCases.find((candidate) => !claimed.has(candidate) &&
+                typeof candidate?.key === "string" &&
+                candidate.key !== "" &&
+                normalizeTestCaseKey(candidate.key) === normalizeTestCaseKey(slug));
+            if (live)
+                pair(slug, live);
+        }
+    }
+    /**
+     * One adoption pass: pair a file with a candidate live case only when the
+     * match is unique in both directions. `onAmbiguity` decides what an ambiguous
+     * file is — refused (a rename we will not guess at) or simply unpaired.
+     */
+    const adoptUnambiguously = (candidatesFor, onAmbiguity, onPair) => {
+        const files = stillUnpaired();
+        const candidates = new Map();
+        for (const slug of files)
+            candidates.set(slug, candidatesFor(slug));
+        for (const slug of files) {
+            const mine = (candidates.get(slug) ?? []).filter((live) => !claimed.has(live));
+            if (mine.length !== 1) {
+                if (mine.length > 1)
+                    onAmbiguity?.(slug, mine);
+                continue;
+            }
+            const [live] = mine;
+            // The other direction: a live case two files both claim is not this
+            // file's, whatever this file thinks.
+            const contenders = files.filter((other) => other !== slug &&
+                !bySlug.has(other) &&
+                (candidates.get(other) ?? []).includes(live));
+            if (contenders.length > 0) {
+                onAmbiguity?.(slug, [live]);
+                continue;
+            }
+            pair(slug, live);
+            onPair?.(slug, live);
+        }
+    };
+    // Pass 3 — a rename the manifest still remembers under the old name. The
+    // stale entry's id is the live case, so following it converges on the SAME
+    // test case rather than creating a second one (DSO-2896-003).
+    if (input.serverSupportsKeys && input.contentMatches) {
+        adoptUnambiguously((slug) => [...staleLive.keys()].filter((live) => input.contentMatches(slug, live)), (slug, candidates) => {
+            const names = candidates
+                .map((live) => staleName(staleLive.get(live)))
+                .join(", ");
+            refused.set(slug, `possible rename of ${names || "a case this manifest still tracks"}, ` +
+                "refusing to guess — push from the machine that renamed it, or " +
+                "restore the previous file name");
+        }, (slug, live) => renamedFrom.set(slug, staleLive.get(live)));
+    }
+    // A file paired by KEY whose manifest row still stands under the old name is
+    // the same rename, seen one push later: the stale row is bookkeeping to clear.
+    for (const [slug, live] of bySlug) {
+        const stateKey = staleLive.get(live);
+        if (stateKey && !renamedFrom.has(slug))
+            renamedFrom.set(slug, stateKey);
+    }
+    // Pass 4 — a legacy case with no key at all, matched by content. This is what
+    // lets a fresh clone of a never-stamped tree converge instead of duplicating
+    // (DSO-2896-001); ambiguity leaves the file unpaired for the creation guard.
+    if (input.serverSupportsKeys && input.contentMatches) {
+        adoptUnambiguously((slug) => input.liveCases.filter((live) => unkeyed(live) && input.contentMatches(slug, live)));
+    }
+    // Pass 5 — the slug-of-name rule #2880 shipped, restricted to cases whose
+    // identity nothing else states. Adopting a KEYED case by its name would
+    // silently re-pair a case another file owns.
+    const derivedNames = testCaseFileBasenames(input.liveCases);
+    const localOnly = [];
+    for (const slug of stillUnpaired()) {
+        const adopted = input.liveCases.find((live) => !claimed.has(live) &&
+            (!input.serverSupportsKeys || unkeyed(live)) &&
+            derivedNames.get(live) === slug);
+        if (adopted)
+            pair(slug, adopted);
+        else if (!refused.has(slug))
+            localOnly.push(slug);
     }
-    return rows;
+    return {
+        bySlug,
+        localOnly,
+        remoteOnly: input.liveCases.filter((live) => !claimed.has(live)),
+        renamedFrom,
+        refused,
+    };
 }
 /**
- * `config diff` for one block's test-case sidecar (#2769). A failed listing is
- * an OUTCOME the caller reports as "not compared" — the old helper returned
- * silently, so a block whose tests could not be fetched simply disappeared from
- * a report that still read as exhaustive.
+ * This block's own `configId`→`configName` pairs, for the comparison (#2880).
+ *
+ * A sidecar pins the config it exercises by NAME so it survives a move between
+ * apps; the server answers with the id. Only the block's configs can equate the
+ * two, and `config diff` reads them from the detail its per-type loops already
+ * fetch — which covers prompts and nothing else. Without this, every script,
+ * integration and workflow sidecar pinned to a config reported Modified
+ * forever, and push read the same pair as server drift.
+ *
+ * One listing per block that has sidecars, and a failed one is silent: an
+ * unresolved reference compares as the id both sides carry, which is the same
+ * degradation `serializeTestCase` already applies.
  */
+async function fillBlockConfigNames(client, appId, blockType, blockId, configIdToName) {
+    try {
+        const configs = blockType === "prompt"
+            ? ((await client.getPrompt(appId, blockId))?.configs ?? [])
+            : blockType === "workflow"
+                ? ((await client.getWorkflow(appId, blockId))?.configs ?? [])
+                : blockType === "script"
+                    ? (await client.listScriptConfigs(appId, blockId)).items
+                    : (await client.listIntegrationConfigs(appId, blockId)).items;
+        for (const config of configs) {
+            if (config?.configId && config?.configName) {
+                configIdToName.set(config.configId, config.configName);
+            }
+        }
+    }
+    catch {
+        // Non-fatal — see above.
+    }
+}
 export async function compareTestCasesForBlock(params) {
     const listed = await listAllTestCases(params.client, params.appId, params.blockType, params.blockId);
     if (!listed.ok)
@@ -4683,17 +5727,108 @@ export async function compareTestCasesForBlock(params) {
             .filter((f) => f.endsWith(".toml"))
             .map((f) => basename(f, ".toml"))
         : [];
-    return {
-        ok: true,
-        rows: classifyTestCaseSidecarDiff({
-            remoteNames: listed.items.map((tc) => tc.name),
-            localSlugs,
-        }).map((row) => ({
-            blockType: params.blockType,
-            blockKey: params.blockKey,
-            ...row,
-        })),
-    };
+    // #2880 — identity is the manifest id, so a rename is one Modified row rather
+    // than a local-only file beside a remote-only case. #2896 — and the committed
+    // key when the manifest has nothing to say, so a fresh clone reports the
+    // truth too.
+    const managed = params.syncState?.entities?.testCases;
+    const spec = configDiffSpec("test-case");
+    const extra = { lookupMaps: params.lookupMaps };
+    const rows = [];
+    const base = { blockType: params.blockType, blockKey: params.blockKey };
+    // The configs this block's sidecars pin by name (see `fillBlockConfigNames`).
+    // Read BEFORE pairing: the content-corroborated adoption passes compare the
+    // same projection this command reports with, and a reference they cannot read
+    // is a difference that is not there.
+    if (localSlugs.length > 0 && params.lookupMaps) {
+        await fillBlockConfigNames(params.client, params.appId, params.blockType, params.blockId, params.lookupMaps.configIdToName);
+    }
+    const paired = pairTestCases({
+        blockType: params.blockType,
+        blockKey: params.blockKey,
+        localSlugs,
+        liveCases: listed.items,
+        managed,
+        serverSupportsKeys: listed.items.some((live) => live && typeof live === "object" && "key" in live),
+        contentMatches: testCaseContentMatcher({ testsDir, spec, extra }),
+    });
+    for (const slug of localSlugs) {
+        const live = paired.bySlug.get(slug);
+        if (!live) {
+            rows.push({ ...base, slug, status: LOCAL_ONLY_NEW });
+            continue;
+        }
+        const filePath = join(testsDir, `${slug}.toml`);
+        let row;
+        try {
+            const tomlData = parseTomlFile(filePath);
+            // #2880 criterion 1 — a sidecar push's preflight would reject is not one
+            // this command calls synced, and the message is the same one. The WHOLE
+            // preflight, not just the sidecar's own rules: an unknown key or a
+            // mistyped value aborts push too.
+            const errors = testCaseSidecarPreflightErrors(filePath, tomlData);
+            if (errors.length > 0) {
+                row = {
+                    ...base,
+                    slug,
+                    status: VALIDATION_ERROR,
+                    hint: errors.join("; "),
+                };
+            }
+            else {
+                const verdict = compareLocalToRemote(spec, tomlData, live, { ruleSetIdToName: new Map(), ruleSetNameToId: new Map() }, extra, 
+                // Both sides read a reference through the same lookups — see
+                // `compareLocalToRemote`.
+                extra);
+                row = { ...base, slug, ...verdict };
+            }
+        }
+        catch (err) {
+            row = {
+                ...base,
+                slug,
+                status: VALIDATION_ERROR,
+                hint: `${filePath}: ${err?.message || String(err)}`,
+            };
+        }
+        // #2880 behavior 19 — attachments are part of what push would do, read
+        // from the SAME plan push executes. A sidecar whose text compares clean but
+        // whose fixtures have not been uploaded is not Synced.
+        const stateKey = `${params.blockType}/${params.blockKey}/${slug}`;
+        const plan = planAttachmentPush({
+            local: readLocalAttachments(join(testsDir, slug)),
+            recorded: managed?.[stateKey],
+        });
+        if (plan.upload.length > 0) {
+            row.attachmentUploads = plan.upload;
+            if (row.status === "exists") {
+                row.status = "modified";
+                row.hint = `${plan.upload.length} attachment(s) to upload`;
+            }
+        }
+        if (plan.removedRemotely.length > 0) {
+            row.attachmentDeletions = plan.removedRemotely;
+            row.hint = [
+                row.hint,
+                `${plan.removedRemotely.length} attachment(s) deleted locally — \`push --prune\` removes them server-side`,
+            ]
+                .filter(Boolean)
+                .join("; ");
+        }
+        rows.push(row);
+    }
+    // #2896 — the row names the file a pull would put this case in, which for a
+    // keyed case is its key. Reporting the slug of its NAME described a file that
+    // would never exist.
+    const remoteNames = testCaseFileBasenames(listed.items);
+    for (const live of paired.remoteOnly) {
+        rows.push({
+            ...base,
+            slug: remoteNames.get(live) ?? slugifyTestCaseName(live?.name || "unnamed"),
+            status: "remote only",
+        });
+    }
+    return { ok: true, rows };
 }
 /**
  * Shape errors in an authored test-case sidecar, for the push preflight
@@ -4730,6 +5865,29 @@ export function testCaseSidecarErrors(filePath, tomlData) {
     }
     return errors;
 }
+/**
+ * EVERY reason `config push` refuses one test-case sidecar (#2880 criterion 1).
+ *
+ * The four checks the push preflight ran inline: the document's shape, the keys
+ * the definition recognizes, the declared type of each value, and the sidecar's
+ * own authoring rules (#2769). Collected in one place because `config diff`
+ * runs the identical list — it used to run only the last of the four, so a
+ * sidecar with an unknown key or a mistyped ordinary field was reported Synced
+ * by the command whose whole promise is that a Synced file pushes.
+ */
+export function testCaseSidecarPreflightErrors(filePath, tomlData) {
+    const errors = [
+        // The document's own shape first: an unrecognized top-level table makes
+        // every per-table check below read an absent table, so its silence would
+        // be misleading.
+        ...configDocumentShapeErrors(filePath, tomlData, TEST_CASE_SURFACE),
+    ];
+    const unknownKeyError = configUnknownKeyError(filePath, tomlData, TEST_CASE_TABLE);
+    if (unknownKeyError)
+        errors.push(unknownKeyError);
+    errors.push(...configDeclaredTypeErrors(filePath, tomlData, TEST_CASE_TABLE), ...testCaseSidecarErrors(filePath, tomlData));
+    return errors;
+}
 /** Whether a block's own authored file is still in the tree. */
 function blockFileExists(configDir, blockType, blockKey) {
     const resourceType = SYNC_RESOURCE_TYPES.find((t) => t.testBlockType === blockType);
@@ -4747,15 +5905,27 @@ function blockFileExists(configDir, blockType, blockKey) {
 export function collectTestCaseDeletions(params) {
     const exists = params.blockExists ??
         ((blockType, blockKey) => blockFileExists(params.configDir, blockType, blockKey));
+    const entries = Object.entries(params.testCaseEntities ?? {});
+    const fileExists = (entry) => existsSync(join(getTestsDir(params.configDir, entry.blockType, entry.blockKey), `${entry.slug}.toml`));
     const candidates = [];
-    for (const [stateKey, entry] of Object.entries(params.testCaseEntities ?? {})) {
+    for (const [stateKey, entry] of entries) {
         if (!entry?.blockType || !entry?.blockKey || !entry?.slug)
             continue;
         if (!exists(entry.blockType, entry.blockKey))
             continue;
-        const filePath = join(getTestsDir(params.configDir, entry.blockType, entry.blockKey), `${entry.slug}.toml`);
-        if (existsSync(filePath))
+        if (fileExists(entry))
             continue;
+        // #2896 — a row whose id ANOTHER row still holds, with its file on disk, is
+        // the trace of a rename. Deleting the case it names would delete the case
+        // that file manages, which is how a rename used to lose its history.
+        const supersededBy = entries.find(([otherKey, other]) => otherKey !== stateKey &&
+            other?.id &&
+            entry.id &&
+            other.id === entry.id &&
+            other?.blockType &&
+            other?.blockKey &&
+            other?.slug &&
+            fileExists(other))?.[0];
         candidates.push({
             stateKey,
             blockType: entry.blockType,
@@ -4763,6 +5933,7 @@ export function collectTestCaseDeletions(params) {
             blockKey: entry.blockKey,
             slug: entry.slug,
             id: entry.id,
+            supersededBy,
         });
     }
     return candidates;
@@ -4815,15 +5986,19 @@ export function collectAttachmentDeletions(params) {
  * has. Returns the lines to print; empty when nothing is pending.
  */
 export function formatPendingTestDeletions(params) {
-    if (params.testCases.length === 0 && params.attachments.length === 0)
+    // #2896 — a row superseded by a RENAME is not a removal: the case is alive
+    // under the new file name, and reporting it here would invite an operator to
+    // prune away a test case they only renamed.
+    const testCases = params.testCases.filter((candidate) => !candidate.supersededBy);
+    if (testCases.length === 0 && params.attachments.length === 0)
         return [];
     const counts = [
-        params.testCases.length > 0 ? `${params.testCases.length} test case(s)` : null,
+        testCases.length > 0 ? `${testCases.length} test case(s)` : null,
         params.attachments.length > 0 ? `${params.attachments.length} attachment(s)` : null,
     ].filter(Boolean);
     return [
         `${counts.join(" and ")} removed locally — run \`config push --prune\` to delete them server-side:`,
-        ...params.testCases.map((candidate) => `  pending delete test-case: ${candidate.blockKey}/${candidate.slug}`),
+        ...testCases.map((candidate) => `  pending delete test-case: ${candidate.blockKey}/${candidate.slug}`),
         ...params.attachments.map((candidate) => `  pending delete attachment: ${candidate.blockKey}/${candidate.slug}/${candidate.filename}`),
     ];
 }
@@ -4865,6 +6040,15 @@ export async function applyTestCasePrune(params) {
     }
     for (const candidate of params.candidates) {
         const key = `${candidate.blockKey}/${candidate.slug}`;
+        // #2896 — the same case, still managed under the file it was renamed to.
