primitive-admin 1.2.0-alpha.11 → 1.2.0-alpha.13

package/dist/src/commands/sync.js

@@ -9,7 +9,8 @@ import { buildDatabaseTypeTomlData } from "../lib/toml-database-config.js";
 // #3317 — see `config-json-field.ts`.
 import { serializeJsonField } from "../lib/config-json-field.js";
 import { parseMetadataCategoryToml, validateMetadataCategoryConfig, serializeMetadataCategoryConfig, parseDeclaredAccessManifestToml, validateDeclaredAccessManifest, } from "../lib/toml-metadata-config.js";
-import { getCurrentAppId, getServerUrl } from "../lib/config.js";
+import { getCurrentAppId, getServerUrl, loadCredentials } from "../lib/config.js";
+import { sessionHoldsScope, tokenReachesScope, } from "../lib/session-scope.js";
 import { requireCurrentEnvironment } from "../lib/env-resolver.js";
 import { ensureFileIgnored } from "../lib/local-state.js";
 import { PROJECT_TREE_DIR } from "../lib/env-resolver-core.js";
@@ -17,6 +18,7 @@ import { cachedVarsNote, layerVars, planVarsOverridePull, varsOverridePath as re
 import { resolveSyncDir, resolveSnapshotsRoot, resolveSyncStateReadPath, resolveSyncStateWritePath, SYNC_STATE_FILENAME, checkLegacyDatabaseTypesDir, } from "../lib/sync-paths.js";
 import { createSnapshot, listSnapshots, resolveSnapshot, restoreSnapshot, pruneSnapshots, } from "../lib/snapshots.js";
 import { parseConfigToml, stringifyConfigToml } from "../lib/config-toml.js";
+import { cloneTomlValue, planDb3TypePull, readDb3TypesDir, resolveDb3TypeModels } from "../lib/db3-type-models.js";
 import { canonicalizeIntegrationRequestConfig } from "../lib/integration-request-config.js";
 import { canonicalizeServerTextFields } from "../lib/server-text-normalization.js";
 import { canonicalJsonStringify } from "../lib/canonical-json.js";
@@ -27,6 +29,9 @@ import { collectAppSettingsPushErrors, writePulledAppSettings, diffAppSettings,
 import { BLOB_BUCKET_TABLE, DATABASE_TYPE_TABLE, DB3_TYPE_TABLE, EMAIL_TEMPLATE_TABLE, INTEGRATION_TABLE, METADATA_CATEGORY_CONFIG_TABLE, PROMPT_CONFIG_TABLE, PROMPT_TABLE, RULE_SET_TABLE, SERVER_FUNCTION_TABLE, TEST_CASE_SURFACE, TEST_CASE_TABLE, configDeclaredTypeErrors, deprecatedConfigKey, fieldServerDefault, findMisshapenTables, findUnknownDocumentKeys, findUnknownGroupedTomlKeys, findUnknownTomlKeys, misshapenTableMessage, retiredTomlKey, retiredDocumentKey, spellsDecimalNumber, unrecognizedPushKeysMessage, unrecognizedPushTablesMessage, warnUnrecognizedServerKeys, } from "../lib/config-surface.js";
 import { buildPayloadFromToml, projectEntityToPayload, projectRecordToToml, tomlOwned, } from "../lib/config-payload.js";
 import { CONFIG_SURFACES, isEmptyForEmit, tomlGroupsOf, RETIRED_CONFIG_DIRECTORIES, RETIRED_TYPE_CONFIG_DIRECTORIES, } from "../lib/generated-config-surfaces.js";
+// #4959 — the retired rule-set resource types, vendored with the one sentence
+// the rule-set routes answer, so the preflight refuses exactly what they do.
+import { retiredRuleSetResourceType } from "../lib/generated-config-surfaces.js";
 // #3626 — the prompt KIND rule, vendored with the definitions so the CLI's
 // preflight refuses exactly what the admin routes refuse.
