primitive-admin 1.1.0-alpha.84 → 1.1.0-alpha.85

package/dist/src/commands/sync.js

@@ -32,9 +32,12 @@ import { buildWorkflowPayloadFromToml, parseWorkflowExpressionsToml, } from "../
 // payload builder so the diff normalizer and the wire cannot disagree.
 import { WORKFLOW_MODEL_DEFAULTS } from "../lib/workflow-defaults.js";
 // #2644 — the one definition per configuration object, vendored from the server.
-import { BLOB_BUCKET_TABLE, COLLECTION_TYPE_CONFIG_TABLE, CRON_TRIGGER_TABLE, DATABASE_TYPE_TABLE, EMAIL_TEMPLATE_TABLE, GROUP_TYPE_CONFIG_TABLE, INTEGRATION_TABLE, METADATA_CATEGORY_CONFIG_TABLE, PROMPT_CONFIG_TABLE, PROMPT_TABLE, RULE_SET_TABLE, SERVER_FUNCTION_TABLE, TEST_CASE_SURFACE, TEST_CASE_TABLE, WEBHOOK_TABLE, WORKFLOW_TABLE, configDeclaredTypeErrors, fieldServerDefault, findMisshapenTables, findUnknownDocumentKeys, findUnknownServerKeys, findUnknownTomlKeys, misshapenTableMessage, retiredConfigKey, spellsDecimalNumber, unrecognizedPullKeysMessage, unrecognizedPushKeysMessage, unrecognizedPushTablesMessage, warnUnrecognizedServerKeys, } from "../lib/config-surface.js";
+import { BLOB_BUCKET_TABLE, COLLECTION_TYPE_CONFIG_TABLE, CRON_TRIGGER_TABLE, DATABASE_TYPE_TABLE, EMAIL_TEMPLATE_TABLE, GROUP_TYPE_CONFIG_TABLE, INTEGRATION_TABLE, METADATA_CATEGORY_CONFIG_TABLE, PROMPT_CONFIG_TABLE, PROMPT_TABLE, RULE_SET_TABLE, SERVER_FUNCTION_TABLE, TEST_CASE_SURFACE, TEST_CASE_TABLE, WEBHOOK_TABLE, WORKFLOW_TABLE, configDeclaredTypeErrors, fieldServerDefault, findMisshapenTables, findUnknownDocumentKeys, findUnknownGroupedTomlKeys, findUnknownServerKeys, findUnknownTomlKeys, misshapenTableMessage, retiredConfigKey, spellsDecimalNumber, unrecognizedPullKeysMessage, unrecognizedPushKeysMessage, unrecognizedPushTablesMessage, warnUnrecognizedServerKeys, } from "../lib/config-surface.js";
 import { buildPayloadFromToml, projectEntityToPayload, projectRecordToToml, tomlOwned, } from "../lib/config-payload.js";
 import { CONFIG_SURFACES, isEmptyForEmit, } from "../lib/generated-config-surfaces.js";
+// #3626 — the prompt KIND rule, vendored with the definitions so the CLI's
+// preflight refuses exactly what the admin routes refuse.
+import { hoistDeprecatedChatKeys, promptKindOf, resolvePromptKind, } from "../lib/generated-config-surfaces.js";
 // #3179 — the function's two halves: the header payloads and the envelope
 // `config push` sends, and the bytes `config pull` writes back.
 import { applyFunctionPull, buildFunctionConfigPush, createDocumentSchemaDropWarner, documentSchemaRetentionFailure, buildFunctionCreatePayload, buildFunctionUpdatePayload, functionDiffEntity, functionTomlIgnoredKeyWarnings, functionTomlPreflightErrors, planDocumentSchemaPull, planFunctionPull, serializeFunction, } from "../lib/function-sync.js";
@@ -713,6 +716,20 @@ export function validateVarsFile(parsedVars, options = {}) {
  * edit — reported as a conflict instead. `force` skips the conflict guard,
  * matching `config push --force` for every other entity.
