primitive-admin 1.1.0-alpha.82 → 1.1.0-alpha.84

package/dist/src/lib/generated-config-surfaces.js

@@ -38,9 +38,16 @@ export const UPDATE_ONLY = ["update"];
  * the definition never dispatches through it (#1976 decision of record); the
  * guard asserts the export exists so a renamed handler fails the CLI unit suite
  * instead of leaving a dangling reference (#2644 behavior 2b).
+ *
+ * `stage` is REQUIRED (#3375): a field handler that does not say when it runs
+ * makes the same empty promise the cross-field slot made before #3373 — it
+ * names an owner, and criterion 5 has nothing to check. A `preflight` handler
+ * is reached from `cli/src/commands/sync.ts#runConfigPushPreflight` before the
+ * first mutating call, which `findUnreachedPreflightRules` proves statically;
+ * an `apply` handler is everything else.
  */
-export function handledBy(modulePath, exportName) {
-    return { handler: `${modulePath}#${exportName}` };
+export function handledBy(modulePath, exportName, stage) {
+    return { handler: `${modulePath}#${exportName}`, stage };
 }
 /**
  * Name the ONE export that enforces a cross-field rule, as
@@ -1395,6 +1402,616 @@ export function crossFieldRulesForStage(surface, stage) {
     }
     return (surface.crossFieldRules ?? []).filter((rule) => rule.stage === stage);
 }
+// ── src/config-surface/preflight-reachability.ts ─────────────────────────
+/**
+ * Is a rule declared `preflight` actually reached before `config push` mutates
+ * anything? (issue #3375, project phase 3, intent §Success criteria 5.)
+ *
+ * #3373 gave a rule a `stage`; #3374 declared three surfaces' rules. Both left
+ * the string a PROMISE. "This runs before the first mutating call" was
+ * satisfied by typing `preflight` beside a rule that is not on the preflight
+ * path at all, because the push preflight was an inline block inside the
+ * command's `.action()` callback with no exported symbol — so "reached from the
+ * preflight" had nothing to resolve against.
+ *
+ * #3375 extracts that block into `cli/src/commands/sync.ts#runConfigPushPreflight`
+ * and this module answers the question statically, from the declared
+ * `<module>#<export>`:
+ *
+ *   - `reachableExports` walks the call graph from one entry symbol over module
+ *     SOURCE TEXT and returns what it reached — plus what it could NOT resolve,
+ *     so silence is never a pass.
+ *   - `findUnreachedPreflightRules` reports every `preflight` declaration,
+ *     cross-field or single-field, whose handler is missing from that set.
+ *   - `findMalformedFieldValidationStages` is the field-level twin of #3373's
+ *     `findMalformedRuleDeclarations`: `ConfigField["validation"]` gained a
+ *     `stage` here, and it must be well-formed to mean anything.
+ *
+ * Everything is a PURE function over values and over source text the caller
+ * passes in: `cli/tests/unit/config-surface-preflight-staging-3375.test.ts`
+ * does the filesystem walk, so this module stays vendorable (`types.ts`
+ * §Purity), exactly the split `rules.ts` already uses.
+ *
+ * ── Two things this check is NOT ──────────────────────────────────────────
+ *
+ * It is NECESSARY, not sufficient, and there is deliberately no converse. A
+ * handler reached on one surface's leg satisfies a `preflight` declaration on
+ * another (the residual the intent accepts and #3379 records), and asking "is
+ * this `apply` rule reached from the preflight?" would be wrong by
+ * construction: `validateSigningSecretDeclaration` IS reached on the function
+ * leg and IS correctly `apply` on the webhook surface, where no CLI call
+ * exists.
+ *
+ * The walk is identifier-based over masked source, so it over-approximates in
+ * the PASSING direction: a local variable shadowing an imported handler's name
+ * reads as a call. That is the safe direction for a guard whose failure mode
+ * must be "a promise you did not keep", not "a promise you did keep, reported
+ * as broken".
+ */
+/** A field's `validation` object may carry these keys and no others (#3375). */
+export const FIELD_VALIDATION_KEYS = ["handler", "stage"];
+const PREFLIGHT_IDENTIFIER = /[A-Za-z_$][\w$]*/g;
+const PREFLIGHT_DECLARATION = /^(?:export\s+)?(?:default\s+)?(?:declare\s+)?(?:abstract\s+)?(?:async\s+)?(function|class|const|let|var|type|interface|enum)\s*\*?\s+([A-Za-z_$][\w$]*)/;
+/** The `<module>` and `<export>` halves, or null when the reference is malformed. */
+function preflightSplitSymbol(symbol) {
+    if (typeof symbol !== "string")
+        return null;
+    const [module, name, ...rest] = symbol.split("#");
+    if (!module || !name || rest.length)
+        return null;
+    return { module, name };
+}
+/** Index of the `}`/`)`/`]` closing the bracket at `open`, or -1. */
+function preflightMatchingBracket(masked, open) {
+    const pairs = { "[": "]", "{": "}", "(": ")" };
+    const stack = [];
+    for (let i = open; i < masked.length; i++) {
+        const ch = masked[i];
+        if (pairs[ch]) {
+            stack.push(pairs[ch]);
+            continue;
+        }
+        if (ch === "]" || ch === "}" || ch === ")") {
+            if (!stack.length || stack.pop() !== ch)
+                return -1;
+            if (!stack.length)
+                return i;
+        }
+    }
+    return -1;
+}
+/**
+ * A keyword that can only OPEN a top-level declaration, never continue an
+ * expression: seeing one at column zero ends the statement before it.
+ *
+ * `async` and `abstract` are spelled with what must follow them, because both
+ * can legitimately continue an expression across a line break; `function` and
+ * `class` alone cannot start an indented continuation in a formatted file, and
+ * the column-zero test below is what rules out the expression forms.
+ */
+const PREFLIGHT_DECLARATION_OPENS = /^(?:export|import|declare|function|class|const|let|var|type|interface|enum|async\s+function|abstract\s+class)\b/;
+/**
+ * End of a `const`/`let`/`var`/`type` statement that begins at `from`: the
+ * first `;` outside any bracket, or the line break before the next top-level
+ * declaration — whichever comes first.
+ *
+ * The second boundary is not optional. TypeScript's automatic semicolon
+ * insertion makes `export const entry = () => 1` a complete statement, and a
+ * scan that only ever stops at a `;` runs on through every following
+ * declaration to the next one that has one — attributing an unrelated
+ * apply-only function's body to this declaration, which is an
+ * over-approximation in the PASSING direction: the staging guard would report
+ * a handler as reached that the preflight never mentions. A depth-zero line
+ * break followed by a declaration keyword at column zero is where a formatted
+ * file puts the boundary, and an indented continuation line (`? x`, `: y`,
+ * `| A`, `.then(…)`) never matches it.
+ *
+ * Falling back to the end of the module would let one missing semicolon
+ * attribute the whole rest of the file to a single declaration — an
+ * over-approximation so large the guard would pass on anything. The fallback is
+ * the end of the line instead, which is what an unterminated statement looks
+ * like in a formatted file.
+ */
+function preflightStatementEnd(masked, from) {
+    let depth = 0;
+    for (let i = from; i < masked.length; i++) {
+        const ch = masked[i];
+        if (ch === "{" || ch === "(" || ch === "[")
+            depth++;
+        else if (ch === "}" || ch === ")" || ch === "]")
+            depth--;
+        else if (ch === ";" && depth <= 0)
+            return i;
+        else if (ch === "\n" && depth <= 0) {
+            const next = preflightNextSignificant(masked, i + 1);
+            if (next === -1)
+                break;
+            // Column zero only: a continuation line is indented, and a comment ahead
+            // of the next declaration is already blanked to whitespace.
+            if (masked[next - 1] !== "\n")
+                continue;
+            if (PREFLIGHT_DECLARATION_OPENS.test(masked.slice(next, next + 40))) {
+                return i;
+            }
+        }
+    }
+    const newline = masked.indexOf("\n", from);
+    return newline === -1 ? masked.length : newline;
+}
+/** Index of the next non-whitespace character at or after `from`, or -1. */
+function preflightNextSignificant(masked, from) {
+    for (let i = from; i < masked.length; i++) {
+        if (!/\s/.test(masked[i]))
+            return i;
+    }
+    return -1;
+}
+/** Index of the previous non-whitespace character before `before`, or -1. */
+function preflightPreviousSignificant(masked, before) {
+    for (let i = before - 1; i >= 0; i--) {
+        if (!/\s/.test(masked[i]))
+            return i;
+    }
+    return -1;
+}
+/**
+ * The character ending the token before `before` — `"` when that token is a
+ * string literal.
+ *
+ * The masker blanks a literal's QUOTES along with its contents, so a
+ * literal type is invisible in the masked view and the search above walks
+ * straight past it to whatever preceded it in the annotation. That matters for
+ * exactly one decision: `function typeOfValue(v): Kind | "null" | "unknown" {`
+ * masks to `… Kind |        |           {`, whose previous significant
+ * character is a `|` — a type continuation — so the body would be read as an
+ * object type, skipped whole, and the NEXT function's body taken as this one's.
+ * The literal table restores the token the mask erased.
+ */
+function preflightPreviousTokenEnd(masked, literals, before) {
+    const previous = preflightPreviousSignificant(masked, before);
+    const gapStart = previous + 1;
+    for (const literal of literals) {
+        if (literal.start >= gapStart && literal.end <= before)
+            return '"';
+    }
+    return previous === -1 ? "" : masked[previous];
+}
+/**
+ * A character that can only CONTINUE a type annotation, so a `{` right after it
+ * opens an object type rather than a function body.
+ */
+const PREFLIGHT_TYPE_CONTINUES = new Set([
+    ":",
+    "|",
+    "&",
+    ",",
+    "(",
+    "[",
+    "<",
+    "=",
+]);
+/**
+ * Index of the `{` that opens a function's BODY, given the offset just past its
+ * name — or -1 when it has none (an overload signature, a `declare`).
+ *
+ * Not simply the next `{`. A parameter destructured into an inline object type
+ * (`input: { configDir: string; … }`) and a return type naming one
+ * (`Promise<{ parsedVars: … }>`) each open a brace first, and taking either
+ * would end the declaration's span at the signature — after which every symbol
+ * the body really calls is invisible, and a staging check whose walk reaches
+ * nothing passes everything.
+ *
+ * So: match the parameter list, then read the return-type annotation off the
+ * text. A `{` inside a generic argument, or one following a character that can
+ * only continue a type, is skipped whole; the first other `{` is the body. A
+ * `;` reached first means there is no body at all. A literal return type
+ * (`: "ok" {`) is read through the lexer's literal table, because the mask
+ * erased its quotes along with its contents.
+ */
+function preflightFunctionBody(masked, literals, afterName) {
+    const paren = masked.indexOf("(", afterName);
+    if (paren === -1)
+        return -1;
+    const closeParen = preflightMatchingBracket(masked, paren);
+    if (closeParen === -1)
+        return -1;
+    let angle = 0;
+    for (let i = closeParen + 1; i < masked.length; i++) {
+        const ch = masked[i];
+        if (ch === ";")
+            return -1; // an overload signature: no body follows
+        if (ch === "<") {
+            angle++;
+            continue;
+        }
+        if (ch === ">" && masked[i - 1] !== "=") {
+            angle = Math.max(0, angle - 1);
+            continue;
+        }
+        if (ch !== "{")
+            continue;
+        const character = preflightPreviousTokenEnd(masked, literals, i);
+        if (angle === 0 && !PREFLIGHT_TYPE_CONTINUES.has(character))
+            return i;
+        const close = preflightMatchingBracket(masked, i);
+        if (close === -1)
+            return -1;
+        i = close;
+    }
+    return -1;
+}
+/** Every top-level declaration of a masked module, with its span. */
+function preflightTopLevelDeclarations(masked, literals) {
+    const out = new Map();
+    /** Names whose recorded span is a signature with no body, so far. */
+    const signatureOnly = new Set();
+    let i = 0;
+    let depth = 0;
+    while (i < masked.length) {
+        const ch = masked[i];
+        const boundary = i === 0 || !/[\w$]/.test(masked[i - 1]);
+        if (depth === 0 && /[A-Za-z_$]/.test(ch) && boundary) {
+            const match = PREFLIGHT_DECLARATION.exec(masked.slice(i, i + 200));
+            if (match) {
+                const kind = match[1];
+                const name = match[2];
+                const afterName = i + match[0].length;
+                let end;
+                let hasBody = true;
+                if (kind === "function" ||
+                    kind === "class" ||
+                    kind === "interface" ||
+                    kind === "enum") {
+                    const brace = kind === "function"
+                        ? preflightFunctionBody(masked, literals, afterName)
+                        : masked.indexOf("{", afterName);
+                    const close = brace === -1 ? -1 : preflightMatchingBracket(masked, brace);
+                    hasBody = close !== -1;
+                    end = close === -1 ? preflightStatementEnd(masked, afterName) : close;
+                }
+                else {
+                    end = preflightStatementEnd(masked, afterName);
+                }
+                // The declaration with a BODY wins, whichever came first: a `declare`
+                // or an overload signature ahead of the real one carries only types,
+                // and letting it hold the name would hide every call the
+                // implementation makes — the walk would report a genuinely reached
+                // handler as unreached. Between two bodies the first still wins.
+                if (!out.has(name) || (signatureOnly.has(name) && hasBody)) {
+                    out.set(name, { start: i, end });
+                    if (hasBody)
+                        signatureOnly.delete(name);
+                    else
+                        signatureOnly.add(name);
+                }
+                i = end + 1;
+                continue;
+            }
+        }
+        if (ch === "{" || ch === "(" || ch === "[")
+            depth++;
+        else if (ch === "}" || ch === ")" || ch === "]")
+            depth = Math.max(0, depth - 1);
+        i++;
+    }
+    return out;
+}
+/**
+ * Read one module's imports, re-exports and declarations.