 import { promptKindOf, resolvePromptKind, } from "../lib/generated-config-surfaces.js";
@@ -66,7 +71,7 @@ import { isFunctionDeclarationFile, resolveDocumentSchema, } from "../lib/functi
 import { createFunctionTypechecker, } from "../lib/function-typecheck.js";
 import { resolveFunctionSourceRoots } from "../lib/function-source-roots.js";
 import { detectLayout, migrateLegacyToV2 } from "../lib/block-layout.js";
-import { ABSENT_FROM_EXPORT, LOCAL_ONLY_ABSENT, LOCAL_ONLY_NEW, PUSH_PRUNE_SPECS, REMOTE_ONLY_UNMANAGED, REMOTE_ONLY_WILL_DELETE, SYNC_RESOURCE_TYPES, VALIDATION_ERROR, applyPrune, attachmentWritePath, attemptFetch, classifyLocalOnly, classifyPruneDeleteFailure, classifyRemoteOnly, collectPushPruneCandidates, decidePushPruneCandidate, formatPrunePlan, hasUncommittedChanges, isSafeAttachmentFilename, planPrune, preserveUnwrittenEntries, removePrunedSidecar, ruleSetFileKey, } from "../lib/sync-resource-types.js";
+import { ABSENT_FROM_EXPORT, LOCAL_ONLY_ABSENT, LOCAL_ONLY_NEW, PUSH_PRUNE_SPECS, REMOTE_ONLY_UNMANAGED, REMOTE_ONLY_WILL_DELETE, SYNC_RESOURCE_TYPES, VALIDATION_ERROR, applyPrune, attachmentWritePath, attemptFetch, classifyLocalOnly, classifyPruneDeleteFailure, classifyRemoteOnly, formatPrunePlan, hasUncommittedChanges, isSafeAttachmentFilename, planPrune, planPushPrune, preserveUnwrittenEntries, pruneAdminScopeRefusal, pruneScopeUnknownRefusal, removePrunedSidecar, ruleSetFileKey, } from "../lib/sync-resource-types.js";
 import { normalizeTestCaseKey, testCaseKeyError, } from "../lib/test-case-keys.js";
 import { slugifyTestCaseName, testCaseFileBasenames } from "../lib/test-case-file-names.js";
 // The sidecar naming rules live in `lib/` (#3061); re-exported here because
@@ -1459,6 +1464,37 @@ export function configUnknownKeyError(filePath, tomlData, table) {
  * spelling with no scheduled removal (a function's frozen `access`, #4738) is
  * not one of them. A repeated table's entries are read one by one.
  */
+/**
+ * #4989 — whether this session can make the prune's hard deletes in `appId`:
+ * read from the stored token and step-up where they say, with the app's
+ * parent looked up only when a pin on it could be what reaches the app, and
+ * from the server for an opaque CI token. Rejects when a read it needs fails;
+ * the caller treats that as unknown, never as `admin`.
+ */
+async function sessionHoldsAdminFor(client, appId) {
+    const credentials = loadCredentials();
+    // No stored session to read: the server judges each delete.
+    if (!credentials)
+        return true;
+    const target = { appId };
+    let holds = sessionHoldsScope(credentials, "admin", target);
+    if (holds === true)
+        return true;
+    const app = (await client.getApp(appId));
+    target.parentAppId = app?.parentAppId ?? null;
+    holds = sessionHoldsScope(credentials, "admin", target);
+    if (holds !== null)
+        return holds;
+    // An opaque CI token: the server says what it holds. "full" is unscoped.
+    const me = (await client.getMe());
+    const session = me?.session;
+    if (!session)
+        return true;
+    return tokenReachesScope({
+        scope: Array.isArray(session.scope) ? session.scope : undefined,
+        apps: session.apps,
+    }, "admin", target);
+}
 function deprecatedKeysPresent(tomlData, table) {
     const prefix = table.tomlPath.join(".");
     const at = table.tomlPath.reduce((node, segment) => (node == null ? node : node[segment]), tomlData);
@@ -1680,6 +1716,31 @@ export function retiredTypeConfigFilesIn(configDir) {
     }
     return refusals;
 }
+/**
+ * Every `rule-sets/*.toml` whose `[ruleSet] resourceType` is retired (#4959:
+ * `lock`), as `<file>: ruleSet.resourceType = "<type>" — <sentence>`. A file
+ * that does not parse is left to the rule-set validators.
+ */
+export function retiredRuleSetFilesIn(configDir) {
+    const dir = join(configDir, "rule-sets");
+    if (!existsSync(dir))
+        return [];
+    const refusals = [];
+    for (const file of readdirSync(dir).filter((f) => f.endsWith(".toml")).sort()) {
+        let resourceType;
+        try {
+            resourceType = parseTomlFile(join(dir, file))?.ruleSet?.resourceType;
+        }
+        catch {
+            continue;
+        }
+        const retired = retiredRuleSetResourceType(resourceType);
+        if (!retired)
+            continue;
+        refusals.push(`${file}: ruleSet.resourceType = ${JSON.stringify(resourceType)} — ${retired.message}`);
+    }
+    return refusals;
+}
 /**
  * `config push`'s preflight — every check the authored files decide on their
  * own, run before the FIRST mutating call (#976 fix A, #3320, #3375).
@@ -1755,6 +1816,13 @@ export async function runConfigPushPreflight(input) {
     }
     if (retiredTypeConfigFiles.length > 0)
         abortOnPreflightErrors();
+    // #4959 — a rule set of a retired resource type (`lock`) is refused here,
+    // with the sentence the rule-set routes give, before the rule-set loop could
+    // skip it as unchanged. Deleting the file and pushing with `--prune` removes
+    // the stored row.