  *
+ * A var only the SERVER moved is the other half of the same comparison, and it
+ * is reported rather than skipped (issue #3714). Its local value still equals
+ * the baseline, so there is nothing to push and no conflict — but the skip that
+ * follows from "local is unchanged" used to be taken before the snapshot was
+ * consulted at all, so the push said nothing about a var edited in the Admin
+ * Console and counted it among the skipped-unchanged. The `drifted[]` keys are
+ * what every other synced type reaches through `classifyPushChange` →
+ * `server-drifted`: the caller prints `DRIFT var: <key>` under "Server drift —
+ * not pushed", writes nothing, and leaves the exit code alone. A baseline key
+ * the snapshot no longer holds at all is the same one-sided move (the server
+ * deleted the row; the local file stands still) and is reported the same way.
+ * `--force` is the resolution that keeps the local value, `config pull` the one
+ * that takes the server's.
+ *
  * Pure and side-effect-free (the caller owns the API calls and sync-state
  * updates) so the guard is unit-testable without a live server. Assumes
  * `parsedVars` has already passed `validateVarsFile` (values are strings). The
@@ -726,6 +743,7 @@ export function planVarsPush(parsedVars, baseline, remoteVars, options = {}) {
     const remoteByKey = new Map(remoteVars.map((r) => [r.key, r]));
     const upserts = [];
     const conflicts = [];
+    const drifted = [];
     const deletions = [];
     let skippedCount = 0;
     const localKeys = new Set();
@@ -733,9 +751,32 @@ export function planVarsPush(parsedVars, baseline, remoteVars, options = {}) {
         localKeys.add(key);
         const valueHash = hashVarValue(value);
         const existing = baseline?.[key];
-        // Unchanged since last sync — skip (unless forced), mirroring the
-        // content-hash skip the other file-backed entities use.
+        // Unchanged since last sync — nothing to push (unless forced), mirroring
+        // the content-hash skip the other file-backed entities use. But "the local
+        // file did not move" is only half the comparison: ask the snapshot whether
+        // the SERVER moved before calling the pair unchanged (issue #3714). One
+        // side having moved is drift, which is reported and not written; only a
+        // pair that still agrees is a skipped-unchanged file.
         if (!options.force && existing && existing.contentHash === valueHash) {
+            const remote = remoteByKey.get(key);
+            if (!remote) {
+                // The row is gone from an authoritative snapshot (the caller fails the
+                // push closed when the fetch fails, and the `--force` fallback that
+                // leaves it empty never reaches here): the server deleted what we last
+                // synced while the file stood still. `--force` recreates it from the
+                // local value; `config pull` drops the line.
+                drifted.push({ key, serverModifiedAt: "deleted" });
+                continue;
+            }
+            if (typeof remote.value === "string" &&
+                hashVarValue(remote.value) !== existing.contentHash) {
+                drifted.push({ key, serverModifiedAt: remote.updatedAt || "unknown" });
+                continue;
+            }
+            // Either both sides still hold the last-synced value, or the snapshot
+            // carries no readable value for the key and nothing establishes a move.
+            // Nothing is written on this path either way, so the only question is
+            // what to report, and an unprovable drift is not one to claim.
             skippedCount++;
             continue;
         }
@@ -823,7 +864,7 @@ export function planVarsPush(parsedVars, baseline, remoteVars, options = {}) {
         }
         deletions.push(key);
     }
-    return { upserts, deletions, conflicts, skippedCount };
+    return { upserts, deletions, conflicts, drifted, skippedCount };
 }
 /**
  * Compute the number of config vars the server would hold after a push plan
@@ -1771,6 +1812,13 @@ export function serializePrompt(prompt, logger) {
                 topP: (record) => (record.topP != null ? Number(record.topP) : undefined),
                 outputSchema: jsonField(`Prompt '${prompt?.promptKey}' config '${config?.configName}'`),
                 providerConfig: jsonField(`Prompt '${prompt?.promptKey}' config '${config?.configName}'`),
+                // #3626, CR3626-002 — the decisions declaration is a `json` field and
+                // goes out the same way its siblings do. Written straight through, a
+                // stored question carrying a `null` anywhere lost that member on pull
+                // (smol-toml has no null), and a `null` inside a LIST threw, taking
+                // `config pull` and `config diff` down with it. The JSON-string
+                // fallback keeps the declaration whole either way.
