primitive-admin 1.1.0-alpha.81 → 1.1.0-alpha.83

package/dist/src/lib/generated-config-surfaces.js

@@ -38,9 +38,16 @@ export const UPDATE_ONLY = ["update"];
  * the definition never dispatches through it (#1976 decision of record); the
  * guard asserts the export exists so a renamed handler fails the CLI unit suite
  * instead of leaving a dangling reference (#2644 behavior 2b).
+ *
+ * `stage` is REQUIRED (#3375): a field handler that does not say when it runs
+ * makes the same empty promise the cross-field slot made before #3373 — it
+ * names an owner, and criterion 5 has nothing to check. A `preflight` handler
+ * is reached from `cli/src/commands/sync.ts#runConfigPushPreflight` before the
+ * first mutating call, which `findUnreachedPreflightRules` proves statically;
+ * an `apply` handler is everything else.
  */
-export function handledBy(modulePath, exportName) {
-    return { handler: `${modulePath}#${exportName}` };
+export function handledBy(modulePath, exportName, stage) {
+    return { handler: `${modulePath}#${exportName}`, stage };
 }
 /**
  * Name the ONE export that enforces a cross-field rule, as
@@ -1395,6 +1402,616 @@ export function crossFieldRulesForStage(surface, stage) {
     }
     return (surface.crossFieldRules ?? []).filter((rule) => rule.stage === stage);
 }
+// ── src/config-surface/preflight-reachability.ts ─────────────────────────
+/**
+ * Is a rule declared `preflight` actually reached before `config push` mutates
+ * anything? (issue #3375, project phase 3, intent §Success criteria 5.)
+ *
+ * #3373 gave a rule a `stage`; #3374 declared three surfaces' rules. Both left
+ * the string a PROMISE. "This runs before the first mutating call" was
+ * satisfied by typing `preflight` beside a rule that is not on the preflight
+ * path at all, because the push preflight was an inline block inside the
+ * command's `.action()` callback with no exported symbol — so "reached from the
+ * preflight" had nothing to resolve against.
+ *
+ * #3375 extracts that block into `cli/src/commands/sync.ts#runConfigPushPreflight`
+ * and this module answers the question statically, from the declared
+ * `<module>#<export>`:
+ *
+ *   - `reachableExports` walks the call graph from one entry symbol over module
+ *     SOURCE TEXT and returns what it reached — plus what it could NOT resolve,
+ *     so silence is never a pass.
+ *   - `findUnreachedPreflightRules` reports every `preflight` declaration,
+ *     cross-field or single-field, whose handler is missing from that set.
+ *   - `findMalformedFieldValidationStages` is the field-level twin of #3373's
+ *     `findMalformedRuleDeclarations`: `ConfigField["validation"]` gained a
+ *     `stage` here, and it must be well-formed to mean anything.
+ *
+ * Everything is a PURE function over values and over source text the caller
+ * passes in: `cli/tests/unit/config-surface-preflight-staging-3375.test.ts`
+ * does the filesystem walk, so this module stays vendorable (`types.ts`
+ * §Purity), exactly the split `rules.ts` already uses.
+ *
+ * ── Two things this check is NOT ──────────────────────────────────────────
+ *
+ * It is NECESSARY, not sufficient, and there is deliberately no converse. A
+ * handler reached on one surface's leg satisfies a `preflight` declaration on
+ * another (the residual the intent accepts and #3379 records), and asking "is
+ * this `apply` rule reached from the preflight?" would be wrong by
+ * construction: `validateSigningSecretDeclaration` IS reached on the function
+ * leg and IS correctly `apply` on the webhook surface, where no CLI call
+ * exists.
+ *
+ * The walk is identifier-based over masked source, so it over-approximates in
+ * the PASSING direction: a local variable shadowing an imported handler's name
+ * reads as a call. That is the safe direction for a guard whose failure mode
+ * must be "a promise you did not keep", not "a promise you did keep, reported
+ * as broken".
+ */
+/** A field's `validation` object may carry these keys and no others (#3375). */
+export const FIELD_VALIDATION_KEYS = ["handler", "stage"];
+const PREFLIGHT_IDENTIFIER = /[A-Za-z_$][\w$]*/g;
+const PREFLIGHT_DECLARATION = /^(?:export\s+)?(?:default\s+)?(?:declare\s+)?(?:abstract\s+)?(?:async\s+)?(function|class|const|let|var|type|interface|enum)\s*\*?\s+([A-Za-z_$][\w$]*)/;
+/** The `<module>` and `<export>` halves, or null when the reference is malformed. */
+function preflightSplitSymbol(symbol) {
+    if (typeof symbol !== "string")
+        return null;
+    const [module, name, ...rest] = symbol.split("#");
+    if (!module || !name || rest.length)
+        return null;
+    return { module, name };
+}
+/** Index of the `}`/`)`/`]` closing the bracket at `open`, or -1. */
+function preflightMatchingBracket(masked, open) {
+    const pairs = { "[": "]", "{": "}", "(": ")" };
+    const stack = [];
+    for (let i = open; i < masked.length; i++) {
+        const ch = masked[i];
+        if (pairs[ch]) {
+            stack.push(pairs[ch]);
+            continue;
+        }
+        if (ch === "]" || ch === "}" || ch === ")") {
+            if (!stack.length || stack.pop() !== ch)
+                return -1;
+            if (!stack.length)
+                return i;
+        }
+    }
+    return -1;
+}
+/**
+ * A keyword that can only OPEN a top-level declaration, never continue an
+ * expression: seeing one at column zero ends the statement before it.
+ *
+ * `async` and `abstract` are spelled with what must follow them, because both
+ * can legitimately continue an expression across a line break; `function` and
+ * `class` alone cannot start an indented continuation in a formatted file, and
+ * the column-zero test below is what rules out the expression forms.
+ */
+const PREFLIGHT_DECLARATION_OPENS = /^(?:export|import|declare|function|class|const|let|var|type|interface|enum|async\s+function|abstract\s+class)\b/;
+/**
+ * End of a `const`/`let`/`var`/`type` statement that begins at `from`: the
+ * first `;` outside any bracket, or the line break before the next top-level
+ * declaration — whichever comes first.
+ *
+ * The second boundary is not optional. TypeScript's automatic semicolon
+ * insertion makes `export const entry = () => 1` a complete statement, and a
+ * scan that only ever stops at a `;` runs on through every following
+ * declaration to the next one that has one — attributing an unrelated
+ * apply-only function's body to this declaration, which is an
+ * over-approximation in the PASSING direction: the staging guard would report
+ * a handler as reached that the preflight never mentions. A depth-zero line
+ * break followed by a declaration keyword at column zero is where a formatted
+ * file puts the boundary, and an indented continuation line (`? x`, `: y`,
+ * `| A`, `.then(…)`) never matches it.
+ *
+ * Falling back to the end of the module would let one missing semicolon
+ * attribute the whole rest of the file to a single declaration — an
+ * over-approximation so large the guard would pass on anything. The fallback is
+ * the end of the line instead, which is what an unterminated statement looks
+ * like in a formatted file.
+ */
+function preflightStatementEnd(masked, from) {
+    let depth = 0;
+    for (let i = from; i < masked.length; i++) {
+        const ch = masked[i];
+        if (ch === "{" || ch === "(" || ch === "[")
+            depth++;
+        else if (ch === "}" || ch === ")" || ch === "]")
+            depth--;
+        else if (ch === ";" && depth <= 0)
+            return i;
+        else if (ch === "\n" && depth <= 0) {
+            const next = preflightNextSignificant(masked, i + 1);
+            if (next === -1)
+                break;
+            // Column zero only: a continuation line is indented, and a comment ahead
+            // of the next declaration is already blanked to whitespace.
+            if (masked[next - 1] !== "\n")
+                continue;
+            if (PREFLIGHT_DECLARATION_OPENS.test(masked.slice(next, next + 40))) {
+                return i;
+            }
+        }
+    }
+    const newline = masked.indexOf("\n", from);
+    return newline === -1 ? masked.length : newline;
+}
+/** Index of the next non-whitespace character at or after `from`, or -1. */
+function preflightNextSignificant(masked, from) {
+    for (let i = from; i < masked.length; i++) {
+        if (!/\s/.test(masked[i]))
+            return i;
+    }
+    return -1;
+}
+/** Index of the previous non-whitespace character before `before`, or -1. */
+function preflightPreviousSignificant(masked, before) {
+    for (let i = before - 1; i >= 0; i--) {
+        if (!/\s/.test(masked[i]))
+            return i;
+    }
+    return -1;
+}
+/**
+ * The character ending the token before `before` — `"` when that token is a
+ * string literal.
+ *
+ * The masker blanks a literal's QUOTES along with its contents, so a
+ * literal type is invisible in the masked view and the search above walks
+ * straight past it to whatever preceded it in the annotation. That matters for
+ * exactly one decision: `function typeOfValue(v): Kind | "null" | "unknown" {`
+ * masks to `… Kind |        |           {`, whose previous significant
+ * character is a `|` — a type continuation — so the body would be read as an
+ * object type, skipped whole, and the NEXT function's body taken as this one's.
+ * The literal table restores the token the mask erased.
+ */
+function preflightPreviousTokenEnd(masked, literals, before) {
+    const previous = preflightPreviousSignificant(masked, before);
+    const gapStart = previous + 1;
+    for (const literal of literals) {
+        if (literal.start >= gapStart && literal.end <= before)
+            return '"';
+    }
+    return previous === -1 ? "" : masked[previous];
+}
+/**
+ * A character that can only CONTINUE a type annotation, so a `{` right after it
+ * opens an object type rather than a function body.
+ */
+const PREFLIGHT_TYPE_CONTINUES = new Set([
+    ":",
+    "|",
+    "&",
+    ",",
+    "(",
+    "[",
+    "<",
+    "=",
+]);
+/**
+ * Index of the `{` that opens a function's BODY, given the offset just past its
+ * name — or -1 when it has none (an overload signature, a `declare`).
+ *
+ * Not simply the next `{`. A parameter destructured into an inline object type
+ * (`input: { configDir: string; … }`) and a return type naming one
+ * (`Promise<{ parsedVars: … }>`) each open a brace first, and taking either
+ * would end the declaration's span at the signature — after which every symbol
+ * the body really calls is invisible, and a staging check whose walk reaches
+ * nothing passes everything.
+ *
+ * So: match the parameter list, then read the return-type annotation off the
+ * text. A `{` inside a generic argument, or one following a character that can
+ * only continue a type, is skipped whole; the first other `{` is the body. A
+ * `;` reached first means there is no body at all. A literal return type
+ * (`: "ok" {`) is read through the lexer's literal table, because the mask
+ * erased its quotes along with its contents.
+ */
+function preflightFunctionBody(masked, literals, afterName) {
+    const paren = masked.indexOf("(", afterName);
+    if (paren === -1)
+        return -1;
+    const closeParen = preflightMatchingBracket(masked, paren);
+    if (closeParen === -1)
+        return -1;
+    let angle = 0;
+    for (let i = closeParen + 1; i < masked.length; i++) {
+        const ch = masked[i];
+        if (ch === ";")
+            return -1; // an overload signature: no body follows
+        if (ch === "<") {
+            angle++;
+            continue;
+        }
+        if (ch === ">" && masked[i - 1] !== "=") {
+            angle = Math.max(0, angle - 1);
+            continue;
+        }
+        if (ch !== "{")
+            continue;
+        const character = preflightPreviousTokenEnd(masked, literals, i);
+        if (angle === 0 && !PREFLIGHT_TYPE_CONTINUES.has(character))
+            return i;
+        const close = preflightMatchingBracket(masked, i);
+        if (close === -1)
+            return -1;
+        i = close;
+    }
+    return -1;
+}
+/** Every top-level declaration of a masked module, with its span. */
+function preflightTopLevelDeclarations(masked, literals) {
+    const out = new Map();
+    /** Names whose recorded span is a signature with no body, so far. */
+    const signatureOnly = new Set();
+    let i = 0;
+    let depth = 0;
+    while (i < masked.length) {
+        const ch = masked[i];
+        const boundary = i === 0 || !/[\w$]/.test(masked[i - 1]);
+        if (depth === 0 && /[A-Za-z_$]/.test(ch) && boundary) {
+            const match = PREFLIGHT_DECLARATION.exec(masked.slice(i, i + 200));
+            if (match) {
+                const kind = match[1];
+                const name = match[2];
+                const afterName = i + match[0].length;
+                let end;
+                let hasBody = true;
+                if (kind === "function" ||
+                    kind === "class" ||
+                    kind === "interface" ||
+                    kind === "enum") {
+                    const brace = kind === "function"
+                        ? preflightFunctionBody(masked, literals, afterName)
+                        : masked.indexOf("{", afterName);
+                    const close = brace === -1 ? -1 : preflightMatchingBracket(masked, brace);
+                    hasBody = close !== -1;
+                    end = close === -1 ? preflightStatementEnd(masked, afterName) : close;
+                }
+                else {
+                    end = preflightStatementEnd(masked, afterName);
+                }
+                // The declaration with a BODY wins, whichever came first: a `declare`
+                // or an overload signature ahead of the real one carries only types,
+                // and letting it hold the name would hide every call the
+                // implementation makes — the walk would report a genuinely reached
+                // handler as unreached. Between two bodies the first still wins.
+                if (!out.has(name) || (signatureOnly.has(name) && hasBody)) {
+                    out.set(name, { start: i, end });
+                    if (hasBody)
+                        signatureOnly.delete(name);
+                    else
+                        signatureOnly.add(name);
+                }
+                i = end + 1;
+                continue;
+            }
+        }
+        if (ch === "{" || ch === "(" || ch === "[")
+            depth++;
+        else if (ch === "}" || ch === ")" || ch === "]")
+            depth = Math.max(0, depth - 1);
+        i++;
+    }
+    return out;
+}
+/**
+ * Read one module's imports, re-exports and declarations.
+ *
+ * The string CONTENTS are blanked in the masked view — that is what stops a
+ * name inside a comment or a message from reading as a call — so a module
+ * specifier is recovered from the lexer's literal table by position rather than
+ * from the masked text.
+ */
+function preflightModuleFacts(source) {
+    const { masked, strings } = lexRuleModuleSource(source);
+    const literalAfter = (index) => {
+        for (const literal of strings) {
+            if (literal.start >= index)
+                return literal.value;
+        }
+        return null;
+    };
+    const imports = new Map();
+    const namespaces = new Map();
+    const namedReExports = new Map();
+    const starReExports = [];
+    /**
+     * `{ a, b as c, type D }` → the value bindings it introduces, as
+     * (name on THIS side, name on the OTHER module's side) pairs. The same
+     * shape reads an import clause and a re-export clause, which are mirrors.
+     */
+    const readClause = (clause, onBinding) => {
+        for (const piece of clause.split(",")) {
+            const parts = piece.trim().split(/\s+/).filter(Boolean);
+            if (!parts.length || parts[0] === "type")
+                continue; // `{ type X }`
+            const there = parts[0];
+            const here = parts.length >= 3 && parts[1] === "as" ? parts[2] : there;
+            onBinding(here, there);
+        }
+    };
+    // Anchored at the start of a line, and stopping at a `;`: a static import is
+    // always top-level, and an unanchored `\bimport\b` would let a dynamic
+    // `await import(…)` deep inside a function run on to some unrelated `from`
+    // and invent a binding out of whichever string literal came next.
+    for (const match of masked.matchAll(/^import\b([^;]*?)\bfrom\b/gm)) {
+        const clause = match[1];
+        if (/^\s*type\b/.test(clause))
+            continue; // `import type { … } from`
+        const specifier = literalAfter((match.index ?? 0) + match[0].length);
+        if (!specifier)
+            continue;
+        const namespace = /\*\s+as\s+([A-Za-z_$][\w$]*)/.exec(clause);
+        if (namespace)
+            namespaces.set(namespace[1], specifier);
+        const named = /\{([^}]*)\}/.exec(clause);
+        if (named) {
+            readClause(named[1], (here, there) => {
+                imports.set(here, { specifier, imported: there });
+            });
+        }
+    }
+    for (const match of masked.matchAll(/^export\s+(type\s+)?\{([^}]*)\}\s*from\b/gm)) {
+        if (match[1])
+            continue; // `export type { … } from` re-exports no value
+        const specifier = literalAfter((match.index ?? 0) + match[0].length);
+        if (!specifier)
+            continue;
+        readClause(match[2], (here, there) => {
+            namedReExports.set(here, { specifier, local: there });
+        });
+    }
+    for (const match of masked.matchAll(/^export\s*\*\s*from\b/gm)) {
+        const specifier = literalAfter((match.index ?? 0) + match[0].length);
+        if (specifier)
+            starReExports.push(specifier);
+    }
+    return {
+        masked,
+        declarations: preflightTopLevelDeclarations(masked, strings),
+        imports,
+        namespaces,
+        namedReExports,
+        starReExports,
+    };
+}
+/**
+ * Walk the call graph from `entry` and return every symbol it reaches.