+    for (const refusal of retiredRuleSetFilesIn(configDir)) {
+        preflightValidationErrors.push(`  ${refusal}`);
+    }
     // Validate all database-type TOMLs: the parse itself refuses an invalid
     // declared-access manifest. (#3189 — the `[[operations]]` `$params` and
     // `[[subscriptions]]` checks retired with the two tables, which the
@@ -1776,9 +1844,12 @@ export async function runConfigPushPreflight(input) {
     // refused here, naming both files, before anything is applied.
     const preflightDb3TypesDir = join(configDir, "db3-types");
     if (existsSync(preflightDb3TypesDir)) {
+        // #5025 — each file as push sends it: with the models it names.
+        const preflightDb3Resolution = resolveDb3TypeModels(preflightDb3TypesDir);
         for (const file of selectFiles("db3-type", preflightDb3TypesDir, readdirSync(preflightDb3TypesDir).filter((f) => f.endsWith(".toml")))) {
             try {
-                parseDb3TypeToml(parseTomlFile(join(preflightDb3TypesDir, file)));
+                const parsed = parseTomlFile(join(preflightDb3TypesDir, file));
+                parseDb3TypeToml(preflightDb3Resolution.documents.get(file) ?? parsed);
             }
             catch (err) {
                 preflightValidationErrors.push(`  ${file}: ${err?.message || String(err)}`);
@@ -1983,7 +2054,10 @@ export async function runConfigPushPreflight(input) {
     // cannot disagree about which files are pushable.
     for (const rejected of collectConfigFileValidationErrors(configDir)) {
         for (const message of rejected.messages) {
-            preflightValidationErrors.push(`  ${message}`);
+            // #5025 — a refusal about two db3 type files is collected for each.
+            if (!preflightValidationErrors.includes(`  ${message}`)) {
+                preflightValidationErrors.push(`  ${message}`);
+            }
         }
     }
     // #4872 — a deprecated key is accepted and never sent; the file is told
@@ -2901,6 +2975,29 @@ export function collectConfigFileValidationErrors(configDir) {
                 messages,
             });
         }
+        // #5025 — a db3 type naming a model declared in another file of the
+        // directory: an undeclared or self reference, or two files declaring one
+        // model differently, refuses every file it is about.
+        if (dir === "db3-types") {
+            for (const refusal of resolveDb3TypeModels(typeDir).refusals) {
+                for (const file of refusal.files) {
+                    const filePath = join(typeDir, file);
+                    let tomlData;
+                    try {
+                        tomlData = parseTomlFile(filePath);
+                    }
+                    catch {
+                        continue;
+                    }
+                    found.push({
+                        type: surface.label,
+                        key: localConfigRowKey(surface.label, tomlData, file),
+                        filePath,
+                        messages: [refusal.message],
+                    });
+                }
+            }
+        }
     }
     return found;
 }
@@ -4134,6 +4231,42 @@ export const DB3_TYPE_DIFF_SPEC = {
     serialize: (record, maps) => serializeDb3Type(record, maps.ruleSetIdToName),
     describe: (entity) => `db3 type "${entity?.databaseType}"`,
 };
+/**
+ * #5025 — what a `config push` conflict on `db3-types/<name>.toml` says when
+ * the server holds a type of that name this tree never pulled: a database
+ * type (`POST databases/types`), or a db3 type pushed from another tree.
+ */
+export function db3TypeConflictHint(name) {
+    return (`The server already holds a type named "${name}" (a database type, or a db3 type this ` +
+        `tree never pulled). Run \`primitive config pull\` to adopt it as db3-types/${name}.toml, ` +
+        `or \`primitive config push --force\` to overwrite it with this file.`);
+}
+/**
+ * #5025 — the baseline a successful `PUT db3-types/:name` stamps: the semantic
+ * hash of the row its answer carries, read as the live listing spells it. A
+ * file naming shared models reads differently whenever the declaring file
+ * moves, while its own bytes stand still, so the byte hash alone would read
+ * the next such edit as both sides having changed.
+ */
+export function db3TypeWriteBaseline(answerType, name, maps) {
+    if (!answerType || typeof answerType !== "object")
+        return undefined;
+    const { name: typeName, revision: _revision, ...row } = answerType;
+    return remoteSemanticBaseline({
+        spec: DB3_TYPE_DIFF_SPEC,
+        maps,
+        returned: { ...row, databaseType: row.databaseType ?? typeName ?? name },
+    });
+}
+/**
+ * #5025 — the hint a declined `db3-types/` push carries: the conflict hint
+ * when the row is live but this tree holds no baseline for it, none otherwise.