+ *
+ * The string CONTENTS are blanked in the masked view — that is what stops a
+ * name inside a comment or a message from reading as a call — so a module
+ * specifier is recovered from the lexer's literal table by position rather than
+ * from the masked text.
+ */
+function preflightModuleFacts(source) {
+    const { masked, strings } = lexRuleModuleSource(source);
+    const literalAfter = (index) => {
+        for (const literal of strings) {
+            if (literal.start >= index)
+                return literal.value;
+        }
+        return null;
+    };
+    const imports = new Map();
+    const namespaces = new Map();
+    const namedReExports = new Map();
+    const starReExports = [];
+    /**
+     * `{ a, b as c, type D }` → the value bindings it introduces, as
+     * (name on THIS side, name on the OTHER module's side) pairs. The same
+     * shape reads an import clause and a re-export clause, which are mirrors.
+     */
+    const readClause = (clause, onBinding) => {
+        for (const piece of clause.split(",")) {
+            const parts = piece.trim().split(/\s+/).filter(Boolean);
+            if (!parts.length || parts[0] === "type")
+                continue; // `{ type X }`
+            const there = parts[0];
+            const here = parts.length >= 3 && parts[1] === "as" ? parts[2] : there;
+            onBinding(here, there);
+        }
+    };
+    // Anchored at the start of a line, and stopping at a `;`: a static import is
+    // always top-level, and an unanchored `\bimport\b` would let a dynamic
+    // `await import(…)` deep inside a function run on to some unrelated `from`
+    // and invent a binding out of whichever string literal came next.
+    for (const match of masked.matchAll(/^import\b([^;]*?)\bfrom\b/gm)) {
+        const clause = match[1];
+        if (/^\s*type\b/.test(clause))
+            continue; // `import type { … } from`
+        const specifier = literalAfter((match.index ?? 0) + match[0].length);
+        if (!specifier)
+            continue;
+        const namespace = /\*\s+as\s+([A-Za-z_$][\w$]*)/.exec(clause);
+        if (namespace)
+            namespaces.set(namespace[1], specifier);
+        const named = /\{([^}]*)\}/.exec(clause);
+        if (named) {
+            readClause(named[1], (here, there) => {
+                imports.set(here, { specifier, imported: there });
+            });
+        }
+    }
+    for (const match of masked.matchAll(/^export\s+(type\s+)?\{([^}]*)\}\s*from\b/gm)) {
+        if (match[1])
+            continue; // `export type { … } from` re-exports no value
+        const specifier = literalAfter((match.index ?? 0) + match[0].length);
+        if (!specifier)
+            continue;
+        readClause(match[2], (here, there) => {
+            namedReExports.set(here, { specifier, local: there });
+        });
+    }
+    for (const match of masked.matchAll(/^export\s*\*\s*from\b/gm)) {
+        const specifier = literalAfter((match.index ?? 0) + match[0].length);
+        if (specifier)
+            starReExports.push(specifier);
+    }
+    return {
+        masked,
+        declarations: preflightTopLevelDeclarations(masked, strings),
+        imports,
+        namespaces,
+        namedReExports,
+        starReExports,
+    };
+}
+/**
+ * Walk the call graph from `entry` and return every symbol it reaches.
+ *
+ * An identifier inside a reached declaration's span is followed when it names
+ * another top-level declaration of the same module, or a value import — which
+ * resolves through the graph to whichever candidate module DECLARES the name,
+ * following `export { x } from` and `export * from` on the way. A symbol is
+ * recorded under the module that declares it, never under a barrel that merely
+ * re-exports it: a declaration that names the barrel is reported unreached,
+ * because the point of the string is to name the one implementation.
+ */
+export function reachableExports(entry, graph) {
+    const reached = new Set();
+    const unresolved = new Set();
+    const facts = new Map();
+    const queued = new Set();
+    const queue = [];
+    const factsFor = (module) => {
+        const source = graph.modules.get(module);
+        if (source === undefined)
+            return null;
+        let cached = facts.get(module);
+        if (!cached) {
+            cached = preflightModuleFacts(source);
+            facts.set(module, cached);
+        }
+        return cached;
+    };
+    /** Candidate modules for a specifier, reporting a dangling relative one. */
+    const candidates = (from, specifier) => {
+        const resolved = graph.resolve(from, specifier);
+        if (resolved === null)
+            return []; // a package: not followed, not reported
+        if (resolved.length === 0) {
+            unresolved.add(`${from}: "${specifier}" resolves to no module in the graph`);
+        }
+        return resolved;
+    };
+    /**
+     * Where `name` is really DECLARED, starting from `module` — following named
+     * and star re-exports. `[]` when nothing in reach declares it.
+     */
+    const declaringSymbols = (module, name, seen) => {
+        const key = `${module}#${name}`;
+        if (seen.has(key))
+            return [];
+        seen.add(key);
+        const moduleFacts = factsFor(module);
+        if (!moduleFacts)
+            return [];
+        if (moduleFacts.declarations.has(name))
+            return [key];
+        const out = [];
+        const named = moduleFacts.namedReExports.get(name);
+        if (named) {
+            for (const candidate of candidates(module, named.specifier)) {
+                out.push(...declaringSymbols(candidate, named.local, seen));
+            }
+        }
+        for (const specifier of moduleFacts.starReExports) {
+            for (const candidate of candidates(module, specifier)) {
+                out.push(...declaringSymbols(candidate, name, seen));
+            }
+        }
+        return out;
+    };
+    const enqueue = (symbol) => {
+        if (queued.has(symbol))
+            return;
+        queued.add(symbol);
+        queue.push(symbol);
+    };
+    /** Follow an imported binding to the symbol(s) it really names. */
+    const followImport = (module, specifier, imported) => {
+        for (const candidate of candidates(module, specifier)) {
+            for (const symbol of declaringSymbols(candidate, imported, new Set())) {
+                enqueue(symbol);
+            }
+        }
+    };
+    const parsedEntry = preflightSplitSymbol(entry);
+    if (!parsedEntry) {
+        return {
+            reached,
+            unresolved: [
+                `"${String(entry)}" is not a "<module>#<export>" reference`,
+            ],
+        };
+    }
+    const entrySymbols = declaringSymbols(parsedEntry.module, parsedEntry.name, new Set());
+    if (entrySymbols.length === 0) {
+        unresolved.add(`${entry}: no module in the graph declares or re-exports it — the ` +
+            "entry point was renamed, un-exported, or never added to the graph");
+    }
+    for (const symbol of entrySymbols)
+        enqueue(symbol);
+    while (queue.length) {
+        const symbol = queue.shift();
+        const parsed = preflightSplitSymbol(symbol);
+        const moduleFacts = factsFor(parsed.module);
+        if (!moduleFacts)
+            continue;
+        const span = moduleFacts.declarations.get(parsed.name);
+        if (!span)
+            continue;
+        reached.add(symbol);
+        const body = moduleFacts.masked.slice(span.start, span.end);
+        // `ns.member` — the namespace binding's own name says nothing, so the
+        // member is read off the text rather than off the identifier stream.
+        for (const [local, specifier] of moduleFacts.namespaces) {
+            const member = new RegExp(`\\b${local}\\s*\\.\\s*([A-Za-z_$][\\w$]*)`, "g");
+            for (const hit of body.matchAll(member)) {
+                followImport(parsed.module, specifier, hit[1]);
+            }
+        }
+        for (const hit of body.matchAll(PREFLIGHT_IDENTIFIER)) {
+            const name = hit[0];
+            if (name === parsed.name)
+                continue;
+            // A property access is not a reference to a top-level name; `ns.member`
+            // above is the one case where it is, and it is handled there. Walked
+            // backwards rather than by slicing, so a long declaration costs the
+            // walk linear time and not quadratic.
+            let back = (hit.index ?? 0) - 1;
+            while (back >= 0 && /\s/.test(body[back]))
+                back--;
+            if (back >= 0 && body[back] === ".")
+                continue;
+            if (moduleFacts.declarations.has(name)) {
+                enqueue(`${parsed.module}#${name}`);
+                continue;
+            }
+            const imported = moduleFacts.imports.get(name);
+            if (imported) {
+                followImport(parsed.module, imported.specifier, imported.imported);
+            }
+        }
+    }
+    return { reached, unresolved: [...unresolved].sort() };
+}
+/** The handler's `<module>` half, or "" when the reference is malformed. */
+function preflightHandlerModule(handler) {
+    const parsed = preflightSplitSymbol(handler);
+    return parsed ? parsed.module : "";
+}
+/**
+ * Every fault in one surface's FIELD validation declarations, each naming the
+ * surface and the field. `[]` means every field is well-formed.
+ *
+ * Runs over every surface in the registry, migrated or not: field declarations
+ * exist independently of the cross-field slot, so the
+ * `CROSS_FIELD_RULES_UNMIGRATED` ratchet does not — and must not — stand
+ * between a field-level `preflight` declaration and this check (DSO-3375-001).
+ */
+export function findMalformedFieldValidationStages(surface) {
+    const out = [];
+    for (const table of surface.tables ?? []) {
+        for (const field of table.fields ?? []) {
+            const validation = field.validation;
+            if (validation === "passthrough")
+                continue;
+            const where = `${surface.label}.${field.field}`;
+            if (!validation || typeof validation !== "object") {
+                out.push(`${where}: \`validation\` must be "passthrough" or ` +
+                    "`{ handler, stage }`");
+                continue;
+            }
+            const keys = Object.keys(validation).sort();
+            const expected = [...FIELD_VALIDATION_KEYS].sort();
+            if (keys.join(",") !== expected.join(",")) {
+                out.push(`${where}: \`validation\` declares ${keys.join(", ") || "no keys"} — ` +
+                    `exactly ${expected.join(" and ")}, and nothing else: the slot ` +
+                    "classifies, it does not carry behavior knobs");
+            }
+            const handler = validation.handler;
+            const modulePath = preflightHandlerModule(handler);
+            if (!modulePath) {
+                out.push(`${where}: handler ${JSON.stringify(handler)} is not a ` +
+                    '"<module>#<export>" reference');
+            }
+            const stage = validation.stage;
+            if (!CROSS_FIELD_RULE_STAGES.includes(stage)) {
+                out.push(`${where}: stage ${JSON.stringify(stage)} is not one of ` +
+                    CROSS_FIELD_RULE_STAGES.join(", ") +
+                    " — a field handler says when it runs");
+            }
+            else if (stage === "preflight" &&
+                modulePath &&
+                !modulePath.startsWith(PREFLIGHT_HANDLER_MODULE_PREFIX)) {
+                out.push(`${where}: a \`preflight\` handler is vendored into the CLI, so its ` +
+                    `module lives under ${PREFLIGHT_HANDLER_MODULE_PREFIX} — ` +
+                    `"${modulePath}" does not`);
+            }
+        }
+    }
+    return out.sort();
+}
+/**
+ * Every `preflight` declaration on this surface whose handler the walk did not
+ * reach, each naming the surface, the rule (or field), the handler and the
+ * entry point.
+ *
+ * The FIELD half runs on every surface. The CROSS-FIELD half runs only where a
+ * surface has declared, because `crossFieldRulesForStage` throws for one that
+ * has not — "not declared yet" is never "rule-free" (#3373), and asking it
+ * here would turn an unmigrated surface into a crash rather than a skip.
+ */
+export function findUnreachedPreflightRules(surface, reached, entry) {
+    const out = [];
+    const unreached = (subject, handler) => `${surface.label}: ${subject} is declared \`preflight\`, but its handler ` +
+        `${handler} is not reached from ${entry} — a preflight rule runs before ` +
+        "the first mutating call, or it is not preflight";
+    for (const table of surface.tables ?? []) {
+        for (const field of table.fields ?? []) {
+            const validation = field.validation;
+            if (!validation || typeof validation !== "object")
+                continue;
+            const { handler, stage } = validation;
+            if (stage !== "preflight")
+                continue;
+            const reference = String(handler);
+            if (reached.has(reference))
+                continue;
+            out.push(unreached(`field \`${field.field}\``, reference));
+        }
+    }
+    if (hasDeclaredCrossFieldRules(surface)) {
+        for (const rule of crossFieldRulesForStage(surface, "preflight")) {
+            if (reached.has(rule.handler))
+                continue;
+            out.push(unreached(`rule "${rule.id}"`, rule.handler));
+        }
+    }
+    return out.sort();
+}
 /**
  * Protocol keys every config UPDATE accepts, whichever object it is.
  *
@@ -2467,144 +3084,170 @@ export function parseFunctionManifest(value) {
         errors: [],
     };
 }
-export const FUNCTION_MODES = ["request", "task", "any"];
-/** The runners, for the doors where a caller states one (#3454, D3454-004). */
-export const FUNCTION_RUNNERS = ["request", "task"];
+// ── src/config-surface/function-retired-keys.ts ──────────────────────────
 /**
- * The rule ids this module owns, declared on the `function` surface (#3374).
- * The union below closes `refuseMode`'s id parameter: a fourth refusal cannot
- * compile without a fourth id, and a fourth id fails `cli-unit-tests` until the
- * surface declares it.
+ * The runtime keys a `functions/<key>.toml` no longer decides anything with —
+ * #3482, project `server-functions` phase 4.
+ *
+ * The sponsor settled it on 2026-09-15 (the intent, "Mode vocabulary?",
+ * amended again): the config says NOTHING about how a function runs. A
+ * function is a function; the caller picks the runtime at each call, cron
+ * fires always start a task run, webhook deliveries always run as a request,
+ * and a function that must not run under one runtime tests for it in code with
+ * `assertRuntime`.