+ *
+ * An identifier inside a reached declaration's span is followed when it names
+ * another top-level declaration of the same module, or a value import — which
+ * resolves through the graph to whichever candidate module DECLARES the name,
+ * following `export { x } from` and `export * from` on the way. A symbol is
+ * recorded under the module that declares it, never under a barrel that merely
+ * re-exports it: a declaration that names the barrel is reported unreached,
+ * because the point of the string is to name the one implementation.
+ */
+export function reachableExports(entry, graph) {
+    const reached = new Set();
+    const unresolved = new Set();
+    const facts = new Map();
+    const queued = new Set();
+    const queue = [];
+    const factsFor = (module) => {
+        const source = graph.modules.get(module);
+        if (source === undefined)
+            return null;
+        let cached = facts.get(module);
+        if (!cached) {
+            cached = preflightModuleFacts(source);
+            facts.set(module, cached);
+        }
+        return cached;
+    };
+    /** Candidate modules for a specifier, reporting a dangling relative one. */
+    const candidates = (from, specifier) => {
+        const resolved = graph.resolve(from, specifier);
+        if (resolved === null)
+            return []; // a package: not followed, not reported
+        if (resolved.length === 0) {
+            unresolved.add(`${from}: "${specifier}" resolves to no module in the graph`);
+        }
+        return resolved;
+    };
+    /**
+     * Where `name` is really DECLARED, starting from `module` — following named
+     * and star re-exports. `[]` when nothing in reach declares it.
+     */
+    const declaringSymbols = (module, name, seen) => {
+        const key = `${module}#${name}`;
+        if (seen.has(key))
+            return [];
+        seen.add(key);
+        const moduleFacts = factsFor(module);
+        if (!moduleFacts)
+            return [];
+        if (moduleFacts.declarations.has(name))
+            return [key];
+        const out = [];
+        const named = moduleFacts.namedReExports.get(name);
+        if (named) {
+            for (const candidate of candidates(module, named.specifier)) {
+                out.push(...declaringSymbols(candidate, named.local, seen));
+            }
+        }
+        for (const specifier of moduleFacts.starReExports) {
+            for (const candidate of candidates(module, specifier)) {
+                out.push(...declaringSymbols(candidate, name, seen));
+            }
+        }
+        return out;
+    };
+    const enqueue = (symbol) => {
+        if (queued.has(symbol))
+            return;
+        queued.add(symbol);
+        queue.push(symbol);
+    };
+    /** Follow an imported binding to the symbol(s) it really names. */
+    const followImport = (module, specifier, imported) => {
+        for (const candidate of candidates(module, specifier)) {
+            for (const symbol of declaringSymbols(candidate, imported, new Set())) {
+                enqueue(symbol);
+            }
+        }
+    };
+    const parsedEntry = preflightSplitSymbol(entry);
+    if (!parsedEntry) {
+        return {
+            reached,
+            unresolved: [
+                `"${String(entry)}" is not a "<module>#<export>" reference`,
+            ],
+        };
+    }
+    const entrySymbols = declaringSymbols(parsedEntry.module, parsedEntry.name, new Set());
+    if (entrySymbols.length === 0) {
+        unresolved.add(`${entry}: no module in the graph declares or re-exports it — the ` +
+            "entry point was renamed, un-exported, or never added to the graph");
+    }
+    for (const symbol of entrySymbols)
+        enqueue(symbol);
+    while (queue.length) {
+        const symbol = queue.shift();
+        const parsed = preflightSplitSymbol(symbol);
+        const moduleFacts = factsFor(parsed.module);
+        if (!moduleFacts)
+            continue;
+        const span = moduleFacts.declarations.get(parsed.name);
+        if (!span)
+            continue;
+        reached.add(symbol);
+        const body = moduleFacts.masked.slice(span.start, span.end);
+        // `ns.member` — the namespace binding's own name says nothing, so the
+        // member is read off the text rather than off the identifier stream.
+        for (const [local, specifier] of moduleFacts.namespaces) {
+            const member = new RegExp(`\\b${local}\\s*\\.\\s*([A-Za-z_$][\\w$]*)`, "g");
+            for (const hit of body.matchAll(member)) {
+                followImport(parsed.module, specifier, hit[1]);
+            }
+        }
+        for (const hit of body.matchAll(PREFLIGHT_IDENTIFIER)) {
+            const name = hit[0];
+            if (name === parsed.name)
+                continue;
+            // A property access is not a reference to a top-level name; `ns.member`
+            // above is the one case where it is, and it is handled there. Walked
+            // backwards rather than by slicing, so a long declaration costs the
+            // walk linear time and not quadratic.
+            let back = (hit.index ?? 0) - 1;
+            while (back >= 0 && /\s/.test(body[back]))
+                back--;
+            if (back >= 0 && body[back] === ".")
+                continue;
+            if (moduleFacts.declarations.has(name)) {
+                enqueue(`${parsed.module}#${name}`);
+                continue;
+            }
+            const imported = moduleFacts.imports.get(name);
+            if (imported) {
+                followImport(parsed.module, imported.specifier, imported.imported);
+            }
+        }
+    }
+    return { reached, unresolved: [...unresolved].sort() };
+}
+/** The handler's `<module>` half, or "" when the reference is malformed. */
+function preflightHandlerModule(handler) {
+    const parsed = preflightSplitSymbol(handler);
+    return parsed ? parsed.module : "";
+}
+/**
+ * Every fault in one surface's FIELD validation declarations, each naming the
+ * surface and the field. `[]` means every field is well-formed.
+ *
+ * Runs over every surface in the registry, migrated or not: field declarations
+ * exist independently of the cross-field slot, so the
+ * `CROSS_FIELD_RULES_UNMIGRATED` ratchet does not — and must not — stand
+ * between a field-level `preflight` declaration and this check (DSO-3375-001).
+ */
+export function findMalformedFieldValidationStages(surface) {
+    const out = [];
+    for (const table of surface.tables ?? []) {
+        for (const field of table.fields ?? []) {
+            const validation = field.validation;
+            if (validation === "passthrough")
+                continue;
+            const where = `${surface.label}.${field.field}`;
+            if (!validation || typeof validation !== "object") {
+                out.push(`${where}: \`validation\` must be "passthrough" or ` +
+                    "`{ handler, stage }`");
+                continue;
+            }
+            const keys = Object.keys(validation).sort();
+            const expected = [...FIELD_VALIDATION_KEYS].sort();
+            if (keys.join(",") !== expected.join(",")) {
+                out.push(`${where}: \`validation\` declares ${keys.join(", ") || "no keys"} — ` +
+                    `exactly ${expected.join(" and ")}, and nothing else: the slot ` +
+                    "classifies, it does not carry behavior knobs");
+            }
+            const handler = validation.handler;
+            const modulePath = preflightHandlerModule(handler);
+            if (!modulePath) {
+                out.push(`${where}: handler ${JSON.stringify(handler)} is not a ` +
+                    '"<module>#<export>" reference');
+            }
+            const stage = validation.stage;
+            if (!CROSS_FIELD_RULE_STAGES.includes(stage)) {
+                out.push(`${where}: stage ${JSON.stringify(stage)} is not one of ` +
+                    CROSS_FIELD_RULE_STAGES.join(", ") +
+                    " — a field handler says when it runs");
+            }
+            else if (stage === "preflight" &&
+                modulePath &&
+                !modulePath.startsWith(PREFLIGHT_HANDLER_MODULE_PREFIX)) {
+                out.push(`${where}: a \`preflight\` handler is vendored into the CLI, so its ` +
+                    `module lives under ${PREFLIGHT_HANDLER_MODULE_PREFIX} — ` +
+                    `"${modulePath}" does not`);
+            }
+        }
+    }
+    return out.sort();
+}
+/**
+ * Every `preflight` declaration on this surface whose handler the walk did not
+ * reach, each naming the surface, the rule (or field), the handler and the
+ * entry point.
+ *
+ * The FIELD half runs on every surface. The CROSS-FIELD half runs only where a
+ * surface has declared, because `crossFieldRulesForStage` throws for one that
+ * has not — "not declared yet" is never "rule-free" (#3373), and asking it
+ * here would turn an unmigrated surface into a crash rather than a skip.
+ */
+export function findUnreachedPreflightRules(surface, reached, entry) {
+    const out = [];
+    const unreached = (subject, handler) => `${surface.label}: ${subject} is declared \`preflight\`, but its handler ` +
+        `${handler} is not reached from ${entry} — a preflight rule runs before ` +
+        "the first mutating call, or it is not preflight";
+    for (const table of surface.tables ?? []) {
+        for (const field of table.fields ?? []) {
+            const validation = field.validation;
+            if (!validation || typeof validation !== "object")
+                continue;
+            const { handler, stage } = validation;
+            if (stage !== "preflight")
+                continue;
+            const reference = String(handler);
+            if (reached.has(reference))
+                continue;
+            out.push(unreached(`field \`${field.field}\``, reference));
+        }
+    }
+    if (hasDeclaredCrossFieldRules(surface)) {
+        for (const rule of crossFieldRulesForStage(surface, "preflight")) {
+            if (reached.has(rule.handler))
+                continue;
+            out.push(unreached(`rule "${rule.id}"`, rule.handler));
+        }
+    }
+    return out.sort();
+}
 /**
  * Protocol keys every config UPDATE accepts, whichever object it is.
  *
@@ -2467,92 +3084,170 @@ export function parseFunctionManifest(value) {
         errors: [],
     };
 }
-export const FUNCTION_MODES = ["request", "task"];
+// ── src/config-surface/function-retired-keys.ts ──────────────────────────
+/**
+ * The runtime keys a `functions/<key>.toml` no longer decides anything with —
+ * #3482, project `server-functions` phase 4.
+ *
+ * The sponsor settled it on 2026-09-15 (the intent, "Mode vocabulary?",
+ * amended again): the config says NOTHING about how a function runs. A
+ * function is a function; the caller picks the runtime at each call, cron
+ * fires always start a task run, webhook deliveries always run as a request,
+ * and a function that must not run under one runtime tests for it in code with
+ * `assertRuntime`.
+ *
+ * ── Why these keys are accepted, not refused ──────────────────────────────
+ *
+ * Every tree pushed since #3454 that declares a cron trigger carries
+ * `mode = …` ON THE ENTRY, because `cron-trigger-mode-required` demanded it;
+ * plenty carry a top-level `mode` or the older `durable`. Removing the keys
+ * from the accepted set outright would refuse those trees with an unknown-key
+ * error one day after the platform insisted on them, which is the opposite of
+ * principle 5 inside a non-breaking phase.
+ *
+ * So through phase 4 they are ACCEPTED and IGNORED, with one warning per key
+ * naming it and the line to delete; from phase 5 (#3188) they are refused with
+ * the rest of the retirement matrix. The value is not validated — there is
+ * nothing left to validate it against, and refusing a bad value for a key
+ * nobody reads would be a refusal about spelling alone.
+ *
+ * Pure: no models, no tenant context, no `env` (see `types.ts` §Purity). Both
+ * the CLI preflight (vendored by `cli/scripts/gen-config-surfaces.mjs`) and the
+ * admin config-version route read this one scanner, so the warning an author
+ * sees from `config push` is the sentence the API answers with.
+ */
+/** The two `[function]` keys that no longer say anything (#3482). */
+export const RETIRED_FUNCTION_RUNTIME_KEYS = ["mode", "durable"];
+const RUNTIME_IS_THE_CALLERS = "a function is a function, and the caller picks the runtime at each call — " +
+    "`invoke` runs it inside the request, `start` runs it as a task";
+const FROM_PHASE_5 = "Remove the line; from phase 5 it is refused.";
 /**
- * Resolve `mode` and its alias `durable` to one mode.
+ * Every retired runtime key a `[function]` table still carries.
+ *
+ * Reads the table the way the author wrote it: the two top-level keys, and a
+ * `mode` on each `[[function.triggers.cron]]` entry. A cron entry's sentence
+ * says the extra thing its author needs to hear — that the schedule no longer
+ * chooses, because every fire starts a task run (#3334's runner branch is
+ * gone).
  *
- * Absent both → `request`. `mode` must be exactly `"request"` or `"task"`;
- * `durable` must be a boolean. Both present and disagreeing is refused naming
- * both keys, so an author who half-migrated a file hears which line to fix.
+ * Order is the order an author reads their file in: the top-level keys first,
+ * then the cron entries in declaration order.
  */
-export function resolveDeclaredMode(input) {
-    const rawMode = input?.mode;
-    const rawDurable = input?.durable;
-    const hasMode = rawMode !== undefined && rawMode !== null;
-    const hasDurable = rawDurable !== undefined && rawDurable !== null;
-    let fromMode = null;
-    if (hasMode) {
-        if (typeof rawMode !== "string" || !FUNCTION_MODES.includes(rawMode)) {
-            return {
-                ok: false,
-                error: `\`mode\` must be "request" or "task" (got ${describe(rawMode)}): a ` +
-                    "request function runs inside the call and returns its result; a " +
-                    "task function returns a run id and survives restarts",
-            };
-        }
-        fromMode = rawMode;
-    }
-    let fromDurable = null;
-    if (hasDurable) {
-        if (typeof rawDurable !== "boolean") {
-            return {
-                ok: false,
-                error: `\`durable\` must be true or false (got ${describe(rawDurable)}); it is ` +
-                    'the accepted alias for `mode = "task"` / `mode = "request"`',
-            };
-        }
-        fromDurable = rawDurable ? "task" : "request";
-    }
-    if (fromMode && fromDurable && fromMode !== fromDurable) {
-        return {
-            ok: false,
-            error: `\`mode = "${fromMode}"\` and \`durable = ${String(rawDurable)}\` disagree: ` +
-                '`durable` is the accepted alias for `mode = "task"` (true) and ' +
-                '`mode = "request"` (false), so keep one key, or make the two agree',
-        };
+export function ignoredFunctionKeys(functionTable) {
+    const table = functionTable;
+    if (!table || typeof table !== "object" || Array.isArray(table))
+        return [];
+    const found = [];
+    for (const key of RETIRED_FUNCTION_RUNTIME_KEYS) {
+        if (table[key] === undefined)
+            continue;
+        found.push({
+            path: key,
+            message: `\`${key}\` is ignored (#3482): ${RUNTIME_IS_THE_CALLERS}. ${FROM_PHASE_5}`,
+        });
     }
-    const mode = fromMode ?? fromDurable ?? "request";
-    return { ok: true, mode, declared: hasMode || hasDurable };
+    const triggers = table.triggers;
+    const rawCron = triggers && typeof triggers === "object" && !Array.isArray(triggers)
+        ? triggers.cron
+        : undefined;
+    const entries = Array.isArray(rawCron)
+        ? rawCron
+        : rawCron && typeof rawCron === "object"
+            ? [rawCron]
+            : [];
+    entries.forEach((entry, index) => {
+        if (!entry || typeof entry !== "object" || Array.isArray(entry))
+            return;
+        if (entry.mode === undefined)
+            return;
+        const rawName = entry.name;
+        const name = typeof rawName === "string" && rawName ? rawName : `#${index + 1}`;
+        found.push({
+            path: `triggers.cron.${name}.mode`,
+            message: `\`mode\` on cron trigger '${name}' is ignored (#3482): every cron ` +
+                `fire starts a task run, and ${RUNTIME_IS_THE_CALLERS}. ${FROM_PHASE_5}`,
+        });
+    });
+    return found;
 }
 /**
- * The mode a stored config-version row runs in.
- *
- * The column is `durable`; a row written before #3281 carries only that, and a
- * row written after it carries the same thing, so there is exactly one reading.
+ * The database types a `[function]` table's retired trigger block names —
+ * #3483.
+ *
+ * Beside `ignoredFunctionKeys` because it answers the same question about the
+ * same table, for the same reader: `config pull` writes a version's AUTHORED
+ * bytes, and a version pushed before the removal carries the block. Without
+ * this the pulled tree would be refused on its next push — a tree an author
+ * cannot get back into a working state, which is the failure D3482-007 already
+ * had to close for the runtime keys.
+ *
+ * This is NOT a refusal and shares nothing with one. The block is refused on
+ * input by `normalizeTriggerDeclaration`; what a strip needs is the list of
+ * entries it is taking out so it can say so, which is why an entry whose
+ * `type` is unreadable still counts as one entry (the empty string). It is the
+ * block's PRESENCE that goes, not its contents.
+ *
+ * TOML spells the block three ways — an array of tables, a single table, and
+ * an inline array — and a scan that missed one would leave a key behind
+ * (CR3482-002's lesson, applied to a whole table).
  */
-export function configMode(row) {
-    return row?.durable === true ? "task" : "request";
+export function retiredDatabaseTriggerTypes(functionTable) {
+    const raw = retiredDatabaseTriggerValue(functionTable);
+    if (raw === undefined || raw === null)
+        return [];
+    const entries = Array.isArray(raw) ? raw : [raw];
+    return entries.map((entry) => {
+        if (!entry || typeof entry !== "object" || Array.isArray(entry))
+            return "";
+        const type = entry.type;
+        return typeof type === "string" ? type : String(type ?? "");
+    });
 }
-/** Is this mode the durable one? The adjective, for the paths that branch on it. */
-export function isDurableMode(mode) {
-    return mode === "task";
+/**
+ * Whether the block is THERE at all — the question a strip has to ask, which
+ * the type list above cannot answer (CR3483-001).