+        // Nothing is deleted server-side, so a dry run must not plan one either.
+        if (candidate.supersededBy) {
+            if (!params.dryRun) {
+                delete params.testCaseEntities[candidate.stateKey];
+                log(`  Test case ${key} was renamed to ${params.testCaseEntities[candidate.supersededBy]?.slug ?? "another file"} — cleared from sync state`);
+            }
+            continue;
+        }
         if (params.dryRun) {
             params.changes.push({ type: "test-case", action: "delete", key });
             continue;
@@ -5045,6 +6229,12 @@ export function registerConfigSyncCommands(sync) {
             // The unfiltered listings, kept so the archived rows this pull declines
             // to export can still be recorded as tombstones in sync state (#2803).
             const integrationTombstoneCandidates = [];
+            // #2887 — prompts and workflows carry a tombstone now, so they need
+            // the same pass: an archived row is retired, not configuration, and
+            // its managed key still has to reach sync state or `--prune` can never
+            // reclaim it.
+            const promptTombstoneCandidates = [];
+            const workflowTombstoneCandidates = [];
             // Fetch all data. Issue #1659: prune decides whether a local file's
             // entity still exists server-side, so every fetch that establishes
             // presence must report success or failure explicitly — an error that
@@ -5063,8 +6253,14 @@ export function registerConfigSyncCommands(sync) {
                     integrationTombstoneCandidates.push(...items);
                     return skipArchivedForPull(items);
                 }),
-                fetchAll((p) => client.listPrompts(resolvedAppId, p)),
-                fetchAll((p) => client.listWorkflows(resolvedAppId, p)),
+                fetchAll((p) => client.listPrompts(resolvedAppId, p)).then((items) => {
+                    promptTombstoneCandidates.push(...items);
+                    return skipArchivedForPull(items);
+                }),
+                fetchAll((p) => client.listWorkflows(resolvedAppId, p)).then((items) => {
+                    workflowTombstoneCandidates.push(...items);
+                    return skipArchivedForPull(items);
+                }),
                 attemptFetch(() => client.listEmailTemplates(resolvedAppId)),
             ]);
             const emailTemplatesResult = emailTemplatesOutcome.ok
@@ -5249,14 +6445,10 @@ export function registerConfigSyncCommands(sync) {
                 warn(`  ${message}`);
             }
             if (settings && pullsApp) {
-                // Write and warn in one place: a googleClientSecret the server
-                // withheld is not in the file, so pull time is where an operator
-                // finds out — a legacy literal from before reference-only still signs
-                // in (#2256), a malformed reference does not, and either one makes a
-                // push of this file fail.
-                writePulledAppSettings(configDir, settings, {
-                    subject: "  app.toml: googleClientSecret",
-                });
+                // Every writable setting round-trips as of #2891 — the server
+                // withholds nothing — so the pulled file is complete and pushable as
+                // written, with no accompanying note about what it could not carry.
+                writePulledAppSettings(configDir, settings);
                 info("  Wrote app.toml");
             }
             // Write config vars (issue #1423). A single flat vars.toml at the
@@ -5318,6 +6510,12 @@ export function registerConfigSyncCommands(sync) {
             }
             // Write integrations
             const integrationEntities = {};
+            // As for webhooks: no rule-set reference, and the pull-wide maps are
+            // not filled until the rule-set leg, well after this one.
+            const integrationPullMaps = {
+                ruleSetIdToName: new Map(),
+                ruleSetNameToId: new Map(),
+            };
             for (const integration of integrations) {
                 const filename = `${integration.integrationKey}.toml`;
                 const filePath = join(configDir, "integrations", filename);
@@ -5326,6 +6524,9 @@ export function registerConfigSyncCommands(sync) {
                     id: integration.integrationId,
                     modifiedAt: integration.modifiedAt || new Date().toISOString(),
                     contentHash: computeFileHash(filePath),
+                    // #2880 — the two sides agree right now, so this is the baseline
+                    // the next push classifies direction against.
+                    semanticHash: configSemanticHash("integration", filePath, integrationPullMaps),
                 };
                 info(`  Wrote integrations/${filename}`);
             }
@@ -5341,6 +6542,14 @@ export function registerConfigSyncCommands(sync) {
             const webhooksDir = join(configDir, "webhooks");
             mkdirSync(webhooksDir, { recursive: true });
             const webhookEntities = {};
+            // Webhooks carry no rule-set reference, so the shared projection's
+            // resolution maps are inert for this type — the same empty pair the
+            // diff path passes (the pull-wide maps are not filled until the
+            // rule-set leg runs, well after this one).
+            const webhookPullMaps = {
+                ruleSetIdToName: new Map(),
+                ruleSetNameToId: new Map(),
+            };
             for (const webhook of webhooks) {
                 const filename = `${webhook.webhookKey}.toml`;
                 const filePath = join(webhooksDir, filename);
@@ -5349,6 +6558,9 @@ export function registerConfigSyncCommands(sync) {
                     id: webhook.webhookId,
                     modifiedAt: webhook.modifiedAt || new Date().toISOString(),
                     contentHash: computeFileHash(filePath),
+                    // #2880 — the file and the server agree right now, so this is the
+                    // baseline the next push classifies direction against.
+                    semanticHash: configSemanticHash("webhook", filePath, webhookPullMaps),
                 };
                 // A stored value that is not a reference is never written to TOML, so
                 // pull time is where an operator finds out: a legacy literal from
@@ -5389,6 +6601,12 @@ export function registerConfigSyncCommands(sync) {
             const cronTriggersDir = join(configDir, "cron-triggers");
             mkdirSync(cronTriggersDir, { recursive: true });
             const cronTriggerEntities = {};
+            // No rule-set reference on either type, and the pull-wide maps are not
+            // filled until the rule-set leg — see the webhook block above.
+            const keylessPullMaps = {
+                ruleSetIdToName: new Map(),
+                ruleSetNameToId: new Map(),
+            };
             for (const trigger of cronTriggerItems) {
                 const filename = `${trigger.triggerKey}.toml`;
                 const filePath = join(cronTriggersDir, filename);
@@ -5397,6 +6615,8 @@ export function registerConfigSyncCommands(sync) {
                     id: trigger.triggerId,
                     modifiedAt: trigger.modifiedAt || new Date().toISOString(),
                     contentHash: computeFileHash(filePath),
+                    // #2880 — the baseline the next push classifies direction against.
+                    semanticHash: configSemanticHash("cron-trigger", filePath, keylessPullMaps),
                 };
             }
             info(`  Pulled ${cronTriggerItems.length} cron trigger(s)`);
@@ -5414,6 +6634,8 @@ export function registerConfigSyncCommands(sync) {
                     id: bucket.bucketId,
                     modifiedAt: bucket.modifiedAt || new Date().toISOString(),
                     contentHash: computeFileHash(filePath),
+                    // #2880 — as for cron triggers.
+                    semanticHash: configSemanticHash("blob-bucket", filePath, keylessPullMaps),
                 };
             }
             info(`  Pulled ${blobBucketItems.length} blob bucket(s)`);
@@ -5997,18 +7219,32 @@ export function registerConfigSyncCommands(sync) {
                         idOf: (w) => w.webhookId,
                     }, Object.keys(priorEntities.webhooks ?? {})),
                 ],
+                // #2887 — the two types that gained a tombstone.
+                [
+                    "prompts",
+                    archivedTombstoneEntries(promptTombstoneCandidates, {
+                        keyOf: (p) => p.promptKey,
+                        idOf: (p) => p.promptId,
+                    }, Object.keys(priorEntities.prompts ?? {})),
+                ],
+                [
+                    "workflows",
+                    archivedTombstoneEntries(workflowTombstoneCandidates, {
+                        keyOf: (w) => w.workflowKey,
+                        idOf: (w) => w.workflowId,
+                    }, Object.keys(priorEntities.workflows ?? {})),
+                ],
             ]) {
                 const built = entitiesBySlot[slot];
                 const resourceType = SYNC_RESOURCE_TYPES.find((rt) => rt.stateSlot === slot);
                 if (!built || !resourceType)
                     continue;
-                for (const [key, entry] of Object.entries(tombstones)) {
-                    if (key in built)
-                        continue;
-                    if (!selectionIncludesKey(pullSelection, resourceType.label, key)) {
-                        continue;
-                    }
-                    built[key] = entry;
+                const recorded = recordArchivedTombstones(built, tombstones, {
+                    label: resourceType.label,
+                    selection: pullSelection,
+                    matchedSelectors,
+                });
+                for (const key of recorded) {
                     info(`  No ${resourceType.dir}/${resourceType.fileFromKey(key)} — ` +
                         "the entity is archived; `config push --prune` reclaims it");
                 }
@@ -6038,6 +7274,11 @@ export function registerConfigSyncCommands(sync) {
                         id: prior.id,
                         modifiedAt: row.modifiedAt || "",
                     };
+                    // #2887 (F-003) — the same matched-selector rule the shared
+                    // recorder applies: a selector that resolved to a tombstone found
+                    // something, so the pull must not then report it as missing.
+                    if (pullSelection)
+                        matchedSelectors.add(`cron-trigger/${key}`);
                     info(`  No cron-triggers/${key}.toml — the trigger is archived; ` +
                         "`config push --prune` reclaims it");
                 }
@@ -6072,6 +7313,12 @@ export function registerConfigSyncCommands(sync) {
                         ? {
                             modifiedAt: new Date().toISOString(),
                             contentHash: computeFileHash(join(configDir, "app.toml")),
+                            // #2880 — the file was just written FROM these settings, so
+                            // this is the state both sides agree on: the baseline the
+                            // next push classifies against. A pull also ends any
+                            // cross-app name exclusion, because the file it just wrote
+                            // states the target's own name.
+                            semanticHash: hashAppSettingsForDiff(settings),
                         }
                         : pullSelection
                             ? priorEntities.app
@@ -6231,6 +7478,15 @@ export function registerConfigSyncCommands(sync) {
             };
         }
         info(`Pushing configuration for app ${resolvedAppId}...`);
+        // The state this push STARTS from, so the failure path below can tell a
+        // run that recorded something from one that recorded nothing (#2936).
+        // Every applied write stamps what it did into `syncState` — an id for a
+        // create, a baseline for an update, a removal for a delete — so a state
+        // that still reads byte-for-byte like this one is a run with no progress
+        // to preserve. `changes` cannot answer the question: it is the PLANNED
+        // list, appended before the call that applies it, so a first write that
+        // rejects leaves it non-empty having applied nothing.
+        const syncStateAtStart = syncState ? JSON.stringify(syncState) : null;
         try {
             const changes = [];
             let skippedCount = 0;
@@ -6428,11 +7684,37 @@ export function registerConfigSyncCommands(sync) {
                     drifted.push({ type, key });
                     return;
                 }
+                // #2880 criterion 7 — neither side's state is known, so nothing is
+                // written. Named as a failure rather than a skip: the file was NOT
+                // pushed, and a run that reported it as skipped-unchanged would be
+                // claiming a comparison it never made.
+                if (outcome.action === "live-unavailable") {
+                    applyFailures.push({
+                        type,
+                        key,
+                        message: "live state could not be read and the manifest holds no " +
+                            "last-sync content hash for this file, so push cannot tell " +
+                            "which side moved. Nothing was written. Run `config pull` to " +
+                            "take the server's state, or `config push --force` to " +
+                            "overwrite it.",
+                    });
+                    return;
+                }
                 if (outcome.action === "immutable") {
+                    // #2934 — say WHICH two values disagree, not just which field.
+                    // "ttlTier cannot be changed" leaves the operator to go and read
+                    // both sides before they can align either; the pre-#2880 409-adopt
+                    // path named the pair in its refusal and this one has the same
+                    // diff in hand.
+                    const mismatches = (outcome.fields || [])
+                        .filter((f) => outcome.immutableFields.includes(f.field))
+                        .map((f) => `${f.field} mismatch: local ${summarizeFieldValue(f.local)} | ` +
+                        `server ${summarizeFieldValue(f.server)}`);
                     applyFailures.push({
                         type,
                         key,
-                        message: `${outcome.immutableFields.join(", ")} cannot be changed by an update. ` +
+                        message: (mismatches.length > 0 ? `${mismatches.join("; ")}. ` : "") +
+                            `${outcome.immutableFields.join(", ")} cannot be changed by an update. ` +
                             `Recreate the ${type} (or rename it and push a new one) to change it; ` +
                             `an update would report success without changing anything.`,
                     });
@@ -6551,6 +7833,37 @@ export function registerConfigSyncCommands(sync) {
             const promptKeyToId = new Map();
             const promptConfigNameToId = new Map(); // key: "promptKey#configName"
             const workflowConfigNameToId = new Map(); // key: "workflowKey#configName"
+            const scriptConfigNameToId = new Map(); // "scriptName#configName" → configId
+            const integrationConfigNameToId = new Map(); // "integrationKey#configName" → configId
+            /**
+             * The id→name direction the test-case comparison reads a reference
+             * through (#2880). Filled from the name→id maps above before the
+             * test-case legs run, and REFILLED as each block's configs are resolved:
+             * the four maps are populated lazily, per block, as a case names one, so
+             * a single fill before the legs start would leave every script and
+             * integration reference — and every prompt this push had no reason to
+             * visit — unresolved, which the comparison reads as server drift on a
+             * file nobody touched.
+             */
+            const pushTestCaseLookupMaps = {
+                configIdToName: new Map(),
+                promptIdToKey: new Map(),
+            };
+            const fillTestCaseLookupMaps = () => {
+                for (const [key, id] of promptKeyToId) {
+                    pushTestCaseLookupMaps.promptIdToKey.set(id, key);
+                }
+                for (const [scoped, id] of [
+                    ...promptConfigNameToId,
+                    ...workflowConfigNameToId,
+                    ...scriptConfigNameToId,
+                    ...integrationConfigNameToId,
+                ]) {
+                    // The map is keyed `<blockKey>#<configName>`; the comparison names
+                    // the config, not the block.
+                    pushTestCaseLookupMaps.configIdToName.set(id, scoped.slice(scoped.indexOf("#") + 1));
+                }
+            };
             // ── Issue #976 (fix A): front-load ALL client-side TOML validation
             // before the first mutating call. Push is apply-as-you-go and processes
             // entities in a fixed sequence (cron triggers are created *before*
@@ -6698,7 +8011,13 @@ export function registerConfigSyncCommands(sync) {
                 try {
                     const parsedApp = parseTomlFile(preflightAppTomlPath);
                     const appErrors = collectAppSettingsPushErrors(parsedApp, {
-                        isCrossAppPush,
+                        // #2880 DSO-001 — the same exclusion the apply block computes, so
+                        // the preflight validates the body that will actually be sent.
+                        excludeName: appSettingsNameExcluded({
+                            isCrossAppPush: !!isCrossAppPush,
+                            recordedExcludedName: syncState?.entities?.app?.excludedName,
+                            fileName: parsedApp?.app?.name,
+                        }),
                     });
                     for (const e of appErrors) {
                         preflightValidationErrors.push(`  app.toml: ${e}`);
@@ -6741,38 +8060,18 @@ export function registerConfigSyncCommands(sync) {
             // preflight pass, so nothing is applied and no request is issued —
             // rather than being dropped on the way to the server and reading as a
             // successful push that changed nothing.