+                questions: jsonField(`Prompt '${prompt?.promptKey}' config '${config?.configName}'`),
             }),
             // #2645 — the live config has to be identifiable in the repo. Emitted
             // only on the active entry (`undefined` elsewhere so the key is omitted),
@@ -1843,6 +1891,24 @@ export function buildPromptPushPayload(key, tomlData, { mode = "update" } = {})
                 // dropped and leaving a stale rule live. On create it is omitted so
                 // the push-adopt path (#1006) can still reach the server's 409.
                 accessRule: (value) => (create ? value : (value ?? null)),
+                // #3626, CR3626-004 — the kind NORMALIZED, exactly as the resolver
+                // that validates it reads it. `kind = " chat "` and `kind = ""` both
+                // mean `chat` to `resolvePromptKind`, so the server stores `chat` and
+                // the comparison — which projects `[prompt]` in create mode precisely
+                // so a changed kind is visible (SO3626-008) — would otherwise read the
+                // authored spelling against the stored one and call a freshly created
+                // prompt an attempted kind change, refused as immutable on every later
+                // push including `--force`. An UNKNOWN kind is passed through as
+                // written: it is a refusal (preflight, then the create handler), and it
+                // has to name what the file says.
+                kind: (value) => {
+                    if (value === undefined || value === null)
+                        return "chat";
+                    if (typeof value !== "string")
+                        return value;
+                    const text = value.trim();
+                    return text === "" ? "chat" : text;
+                },
             },
         }),
     };
@@ -1877,11 +1943,19 @@ export function buildPromptCreatePayload(key, tomlData) {
     for (const owned of ["configName", ...SEEDED_CONFIG_DEFERRED]) {
         delete seed[owned];
     }
+    const prompt = buildPromptPushPayload(key, tomlData, { mode: "create" });
+    // #3626, SO3626-001 — the placeholder is a CHAT fallback. A decisions prompt
+    // has no template at all (its input is a `state` value plus its questions),
+    // and injecting one would store a chat key the block rule then refuses on
+    // every later update.
+    if (promptKindOf(prompt) === "decisions") {
+        return { ...prompt, ...seed };
+    }
     return {
-        ...buildPromptPushPayload(key, tomlData, { mode: "create" }),
+        ...prompt,
         ...seed,
-        // The server requires a template; keep the historical placeholder so a
-        // prompt authored without one still creates.
+        // The server requires a template for a chat config; keep the historical
+        // placeholder so a prompt authored without one still creates.
         userPromptTemplate: seed.userPromptTemplate || "{{ input }}",
     };
 }
@@ -1925,9 +1999,14 @@ export function seededOnlyPromptConfigFields(firstConfig, seededConfigName = "de
     const patch = {};
     for (const field of SEEDED_CONFIG_DEFERRED) {
         const value = full[field];
-        // A value the entry does not carry is left alone: the seeded config has
-        // none either, so there is nothing to clear.
-        if (value === undefined || value === null)
+        // #3626 — an omitted value CLEARS. The create handler does not merely skip
+        // `description`, it writes the hard-coded "Default configuration", so
+        // leaving it alone left every newly-pushed prompt reporting `Modified`
+        // forever against a description its file never asked for: push's own
+        // "the file is the whole truth" rule (#1567), broken by the one field the
+        // create body cannot carry. `outputSchema` is unaffected — create never
+        // sets the seeded config's, so the null is a no-op there.
+        if (value === undefined)
             continue;
         patch[field] = value;
     }
@@ -1958,7 +2037,15 @@ export function buildPromptConfigPayload(tomlConfig, { mode = "update" } = {}) {
      * differ from the one the server has always received.
      */
     const tomlOwned = (value) => (create ? value : (value ?? null));
-    return buildPayloadFromToml(PROMPT_CONFIG_TABLE, tomlConfig, {
+    // #3626 §4 — the nine chat keys moved under `[configs.chat]`, and the flat
+    // spelling is accepted as DEPRECATED. Hoisting here rather than at each call
+    // site means push, `config diff` and the create-seed builder all read a file
+    // the same way, so an unmigrated file and its pulled rewrite compare Synced.
+    // A key set BOTH ways is refused in preflight
+    // (`promptDeprecatedChatKeyErrors`); the hoist leaves the grouped value
+    // standing so nothing here has to guess.
+    const entry = hoistDeprecatedChatKeys(tomlConfig).entry;
+    return buildPayloadFromToml(PROMPT_CONFIG_TABLE, entry, {
         mode,
         values: {
             provider: (value) => (create ? value || "openrouter" : value),
@@ -1978,6 +2065,10 @@ export function buildPromptConfigPayload(tomlConfig, { mode = "update" } = {}) {
             // the merged config refused as "both set".
             reasoningEffort: tomlOwned,
             reasoningBudget: tomlOwned,
+            // #3626, SO3626-002 — the decisions declaration is TOML-owned on the
+            // same terms: deleting `[configs.decisions]` has to clear `questions`
+            // server-side, or the file stops describing what the model is asked.