+ *
+ * ── Why these keys are accepted, not refused ──────────────────────────────
+ *
+ * Every tree pushed since #3454 that declares a cron trigger carries
+ * `mode = …` ON THE ENTRY, because `cron-trigger-mode-required` demanded it;
+ * plenty carry a top-level `mode` or the older `durable`. Removing the keys
+ * from the accepted set outright would refuse those trees with an unknown-key
+ * error one day after the platform insisted on them, which is the opposite of
+ * principle 5 inside a non-breaking phase.
+ *
+ * So through phase 4 they are ACCEPTED and IGNORED, with one warning per key
+ * naming it and the line to delete; from phase 5 (#3188) they are refused with
+ * the rest of the retirement matrix. The value is not validated — there is
+ * nothing left to validate it against, and refusing a bad value for a key
+ * nobody reads would be a refusal about spelling alone.
+ *
+ * Pure: no models, no tenant context, no `env` (see `types.ts` §Purity). Both
+ * the CLI preflight (vendored by `cli/scripts/gen-config-surfaces.mjs`) and the
+ * admin config-version route read this one scanner, so the warning an author
+ * sees from `config push` is the sentence the API answers with.
  */
-export const FUNCTION_MODE_RULE_IDS = [
-    "mode-value",
-    "durable-value",
-    "mode-durable-agreement",
-];
-/** The one refusal constructor (#3373's anchor); `error` keeps its name. */
-function refuseMode(ruleId, error) {
-    return { ok: false, ruleId, error };
-}
-/**
- * Resolve `mode` and its alias `durable` to one mode.
- *
- * Absent both → `any` (#3454): a file that says nothing about its runner takes
- * either, which is what "a function is a function" means. `mode` must be one
- * of the three words; `durable` must be a boolean. Both present and
- * disagreeing is refused naming both keys, so an author who half-migrated a
- * file hears which line to fix — and `durable` beside `mode = "any"` is one of
- * those disagreements, because a boolean cannot say "either".
- */
-export function resolveDeclaredMode(input) {
-    const rawMode = input?.mode;
-    const rawDurable = input?.durable;
-    const hasMode = rawMode !== undefined && rawMode !== null;
-    const hasDurable = rawDurable !== undefined && rawDurable !== null;
-    let fromMode = null;
-    if (hasMode) {
-        if (typeof rawMode !== "string" || !FUNCTION_MODES.includes(rawMode)) {
-            return refuseMode("mode-value", `\`mode\` must be "request", "task" or "any" (got ${describe(rawMode)}): ` +
-                '"any" — the default — lets the caller pick, running the function ' +
-                "inside the call with `invoke` or as a background run with `start`; " +
-                '"request" and "task" lock it to one of the two');
-        }
-        fromMode = rawMode;
-    }
-    let fromDurable = null;
-    if (hasDurable) {
-        if (typeof rawDurable !== "boolean") {
-            return refuseMode("durable-value", `\`durable\` must be true or false (got ${describe(rawDurable)}); it is ` +
-                'the accepted alias for `mode = "task"` / `mode = "request"`');
-        }
-        fromDurable = rawDurable ? "task" : "request";
-    }
-    if (fromMode && fromDurable && fromMode !== fromDurable) {
-        // `mode = "any"` beside either boolean lands here too, and deliberately:
-        // the boolean names one runner and `any` names neither, so there is no
-        // value of `durable` the author could have meant. The remedy the message
-        // gives — drop one key — is the same in both cases.
-        return refuseMode("mode-durable-agreement", `\`mode = "${fromMode}"\` and \`durable = ${String(rawDurable)}\` disagree: ` +
-            '`durable` is the accepted alias for `mode = "task"` (true) and ' +
-            '`mode = "request"` (false), and it cannot say `mode = "any"` at all, ' +
-            "so keep one key, or make the two agree");
-    }
-    const mode = fromMode ?? fromDurable ?? "any";
-    return { ok: true, mode, declared: hasMode || hasDurable };
-}
+/** The two `[function]` keys that no longer say anything (#3482). */
+export const RETIRED_FUNCTION_RUNTIME_KEYS = ["mode", "durable"];
+const RUNTIME_IS_THE_CALLERS = "a function is a function, and the caller picks the runtime at each call — " +
+    "`invoke` runs it inside the request, `start` runs it as a task";
+const FROM_PHASE_5 = "Remove the line; from phase 5 it is refused.";
 /**
- * The mode a stored config-version row runs in.
+ * Every retired runtime key a `[function]` table still carries.
  *
- * `mode` is the stored fact and is read first. A row written before #3454
- * carries none, and is read the way it always read: the `durable` boolean, and
- * the request runner otherwise. That reading is CONSERVATIVE on purpose — it
- * is byte for byte what the row did before the change — and widening a
- * pre-change row to `any` needs its own authored declaration, which
- * `src/server-functions/legacy-mode.ts` recovers from the envelope's TOML and
- * records on the row once (D3454-002).
+ * Reads the table the way the author wrote it: the two top-level keys, and a
+ * `mode` on each `[[function.triggers.cron]]` entry. A cron entry's sentence
+ * says the extra thing its author needs to hear — that the schedule no longer
+ * chooses, because every fire starts a task run (#3334's runner branch is
+ * gone).
+ *
+ * Order is the order an author reads their file in: the top-level keys first,
+ * then the cron entries in declaration order.
  */
-export function configMode(row) {
-    const stored = row?.mode;
-    if (typeof stored === "string" && FUNCTION_MODES.includes(stored)) {
-        return stored;
+export function ignoredFunctionKeys(functionTable) {
+    const table = functionTable;
+    if (!table || typeof table !== "object" || Array.isArray(table))
+        return [];
+    const found = [];
+    for (const key of RETIRED_FUNCTION_RUNTIME_KEYS) {
+        if (table[key] === undefined)
+            continue;
+        found.push({
+            path: key,
+            message: `\`${key}\` is ignored (#3482): ${RUNTIME_IS_THE_CALLERS}. ${FROM_PHASE_5}`,
+        });
     }
-    return row?.durable === true ? "task" : "request";
-}
-/** Is this mode the durable one? The adjective, for the paths that branch on it. */
-export function isDurableMode(mode) {
-    return mode === "task";
+    const triggers = table.triggers;
+    const rawCron = triggers && typeof triggers === "object" && !Array.isArray(triggers)
+        ? triggers.cron
+        : undefined;
+    const entries = Array.isArray(rawCron)
+        ? rawCron
+        : rawCron && typeof rawCron === "object"
+            ? [rawCron]
+            : [];
+    entries.forEach((entry, index) => {
+        if (!entry || typeof entry !== "object" || Array.isArray(entry))
+            return;
+        if (entry.mode === undefined)
+            return;
+        const rawName = entry.name;
+        const name = typeof rawName === "string" && rawName ? rawName : `#${index + 1}`;
+        found.push({
+            path: `triggers.cron.${name}.mode`,
+            message: `\`mode\` on cron trigger '${name}' is ignored (#3482): every cron ` +
+                `fire starts a task run, and ${RUNTIME_IS_THE_CALLERS}. ${FROM_PHASE_5}`,
+        });
+    });
+    return found;
 }
 /**
- * The runner a call gets on a version of this mode, given what it asked for.
- *
- * A LOCK answers itself whatever was requested — the refusal for the other
- * door is a separate decision, made before this one, so that a caller hears a
- * mismatch rather than silently getting the runner it did not ask for. An
- * `any` version answers what the caller named, and the REQUEST runner when it
- * named nothing: that is byte for byte what every `invoke` caller gets today.
+ * The database types a `[function]` table's retired trigger block names —
+ * #3483.
+ *
+ * Beside `ignoredFunctionKeys` because it answers the same question about the
+ * same table, for the same reader: `config pull` writes a version's AUTHORED
+ * bytes, and a version pushed before the removal carries the block. Without
+ * this the pulled tree would be refused on its next push — a tree an author
+ * cannot get back into a working state, which is the failure D3482-007 already
+ * had to close for the runtime keys.
+ *
+ * This is NOT a refusal and shares nothing with one. The block is refused on
+ * input by `normalizeTriggerDeclaration`; what a strip needs is the list of
+ * entries it is taking out so it can say so, which is why an entry whose
+ * `type` is unreadable still counts as one entry (the empty string). It is the
+ * block's PRESENCE that goes, not its contents.
+ *
+ * TOML spells the block three ways — an array of tables, a single table, and
+ * an inline array — and a scan that missed one would leave a key behind
+ * (CR3482-002's lesson, applied to a whole table).
  */
-export function runnerFor(mode, requested) {
-    if (mode === "request" || mode === "task")
-        return mode;
-    return requested ?? "request";
+export function retiredDatabaseTriggerTypes(functionTable) {
+    const raw = retiredDatabaseTriggerValue(functionTable);
+    if (raw === undefined || raw === null)
+        return [];
+    const entries = Array.isArray(raw) ? raw : [raw];
+    return entries.map((entry) => {
+        if (!entry || typeof entry !== "object" || Array.isArray(entry))
+            return "";
+        const type = entry.type;
+        return typeof type === "string" ? type : String(type ?? "");
+    });
 }
-function describe(value) {
-    if (typeof value === "string")
-        return JSON.stringify(value);
-    if (value === null)
-        return "null";
-    if (typeof value === "object")
-        return Array.isArray(value) ? "an array" : "a table";
-    return String(value);
+/**
+ * Whether the block is THERE at all — the question a strip has to ask, which
+ * the type list above cannot answer (CR3483-001).
+ *
+ * `database = []` names no type, so the list is empty and a strip that decided
+ * by its length left the key in the pulled file. That file then fails its own
+ * next push: `normalizeTriggerDeclaration` refuses the key by PRESENCE, of any
+ * shape, an empty array included — so the two halves disagreed about what the
+ * block is, and the tree an author pulled was a tree they could not push.
+ * Presence is the one rule both sides read now, spelled the way
+ * `normalizeTriggerDeclaration` spells it — `!== undefined` — so a value one
+ * of them would call a block and the other would not cannot exist.
+ */
+export function hasRetiredDatabaseTriggerBlock(functionTable) {
+    return retiredDatabaseTriggerValue(functionTable) !== undefined;
 }
 /**
- * The mode a derivation is checked against.
- *
- * An OMITTED option is the DEFAULT mode, which is `any` since #3454 — the same
- * answer `resolveDeclaredMode` gives a file that says nothing. Every
- * authoritative door resolves and passes explicitly; this keeps the two
- * readings one reading rather than letting an omission mean something a
- * declaration cannot.
+ * The raw `[function.triggers].database` value, or `undefined` when the block
+ * is absent. One walk down to the key, so presence and contents can never be
+ * read off two different traversals.
  */
-function modeOf(options) {
-    return options.mode ?? "any";
+function retiredDatabaseTriggerValue(functionTable) {
+    const table = functionTable;
+    if (!table || typeof table !== "object" || Array.isArray(table)) {
+        return undefined;
+    }
+    const triggers = table.triggers;
+    if (!triggers || typeof triggers !== "object" || Array.isArray(triggers)) {
+        return undefined;
+    }
+    return triggers.database;
 }
 /**
- * Why a webhook cannot drive a task function, and what to do instead (#3334).
+ * The same scan, rendered for one file — the shape `config push` and
+ * `config diff` print and the admin route answers with.
  *
- * The first clause is verbatim what it has always been, so sibling pins on the
- * request-mode prefix (#3281's) keep holding; everything after the dash is the
- * half that was missing — an author who meets this at the push door could not
- * previously tell whether it was a limitation or a design, nor what to write.
+ * `label` is what the reader can act on: `functions/<key>.toml` from the CLI,
+ * and the function's key from the API, which has no file to name.
  */
-export const WEBHOOK_ON_TASK_REFUSAL = "webhook triggers require request mode: set `mode = \"request\"` (or " +
-    "remove `mode = \"task\"`) — a webhook delivery needs its answer inside the " +
-    "request, and a task run has none to give there: verify and acknowledge in " +
-    "the request function, then hand the work to a task function with " +
-    "ctx.functions.start — or remove [function.triggers.webhook]";
+export function ignoredFunctionKeyWarnings(label, functionTable) {
+    return ignoredFunctionKeys(functionTable).map((ignored) => `${label}: ${ignored.message}`);
+}
 export const EMPTY_TRIGGER_DECLARATION = {
     webhook: null,
     cron: [],
-    databases: [],
 };
 /**
  * The most cron entries one function may declare.
@@ -2622,22 +3265,6 @@ export const MAX_CRON_TRIGGERS_PER_FUNCTION = 10;
  * collide with (the intent, "Key namespace?").
  */
 const CRON_NAME_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9_-]*$/;
-/**
- * The most database types one function may watch (#3184, D-07).
- *
- * Per-OBJECT, like the cron cap above: a function watching more than a handful
- * of types is describing a fan-in the platform cannot bound per write, and
- * every extra type is another discovery read on somebody's write path.
- */
-export const MAX_DATABASE_TRIGGERS_PER_FUNCTION = 5;
-/**
- * A database type key, matching the charset the grant grammar already uses for
- * the same value (`src/config-surface/function-grants.ts`). One rule for one
- * concept: `database:<type>/<model>:read` and `[[function.triggers.database]]`
- * name the same thing.
- */
-const DATABASE_TYPE_PATTERN = /^[A-Za-z0-9_-]+$/;
-const DATABASE_KEYS = new Set(["type"]);
 const WEBHOOK_KEYS = new Set([
     "verificationScheme",
     "signingSecret",
@@ -2651,6 +3278,12 @@ const WEBHOOK_KEYS = new Set([
 const CRON_KEYS = new Set([
     "name",
     "cron",
+    // #3482 — RETIRED and still accepted. `cron-trigger-mode-required` demanded
+    // this key on every default-mode function since #3454, so every tree pushed
+    // with a cron entry since then carries it; dropping it from the accepted set
+    // would refuse those trees with an unknown-key error one day after the
+    // platform insisted on it (D3482-006). Ignored, warned about at the push
+    // door, and refused from phase 5.