-            for (const { dir, surface, tables } of unknownKeyPreflightTargets()) {
-                const typeDir = join(configDir, dir);
-                if (!existsSync(typeDir))
-                    continue;
-                for (const file of readdirSync(typeDir).filter((f) => f.endsWith(".toml"))) {
-                    const filePath = join(typeDir, file);
-                    let tomlData;
-                    try {
-                        tomlData = parseTomlFile(filePath);
-                    }
-                    catch {
-                        // A file that does not parse is reported by the per-type loop
-                        // with its own message; nothing to add here.
-                        continue;
-                    }
-                    // The document's own shape first: an unrecognized top-level table
-                    // makes every per-table check below read an absent table, so its
-                    // silence would be misleading.
-                    for (const shapeError of configDocumentShapeErrors(filePath, tomlData, surface)) {
-                        preflightValidationErrors.push(`  ${shapeError}`);
-                    }
-                    for (const table of tables) {
-                        const unknownKeyError = configUnknownKeyError(filePath, tomlData, table);
-                        if (unknownKeyError) {
-                            preflightValidationErrors.push(`  ${unknownKeyError}`);
-                        }
-                    }
+            // #2880 — the same collector `config diff` runs, so the two commands
+            // cannot disagree about which files are pushable.
+            for (const rejected of collectConfigFileValidationErrors(configDir)) {
+                for (const message of rejected.messages) {
+                    preflightValidationErrors.push(`  ${message}`);
                 }
             }
             // The `<key>.tests/*.toml` sidecars, which sit beside the block they
             // test rather than in a type directory of their own. Same posture,
-            // reached through the registry's `test-case` surface.
+            // reached through the registry's `test-case` surface — and through the
+            // same collector `config diff` runs per sidecar (#2880), so neither
+            // command can refuse a file the other calls Synced.
             for (const filePath of testCaseTomlFiles(configDir)) {
                 let tomlData;
                 try {
@@ -6782,18 +8081,8 @@ export function registerConfigSyncCommands(sync) {
                     // Reported by the per-block test-case loop with its own message.
                     continue;
                 }
-                for (const shapeError of configDocumentShapeErrors(filePath, tomlData, TEST_CASE_SURFACE)) {
-                    preflightValidationErrors.push(`  ${shapeError}`);
-                }
-                const unknownKeyError = configUnknownKeyError(filePath, tomlData, TEST_CASE_TABLE);
-                if (unknownKeyError) {
-                    preflightValidationErrors.push(`  ${unknownKeyError}`);
-                }
-                // #2769 — with TOML the only authoring path, a sidecar the server
-                // would reject (no `name`) or whose JSON text does not parse fails
-                // here, before any test case is created or updated.
-                for (const shapeError of testCaseSidecarErrors(filePath, tomlData)) {
-                    preflightValidationErrors.push(`  ${shapeError}`);
+                for (const message of testCaseSidecarPreflightErrors(filePath, tomlData)) {
+                    preflightValidationErrors.push(`  ${message}`);
                 }
             }
             if (preflightValidationErrors.length > 0) {
@@ -6938,36 +8227,191 @@ export function registerConfigSyncCommands(sync) {
             // else in the slot (issue #2645): a full push applies it, and
             // `--only app` applies it alone. The separate `settings push` command
             // that used to own this is gone.
+            //
+            // #2880 behaviors 10, 11 and 14 — this block used to answer "changed?"
+            // from the file's BYTES and then PATCH only the keys the file spelled.
+            // Both are gone. The comparison is the one `config diff` reports, over
+            // the full writable descriptor set, and the payload is the whole file:
+            // a key the file no longer carries is the clear (or the declared
+            // default) push applies, exactly as it is for every other type (#1567).
             const appTomlPath = join(configDir, "app.toml");
             if (existsSync(appTomlPath) && (!pushSelection || pushSelection.app)) {
-                const appChanged = options.force || !syncState?.entities?.app?.contentHash ||
-                    shouldPushFile(appTomlPath, syncState.entities.app.contentHash);
-                if (!appChanged) {
-                    skippedCount++;
-                    info("  Skipped app settings (unchanged)");
+                const tomlData = parseTomlFile(appTomlPath);
+                const appEntry = syncState?.entities?.app;
+                const appFileHash = computeFileHash(appTomlPath);
+                const appFileName = tomlData?.app?.name;
+                const recordedExcludedName = appEntry?.excludedName;
+                // DSO-001, the cross-app rule in three parts.
+                //
+                // `payloadExcludesName` — is `[app].name` out of the body? A
+                // cross-app push never renames its target, and neither does a later
+                // push of a file still stating the name that push left behind.
+                //
+                // `compareExcludesName` — are the two hashes computed without it?
+                // While an exclusion RECORD exists they must be, because that is how
+                // the baseline was stamped, and `classifyPushChange` can only answer
+                // `local-edited` when the remote hash equals the baseline.
+                //
+                // `appNameEdited` — the file has moved away from the recorded name.
+                // That is a local rename BY CONSTRUCTION, not by comparison: no
+                // baseline hashed without `name` can ever attribute it.
+                const payloadExcludesName = appSettingsNameExcluded({
+                    isCrossAppPush: !!isCrossAppPush,
+                    recordedExcludedName,
+                    fileName: appFileName,
+                });
+                const compareExcludesName = !!isCrossAppPush || recordedExcludedName !== undefined;
+                const appNameEdited = !isCrossAppPush &&
+                    recordedExcludedName !== undefined &&
+                    !payloadExcludesName;
+                // The whole-truth body. Errors (an unrecognized or retired key, a
+                // type mismatch, a missing required key) already aborted the push in
+                // the preflight pass above, so only warnings remain here.
+                const { settings: appPayload, warnings: appWarnings } = buildAppSettingsPayload(tomlData, {
+                    excludeName: payloadExcludesName,
+                });
+                for (const w of appWarnings) {
+                    warn(`  ${w}`);
+                }
+                let appLiveOk = true;
+                let liveSettings;
+                try {
+                    liveSettings = await client.getAppSettings(resolvedAppId);
+                }
+                catch (err) {
+                    appLiveOk = false;
+                    warnLiveUnavailable("app-settings", err);
+                }
+                /** Record the state both sides are now known to be in. */
+                const stampAppEntry = (baselineSettings, options) => {
+                    if (!syncState)
+                        return;
+                    syncState.entities.app = {
+                        modifiedAt: baselineSettings?.modifiedAt ||
+                            appEntry?.modifiedAt ||
+                            new Date().toISOString(),
+                        contentHash: appFileHash,
+                        semanticHash: hashAppSettingsForDiff(baselineSettings, {
+                            excludeName: options.recordExclusion !== undefined ||
+                                (options.keepExclusion && compareExcludesName),
+                        }),
+                        ...(options.recordExclusion !== undefined
+                            ? { excludedName: options.recordExclusion }
+                            : options.keepExclusion && recordedExcludedName !== undefined
+                                ? { excludedName: recordedExcludedName }
+                                : {}),
+                    };
+                };
+                let applyAppSettings = true;
+                if (appLiveOk) {
+                    const compareOptions = { excludeName: compareExcludesName };
+                    const localHash = hashAppSettingsForDiff(appPayload, compareOptions);
+                    const remoteHash = hashAppSettingsForDiff(liveSettings ?? {}, compareOptions);
+                    if (options.force) {
+                        // `--force` is the operator saying "local wins": no direction
+                        // check, exactly as it is for every other type.
+                    }
+                    else if (isCrossAppPush) {
+                        // The target's settings are not this slot's history: there is no
+                        // baseline and none is inferable, and applying the source's
+                        // configuration is the whole point of the push. `name` is already
+                        // out of the body, so the one thing that could not be recovered
+                        // by a later `config pull` is not at risk.
+                    }
+                    else {
+                        const direction = classifyPushChange({
+                            localHash,
+                            remoteHash,
+                            baselineHash: appEntry?.semanticHash,
+                            legacy: {
+                                localBytesMatchStoredContentHash: appEntry?.contentHash !== undefined &&
+                                    appEntry.contentHash === appFileHash,
+                                // Deliberately never true: `entities.app.modifiedAt` is
+                                // stamped from the LOCAL clock, so it proves nothing about
+                                // the server. A pre-upgrade manifest whose bytes have also
+                                // moved is therefore `unknown-direction` — a conflict, not a
+                                // blind overwrite of state nobody compared.
+                                liveModifiedAtMatchesStored: false,
+                            },
+                        });
+                        const fields = appSettingsFieldDiffs(appPayload, liveSettings ?? {}, compareOptions).map((d) => ({
+                            field: `[${d.section}].${d.key}`,
+                            local: d.local,
+                            server: d.remote,
+                        }));
+                        if (direction === "unchanged") {
+                            // A rename still has to go out: the comparison above cannot
+                            // see `name` while the exclusion record stands.
+                            if (!appNameEdited) {
+                                skippedCount++;
+                                info("  Skipped app settings (unchanged)");
+                                stampAppEntry(liveSettings, { keepExclusion: true });
+                                applyAppSettings = false;
+                            }
+                        }
+                        else if (direction === "server-drifted") {
+                            recordDeclined("app-settings", "app.toml", { action: "drift", localHash, remoteHash, fields }, appEntry?.modifiedAt);
+                            applyAppSettings = false;
+                        }
+                        else if (direction === "both-changed" ||
+                            direction === "unknown-direction") {
+                            recordDeclined("app-settings", "app.toml", {
+                                action: "conflict",
+                                direction,
+                                localHash,
+                                remoteHash,
+                                fields,
+                                serverModifiedAt: liveSettings?.modifiedAt,
+                            }, appEntry?.modifiedAt);
+                            applyAppSettings = false;
+                        }
+                    }
                 }
                 else {
-                    const tomlData = parseTomlFile(appTomlPath);
-                    // Definition-driven parse of every section ([app]/[auth]/[cors]/
-                    // [invitations]) — issue #1033, projected from the vendored
-                    // `app-settings` surface since #2644. `name` is stripped on
-                    // cross-app push. Errors (an unrecognized key or table, a type
-                    // mismatch) already aborted the push in the preflight pass above,
-                    // so only warnings remain here.
-                    const { settings, warnings: appWarnings } = parseTomlToAppSettings(tomlData, { isCrossAppPush });
-                    for (const w of appWarnings) {
-                        warn(`  ${w}`);
+                    const degraded = decideDegradedPush({
+                        force: options.force,
+                        storedContentHash: appEntry?.contentHash,
+                        currentFileHash: appFileHash,
+                    });
+                    if (degraded.action === "skip") {
+                        skippedCount++;
+                        info("  Skipped app settings (unchanged)");
+                        applyAppSettings = false;
+                    }
+                    else if (degraded.action === "decline") {
+                        recordDeclined("app-settings", "app.toml", { action: "live-unavailable" }, appEntry?.modifiedAt);
+                        applyAppSettings = false;
                     }
+                }
+                if (applyAppSettings) {
                     changes.push({ type: "app", action: "update", key: "settings" });
                     if (!options.dryRun) {
-                        await client.updateAppSettings(resolvedAppId, settings);
+                        const updated = await client.updateAppSettings(resolvedAppId, appPayload);
                         info("  Updated app settings");
-                        // Store content hash after successful push
-                        if (syncState) {
-                            if (!syncState.entities.app) {
-                                syncState.entities.app = { modifiedAt: new Date().toISOString() };
-                            }
-                            syncState.entities.app.contentHash = computeFileHash(appTomlPath);
+                        // Stamped from what the server RETURNED, not from the body sent:
+                        // `PUT /settings` normalizes (a trailing slash off `baseUrl`, a
+                        // lower-cased test-account email), so the payload is not what the
+                        // next comparison will read. The PUT echoes the full settings; if
+                        // a server ever answers with something else, re-read rather than
+                        // record a state nobody observed.
+                        const baselineSettings = updated && typeof updated === "object" && "mode" in updated
+                            ? updated
+                            : await client
+                                .getAppSettings(resolvedAppId)
+                                .catch(() => undefined);
+                        if (baselineSettings) {
+                            stampAppEntry(baselineSettings, {
+                                keepExclusion: false,
+                                // A cross-app apply is what CREATES the exclusion: the
+                                // target keeps its own name, and the file's name is recorded
+                                // so a later edit to that line reads as the rename it is.
+                                // Recorded AS STATED (#2936) — the stripped line was never
+                                // type-checked, so text is not the shape it has to have, and
+                                // a re-run of the same file has to read as the same name.
+                                ...(isCrossAppPush && appFileName !== undefined
+                                    ? { recordExclusion: appFileName }
+                                    : {}),
+                            });
                         }
                     }
                 }
@@ -7190,13 +8634,26 @@ export function registerConfigSyncCommands(sync) {
                             continue;
                         }
                     }
-                    else if (!options.force &&
-                        existingId &&
-                        !shouldPushFile(filePath, entry?.contentHash)) {
-                        // Fallback gate: the manifest byte hash, exactly as before.
-                        skippedCount++;
-                        ruleSetNameToId.set(ruleSetData.name, existingId);
-                        continue;
+                    else {
+                        // Fallback gate: the manifest byte hash, and — since #2880 — a
+                        // decline rather than a blind write when there is no hash.
+                        const degraded = decideDegradedPush({
+                            force: options.force,
+                            storedContentHash: entry?.contentHash,
+                            currentFileHash: computeFileHash(filePath),
+                        });
+                        if (degraded.action === "skip") {
+                            skippedCount++;
+                            if (existingId)
+                                ruleSetNameToId.set(ruleSetData.name, existingId);
+                            continue;
+                        }
+                        if (degraded.action === "decline") {
+                            recordDeclined("rule-set", fileKey, { action: "live-unavailable" }, entry?.modifiedAt);
+                            if (existingId)
+                                ruleSetNameToId.set(ruleSetData.name, existingId);
+                            continue;
+                        }
                     }
                     if (existingId) {
                         // Update existing rule set
@@ -7337,17 +8794,118 @@ export function registerConfigSyncCommands(sync) {
             const integrationsDir = join(configDir, "integrations");
             if (existsSync(integrationsDir)) {
                 const files = selectFiles("integration", integrationsDir, readdirSync(integrationsDir).filter((f) => f.endsWith(".toml")));
+                // #2880 — integrations join the live-state reconcile (#2731 B3), for
+                // the reason webhooks did: diff compared presence while push gated on
+                // the file's bytes, so a field edit was invisible to one command and
+                // applied by the other, and a comment was a change to the other and
+                // not the one.