+            questions: tomlOwned,
         },
     });
 }
@@ -2053,11 +2144,19 @@ export function configUnknownKeyError(filePath, tomlData, table) {
             : []
         : [at];
     const unknown = new Set();
+    // #3626 — a key inside a declared `[configs.<group>]` block that no field
+    // declares under it, and a group value that is not a table at all. Reported
+    // with the group in the path (`configs.chat.nope`) so the author is told
+    // where the CLI looked.
+    const groupedUnknown = new Set();
     for (const entry of entries) {
         for (const key of findUnknownTomlKeys(entry, table))
             unknown.add(key);
+        for (const key of findUnknownGroupedTomlKeys(entry, table)) {
+            groupedUnknown.add(key);
+        }
     }
-    if (unknown.size === 0)
+    if (unknown.size === 0 && groupedUnknown.size === 0)
         return null;
     // #2645/#2803 — a key this CLI removed on purpose gets the guidance stated
     // once beside the definitions (`src/config-surface/retired-keys.ts`), not the
@@ -2074,8 +2173,32 @@ export function configUnknownKeyError(filePath, tomlData, table) {
     for (const key of retiredHere) {
         messages.push(`${filePath}: ${prefix}.${key} — ${retiredConfigKey(prefix, key).toml}`);
     }
-    if (trulyUnknown.length > 0) {
-        messages.push(unrecognizedPushKeysMessage(filePath, table.tomlPath, trulyUnknown));
+    // #3626, SO3626-013 — a key the definition DOES declare, written at the
+    // table root when it is authored under a group. Before grouping,
+    // `acceptedTomlKeys` took every field key at the root, so a flat `questions`
+    // passed this check and was then dropped in silence by the payload builder.
+    // It is an unknown key now, and the message says where it belongs rather
+    // than sending the author to the generic "check the spelling" hint.
+    const misplaced = trulyUnknown
+        .map((key) => ({
+        key,
+        group: table.fields.find((f) => f.tomlKey === key && f.tomlGroup)
+            ?.tomlGroup,
+    }))
+        .filter((entry) => !!entry.group);
+    for (const { key, group } of misplaced) {
+        messages.push(`${filePath}: ${prefix}[0].${key} is not a [[${prefix}]] key; ` +
+            `write it under [${prefix}.${group}]`);
+    }
+    const misplacedKeys = new Set(misplaced.map((m) => m.key));
+    const stillUnknown = trulyUnknown.filter((k) => !misplacedKeys.has(k));
+    if (stillUnknown.length > 0) {
+        messages.push(unrecognizedPushKeysMessage(filePath, table.tomlPath, stillUnknown));
+    }
+    if (groupedUnknown.size > 0) {
+        messages.push(unrecognizedPushKeysMessage(filePath, table.tomlPath, [
+            ...groupedUnknown,
+        ].sort()));
     }
     return messages.join("\n");
 }
@@ -2507,6 +2630,28 @@ export async function runConfigPushPreflight(input) {
             preflightValidationErrors.push(`  ${message}`);
         }
     }
+    // #3626 §4 — one advisory line per prompt file still written in the flat
+    // chat spelling, beside the `celContextAccess` notice above. The push
+    // continues and the keys are applied; `config pull` rewrites the file, so a
+    // single pull-then-push clears the notice. Printed even under `--dry-run`,
+    // which never reaches the apply — the notice is about the FILE.
+    const preflightPromptsDir = join(configDir, "prompts");
+    if (existsSync(preflightPromptsDir)) {
+        for (const file of selectFiles("prompt", preflightPromptsDir, readdirSync(preflightPromptsDir).filter((f) => f.endsWith(".toml")))) {
+            const filePath = join(preflightPromptsDir, file);
+            let tomlData;
+            try {
+                tomlData = parseTomlFile(filePath);
+            }
+            catch {
+                // A file that does not parse is reported by the collector above.