+ *
+ * `database = []` names no type, so the list is empty and a strip that decided
+ * by its length left the key in the pulled file. That file then fails its own
+ * next push: `normalizeTriggerDeclaration` refuses the key by PRESENCE, of any
+ * shape, an empty array included — so the two halves disagreed about what the
+ * block is, and the tree an author pulled was a tree they could not push.
+ * Presence is the one rule both sides read now, spelled the way
+ * `normalizeTriggerDeclaration` spells it — `!== undefined` — so a value one
+ * of them would call a block and the other would not cannot exist.
+ */
+export function hasRetiredDatabaseTriggerBlock(functionTable) {
+    return retiredDatabaseTriggerValue(functionTable) !== undefined;
 }
-function describe(value) {
-    if (typeof value === "string")
-        return JSON.stringify(value);
-    if (value === null)
-        return "null";
-    if (typeof value === "object")
-        return Array.isArray(value) ? "an array" : "a table";
-    return String(value);
+/**
+ * The raw `[function.triggers].database` value, or `undefined` when the block
+ * is absent. One walk down to the key, so presence and contents can never be
+ * read off two different traversals.
+ */
+function retiredDatabaseTriggerValue(functionTable) {
+    const table = functionTable;
+    if (!table || typeof table !== "object" || Array.isArray(table)) {
+        return undefined;
+    }
+    const triggers = table.triggers;
+    if (!triggers || typeof triggers !== "object" || Array.isArray(triggers)) {
+        return undefined;
+    }
+    return triggers.database;
 }
 /**
- * Why a webhook cannot drive a task function, and what to do instead (#3334).
+ * The same scan, rendered for one file — the shape `config push` and
+ * `config diff` print and the admin route answers with.
  *
- * The first clause is verbatim what it has always been, so sibling pins on the
- * request-mode prefix (#3281's) keep holding; everything after the dash is the
- * half that was missing — an author who meets this at the push door could not
- * previously tell whether it was a limitation or a design, nor what to write.
+ * `label` is what the reader can act on: `functions/<key>.toml` from the CLI,
+ * and the function's key from the API, which has no file to name.
  */
-export const WEBHOOK_ON_TASK_REFUSAL = "webhook triggers require request mode: set `mode = \"request\"` (or " +
-    "remove `mode = \"task\"`) — a webhook delivery needs its answer inside the " +
-    "request, and a task run has none to give there: verify and acknowledge in " +
-    "the request function, then hand the work to a task function with " +
-    "ctx.functions.start — or remove [function.triggers.webhook]";
+export function ignoredFunctionKeyWarnings(label, functionTable) {
+    return ignoredFunctionKeys(functionTable).map((ignored) => `${label}: ${ignored.message}`);
+}
 export const EMPTY_TRIGGER_DECLARATION = {
     webhook: null,
     cron: [],
-    databases: [],
 };
 /**
  * The most cron entries one function may declare.
@@ -2570,22 +3265,6 @@ export const MAX_CRON_TRIGGERS_PER_FUNCTION = 10;
  * collide with (the intent, "Key namespace?").
  */
 const CRON_NAME_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9_-]*$/;
-/**
- * The most database types one function may watch (#3184, D-07).
- *
- * Per-OBJECT, like the cron cap above: a function watching more than a handful
- * of types is describing a fan-in the platform cannot bound per write, and
- * every extra type is another discovery read on somebody's write path.
- */
-export const MAX_DATABASE_TRIGGERS_PER_FUNCTION = 5;
-/**
- * A database type key, matching the charset the grant grammar already uses for
- * the same value (`src/config-surface/function-grants.ts`). One rule for one
- * concept: `database:<type>/<model>:read` and `[[function.triggers.database]]`
- * name the same thing.
- */
-const DATABASE_TYPE_PATTERN = /^[A-Za-z0-9_-]+$/;
-const DATABASE_KEYS = new Set(["type"]);
 const WEBHOOK_KEYS = new Set([
     "verificationScheme",
     "signingSecret",
@@ -2599,18 +3278,67 @@ const WEBHOOK_KEYS = new Set([
 const CRON_KEYS = new Set([
     "name",
     "cron",
+    // #3482 — RETIRED and still accepted. `cron-trigger-mode-required` demanded
+    // this key on every default-mode function since #3454, so every tree pushed
+    // with a cron entry since then carries it; dropping it from the accepted set
+    // would refuse those trees with an unknown-key error one day after the
+    // platform insisted on it (D3482-006). Ignored, warned about at the push
+    // door, and refused from phase 5.
+    "mode",
     "timezone",
     "overlapPolicy",
     "rootInput",
 ]);
 const VALID_OVERLAP_POLICIES = ["skip", "allow"];
+/**
+ * The rule ids this module owns — one per refusal, declared on the `function`
+ * surface (#3374). The union below closes `refuseTrigger`'s id parameter, so a
+ * twenty-seventh refusal cannot compile without a twenty-seventh id, and that
+ * id fails `cli-unit-tests` until the surface declares it (#3373's anchor).
+ */
+export const TRIGGER_RULE_IDS = [
+    "triggers-table",
+    "trigger-kind",
+    // #3483 — one refusal replaced the eight that shaped the block. There is no
+    // shape left to get right; the block itself is what is refused.
+    "database-trigger-removed",
+    "webhook-trigger-single",
+    "webhook-trigger-table",
+    "webhook-trigger-keys",
+    "webhook-trigger-scheme-required",
+    "webhook-trigger-scheme-none",
+    "webhook-trigger-number",
+    "webhook-trigger-dedup-boolean",
+    "webhook-trigger-verification-table",
+    "cron-trigger-cap",
+    "cron-trigger-entry",
+    "cron-trigger-keys",
+    "cron-trigger-name-required",
+    "cron-trigger-name-charset",
+    "cron-trigger-duplicate",
+    "cron-trigger-expression-required",
+    "cron-trigger-overlap-policy",
+];
+/**
+ * A broken trigger rule. `ruleId` names which one, for a reader that wants to
+ * branch without matching prose; every existing site reads `message` only.
+ * Optional so `new TriggerDeclarationError(message)` — the CLI's own parse
+ * refusal in `function-sync.ts` — keeps constructing.
+ */
 export class TriggerDeclarationError extends Error {
+    ruleId;
+    constructor(message, ruleId) {
+        super(message);
+        this.ruleId = ruleId;
+    }
+}
+/** The one `throw` in this module: every refusal names its rule here. */
+function refuseTrigger(ruleId, message) {
+    throw new TriggerDeclarationError(message, ruleId);
 }
 /** Is anything at all declared? Used to skip work on the common case. */
 export function hasDeclaredTriggers(declaration) {
-    return (declaration.webhook !== null ||
-        declaration.cron.length > 0 ||
-        declaration.databases.length > 0);
+    return declaration.webhook !== null || declaration.cron.length > 0;
 }
 /**
  * Normalize the `triggers` table of an already-parsed `[function]` table.
@@ -2621,114 +3349,72 @@ export function hasDeclaredTriggers(declaration) {
  * push boundary can normalize a declaration it read from a stored row without
  * re-parsing bytes.
  */
-export function normalizeTriggerDeclaration(functionTable, options = {}) {
+export function normalizeTriggerDeclaration(functionTable) {
     const triggers = functionTable?.triggers;
     if (triggers === undefined || triggers === null) {
         return EMPTY_TRIGGER_DECLARATION;
     }
     if (typeof triggers !== "object" || Array.isArray(triggers)) {
-        throw new TriggerDeclarationError("[function.triggers] must be a table declaring `webhook` and/or `cron`");
+        refuseTrigger("triggers-table", "[function.triggers] must be a table declaring `webhook` and/or `cron`");
+    }
+    // #3483 — checked BEFORE the unknown-kind rule, so an author who declares
+    // the block hears why it went rather than that `database` is not a word the
+    // platform knows. Any shape of the key is the same refusal: it is the
+    // block's PRESENCE that is refused, and an author who wrote
+    // `triggers.database = []` still has a line to delete.
+    if (triggers.database !== undefined) {
+        refuseTrigger("database-trigger-removed", DATABASE_TRIGGER_REMOVED);
     }
     for (const key of Object.keys(triggers)) {
-        if (key !== "webhook" && key !== "cron" && key !== "database") {
-            throw new TriggerDeclarationError(`unknown trigger kind '${key}' under [function.triggers]: the kinds are ` +
-                "`webhook`, `cron` and `database`");
+        if (key !== "webhook" && key !== "cron") {
+            refuseTrigger("trigger-kind", `unknown trigger kind '${key}' under [function.triggers]: the kinds are ` +
+                "`webhook` and `cron`");
         }
     }
-    const webhook = normalizeWebhook(triggers.webhook, options);
-    const cron = normalizeCron(triggers.cron, options);
-    const databases = normalizeDatabases(triggers.database, options);
-    return { webhook, cron, databases };
+    const webhook = normalizeWebhook(triggers.webhook);
+    const cron = normalizeCron(triggers.cron);
+    return { webhook, cron };
 }
 /**
- * `[[function.triggers.database]]` — one accepted key, `type` (#3184, D-07).
- *
- * Sync mode only, permanently: a database-change fire runs INSIDE the write
- * request, best-effort, with no run row (the intent, "Sync functions write a
- * run row?"), and there is no durable shape for that. This is the same
- * permanent refusal `webhook` carries, not the release-scoped one `cron` does.
+ * The sentence an author who declared the block is owed — D3483-001.
+ *
+ * It names the pattern that replaces the trigger rather than only saying the
+ * trigger is gone, because the author's problem is not "how do I spell this"
+ * but "where does this work go now". The answer is: into the handler that
+ * writes the row. Database access moves behind server functions (phase 6
+ * retires the client's direct database paths), so the code that writes a
+ * record is already a function — a trigger fired by that write has no caller
+ * it cannot already see.
  */
-function normalizeDatabases(raw, options) {
-    if (raw === undefined || raw === null)
-        return [];
-    const entries = Array.isArray(raw) ? raw : [raw];
-    if (entries.length === 0)
-        return [];
-    if (options.mode === "task") {
-        throw new TriggerDeclarationError("database triggers require request mode: set `mode = \"request\"` (or " +
-            "remove `mode = \"task\"`), or remove the [[function.triggers.database]] " +
-            "entries");
-    }
-    if (entries.length > MAX_DATABASE_TRIGGERS_PER_FUNCTION) {
-        throw new TriggerDeclarationError(`a function may watch at most ${MAX_DATABASE_TRIGGERS_PER_FUNCTION} database ` +
-            `types, and this one declares ${entries.length}`);
-    }
-    const seen = new Set();
-    const normalized = [];
-    for (const entry of entries) {
-        if (entry === null || typeof entry !== "object" || Array.isArray(entry)) {
-            throw new TriggerDeclarationError("each [[function.triggers.database]] entry must be a table");
-        }
-        const table = entry;
-        for (const key of Object.keys(table)) {
-            if (!DATABASE_KEYS.has(key)) {
-                throw new TriggerDeclarationError(`unknown key '${key}' in a [[function.triggers.database]] entry: the ` +
-                    `only accepted key is ${[...DATABASE_KEYS].join(", ")}`);
-            }
-        }
-        const type = String(table.type ?? "").trim();
-        if (!type) {
-            throw new TriggerDeclarationError("each [[function.triggers.database]] entry needs a `type`: it names the " +
-                "database type whose writes fire the function");
-        }
-        if (!DATABASE_TYPE_PATTERN.test(type)) {
-            throw new TriggerDeclarationError(`database trigger type '${type}' must contain only letters, digits, ` +
-                "'-' or '_'");
-        }
-        if (seen.has(type)) {
-            throw new TriggerDeclarationError(`duplicate database trigger type '${type}': a function fires once per ` +
-                "write request, so each type is declared once");
-        }
-        seen.add(type);
-        normalized.push({ type });
-    }
-    // Sorted, like the cron entries: two files that differ only in the order
-    // they list their blocks describe the same triggers.
-    normalized.sort((a, b) => a.type.localeCompare(b.type));
-    return normalized;
-}
-function normalizeWebhook(raw, options) {
+const DATABASE_TRIGGER_REMOVED = "[[function.triggers.database]] is no longer supported (#3483): database " +
+    "access moves behind functions, so the code that writes the record is a " +
+    "function — do the follow-up in the handler that writes (write the row, " +
+    "then publish, notify or write again), or hand longer work to a task with " +
+    "ctx.functions.start. Remove the block.";
+function normalizeWebhook(raw) {
     if (raw === undefined || raw === null)
         return null;
     if (Array.isArray(raw)) {
         // `[[function.triggers.webhook]]` — the shape that would declare two.
-        throw new TriggerDeclarationError("[function.triggers.webhook] is a single table: one webhook trigger per " +
+        refuseTrigger("webhook-trigger-single", "[function.triggers.webhook] is a single table: one webhook trigger per " +
             "function (the intent, \"Webhook trigger URL and scheme?\")");
     }
     if (typeof raw !== "object") {
-        throw new TriggerDeclarationError("[function.triggers.webhook] must be a table");
+        refuseTrigger("webhook-trigger-table", "[function.triggers.webhook] must be a table");
     }
     const table = raw;
     for (const key of Object.keys(table)) {
         if (!WEBHOOK_KEYS.has(key)) {
-            throw new TriggerDeclarationError(`unknown key '${key}' under [function.triggers.webhook]: accepted keys ` +
+            refuseTrigger("webhook-trigger-keys", `unknown key '${key}' under [function.triggers.webhook]: accepted keys ` +
                 `are ${[...WEBHOOK_KEYS].join(", ")}`);
         }
     }
-    // The intent forbids this permanently: a webhook fires the function inside
-    // the receiver, and the provider is holding the connection open waiting for
-    // its answer. A task run has no answer to give inside that request — it
-    // returns a run id and finishes later — so the refusal says so and names
-    // the pattern that does the same job (#3334).
-    if (options.mode === "task") {
-        throw new TriggerDeclarationError(WEBHOOK_ON_TASK_REFUSAL);
-    }
     const scheme = String(table.verificationScheme ?? "").trim();
     if (!scheme) {
-        throw new TriggerDeclarationError("[function.triggers.webhook] verificationScheme is required");
+        refuseTrigger("webhook-trigger-scheme-required", "[function.triggers.webhook] verificationScheme is required");
     }
     if (scheme === "none") {
-        throw new TriggerDeclarationError("verification scheme 'none' is not allowed for function triggers: an " +
+        refuseTrigger("webhook-trigger-scheme-none", "verification scheme 'none' is not allowed for function triggers: an " +
             "unauthenticated caller could run the function");
     }
     const declaration = { verificationScheme: scheme };
@@ -2745,13 +3431,13 @@ function normalizeWebhook(raw, options) {
             continue;
         const value = Number(table[key]);
         if (!Number.isFinite(value)) {
-            throw new TriggerDeclarationError(`[function.triggers.webhook] ${key} must be a number`);
+            refuseTrigger("webhook-trigger-number", `[function.triggers.webhook] ${key} must be a number`);
         }
         declaration[key] = value;
     }
     if (table.deduplicationEnabled !== undefined) {
         if (typeof table.deduplicationEnabled !== "boolean") {
-            throw new TriggerDeclarationError("[function.triggers.webhook] deduplicationEnabled must be a boolean");
+            refuseTrigger("webhook-trigger-dedup-boolean", "[function.triggers.webhook] deduplicationEnabled must be a boolean");
         }
         declaration.deduplicationEnabled = table.deduplicationEnabled;
     }
@@ -2760,58 +3446,56 @@ function normalizeWebhook(raw, options) {
         if (verification === null ||
             typeof verification !== "object" ||
             Array.isArray(verification)) {
-            throw new TriggerDeclarationError("[function.triggers.webhook.verification] must be a table");
+            refuseTrigger("webhook-trigger-verification-table", "[function.triggers.webhook.verification] must be a table");
         }
         declaration.verification = jsonSafe(verification);
     }
     return declaration;
 }
-function normalizeCron(raw, options) {
+function normalizeCron(raw) {
     if (raw === undefined || raw === null)
         return [];
     const entries = Array.isArray(raw) ? raw : [raw];
     if (entries.length === 0)
         return [];
-    // No mode check: a cron entry is legal in EITHER mode (#3334). The intent
-    // allows it ("Sync functions write a run row?": *HTTP and cron allow both*),
-    // and the cron DO starts a durable run for a task target. #3181's refusal
-    // here was release-scoped, written before task starts existed, and its own
-    // comment asked for exactly this one-line removal.