+                const integrationSpec = configDiffSpec("integration");
+                const liveIntegrations = new Map();
+                let integrationsLiveOk = true;
+                if (files.length > 0) {
+                    try {
+                        const listed = await fetchAll((p) => client.listIntegrations(resolvedAppId, p));
+                        for (const i of listed) {
+                            if (i?.integrationKey)
+                                liveIntegrations.set(i.integrationKey, i);
+                        }
+                    }
+                    catch (err) {
+                        integrationsLiveOk = false;
+                        warnLiveUnavailable("integrations", err);
+                    }
+                }
+                /** The detail — `accessRule` and `requestConfig` are not on the list. */
+                const refetchLiveIntegration = async (integrationId) => {
+                    const full = await client.getIntegration(resolvedAppId, integrationId);
+                    return full ? { record: full } : null;
+                };
                 for (const file of files) {
                     const filePath = join(integrationsDir, file);
                     const tomlData = parseTomlFile(filePath);
-                    const integration = tomlData.integration || {};
-                    const key = integration.key || basename(file, ".toml");
-                    const existingId = syncState?.entities?.integrations?.[key]?.id;
-                    // Skip if file hasn't changed since last sync
-                    if (!options.force && existingId && !shouldPushFile(filePath, syncState?.entities?.integrations?.[key]?.contentHash)) {
-                        skippedCount++;
-                        continue;
+                    const key = tomlData.integration?.key || basename(file, ".toml");
+                    // The gate re-parses the DOCUMENT, so the key the file left to its
+                    // name has to be in it (see `withDerivedIdentity`).
+                    withDerivedIdentity(tomlData, "integration", { key });
+                    const existingEntry = syncState?.entities?.integrations?.[key];
+                    const liveListed = liveIntegrations.get(key);
+                    let integrationLiveOk = integrationsLiveOk;
+                    let liveIntegration = undefined;
+                    if (integrationLiveOk && liveListed?.integrationId) {
+                        try {
+                            liveIntegration = await client.getIntegration(resolvedAppId, liveListed.integrationId);
+                        }
+                        catch (err) {
+                            integrationLiveOk = false;
+                            warnLiveUnavailable(`integration ${key}`, err);
+                        }
                     }
+                    let gate;
+                    if (integrationLiveOk) {
+                        gate = decidePushForConfig({
+                            spec: integrationSpec,
+                            maps: pushDiffMaps,
+                            localParsed: tomlData,
+                            live: liveIntegration
+                                ? {
+                                    record: liveIntegration,
+                                    modifiedAt: liveIntegration.modifiedAt,
+                                }
+                                : null,
+                            entry: existingEntry,
+                            localFileHash: computeFileHash(filePath),
+                            force: options.force,
+                            // #2934 — the create leg below adopts an existing integration
+                            // by `integrationKey` on the server's conflict (#1006), so an
+                            // integration the manifest has never recorded is that same
+                            // adopt, reached one step earlier because the reconcile above
+                            // already read the server.
+                            adoptsUntrackedByKey: true,
+                        });
+                        if (gate.action === "skip") {
+                            skippedCount++;
+                            if (syncState && liveIntegration?.integrationId) {
+                                if (!syncState.entities.integrations) {
+                                    syncState.entities.integrations = {};
+                                }
+                                syncState.entities.integrations[key] = {
+                                    id: liveIntegration.integrationId,
+                                    modifiedAt: liveIntegration.modifiedAt ||
+                                        existingEntry?.modifiedAt ||
+                                        new Date().toISOString(),
+                                    contentHash: computeFileHash(filePath),
+                                    semanticHash: gate.remoteHash,
+                                };
+                            }
+                            continue;
+                        }
+                        if (gate.action === "drift" ||
+                            gate.action === "conflict" ||
+                            gate.action === "immutable") {
+                            recordDeclined("integration", key, gate, existingEntry?.modifiedAt);
+                            continue;
+                        }
+                    }
+                    else {
+                        const degraded = decideDegradedPush({
+                            force: options.force,
+                            storedContentHash: existingEntry?.contentHash,
+                            currentFileHash: computeFileHash(filePath),
+                        });
+                        if (degraded.action === "skip") {
+                            skippedCount++;
+                            continue;
+                        }
+                        if (degraded.action === "decline") {
+                            recordDeclined("integration", key, { action: "live-unavailable" }, existingEntry?.modifiedAt);
+                            continue;
+                        }
+                    }
+                    const existingId = resolveExistingId({
+                        liveOk: integrationLiveOk,
+                        liveId: liveListed?.integrationId,
+                        manifestId: existingEntry?.id,
+                    });
                     // Same body on the create, update, and adopt-then-update paths.
                     const payload = buildIntegrationPushPayload(key, tomlData);
                     // #2631 — `accessRule` is TOML-owned, so a file with no rule pushes
@@ -7361,26 +8919,41 @@ export function registerConfigSyncCommands(sync) {
                     if (existingId) {
                         changes.push({ type: "integration", action: "update", key });
                         if (!options.dryRun) {
+                            // #2731 B4 — the guard is the LIVE timestamp the reconcile just
+                            // read (the gate carries it), not the manifest's.
                             const expectedModifiedAt = options.force
                                 ? undefined
-                                : syncState?.entities?.integrations?.[key]?.modifiedAt;
+                                : gate?.action === "update"
+                                    ? gate.expectedModifiedAt
+                                    : existingEntry?.modifiedAt;
                             try {
+                                // Named as the ADOPT it is (#2934) — see the cron-trigger
+                                // leg.
+                                if (gate?.action === "update" && gate.direction === "adopt-untracked") {
+                                    info(`  Integration already exists on server, adopting by key: ${key}`);
+                                }
                                 const updated = await client.updateIntegration(resolvedAppId, existingId, payload, expectedModifiedAt);
                                 info(`  Updated integration: ${key}`);
-                                // Update sync state with new modifiedAt
-                                if (syncState?.entities?.integrations?.[key] && updated?.modifiedAt) {
-                                    syncState.entities.integrations[key].modifiedAt = updated.modifiedAt;
-                                    syncState.entities.integrations[key].contentHash = computeFileHash(filePath);
+                                if (syncState) {
+                                    if (!syncState.entities.integrations) {
+                                        syncState.entities.integrations = {};
+                                    }
+                                    syncState.entities.integrations[key] = {
+                                        id: existingId,
+                                        modifiedAt: updated?.modifiedAt ||
+                                            existingEntry?.modifiedAt ||
+                                            new Date().toISOString(),
+                                        contentHash: computeFileHash(filePath),
+                                        // From the entity the SERVER returned: the handler
+                                        // canonicalizes `requestConfig`, so the payload sent is
+                                        // not what the next comparison will see.
+                                        semanticHash: await stampRemoteSemanticHash(integrationSpec, updated, () => refetchLiveIntegration(existingId)),
+                                    };
                                 }
                             }
                             catch (err) {
                                 if (err instanceof ConflictError) {
-                                    conflicts.push({
-                                        type: "integration",
-                                        key,
-                                        serverModifiedAt: err.serverModifiedAt,
-                                        localModifiedAt: expectedModifiedAt || "unknown",
-                                    });
+                                    conflicts.push(await lateConflict("integration", key, err, expectedModifiedAt, () => refetchLiveIntegration(existingId), integrationSpec, tomlData));
                                 }
                                 else {
                                     throw wrapEntityError(err, "update", "integration", key);
@@ -7403,6 +8976,12 @@ export function registerConfigSyncCommands(sync) {
                                         id: created.integrationId,
                                         modifiedAt: created.modifiedAt,
                                         contentHash: computeFileHash(filePath),
+                                        // #2880 — a create records its baseline too, read from
+                                        // the stored entity: the handler materializes the
+                                        // defaults and canonicalizes `requestConfig`, so a
+                                        // baseline taken from the file would read those as a
+                                        // difference on the very next run.
+                                        semanticHash: await stampRemoteSemanticHash(integrationSpec, created, () => refetchLiveIntegration(created.integrationId)),
                                     };
                                 }
                             }
@@ -7434,6 +9013,9 @@ export function registerConfigSyncCommands(sync) {
                                             existing.modifiedAt ||
                                             new Date().toISOString(),
                                         contentHash: computeFileHash(filePath),
+                                        // #2880 — an adoption converges here, so it stamps the
+                                        // baseline the next run classifies against.
+                                        semanticHash: await stampRemoteSemanticHash(integrationSpec, updated, () => refetchLiveIntegration(existing.integrationId)),
                                     };
                                 }
                             }
@@ -7445,42 +9027,187 @@ export function registerConfigSyncCommands(sync) {
             const webhooksDir = join(configDir, "webhooks");
             if (existsSync(webhooksDir)) {
                 const files = selectFiles("webhook", webhooksDir, readdirSync(webhooksDir).filter((f) => f.endsWith(".toml")));
+                // #2880 — webhooks join the live-state reconcile (#2731 B3). #2757
+                // gave the type diff's comparator and left push on the manifest byte
+                // hash, so the two commands answered "changed?" from different
+                // sources and disagreed in both directions: a comment moved the bytes
+                // and push planned an update diff read as Synced, and a file whose
+                // bytes had not moved was skipped however far its CONTENT had drifted
+                // from the server, so a reported `Modified` could never be pushed
+                // away. Both are the same fix — push decides from the projection diff
+                // compares, against the entity diff compares it to.
+                //
+                // It also retires `modifiedAt` as a CONTENT signal wherever a
+                // baseline exists, which is what stops a delivery (whose
+                // `lastTriggeredAt` bumps `modifiedAt`) from reading as a permanent
+                // conflict on an unedited file (#2894).
+                const webhookSpec = configDiffSpec("webhook");
+                // The list says WHICH webhooks the server has and under which id; the
+                // detail is what `config pull` serializes from, so the comparison
+                // fetches it per selected file. A failed list is NOT an empty list —
+                // treating it as one would send every webhook down the create path —
+                // so it degrades the section to the byte-hash gate, type named.
+                const liveWebhooks = new Map();
+                let webhooksLiveOk = true;
+                if (files.length > 0) {
+                    try {
+                        const listed = await fetchAll((p) => client.listWebhooks(resolvedAppId, p));
+                        for (const w of listed) {
+                            if (w?.webhookKey)
+                                liveWebhooks.set(w.webhookKey, w);
+                        }
+                    }
+                    catch (err) {
+                        webhooksLiveOk = false;
+                        warnLiveUnavailable("webhooks", err);
+                    }
+                }
+                /** One webhook as the server holds it NOW — the post-apply baseline. */
+                const refetchLiveWebhook = async (webhookId) => {
+                    const full = await client.getWebhook(resolvedAppId, webhookId);
+                    return full ? { record: full } : null;
+                };
                 for (const file of files) {
                     const filePath = join(webhooksDir, file);
                     const tomlData = parseTomlFile(filePath);
-                    const webhook = tomlData.webhook || {};
-                    const key = webhook.key || basename(file, ".toml");
-                    const existingId = syncState?.entities?.webhooks?.[key]?.id;
-                    if (!options.force && existingId &&
-                        !shouldPushFile(filePath, syncState?.entities?.webhooks?.[key]?.contentHash)) {
-                        skippedCount++;
-                        continue;
+                    const key = tomlData.webhook?.key || basename(file, ".toml");
+                    // The gate re-parses the DOCUMENT, so the key the file left to its
+                    // name has to be in it (see `withDerivedIdentity`): `displayName`
+                    // falls back to the key, so a file stating neither would otherwise
+                    // project an empty name against the derived one the server holds.
+                    withDerivedIdentity(tomlData, "webhook", { key });
+                    const existingEntry = syncState?.entities?.webhooks?.[key];
+                    const liveListed = liveWebhooks.get(key);
+                    // A detail read that fails degrades THIS webhook to the byte-hash
+                    // gate, never the section — its neighbours still reconcile.
+                    let webhookLiveOk = webhooksLiveOk;
+                    let liveWebhook = undefined;
+                    if (webhookLiveOk && liveListed?.webhookId) {
+                        try {
+                            liveWebhook = await client.getWebhook(resolvedAppId, liveListed.webhookId);
+                        }
+                        catch (err) {
+                            webhookLiveOk = false;
+                            warnLiveUnavailable(`webhook ${key}`, err);
+                        }
                     }
+                    let gate;
+                    if (webhookLiveOk) {
+                        gate = decidePushForConfig({
+                            spec: webhookSpec,
+                            // Webhooks carry no rule-set reference, so these maps are inert
+                            // for this type — shared with `stampRemoteSemanticHash` so the
+                            // gate and the baseline it compares against cannot diverge.
+                            maps: pushDiffMaps,
+                            localParsed: tomlData,
+                            live: liveWebhook
+                                ? { record: liveWebhook, modifiedAt: liveWebhook.modifiedAt }
+                                : null,
+                            entry: existingEntry,
+                            localFileHash: computeFileHash(filePath),
+                            force: options.force,
+                            // #2934 — the create leg below adopts an existing webhook by
+                            // `webhookKey` on the server's conflict (#1006), so a webhook
+                            // the manifest has never recorded is that same adopt, reached
+                            // one step earlier because the reconcile above already read the
+                            // server.
+                            adoptsUntrackedByKey: true,
+                        });
+                        if (gate.action === "skip") {
+                            skippedCount++;
+                            if (syncState && liveWebhook?.webhookId) {
+                                if (!syncState.entities.webhooks)
+                                    syncState.entities.webhooks = {};
+                                syncState.entities.webhooks[key] = {
+                                    id: liveWebhook.webhookId,
+                                    modifiedAt: liveWebhook.modifiedAt ||
+                                        existingEntry?.modifiedAt ||
+                                        new Date().toISOString(),
+                                    contentHash: computeFileHash(filePath),
+                                    // The two sides agree HERE, so this is the baseline the
+                                    // next run classifies against — which is what stops a
+                                    // comment-only edit from re-reporting forever.
+                                    semanticHash: gate.remoteHash,
+                                };
+                            }
+                            continue;
+                        }
+                        if (gate.action === "drift" ||
+                            gate.action === "conflict" ||
+                            gate.action === "immutable") {
+                            recordDeclined("webhook", key, gate, existingEntry?.modifiedAt);
+                            continue;
+                        }
+                    }
+                    else {
+                        const degraded = decideDegradedPush({
+                            force: options.force,
+                            storedContentHash: existingEntry?.contentHash,
+                            currentFileHash: computeFileHash(filePath),
+                        });
+                        if (degraded.action === "skip") {
+                            skippedCount++;
+                            continue;
+                        }
+                        if (degraded.action === "decline") {
+                            recordDeclined("webhook", key, { action: "live-unavailable" }, existingEntry?.modifiedAt);
+                            continue;
+                        }
+                    }
+                    // Live state decides create-vs-update: a webhook the manifest never
+                    // recorded is adopted, and one the manifest still names but the
+                    // server no longer has goes to the create path (#1659).
+                    const existingId = resolveExistingId({
+                        liveOk: webhookLiveOk,
+                        liveId: liveListed?.webhookId,
+                        manifestId: existingEntry?.id,
+                    });
                     // Same body on the create, update, and adopt-then-update paths,
                     // built from the vendored definition (#2644).
                     const payload = buildWebhookPushPayload(key, tomlData);
                     if (existingId) {
                         changes.push({ type: "webhook", action: "update", key });
                         if (!options.dryRun) {
+                            // #2731 B4 — the guard is the LIVE timestamp the reconcile
+                            // fetch just read (the gate carries it), not the manifest's:
+                            // that closes the window between the read and this write
+                            // rather than re-reporting a difference we just looked at.
                             const expectedModifiedAt = options.force
                                 ? undefined
-                                : syncState?.entities?.webhooks?.[key]?.modifiedAt;
+                                : gate?.action === "update"
+                                    ? gate.expectedModifiedAt
+                                    : existingEntry?.modifiedAt;
                             try {
+                                // Named as the ADOPT it is (#2934) — see the cron-trigger
+                                // leg: a bare "Updated webhook" would not say the push took
+                                // over an object the operator never recorded.