+                continue;
+            }
+            const notice = promptFlatChatKeyWarning(filePath, tomlData);
+            if (notice)
+                warn(`  ${notice}`);
+        }
+    }
     // The `<key>.tests/*.toml` sidecars, which sit beside the block they
     // test rather than in a type directory of their own. Same posture,
     // reached through the registry's `test-case` surface — and through the
@@ -2546,6 +2691,127 @@ export async function runConfigPushPreflight(input) {
  * whose spelling is not the declared type. A file that does not parse is left
  * to the per-type loop that reads it, which names the parse error itself.
  */
+/**
+ * A prompt file's KIND errors — #3626, decidable from the file alone.
+ *
+ * Three refusals, all of them the same rule seen from different angles: a key
+ * set both flat and under `[configs.chat]` (the hoist will not guess), a
+ * `[[configs]]` entry carrying the block of the OTHER kind, and a malformed
+ * decisions declaration. The last two come from `resolvePromptKind`, the same
+ * vendored function the admin routes validate with, so the CLI's refusal and
+ * the server's cannot disagree — and this one lands in the preflight, before
+ * the first mutating call.
+ */
+export function promptKindFileErrors(filePath, tomlData) {
+    const entries = Array.isArray(tomlData?.configs) ? tomlData.configs : [];
+    const errors = [];
+    for (const [index, entry] of entries.entries()) {
+        const hoisted = hoistDeprecatedChatKeys(entry);
+        for (const key of hoisted.conflicts) {
+            errors.push(`${filePath}: configs[${index}].${key} is set both flat and under ` +
+                `[configs.chat]; keep the [configs.chat] spelling`);
+        }
+        const chat = hoisted.entry.chat ?? {};
+        const decisions = hoisted.entry.decisions ?? {};
+        // #3626 — the FIRST entry of a chat prompt carries the create seed's
+        // placeholder. `buildPromptCreatePayload` sends `{{ input }}` when the
+        // file names no template, which is how a prompt authored without one has
+        // always created; refusing it here would break a file that pushed before
+        // the kind existed. An entry that really names none on the UPDATE path is
+        // still refused, by the server, with this same message.
+        //
+        // CR3626-005 — the fallback is `||`, not `??`, because that is what
+        // `buildPromptCreatePayload` applies (`seed.userPromptTemplate ||
+        // "{{ input }}"`). `config create prompt` scaffolds an EMPTY
+        // `userPromptTemplate`, so reading absence more narrowly than the builder
+        // does refused the file this CLI had just written, for a value the create
+        // would have replaced with the placeholder anyway.
+        const seedsTemplate = index === 0 && promptKindOf(tomlData?.prompt) !== "decisions";
+        const userPromptTemplate = seedsTemplate
+            ? chat.userPromptTemplate || "{{ input }}"
+            : chat.userPromptTemplate;
+        const resolution = resolvePromptKind({
+            kind: tomlData?.prompt?.kind,
+            provider: hoisted.entry.provider,
+            model: hoisted.entry.model,
+            config: {
+                systemPrompt: chat.systemPrompt,
+                userPromptTemplate,
+                temperature: chat.temperature,
+                topP: chat.topP,
+                maxTokens: chat.maxTokens,
+                outputFormat: chat.outputFormat,
+                outputSchema: chat.outputSchema,
+                reasoningEffort: chat.reasoningEffort,
+                reasoningBudget: chat.reasoningBudget,
+                questions: decisions.questions,
+            },
+        });
+        if (resolution.ok === false) {
+            errors.push(`${filePath}: configs[${index}] — ${resolution.error}`);
+        }
+    }
+    return errors;
+}
+/**
+ * The immutable-`kind` refusal for a prompt update the comparison gate did not
+ * decide — #3626, CR3626-001.
+ *
+ * `kind` is create-only (D3626-008), and the gate refuses a change to it on
+ * every path that compares the two sides. Two update paths do not compare: a
+ * prompt whose DETAIL read failed falls back to the manifest byte-hash gate,
+ * which `--force` writes straight through, and a prompt ADOPTED after a
+ * create's 409 is re-issued as an update without a comparison at all. Both
+ * would otherwise PATCH the file's schemas, access rule and metadata onto a
+ * row of the other kind, and only then have its configs refused against the
+ * kind the update cannot change.
+ *
+ * Returns the gate's own outcome shape, so `recordDeclined` prints the same
+ * two values and the same remedy — create the prompt under a new key.