     "mode",
     "timezone",
     "overlapPolicy",
@@ -2666,17 +3299,12 @@ const VALID_OVERLAP_POLICIES = ["skip", "allow"];
 export const TRIGGER_RULE_IDS = [
     "triggers-table",
     "trigger-kind",
-    "database-trigger-mode",
-    "database-trigger-cap",
-    "database-trigger-entry",
-    "database-trigger-keys",
-    "database-trigger-type-required",
-    "database-trigger-type-charset",
-    "database-trigger-duplicate",
+    // #3483 — one refusal replaced the eight that shaped the block. There is no
+    // shape left to get right; the block itself is what is refused.
+    "database-trigger-removed",
     "webhook-trigger-single",
     "webhook-trigger-table",
     "webhook-trigger-keys",
-    "webhook-trigger-mode",
     "webhook-trigger-scheme-required",
     "webhook-trigger-scheme-none",
     "webhook-trigger-number",
@@ -2690,9 +3318,6 @@ export const TRIGGER_RULE_IDS = [
     "cron-trigger-duplicate",
     "cron-trigger-expression-required",
     "cron-trigger-overlap-policy",
-    "cron-trigger-mode-value",
-    "cron-trigger-mode-required",
-    "cron-trigger-mode-locked",
 ];
 /**
  * A broken trigger rule. `ruleId` names which one, for a reader that wants to
@@ -2713,9 +3338,7 @@ function refuseTrigger(ruleId, message) {
 }
 /** Is anything at all declared? Used to skip work on the common case. */
 export function hasDeclaredTriggers(declaration) {
-    return (declaration.webhook !== null ||
-        declaration.cron.length > 0 ||
-        declaration.databases.length > 0);
+    return declaration.webhook !== null || declaration.cron.length > 0;
 }
 /**
  * Normalize the `triggers` table of an already-parsed `[function]` table.
@@ -2726,7 +3349,7 @@ export function hasDeclaredTriggers(declaration) {
  * push boundary can normalize a declaration it read from a stored row without
  * re-parsing bytes.
  */
-export function normalizeTriggerDeclaration(functionTable, options = {}) {
+export function normalizeTriggerDeclaration(functionTable) {
     const triggers = functionTable?.triggers;
     if (triggers === undefined || triggers === null) {
         return EMPTY_TRIGGER_DECLARATION;
@@ -2734,75 +3357,41 @@ export function normalizeTriggerDeclaration(functionTable, options = {}) {
     if (typeof triggers !== "object" || Array.isArray(triggers)) {
         refuseTrigger("triggers-table", "[function.triggers] must be a table declaring `webhook` and/or `cron`");
     }
+    // #3483 — checked BEFORE the unknown-kind rule, so an author who declares
+    // the block hears why it went rather than that `database` is not a word the
+    // platform knows. Any shape of the key is the same refusal: it is the
+    // block's PRESENCE that is refused, and an author who wrote
+    // `triggers.database = []` still has a line to delete.
+    if (triggers.database !== undefined) {
+        refuseTrigger("database-trigger-removed", DATABASE_TRIGGER_REMOVED);
+    }
     for (const key of Object.keys(triggers)) {
-        if (key !== "webhook" && key !== "cron" && key !== "database") {
+        if (key !== "webhook" && key !== "cron") {
             refuseTrigger("trigger-kind", `unknown trigger kind '${key}' under [function.triggers]: the kinds are ` +
-                "`webhook`, `cron` and `database`");
+                "`webhook` and `cron`");
         }
     }
-    const webhook = normalizeWebhook(triggers.webhook, options);
-    const cron = normalizeCron(triggers.cron, options);
-    const databases = normalizeDatabases(triggers.database, options);
-    return { webhook, cron, databases };
+    const webhook = normalizeWebhook(triggers.webhook);
+    const cron = normalizeCron(triggers.cron);
+    return { webhook, cron };
 }
 /**
- * `[[function.triggers.database]]` — one accepted key, `type` (#3184, D-07).
- *
- * Sync mode only, permanently: a database-change fire runs INSIDE the write
- * request, best-effort, with no run row (the intent, "Sync functions write a
- * run row?"), and there is no durable shape for that. This is the same
- * permanent refusal `webhook` carries, not the release-scoped one `cron` does.
+ * The sentence an author who declared the block is owed — D3483-001.
+ *
+ * It names the pattern that replaces the trigger rather than only saying the
+ * trigger is gone, because the author's problem is not "how do I spell this"
+ * but "where does this work go now". The answer is: into the handler that
+ * writes the row. Database access moves behind server functions (phase 6
+ * retires the client's direct database paths), so the code that writes a
+ * record is already a function — a trigger fired by that write has no caller
+ * it cannot already see.
  */
-function normalizeDatabases(raw, options) {
-    if (raw === undefined || raw === null)
-        return [];
-    const entries = Array.isArray(raw) ? raw : [raw];
-    if (entries.length === 0)
-        return [];
-    if (modeOf(options) === "task") {
-        refuseTrigger("database-trigger-mode", "database triggers require request mode: set `mode = \"request\"` (or " +
-            "remove `mode = \"task\"`), or remove the [[function.triggers.database]] " +
-            "entries");
-    }
-    if (entries.length > MAX_DATABASE_TRIGGERS_PER_FUNCTION) {
-        refuseTrigger("database-trigger-cap", `a function may watch at most ${MAX_DATABASE_TRIGGERS_PER_FUNCTION} database ` +
-            `types, and this one declares ${entries.length}`);
-    }
-    const seen = new Set();
-    const normalized = [];
-    for (const entry of entries) {
-        if (entry === null || typeof entry !== "object" || Array.isArray(entry)) {
-            refuseTrigger("database-trigger-entry", "each [[function.triggers.database]] entry must be a table");
-        }
-        const table = entry;
-        for (const key of Object.keys(table)) {
-            if (!DATABASE_KEYS.has(key)) {
-                refuseTrigger("database-trigger-keys", `unknown key '${key}' in a [[function.triggers.database]] entry: the ` +
-                    `only accepted key is ${[...DATABASE_KEYS].join(", ")}`);
-            }
-        }
-        const type = String(table.type ?? "").trim();
-        if (!type) {
-            refuseTrigger("database-trigger-type-required", "each [[function.triggers.database]] entry needs a `type`: it names the " +
-                "database type whose writes fire the function");
-        }
-        if (!DATABASE_TYPE_PATTERN.test(type)) {
-            refuseTrigger("database-trigger-type-charset", `database trigger type '${type}' must contain only letters, digits, ` +
-                "'-' or '_'");
-        }
-        if (seen.has(type)) {
-            refuseTrigger("database-trigger-duplicate", `duplicate database trigger type '${type}': a function fires once per ` +
-                "write request, so each type is declared once");
-        }
-        seen.add(type);
-        normalized.push({ type });
-    }
-    // Sorted, like the cron entries: two files that differ only in the order
-    // they list their blocks describe the same triggers.
-    normalized.sort((a, b) => a.type.localeCompare(b.type));
-    return normalized;
-}
-function normalizeWebhook(raw, options) {
+const DATABASE_TRIGGER_REMOVED = "[[function.triggers.database]] is no longer supported (#3483): database " +
+    "access moves behind functions, so the code that writes the record is a " +
+    "function — do the follow-up in the handler that writes (write the row, " +
+    "then publish, notify or write again), or hand longer work to a task with " +
+    "ctx.functions.start. Remove the block.";
+function normalizeWebhook(raw) {
     if (raw === undefined || raw === null)
         return null;
     if (Array.isArray(raw)) {
@@ -2820,14 +3409,6 @@ function normalizeWebhook(raw, options) {
                 `are ${[...WEBHOOK_KEYS].join(", ")}`);
         }
     }
-    // The intent forbids this permanently: a webhook fires the function inside
-    // the receiver, and the provider is holding the connection open waiting for
-    // its answer. A task run has no answer to give inside that request — it
-    // returns a run id and finishes later — so the refusal says so and names
-    // the pattern that does the same job (#3334).
-    if (modeOf(options) === "task") {
-        refuseTrigger("webhook-trigger-mode", WEBHOOK_ON_TASK_REFUSAL);
-    }
     const scheme = String(table.verificationScheme ?? "").trim();
     if (!scheme) {
         refuseTrigger("webhook-trigger-scheme-required", "[function.triggers.webhook] verificationScheme is required");
@@ -2871,18 +3452,12 @@ function normalizeWebhook(raw, options) {
     }
     return declaration;
 }
-function normalizeCron(raw, options) {
+function normalizeCron(raw) {
     if (raw === undefined || raw === null)
         return [];
     const entries = Array.isArray(raw) ? raw : [raw];
     if (entries.length === 0)
         return [];
-    // No refusal for the function's own mode: a cron entry is legal in EVERY
-    // mode (#3334). The intent allows it ("Sync functions write a run row?":
-    // *HTTP and cron allow both*), and the cron DO starts a durable run for a
-    // task target. What each ENTRY is checked for is which runner ITS fires use
-    // (#3454) — see the three `cron-trigger-mode-*` refusals below.
-    const functionMode = modeOf(options);
     if (entries.length > MAX_CRON_TRIGGERS_PER_FUNCTION) {
         refuseTrigger("cron-trigger-cap", `a function may declare at most ${MAX_CRON_TRIGGERS_PER_FUNCTION} cron ` +
             `trigger entries, and this one declares ${entries.length}`);
@@ -2918,27 +3493,10 @@ function normalizeCron(raw, options) {
         if (!cron) {
             refuseTrigger("cron-trigger-expression-required", `cron trigger '${name}' needs a \`cron\` expression`);
         }
-        // ── which runner this schedule's fires use (#3454, D3454-006) ──
+        // #3482 — no runner branch here any more. Every cron fire starts a task
+        // run, so an entry's `mode` decides nothing; it is accepted (D3482-006),
+        // reported as ignored by `ignoredFunctionKeys`, and dropped.
         const declaration = { name, cron };
-        if (table.mode !== undefined && table.mode !== null) {
-            const entryMode = String(table.mode);
-            if (!FUNCTION_RUNNERS.includes(entryMode)) {
-                refuseTrigger("cron-trigger-mode-value", `cron trigger '${name}': \`mode\` must be "request" or "task" (got ` +
-                    `${JSON.stringify(table.mode)}): a fire runs on one runner, so the ` +
-                    'entry names one — "any" is a mode a FUNCTION may have, not a runner');
-            }
-            if (functionMode !== "any" && functionMode !== entryMode) {
-                refuseTrigger("cron-trigger-mode-locked", `cron trigger '${name}' says \`mode = "${entryMode}"\` but the ` +
-                    `function is locked to ${functionMode}: drop the entry's mode or ` +
-                    "change the function's");
-            }
-            declaration.mode = entryMode;
-        }
-        else if (functionMode === "any") {
-            refuseTrigger("cron-trigger-mode-required", `cron trigger '${name}': the function's mode is any, so the entry says ` +
-                'which runner each fire uses: add `mode = "request"` or ' +
-                '`mode = "task"`');
-        }
         if (table.timezone !== undefined) {
             declaration.timezone = String(table.timezone);
         }
@@ -3006,15 +3564,39 @@ export function parseStoredTriggerDeclaration(stored) {
         return {
             webhook: parsed?.webhook ?? null,
             cron: Array.isArray(parsed?.cron) ? parsed.cron : [],
-            // Absent in every row written before #3184, which is exactly what an
-            // empty list means: that version watches no database type.
-            databases: Array.isArray(parsed?.databases) ? parsed.databases : [],
+            // #3483 — a stored `databases` key is DROPPED, not read. A version
+            // pushed before the refusal existed still carries one in its immutable
+            // JSON, and the row is never rewritten; answering nothing at all is what
+            // makes that version inert at every reader at once.
+            // `storedDatabaseTriggerTypes` below is how a caller that wants to SAY
+            // something about it still can.
         };
     }
     catch {
         return EMPTY_TRIGGER_DECLARATION;
     }
 }
+/**
+ * The database types a STORED declaration used to watch, for a reader that
+ * wants to name them — #3483.
+ *
+ * Pure, and separate from the parse on purpose: the parse answers what the
+ * version means NOW (nothing), and this answers what it said, which is only
+ * ever used to write one log line. Nothing branches on it.
+ */
+export function storedDatabaseTriggerTypes(stored) {
+    if (typeof stored !== "string" || !stored.trim())
+        return [];
+    try {
+        const parsed = JSON.parse(stored);
+        if (!Array.isArray(parsed?.databases))
+            return [];
+        return parsed.databases.map((entry) => String(entry?.type ?? ""));
+    }
+    catch {
+        return [];
+    }
+}
 /** The `CronTrigger.triggerKey` an entry owns. */
 export function cronTriggerKeyFor(functionKey, name) {
     return `${functionKey}:${name}`;
@@ -3403,7 +3985,7 @@ export function checkWorkflowSystemAccessRule(input) {
  * (`cli/src/lib/workflow-payload.ts`, #1177), both deleted with this change.