+                                if (gate?.action === "update" && gate.direction === "adopt-untracked") {
+                                    info(`  Webhook already exists on server, adopting by key: ${key}`);
+                                }
                                 const updated = await client.updateWebhook(resolvedAppId, existingId, payload, expectedModifiedAt);
                                 info(`  Updated webhook: ${key}`);
-                                if (syncState?.entities?.webhooks?.[key] && updated?.modifiedAt) {
-                                    syncState.entities.webhooks[key].modifiedAt = updated.modifiedAt;
-                                    syncState.entities.webhooks[key].contentHash = computeFileHash(filePath);
+                                if (syncState) {
+                                    if (!syncState.entities.webhooks)
+                                        syncState.entities.webhooks = {};
+                                    syncState.entities.webhooks[key] = {
+                                        id: existingId,
+                                        modifiedAt: updated?.modifiedAt ||
+                                            existingEntry?.modifiedAt ||
+                                            new Date().toISOString(),
+                                        contentHash: computeFileHash(filePath),
+                                        // Stamped from the RETURNED entity, not the payload sent:
+                                        // the handler normalizes, so the payload is not what the
+                                        // next comparison will see.
+                                        semanticHash: await stampRemoteSemanticHash(webhookSpec, updated, () => refetchLiveWebhook(existingId)),
+                                    };
                                 }
                             }
                             catch (err) {
                                 if (err instanceof ConflictError) {
-                                    conflicts.push({
-                                        type: "webhook",
-                                        key,
-                                        serverModifiedAt: err.serverModifiedAt,
-                                        localModifiedAt: expectedModifiedAt || "unknown",
-                                    });
+                                    // A late 409: the server moved between the reconcile fetch
+                                    // and this write, so the gate's field diff describes a state
+                                    // that is gone. Recompute against the current record.
+                                    conflicts.push(await lateConflict("webhook", key, err, expectedModifiedAt, () => refetchLiveWebhook(existingId), webhookSpec, tomlData));
                                 }
                                 else {
                                     throw wrapEntityError(err, "update", "webhook", key);
@@ -7502,6 +9229,10 @@ export function registerConfigSyncCommands(sync) {
                                         id: created.webhookId,
                                         modifiedAt: created.modifiedAt,
                                         contentHash: computeFileHash(filePath),
+                                        // #2880 — the baseline the next run classifies against,
+                                        // read from what the server stored rather than what was
+                                        // sent (the handler normalizes).
+                                        semanticHash: await stampRemoteSemanticHash(webhookSpec, created, () => refetchLiveWebhook(created.webhookId)),
                                     };
                                 }
                             }
@@ -7533,28 +9264,119 @@ export function registerConfigSyncCommands(sync) {
                                             existing.modifiedAt ||
                                             new Date().toISOString(),
                                         contentHash: computeFileHash(filePath),
+                                        // #2880 — an adoption converges here, so it stamps the
+                                        // baseline too; without it the next run has no direction
+                                        // signal for a row this one just reconciled.
+                                        semanticHash: await stampRemoteSemanticHash(webhookSpec, updated, () => refetchLiveWebhook(existing.webhookId)),
                                     };
                                 }
                             }
                         }
                     }
-                }
-            }
-            // Process cron triggers
-            const cronTriggersDir = join(configDir, "cron-triggers");
-            if (existsSync(cronTriggersDir)) {
-                const files = selectFiles("cron-trigger", cronTriggersDir, readdirSync(cronTriggersDir).filter((f) => f.endsWith(".toml")));
-                for (const file of files) {
-                    const filePath = join(cronTriggersDir, file);
-                    const tomlData = parseTomlFile(filePath);
-                    const cronTrigger = tomlData.cronTrigger || {};
-                    const key = cronTrigger.key || basename(file, ".toml");
-                    const existingId = syncState?.entities?.cronTriggers?.[key]?.id;
-                    if (!options.force && existingId &&
-                        !shouldPushFile(filePath, syncState?.entities?.cronTriggers?.[key]?.contentHash)) {
-                        skippedCount++;
-                        continue;
-                    }
+                }
+            }
+            // Process cron triggers
+            const cronTriggersDir = join(configDir, "cron-triggers");
+            if (existsSync(cronTriggersDir)) {
+                const files = selectFiles("cron-trigger", cronTriggersDir, readdirSync(cronTriggersDir).filter((f) => f.endsWith(".toml")));
+                // #2880 — cron triggers join the live-state reconcile. The LIST row is
+                // the whole record for this type (it is what `config pull`
+                // serializes from), so the section needs no per-entity detail read.
+                // The update endpoint takes no `expectedModifiedAt`, which is exactly
+                // why the read-time direction classification matters here: it is the
+                // only protection this type has ever had, and it was comparing bytes.
+                const cronSpec = configDiffSpec("cron-trigger");
+                const liveCronTriggers = new Map();
+                let cronLiveOk = true;
+                if (files.length > 0) {
+                    try {
+                        const listed = await client.listCronTriggers(resolvedAppId);
+                        for (const t of (listed?.items ?? [])) {
+                            if (t?.triggerKey)
+                                liveCronTriggers.set(t.triggerKey, t);
+                        }
+                    }
+                    catch (err) {
+                        cronLiveOk = false;
+                        warnLiveUnavailable("cron-triggers", err);
+                    }
+                }
+                const refetchLiveCronTrigger = async (triggerId) => {
+                    const full = await client.getCronTrigger(resolvedAppId, triggerId);
+                    return full ? { record: full } : null;
+                };
+                for (const file of files) {
+                    const filePath = join(cronTriggersDir, file);
+                    const tomlData = parseTomlFile(filePath);
+                    const key = tomlData.cronTrigger?.key || basename(file, ".toml");
+                    withDerivedIdentity(tomlData, "cronTrigger", { key });
+                    const existingEntry = syncState?.entities?.cronTriggers?.[key];
+                    const liveCron = liveCronTriggers.get(key);
+                    let gate;
+                    if (cronLiveOk) {
+                        gate = decidePushForConfig({
+                            spec: cronSpec,
+                            maps: pushDiffMaps,
+                            localParsed: tomlData,
+                            live: liveCron
+                                ? { record: liveCron, modifiedAt: liveCron.modifiedAt }
+                                : null,
+                            entry: existingEntry,
+                            localFileHash: computeFileHash(filePath),
+                            force: options.force,
+                            // #2934 — the create path below adopts an existing trigger by
+                            // `triggerKey` on the server's 409 (#976), so a trigger the
+                            // manifest has never recorded is that same adopt, reached one
+                            // step earlier because the reconcile above already read the
+                            // server. Without this the gate refuses it as a difference it
+                            // cannot attribute and the create the guard recovers from is
+                            // never sent — a conflict no `config push` can clear.
+                            adoptsUntrackedByKey: true,
+                        });
+                        if (gate.action === "skip") {
+                            skippedCount++;
+                            if (syncState && liveCron?.triggerId) {
+                                if (!syncState.entities.cronTriggers) {
+                                    syncState.entities.cronTriggers = {};
+                                }
+                                syncState.entities.cronTriggers[key] = {
+                                    id: liveCron.triggerId,
+                                    modifiedAt: liveCron.modifiedAt ||
+                                        existingEntry?.modifiedAt ||
+                                        new Date().toISOString(),
+                                    contentHash: computeFileHash(filePath),
+                                    semanticHash: gate.remoteHash,
+                                };
+                            }
+                            continue;
+                        }
+                        if (gate.action === "drift" ||
+                            gate.action === "conflict" ||
+                            gate.action === "immutable") {
+                            recordDeclined("cron-trigger", key, gate, existingEntry?.modifiedAt);
+                            continue;
+                        }
+                    }
+                    else {
+                        const degraded = decideDegradedPush({
+                            force: options.force,
+                            storedContentHash: existingEntry?.contentHash,
+                            currentFileHash: computeFileHash(filePath),
+                        });
+                        if (degraded.action === "skip") {
+                            skippedCount++;
+                            continue;
+                        }
+                        if (degraded.action === "decline") {
+                            recordDeclined("cron-trigger", key, { action: "live-unavailable" }, existingEntry?.modifiedAt);
+                            continue;
+                        }
+                    }
+                    const existingId = resolveExistingId({
+                        liveOk: cronLiveOk,
+                        liveId: liveCron?.triggerId,
+                        manifestId: existingEntry?.id,
+                    });
                     // Built from the vendored definition (#2644). The create body
                     // omits `state` — the handler assigns it — which is what the
                     // definition's `writableOn` records.
@@ -7568,11 +9390,30 @@ export function registerConfigSyncCommands(sync) {
                         changes.push({ type: "cron-trigger", action: "update", key });
                         if (!options.dryRun) {
                             try {
+                                // Say so when this update is an ADOPT (#2934): the operator
+                                // never recorded this trigger, so a bare "Updated cron
+                                // trigger" would not tell them the push took over an object
+                                // it found on the server. Same sentence the 409 recovery
+                                // below prints.
+                                if (gate?.action === "update" && gate.direction === "adopt-untracked") {
+                                    info(`  Cron trigger already exists on server, adopting by key: ${key}`);
+                                }
                                 const updated = await client.updateCronTrigger(resolvedAppId, existingId, updatePayload);
                                 info(`  Updated cron trigger: ${key}`);
-                                if (syncState?.entities?.cronTriggers?.[key] && updated?.modifiedAt) {
-                                    syncState.entities.cronTriggers[key].modifiedAt = updated.modifiedAt;
-                                    syncState.entities.cronTriggers[key].contentHash = computeFileHash(filePath);
+                                if (syncState) {
+                                    if (!syncState.entities.cronTriggers) {
+                                        syncState.entities.cronTriggers = {};
+                                    }
+                                    syncState.entities.cronTriggers[key] = {
+                                        id: existingId,
+                                        modifiedAt: updated?.modifiedAt ||
+                                            existingEntry?.modifiedAt ||
+                                            new Date().toISOString(),
+                                        contentHash: computeFileHash(filePath),
+                                        // #2880 — from the entity the server returned: the
+                                        // handler materializes `timezone`/`overlapPolicy`.
+                                        semanticHash: await stampRemoteSemanticHash(cronSpec, updated, () => refetchLiveCronTrigger(existingId)),
+                                    };
                                 }
                             }
                             catch (err) {
@@ -7594,6 +9435,7 @@ export function registerConfigSyncCommands(sync) {
                                         id: created.triggerId,
                                         modifiedAt: created.modifiedAt,
                                         contentHash: computeFileHash(filePath),
+                                        semanticHash: await stampRemoteSemanticHash(cronSpec, created, () => refetchLiveCronTrigger(created.triggerId)),
                                     };
                                 }
                             }
@@ -7629,6 +9471,7 @@ export function registerConfigSyncCommands(sync) {
                                         id: adoptedId,
                                         modifiedAt: updated?.modifiedAt || new Date().toISOString(),
                                         contentHash: computeFileHash(filePath),
+                                        semanticHash: await stampRemoteSemanticHash(cronSpec, updated, () => refetchLiveCronTrigger(adoptedId)),
                                     };
                                 }
                             }
@@ -7640,17 +9483,106 @@ export function registerConfigSyncCommands(sync) {
             const blobBucketsPushDir = join(configDir, "blob-buckets");
             if (existsSync(blobBucketsPushDir)) {
                 const files = selectFiles("blob-bucket", blobBucketsPushDir, readdirSync(blobBucketsPushDir).filter((f) => f.endsWith(".toml")));
+                // #2880 — blob buckets join the live-state reconcile. As for cron
+                // triggers the list row IS the record, and the update takes no
+                // concurrency token, so read-time classification is the protection.
+                // `ttlTier` is create-only, so a local change to it surfaces as the
+                // `immutable` outcome — named with its remedy instead of PATCHed into
+                // a success that changes nothing — including under `--force`.
+                const bucketSpec = configDiffSpec("blob-bucket");
+                const liveBuckets = new Map();
+                let bucketsLiveOk = true;
+                if (files.length > 0) {
+                    try {
+                        const listed = await client.listBlobBuckets(resolvedAppId);
+                        for (const b of (listed?.items ?? [])) {
+                            if (b?.bucketKey)
+                                liveBuckets.set(b.bucketKey, b);
+                        }
+                    }
+                    catch (err) {
+                        bucketsLiveOk = false;
+                        warnLiveUnavailable("blob-buckets", err);
+                    }
+                }
+                const refetchLiveBucket = async (bucketId) => {
+                    const full = await client.getBlobBucket(resolvedAppId, bucketId);
+                    return full ? { record: full } : null;
+                };
                 for (const file of files) {
                     const filePath = join(blobBucketsPushDir, file);
                     const tomlData = parseTomlFile(filePath);
+                    const key = tomlData.bucket?.key || basename(file, ".toml");
+                    withDerivedIdentity(tomlData, "bucket", { key });
                     const bucket = tomlData.bucket || {};
-                    const key = bucket.key || basename(file, ".toml");
-                    const existingId = syncState?.entities?.blobBuckets?.[key]?.id;
-                    if (!options.force && existingId &&
-                        !shouldPushFile(filePath, syncState?.entities?.blobBuckets?.[key]?.contentHash)) {
-                        skippedCount++;
-                        continue;
+                    const existingEntry = syncState?.entities?.blobBuckets?.[key];
+                    const liveBucket = liveBuckets.get(key);
+                    let gate;
+                    if (bucketsLiveOk) {
+                        gate = decidePushForConfig({
+                            spec: bucketSpec,
+                            maps: pushDiffMaps,
+                            localParsed: tomlData,
+                            live: liveBucket
+                                ? { record: liveBucket, modifiedAt: liveBucket.modifiedAt }
+                                : null,
+                            entry: existingEntry,
+                            localFileHash: computeFileHash(filePath),
+                            force: options.force,
+                            // #2934 — the create leg below adopts an existing bucket by
+                            // `bucketKey` on the server's 409 (#1006/#1459), so a bucket
+                            // the manifest has never recorded is that same adopt, reached
+                            // one step earlier because the reconcile above already read the
+                            // server. `ttlTier` is fixed at creation, so a divergent tier
+                            // still declines as `immutable` — the gate checks that before
+                            // the adopt, exactly as the 409 recovery checks it before the
+                            // update it re-issues.