+ *
+ * `null` when the kinds agree and when the server's kind is simply not KNOWN:
+ * a push that could not read live state at all has nothing to compare, and
+ * that path's contract (`decideDegradedPush`, #2880) is already "decline
+ * unless the operator forces it", stated for every field at once.
+ */
+export function promptKindImmutableOutcome(storedKind, localDoc) {
+    if (!storedKind)
+        return null;
+    const localKind = promptKindOf(localDoc?.prompt);
+    if (localKind === storedKind)
+        return null;
+    return {
+        action: "immutable",
+        // The hashes are the gate's evidence for WHICH side moved, and this
+        // refusal does not depend on that: the field cannot be written either way.
+        localHash: "",
+        remoteHash: "",
+        fields: [{ field: "kind", local: localKind, server: storedKind }],
+        immutableFields: ["kind"],
+    };
+}
+/**
+ * The one deprecation notice a prompt file using the FLAT chat spelling earns
+ * — #3626 §4, beside the `celContextAccess` notice's precedent.
+ *
+ * Advisory: the push continues and the keys are applied. `null` when the file
+ * is already written in the grouped spelling, so a migrated tree is silent.
+ */
+export function promptFlatChatKeyWarning(filePath, tomlData) {
+    const entries = Array.isArray(tomlData?.configs) ? tomlData.configs : [];
+    const moved = new Set();
+    for (const entry of entries) {
+        for (const key of hoistDeprecatedChatKeys(entry).moved)
+            moved.add(key);
+    }
+    if (moved.size === 0)
+        return null;
+    const named = [...moved].sort().join(", ");
+    return (`${filePath}: ${named} ${moved.size === 1 ? "is" : "are"} written flat ` +
+        "under [[configs]]; this spelling is deprecated — move them under " +
+        "[configs.chat] (`config pull` rewrites the file). Rejecting the flat " +
+        "spelling is tracked in #3642.");
+}
 export function collectConfigFileValidationErrors(configDir) {
     const found = [];
     for (const { dir, surface, tables } of unknownKeyPreflightTargets()) {
@@ -2581,6 +2847,12 @@ export function collectConfigFileValidationErrors(configDir) {
             for (const table of surface.tables) {
                 messages.push(...configDeclaredTypeErrors(filePath, tomlData, table));
             }
+            // #3626 — the prompt kind's own file-decidable refusals, run by the same
+            // collector so `config push` and `config diff` cannot disagree about
+            // which prompt files are pushable.
+            if (surface.label === "prompt") {
+                messages.push(...promptKindFileErrors(filePath, tomlData));
+            }
             if (messages.length === 0)
                 continue;
             found.push({
@@ -4055,7 +4327,17 @@ const CONFIG_DIFF_SPECS = {
         // (`[prompt].key`) is still read here, because it is what `displayName`
         // falls back to. Diff injects the resolved key into a file that omits it,
         // exactly as push derives it from the file name.
-        parse: (doc) => buildPromptPushPayload(doc?.prompt?.key ?? "", doc),
+        //
+        // #3626, SO3626-008 — projected in CREATE mode. `kind` is `writableOn:
+        // ["create"]`, and `buildPayloadFromToml` drops a field not writable in the
+        // mode, so an update-mode projection would leave a CHANGED kind out of the
+        // compared surface entirely: `findImmutableFieldDiffs` would never see it,
+        // diff would call the file Synced, and push would start applying the
+        // prompt's other changes before the server refused a config against the
+        // unchanged kind. The blob-bucket comparator projects in create mode for
+        // exactly this reason (`ttlTier`, below). PATCH payloads still omit `kind`
+        // — this is the comparison's projection, not push's.
+        parse: (doc) => buildPromptPushPayload(doc?.prompt?.key ?? "", doc, { mode: "create" }),
         serialize: (record) => serializePrompt(record),
         // Read from the DOCUMENT, not the parsed entity: `[[configs]]` is a sibling
         // table of `[prompt]`, and the prompt's own push payload does not carry it
@@ -8908,6 +9190,9 @@ What a push guarantees (two stages):
                         upserts: varPlan.upserts.filter((u) => wanted.has(u.key)),
                         deletions: varPlan.deletions.filter((k) => wanted.has(k)),
                         conflicts: varPlan.conflicts.filter((c) => wanted.has(c.key)),
+                        // A drifted var nobody selected is not this push's business to
+                        // report, the same way its writes are not this push's to make.