  */
 const HANDLERS = "src/workflows/config/workflow-field-handlers.ts";
-const handler = (name) => handledBy(HANDLERS, name);
+const handler = (name) => handledBy(HANDLERS, name, "apply");
 /**
  * The save-time rules the server runs and the CLI does not (#3374). They need
  * the runner's vocabulary (`isValidRunAs`, `GRANTABLE_SENSITIVE_CAPS`), which
@@ -3767,6 +4349,207 @@ export const WORKFLOW_SURFACE = {
             "the durable runtime can execute (`delay`, `event.wait`)."),
     ],
 };
+const FIELD_RANGES = [
+    { name: "minute", min: 0, max: 59 },
+    { name: "hour", min: 0, max: 23 },
+    { name: "day-of-month", min: 1, max: 31 },
+    { name: "month", min: 1, max: 12 },
+    { name: "day-of-week", min: 0, max: 6 },
+];
+function parseField(field, min, max, fieldName) {
+    const result = new Set();
+    const parts = field.split(",");
+    for (const partRaw of parts) {
+        const part = partRaw.trim();
+        if (!part) {
+            throw new Error(`Invalid ${fieldName} field: empty segment`);
+        }
+        let step = 1;
+        let rangePart = part;
+        const slashIdx = part.indexOf("/");
+        if (slashIdx !== -1) {
+            rangePart = part.slice(0, slashIdx);
+            const stepStr = part.slice(slashIdx + 1);
+            const stepNum = Number(stepStr);
+            if (!Number.isInteger(stepNum) || stepNum <= 0) {
+                throw new Error(`Invalid ${fieldName} step: "${stepStr}"`);
+            }
+            step = stepNum;
+        }
+        let lo;
+        let hi;
+        if (rangePart === "*") {
+            lo = min;
+            hi = max;
+        }
+        else if (rangePart.includes("-")) {
+            const [loStr, hiStr] = rangePart.split("-");
+            lo = Number(loStr);
+            hi = Number(hiStr);
+            if (!Number.isInteger(lo) || !Number.isInteger(hi)) {
+                throw new Error(`Invalid ${fieldName} range: "${rangePart}"`);
+            }
+        }
+        else {
+            const exact = Number(rangePart);
+            if (!Number.isInteger(exact)) {
+                throw new Error(`Invalid ${fieldName} value: "${rangePart}"`);
+            }
+            lo = exact;
+            hi = exact;
+        }
+        // Normalize day-of-week 7 -> 0 (Sunday). We only do this for bare
+        // values, not inside a range — `5-7` would otherwise become `5-0`
+        // which then fails the `lo > hi` check with a confusing error. Users
+        // who want Fri–Sun should write `5-0,0` or `5,6,0`; we reject 7 in
+        // ranges outright with a clearer message.
+        if (fieldName === "day-of-week") {
+            const isRange = rangePart.includes("-");
+            if (isRange && (lo === 7 || hi === 7)) {
+                throw new Error(`Invalid day-of-week range "${rangePart}": 7 (Sunday) is only allowed as a single value, not inside a range. Use 0 for Sunday in ranges.`);
+            }
+            if (!isRange) {
+                if (lo === 7)
+                    lo = 0;
+                if (hi === 7)
+                    hi = 0;
+            }
+        }
+        if (lo < min || hi > max || lo > hi) {
+            throw new Error(`Invalid ${fieldName} range: ${lo}-${hi} (allowed ${min}-${max})`);
+        }
+        for (let v = lo; v <= hi; v += step) {
+            result.add(v);
+        }
+    }
+    return result;
+}
+export function parseCron(expr) {
+    if (!expr || typeof expr !== "string") {
+        throw new Error("Cron expression must be a non-empty string");
+    }
+    const fields = expr.trim().split(/\s+/);
+    if (fields.length !== 5) {
+        throw new Error(`Cron expression must have exactly 5 fields, got ${fields.length}: "${expr}"`);
+    }
+    const [minField, hourField, domField, monField, dowField] = fields;
+    const minutes = parseField(minField, FIELD_RANGES[0].min, FIELD_RANGES[0].max, "minute");
+    const hours = parseField(hourField, FIELD_RANGES[1].min, FIELD_RANGES[1].max, "hour");
+    const daysOfMonth = parseField(domField, FIELD_RANGES[2].min, FIELD_RANGES[2].max, "day-of-month");
+    const months = parseField(monField, FIELD_RANGES[3].min, FIELD_RANGES[3].max, "month");
+    const daysOfWeek = parseField(dowField, FIELD_RANGES[4].min, FIELD_RANGES[4].max, "day-of-week");
+    return {
+        minutes,
+        hours,
+        daysOfMonth,
+        months,
+        daysOfWeek,
+        dayOfMonthWild: domField === "*",
+        dayOfWeekWild: dowField === "*",
+    };
+}
+// ─── The two predicates both runners call ───────────────────────────────
+/**
+ * The message `parseCron` would throw for `expr`, or null when it parses.
+ *
+ * The same grammar, asked as a question instead of as an exception, because
+ * both callers want the sentence rather than the control flow: the CLI's push
+ * preflight collects one message per broken entry, and the standalone cron
+ * routes render theirs into a 400 body. `expr` is typed `unknown` because it
+ * arrives as an authored TOML value, where it can be anything at all.
+ */
+export function cronExpressionError(expr) {
+    try {
+        parseCron(expr);
+        return null;
+    }
+    catch (err) {
+        return err?.message || String(err);
+    }
+}
+/**
+ * Whether `Intl.DateTimeFormat` accepts `name` as a timezone.
+ *
+ * This is THE timezone check — before #3376 the identical probe was written
+ * out three times (the function push boundary and the standalone create and
+ * update). Each of those sites keeps its own sentence and its own defaulting;
+ * what they now share is this answer. A non-string is false rather than a
+ * throw, for the same reason as above.
+ */
+export function isValidTimezone(name) {
+    try {
+        new Intl.DateTimeFormat("en-US", { timeZone: name });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+// ── src/config-surface/cron-rules.ts ─────────────────────────────────────
+/**
+ * The cron schedule rules two runners share (#3376, project
+ * `cli-server-rule-parity` phase 4; intent §Success criteria 6).
+ *
+ * ── One implementation, two runners ──────────────────────────────────────
+ *
+ * A cron expression the grammar refuses, and a timezone `Intl` does not know,
+ * are both decidable from the authored file. Before this issue only the SERVER
+ * decided them, inside the apply loop: a `functions/<key>.toml` carrying
+ * either passed `config push`'s preflight, sibling entities were written, and
+ * the function alone was refused — while the command promises that a refusal
+ * means nothing was applied. Now `cli/src/lib/function-sync.ts` and
+ * `src/services/function-trigger-validation.ts` both call the rule below, and
+ * the sentence an author reads is the same on either side of the wire because
+ * it is built in one place.
+ *
+ * ── Why this is a `*-rules.ts` module and the parser is not ──────────────
+ *
+ * The registry's unclaimed-export check (`findUnclaimedRuleModuleExports`)
+ * keys on this name under `src/config-surface/`: every exported function here
+ * is a rule, so one no surface declares fails `cli-unit-tests`. The anchor
+ * also forbids a `throw` outside the one refusal constructor — and `parseCron`
+ * throws eight different sentences, which `tests/unit/cron-parser.test.ts`
+ * pins. So the grammar and the `Intl` probe live next door in
+ * `cron-expression.ts`, which is a shared-predicate module rather than a rules
+ * module, and this one only decides and renders.
+ *
+ * ── What is NOT shared ───────────────────────────────────────────────────
+ *
+ * The standalone cron routes ask the same two predicates and render their own
+ * `Invalid cron expression: …` / `Invalid timezone: …`, with their own
+ * defaulting (create reads an absent timezone as UTC, update does not). That
+ * is intent assumption 2 in the form its own fallback describes, and the shape
+ * `workflow-rules.ts` set in phase 2: one predicate, each site's message and
+ * defaulting preserved. No refusal message changed anywhere.
+ */
+/** The rule ids this module owns — the union type below anchors them (#3373). */
+export const CRON_TRIGGER_RULE_IDS = [
+    "cron-trigger-expression",
+    "cron-trigger-timezone",
+];
+/** The one refusal constructor: a new branch cannot compile without an id. */
+function refuseCronTriggerRule(ruleId, message) {
+    return { ruleId, message };
+}
+/**
+ * One `[[function.triggers.cron]]` entry's schedule, or null.
+ *
+ * Expression first, then timezone, which is the order the push boundary ran
+ * them in — so an entry broken both ways still answers with the expression's
+ * refusal, exactly as before. An unset or empty `timezone` reads as UTC, again
+ * exactly as before: the boundary's `entry.timezone || "UTC"`.
+ */
+export function checkCronTriggerEntry(entry) {
+    const cronError = cronExpressionError(entry.cron);
+    if (cronError !== null) {
+        return refuseCronTriggerRule("cron-trigger-expression", `cron trigger '${entry.name}': invalid cron expression — ${cronError}`);
+    }
+    const timezone = entry.timezone || "UTC";
+    if (!isValidTimezone(timezone)) {
+        return refuseCronTriggerRule("cron-trigger-timezone", `cron trigger '${entry.name}': invalid timezone '${timezone}'`);
+    }
+    return null;
+}
 // ── src/config-surface/prompt-reasoning.ts ───────────────────────────────
 /**
  * The prompt config's reasoning controls, resolved onto each provider's own
@@ -4034,7 +4817,7 @@ export const PROMPT_SURFACE = {
                     type: "json",
                     emit: "whenSet",
                     writableOn: BOTH,
-                    validation: handledBy(PROMPT_HANDLER, "AdminAPI"),
+                    validation: handledBy(PROMPT_HANDLER, "AdminAPI", "apply"),
                 },
                 // #2644 — accepted by both handlers and returned by the detail, but
                 // never written to TOML before this: a prompt's declared output shape
@@ -4045,7 +4828,7 @@ export const PROMPT_SURFACE = {
                     type: "json",
                     emit: "whenSet",
                     writableOn: BOTH,
-                    validation: handledBy(PROMPT_HANDLER, "AdminAPI"),
+                    validation: handledBy(PROMPT_HANDLER, "AdminAPI", "apply"),
                 },
                 // #2652 — the CEL rule gating who may execute the prompt. Required at
                 // create; an explicit null/"" on update clears it (fail-closed). This
@@ -4058,7 +4841,7 @@ export const PROMPT_SURFACE = {
                     type: "string",
                     emit: "whenSet",
                     writableOn: BOTH,
-                    validation: handledBy(PROMPT_HANDLER, "AdminAPI"),
+                    validation: handledBy(PROMPT_HANDLER, "AdminAPI", "apply"),
                 },
             ],
             notExposed: {
@@ -4160,7 +4943,7 @@ export const PROMPT_SURFACE = {
                     emit: "always",
                     writableOn: BOTH,
                     // Renamable on update, uniqueness-checked within the prompt.
-                    validation: handledBy(PROMPT_HANDLER, "AdminAPI"),
+                    validation: handledBy(PROMPT_HANDLER, "AdminAPI", "apply"),
                 },
                 // #2645 — a config's status is configuration: `prompts configs update
                 // --status archived` used to be the only way to retire one, and pull
@@ -4183,7 +4966,7 @@ export const PROMPT_SURFACE = {
                     type: "string",
                     emit: "whenSet",
                     writableOn: UPDATE_ONLY,
-                    validation: handledBy(PROMPT_HANDLER, "AdminAPI"),
+                    validation: handledBy(PROMPT_HANDLER, "AdminAPI", "apply"),
                     serverDefault: "active",
                 },
                 {
@@ -4201,7 +4984,7 @@ export const PROMPT_SURFACE = {
                     emit: "always",
                     writableOn: BOTH,
                     // openrouter | gemini, lower-cased and cross-checked against the model.
-                    validation: handledBy(PROMPT_HANDLER, "AdminAPI"),
+                    validation: handledBy(PROMPT_HANDLER, "AdminAPI", "apply"),
                 },
                 {
                     field: "model",
@@ -4209,7 +4992,7 @@ export const PROMPT_SURFACE = {
                     type: "string",
                     emit: "always",
                     writableOn: BOTH,
-                    validation: handledBy(PROMPT_HANDLER, "AdminAPI"),
+                    validation: handledBy(PROMPT_HANDLER, "AdminAPI", "apply"),
                 },
                 {
                     field: "systemPrompt",
@@ -4219,7 +5002,7 @@ export const PROMPT_SURFACE = {
                     writableOn: BOTH,
                     // Offloaded to R2 above the inline size limit and read back
                     // transparently, so the TOML value is the whole prompt either way.
-                    validation: handledBy("src/services/large-field-storage.ts", "storeField"),
+                    validation: handledBy("src/services/large-field-storage.ts", "storeField", "apply"),
                 },
                 {
                     field: "userPromptTemplate",
@@ -4227,7 +5010,7 @@ export const PROMPT_SURFACE = {
                     type: "string",
                     emit: "whenSet",
                     writableOn: BOTH,
-                    validation: handledBy("src/services/large-field-storage.ts", "storeField"),
+                    validation: handledBy("src/services/large-field-storage.ts", "storeField", "apply"),
                 },
                 {
                     field: "temperature",
@@ -4236,7 +5019,7 @@ export const PROMPT_SURFACE = {
                     emit: "whenSet",
                     writableOn: BOTH,
                     // Stored as a string on the model, returned parsed as a number.