+                            adoptsUntrackedByKey: true,
+                        });
+                        if (gate.action === "skip") {
+                            skippedCount++;
+                            if (syncState && liveBucket?.bucketId) {
+                                if (!syncState.entities.blobBuckets) {
+                                    syncState.entities.blobBuckets = {};
+                                }
+                                syncState.entities.blobBuckets[key] = {
+                                    id: liveBucket.bucketId,
+                                    modifiedAt: liveBucket.modifiedAt ||
+                                        existingEntry?.modifiedAt ||
+                                        new Date().toISOString(),
+                                    contentHash: computeFileHash(filePath),
+                                    semanticHash: gate.remoteHash,
+                                };
+                            }
+                            continue;
+                        }
+                        if (gate.action === "drift" ||
+                            gate.action === "conflict" ||
+                            gate.action === "immutable") {
+                            recordDeclined("blob-bucket", key, gate, existingEntry?.modifiedAt);
+                            continue;
+                        }
+                    }
+                    else {
+                        const degraded = decideDegradedPush({
+                            force: options.force,
+                            storedContentHash: existingEntry?.contentHash,
+                            currentFileHash: computeFileHash(filePath),
+                        });
+                        if (degraded.action === "skip") {
+                            skippedCount++;
+                            continue;
+                        }
+                        if (degraded.action === "decline") {
+                            recordDeclined("blob-bucket", key, { action: "live-unavailable" }, existingEntry?.modifiedAt);
+                            continue;
+                        }
                     }
+                    const existingId = resolveExistingId({
+                        liveOk: bucketsLiveOk,
+                        liveId: liveBucket?.bucketId,
+                        manifestId: existingEntry?.id,
+                    });
                     if (existingId) {
                         // #1020 (D8): idempotently apply preset/ruleSet/name/description
                         // changes via PATCH. bucketKey/ttlTier are immutable and not sent.
@@ -7658,15 +9590,29 @@ export function registerConfigSyncCommands(sync) {
                         changes.push({ type: "blob-bucket", action: "update", key });
                         if (!options.dryRun) {
                             try {
+                                // Named as the ADOPT it is (#2934) — see the cron-trigger
+                                // leg.
+                                if (gate?.action === "update" && gate.direction === "adopt-untracked") {
+                                    info(`  Blob bucket already exists on server, adopting by key: ${key}`);
+                                }
                                 await client.updateBlobBucket(resolvedAppId, existingId, updatePayload);
                                 info(`  Updated blob bucket: ${key}`);
                                 // #1459: stamp the content hash ONLY after a successful
                                 // update, and only when this is not a dry run. A failed
                                 // update (or a dry run) must leave the file pending rather
                                 // than mark it in-sync and suppress it on the next push.
-                                if (syncState?.entities?.blobBuckets?.[key]) {
-                                    syncState.entities.blobBuckets[key].contentHash =
-                                        computeFileHash(filePath);
+                                if (syncState) {
+                                    if (!syncState.entities.blobBuckets) {
+                                        syncState.entities.blobBuckets = {};
+                                    }
+                                    syncState.entities.blobBuckets[key] = {
+                                        id: existingId,
+                                        modifiedAt: existingEntry?.modifiedAt || new Date().toISOString(),
+                                        contentHash: computeFileHash(filePath),
+                                        // #2880 — the baseline, refetched because the PATCH
+                                        // response is not the stored record for this type.
+                                        semanticHash: await stampRemoteSemanticHash(bucketSpec, undefined, () => refetchLiveBucket(existingId)),
+                                    };
                                 }
                             }
                             catch (err) {
@@ -7694,6 +9640,7 @@ export function registerConfigSyncCommands(sync) {
                                         id: created.bucketId,
                                         modifiedAt: created.modifiedAt || new Date().toISOString(),
                                         contentHash: computeFileHash(filePath),
+                                        semanticHash: await stampRemoteSemanticHash(bucketSpec, created, () => refetchLiveBucket(created.bucketId)),
                                     };
                                 }
                             }
@@ -7764,6 +9711,9 @@ export function registerConfigSyncCommands(sync) {
                                             existing.modifiedAt ||
                                             new Date().toISOString(),
                                         contentHash: computeFileHash(filePath),
+                                        // #2880 — an adoption converges, so it stamps the
+                                        // baseline the next run classifies against.
+                                        semanticHash: await stampRemoteSemanticHash(bucketSpec, updated, () => refetchLiveBucket(existing.bucketId)),
                                     };
                                 }
                             }
@@ -7881,6 +9831,15 @@ export function registerConfigSyncCommands(sync) {
                             entry: existingEntry,
                             localFileHash: computeFileHash(filePath),
                             force: options.force,
+                            // #2909 — the prompt create path adopts an existing prompt by
+                            // `promptKey` on a 409 (#1006), so a prompt the manifest has
+                            // never recorded is that same adopt, reached one step earlier
+                            // because the reconcile above already read the server. Refusing
+                            // it here made the documented adopt unreachable: the CREATE the
+                            // guard recovers from is never sent when live state names the
+                            // prompt, so the push reported a conflict no `config push`
+                            // could clear.
+                            adoptsUntrackedByKey: true,
                         });
                         if (gate.action === "skip") {
                             skippedCount++;
@@ -7917,14 +9876,26 @@ export function registerConfigSyncCommands(sync) {
                             continue;
                         }
                     }
-                    else if (!options.force &&
-                        existingEntry?.id &&
-                        !shouldPushFile(filePath, existingEntry.contentHash)) {
+                    else {
                         // Degraded: the manifest byte-hash gate this section has always
-                        // fallen back to when the server cannot be read.
-                        skippedCount++;
-                        promptKeyToId.set(key, existingEntry.id);
-                        continue;
+                        // fallen back to when the server cannot be read — and, since
+                        // #2880, a decline when there is no baseline to gate on rather
+                        // than an unconditional write over unread server state.
+                        const degraded = decideDegradedPush({
+                            force: options.force,
+                            storedContentHash: existingEntry?.contentHash,
+                            currentFileHash: computeFileHash(filePath),
+                        });
+                        if (degraded.action === "skip") {
+                            skippedCount++;
+                            if (existingEntry?.id)
+                                promptKeyToId.set(key, existingEntry.id);
+                            continue;
+                        }
+                        if (degraded.action === "decline") {
+                            recordDeclined("prompt", key, { action: "live-unavailable" }, existingEntry?.modifiedAt);
+                            continue;
+                        }
                     }
                     // Live state decides create-vs-update: a prompt the manifest never
                     // recorded is adopted, and one the manifest still names but the
@@ -8074,6 +10045,13 @@ export function registerConfigSyncCommands(sync) {
                         changes.push({ type: "prompt", action: "update", key });
                         promptKeyToId.set(key, existingId);
                         if (!options.dryRun) {
+                            // Say so when this update is an ADOPT (#2909): the operator
+                            // never recorded this prompt, so a bare "Updated prompt" would
+                            // not tell them the push took over an object it found on the
+                            // server. Same sentence the 409 recovery prints.
+                            if (gate?.action === "update" && gate.direction === "adopt-untracked") {
+                                info(`  Prompt already exists on server, adopting by key: ${key}`);
+                            }
                             // A prompt adopted from live state has no manifest row yet, and
                             // `applyPromptUpdate` stamps INTO that row — without it the
                             // push would apply and record nothing, and the next run would
@@ -8466,16 +10444,25 @@ export function registerConfigSyncCommands(sync) {
                                 }
                                 : undefined;
                         }
-                        else if (!options.force) {
+                        else {
                             // Fallback gate: the manifest byte hash. A script with no
                             // recorded hash has no baseline at all and its apply is a blind
                             // overwrite, so it FAILS CLOSED rather than pushing on a guess.
-                            if (scriptEntry?.contentHash === undefined) {
-                                warn(`  transform ${name}: no last-sync content hash — skipped (run \`config pull\` to establish one, or --force to push anyway)`);
+                            // #2880 — through the shared decision, so every type declines
+                            // for the same reason in the same words.
+                            const degraded = decideDegradedPush({
+                                force: options.force,
+                                storedContentHash: scriptEntry?.contentHash,
+                                currentFileHash: computeFileHash(filePath),
+                            });
+                            if (degraded.action === "skip") {
+                                skippedCount++;
                                 continue;
                             }
-                            if (!shouldPushFile(filePath, scriptEntry.contentHash)) {
-                                skippedCount++;
+                            if (degraded.action === "decline") {
+                                recordDeclined("transform", name, {
+                                    action: "live-unavailable",
+                                });
                                 continue;
                             }
                         }
@@ -8558,6 +10545,37 @@ export function registerConfigSyncCommands(sync) {
             const workflowsDir = join(configDir, "workflows");
             if (existsSync(workflowsDir)) {
                 const files = selectFiles("workflow", workflowsDir, readdirSync(workflowsDir).filter((f) => f.endsWith(".toml")));
+                // #2896 — pairing for a clone with no sync state. A workflow the
+                // manifest has no row for is not thereby a create: the create path
+                // below already adopts an existing workflow by key on the server's
+                // 409 (#1006/#1174), so letting live state answer the same question
+                // one step earlier is that same adopt — reached before a doomed
+                // create is sent, which is what the prompt reconcile does (#2909).
+                // Without it a stateless clone plans "create workflow" for every
+                // workflow the server already holds, and its `.tests/` sidecars —
+                // addressed through the sync-state id the plan never records —
+                // cascade into duplicate test-case creates. Fetched once, and only
+                // when a file is actually untracked; a failed listing degrades to
+                // the create-then-409 path, which still converges.
+                let liveWorkflowIdsByKey;
+                const lookupLiveWorkflowId = async (workflowKey) => {
+                    if (liveWorkflowIdsByKey === undefined) {
+                        try {
+                            const live = await fetchAll((p) => client.listWorkflows(resolvedAppId, p));
+                            liveWorkflowIdsByKey = new Map(live
+                                .filter((w) => w?.workflowKey && w?.workflowId)
+                                .map((w) => [
+                                w.workflowKey,
+                                w.workflowId,
+                            ]));
+                        }
+                        catch (err) {
+                            liveWorkflowIdsByKey = null;
+                            warn(`  workflows: live state unavailable (${err instanceof Error ? err.message : String(err)}) — an untracked workflow plans a create and adopts on the server's conflict`);
+                        }
+                    }
+                    return liveWorkflowIdsByKey?.get(workflowKey);
+                };
                 for (const file of files) {
                     const filePath = join(workflowsDir, file);
                     const tomlData = parseTomlFile(filePath);
@@ -8638,7 +10656,32 @@ export function registerConfigSyncCommands(sync) {
                         throw new Error(`${filePath}: workflow expressions are invalid:\n  - ${exprErrors.join("\n  - ")}`);
                     }
                     workflow.expressions = workflowExpressions;
-                    const existingId = syncState?.entities?.workflows?.[key]?.id;
+                    let existingId = syncState?.entities?.workflows?.[key]?.id;
+                    // #2896 — an untracked key is asked of live state before it is
+                    // declared a create. A match is adopted NOW: the id is seeded into
+                    // the manifest row exactly as the 409 recovery seeds it, so the
+                    // dry-run plan says the update a real push would perform, and the
+                    // test-case legs below can address this block instead of planning
+                    // its sidecars as duplicate creates.
+                    let adoptedFromLive = false;
+                    if (!existingId) {
+                        const liveId = await lookupLiveWorkflowId(key);
+                        if (liveId) {
+                            existingId = liveId;
+                            adoptedFromLive = true;
+                            if (syncState) {
+                                if (!syncState.entities.workflows) {
+                                    syncState.entities.workflows = {};
+                                }
+                                if (!syncState.entities.workflows[key]) {
+                                    syncState.entities.workflows[key] = { id: liveId };
+                                }
+                                else {
+                                    syncState.entities.workflows[key].id = liveId;
+                                }
+                            }
+                        }
+                    }
                     const existingActiveConfigId = syncState?.entities?.workflows?.[key]?.activeConfigId;
                     // Skip if file hasn't changed since last sync. Use the expanded
                     // content hash (post fragment splice) so that edits to included
@@ -8806,13 +10849,30 @@ export function registerConfigSyncCommands(sync) {
                         // Update existing workflow
                         changes.push({ type: "workflow", action: "update", key });
                         if (!options.dryRun) {
+                            // An adopted workflow has no stored modifiedAt, so the
+                            // undefined here omits the concurrency guard — the same
+                            // "first adopt forces the PATCH" the 409 branch documents.
                             const expectedModifiedAt = options.force
                                 ? undefined
                                 : syncState?.entities?.workflows?.[key]?.modifiedAt;
                             try {
+                                let activeConfigId = existingActiveConfigId;
+                                if (adoptedFromLive && activeConfigId === undefined) {
+                                    // Seed the real activeConfigId from the server, as the
+                                    // 409-adopt branch does: sync state has none for an
+                                    // adopted workflow, and without it the shared update body
+                                    // wrongly falls back to `updateWorkflowDraft`.
+                                    const fullWorkflow = await client.getWorkflow(resolvedAppId, existingId);
+                                    activeConfigId = fullWorkflow?.workflow?.activeConfigId;
+                                    if (syncState?.entities?.workflows?.[key] &&
+                                        activeConfigId) {
+                                        syncState.entities.workflows[key].activeConfigId =
+                                            activeConfigId;
+                                    }
+                                }
                                 await applyWorkflowUpdate(existingId, {
                                     expectedModifiedAt,
-                                    activeConfigId: existingActiveConfigId,
+                                    activeConfigId,
                                 });
                             }
                             catch (err) {
@@ -9225,13 +11285,22 @@ export function registerConfigSyncCommands(sync) {
                             }
                         }
                     }
-                    // Fallback gate: the manifest byte hash, unchanged from before.
-                    if (!dbTypeGate &&
-                        !options.force &&
-                        existingEntry &&
-                        !shouldPushFile(filePath, existingEntry.contentHash)) {
-                        skippedCount++;
-                        continue;
+                    // Fallback gate: the manifest byte hash — and, since #2880, a
+                    // decline when there is no hash to gate on.
+                    if (!dbTypeGate) {
+                        const degraded = decideDegradedPush({
+                            force: options.force,
+                            storedContentHash: existingEntry?.contentHash,
+                            currentFileHash: computeFileHash(filePath),
+                        });
+                        if (degraded.action === "skip") {
+                            skippedCount++;
+                            continue;
+                        }
+                        if (degraded.action === "decline") {
+                            recordDeclined("database-type-config", dbType, { action: "live-unavailable" }, existingEntry?.modifiedAt);
+                            continue;
+                        }
                     }
                     // ── Issues #813 / #1336 / #2732: state what this push's operation
                     // set will BE, then run a validate-first pass before any mutating
@@ -10356,6 +12425,12 @@ export function registerConfigSyncCommands(sync) {
                             entry: existingEntry,
                             localFileHash: computeFileHash(filePath),
                             force: options.force,
+                            // #2934 — the create leg below adopts an existing config by
+                            // `groupType` on the server's 409 (#1851), so a config the
+                            // manifest has never recorded is that same adopt, reached one
+                            // step earlier because the reconcile above already read the
+                            // server.
+                            adoptsUntrackedByKey: true,
                         });
                         if (gate.action === "skip") {
                             skippedCount++;
@@ -10379,9 +12454,22 @@ export function registerConfigSyncCommands(sync) {
                             continue;
                         }
                     }
-                    else if (!options.force && existingEntry && !shouldPushFile(filePath, existingEntry.contentHash)) {
-                        skippedCount++;
-                        continue;
+                    else {
+                        // Fallback gate: the manifest byte hash — and, since #2880, a
+                        // decline rather than a blind write when there is no hash.
+                        const degraded = decideDegradedPush({
+                            force: options.force,
+                            storedContentHash: existingEntry?.contentHash,
+                            currentFileHash: computeFileHash(filePath),
+                        });
+                        if (degraded.action === "skip") {
+                            skippedCount++;
+                            continue;
+                        }
+                        if (degraded.action === "decline") {
+                            recordDeclined("group-type-config", groupType, { action: "live-unavailable" }, existingEntry?.modifiedAt);
+                            continue;
+                        }
                     }
                     // Live state decides create-vs-update: a config the manifest never
                     // recorded is adopted, and one the manifest still names but the
@@ -10400,6 +12488,11 @@ export function registerConfigSyncCommands(sync) {
                                     ? gate.expectedModifiedAt
                                     : existingEntry?.modifiedAt;
                             try {
+                                // Named as the ADOPT it is (#2934) — see the cron-trigger
+                                // leg.