+                        drifted: varPlan.drifted.filter((d) => wanted.has(d.key)),
                         skippedCount: 0,
                     };
                 }
@@ -9200,6 +9485,13 @@ What a push guarantees (two stages):
                         localModifiedAt: c.localModifiedAt,
                     });
                 }
+                // …and var drift into the shared drift accumulator (#3714), so a var
+                // only the server moved prints the `DRIFT var: KEY` row every other
+                // type prints for that shape. It is not a failure: nothing was
+                // written and neither the exit code nor the pushed count moves.
+                for (const d of varPlan.drifted) {
+                    drifted.push({ type: "var", key: d.key });
+                }
                 // Delete removed keys BEFORE upserting new ones (issue #1423 review
                 // pass 3). At the server's 100-var cap, a replacement (remove one key,
                 // add another) is a valid final state, but upserting the new key first
@@ -10502,13 +10794,26 @@ What a push guarantees (two stages):
                 // manifest byte-hash gate with the type named, like every other
                 // converted type.
                 const livePromptIds = new Map();
+                // #3626, CR3626-001 — the KIND the server holds for each prompt,
+                // taken from the same list. `kind` is immutable after create
+                // (D3626-008), and the comparison gate refuses a change to it — but
+                // only on the paths that reach that gate. This map is what the other
+                // two read: a prompt whose DETAIL read failed (degraded to the
+                // byte-hash gate, which `--force` writes through) and a prompt
+                // adopted by key after a 409 (which re-issues the file as an UPDATE
+                // without ever comparing). Both would otherwise PATCH the prompt's
+                // schemas, access rule and metadata onto a row of the other kind
+                // before a config was refused against the kind that did not change.
+                const livePromptKinds = new Map();
                 let promptsLiveOk = true;
                 if (files.length > 0) {
                     try {
                         const listed = await fetchAll((p) => client.listPrompts(resolvedAppId, p));
                         for (const p of listed) {
-                            if (p?.promptKey)
-                                livePromptIds.set(p.promptKey, p.promptId);
+                            if (!p?.promptKey)
+                                continue;
+                            livePromptIds.set(p.promptKey, p.promptId);
+                            livePromptKinds.set(p.promptKey, promptKindOf(p));
                         }
                     }
                     catch (err) {
@@ -10831,6 +11136,18 @@ What a push guarantees (two stages):
                         }
                     };
                     if (existingId) {
+                        // #3626, CR3626-001 — the kind, before anything is written. The
+                        // comparison gate above already refuses a changed `kind`, but it
+                        // only ran when the DETAIL read succeeded; a prompt degraded to
+                        // the byte-hash gate reaches this line with `--force` and no
+                        // comparison at all. The list's kind is enough to answer it, and
+                        // answering it here keeps the promise the gate makes: a kind
+                        // change is declined before the first mutating call.
+                        const degradedKindDecline = promptKindImmutableOutcome(livePrompt ? promptKindOf(livePrompt) : livePromptKinds.get(key), tomlData);
+                        if (degradedKindDecline) {
+                            recordDeclined("prompt", key, degradedKindDecline, existingEntry?.modifiedAt);
+                            continue;
+                        }
                         // Update existing prompt
                         changes.push({ type: "prompt", action: "update", key });
                         promptKeyToId.set(key, existingId);
@@ -10923,6 +11240,19 @@ What a push guarantees (two stages):
                                 });
                                 adopted = true;
                                 const adoptedId = existing.promptId;
+                                // #3626, CR3626-001 — the adopted prompt's KIND, before the
+                                // re-issue writes anything. This path never reaches the
+                                // comparison gate (the create is what failed), so without
+                                // this an orphaned chat prompt would take a decisions file's
+                                // schemas, access rule and metadata by PATCH and only then
+                                // refuse its configs against the kind the update cannot
+                                // change. The lookup already read the record, so the answer
+                                // costs nothing.
+                                const adoptKindDecline = promptKindImmutableOutcome(promptKindOf(existing), tomlData);
+                                if (adoptKindDecline) {
+                                    recordDeclined("prompt", key, adoptKindDecline);
+                                    continue;
+                                }
                                 // Seed the sync-state entity record so the shared update body
                                 // can stamp modifiedAt/contentHash into it (sync state has no
                                 // entry for an orphaned prompt), and track the key→ID map.