-                    validation: handledBy(PROMPT_HANDLER, "AdminAPI"),
+                    validation: handledBy(PROMPT_HANDLER, "AdminAPI", "apply"),
                     dualEncoded: {
                         note: "#2869 — a `StringField` on the model: the server stores what it " +
                             "is given and returns `parseFloat` of it, so `temperature = " +
@@ -4252,7 +5035,7 @@ export const PROMPT_SURFACE = {
                     type: "number",
                     emit: "whenSet",
                     writableOn: BOTH,
-                    validation: handledBy(PROMPT_HANDLER, "AdminAPI"),
+                    validation: handledBy(PROMPT_HANDLER, "AdminAPI", "apply"),
                     dualEncoded: {
                         note: "#2869 — a `StringField` returned parsed, exactly as `temperature`.",
                     },
@@ -4281,7 +5064,7 @@ export const PROMPT_SURFACE = {
                     type: "json",
                     emit: "whenSet",
                     writableOn: BOTH,
-                    validation: handledBy(PROMPT_HANDLER, "AdminAPI"),
+                    validation: handledBy(PROMPT_HANDLER, "AdminAPI", "apply"),
                 },
                 {
                     field: "providerConfig",
@@ -4289,7 +5072,7 @@ export const PROMPT_SURFACE = {
                     type: "json",
                     emit: "whenSet",
                     writableOn: BOTH,
-                    validation: handledBy(PROMPT_HANDLER, "AdminAPI"),
+                    validation: handledBy(PROMPT_HANDLER, "AdminAPI", "apply"),
                 },
                 // #3358 — the provider's reasoning budget, in a provider-neutral
                 // spelling. Before this the only lever was the model itself: an app
@@ -4309,7 +5092,7 @@ export const PROMPT_SURFACE = {
                     type: "string",
                     emit: "whenSet",
                     writableOn: BOTH,
-                    validation: handledBy("src/config-surface/prompt-reasoning.ts", "resolvePromptReasoning"),
+                    validation: handledBy("src/config-surface/prompt-reasoning.ts", "resolvePromptReasoning", "apply"),
                 },
                 {
                     field: "reasoningBudget",
@@ -4317,7 +5100,7 @@ export const PROMPT_SURFACE = {
                     type: "number",
                     emit: "whenSet",
                     writableOn: BOTH,
-                    validation: handledBy("src/config-surface/prompt-reasoning.ts", "resolvePromptReasoning"),
+                    validation: handledBy("src/config-surface/prompt-reasoning.ts", "resolvePromptReasoning", "apply"),
                 },
             ],
             notExposed: {
@@ -4440,7 +5223,7 @@ export const INTEGRATION_SURFACE = {
                     type: "number",
                     emit: "always",
                     writableOn: BOTH,
-                    validation: handledBy(INTEGRATION_HANDLER, "AdminAPI"),
+                    validation: handledBy(INTEGRATION_HANDLER, "AdminAPI", "apply"),
                     // `src/admin-api.ts` createAppIntegration: a create with no
                     // `timeoutMs` stores 300000. Recorded so a hand-authored file that
                     // omits the key compares (and pushes) as the value the server holds
@@ -4456,7 +5239,7 @@ export const INTEGRATION_SURFACE = {
                     type: "number",
                     emit: "whenSet",
                     writableOn: BOTH,
-                    validation: handledBy(INTEGRATION_HANDLER, "AdminAPI"),
+                    validation: handledBy(INTEGRATION_HANDLER, "AdminAPI", "apply"),
                     // Same create default, same reason (#2880 DSO-002): 1 MiB.
                     serverDefault: 1048576,
                 },
@@ -4468,7 +5251,7 @@ export const INTEGRATION_SURFACE = {
                     type: "string",
                     emit: "whenSet",
                     writableOn: BOTH,
-                    validation: handledBy(INTEGRATION_HANDLER, "AdminAPI"),
+                    validation: handledBy(INTEGRATION_HANDLER, "AdminAPI", "apply"),
                 },
             ],
             notExposed: {
@@ -4633,7 +5416,7 @@ export const WEBHOOK_SURFACE = {
                     type: "string",
                     emit: "always",
                     writableOn: BOTH,
-                    validation: handledBy(WEBHOOK_HANDLER, "AdminAPI"),
+                    validation: handledBy(WEBHOOK_HANDLER, "AdminAPI", "apply"),
                 },
                 {
                     field: "toleranceSeconds",
@@ -4641,7 +5424,7 @@ export const WEBHOOK_SURFACE = {
                     type: "number",
                     emit: "always",
                     writableOn: BOTH,
-                    validation: handledBy(WEBHOOK_CONFIG_VALIDATION, "validateReplayProtection"),
+                    validation: handledBy(WEBHOOK_CONFIG_VALIDATION, "validateReplayProtection", "apply"),
                 },
                 {
                     field: "deduplicationEnabled",
@@ -4649,7 +5432,7 @@ export const WEBHOOK_SURFACE = {
                     type: "boolean",
                     emit: "always",
                     writableOn: BOTH,
-                    validation: handledBy(WEBHOOK_CONFIG_VALIDATION, "validateReplayProtection"),
+                    validation: handledBy(WEBHOOK_CONFIG_VALIDATION, "validateReplayProtection", "apply"),
                 },
                 {
                     field: "deduplicationWindowMs",
@@ -4657,7 +5440,7 @@ export const WEBHOOK_SURFACE = {
                     type: "number",
                     emit: "always",
                     writableOn: BOTH,
-                    validation: handledBy(WEBHOOK_CONFIG_VALIDATION, "validateReplayProtection"),
+                    validation: handledBy(WEBHOOK_CONFIG_VALIDATION, "validateReplayProtection", "apply"),
                 },
                 // Per-webhook inbound body cap. Unset means the platform default
                 // (5 MiB), so it is omitted from TOML rather than written as a zero.
@@ -4667,7 +5450,7 @@ export const WEBHOOK_SURFACE = {
                     type: "number",
                     emit: "whenSet",
                     writableOn: BOTH,
-                    validation: handledBy(WEBHOOK_CONFIG_VALIDATION, "validateMaxBodyBytes"),
+                    validation: handledBy(WEBHOOK_CONFIG_VALIDATION, "validateMaxBodyBytes", "apply"),
                 },
                 {
                     field: "secretGracePeriodMs",
@@ -4675,7 +5458,7 @@ export const WEBHOOK_SURFACE = {
                     type: "number",
                     emit: "always",
                     writableOn: BOTH,
-                    validation: handledBy(WEBHOOK_CONFIG_VALIDATION, "normalizeSecretGracePeriodMs"),
+                    validation: handledBy(WEBHOOK_CONFIG_VALIDATION, "normalizeSecretGracePeriodMs", "apply"),
                 },
                 // #2254 — reference-only: a whole `{{secrets.KEY}}` reference naming an
                 // existing app secret, and nothing else. The server never returns
@@ -4687,7 +5470,7 @@ export const WEBHOOK_SURFACE = {
                     type: "string",
                     emit: "whenSet",
                     writableOn: BOTH,
-                    validation: handledBy(WEBHOOK_SIGNING_SECRET_RULE, "validateWholeSecretReference"),
+                    validation: handledBy(WEBHOOK_SIGNING_SECRET_RULE, "validateWholeSecretReference", "apply"),
                 },
             ],
             notExposed: {
@@ -4986,7 +5769,23 @@ export const CRON_TRIGGER_SURFACE = {
                     type: "string",
                     emit: "always",
                     writableOn: BOTH,
-                    validation: handledBy("src/cron-parser.ts", "parseCron"),
+                    // #3376 — re-pointed from `src/cron-parser.ts`, which now only
+                    // re-exports the parser: the drift guard resolves `export function
+                    // <name>` in the named module's OWN source, so the declaring module
+                    // is the only one it can name.
+                    //
+                    // `apply`, not `preflight`, even though the predicate is vendored
+                    // and the rule is decidable from the file: no CLI check reads a
+                    // standalone `cron-triggers/<key>.toml`'s VALUES.
+                    // `collectConfigFileValidationErrors` is definition-driven and
+                    // cannot dispatch through a `handledBy` string (#1976), so this
+                    // file still fails at apply with the controller's message.
+                    // `preflight` would make the registry promise a refusal that in
+                    // fact lands mid-apply — and the reachability walker could not
+                    // catch the lie, because the FUNCTION leg reaches this same
+                    // predicate. Building that standalone leg, with its `config diff`
+                    // twin, is a finding for #3379.
+                    validation: handledBy("src/config-surface/cron-expression.ts", "cronExpressionError", "apply"),
                 },
                 {
                     field: "timezone",
@@ -4994,8 +5793,12 @@ export const CRON_TRIGGER_SURFACE = {
                     type: "string",
                     emit: "always",
                     writableOn: BOTH,
-                    // Validated against Intl; unset reads as "UTC".
-                    validation: handledBy(CRON_TRIGGER_HANDLER, "CronTriggersController"),
+                    // Validated against Intl; unset reads as "UTC". #3376 named the
+                    // predicate itself rather than the controller class: the probe the
+                    // three sites used to spell out is one function now, and this is
+                    // one of the two surfaces that own it. `apply` for the same reason
+                    // as `cron` above — no standalone CLI preflight runs it (#3379).
+                    validation: handledBy("src/config-surface/cron-expression.ts", "isValidTimezone", "apply"),
                     // `cron-triggers-controller.ts` stores `timezone || "UTC"`, so a file
                     // that omits the key describes a trigger running in UTC — compared
                     // and pushed as that, rather than as a difference no push can clear
@@ -5009,7 +5812,7 @@ export const CRON_TRIGGER_SURFACE = {
                     emit: "always",
                     writableOn: BOTH,
                     // #1002 — a reserved `__internal.` key is rejected at save time.
-                    validation: handledBy(CRON_TRIGGER_HANDLER, "CronTriggersController"),
+                    validation: handledBy(CRON_TRIGGER_HANDLER, "CronTriggersController", "apply"),
                 },
                 {
                     field: "overlapPolicy",
@@ -5018,7 +5821,7 @@ export const CRON_TRIGGER_SURFACE = {
                     emit: "always",
                     writableOn: BOTH,
                     // skip | allow.
-                    validation: handledBy(CRON_TRIGGER_HANDLER, "CronTriggersController"),
+                    validation: handledBy(CRON_TRIGGER_HANDLER, "CronTriggersController", "apply"),
                     // Same store-time default as `timezone` (#2880 DSO-002).
                     serverDefault: "skip",
                 },
@@ -5222,7 +6025,7 @@ export const BLOB_BUCKET_SURFACE = {
                     emit: "always",
                     writableOn: CREATE_ONLY,
                     // Immutable after create: `update` never reads it.
-                    validation: handledBy(BLOB_BUCKET_HANDLER, "BlobBucketsController"),
+                    validation: handledBy(BLOB_BUCKET_HANDLER, "BlobBucketsController", "apply"),
                 },
                 {
                     field: "preset",
@@ -5232,7 +6035,7 @@ export const BLOB_BUCKET_SURFACE = {
                     writableOn: BOTH,
                     // #1020 — the honest access field. A rule-set-backed bucket reports
                     // "custom", which is not written back as a preset.
-                    validation: handledBy("src/app-api/resource-types/blob-bucket.ts", "resolveBucketPreset"),
+                    validation: handledBy("src/app-api/resource-types/blob-bucket.ts", "resolveBucketPreset", "apply"),
                 },
                 {
                     field: "ruleSetId",
@@ -5242,7 +6045,7 @@ export const BLOB_BUCKET_SURFACE = {
                     writableOn: BOTH,
                     // Existence-checked against AccessRuleSet; mutually exclusive with a
                     // preset change in the same request.
-                    validation: handledBy(BLOB_BUCKET_HANDLER, "BlobBucketsController"),
+                    validation: handledBy(BLOB_BUCKET_HANDLER, "BlobBucketsController", "apply"),
                 },
             ],
             notExposed: {
@@ -5370,7 +6173,7 @@ export const EMAIL_TEMPLATE_SURFACE = {
                     emit: "always",
                     writableOn: BOTH,
                     // Size-capped and checked for unescaped `{{{var}}}` interpolation.
-                    validation: handledBy(EMAIL_TEMPLATE_HANDLER, "AdminAPI"),
+                    validation: handledBy(EMAIL_TEMPLATE_HANDLER, "AdminAPI", "apply"),
                 },
                 {
                     field: "htmlBody",
@@ -5378,7 +6181,7 @@ export const EMAIL_TEMPLATE_SURFACE = {
                     type: "string",
                     emit: "whenSet",
                     writableOn: BOTH,
-                    validation: handledBy(EMAIL_TEMPLATE_HANDLER, "AdminAPI"),
+                    validation: handledBy(EMAIL_TEMPLATE_HANDLER, "AdminAPI", "apply"),
                 },
                 {
                     field: "textBody",
@@ -5386,7 +6189,7 @@ export const EMAIL_TEMPLATE_SURFACE = {
                     type: "string",
                     emit: "whenSet",
                     writableOn: BOTH,
-                    validation: handledBy(EMAIL_TEMPLATE_HANDLER, "AdminAPI"),
+                    validation: handledBy(EMAIL_TEMPLATE_HANDLER, "AdminAPI", "apply"),
                 },
             ],
             notExposed: {
@@ -5516,7 +6319,7 @@ export const DATABASE_TYPE_SURFACE = {
                     writableOn: CREATE_ONLY,
                     // The type's identity: required and `#`-free on create, taken from
                     // the URL on update.
-                    validation: handledBy(DB_TYPE_HANDLER, "DatabaseTypeConfigController"),
+                    validation: handledBy(DB_TYPE_HANDLER, "DatabaseTypeConfigController", "apply"),
                 },
                 {
                     field: "ruleSetId",
@@ -5526,7 +6329,7 @@ export const DATABASE_TYPE_SURFACE = {
                     writableOn: BOTH,
                     // Authored as a portable name and sent as an id; the server checks
                     // the set exists and has `resourceType: "database"`.
-                    validation: handledBy(DB_TYPE_HANDLER, "DatabaseTypeConfigController"),
+                    validation: handledBy(DB_TYPE_HANDLER, "DatabaseTypeConfigController", "apply"),
                 },
                 {
                     field: "metadataAccess",
@@ -5536,7 +6339,7 @@ export const DATABASE_TYPE_SURFACE = {
                     writableOn: BOTH,
                     // CEL, parsed before storing (#1336). The legacy `metadataAccess`
                     // spelling stays readable on push — see tomlOnlyKeys.
-                    validation: handledBy(DB_TYPE_HANDLER, "DatabaseTypeConfigController"),
+                    validation: handledBy(DB_TYPE_HANDLER, "DatabaseTypeConfigController", "apply"),
                 },
                 {
                     field: "defaultAccess",
@@ -5545,7 +6348,7 @@ export const DATABASE_TYPE_SURFACE = {
                     emit: "whenSet",
                     writableOn: BOTH,
                     // CEL, plus the shared `md`-shape allowlist (#1523).