     if (entries.length > MAX_CRON_TRIGGERS_PER_FUNCTION) {
-        throw new TriggerDeclarationError(`a function may declare at most ${MAX_CRON_TRIGGERS_PER_FUNCTION} cron ` +
+        refuseTrigger("cron-trigger-cap", `a function may declare at most ${MAX_CRON_TRIGGERS_PER_FUNCTION} cron ` +
             `trigger entries, and this one declares ${entries.length}`);
     }
     const seen = new Set();
     const normalized = [];
     for (const entry of entries) {
         if (entry === null || typeof entry !== "object" || Array.isArray(entry)) {
-            throw new TriggerDeclarationError("each [[function.triggers.cron]] entry must be a table");
+            refuseTrigger("cron-trigger-entry", "each [[function.triggers.cron]] entry must be a table");
         }
         const table = entry;
         for (const key of Object.keys(table)) {
             if (!CRON_KEYS.has(key)) {
-                throw new TriggerDeclarationError(`unknown key '${key}' in a [[function.triggers.cron]] entry: accepted ` +
+                refuseTrigger("cron-trigger-keys", `unknown key '${key}' in a [[function.triggers.cron]] entry: accepted ` +
                     `keys are ${[...CRON_KEYS].join(", ")}`);
             }
         }
         const name = String(table.name ?? "").trim();
         if (!name) {
-            throw new TriggerDeclarationError("each [[function.triggers.cron]] entry needs a `name`: it is required " +
+            refuseTrigger("cron-trigger-name-required", "each [[function.triggers.cron]] entry needs a `name`: it is required " +
                 "because it is half of the trigger's key, `<functionKey>:<name>`");
         }
         if (!CRON_NAME_PATTERN.test(name)) {
-            throw new TriggerDeclarationError(`cron trigger name '${name}' must start with a letter or digit and ` +
+            refuseTrigger("cron-trigger-name-charset", `cron trigger name '${name}' must start with a letter or digit and ` +
                 "contain only letters, digits, '-' or '_'");
         }
         if (seen.has(name)) {
-            throw new TriggerDeclarationError(`duplicate cron trigger name '${name}': names are the trigger's key ` +
+            refuseTrigger("cron-trigger-duplicate", `duplicate cron trigger name '${name}': names are the trigger's key ` +
                 "within the function, so each must appear once");
         }
         seen.add(name);
         const cron = String(table.cron ?? "").trim();
         if (!cron) {
-            throw new TriggerDeclarationError(`cron trigger '${name}' needs a \`cron\` expression`);
+            refuseTrigger("cron-trigger-expression-required", `cron trigger '${name}' needs a \`cron\` expression`);
         }
+        // #3482 — no runner branch here any more. Every cron fire starts a task
+        // run, so an entry's `mode` decides nothing; it is accepted (D3482-006),
+        // reported as ignored by `ignoredFunctionKeys`, and dropped.
         const declaration = { name, cron };
         if (table.timezone !== undefined) {
             declaration.timezone = String(table.timezone);
@@ -2819,7 +3503,7 @@ function normalizeCron(raw, options) {
         if (table.overlapPolicy !== undefined) {
             const policy = String(table.overlapPolicy);
             if (!VALID_OVERLAP_POLICIES.includes(policy)) {
-                throw new TriggerDeclarationError(`cron trigger '${name}': overlapPolicy must be one of ` +
+                refuseTrigger("cron-trigger-overlap-policy", `cron trigger '${name}': overlapPolicy must be one of ` +
                     VALID_OVERLAP_POLICIES.join(", "));
             }
             declaration.overlapPolicy = policy;
@@ -2880,15 +3564,39 @@ export function parseStoredTriggerDeclaration(stored) {
         return {
             webhook: parsed?.webhook ?? null,
             cron: Array.isArray(parsed?.cron) ? parsed.cron : [],
-            // Absent in every row written before #3184, which is exactly what an
-            // empty list means: that version watches no database type.
-            databases: Array.isArray(parsed?.databases) ? parsed.databases : [],
+            // #3483 — a stored `databases` key is DROPPED, not read. A version
+            // pushed before the refusal existed still carries one in its immutable
+            // JSON, and the row is never rewritten; answering nothing at all is what
+            // makes that version inert at every reader at once.
+            // `storedDatabaseTriggerTypes` below is how a caller that wants to SAY
+            // something about it still can.
         };
     }
     catch {
         return EMPTY_TRIGGER_DECLARATION;
     }
 }
+/**
+ * The database types a STORED declaration used to watch, for a reader that
+ * wants to name them — #3483.
+ *
+ * Pure, and separate from the parse on purpose: the parse answers what the
+ * version means NOW (nothing), and this answers what it said, which is only
+ * ever used to write one log line. Nothing branches on it.
+ */
+export function storedDatabaseTriggerTypes(stored) {
+    if (typeof stored !== "string" || !stored.trim())
+        return [];
+    try {
+        const parsed = JSON.parse(stored);
+        if (!Array.isArray(parsed?.databases))
+            return [];
+        return parsed.databases.map((entry) => String(entry?.type ?? ""));
+    }
+    catch {
+        return [];
+    }
+}
 /** The `CronTrigger.triggerKey` an entry owns. */
 export function cronTriggerKeyFor(functionKey, name) {
     return `${functionKey}:${name}`;
@@ -3141,6 +3849,27 @@ export function requiresSigningSecret(scheme) {
 /** The coded refusals, so a client can branch without matching prose. */
 export const SIGNING_SECRET_MUST_BE_SECRET_REF = "SIGNING_SECRET_MUST_BE_SECRET_REF";
 export const SIGNING_SECRET_NOT_SUPPORTED_FOR_SCHEME = "SIGNING_SECRET_NOT_SUPPORTED_FOR_SCHEME";
+/**
+ * The rule ids this module owns, declared on the `function` surface as
+ * `preflight` and on the `webhook` surface as `apply` (#3374) — one rule, two
+ * surfaces, one handler. `whole-secret-reference` is generic on purpose:
+ * `validateWholeSecretReference` is reused by the Google client secret and by
+ * both webhook controllers under their own labels and codes.
+ */
+export const SIGNING_SECRET_RULE_IDS = [
+    "signing-secret-required",
+    "whole-secret-reference",
+    "signing-secret-not-supported",
+];
+/** The one refusal constructor (#3373's anchor). */
+function refuseSigningSecret(ruleId, message, extra = {}) {
+    const refusal = { ruleId, message };
+    if (extra.code !== undefined)
+        refusal.code = extra.code;
+    if (extra.plain !== undefined)
+        refusal.plain = extra.plain;
+    return refusal;
+}
 /** The reference-only message, shared by every field that carries one. */
 export function wholeSecretReferenceMessage(label) {
     return (`${label} must be a whole {{secrets.KEY}} reference to an app secret, not ` +
@@ -3159,7 +3888,7 @@ export function wholeSecretReferenceMessage(label) {
 export function validateWholeSecretReference(label, value, code) {
     if (typeof value === "string" && isWholeSecretReference(value))
         return null;
-    return { message: wholeSecretReferenceMessage(label), code };
+    return refuseSigningSecret("whole-secret-reference", wholeSecretReferenceMessage(label), { code });
 }
 /**
  * The whole file-decidable `signingSecret` rule, in the order the standalone
@@ -3175,21 +3904,67 @@ export function validateSigningSecretDeclaration(input) {
     const scheme = input.verificationScheme;
     if (requiresSigningSecret(scheme)) {
         if (!input.signingSecret) {
-            return {
-                message: `signingSecret is required for verification scheme '${scheme}'`,
-                plain: true,
-            };
+            return refuseSigningSecret("signing-secret-required", `signingSecret is required for verification scheme '${scheme}'`, { plain: true });
         }
         return validateWholeSecretReference("signingSecret", input.signingSecret, SIGNING_SECRET_MUST_BE_SECRET_REF);
     }
     if (input.signingSecret !== undefined &&
         input.signingSecret !== null &&
         input.signingSecret !== "") {
-        return {
-            message: `signingSecret is not supported for verification scheme '${scheme}' — ` +
-                "its key material comes from the scheme's config.",
-            code: SIGNING_SECRET_NOT_SUPPORTED_FOR_SCHEME,
-        };
+        return refuseSigningSecret("signing-secret-not-supported", `signingSecret is not supported for verification scheme '${scheme}' — ` +
+            "its key material comes from the scheme's config.", { code: SIGNING_SECRET_NOT_SUPPORTED_FOR_SCHEME });
+    }
+    return null;
+}
+// ── src/config-surface/workflow-rules.ts ─────────────────────────────────
+/**
+ * The workflow rules two runners share (#3374, project `cli-server-rule-parity`
+ * phase 2; intent §Success criteria 3).
+ *
+ * ── One predicate, two messages ──────────────────────────────────────────
+ *
+ * `runAs = "system"` beside a non-empty `accessRule` is dead config: a system
+ * run can only be started by the system and never evaluates its access rule
+ * (#1258, broadening #1172). The server refused it at save time
+ * (`validateWorkflowIdentityConfig`) and the CLI refused it in the push
+ * preflight (`validateWorkflowIdentity`), and the two carried the conjunction
+ * byte-for-byte as separate copies kept in step by a comment. This module is
+ * the one copy: it decides, and returns a STRUCTURED violation — the rule id
+ * and the server's sentence — that each site renders in its own words. The
+ * server pushes the sentence into its `string[]`; the CLI keeps its own hint,
+ * which names the preflight remedy. Neither message changed.
+ *
+ * ── Why a `*-rules.ts` module ────────────────────────────────────────────
+ *
+ * The registry's unclaimed-export check (`findUnclaimedRuleModuleExports`)
+ * keys on this name under `src/config-surface/`: every exported function here
+ * is a rule, so one no surface declares fails `cli-unit-tests`. Shared
+ * predicates that are not rules live elsewhere (`webhook-signing-secret.ts`).
+ * The module is vendored into the CLI artifact like the rest of the
+ * directory, which is what lets `workflow`'s declaration call the rule
+ * `preflight`.
+ */
+/** The rule ids this module owns — the union type below anchors them (#3373). */
+export const WORKFLOW_RULE_IDS = ["system-access-rule"];
+/** The one refusal constructor: a new branch cannot compile without an id. */
+function refuseWorkflowRule(ruleId, message) {
+    return { ruleId, message };
+}
+/**
+ * `runAs = "system"` with a non-empty string `accessRule`, or null.
+ *
+ * Exactly the conjunction both sites carried: a default, unset, empty or
+ * whitespace-only rule is no rule, and a non-string one (`accessRule = false`)
+ * is malformed input for another check to name, not dead config. The message
+ * is the server's save-time sentence; the CLI renders its own hint from the
+ * same answer.
+ */
+export function checkWorkflowSystemAccessRule(input) {
+    const { runAs, accessRule } = input;
+    if (runAs === "system" &&
+        typeof accessRule === "string" &&
+        accessRule.trim() !== "") {
+        return refuseWorkflowRule("system-access-rule", 'runAs:"system" workflows do not evaluate accessRule — remove the accessRule');
     }
     return null;
 }
@@ -3210,7 +3985,20 @@ export function validateSigningSecretDeclaration(input) {
  * (`cli/src/lib/workflow-payload.ts`, #1177), both deleted with this change.
  */
 const HANDLERS = "src/workflows/config/workflow-field-handlers.ts";
-const handler = (name) => handledBy(HANDLERS, name);
+const handler = (name) => handledBy(HANDLERS, name, "apply");
+/**
+ * The save-time rules the server runs and the CLI does not (#3374). They need
+ * the runner's vocabulary (`isValidRunAs`, `GRANTABLE_SENSITIVE_CAPS`), which
+ * this directory cannot import, so they are `apply`; the module carries the
+ * rule-id anchor and `definition-store.ts` re-exports it.
+ */
+const WORKFLOW_SAVE_RULES = "src/workflows/config/workflow-save-rules.ts";
+const workflowApplyRule = (id, exportName, description) => ({
+    id,
+    description,
+    stage: "apply",
+    handler: enforcedBy(WORKFLOW_SAVE_RULES, exportName),
+});
 /**
  * The five per-app / per-user queue limits (#1177). All share one handler: a
  * finite non-negative number, floored.
@@ -3524,7 +4312,464 @@ export const WORKFLOW_SURFACE = {
                 "tables), expanded into `steps` by expandWorkflowTomlData before push.",
         },
     },
+    // ── Cross-field rules (#3374) ─────────────────────────────────────────────
+    //
+    // One rule the CLI's push preflight runs — through the vendored copy of
+    // `workflow-rules.ts` — and seven the server runs at save time. What stays
+    // UNDECLARED, on purpose: the step-body validation (`validateWorkflowDefinition`
+    // and the `steps` structural sub-tree, which is not a field-table rule), and
+    // the enable-time activation lint (`workflow-activation-lint.ts`, a transition
+    // check rather than a write rule). `runAs`'s VALUE is checked twice today —
+    // by its field handler and again inside the identity validator — which is
+    // stated here as a finding, not fixed.
+    crossFieldRules: [
+        {
+            id: "system-access-rule",
+            description: 'A `runAs = "system"` workflow may not carry a non-empty `accessRule`: ' +
+                "a system run never evaluates its rule, so any rule there is dead " +
+                "config. The one predicate both runners share; each renders its own " +
+                "message.",
+            stage: "preflight",
+            handler: enforcedBy("src/config-surface/workflow-rules.ts", "checkWorkflowSystemAccessRule"),
+        },
+        workflowApplyRule("run-as-value", "validateWorkflowIdentityConfig", '`runAs` must be "caller" or "system" when present — the runner has no ' +
+            "third identity."),
+        workflowApplyRule("capabilities-shape", "validateWorkflowIdentityConfig", "`capabilities` must be an array or set of capability strings."),
+        workflowApplyRule("capability-grantable", "validateWorkflowIdentityConfig", "Every declared capability must be one the runner can grant; the " +
+            "always-on data baseline is never declared."),
+        workflowApplyRule("iterate-users-system-only", "validateWorkflowIdentityConfig", 'An `iterate-users` step may appear only in a `runAs = "system"` ' +
+            "workflow — fanning out over every user is not a member-as-themselves " +
+            "operation."),
+        workflowApplyRule("access-rule-type", "validateWorkflowIdentityConfig", "On create, a supplied `accessRule` must be a string — a non-string is " +
+            "malformed input, reported as such rather than as an omission."),
+        workflowApplyRule("access-rule-required", "validateWorkflowIdentityConfig", "On create, a caller-mode workflow must state its `accessRule` (`\"true\"` " +
+            "for any app member), so a locked workflow is a decision rather than a " +
+            "default."),
+        workflowApplyRule("sync-callable-step-kind", "validateSyncCallableSteps", "A `syncCallable = true` workflow may not carry a step kind that only " +
+            "the durable runtime can execute (`delay`, `event.wait`)."),
+    ],
 };
+const FIELD_RANGES = [
+    { name: "minute", min: 0, max: 59 },
+    { name: "hour", min: 0, max: 23 },
+    { name: "day-of-month", min: 1, max: 31 },
+    { name: "month", min: 1, max: 12 },
+    { name: "day-of-week", min: 0, max: 6 },
+];
+function parseField(field, min, max, fieldName) {
+    const result = new Set();
+    const parts = field.split(",");
+    for (const partRaw of parts) {
+        const part = partRaw.trim();
+        if (!part) {
+            throw new Error(`Invalid ${fieldName} field: empty segment`);
+        }
+        let step = 1;
+        let rangePart = part;
+        const slashIdx = part.indexOf("/");
+        if (slashIdx !== -1) {
+            rangePart = part.slice(0, slashIdx);
+            const stepStr = part.slice(slashIdx + 1);
+            const stepNum = Number(stepStr);
+            if (!Number.isInteger(stepNum) || stepNum <= 0) {
+                throw new Error(`Invalid ${fieldName} step: "${stepStr}"`);
+            }
+            step = stepNum;
+        }
+        let lo;
+        let hi;
+        if (rangePart === "*") {
+            lo = min;
+            hi = max;
+        }
+        else if (rangePart.includes("-")) {
+            const [loStr, hiStr] = rangePart.split("-");
+            lo = Number(loStr);
+            hi = Number(hiStr);
+            if (!Number.isInteger(lo) || !Number.isInteger(hi)) {
+                throw new Error(`Invalid ${fieldName} range: "${rangePart}"`);
+            }
+        }
+        else {
+            const exact = Number(rangePart);
+            if (!Number.isInteger(exact)) {
+                throw new Error(`Invalid ${fieldName} value: "${rangePart}"`);
+            }
+            lo = exact;
+            hi = exact;
+        }
+        // Normalize day-of-week 7 -> 0 (Sunday). We only do this for bare
+        // values, not inside a range — `5-7` would otherwise become `5-0`
+        // which then fails the `lo > hi` check with a confusing error. Users
+        // who want Fri–Sun should write `5-0,0` or `5,6,0`; we reject 7 in
+        // ranges outright with a clearer message.