+                                if (gate?.action === "update" && gate.direction === "adopt-untracked") {
+                                    info(`  Group type config already exists on server, adopting by key: ${groupType}`);
+                                }
                                 const updated = await client.updateGroupTypeConfig(resolvedAppId, groupType, buildGroupTypeConfigPayload(configData, "update"), expectedModifiedAt);
                                 info(`  Updated group type config: ${groupType}`);
                                 if (syncState) {
@@ -10553,6 +12646,10 @@ export function registerConfigSyncCommands(sync) {
                             entry: existingEntry,
                             localFileHash: computeFileHash(filePath),
                             force: options.force,
+                            // #2934 — as for group type configs: the create leg adopts by
+                            // `collectionType` on the server's 409 (#1851), so a config the
+                            // manifest has never recorded is that adopt.
+                            adoptsUntrackedByKey: true,
                         });
                         if (gate.action === "skip") {
                             skippedCount++;
@@ -10576,9 +12673,22 @@ export function registerConfigSyncCommands(sync) {
                             continue;
                         }
                     }
-                    else if (!options.force && existingEntry && !shouldPushFile(filePath, existingEntry.contentHash)) {
-                        skippedCount++;
-                        continue;
+                    else {
+                        // Fallback gate: the manifest byte hash — and, since #2880, a
+                        // decline rather than a blind write when there is no hash.
+                        const degraded = decideDegradedPush({
+                            force: options.force,
+                            storedContentHash: existingEntry?.contentHash,
+                            currentFileHash: computeFileHash(filePath),
+                        });
+                        if (degraded.action === "skip") {
+                            skippedCount++;
+                            continue;
+                        }
+                        if (degraded.action === "decline") {
+                            recordDeclined("collection-type-config", collectionType, { action: "live-unavailable" }, existingEntry?.modifiedAt);
+                            continue;
+                        }
                     }
                     // Live state decides create-vs-update; see the group-type section.
                     if (resolveExistingId({
@@ -10595,6 +12705,11 @@ export function registerConfigSyncCommands(sync) {
                                     ? gate.expectedModifiedAt
                                     : existingEntry?.modifiedAt;
                             try {
+                                // Named as the ADOPT it is (#2934) — see the cron-trigger
+                                // leg.
+                                if (gate?.action === "update" && gate.direction === "adopt-untracked") {
+                                    info(`  Collection type config already exists on server, adopting by key: ${collectionType}`);
+                                }
                                 const updated = await client.updateCollectionTypeConfig(resolvedAppId, collectionType, buildCollectionTypeConfigPayload(configData, "update"), expectedModifiedAt);
                                 info(`  Updated collection type config: ${collectionType}`);
                                 if (syncState) {
@@ -10763,9 +12878,22 @@ export function registerConfigSyncCommands(sync) {
                             continue;
                         }
                     }
-                    else if (!options.force && existingEntry && !shouldPushFile(filePath, existingEntry.contentHash)) {
-                        skippedCount++;
-                        continue;
+                    else {
+                        // Fallback gate: the manifest byte hash — and, since #2880, a
+                        // decline rather than a blind write when there is no hash.
+                        const degraded = decideDegradedPush({
+                            force: options.force,
+                            storedContentHash: existingEntry?.contentHash,
+                            currentFileHash: computeFileHash(filePath),
+                        });
+                        if (degraded.action === "skip") {
+                            skippedCount++;
+                            continue;
+                        }
+                        if (degraded.action === "decline") {
+                            recordDeclined("metadata-category-config", entityKey, { action: "live-unavailable" }, existingEntry?.modifiedAt);
+                            continue;
+                        }
                     }
                     const isCreate = !resolveExistingId({
                         liveOk: metadataCategoryLiveOk,
@@ -10903,17 +13031,23 @@ export function registerConfigSyncCommands(sync) {
                             continue;
                         }
                     }
-                    else if (!options.force) {
+                    else {
                         // Fallback: the byte-hash gate. A legacy entry has no
                         // `contentHash` to compare against, and this type's apply is a
                         // blind overwrite of whatever the server holds — so it FAILS
-                        // CLOSED (warned and skipped) rather than upserting on a guess.
-                        if (!existingEntry?.contentHash) {
-                            warn(`  email-template ${emailType}: no last-sync content hash — skipped (run \`config pull\` to establish one, or --force to push anyway)`);
+                        // CLOSED rather than upserting on a guess (#2880: through the
+                        // shared decision, in the same words as every other type).
+                        const degraded = decideDegradedPush({
+                            force: options.force,
+                            storedContentHash: existingEntry?.contentHash,
+                            currentFileHash: computeFileHash(filePath),
+                        });
+                        if (degraded.action === "skip") {
+                            skippedCount++;
                             continue;
                         }
-                        if (!shouldPushFile(filePath, existingEntry.contentHash)) {
-                            skippedCount++;
+                        if (degraded.action === "decline") {
+                            recordDeclined("email-template", emailType, { action: "live-unavailable" }, existingEntry?.modifiedAt);
                             continue;
                         }
                     }
@@ -10995,8 +13129,12 @@ export function registerConfigSyncCommands(sync) {
             }
             // Push test cases for every test-bearing block (#2769: integrations
             // joined the three that already had a sidecar).
-            const scriptConfigNameToId = new Map(); // "scriptName#configName" → configId
-            const integrationConfigNameToId = new Map(); // "integrationKey#configName" → configId
+            //
+            // #2880 — every block that could name a config has been pushed by now,
+            // so the id→name direction the comparison reads references through has
+            // everything this push learned. It is refilled per case as the lazy
+            // per-block config lookups below resolve more of it.
+            fillTestCaseLookupMaps();
             /** The id the last sync recorded for a block, whatever this push selected. */
             const recordedBlockId = (blockType, blockKey) => {
                 const slot = blockType === "prompt"
@@ -11092,6 +13230,8 @@ export function registerConfigSyncCommands(sync) {
                             client, appId: resolvedAppId, blockType: "prompt", blockId,
                             blockKey: promptKey, configDir, syncState,
                             dryRun: options.dryRun, changes, failures: applyFailures,
+                            declined: recordDeclined, lookupMaps: pushTestCaseLookupMaps,
+                            refreshLookupMaps: fillTestCaseLookupMaps,
                             resolutionMaps: pushMaps, options: { force: options.force },
                         })).skipped;
                     }
@@ -11108,6 +13248,8 @@ export function registerConfigSyncCommands(sync) {
                             client, appId: resolvedAppId, blockType: "workflow", blockId,
                             blockKey: workflowKey, configDir, syncState,
                             dryRun: options.dryRun, changes, failures: applyFailures,
+                            declined: recordDeclined, lookupMaps: pushTestCaseLookupMaps,
+                            refreshLookupMaps: fillTestCaseLookupMaps,
                             resolutionMaps: pushMaps, options: { force: options.force },
                         })).skipped;
                     }
@@ -11134,6 +13276,8 @@ export function registerConfigSyncCommands(sync) {
                         client, appId: resolvedAppId, blockType: "script", blockId,
                         blockKey: scriptName, configDir, syncState,
                         dryRun: options.dryRun, changes, failures: applyFailures,
+                        declined: recordDeclined, lookupMaps: pushTestCaseLookupMaps,
+                        refreshLookupMaps: fillTestCaseLookupMaps,
                         resolutionMaps: pushMaps, options: { force: options.force },
                     })).skipped;
                 }
@@ -11156,6 +13300,8 @@ export function registerConfigSyncCommands(sync) {
                         client, appId: resolvedAppId, blockType: "integration", blockId,
                         blockKey: integrationKey, configDir, syncState,
                         dryRun: options.dryRun, changes, failures: applyFailures,
+                        declined: recordDeclined, lookupMaps: pushTestCaseLookupMaps,
+                        refreshLookupMaps: fillTestCaseLookupMaps,
                         resolutionMaps: pushMaps, options: { force: options.force },
                     })).skipped;
                 }
@@ -11507,8 +13653,18 @@ export function registerConfigSyncCommands(sync) {
             }
         }
         catch (err) {
-            // Save sync state even on failure so partial progress is preserved
-            if (syncState) {
+            // Save sync state even on failure so partial progress is preserved —
+            // but ONLY when there is progress (#2936), which is the state having
+            // moved, not a write having been planned. A preflight abort applies
+            // nothing; so does a first write that the server rejects. For a
+            // cross-app push the state in hand is the reset one: bound to the
+            // target with every entity id dropped. Writing that after "no changes
+            // were applied" rebinds the slot to an app it never wrote to, leaving
+            // the next push with no baseline and nothing tracked — the conflict
+            // `config push` cannot clear. A dry run applies nothing either, and
+            // the success path already declines to save for it.
+            const recordedProgress = !!syncState && JSON.stringify(syncState) !== syncStateAtStart;
+            if (syncState && recordedProgress && !options.dryRun) {
                 try {
                     syncState.lastSyncedAt = new Date().toISOString();
                     saveSyncState(configDir, syncState);
@@ -11681,6 +13837,10 @@ export function registerConfigSyncCommands(sync) {
             const localEmailTemplatesParsed = new Map();
             // #2757 — the same, for webhooks.
             const localWebhooksParsed = new Map();
+            // #2880 — the same, for integrations, cron triggers and blob buckets.
+            const localIntegrationsParsed = new Map();
+            const localCronTriggersParsed = new Map();
+            const localBlobBucketsParsed = new Map();
             // #2748 — the same, for prompts.
             const localPromptsParsed = new Map();
             // Parsed local TOML per key for the five content-aware config types.
@@ -11695,6 +13855,16 @@ export function registerConfigSyncCommands(sync) {
                     const tomlData = parseTomlFile(join(integrationsDir, file));
                     const key = tomlData.integration?.key || basename(file, ".toml");
                     localIntegrations.add(key);
+                    // #2880 — the parsed file is kept so the row can be COMPARED. The
+                    // resolved key is injected back the way webhooks and prompts inject
+                    // theirs: `[integration].key` is optional (push falls back to the
+                    // file name) and the comparison reads it as `displayName`'s
+                    // fallback, so a file that omits it would otherwise report Modified
+                    // forever — even right after a successful push.
+                    if (!tomlData.integration)
+                        tomlData.integration = {};
+                    tomlData.integration.key = key;
+                    localIntegrationsParsed.set(key, tomlData);
                 }
             }
             const webhooksDirPath = join(configDir, "webhooks");
@@ -11721,6 +13891,12 @@ export function registerConfigSyncCommands(sync) {
                     const tomlData = parseTomlFile(join(cronTriggersDirPath, file));
                     const key = tomlData.cronTrigger?.key || basename(file, ".toml");
                     localCronTriggers.add(key);
+                    // #2880 — kept parsed so the row can be COMPARED, with the resolved
+                    // key injected back the way every other type injects its identity.
+                    if (!tomlData.cronTrigger)
+                        tomlData.cronTrigger = {};
+                    tomlData.cronTrigger.key = key;
+                    localCronTriggersParsed.set(key, tomlData);
                 }
             }
             const blobBucketsDiffDir = join(configDir, "blob-buckets");
@@ -11729,6 +13905,11 @@ export function registerConfigSyncCommands(sync) {
                     const tomlData = parseTomlFile(join(blobBucketsDiffDir, file));
                     const key = tomlData.bucket?.key || basename(file, ".toml");
                     localBlobBuckets.add(key);
+                    // #2880 — as above.
+                    if (!tomlData.bucket)
+                        tomlData.bucket = {};
+                    tomlData.bucket.key = key;
+                    localBlobBucketsParsed.set(key, tomlData);
                 }
             }
             const promptsDir = join(configDir, "prompts");
@@ -11923,22 +14104,57 @@ export function registerConfigSyncCommands(sync) {
             // left alone. Prior sync state is the discriminator, mirroring the
             // local-only split above.
             const remoteOnlyStatus = (slot, key) => classifyRemoteOnly(syncState?.entities, slot, key);
-            // Integrations
+            // Integrations — #2880: content-aware, mirroring the webhook block.
+            //
+            // Existence-only comparison meant an edited `accessRule` or upstream
+            // `[requestConfig]` read as Synced while `config push` applied it from
+            // the file's byte hash. The detail is fetched per integration because
+            // `accessRule` and `requestConfig` are on the detail only, which is
+            // also what `config pull` writes from; a per-integration fetch failure
+            // degrades that ONE row to "content not compared".
+            const integrationSpec = configDiffSpec("integration");
+            // Integrations carry no rule-set reference, so the resolution maps the
+            // shared projection takes are empty for this type.
+            const integrationDiffMaps = {
+                ruleSetIdToName: new Map(),
+                ruleSetNameToId: new Map(),
+            };
             const remoteIntegrationRecords = new Map(integrationItems.map((i) => [i.integrationKey, i]));
             for (const key of localIntegrations) {
                 if (!remoteIntegrations.has(key)) {
                     differences.push({ type: "integration", key, status: localOnlyStatus("integrations", key) });
+                    continue;
+                }
+                let status = "exists";
+                let hint;
+                const localParsed = localIntegrationsParsed.get(key);
+                const integrationId = remoteIntegrationRecords.get(key)?.integrationId;
+                const detailOutcome = await attemptFetch(async () => integrationId
+                    ? await client.getIntegration(resolvedAppId, integrationId)
+                    : null);
+                if (!detailOutcome.ok || !detailOutcome.value || !localParsed) {
+                    hint = "content not compared (fetch failed)";
                 }
                 else {
-                    // #2803 — availability is operator state, not drift, and it is the
-                    // same annotation every carrying type gets.
-                    differences.push({
-                        type: "integration",
-                        key,
-                        status: "exists",
-                        hint: outOfServiceHint(remoteIntegrationRecords.get(key)),
-                    });
+                    try {
+                        const remoteHash = hashRemoteConfigForDiff(integrationSpec, detailOutcome.value, integrationDiffMaps);
+                        const localHash = hashLocalConfigForDiff(integrationSpec, localParsed, integrationDiffMaps);
+                        if (remoteHash !== localHash) {
+                            status = "modified";
+                            hint = "run `config pull` to rewrite the local TOML to match running state";
+                        }
+                    }
+                    catch {
+                        hint = "content not compared (comparison failed)";
+                    }
                 }
+                // #2803 — availability is operator state, not drift, and it is the
+                // same annotation every carrying type gets, appended to whatever the
+                // content comparison already had to say.