-                    validation: handledBy(DB_TYPE_HANDLER, "DatabaseTypeConfigController"),
+                    validation: handledBy(DB_TYPE_HANDLER, "DatabaseTypeConfigController", "apply"),
                 },
                 {
                     field: "autoPopulatedFields",
@@ -5555,7 +6358,7 @@ export const DATABASE_TYPE_SURFACE = {
                     writableOn: BOTH,
                     // #750 — shorthand and verbose forms both accepted, normalized by
                     // `validateAndNormalizeAutoPopulatedFields`.
-                    validation: handledBy(DB_TYPE_HANDLER, "DatabaseTypeConfigController"),
+                    validation: handledBy(DB_TYPE_HANDLER, "DatabaseTypeConfigController", "apply"),
                 },
                 {
                     field: "timestamps",
@@ -5565,7 +6368,7 @@ export const DATABASE_TYPE_SURFACE = {
                     writableOn: BOTH,
                     // #748 — `{ create?, update?, models? }`, normalized by
                     // `validateAndNormalizeTimestamps`.
-                    validation: handledBy(DB_TYPE_HANDLER, "DatabaseTypeConfigController"),
+                    validation: handledBy(DB_TYPE_HANDLER, "DatabaseTypeConfigController", "apply"),
                 },
             ],
             notExposed: {
@@ -5707,7 +6510,7 @@ export const RULE_SET_SURFACE = {
                     emit: "always",
                     writableOn: BOTH,
                     // Required, trimmed, and non-empty on both modes.
-                    validation: handledBy(RULE_SET_HANDLER, "RuleSetsController"),
+                    validation: handledBy(RULE_SET_HANDLER, "RuleSetsController", "apply"),
                 },
                 {
                     field: "resourceType",
@@ -5717,7 +6520,7 @@ export const RULE_SET_SURFACE = {
                     writableOn: CREATE_ONLY,
                     // Checked against `getValidResourceTypes()`, and singleton types
                     // (#1148) reject a second set. `update` never reads it.
-                    validation: handledBy(RULE_SET_HANDLER, "RuleSetsController"),
+                    validation: handledBy(RULE_SET_HANDLER, "RuleSetsController", "apply"),
                 },
                 {
                     field: "description",
@@ -5809,7 +6612,7 @@ export const GROUP_TYPE_CONFIG_SURFACE = {
                     writableOn: CREATE_ONLY,
                     // The config's identity: required and `#`-free on create, taken from
                     // the URL on update.
-                    validation: handledBy(GROUP_TYPE_HANDLER, "GroupTypeConfigController"),
+                    validation: handledBy(GROUP_TYPE_HANDLER, "GroupTypeConfigController", "apply"),
                 },
                 {
                     field: "ruleSetId",
@@ -5819,7 +6622,7 @@ export const GROUP_TYPE_CONFIG_SURFACE = {
                     writableOn: BOTH,
                     // Authored as a name, sent as an id; existence and resourceType are
                     // checked server-side, and an empty value clears the reference.
-                    validation: handledBy(GROUP_TYPE_HANDLER, "GroupTypeConfigController"),
+                    validation: handledBy(GROUP_TYPE_HANDLER, "GroupTypeConfigController", "apply"),
                 },
                 {
                     field: "autoAddCreator",
@@ -5829,7 +6632,7 @@ export const GROUP_TYPE_CONFIG_SURFACE = {
                     writableOn: BOTH,
                     // Defaults to `true` when absent on create, and is coerced with `!!`
                     // on update — not a stored-as-is passthrough.
-                    validation: handledBy(GROUP_TYPE_HANDLER, "GroupTypeConfigController"),
+                    validation: handledBy(GROUP_TYPE_HANDLER, "GroupTypeConfigController", "apply"),
                 },
             ],
             notExposed: {
@@ -5902,7 +6705,7 @@ export const COLLECTION_TYPE_CONFIG_SURFACE = {
                     writableOn: CREATE_ONLY,
                     // The config's identity: required on create, taken from the URL on
                     // update.
-                    validation: handledBy(COLLECTION_TYPE_HANDLER, "CollectionTypeConfigController"),
+                    validation: handledBy(COLLECTION_TYPE_HANDLER, "CollectionTypeConfigController", "apply"),
                 },
                 {
                     field: "ruleSetId",
@@ -5912,7 +6715,7 @@ export const COLLECTION_TYPE_CONFIG_SURFACE = {
                     writableOn: BOTH,
                     // Authored as a name, sent as an id; existence and resourceType are
                     // checked server-side, and an empty value clears the reference.
-                    validation: handledBy(COLLECTION_TYPE_HANDLER, "CollectionTypeConfigController"),
+                    validation: handledBy(COLLECTION_TYPE_HANDLER, "CollectionTypeConfigController", "apply"),
                 },
             ],
             notExposed: {
@@ -5977,6 +6780,18 @@ export const COLLECTION_TYPE_CONFIG_SURFACE = {
  * enum and `unique` rules — but the field itself round-trips as one value.
  */
 const METADATA_HANDLER = "src/app-api/controllers/metadata-controller.ts";
+/**
+ * ── Why this module's CLI handler is declared `apply` (#3375) ─────────────
+ *
+ * A `preflight` handler must be VENDORED — its module lives under
+ * `src/config-surface/`, so the CLI runs the server's own copy through the
+ * generated artifact rather than a second implementation. A handler that
+ * lives in `cli/src/` is a CLI-only copy of a server rule, which is precisely
+ * the drift this project exists to remove; until it is vendored it cannot make
+ * the registry's preflight promise, whatever the push path happens to do
+ * today. Declared `apply`, and recorded as a finding for the validation child
+ * (#3379) rather than papered over with a third stage.
+ */
 const CLI_METADATA_TOML = "cli/src/lib/toml-metadata-config.ts";
 export const METADATA_CATEGORY_CONFIG_SURFACE = {
     label: "metadata-category-config",
@@ -5995,7 +6810,7 @@ export const METADATA_CATEGORY_CONFIG_SURFACE = {
                     emit: "always",
                     writableOn: BOTH,
                     // Half of the category's identity; required on every upsert.
-                    validation: handledBy(METADATA_HANDLER, "MetadataController"),
+                    validation: handledBy(METADATA_HANDLER, "MetadataController", "apply"),
                 },
                 {
                     field: "category",
@@ -6004,7 +6819,7 @@ export const METADATA_CATEGORY_CONFIG_SURFACE = {
                     emit: "always",
                     writableOn: BOTH,
                     // The other half of the identity; required on every upsert.
-                    validation: handledBy(METADATA_HANDLER, "MetadataController"),
+                    validation: handledBy(METADATA_HANDLER, "MetadataController", "apply"),
                 },
                 {
                     field: "readRule",
@@ -6013,7 +6828,7 @@ export const METADATA_CATEGORY_CONFIG_SURFACE = {
                     emit: "whenSet",
                     writableOn: BOTH,
                     // CEL, parsed and stored or nulled.
-                    validation: handledBy(METADATA_HANDLER, "MetadataController"),
+                    validation: handledBy(METADATA_HANDLER, "MetadataController", "apply"),
                 },
                 {
                     field: "writeRule",
@@ -6021,7 +6836,7 @@ export const METADATA_CATEGORY_CONFIG_SURFACE = {
                     type: "string",
                     emit: "whenSet",
                     writableOn: BOTH,
-                    validation: handledBy(METADATA_HANDLER, "MetadataController"),
+                    validation: handledBy(METADATA_HANDLER, "MetadataController", "apply"),
                 },
                 {
                     field: "description",
@@ -6041,7 +6856,7 @@ export const METADATA_CATEGORY_CONFIG_SURFACE = {
                     // `{ fields: {} }` so the file stays pushable. Field types, enums and
                     // the single-`unique` rule are checked locally before push and again
                     // server-side.
-                    validation: handledBy(CLI_METADATA_TOML, "validateCategorySchema"),
+                    validation: handledBy(CLI_METADATA_TOML, "validateCategorySchema", "apply"),
                 },
             ],
             notExposed: {
@@ -6197,34 +7012,16 @@ const functionRules = (stage, modulePath, exportName, entries) => entries.map(([
     stage,
     handler: enforcedBy(modulePath, exportName),
 }));
-/** `mode` / `durable`: one fact, two spellings, resolved once (#3281). */
-const FUNCTION_MODE_RULES = functionRules("preflight", "src/config-surface/function-mode.ts", "resolveDeclaredMode", [
-    ["mode-value", '`mode` must be exactly "request" or "task" when present.'],
-    ["durable-value", "`durable`, the accepted alias of `mode`, must be a boolean."],
-    [
-        "mode-durable-agreement",
-        "A file carrying both `mode` and `durable` must have them agree; a " +
-            "silent winner would be worse than two spellings.",
-    ],
-]);
 /** The trigger blocks' shape rules — one id per refusal (#3181, #3184, #3334). */
 const TRIGGER_DECLARATION_RULES = functionRules("preflight", "src/config-surface/trigger-declaration.ts", "normalizeTriggerDeclaration", [
     ["triggers-table", "`[function.triggers]` must be a table."],
-    ["trigger-kind", "Only `webhook`, `cron` and `database` are trigger kinds."],
-    [
-        "database-trigger-mode",
-        "A database trigger needs request mode: the fire runs inside the write " +
-            "request, and a task run has no answer to give there.",
-    ],
-    ["database-trigger-cap", "A function watches at most five database types."],
-    ["database-trigger-entry", "Each `[[function.triggers.database]]` entry is a table."],
-    ["database-trigger-keys", "A database entry accepts only `type`."],
-    ["database-trigger-type-required", "A database entry names its `type`."],
+    ["trigger-kind", "Only `webhook` and `cron` are trigger kinds."],
     [
-        "database-trigger-type-charset",
-        "A database trigger type uses the grant grammar's charset.",
+        "database-trigger-removed",
+        "`[[function.triggers.database]]` is refused: the trigger was removed " +
+            "(#3483), and the refusal names the pattern that replaces it — do the " +
+            "follow-up in the handler that writes, or start a task.",
     ],
-    ["database-trigger-duplicate", "Each database type is declared once."],
     [
         "webhook-trigger-single",
         "`[function.triggers.webhook]` is one table, never an array: one webhook " +
@@ -6232,11 +7029,6 @@ const TRIGGER_DECLARATION_RULES = functionRules("preflight", "src/config-surface
     ],
     ["webhook-trigger-table", "`[function.triggers.webhook]` must be a table."],
     ["webhook-trigger-keys", "A webhook block accepts only its declared keys."],
-    [
-        "webhook-trigger-mode",
-        "A webhook trigger needs request mode: the provider waits inside the " +
-            "request for an answer a task run cannot give there.",
-    ],
     ["webhook-trigger-scheme-required", "A webhook block names its `verificationScheme`."],
     [
         "webhook-trigger-scheme-none",
@@ -6260,20 +7052,6 @@ const TRIGGER_DECLARATION_RULES = functionRules("preflight", "src/config-surface
     ["cron-trigger-duplicate", "Each cron name appears once within the function."],
     ["cron-trigger-expression-required", "A cron entry carries a `cron` expression."],
     ["cron-trigger-overlap-policy", "`overlapPolicy` is `skip` or `allow`."],
-    [
-        "cron-trigger-mode-value",
-        "A cron entry's `mode` names one of the two runners: a fire runs on one " +
-            "of them, so `any` is not a value it can take.",
-    ],
-    [
-        "cron-trigger-mode-required",
-        "A cron entry on an `any` function says which runner each fire uses: " +
-            "nothing else in the system answers it.",
-    ],
-    [
-        "cron-trigger-mode-locked",
-        "A cron entry may not name the runner the function's own lock forbids.",
-    ],
 ]);
 /**
  * The file-decidable half of the webhook `signingSecret` rule (#3320). The
@@ -6297,33 +7075,35 @@ const SIGNING_SECRET_RULES = functionRules("preflight", "src/config-surface/webh
             "`plaid`) or that verifies nothing (`none`) refuses a `signingSecret`.",
     ],
 ]);
-/** What only the app's state can decide, at the push boundary (#3181). */
-const FUNCTION_TRIGGER_STATE_RULES = functionRules("apply", "src/services/function-trigger-validation.ts", "validateFunctionTriggerDeclaration", [
+/**
+ * The cron entries' schedule, decidable from the file (#3376).
+ *
+ * Both were `apply` until this issue — declared where they ran, with a note
+ * saying so — because the only implementation lived on the server. Splitting
+ * `src/cron-parser.ts` put the grammar and the `Intl` probe under
+ * `src/config-surface/`, so the CLI's push preflight runs the same rule
+ * before the first request and a malformed schedule no longer reaches apply.
+ */
+const CRON_SCHEDULE_RULES = functionRules("preflight", "src/config-surface/cron-rules.ts", "checkCronTriggerEntry", [
     [
-        "database-trigger-type-exists",
-        "A watched database type must exist in the app, or the function would " +
-            "silently never fire.",
+        "cron-trigger-expression",
+        "The `cron` expression must parse under the server's five-field grammar " +
+            "(`parseCron`).",
     ],
     [
-        "database-trigger-type-watchers",
-        "A database type has a per-type cap on the functions watching it.",
+        "cron-trigger-timezone",
+        "The `timezone`, unset reading as UTC, must be one " +
+            "`Intl.DateTimeFormat` accepts.",
     ],
+]);
+/** What only the app's state can decide, at the push boundary (#3181). */
+const FUNCTION_TRIGGER_STATE_RULES = functionRules("apply", "src/services/function-trigger-validation.ts", "validateFunctionTriggerDeclaration", [
     [
         "webhook-trigger-settings",
         "The webhook block's verification settings pass the same pipeline the " +
             "standalone create runs (scheme config, replay protection, secret " +
             "existence), prefixed `[function.triggers.webhook]: `.",
     ],
-    [
-        "cron-trigger-expression",
-        "The `cron` expression must parse (`parseCron`). File-decidable; #3376 " +
-            "moves it to preflight.",
-    ],
-    [
-        "cron-trigger-timezone",
-        "The `timezone` must be one `Intl.DateTimeFormat` accepts. " +
-            "File-decidable; #3376 moves it to preflight.",
-    ],
     [
         "webhook-trigger-key-held",
         "A standalone webhook that already holds the function's key blocks the " +
@@ -6366,7 +7146,7 @@ export const SERVER_FUNCTION_SURFACE = {
                     // function with no gate fails closed at invoke, so accepting a bundle
                     // for one would report a successful push of something that can never
                     // run.