+        if (fieldName === "day-of-week") {
+            const isRange = rangePart.includes("-");
+            if (isRange && (lo === 7 || hi === 7)) {
+                throw new Error(`Invalid day-of-week range "${rangePart}": 7 (Sunday) is only allowed as a single value, not inside a range. Use 0 for Sunday in ranges.`);
+            }
+            if (!isRange) {
+                if (lo === 7)
+                    lo = 0;
+                if (hi === 7)
+                    hi = 0;
+            }
+        }
+        if (lo < min || hi > max || lo > hi) {
+            throw new Error(`Invalid ${fieldName} range: ${lo}-${hi} (allowed ${min}-${max})`);
+        }
+        for (let v = lo; v <= hi; v += step) {
+            result.add(v);
+        }
+    }
+    return result;
+}
+export function parseCron(expr) {
+    if (!expr || typeof expr !== "string") {
+        throw new Error("Cron expression must be a non-empty string");
+    }
+    const fields = expr.trim().split(/\s+/);
+    if (fields.length !== 5) {
+        throw new Error(`Cron expression must have exactly 5 fields, got ${fields.length}: "${expr}"`);
+    }
+    const [minField, hourField, domField, monField, dowField] = fields;
+    const minutes = parseField(minField, FIELD_RANGES[0].min, FIELD_RANGES[0].max, "minute");
+    const hours = parseField(hourField, FIELD_RANGES[1].min, FIELD_RANGES[1].max, "hour");
+    const daysOfMonth = parseField(domField, FIELD_RANGES[2].min, FIELD_RANGES[2].max, "day-of-month");
+    const months = parseField(monField, FIELD_RANGES[3].min, FIELD_RANGES[3].max, "month");
+    const daysOfWeek = parseField(dowField, FIELD_RANGES[4].min, FIELD_RANGES[4].max, "day-of-week");
+    return {
+        minutes,
+        hours,
+        daysOfMonth,
+        months,
+        daysOfWeek,
+        dayOfMonthWild: domField === "*",
+        dayOfWeekWild: dowField === "*",
+    };
+}
+// ─── The two predicates both runners call ───────────────────────────────
+/**
+ * The message `parseCron` would throw for `expr`, or null when it parses.
+ *
+ * The same grammar, asked as a question instead of as an exception, because
+ * both callers want the sentence rather than the control flow: the CLI's push
+ * preflight collects one message per broken entry, and the standalone cron
+ * routes render theirs into a 400 body. `expr` is typed `unknown` because it
+ * arrives as an authored TOML value, where it can be anything at all.
+ */
+export function cronExpressionError(expr) {
+    try {
+        parseCron(expr);
+        return null;
+    }
+    catch (err) {
+        return err?.message || String(err);
+    }
+}
+/**
+ * Whether `Intl.DateTimeFormat` accepts `name` as a timezone.
+ *
+ * This is THE timezone check — before #3376 the identical probe was written
+ * out three times (the function push boundary and the standalone create and
+ * update). Each of those sites keeps its own sentence and its own defaulting;
+ * what they now share is this answer. A non-string is false rather than a
+ * throw, for the same reason as above.
+ */
+export function isValidTimezone(name) {
+    try {
+        new Intl.DateTimeFormat("en-US", { timeZone: name });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+// ── src/config-surface/cron-rules.ts ─────────────────────────────────────
+/**
+ * The cron schedule rules two runners share (#3376, project
+ * `cli-server-rule-parity` phase 4; intent §Success criteria 6).
+ *
+ * ── One implementation, two runners ──────────────────────────────────────
+ *
+ * A cron expression the grammar refuses, and a timezone `Intl` does not know,
+ * are both decidable from the authored file. Before this issue only the SERVER
+ * decided them, inside the apply loop: a `functions/<key>.toml` carrying
+ * either passed `config push`'s preflight, sibling entities were written, and
+ * the function alone was refused — while the command promises that a refusal
+ * means nothing was applied. Now `cli/src/lib/function-sync.ts` and
+ * `src/services/function-trigger-validation.ts` both call the rule below, and
+ * the sentence an author reads is the same on either side of the wire because
+ * it is built in one place.
+ *
+ * ── Why this is a `*-rules.ts` module and the parser is not ──────────────
+ *
+ * The registry's unclaimed-export check (`findUnclaimedRuleModuleExports`)
+ * keys on this name under `src/config-surface/`: every exported function here
+ * is a rule, so one no surface declares fails `cli-unit-tests`. The anchor
+ * also forbids a `throw` outside the one refusal constructor — and `parseCron`
+ * throws eight different sentences, which `tests/unit/cron-parser.test.ts`
+ * pins. So the grammar and the `Intl` probe live next door in
+ * `cron-expression.ts`, which is a shared-predicate module rather than a rules
+ * module, and this one only decides and renders.
+ *
+ * ── What is NOT shared ───────────────────────────────────────────────────
+ *
+ * The standalone cron routes ask the same two predicates and render their own
+ * `Invalid cron expression: …` / `Invalid timezone: …`, with their own
+ * defaulting (create reads an absent timezone as UTC, update does not). That
+ * is intent assumption 2 in the form its own fallback describes, and the shape
+ * `workflow-rules.ts` set in phase 2: one predicate, each site's message and
+ * defaulting preserved. No refusal message changed anywhere.
+ */
+/** The rule ids this module owns — the union type below anchors them (#3373). */
+export const CRON_TRIGGER_RULE_IDS = [
+    "cron-trigger-expression",
+    "cron-trigger-timezone",
+];
+/** The one refusal constructor: a new branch cannot compile without an id. */
+function refuseCronTriggerRule(ruleId, message) {
+    return { ruleId, message };
+}
+/**
+ * One `[[function.triggers.cron]]` entry's schedule, or null.
+ *
+ * Expression first, then timezone, which is the order the push boundary ran
+ * them in — so an entry broken both ways still answers with the expression's
+ * refusal, exactly as before. An unset or empty `timezone` reads as UTC, again
+ * exactly as before: the boundary's `entry.timezone || "UTC"`.
+ */
+export function checkCronTriggerEntry(entry) {
+    const cronError = cronExpressionError(entry.cron);
+    if (cronError !== null) {
+        return refuseCronTriggerRule("cron-trigger-expression", `cron trigger '${entry.name}': invalid cron expression — ${cronError}`);
+    }
+    const timezone = entry.timezone || "UTC";
+    if (!isValidTimezone(timezone)) {
+        return refuseCronTriggerRule("cron-trigger-timezone", `cron trigger '${entry.name}': invalid timezone '${timezone}'`);
+    }
+    return null;
+}
+// ── src/config-surface/prompt-reasoning.ts ───────────────────────────────
+/**
+ * The prompt config's reasoning controls, resolved onto each provider's own
+ * spelling — issue #3358.
+ *
+ * A `[[configs]]` entry states EITHER `reasoningEffort` (a provider-neutral
+ * level, `none` through `high`) or `reasoningBudget` (a token count), never
+ * both. This module is the whole translation: every authored pair either maps
+ * onto the provider's native key or is REFUSED with a message naming the
+ * remedy. Nothing is dropped — that was the trap `providerConfig` already laid
+ * in the tree (stored, serialized, round-tripped, and never read at execution),
+ * and the issue's third success criterion is precisely that a config asking for
+ * something a provider cannot express fails rather than silently doing nothing.
+ *
+ * Pure and dependency-free, like every module under `src/config-surface/`: the
+ * server's create/update handlers, the executor, and the vendored CLI artifact
+ * all read this one copy, so a refusal at push and a refusal at execution
+ * cannot disagree.
+ *
+ * Provider facts this encodes:
+ *
+ *  - OpenRouter takes a unified `reasoning` block: `{ effort }`,
+ *    `{ max_tokens }`, or `{ enabled: false }` to decline it. `max_tokens` is an
+ *    exact bound on budget-native models and is translated to the nearest
+ *    effort level on effort-only ones, so it is documented as a bound, not a
+ *    guarantee — `metrics.reasoningTokens` is the measure of what was spent.
+ *    Default routing lets an endpoint IGNORE a parameter it does not support,
+ *    so a request carrying `reasoning` also carries
+ *    `provider: { require_parameters: true }`: an endpoint that cannot honor it
+ *    is refused by OpenRouter and surfaces as a failed execution rather than a
+ *    silent drop.
+ *  - Gemini 3.x expresses thinking as a LEVEL
+ *    (`thinkingConfig.thinkingLevel`) and cannot turn it off; `thinkingBudget`
+ *    is accepted there only for backward compatibility and is translated to a
+ *    level rather than honored as a bound, so a numeric budget is refused with
+ *    a pointer at `reasoningEffort`.
+ *  - Gemini 2.5 expresses it as a numeric BUDGET
+ *    (`thinkingConfig.thinkingBudget`); `0` turns thinking off on Flash and
+ *    Flash-Lite, while Pro has a floor of 128 and answers 400 for less.
+ *  - Gemini 2.0 and earlier have no thinking control at all.
+ */
+/** The provider-neutral effort levels a config may state. */
+export const REASONING_EFFORTS = [
+    "none",
+    "minimal",
+    "low",
+    "medium",
+    "high",
+];
+/** The smallest budget Gemini 2.5 Pro accepts; it cannot stop thinking. */
+export const GEMINI_PRO_MIN_THINKING_BUDGET = 128;
+export function geminiReasoningFamily(model) {
+    const match = /gemini-(\d+)(?:[.-](\d+))?/i.exec(model || "");
+    if (!match)
+        return "none";
+    const major = Number(match[1]);
+    const minor = match[2] === undefined ? 0 : Number(match[2]);
+    if (!Number.isFinite(major))
+        return "none";
+    if (major >= 3)
+        return "level";
+    if (major === 2 && minor >= 5)
+        return "budget";
+    return "none";
+}
+/** Gemini Pro: the tier that cannot stop thinking in either family. */
+export function isGeminiProModel(model) {
+    return /(^|[-_/.])pro($|[-_/.])/i.test(model || "");
+}
+/** Is EITHER reasoning key stated on this config? */
+export function hasPromptReasoning(input) {
+    return (normalizeEffort(input.reasoningEffort) !== null ||
+        normalizeBudget(input.reasoningBudget) !== null);
+}
+function normalizeEffort(value) {
+    if (value === undefined || value === null)
+        return null;
+    const text = String(value).trim();
+    return text === "" ? null : text.toLowerCase();
+}
+function normalizeBudget(value) {
+    if (value === undefined || value === null)
+        return null;
+    if (typeof value === "string" && value.trim() === "")
+        return null;
+    const parsed = typeof value === "number" ? value : Number(value);
+    return Number.isNaN(parsed) ? Number.NaN : parsed;
+}
+/**
+ * Resolve an authored pair onto the provider's spelling.
+ *
+ * Returns `{ ok: true, directive: null }` when neither key is set — the case
+ * that must leave the upstream payload byte-identical to what it was before
+ * this issue — a directive when the pair maps, and `{ ok: false, error }` when
+ * it does not. The error text is what `config push` reports as the file's
+ * error and what the admin routes answer 400 with.
+ */
+export function resolvePromptReasoning(input) {
+    const effort = normalizeEffort(input.reasoningEffort);
+    const budget = normalizeBudget(input.reasoningBudget);
+    if (effort === null && budget === null) {
+        return { ok: true, directive: null };
+    }
+    if (effort !== null && budget !== null && !Number.isNaN(budget)) {
+        return {
+            ok: false,
+            error: "reasoningEffort and reasoningBudget cannot both be set on one prompt " +
+                "config: state an effort level or a numeric token budget, not both. " +
+                "Remove one of the two keys.",
+        };
+    }
+    if (effort !== null && !REASONING_EFFORTS.includes(effort)) {
+        return {
+            ok: false,
+            error: `reasoningEffort must be one of ${REASONING_EFFORTS.join(", ")}; ` +
+                `got '${input.reasoningEffort}'`,
+        };
+    }
+    if (budget !== null && (!Number.isInteger(budget) || budget < 0)) {
+        return {
+            ok: false,
+            error: "reasoningBudget must be a non-negative whole number of reasoning " +
+                `tokens; got '${input.reasoningBudget}'`,
+        };
+    }
+    const provider = String(input.provider || "").trim().toLowerCase();
+    const model = String(input.model || "").trim();
+    if (provider === "openrouter") {
+        return { ok: true, directive: openRouterDirective(effort, budget) };
+    }
+    if (provider === "gemini") {
+        return geminiResolution(model, effort, budget);
+    }
+    return {
+        ok: false,
+        error: `provider '${input.provider ?? ""}' has no reasoning control; ` +
+            "reasoningEffort and reasoningBudget are supported on 'openrouter' and " +
+            "'gemini'",
+    };
+}
+function openRouterDirective(effort, budget) {
+    const reasoning = effort === "none"
+        ? // `enabled: false` rather than `effort: "none"`: the older switch every
+            // model path handles, where the newer spelling is not universal.
+            { enabled: false }
+        : effort !== null
+            ? { effort }
+            : { max_tokens: budget };
+    return { provider: "openrouter", reasoning, requireParameters: true };
+}
+function geminiResolution(model, effort, budget) {
+    const family = geminiReasoningFamily(model);
+    const isPro = isGeminiProModel(model);
+    if (family === "none") {
+        return {
+            ok: false,
+            error: `Gemini model '${model}' has no reasoning control: reasoningEffort and ` +
+                "reasoningBudget need Gemini 2.5 (a token budget) or Gemini 3 (an " +
+                "effort level). Remove the key or move the config to a model that has one.",
+        };
+    }
+    if (family === "level") {
+        if (budget !== null) {
+            return {
+                ok: false,
+                error: `Gemini model '${model}' expresses reasoning as a LEVEL, not a token ` +
+                    "budget — it translates thinkingBudget to a level rather than honoring " +
+                    "it as a bound. Use reasoningEffort " +
+                    `(${REASONING_EFFORTS.filter((e) => e !== "none").join(", ")}) instead ` +
+                    "of reasoningBudget.",
+            };
+        }
+        if (effort === "none") {
+            return {
+                ok: false,
+                error: `Gemini model '${model}' cannot turn thinking off. The lowest level it ` +
+                    `accepts is '${isPro ? "low" : "minimal"}'.`,
+            };
+        }
+        if (isPro && (effort === "minimal" || effort === "medium")) {
+            return {
+                ok: false,
+                error: `Gemini Pro model '${model}' accepts only 'low' or 'high' as a ` +
+                    `thinking level; '${effort}' is a Flash-only level.`,
+            };
+        }
+        return {
+            ok: true,
+            directive: {
+                provider: "gemini",
+                thinkingConfig: { thinkingLevel: String(effort).toUpperCase() },
+            },
+        };
+    }
+    // family === "budget" — Gemini 2.5.
+    if (effort !== null && effort !== "none") {
+        return {
+            ok: false,
+            error: `Gemini model '${model}' expresses reasoning as a token BUDGET, not an ` +
+                `effort level. Use reasoningBudget instead of reasoningEffort = '${effort}' ` +
+                "(reasoningEffort = \"none\" is accepted and means a budget of 0).",
+        };
+    }
+    const resolved = effort === "none" ? 0 : budget;
+    if (isPro && resolved < GEMINI_PRO_MIN_THINKING_BUDGET) {
+        return {
+            ok: false,
+            error: `Gemini Pro model '${model}' cannot turn thinking off: its smallest ` +
+                `thinking budget is ${GEMINI_PRO_MIN_THINKING_BUDGET} tokens, and ` +
+                `${resolved} is refused by the provider.`,
+        };
+    }
+    return {
+        ok: true,
+        directive: {
+            provider: "gemini",
+            thinkingConfig: { thinkingBudget: resolved },
+        },
+    };
+}
 // ── src/config-surface/prompt.ts ─────────────────────────────────────────
 /**
  * The `prompt` configuration object's definition (issue #2644, phase 2).
@@ -3572,7 +4817,7 @@ export const PROMPT_SURFACE = {
                     type: "json",
                     emit: "whenSet",
                     writableOn: BOTH,
-                    validation: handledBy(PROMPT_HANDLER, "AdminAPI"),
+                    validation: handledBy(PROMPT_HANDLER, "AdminAPI", "apply"),
                 },
                 // #2644 — accepted by both handlers and returned by the detail, but
                 // never written to TOML before this: a prompt's declared output shape
@@ -3583,7 +4828,7 @@ export const PROMPT_SURFACE = {
                     type: "json",
                     emit: "whenSet",
                     writableOn: BOTH,
-                    validation: handledBy(PROMPT_HANDLER, "AdminAPI"),
+                    validation: handledBy(PROMPT_HANDLER, "AdminAPI", "apply"),
                 },
                 // #2652 — the CEL rule gating who may execute the prompt. Required at
                 // create; an explicit null/"" on update clears it (fail-closed). This
@@ -3596,7 +4841,7 @@ export const PROMPT_SURFACE = {
                     type: "string",
                     emit: "whenSet",
                     writableOn: BOTH,
-                    validation: handledBy(PROMPT_HANDLER, "AdminAPI"),
+                    validation: handledBy(PROMPT_HANDLER, "AdminAPI", "apply"),
                 },
             ],
             notExposed: {
@@ -3669,8 +4914,13 @@ export const PROMPT_SURFACE = {
             tomlOnlyKeys: {
                 key: {
                     kind: "structural",
-                    note: "The prompt key. `config pull` writes it for readability; push takes " +
-                        "the identity from the file name and attaches `promptKey` itself.",
+                    note: "The prompt key. `config pull` writes it, and push resolves the " +
+                        "identity as the declared `[prompt] key` when there is one and the " +
+                        "file name otherwise (`tomlData.prompt?.key || basename(file)`), " +
+                        "then attaches `promptKey` itself. In a pulled tree the two always " +
+                        "agree; a hand-written file whose key differs from its name is " +
+                        "deployed — and typed by `functions codegen` — under the DECLARED " +
+                        "key (#3330).",
                 },
             },
             responseOnlyKeys: {
@@ -3693,7 +4943,7 @@ export const PROMPT_SURFACE = {
                     emit: "always",
                     writableOn: BOTH,
                     // Renamable on update, uniqueness-checked within the prompt.