+                hint = outOfServiceHint(detailOutcome.ok && detailOutcome.value
+                    ? detailOutcome.value
+                    : remoteIntegrationRecords.get(key), hint);
+                differences.push({ type: "integration", key, status, hint });
             }
             for (const key of remoteIntegrations) {
                 if (!localIntegrations.has(key)) {
@@ -11980,17 +14196,11 @@ export function registerConfigSyncCommands(sync) {
                     hint = "content not compared (fetch failed)";
                 }
                 else {
-                    try {
-                        const remoteHash = hashRemoteConfigForDiff(webhookSpec, detailOutcome.value, webhookDiffMaps);
-                        const localHash = hashLocalConfigForDiff(webhookSpec, localParsed, webhookDiffMaps);
-                        if (remoteHash !== localHash) {
-                            status = "modified";
-                            hint = "run `config pull` to rewrite the local TOML to match running state";
-                        }
-                    }
-                    catch {
-                        hint = "content not compared (comparison failed)";
-                    }
+                    // Through the shared verdict, so the file's unmanaged fields are
+                    // read here exactly as the push gate reads them (#2880).
+                    const verdict = compareLocalToRemote(webhookSpec, localParsed, detailOutcome.value, webhookDiffMaps);
+                    status = verdict.status;
+                    hint = verdict.hint;
                 }
                 // #2803 — a paused/archived webhook is operator state, appended to
                 // whatever the content comparison already had to say.
@@ -12002,35 +14212,43 @@ export function registerConfigSyncCommands(sync) {
                     differences.push({ type: "webhook", key, status: remoteOnlyStatus("webhooks", key) });
                 }
             }
-            // Cron Triggers
+            // Cron Triggers — #2880: content-aware. The LIST row is the whole
+            // record for this type (it is what `config pull` serializes from), so
+            // no second fetch is needed; a comparison that throws degrades that ONE
+            // row rather than the diff.
+            const cronSpec = configDiffSpec("cron-trigger");
             const remoteCronTriggerRecords = new Map(cronTriggerItemsDiff.map((t) => [t.triggerKey, t]));
             for (const key of localCronTriggers) {
                 if (!remoteCronTriggers.has(key)) {
                     differences.push({ type: "cron-trigger", key, status: localOnlyStatus("cronTriggers", key) });
+                    continue;
                 }
-                else {
-                    // #2645 criterion 9 — a paused trigger is operator state, not drift.
-                    differences.push({
-                        type: "cron-trigger",
-                        key,
-                        status: "exists",
-                        hint: outOfServiceHint(remoteCronTriggerRecords.get(key)),
-                    });
-                }
+                const { status, hint } = compareLocalToRemote(cronSpec, localCronTriggersParsed.get(key), remoteCronTriggerRecords.get(key));
+                differences.push({
+                    type: "cron-trigger",
+                    key,
+                    status,
+                    // #2645 criterion 9 — a paused trigger is operator state, not
+                    // drift, appended to whatever the content comparison had to say.
+                    hint: outOfServiceHint(remoteCronTriggerRecords.get(key), hint),
+                });
             }
             for (const key of remoteCronTriggers) {
                 if (!localCronTriggers.has(key)) {
                     differences.push({ type: "cron-trigger", key, status: remoteOnlyStatus("cronTriggers", key) });
                 }
             }
-            // Blob Buckets
+            // Blob Buckets — #2880: the same, and the list row is the record here
+            // too.
+            const blobBucketSpec = configDiffSpec("blob-bucket");
+            const remoteBlobBucketRecords = new Map((blobBucketsDiffResult.items || []).map((b) => [b.bucketKey, b]));
             for (const key of localBlobBuckets) {
                 if (!remoteBlobBuckets.has(key)) {
                     differences.push({ type: "blob-bucket", key, status: localOnlyStatus("blobBuckets", key) });
+                    continue;
                 }
-                else {
-                    differences.push({ type: "blob-bucket", key, status: "exists" });
-                }
+                const { status, hint } = compareLocalToRemote(blobBucketSpec, localBlobBucketsParsed.get(key), remoteBlobBucketRecords.get(key));
+                differences.push({ type: "blob-bucket", key, status, hint });
             }
             for (const key of remoteBlobBuckets) {
                 if (!localBlobBuckets.has(key)) {
@@ -12048,6 +14266,22 @@ export function registerConfigSyncCommands(sync) {
             // fetches the detail `config pull` writes from. A failed fetch degrades
             // that ONE row to "content not compared", never the whole diff.
             const promptSpec = configDiffSpec("prompt");
+            /**
+             * The id→name lookups a test case's references are read through
+             * (#2880). Filled from the prompt details this loop already fetches —
+             * a second listing per block would double the diff's request count to
+             * learn what is already on the wire.
+             */
+            const diffTestCaseLookupMaps = {
+                configIdToName: new Map(),
+                promptIdToKey: new Map(),
+            };
+            for (const p of promptItems) {
+                const key = p?.promptKey;
+                const id = p?.promptId;
+                if (key && id)
+                    diffTestCaseLookupMaps.promptIdToKey.set(id, key);
+            }
             // Prompts carry no rule-set reference, so the resolution maps the shared
             // projection takes are empty for this type.
             const promptDiffMaps = {
@@ -12069,6 +14303,13 @@ export function registerConfigSyncCommands(sync) {
                     hint = "content not compared (fetch failed)";
                 }
                 else {
+                    // #2880 — the prompt's configs, for the test-case references that
+                    // name them.
+                    for (const config of detailOutcome.value.configs ?? []) {
+                        if (config?.configId && config?.configName) {
+                            diffTestCaseLookupMaps.configIdToName.set(config.configId, config.configName);
+                        }
+                    }
                     try {
                         const remoteHash = hashRemoteConfigForDiff(promptSpec, detailOutcome.value, promptDiffMaps);
                         const localHash = hashLocalConfigForDiff(promptSpec, localParsed, promptDiffMaps);
@@ -12440,6 +14681,10 @@ export function registerConfigSyncCommands(sync) {
                     blockId,
                     blockKey,
                     configDir,
+                    // #2880 — identity is the manifest id, and the attachment plan
+                    // reads the hashes the manifest recorded.
+                    syncState,
+                    lookupMaps: diffTestCaseLookupMaps,
                 });
                 if (!outcome.ok) {
                     // A block whose listing failed is REPORTED, not skipped in silence.
@@ -12482,6 +14727,96 @@ export function registerConfigSyncCommands(sync) {
                     await compareTestCases("integration", i.integrationId, key);
                 }
             }
+            // App settings — #2880 behavior 9, subsuming #2875.
+            //
+            // The whole-tree diff used not to compare `app.toml` AT ALL, so an
+            // edited file reported every count as zero: "nothing to push" printed
+            // over a push that would change the running app. `--only app` had the
+            // per-field comparison the whole time; this is that same helper, on the
+            // command an operator actually runs to ask whether anything differs.
+            //
+            // Compared over the FULL writable descriptor set, because push applies
+            // the file as the whole truth (criterion 4): a key the file omits is
+            // the clear push will send, not an absence of opinion. The settings are
+            // fetched only when there is a local file to compare and the selection
+            // asks for it, so an unselected `app.toml` costs no request.
+            const appTomlPathForDiff = join(configDir, "app.toml");
+            if (existsSync(appTomlPathForDiff) &&
+                selectionIncludesApp(diffSelection)) {
+                const appRow = (status, hint) => differences.push({
+                    type: "app-settings",
+                    key: "app.toml",
+                    status,
+                    hint,
+                });
+                let appTomlData;
+                try {
+                    appTomlData = parseTomlFile(appTomlPathForDiff);
+                }
+                catch (err) {
+                    appRow(VALIDATION_ERROR, `could not parse app.toml: ${err?.message || String(err)}`);
+                }
+                if (appTomlData) {
+                    const excludeName = appSettingsNameExcludedForState(syncState, resolvedAppId, appTomlData);
+                    // The SAME validator push's preflight runs (criterion 1): a
+                    // declared-type mismatch, an unrecognized or retired key, and a
+                    // missing required key are reported here with push's own message
+                    // rather than compared past and called Synced.
+                    const { settings: localAppSettings, errors: appErrors } = buildAppSettingsPayload(appTomlData, { excludeName });
+                    if (appErrors.length > 0) {
+                        appRow(VALIDATION_ERROR, appErrors.join("; "));
+                    }
+                    else {
+                        const settingsOutcome = await attemptFetch(() => client.getAppSettings(resolvedAppId));
+                        if (!settingsOutcome.ok) {
+                            // #1485's rule, for this type: a failed read is not "matches".
+                            notCompared.push({
+                                type: "app-settings",
+                                reason: gateReason(settingsOutcome.error),
+                            });
+                        }
+                        else {
+                            const fieldDiffs = appSettingsFieldDiffs(localAppSettings, settingsOutcome.value ?? {}, { excludeName });
+                            if (fieldDiffs.length === 0) {
+                                appRow("exists");
+                            }
+                            else {
+                                appRow("modified", `${fieldDiffs.length} field(s) differ: ` +
+                                    fieldDiffs
+                                        .map((d) => `[${d.section}].${d.key}`)
+                                        .join(", ") +
+                                    " — `config diff --only app` shows the values");
+                            }
+                        }
+                    }
+                }
+            }
+            // #2880 criterion 1 (symmetry) — a file `config push` would refuse is
+            // not a file this command calls Synced.
+            //
+            // The comparison above can only report a difference it can SEE, and a
+            // local key with no server counterpart is invisible to it: the
+            // reporter's prompts still carrying the `[prompt].status` #2803 retired
+            // compared clean field for field while push refused the whole tree. So
+            // the same preflight push runs decides these rows, and its message —
+            // verbatim, so the two commands read identically — replaces whatever
+            // the comparison had to say about the file.
+            for (const rejected of collectConfigFileValidationErrors(configDir)) {
+                const row = differences.find((d) => d.type === rejected.type && d.key === rejected.key);
+                const hint = rejected.messages.join("; ");
+                if (row) {
+                    row.status = VALIDATION_ERROR;
+                    row.hint = hint;
+                }
+                else {
+                    differences.push({
+                        type: rejected.type,
+                        key: rejected.key,
+                        status: VALIDATION_ERROR,
+                        hint,
+                    });
+                }
+            }
             // `--only` (issue #2645) reports just the objects the operator named.
             // The rows are filtered rather than the fetches: every leg keeps its own
             // failure handling, so a type whose listing failed is still reported as
@@ -12489,7 +14824,13 @@ export function registerConfigSyncCommands(sync) {
             if (diffSelection) {
                 differences = differences.filter((row) => row.type === "var"
                     ? diffSelection.varKeys.has(row.key)
-                    : selectionIncludesKey(diffSelection, row.type, row.key));
+                    : // #2880 — `app.toml` is a root singleton, outside
+                        // `SYNC_RESOURCE_TYPES`, so it has its own selection predicate
+                        // (the row is only built when this is true, but the filter is
+                        // what makes that visible where selection is decided).
+                        row.type === "app-settings"
+                            ? selectionIncludesApp(diffSelection)
+                            : selectionIncludesKey(diffSelection, row.type, row.key));
             }
             divider();
             const localOnly = differences.filter((d) => d.status === LOCAL_ONLY_NEW);
@@ -12501,6 +14842,23 @@ export function registerConfigSyncCommands(sync) {
             const remoteOnlyUnmanaged = differences.filter((d) => d.status === REMOTE_ONLY_UNMANAGED);
             const modified = differences.filter((d) => d.status === "modified");
             const existing = differences.filter((d) => d.status === "exists");
+            // #2880 — files push would refuse. Reported before anything else: no
+            // other row's status is trustworthy while a file in the tree cannot be
+            // pushed at all.
+            const invalid = differences.filter((d) => d.status === VALIDATION_ERROR);
+            // #2880 — the same messages `config push` aborts with, so a clean diff
+            // can be read as "nothing to push" and a dirty one names the fix.
+            if (invalid.length > 0) {
+                warn("Invalid — `config push` will refuse these (not compared):");
+                for (const d of invalid) {
+                    console.log(`  ${chalk.red("✗")} ${d.type}: ${d.key}`);
+                    for (const message of (d.hint ?? "").split("; ")) {
+                        if (message)
+                            console.log(`    ${message}`);
+                    }
+                }
+                console.log();
+            }
             if (localOnly.length > 0) {
                 info("Local only — new (will be created on push):");
                 for (const d of localOnly) {
@@ -12571,17 +14929,35 @@ export function registerConfigSyncCommands(sync) {
             const tcLocalOnly = testCaseDiffs.filter((d) => d.status === LOCAL_ONLY_NEW);
             const tcRemoteOnly = testCaseDiffs.filter((d) => d.status === "remote only");
             const tcSynced = testCaseDiffs.filter((d) => d.status === "exists");
-            if (tcLocalOnly.length > 0 || tcRemoteOnly.length > 0) {
+            // #2880 — sidecars whose CONTENT differs, and sidecars push would
+            // refuse. Both used to read as "= test-case: …", because the comparison
+            // stopped at whether the slug existed on both sides.
+            const tcModified = testCaseDiffs.filter((d) => d.status === "modified");
+            const tcInvalid = testCaseDiffs.filter((d) => d.status === VALIDATION_ERROR);
+            if (tcLocalOnly.length > 0 ||
+                tcRemoteOnly.length > 0 ||
+                tcModified.length > 0 ||
+                tcInvalid.length > 0) {
                 console.log();
                 info("Test Cases:");
+                for (const d of tcInvalid) {
+                    console.log(`  ${chalk.red("✗")} ${d.blockType}/${d.blockKey} test-case: ${d.slug}`);
+                    if (d.hint)
+                        console.log(`    ${d.hint}`);
+                }
                 for (const d of tcLocalOnly) {
                     console.log(`  ${chalk.green("+")} ${d.blockType}/${d.blockKey} test-case: ${d.slug}`);
                 }
                 for (const d of tcRemoteOnly) {
                     console.log(`  ${chalk.red("-")} ${d.blockType}/${d.blockKey} test-case: ${d.slug}`);
                 }
+                for (const d of tcModified) {
+                    const hint = d.hint ? ` ${chalk.dim(`(${d.hint})`)}` : "";
+                    console.log(`  ${chalk.yellow("~")} ${d.blockType}/${d.blockKey} test-case: ${d.slug}${hint}`);
+                }
                 for (const d of tcSynced) {
-                    console.log(`  ${chalk.dim("=")} ${d.blockType}/${d.blockKey} test-case: ${d.slug}`);
+                    const hint = d.hint ? ` ${chalk.dim(`(${d.hint})`)}` : "";
+                    console.log(`  ${chalk.dim("=")} ${d.blockType}/${d.blockKey} test-case: ${d.slug}${hint}`);
                 }
             }
             divider();
@@ -12591,13 +14967,20 @@ export function registerConfigSyncCommands(sync) {
             keyValue("Remote only (unmanaged, left alone)", remoteOnlyUnmanaged.length);
             keyValue("Modified", modified.length);
             keyValue("Synced", existing.length);
+            if (invalid.length > 0) {
+                keyValue("Invalid (push would refuse)", invalid.length);
+            }
             if (notCompared.length > 0) {
                 keyValue("Not compared", notCompared.map((nc) => `${nc.type} (${nc.reason})`).join(", "));
             }
             if (testCaseDiffs.length > 0) {
                 keyValue("Test Cases (local only)", tcLocalOnly.length);
                 keyValue("Test Cases (remote only)", tcRemoteOnly.length);
+                keyValue("Test Cases (modified)", tcModified.length);
                 keyValue("Test Cases (synced)", tcSynced.length);
+                if (tcInvalid.length > 0) {
+                    keyValue("Test Cases (push would refuse)", tcInvalid.length);
+                }
             }
         }
         catch (err) {