-                    validation: handledBy(FUNCTION_HANDLER, "ServerFunctionsController"),
+                    validation: handledBy(FUNCTION_HANDLER, "ServerFunctionsController", "apply"),
                 },
                 {
                     field: "inputSchema",
@@ -6374,7 +7154,7 @@ export const SERVER_FUNCTION_SURFACE = {
                     type: "json",
                     emit: "whenSet",
                     writableOn: BOTH,
-                    validation: handledBy(FUNCTION_HANDLER, "ServerFunctionsController"),
+                    validation: handledBy(FUNCTION_HANDLER, "ServerFunctionsController", "apply"),
                 },
                 {
                     field: "outputSchema",
@@ -6382,7 +7162,7 @@ export const SERVER_FUNCTION_SURFACE = {
                     type: "json",
                     emit: "whenSet",
                     writableOn: BOTH,
-                    validation: handledBy(FUNCTION_HANDLER, "ServerFunctionsController"),
+                    validation: handledBy(FUNCTION_HANDLER, "ServerFunctionsController", "apply"),
                 },
             ],
             notExposed: {
@@ -6418,6 +7198,18 @@ export const SERVER_FUNCTION_SURFACE = {
                         "Repointed by a config-version push; versions are nameless, so " +
                         "there is no `activeConfigName` for an author to write.",
                 },
+                activeConfigActivatedAt: {
+                    kind: "server-owned",
+                    note: "#3462 — WHEN the active version was put live. Stamped by both " +
+                        "doors that move the pointer (`config push` and the activate " +
+                        "route); an audit fact, so nothing authors it and `config pull` " +
+                        "does not write it back.",
+                },
+                activeConfigActivatedBy: {
+                    kind: "server-owned",
+                    note: "#3462 — WHICH admin put the active version live. Same two doors, " +
+                        "same reason: the actor is observed, never declared.",
+                },
                 runAs: {
                     kind: "server-owned",
                     note: "RETIRED from the write surface by #3279: function code acts as " +
@@ -6462,26 +7254,24 @@ export const SERVER_FUNCTION_SURFACE = {
                 },
                 mode: {
                     kind: "structural",
-                    note: '`mode = "request" | "task" | "any"` (#3281, widened by #3454): ' +
-                        '"any" — the default when the key is absent — takes EITHER runner ' +
-                        "and the caller picks at call time, with `invoke` running it " +
-                        "inside the call and `start` returning a run id (#3186); " +
-                        '"request" and "task" LOCK it to one, and the other door is ' +
-                        "refused. Stored on the config version (its `mode` column, with " +
-                        "`durable` beside it as the adjective) and pushed with it, so it " +
-                        "is versioned with the code it describes rather than mutable on " +
-                        "the header.",
+                    note: "RETIRED (#3482), and still ACCEPTED through phase 4. A function " +
+                        "is a function: the CALLER picks the runtime at each call, with " +
+                        "`invoke` running it inside the request and `start` running it as " +
+                        "a task, cron fires always starting a task run and webhook " +
+                        "deliveries always running as a request. A file that still " +
+                        "carries the key pushes, with a warning naming it as ignored and " +
+                        "every other key applied, and `config pull` removes it; from " +
+                        "phase 5 (#3188) it is refused as an unknown key. Nothing reads " +
+                        "it, and its value is not validated. A function that must not run " +
+                        "under one runtime says so in code with `assertRuntime`.",
                 },
                 durable: {
                     kind: "structural",
-                    note: 'The accepted ALIAS of the two LOCKS (#3281, #3454): ' +
-                        '`durable = true` is `mode = "task"` and `durable = false` is ' +
-                        '`mode = "request"`. A boolean names one runner, so it cannot say ' +
-                        '`mode = "any"`: beside it the file is refused naming both keys, ' +
-                        "as two locks that disagree always were. Kept as the adjective for " +
-                        "the property; `config pull` writes the authored bytes back " +
-                        "unchanged, so a file that says it keeps saying it until its " +
-                        "author edits it.",
+                    note: "RETIRED (#3482), and still ACCEPTED through phase 4 — the same " +
+                        "as `mode`, whose alias it was. It named one runner for the whole " +
+                        "function, and there is no such thing any more. A file that " +
+                        "carries it pushes with a warning, `config pull` removes it, and " +
+                        "phase 5 refuses it.",
                 },
                 limits: {
                     kind: "structural",
@@ -6524,9 +7314,11 @@ export const SERVER_FUNCTION_SURFACE = {
     // id-bearing slot until #3375 gives `ConfigField.validation` a stage, and a
     // module's list must equal its declarations in both directions.
     crossFieldRules: [
-        ...FUNCTION_MODE_RULES,
         ...TRIGGER_DECLARATION_RULES,
         ...SIGNING_SECRET_RULES,
+        // #3376 — after the signing-secret group, mirroring the order
+        // `functionTomlPreflightErrors` runs them in.
+        ...CRON_SCHEDULE_RULES,
         ...FUNCTION_TRIGGER_STATE_RULES,
     ],
 };
@@ -6555,6 +7347,18 @@ export const SERVER_FUNCTION_SURFACE = {
  * re-stringifies on store.
  */
 const TEST_CASE_HANDLER = "src/admin-api.ts";
+/**
+ * ── Why this module's CLI handler is declared `apply` (#3375) ─────────────
+ *
+ * A `preflight` handler must be VENDORED — its module lives under
+ * `src/config-surface/`, so the CLI runs the server's own copy through the
+ * generated artifact rather than a second implementation. A handler that
+ * lives in `cli/src/` is a CLI-only copy of a server rule, which is precisely
+ * the drift this project exists to remove; until it is vendored it cannot make
+ * the registry's preflight promise, whatever the push path happens to do
+ * today. Declared `apply`, and recorded as a finding for the validation child
+ * (#3379) rather than papered over with a third stage.
+ */
 const CLI_SYNC = "cli/src/commands/sync.ts";
 export const TEST_CASE_SURFACE = {
     label: "test-case",
@@ -6572,7 +7376,7 @@ export const TEST_CASE_SURFACE = {
                     emit: "always",
                     writableOn: BOTH,
                     // Required and trimmed on create; an empty name is a 400.
-                    validation: handledBy(TEST_CASE_HANDLER, "AdminAPI"),
+                    validation: handledBy(TEST_CASE_HANDLER, "AdminAPI", "apply"),
                 },
                 {
                     field: "description",
@@ -6590,7 +7394,7 @@ export const TEST_CASE_SURFACE = {
                     writableOn: BOTH,
                     // Required. TOML carries the JSON text; the wire carries the parsed
                     // object, which the server re-stringifies for storage.
-                    validation: handledBy(CLI_SYNC, "parseTestCaseToml"),
+                    validation: handledBy(CLI_SYNC, "parseTestCaseToml", "apply"),
                 },
                 {
                     field: "configId",
@@ -6599,7 +7403,7 @@ export const TEST_CASE_SURFACE = {
                     emit: "always",
                     writableOn: BOTH,
                     // Authored as the config's NAME and resolved to an id at push time.
-                    validation: handledBy(CLI_SYNC, "parseTestCaseToml"),
+                    validation: handledBy(CLI_SYNC, "parseTestCaseToml", "apply"),
                 },
                 {
                     field: "evaluatorPromptId",
@@ -6608,7 +7412,7 @@ export const TEST_CASE_SURFACE = {
                     emit: "always",
                     writableOn: BOTH,
                     // Authored as the judge prompt's KEY and resolved to an id at push.
-                    validation: handledBy(CLI_SYNC, "parseTestCaseToml"),
+                    validation: handledBy(CLI_SYNC, "parseTestCaseToml", "apply"),
                 },
                 {
                     field: "evaluatorConfigId",
@@ -6616,7 +7420,7 @@ export const TEST_CASE_SURFACE = {
                     type: "string",
                     emit: "always",
                     writableOn: BOTH,
-                    validation: handledBy(CLI_SYNC, "parseTestCaseToml"),
+                    validation: handledBy(CLI_SYNC, "parseTestCaseToml", "apply"),
                 },
                 {
                     field: "expectedOutputPattern",
@@ -6633,7 +7437,7 @@ export const TEST_CASE_SURFACE = {
                     emit: "always",
                     writableOn: BOTH,
                     // JSON array of strings; TOML carries the JSON text.
-                    validation: handledBy(CLI_SYNC, "parseTestCaseToml"),
+                    validation: handledBy(CLI_SYNC, "parseTestCaseToml", "apply"),
                 },
                 {
                     field: "expectedJsonSubset",
@@ -6642,7 +7446,7 @@ export const TEST_CASE_SURFACE = {
                     emit: "always",
                     writableOn: BOTH,
                     // JSON object, deep-partial-matched against the parsed output.
-                    validation: handledBy(CLI_SYNC, "parseTestCaseToml"),
+                    validation: handledBy(CLI_SYNC, "parseTestCaseToml", "apply"),
                 },
             ],
             notExposed: {
@@ -6836,7 +7640,7 @@ export const APP_SETTINGS_SURFACE = {
                     // with `=== true`, so `"false"` must be a 400 rather than a stored
                     // `true`. The generated request schema stays keys-only (#1976), so
                     // the check is `parseDirectLlmEnabledWrite` in the handler.
-                    validation: handledBy(SETTINGS_HANDLER, "SettingsController"),
+                    validation: handledBy(SETTINGS_HANDLER, "SettingsController", "apply"),
                 },
                 {
                     field: "allowedDomains",
@@ -6854,7 +7658,7 @@ export const APP_SETTINGS_SURFACE = {
                     writableOn: UPDATE_ONLY,
                     // `+primitivetest` bypass whitelist (#490/#675), shape-checked by
                     // `validateTestAccountBaseEmails`.
-                    validation: handledBy(SETTINGS_HANDLER, "SettingsController"),
+                    validation: handledBy(SETTINGS_HANDLER, "SettingsController", "apply"),
                 },
                 {
                     field: "largeDocumentWindowDays",
@@ -6868,7 +7672,7 @@ export const APP_SETTINGS_SURFACE = {
                     // Refused rather than clamped: answering 200 to a 30-day window the
                     // server does not keep would have the caller plan a month of
                     // offline work around it (`parseLargeDocumentWindowSetting`).
-                    validation: handledBy(SETTINGS_HANDLER, "SettingsController"),
+                    validation: handledBy(SETTINGS_HANDLER, "SettingsController", "apply"),
                 },
             ],
             notExposed: {
@@ -6986,7 +7790,7 @@ export const APP_SETTINGS_SURFACE = {
                     // per-type secret table, cross-entry URI uniqueness and the
                     // aggregate caps are all `validateGoogleClientsWrite`
                     // (`src/services/google-clients.ts`), applied by the handler.
-                    validation: handledBy(SETTINGS_HANDLER, "SettingsController"),
+                    validation: handledBy(SETTINGS_HANDLER, "SettingsController", "apply"),
                 },
                 {
                     field: "passkeyEnabled",
@@ -7007,7 +7811,7 @@ export const APP_SETTINGS_SURFACE = {
                     writableOn: UPDATE_ONLY,
                     // Mirrored into the two retired model fields by the handler so an
                     // un-migrated reader cannot disagree.
-                    validation: handledBy(SETTINGS_HANDLER, "SettingsController"),
+                    validation: handledBy(SETTINGS_HANDLER, "SettingsController", "apply"),
                 },
                 {
                     field: "appleSignInEnabled",
@@ -7037,7 +7841,7 @@ export const APP_SETTINGS_SURFACE = {
                     // `validateRedirectUris`; matching is fail-closed, and a request
                     // whose target this list does not cover gets a code-only email
                     // rather than a link (#2884).
-                    validation: handledBy(SETTINGS_HANDLER, "SettingsController"),
+                    validation: handledBy(SETTINGS_HANDLER, "SettingsController", "apply"),
                 },
                 {
                     field: "passkeyRpConfig",
@@ -7047,7 +7851,7 @@ export const APP_SETTINGS_SURFACE = {
                     writableOn: UPDATE_ONLY,
                     // `[auth.passkeys]` — rpId → { name }, shape-checked by
                     // `SettingsController.validatePasskeyRpConfig`.
-                    validation: handledBy(SETTINGS_HANDLER, "SettingsController"),
+                    validation: handledBy(SETTINGS_HANDLER, "SettingsController", "apply"),
                 },
                 {
                     field: "passkeyUserVerification",
@@ -7065,7 +7869,7 @@ export const APP_SETTINGS_SURFACE = {
                     // both halves of every passkey ceremony state, so an unrecognized
                     // value is a 400 rather than a silent fall back to the default —
                     // the `directLlmEnabled` rationale, applied to a security policy.
-                    validation: handledBy(SETTINGS_HANDLER, "SettingsController"),
+                    validation: handledBy(SETTINGS_HANDLER, "SettingsController", "apply"),
                 },
             ],
             notExposed: {},
@@ -7535,6 +8339,8 @@ export const GENERATED_CONFIG_MODEL_FIELDS = {
         "description",
         "status",
         "activeConfigId",
+        "activeConfigActivatedAt",
+        "activeConfigActivatedBy",
         "runAs",
         "access",
         "inputSchema",