-                    validation: handledBy(PROMPT_HANDLER, "AdminAPI"),
+                    validation: handledBy(PROMPT_HANDLER, "AdminAPI", "apply"),
                 },
                 // #2645 — a config's status is configuration: `prompts configs update
                 // --status archived` used to be the only way to retire one, and pull
@@ -3716,7 +4966,7 @@ export const PROMPT_SURFACE = {
                     type: "string",
                     emit: "whenSet",
                     writableOn: UPDATE_ONLY,
-                    validation: handledBy(PROMPT_HANDLER, "AdminAPI"),
+                    validation: handledBy(PROMPT_HANDLER, "AdminAPI", "apply"),
                     serverDefault: "active",
                 },
                 {
@@ -3734,7 +4984,7 @@ export const PROMPT_SURFACE = {
                     emit: "always",
                     writableOn: BOTH,
                     // openrouter | gemini, lower-cased and cross-checked against the model.
-                    validation: handledBy(PROMPT_HANDLER, "AdminAPI"),
+                    validation: handledBy(PROMPT_HANDLER, "AdminAPI", "apply"),
                 },
                 {
                     field: "model",
@@ -3742,7 +4992,7 @@ export const PROMPT_SURFACE = {
                     type: "string",
                     emit: "always",
                     writableOn: BOTH,
-                    validation: handledBy(PROMPT_HANDLER, "AdminAPI"),
+                    validation: handledBy(PROMPT_HANDLER, "AdminAPI", "apply"),
                 },
                 {
                     field: "systemPrompt",
@@ -3752,7 +5002,7 @@ export const PROMPT_SURFACE = {
                     writableOn: BOTH,
                     // Offloaded to R2 above the inline size limit and read back
                     // transparently, so the TOML value is the whole prompt either way.
-                    validation: handledBy("src/services/large-field-storage.ts", "storeField"),
+                    validation: handledBy("src/services/large-field-storage.ts", "storeField", "apply"),
                 },
                 {
                     field: "userPromptTemplate",
@@ -3760,7 +5010,7 @@ export const PROMPT_SURFACE = {
                     type: "string",
                     emit: "whenSet",
                     writableOn: BOTH,
-                    validation: handledBy("src/services/large-field-storage.ts", "storeField"),
+                    validation: handledBy("src/services/large-field-storage.ts", "storeField", "apply"),
                 },
                 {
                     field: "temperature",
@@ -3769,7 +5019,7 @@ export const PROMPT_SURFACE = {
                     emit: "whenSet",
                     writableOn: BOTH,
                     // Stored as a string on the model, returned parsed as a number.
-                    validation: handledBy(PROMPT_HANDLER, "AdminAPI"),
+                    validation: handledBy(PROMPT_HANDLER, "AdminAPI", "apply"),
                     dualEncoded: {
                         note: "#2869 — a `StringField` on the model: the server stores what it " +
                             "is given and returns `parseFloat` of it, so `temperature = " +
@@ -3785,7 +5035,7 @@ export const PROMPT_SURFACE = {
                     type: "number",
                     emit: "whenSet",
                     writableOn: BOTH,
-                    validation: handledBy(PROMPT_HANDLER, "AdminAPI"),
+                    validation: handledBy(PROMPT_HANDLER, "AdminAPI", "apply"),
                     dualEncoded: {
                         note: "#2869 — a `StringField` returned parsed, exactly as `temperature`.",
                     },
@@ -3814,7 +5064,7 @@ export const PROMPT_SURFACE = {
                     type: "json",
                     emit: "whenSet",
                     writableOn: BOTH,
-                    validation: handledBy(PROMPT_HANDLER, "AdminAPI"),
+                    validation: handledBy(PROMPT_HANDLER, "AdminAPI", "apply"),
                 },
                 {
                     field: "providerConfig",
@@ -3822,7 +5072,35 @@ export const PROMPT_SURFACE = {
                     type: "json",
                     emit: "whenSet",
                     writableOn: BOTH,
-                    validation: handledBy(PROMPT_HANDLER, "AdminAPI"),
+                    validation: handledBy(PROMPT_HANDLER, "AdminAPI", "apply"),
+                },
+                // #3358 — the provider's reasoning budget, in a provider-neutral
+                // spelling. Before this the only lever was the model itself: an app
+                // running a classification prompt on a reasoning-by-default model paid
+                // 49–82% of its decode for deliberation it did not want, in latency as
+                // well as money, and no key in this table could decline it.
+                //
+                // The two are MUTUALLY EXCLUSIVE — a config states an effort level or a
+                // numeric token budget, never both — and every authored value either
+                // maps onto the provider's own spelling or is refused at push. That
+                // mapping is `resolvePromptReasoning`, named here so the drift guard
+                // checks the export and the parity project (#3374/#3375) can declare it
+                // as a preflight rule without moving it.
+                {
+                    field: "reasoningEffort",
+                    tomlKey: "reasoningEffort",
+                    type: "string",
+                    emit: "whenSet",
+                    writableOn: BOTH,
+                    validation: handledBy("src/config-surface/prompt-reasoning.ts", "resolvePromptReasoning", "apply"),
+                },
+                {
+                    field: "reasoningBudget",
+                    tomlKey: "reasoningBudget",
+                    type: "number",
+                    emit: "whenSet",
+                    writableOn: BOTH,
+                    validation: handledBy("src/config-surface/prompt-reasoning.ts", "resolvePromptReasoning", "apply"),
                 },
             ],
             notExposed: {
@@ -3945,7 +5223,7 @@ export const INTEGRATION_SURFACE = {
                     type: "number",
                     emit: "always",
                     writableOn: BOTH,
-                    validation: handledBy(INTEGRATION_HANDLER, "AdminAPI"),
+                    validation: handledBy(INTEGRATION_HANDLER, "AdminAPI", "apply"),
                     // `src/admin-api.ts` createAppIntegration: a create with no
                     // `timeoutMs` stores 300000. Recorded so a hand-authored file that
                     // omits the key compares (and pushes) as the value the server holds
@@ -3961,7 +5239,7 @@ export const INTEGRATION_SURFACE = {
                     type: "number",
                     emit: "whenSet",
                     writableOn: BOTH,
-                    validation: handledBy(INTEGRATION_HANDLER, "AdminAPI"),
+                    validation: handledBy(INTEGRATION_HANDLER, "AdminAPI", "apply"),
                     // Same create default, same reason (#2880 DSO-002): 1 MiB.
                     serverDefault: 1048576,
                 },
@@ -3973,7 +5251,7 @@ export const INTEGRATION_SURFACE = {
                     type: "string",
                     emit: "whenSet",
                     writableOn: BOTH,
-                    validation: handledBy(INTEGRATION_HANDLER, "AdminAPI"),
+                    validation: handledBy(INTEGRATION_HANDLER, "AdminAPI", "apply"),
                 },
             ],
             notExposed: {
@@ -4087,6 +5365,18 @@ const WEBHOOK_CONFIG_VALIDATION = "src/app-api/services/webhook-verification/con
 // alone, so it moved beside the definitions where `config push`'s preflight can
 // run the server's own copy of it.
 const WEBHOOK_SIGNING_SECRET_RULE = "src/config-surface/webhook-signing-secret.ts";
+/**
+ * Every rule of this object is `apply` (#3374): the standalone webhook's CLI
+ * path runs field-shape checks only, and everything else needs the app's state
+ * or the STORED row. A module-local builder, named so it cannot collide with a
+ * sibling's once the directory is concatenated into the artifact.
+ */
+const webhookApplyRules = (modulePath, exportName, entries) => entries.map(([id, description]) => ({
+    id,
+    description,
+    stage: "apply",
+    handler: enforcedBy(modulePath, exportName),
+}));
 export const WEBHOOK_SURFACE = {
     label: "webhook",
     tables: [
@@ -4126,7 +5416,7 @@ export const WEBHOOK_SURFACE = {
                     type: "string",
                     emit: "always",
                     writableOn: BOTH,
-                    validation: handledBy(WEBHOOK_HANDLER, "AdminAPI"),
+                    validation: handledBy(WEBHOOK_HANDLER, "AdminAPI", "apply"),
                 },
                 {
                     field: "toleranceSeconds",
@@ -4134,7 +5424,7 @@ export const WEBHOOK_SURFACE = {
                     type: "number",
                     emit: "always",
                     writableOn: BOTH,
-                    validation: handledBy(WEBHOOK_CONFIG_VALIDATION, "validateReplayProtection"),
+                    validation: handledBy(WEBHOOK_CONFIG_VALIDATION, "validateReplayProtection", "apply"),
                 },
                 {
                     field: "deduplicationEnabled",
@@ -4142,7 +5432,7 @@ export const WEBHOOK_SURFACE = {
                     type: "boolean",
                     emit: "always",
                     writableOn: BOTH,
-                    validation: handledBy(WEBHOOK_CONFIG_VALIDATION, "validateReplayProtection"),
+                    validation: handledBy(WEBHOOK_CONFIG_VALIDATION, "validateReplayProtection", "apply"),
                 },
                 {
                     field: "deduplicationWindowMs",
@@ -4150,7 +5440,7 @@ export const WEBHOOK_SURFACE = {
                     type: "number",
                     emit: "always",
                     writableOn: BOTH,
-                    validation: handledBy(WEBHOOK_CONFIG_VALIDATION, "validateReplayProtection"),
+                    validation: handledBy(WEBHOOK_CONFIG_VALIDATION, "validateReplayProtection", "apply"),
                 },
                 // Per-webhook inbound body cap. Unset means the platform default
                 // (5 MiB), so it is omitted from TOML rather than written as a zero.
@@ -4160,7 +5450,7 @@ export const WEBHOOK_SURFACE = {
                     type: "number",
                     emit: "whenSet",
                     writableOn: BOTH,
-                    validation: handledBy(WEBHOOK_CONFIG_VALIDATION, "validateMaxBodyBytes"),
+                    validation: handledBy(WEBHOOK_CONFIG_VALIDATION, "validateMaxBodyBytes", "apply"),
                 },
                 {
                     field: "secretGracePeriodMs",
@@ -4168,7 +5458,7 @@ export const WEBHOOK_SURFACE = {
                     type: "number",
                     emit: "always",
                     writableOn: BOTH,
-                    validation: handledBy(WEBHOOK_CONFIG_VALIDATION, "normalizeSecretGracePeriodMs"),
+                    validation: handledBy(WEBHOOK_CONFIG_VALIDATION, "normalizeSecretGracePeriodMs", "apply"),
                 },
                 // #2254 — reference-only: a whole `{{secrets.KEY}}` reference naming an
                 // existing app secret, and nothing else. The server never returns
@@ -4180,7 +5470,7 @@ export const WEBHOOK_SURFACE = {
                     type: "string",
                     emit: "whenSet",
                     writableOn: BOTH,
-                    validation: handledBy(WEBHOOK_SIGNING_SECRET_RULE, "validateWholeSecretReference"),
+                    validation: handledBy(WEBHOOK_SIGNING_SECRET_RULE, "validateWholeSecretReference", "apply"),
                 },
             ],
             notExposed: {
@@ -4345,6 +5635,91 @@ export const WEBHOOK_SURFACE = {
                 "configs, which spells `[metadata]` the same way.",
         },
     },
+    // ── Cross-field rules (#3374) ─────────────────────────────────────────────
+    //
+    // Nothing here is `preflight`. Stage is a property of the (surface, rule)
+    // pair, and on THIS surface even the file-decidable signing-secret rule is
+    // enforced mid-apply: the standalone webhook CLI path runs no signing-secret
+    // preflight (`function-sync.ts` is that rule's only CLI caller), and an
+    // update that omits `signingSecret` keeps the stored one, so a local check
+    // would need update-retains-stored-secret semantics the intent lists as a
+    // non-goal. Declaring `preflight` would promise a refusal that lands after
+    // sibling entities are written.
+    //
+    // The residue, named: `webhook-verification/config-validation.ts` is not a
+    // rules module (it builds forty-odd refusals, most single-field). Its
+    // cross-field refusals — scheme × config, replay protection, config secret
+    // references — reach a write only through `validateWebhookSettings`, which
+    // re-builds each under its own pipeline id, so they are declared here under
+    // those ids; the module itself is unmigrated.
+    crossFieldRules: [
+        ...webhookApplyRules(WEBHOOK_SIGNING_SECRET_RULE, "validateSigningSecretDeclaration", [
+            [
+                "signing-secret-required",
+                "A scheme that verifies with an HMAC secret must be given a " +
+                    "`signingSecret`. The same handler the function surface runs in " +
+                    "preflight; here it runs at apply because the standalone CLI path " +
+                    "never calls it and an update preserves an omitted stored secret.",
+            ],
+            [
+                "whole-secret-reference",
+                "A supplied `signingSecret` is a whole `{{secrets.KEY}}` reference " +
+                    "and nothing else — a literal is never stored (#2254).",
+            ],
+            [
+                "signing-secret-not-supported",
+                "A scheme whose key material lives in its config (`discord`, `jwt`, " +
+                    "`plaid`) or that verifies nothing (`none`) refuses a `signingSecret`.",
+            ],
+        ]),
+        ...webhookApplyRules("src/app-api/services/webhook-limits.ts", "validateWebhookCountUnderCap", [
+            [
+                "webhook-cap",
+                "An app holds at most fifty webhook rows, archived included; a " +
+                    "create that would add one past the cap is refused with " +
+                    "`WEBHOOK_LIMIT_REACHED` (#2232). Read early by `config push` as an " +
+                    "advisory check; the server decides.",
+            ],
+        ]),
+        ...webhookApplyRules("src/app-api/services/webhook-settings-validation.ts", "validateWebhookSettings", [
+            ["verification-scheme-required", "A webhook names its `verificationScheme`."],
+            ["verification-scheme-value", "The scheme is one the receiver knows."],
+            [
+                "verification-config",
+                "The scheme's `config` is valid for that scheme under this " +
+                    "environment's JWKS policy, and carries no literal credential.",
+            ],
+            [
+                "replay-protection",
+                "A signed scheme keeps deduplication on, with a window and tolerance " +
+                    "in range and long enough to cover the signature's freshness window.",
+            ],
+            [
+                "signing-secret-exists",
+                "The app secret a `signingSecret` reference names must exist, so a " +
+                    "missing key fails the write rather than the first delivery.",
+            ],
+            [
+                "verification-config-secrets-exist",
+                "Every secret reference the active scheme's `config` resolves at " +
+                    "delivery must name an existing app secret.",
+            ],
+        ]),
+        ...webhookApplyRules("src/app-api/services/webhook-verification/signing-secret-migration.ts", "validateSigningSecretMigration", [
+            [
+                "signing-secret-migration",
+                "A row whose STORED `signingSecret` is still a legacy literal cannot " +
+                    "be updated until the write migrates it to a reference (#2332); " +
+                    "gated on the scheme and status the row will end up with.",
+            ],
+            [
+                "signing-secret-migration-malformed",
+                "The same gate for a stored value carrying reference syntax that does " +
+                    "not resolve — every signed delivery is already failing, and the " +
+                    "message says so.",
+            ],
+        ]),
+    ],
 };
 // ── src/config-surface/cron-trigger.ts ───────────────────────────────────
 /**
@@ -4394,7 +5769,23 @@ export const CRON_TRIGGER_SURFACE = {
                     type: "string",
                     emit: "always",
                     writableOn: BOTH,
-                    validation: handledBy("src/cron-parser.ts", "parseCron"),
+                    // #3376 — re-pointed from `src/cron-parser.ts`, which now only
+                    // re-exports the parser: the drift guard resolves `export function
+                    // <name>` in the named module's OWN source, so the declaring module
+                    // is the only one it can name.
+                    //
+                    // `apply`, not `preflight`, even though the predicate is vendored
+                    // and the rule is decidable from the file: no CLI check reads a
+                    // standalone `cron-triggers/<key>.toml`'s VALUES.
+                    // `collectConfigFileValidationErrors` is definition-driven and
+                    // cannot dispatch through a `handledBy` string (#1976), so this
+                    // file still fails at apply with the controller's message.
+                    // `preflight` would make the registry promise a refusal that in
+                    // fact lands mid-apply — and the reachability walker could not
+                    // catch the lie, because the FUNCTION leg reaches this same
+                    // predicate. Building that standalone leg, with its `config diff`
+                    // twin, is a finding for #3379.
+                    validation: handledBy("src/config-surface/cron-expression.ts", "cronExpressionError", "apply"),
                 },
                 {
                     field: "timezone",
@@ -4402,8 +5793,12 @@ export const CRON_TRIGGER_SURFACE = {
                     type: "string",
                     emit: "always",
                     writableOn: BOTH,
-                    // Validated against Intl; unset reads as "UTC".
-                    validation: handledBy(CRON_TRIGGER_HANDLER, "CronTriggersController"),
+                    // Validated against Intl; unset reads as "UTC". #3376 named the
+                    // predicate itself rather than the controller class: the probe the
+                    // three sites used to spell out is one function now, and this is
+                    // one of the two surfaces that own it. `apply` for the same reason
+                    // as `cron` above — no standalone CLI preflight runs it (#3379).
+                    validation: handledBy("src/config-surface/cron-expression.ts", "isValidTimezone", "apply"),
                     // `cron-triggers-controller.ts` stores `timezone || "UTC"`, so a file
                     // that omits the key describes a trigger running in UTC — compared
                     // and pushed as that, rather than as a difference no push can clear
@@ -4417,7 +5812,7 @@ export const CRON_TRIGGER_SURFACE = {
                     emit: "always",
                     writableOn: BOTH,
                     // #1002 — a reserved `__internal.` key is rejected at save time.
-                    validation: handledBy(CRON_TRIGGER_HANDLER, "CronTriggersController"),
+                    validation: handledBy(CRON_TRIGGER_HANDLER, "CronTriggersController", "apply"),
                 },
                 {
                     field: "overlapPolicy",
@@ -4426,7 +5821,7 @@ export const CRON_TRIGGER_SURFACE = {
                     emit: "always",
                     writableOn: BOTH,
                     // skip | allow.
-                    validation: handledBy(CRON_TRIGGER_HANDLER, "CronTriggersController"),
+                    validation: handledBy(CRON_TRIGGER_HANDLER, "CronTriggersController", "apply"),
                     // Same store-time default as `timezone` (#2880 DSO-002).
                     serverDefault: "skip",
                 },
@@ -4630,7 +6025,7 @@ export const BLOB_BUCKET_SURFACE = {
                     emit: "always",
                     writableOn: CREATE_ONLY,
                     // Immutable after create: `update` never reads it.
-                    validation: handledBy(BLOB_BUCKET_HANDLER, "BlobBucketsController"),
+                    validation: handledBy(BLOB_BUCKET_HANDLER, "BlobBucketsController", "apply"),
                 },
                 {
                     field: "preset",
@@ -4640,7 +6035,7 @@ export const BLOB_BUCKET_SURFACE = {
                     writableOn: BOTH,
                     // #1020 — the honest access field. A rule-set-backed bucket reports
                     // "custom", which is not written back as a preset.
-                    validation: handledBy("src/app-api/resource-types/blob-bucket.ts", "resolveBucketPreset"),
+                    validation: handledBy("src/app-api/resource-types/blob-bucket.ts", "resolveBucketPreset", "apply"),
                 },
                 {
                     field: "ruleSetId",
@@ -4650,7 +6045,7 @@ export const BLOB_BUCKET_SURFACE = {
                     writableOn: BOTH,
                     // Existence-checked against AccessRuleSet; mutually exclusive with a
                     // preset change in the same request.
-                    validation: handledBy(BLOB_BUCKET_HANDLER, "BlobBucketsController"),
+                    validation: handledBy(BLOB_BUCKET_HANDLER, "BlobBucketsController", "apply"),
                 },
             ],
             notExposed: {
@@ -4778,7 +6173,7 @@ export const EMAIL_TEMPLATE_SURFACE = {
                     emit: "always",
                     writableOn: BOTH,
                     // Size-capped and checked for unescaped `{{{var}}}` interpolation.
-                    validation: handledBy(EMAIL_TEMPLATE_HANDLER, "AdminAPI"),
+                    validation: handledBy(EMAIL_TEMPLATE_HANDLER, "AdminAPI", "apply"),
                 },
                 {
                     field: "htmlBody",
@@ -4786,7 +6181,7 @@ export const EMAIL_TEMPLATE_SURFACE = {
                     type: "string",
                     emit: "whenSet",
                     writableOn: BOTH,
-                    validation: handledBy(EMAIL_TEMPLATE_HANDLER, "AdminAPI"),
+                    validation: handledBy(EMAIL_TEMPLATE_HANDLER, "AdminAPI", "apply"),
                 },
                 {
                     field: "textBody",
@@ -4794,7 +6189,7 @@ export const EMAIL_TEMPLATE_SURFACE = {
                     type: "string",
                     emit: "whenSet",
                     writableOn: BOTH,
-                    validation: handledBy(EMAIL_TEMPLATE_HANDLER, "AdminAPI"),
+                    validation: handledBy(EMAIL_TEMPLATE_HANDLER, "AdminAPI", "apply"),
                 },
             ],
             notExposed: {
@@ -4924,7 +6319,7 @@ export const DATABASE_TYPE_SURFACE = {
                     writableOn: CREATE_ONLY,
                     // The type's identity: required and `#`-free on create, taken from
                     // the URL on update.
-                    validation: handledBy(DB_TYPE_HANDLER, "DatabaseTypeConfigController"),
+                    validation: handledBy(DB_TYPE_HANDLER, "DatabaseTypeConfigController", "apply"),
                 },
                 {
                     field: "ruleSetId",
@@ -4934,7 +6329,7 @@ export const DATABASE_TYPE_SURFACE = {
                     writableOn: BOTH,
                     // Authored as a portable name and sent as an id; the server checks
                     // the set exists and has `resourceType: "database"`.
-                    validation: handledBy(DB_TYPE_HANDLER, "DatabaseTypeConfigController"),
+                    validation: handledBy(DB_TYPE_HANDLER, "DatabaseTypeConfigController", "apply"),
                 },
                 {
                     field: "metadataAccess",
@@ -4944,7 +6339,7 @@ export const DATABASE_TYPE_SURFACE = {
                     writableOn: BOTH,
                     // CEL, parsed before storing (#1336). The legacy `metadataAccess`
                     // spelling stays readable on push — see tomlOnlyKeys.
-                    validation: handledBy(DB_TYPE_HANDLER, "DatabaseTypeConfigController"),
+                    validation: handledBy(DB_TYPE_HANDLER, "DatabaseTypeConfigController", "apply"),
                 },
                 {
                     field: "defaultAccess",
@@ -4953,7 +6348,7 @@ export const DATABASE_TYPE_SURFACE = {
                     emit: "whenSet",
                     writableOn: BOTH,
                     // CEL, plus the shared `md`-shape allowlist (#1523).
-                    validation: handledBy(DB_TYPE_HANDLER, "DatabaseTypeConfigController"),
+                    validation: handledBy(DB_TYPE_HANDLER, "DatabaseTypeConfigController", "apply"),
                 },
                 {
                     field: "autoPopulatedFields",
@@ -4963,7 +6358,7 @@ export const DATABASE_TYPE_SURFACE = {
                     writableOn: BOTH,
                     // #750 — shorthand and verbose forms both accepted, normalized by
                     // `validateAndNormalizeAutoPopulatedFields`.
-                    validation: handledBy(DB_TYPE_HANDLER, "DatabaseTypeConfigController"),
+                    validation: handledBy(DB_TYPE_HANDLER, "DatabaseTypeConfigController", "apply"),
                 },
                 {
                     field: "timestamps",
@@ -4973,7 +6368,7 @@ export const DATABASE_TYPE_SURFACE = {
                     writableOn: BOTH,
                     // #748 — `{ create?, update?, models? }`, normalized by
                     // `validateAndNormalizeTimestamps`.
-                    validation: handledBy(DB_TYPE_HANDLER, "DatabaseTypeConfigController"),
+                    validation: handledBy(DB_TYPE_HANDLER, "DatabaseTypeConfigController", "apply"),
                 },
             ],
             notExposed: {
@@ -5115,7 +6510,7 @@ export const RULE_SET_SURFACE = {
                     emit: "always",
                     writableOn: BOTH,
                     // Required, trimmed, and non-empty on both modes.
-                    validation: handledBy(RULE_SET_HANDLER, "RuleSetsController"),
+                    validation: handledBy(RULE_SET_HANDLER, "RuleSetsController", "apply"),
                 },
                 {
                     field: "resourceType",
@@ -5125,7 +6520,7 @@ export const RULE_SET_SURFACE = {
                     writableOn: CREATE_ONLY,
                     // Checked against `getValidResourceTypes()`, and singleton types
                     // (#1148) reject a second set. `update` never reads it.
-                    validation: handledBy(RULE_SET_HANDLER, "RuleSetsController"),
+                    validation: handledBy(RULE_SET_HANDLER, "RuleSetsController", "apply"),
                 },
                 {
                     field: "description",
@@ -5217,7 +6612,7 @@ export const GROUP_TYPE_CONFIG_SURFACE = {
                     writableOn: CREATE_ONLY,
                     // The config's identity: required and `#`-free on create, taken from
                     // the URL on update.
-                    validation: handledBy(GROUP_TYPE_HANDLER, "GroupTypeConfigController"),
+                    validation: handledBy(GROUP_TYPE_HANDLER, "GroupTypeConfigController", "apply"),
                 },
                 {
                     field: "ruleSetId",
@@ -5227,7 +6622,7 @@ export const GROUP_TYPE_CONFIG_SURFACE = {
                     writableOn: BOTH,
                     // Authored as a name, sent as an id; existence and resourceType are
                     // checked server-side, and an empty value clears the reference.
-                    validation: handledBy(GROUP_TYPE_HANDLER, "GroupTypeConfigController"),
+                    validation: handledBy(GROUP_TYPE_HANDLER, "GroupTypeConfigController", "apply"),
                 },
                 {
                     field: "autoAddCreator",
@@ -5237,7 +6632,7 @@ export const GROUP_TYPE_CONFIG_SURFACE = {
                     writableOn: BOTH,
                     // Defaults to `true` when absent on create, and is coerced with `!!`
                     // on update — not a stored-as-is passthrough.
-                    validation: handledBy(GROUP_TYPE_HANDLER, "GroupTypeConfigController"),
+                    validation: handledBy(GROUP_TYPE_HANDLER, "GroupTypeConfigController", "apply"),
                 },
             ],
             notExposed: {
@@ -5310,7 +6705,7 @@ export const COLLECTION_TYPE_CONFIG_SURFACE = {
                     writableOn: CREATE_ONLY,
                     // The config's identity: required on create, taken from the URL on
                     // update.
-                    validation: handledBy(COLLECTION_TYPE_HANDLER, "CollectionTypeConfigController"),
+                    validation: handledBy(COLLECTION_TYPE_HANDLER, "CollectionTypeConfigController", "apply"),
                 },
                 {
                     field: "ruleSetId",
@@ -5320,7 +6715,7 @@ export const COLLECTION_TYPE_CONFIG_SURFACE = {
                     writableOn: BOTH,
                     // Authored as a name, sent as an id; existence and resourceType are
                     // checked server-side, and an empty value clears the reference.
-                    validation: handledBy(COLLECTION_TYPE_HANDLER, "CollectionTypeConfigController"),
+                    validation: handledBy(COLLECTION_TYPE_HANDLER, "CollectionTypeConfigController", "apply"),
                 },
             ],
             notExposed: {
@@ -5385,6 +6780,18 @@ export const COLLECTION_TYPE_CONFIG_SURFACE = {
  * enum and `unique` rules — but the field itself round-trips as one value.
  */
 const METADATA_HANDLER = "src/app-api/controllers/metadata-controller.ts";
+/**
+ * ── Why this module's CLI handler is declared `apply` (#3375) ─────────────
+ *
+ * A `preflight` handler must be VENDORED — its module lives under
+ * `src/config-surface/`, so the CLI runs the server's own copy through the
+ * generated artifact rather than a second implementation. A handler that
+ * lives in `cli/src/` is a CLI-only copy of a server rule, which is precisely
+ * the drift this project exists to remove; until it is vendored it cannot make
+ * the registry's preflight promise, whatever the push path happens to do
+ * today. Declared `apply`, and recorded as a finding for the validation child
+ * (#3379) rather than papered over with a third stage.
+ */
 const CLI_METADATA_TOML = "cli/src/lib/toml-metadata-config.ts";
 export const METADATA_CATEGORY_CONFIG_SURFACE = {
     label: "metadata-category-config",
@@ -5403,7 +6810,7 @@ export const METADATA_CATEGORY_CONFIG_SURFACE = {
                     emit: "always",
                     writableOn: BOTH,
                     // Half of the category's identity; required on every upsert.
-                    validation: handledBy(METADATA_HANDLER, "MetadataController"),
+                    validation: handledBy(METADATA_HANDLER, "MetadataController", "apply"),
                 },
                 {
                     field: "category",
@@ -5412,7 +6819,7 @@ export const METADATA_CATEGORY_CONFIG_SURFACE = {
                     emit: "always",
                     writableOn: BOTH,
                     // The other half of the identity; required on every upsert.
-                    validation: handledBy(METADATA_HANDLER, "MetadataController"),
+                    validation: handledBy(METADATA_HANDLER, "MetadataController", "apply"),
                 },
                 {
                     field: "readRule",
@@ -5421,7 +6828,7 @@ export const METADATA_CATEGORY_CONFIG_SURFACE = {
                     emit: "whenSet",
                     writableOn: BOTH,
                     // CEL, parsed and stored or nulled.
-                    validation: handledBy(METADATA_HANDLER, "MetadataController"),
+                    validation: handledBy(METADATA_HANDLER, "MetadataController", "apply"),
                 },
                 {
                     field: "writeRule",
@@ -5429,7 +6836,7 @@ export const METADATA_CATEGORY_CONFIG_SURFACE = {
                     type: "string",
                     emit: "whenSet",
                     writableOn: BOTH,
-                    validation: handledBy(METADATA_HANDLER, "MetadataController"),
+                    validation: handledBy(METADATA_HANDLER, "MetadataController", "apply"),
                 },
                 {
                     field: "description",
@@ -5449,7 +6856,7 @@ export const METADATA_CATEGORY_CONFIG_SURFACE = {
                     // `{ fields: {} }` so the file stays pushable. Field types, enums and
                     // the single-`unique` rule are checked locally before push and again
                     // server-side.
-                    validation: handledBy(CLI_METADATA_TOML, "validateCategorySchema"),
+                    validation: handledBy(CLI_METADATA_TOML, "validateCategorySchema", "apply"),
                 },
             ],
             notExposed: {
@@ -5591,6 +6998,128 @@ export const TRANSFORM_SURFACE = {
  * table's prefix.
  */
 const FUNCTION_HANDLER = "src/admin-api/controllers/server-functions-controller.ts";
+/**
+ * The rule declarations (#3374). Three vendored modules decide everything the
+ * file alone can decide, and the CLI's push preflight runs each of them
+ * (`cli/src/lib/function-sync.ts`) before the first request — so those are
+ * `preflight`. One server module decides everything that needs the app's
+ * state, and it is `apply`. A rule id here is one id in its module's
+ * `*_RULE_IDS` list; the guard holds the two sides equal.
+ */
+const functionRules = (stage, modulePath, exportName, entries) => entries.map(([id, description]) => ({
+    id,
+    description,
+    stage,
+    handler: enforcedBy(modulePath, exportName),
+}));
+/** The trigger blocks' shape rules — one id per refusal (#3181, #3184, #3334). */
+const TRIGGER_DECLARATION_RULES = functionRules("preflight", "src/config-surface/trigger-declaration.ts", "normalizeTriggerDeclaration", [
+    ["triggers-table", "`[function.triggers]` must be a table."],
+    ["trigger-kind", "Only `webhook` and `cron` are trigger kinds."],
+    [
+        "database-trigger-removed",
+        "`[[function.triggers.database]]` is refused: the trigger was removed " +
+            "(#3483), and the refusal names the pattern that replaces it — do the " +
+            "follow-up in the handler that writes, or start a task.",
+    ],
+    [
+        "webhook-trigger-single",
+        "`[function.triggers.webhook]` is one table, never an array: one webhook " +
+            "trigger per function.",
+    ],
+    ["webhook-trigger-table", "`[function.triggers.webhook]` must be a table."],
+    ["webhook-trigger-keys", "A webhook block accepts only its declared keys."],
+    ["webhook-trigger-scheme-required", "A webhook block names its `verificationScheme`."],
+    [
+        "webhook-trigger-scheme-none",
+        "Scheme `none` is refused on a function trigger: an unauthenticated " +
+            "caller could run the function.",
+    ],
+    ["webhook-trigger-number", "The numeric webhook settings must be numbers."],
+    ["webhook-trigger-dedup-boolean", "`deduplicationEnabled` must be a boolean."],
+    [
+        "webhook-trigger-verification-table",
+        "`[function.triggers.webhook.verification]` must be a table.",
+    ],
+    ["cron-trigger-cap", "A function declares at most ten cron entries."],
+    ["cron-trigger-entry", "Each `[[function.triggers.cron]]` entry is a table."],
+    ["cron-trigger-keys", "A cron entry accepts only its declared keys."],
+    [
+        "cron-trigger-name-required",
+        "A cron entry names itself: the name is half of its trigger key.",
+    ],
+    ["cron-trigger-name-charset", "A cron name uses the standalone trigger-key charset."],
+    ["cron-trigger-duplicate", "Each cron name appears once within the function."],
+    ["cron-trigger-expression-required", "A cron entry carries a `cron` expression."],
+    ["cron-trigger-overlap-policy", "`overlapPolicy` is `skip` or `allow`."],
+]);
+/**
+ * The file-decidable half of the webhook `signingSecret` rule (#3320). The
+ * SAME handler under the SAME ids is declared `apply` on the standalone
+ * `webhook` surface, whose CLI path does not run it: stage is a property of
+ * the (surface, rule) pair.
+ */
+const SIGNING_SECRET_RULES = functionRules("preflight", "src/config-surface/webhook-signing-secret.ts", "validateSigningSecretDeclaration", [
+    [
+        "signing-secret-required",
+        "A scheme that verifies with an HMAC secret must be given a `signingSecret`.",
+    ],
+    [
+        "whole-secret-reference",
+        "A supplied `signingSecret` is a whole `{{secrets.KEY}}` reference and " +
+            "nothing else — a literal is never stored.",
+    ],
+    [
+        "signing-secret-not-supported",
+        "A scheme whose key material lives in its config (`discord`, `jwt`, " +
+            "`plaid`) or that verifies nothing (`none`) refuses a `signingSecret`.",
+    ],
+]);
+/**
+ * The cron entries' schedule, decidable from the file (#3376).
+ *
+ * Both were `apply` until this issue — declared where they ran, with a note
+ * saying so — because the only implementation lived on the server. Splitting
+ * `src/cron-parser.ts` put the grammar and the `Intl` probe under
+ * `src/config-surface/`, so the CLI's push preflight runs the same rule
+ * before the first request and a malformed schedule no longer reaches apply.
+ */
+const CRON_SCHEDULE_RULES = functionRules("preflight", "src/config-surface/cron-rules.ts", "checkCronTriggerEntry", [
+    [
+        "cron-trigger-expression",
+        "The `cron` expression must parse under the server's five-field grammar " +
+            "(`parseCron`).",
+    ],
+    [
+        "cron-trigger-timezone",
+        "The `timezone`, unset reading as UTC, must be one " +
+            "`Intl.DateTimeFormat` accepts.",
+    ],
+]);
+/** What only the app's state can decide, at the push boundary (#3181). */
+const FUNCTION_TRIGGER_STATE_RULES = functionRules("apply", "src/services/function-trigger-validation.ts", "validateFunctionTriggerDeclaration", [
+    [
+        "webhook-trigger-settings",
+        "The webhook block's verification settings pass the same pipeline the " +
+            "standalone create runs (scheme config, replay protection, secret " +
+            "existence), prefixed `[function.triggers.webhook]: `.",
+    ],
+    [
+        "webhook-trigger-key-held",
+        "A standalone webhook that already holds the function's key blocks the " +
+            "trigger — nobody else's webhook is rewritten.",
+    ],
+    [
+        "function-webhook-cap",
+        "The per-app webhook cap, measured prospectively over what this push " +
+            "would add (the standalone cap's sentence, this surface's count).",
+    ],
+    [
+        "function-cron-cap",
+        "The per-app cron-trigger cap, measured prospectively over what this " +
+            "push would add.",
+    ],
+]);
 export const SERVER_FUNCTION_SURFACE = {
     label: "function",
     tables: [
@@ -5617,7 +7146,7 @@ export const SERVER_FUNCTION_SURFACE = {
                     // function with no gate fails closed at invoke, so accepting a bundle
                     // for one would report a successful push of something that can never
                     // run.
-                    validation: handledBy(FUNCTION_HANDLER, "ServerFunctionsController"),
+                    validation: handledBy(FUNCTION_HANDLER, "ServerFunctionsController", "apply"),
                 },
                 {
                     field: "inputSchema",
@@ -5625,7 +7154,7 @@ export const SERVER_FUNCTION_SURFACE = {
                     type: "json",
                     emit: "whenSet",
                     writableOn: BOTH,
-                    validation: handledBy(FUNCTION_HANDLER, "ServerFunctionsController"),
+                    validation: handledBy(FUNCTION_HANDLER, "ServerFunctionsController", "apply"),
                 },
                 {
                     field: "outputSchema",
@@ -5633,7 +7162,7 @@ export const SERVER_FUNCTION_SURFACE = {
                     type: "json",
                     emit: "whenSet",
                     writableOn: BOTH,
-                    validation: handledBy(FUNCTION_HANDLER, "ServerFunctionsController"),
+                    validation: handledBy(FUNCTION_HANDLER, "ServerFunctionsController", "apply"),
                 },
             ],
             notExposed: {
@@ -5669,6 +7198,18 @@ export const SERVER_FUNCTION_SURFACE = {
                         "Repointed by a config-version push; versions are nameless, so " +
                         "there is no `activeConfigName` for an author to write.",
                 },
+                activeConfigActivatedAt: {
+                    kind: "server-owned",
+                    note: "#3462 — WHEN the active version was put live. Stamped by both " +
+                        "doors that move the pointer (`config push` and the activate " +
+                        "route); an audit fact, so nothing authors it and `config pull` " +
+                        "does not write it back.",
+                },
+                activeConfigActivatedBy: {
+                    kind: "server-owned",
+                    note: "#3462 — WHICH admin put the active version live. Same two doors, " +
+                        "same reason: the actor is observed, never declared.",
+                },
                 runAs: {
                     kind: "server-owned",
                     note: "RETIRED from the write surface by #3279: function code acts as " +
@@ -5713,21 +7254,24 @@ export const SERVER_FUNCTION_SURFACE = {
                 },
                 mode: {
                     kind: "structural",
-                    note: '`mode = "request" | "task"` (#3281): a request function runs ' +
-                        "inside the call and returns its result; a task function returns " +
-                        "a run id and survives restarts (#3186). Stored on the config " +
-                        "version (as its `durable` column) and pushed with it, so it is " +
-                        "versioned with the code it describes rather than mutable on the " +
-                        "header. Absent means request.",
+                    note: "RETIRED (#3482), and still ACCEPTED through phase 4. A function " +
+                        "is a function: the CALLER picks the runtime at each call, with " +
+                        "`invoke` running it inside the request and `start` running it as " +
+                        "a task, cron fires always starting a task run and webhook " +
+                        "deliveries always running as a request. A file that still " +
+                        "carries the key pushes, with a warning naming it as ignored and " +
+                        "every other key applied, and `config pull` removes it; from " +
+                        "phase 5 (#3188) it is refused as an unknown key. Nothing reads " +
+                        "it, and its value is not validated. A function that must not run " +
+                        "under one runtime says so in code with `assertRuntime`.",
                 },
                 durable: {
                     kind: "structural",
-                    note: 'The accepted ALIAS of `mode` through the transition (#3281): ' +
-                        '`durable = true` is `mode = "task"` and `durable = false` is ' +
-                        '`mode = "request"`. When both keys are present they must agree, ' +
-                        "or the file is refused naming both. Kept as the adjective for the " +
-                        "property; `config pull` writes the authored bytes back unchanged, " +
-                        "so a file that says it keeps saying it until its author edits it.",
+                    note: "RETIRED (#3482), and still ACCEPTED through phase 4 — the same " +
+                        "as `mode`, whose alias it was. It named one runner for the whole " +
+                        "function, and there is no such thing any more. A file that " +
+                        "carries it pushes with a warning, `config pull` removes it, and " +
+                        "phase 5 refuses it.",
                 },
                 limits: {
                     kind: "structural",
@@ -5763,6 +7307,20 @@ export const SERVER_FUNCTION_SURFACE = {
     // The file is the `[function]` table and nothing else. The function's code is
     // in the source files `entry` reaches, not in a TOML table.
     tomlDocumentKeys: {},
+    // ── Cross-field rules (#3374) ─────────────────────────────────────────────
+    //
+    // Single-field refusals inside these modules (`mode`'s value, a webhook
+    // block's `verificationScheme`) are declared here too: this is the only
+    // id-bearing slot until #3375 gives `ConfigField.validation` a stage, and a
+    // module's list must equal its declarations in both directions.
+    crossFieldRules: [
+        ...TRIGGER_DECLARATION_RULES,
+        ...SIGNING_SECRET_RULES,
+        // #3376 — after the signing-secret group, mirroring the order
+        // `functionTomlPreflightErrors` runs them in.
+        ...CRON_SCHEDULE_RULES,
+        ...FUNCTION_TRIGGER_STATE_RULES,
+    ],
 };
 // ── src/config-surface/test-case.ts ──────────────────────────────────────
 /**
@@ -5789,6 +7347,18 @@ export const SERVER_FUNCTION_SURFACE = {
  * re-stringifies on store.
  */
 const TEST_CASE_HANDLER = "src/admin-api.ts";
+/**
+ * ── Why this module's CLI handler is declared `apply` (#3375) ─────────────
+ *
+ * A `preflight` handler must be VENDORED — its module lives under
+ * `src/config-surface/`, so the CLI runs the server's own copy through the
+ * generated artifact rather than a second implementation. A handler that
+ * lives in `cli/src/` is a CLI-only copy of a server rule, which is precisely
+ * the drift this project exists to remove; until it is vendored it cannot make
+ * the registry's preflight promise, whatever the push path happens to do
+ * today. Declared `apply`, and recorded as a finding for the validation child
+ * (#3379) rather than papered over with a third stage.
+ */
 const CLI_SYNC = "cli/src/commands/sync.ts";
 export const TEST_CASE_SURFACE = {
     label: "test-case",
@@ -5806,7 +7376,7 @@ export const TEST_CASE_SURFACE = {
                     emit: "always",
                     writableOn: BOTH,
                     // Required and trimmed on create; an empty name is a 400.
-                    validation: handledBy(TEST_CASE_HANDLER, "AdminAPI"),
+                    validation: handledBy(TEST_CASE_HANDLER, "AdminAPI", "apply"),
                 },
                 {
                     field: "description",
@@ -5824,7 +7394,7 @@ export const TEST_CASE_SURFACE = {
                     writableOn: BOTH,
                     // Required. TOML carries the JSON text; the wire carries the parsed
                     // object, which the server re-stringifies for storage.
-                    validation: handledBy(CLI_SYNC, "parseTestCaseToml"),
+                    validation: handledBy(CLI_SYNC, "parseTestCaseToml", "apply"),
                 },
                 {
                     field: "configId",
@@ -5833,7 +7403,7 @@ export const TEST_CASE_SURFACE = {
                     emit: "always",
                     writableOn: BOTH,
                     // Authored as the config's NAME and resolved to an id at push time.
-                    validation: handledBy(CLI_SYNC, "parseTestCaseToml"),
+                    validation: handledBy(CLI_SYNC, "parseTestCaseToml", "apply"),
                 },
                 {
                     field: "evaluatorPromptId",
@@ -5842,7 +7412,7 @@ export const TEST_CASE_SURFACE = {
                     emit: "always",
                     writableOn: BOTH,
                     // Authored as the judge prompt's KEY and resolved to an id at push.
-                    validation: handledBy(CLI_SYNC, "parseTestCaseToml"),
+                    validation: handledBy(CLI_SYNC, "parseTestCaseToml", "apply"),
                 },
                 {
                     field: "evaluatorConfigId",
@@ -5850,7 +7420,7 @@ export const TEST_CASE_SURFACE = {
                     type: "string",
                     emit: "always",
                     writableOn: BOTH,
-                    validation: handledBy(CLI_SYNC, "parseTestCaseToml"),
+                    validation: handledBy(CLI_SYNC, "parseTestCaseToml", "apply"),
                 },
                 {
                     field: "expectedOutputPattern",
@@ -5867,7 +7437,7 @@ export const TEST_CASE_SURFACE = {
                     emit: "always",
                     writableOn: BOTH,
                     // JSON array of strings; TOML carries the JSON text.
-                    validation: handledBy(CLI_SYNC, "parseTestCaseToml"),
+                    validation: handledBy(CLI_SYNC, "parseTestCaseToml", "apply"),
                 },
                 {
                     field: "expectedJsonSubset",
@@ -5876,7 +7446,7 @@ export const TEST_CASE_SURFACE = {
                     emit: "always",
                     writableOn: BOTH,
                     // JSON object, deep-partial-matched against the parsed output.
-                    validation: handledBy(CLI_SYNC, "parseTestCaseToml"),
+                    validation: handledBy(CLI_SYNC, "parseTestCaseToml", "apply"),
                 },
             ],
             notExposed: {
@@ -6070,7 +7640,7 @@ export const APP_SETTINGS_SURFACE = {
                     // with `=== true`, so `"false"` must be a 400 rather than a stored
                     // `true`. The generated request schema stays keys-only (#1976), so
                     // the check is `parseDirectLlmEnabledWrite` in the handler.
-                    validation: handledBy(SETTINGS_HANDLER, "SettingsController"),
+                    validation: handledBy(SETTINGS_HANDLER, "SettingsController", "apply"),
                 },
                 {
                     field: "allowedDomains",
@@ -6088,7 +7658,7 @@ export const APP_SETTINGS_SURFACE = {
                     writableOn: UPDATE_ONLY,
                     // `+primitivetest` bypass whitelist (#490/#675), shape-checked by
                     // `validateTestAccountBaseEmails`.
-                    validation: handledBy(SETTINGS_HANDLER, "SettingsController"),
+                    validation: handledBy(SETTINGS_HANDLER, "SettingsController", "apply"),
                 },
                 {
                     field: "largeDocumentWindowDays",
@@ -6102,7 +7672,7 @@ export const APP_SETTINGS_SURFACE = {
                     // Refused rather than clamped: answering 200 to a 30-day window the
                     // server does not keep would have the caller plan a month of
                     // offline work around it (`parseLargeDocumentWindowSetting`).
-                    validation: handledBy(SETTINGS_HANDLER, "SettingsController"),
+                    validation: handledBy(SETTINGS_HANDLER, "SettingsController", "apply"),
                 },
             ],
             notExposed: {
@@ -6220,7 +7790,7 @@ export const APP_SETTINGS_SURFACE = {
                     // per-type secret table, cross-entry URI uniqueness and the
                     // aggregate caps are all `validateGoogleClientsWrite`
                     // (`src/services/google-clients.ts`), applied by the handler.
-                    validation: handledBy(SETTINGS_HANDLER, "SettingsController"),
+                    validation: handledBy(SETTINGS_HANDLER, "SettingsController", "apply"),
                 },
                 {
                     field: "passkeyEnabled",
@@ -6241,7 +7811,7 @@ export const APP_SETTINGS_SURFACE = {
                     writableOn: UPDATE_ONLY,
                     // Mirrored into the two retired model fields by the handler so an
                     // un-migrated reader cannot disagree.
-                    validation: handledBy(SETTINGS_HANDLER, "SettingsController"),
+                    validation: handledBy(SETTINGS_HANDLER, "SettingsController", "apply"),
                 },
                 {
                     field: "appleSignInEnabled",
@@ -6271,7 +7841,7 @@ export const APP_SETTINGS_SURFACE = {
                     // `validateRedirectUris`; matching is fail-closed, and a request
                     // whose target this list does not cover gets a code-only email
                     // rather than a link (#2884).
-                    validation: handledBy(SETTINGS_HANDLER, "SettingsController"),
+                    validation: handledBy(SETTINGS_HANDLER, "SettingsController", "apply"),
                 },
                 {
                     field: "passkeyRpConfig",
@@ -6281,7 +7851,7 @@ export const APP_SETTINGS_SURFACE = {
                     writableOn: UPDATE_ONLY,
                     // `[auth.passkeys]` — rpId → { name }, shape-checked by
                     // `SettingsController.validatePasskeyRpConfig`.
-                    validation: handledBy(SETTINGS_HANDLER, "SettingsController"),
+                    validation: handledBy(SETTINGS_HANDLER, "SettingsController", "apply"),
                 },
                 {
                     field: "passkeyUserVerification",
@@ -6299,7 +7869,7 @@ export const APP_SETTINGS_SURFACE = {
                     // both halves of every passkey ceremony state, so an unrecognized
                     // value is a 400 rather than a silent fall back to the default —
                     // the `directLlmEnabled` rationale, applied to a security policy.
-                    validation: handledBy(SETTINGS_HANDLER, "SettingsController"),
+                    validation: handledBy(SETTINGS_HANDLER, "SettingsController", "apply"),
                 },
             ],
             notExposed: {},
@@ -6463,10 +8033,8 @@ export const CONFIG_SURFACES = [
  * is as review-visible as weakening any other assertion.
  */
 export const CROSS_FIELD_RULES_UNMIGRATED = [
-    "workflow",
     "prompt",
     "integration",
-    "webhook",
     "cron-trigger",
     "blob-bucket",
     "email-template",
@@ -6475,7 +8043,6 @@ export const CROSS_FIELD_RULES_UNMIGRATED = [
     "group-type-config",
     "collection-type-config",
     "metadata-category-config",
-    "function",
     "test-case",
     "app-settings",
 ];
@@ -6603,6 +8170,8 @@ export const GENERATED_CONFIG_MODEL_FIELDS = {
         "outputFormat",
         "outputSchema",
         "providerConfig",
+        "reasoningEffort",
+        "reasoningBudget",
         "status",
         "createdBy",
         "createdAt",
@@ -6770,6 +8339,8 @@ export const GENERATED_CONFIG_MODEL_FIELDS = {
         "description",
         "status",
         "activeConfigId",
+        "activeConfigActivatedAt",
+        "activeConfigActivatedBy",
         "runAs",
         "access",
         "inputSchema",