+ */
+export function db3TypeDeclineHint(name, outcome) {
+    return outcome.action === "conflict" && outcome.direction === "unknown-direction"
+        ? db3TypeConflictHint(name)
+        : undefined;
+}
 /**
  * #4802 — the names a config tree holds in BOTH `db3-types/` and
  * `database-type-configs/`, each one resource. Twins whose files read the same
@@ -4150,6 +4283,8 @@ export function classifyDb3TypeTwins(configDir, maps = { ruleSetIdToName: new Ma
     if (!existsSync(db3Dir) || !existsSync(legacyDir))
         return { agreeing, refusals, refusedNames };
     const legacy = new Map();
+    // #5025 — the db3 side as push sends it, with the models it names.
+    const resolved = resolveDb3TypeModels(db3Dir).documents;
     for (const file of readdirSync(legacyDir).filter((f) => f.endsWith(".toml"))) {
         try {
             const parsed = parseTomlFile(join(legacyDir, file));
@@ -4167,6 +4302,7 @@ export function classifyDb3TypeTwins(configDir, maps = { ruleSetIdToName: new Ma
         catch {
             continue;
         }
+        parsed = resolved.get(file) ?? parsed;
         const name = parsed?.type?.name || basename(file, ".toml");
         const twin = legacy.get(name);
         if (!twin)
@@ -7794,11 +7930,42 @@ export function registerConfigSyncCommands(sync) {
             }
             // #4802 — db3 types: the same rows, named by `name`.
             const db3TypeEntities = {};
+            const db3TypeContents = new Map();
+            for (const typeConfig of db3TypesToWrite) {
+                db3TypeContents.set(`${typeConfig.databaseType}.toml`, serializeDb3Type(typeConfig, ruleSetIdToName, { logger: (msg) => info(`  ${msg}`) }));
+            }
+            // #5025 — a local file naming models declared in another file is kept
+            // when, resolved against the tree this pull leaves, it reads as its
+            // server row; decided for every file before any is written. The tree
+            // it leaves has no file the prune below removes, so a declaring type
+            // deleted on the server is planned out here (a file the prune then
+            // keeps for its local edits only costs a rewrite in full).
+            const db3TypeResource = SYNC_RESOURCE_TYPES.find((type) => type.stateSlot === "db3Types");
+            const db3PrunePlan = planPrune({
+                resourceType: db3TypeResource,
+                priorKeys: Object.keys(priorEntities.db3Types ?? {}).filter((key) => selectionIncludesKey(pullSelection, db3TypeResource.label, key)),
+                presence: databaseTypeConfigsOutcome.ok
+                    ? { ok: true, serverKeys: db3TypesToWrite.map((t) => t.databaseType) }
+                    : { ok: false },
+                enabled: options.prune !== false,
+            });
+            const db3PullPlan = planDb3TypePull({
+                local: readDb3TypesDir(join(configDir, "db3-types")),
+                server: db3TypeContents,
+                same: (serverContent, document) => sameDb3TypeAs(serverContent, pullDiffMaps)(stringifyConfigToml(document)),
+                removed: db3PrunePlan.keys.map((key) => db3TypeResource.fileFromKey(key)),
+            });
             for (const typeConfig of db3TypesToWrite) {
                 const filename = `${typeConfig.databaseType}.toml`;
                 const filePath = join(configDir, "db3-types", filename);
-                const content = serializeDb3Type(typeConfig, ruleSetIdToName, { logger: (msg) => info(`  ${msg}`) });
-                const written = writePulledFile(filePath, content, pullWrites, sameDb3TypeAs(content, pullDiffMaps));
+                const content = db3TypeContents.get(filename);
+                const kept = db3PullPlan.keep.has(filename);
+                if (kept)
+                    pullWrites.unchanged += 1;
+                // A reference-form file the plan rewrites is compared by bytes only:
+                // unresolved, it can read as the server row while what it pushes does not.
+                const matches = db3PullPlan.rewrite.has(filename) ? undefined : sameDb3TypeAs(content, pullDiffMaps);
+                const written = !kept && writePulledFile(filePath, content, pullWrites, matches);
                 let semanticHash;
                 try {
                     semanticHash = hashLocalConfigForDiff(DB3_TYPE_DIFF_SPEC, parseConfigToml(content), pullDiffMaps);
@@ -7816,6 +7983,8 @@ export function registerConfigSyncCommands(sync) {
                 if (written)
                     info(`  Wrote db3-types/${filename}`);
             }
+            for (const note of db3PullPlan.notes)
+                warn(`  Note: ${note}`);
             // #3182 — the typed-handle artifacts are REGENERATED, never pulled:
             // they are not in the envelope, and a fresh clone must end up with the
             // same three files a push would have written. Written here, after the
@@ -8399,6 +8568,8 @@ What a push guarantees (two stages):
                         else if (conflict.direction === "late-409") {
                             console.log(`    ${chalk.dim("the server changed between this push's read and its write")}`);
                         }
+                        if (conflict.hint)
+                            console.log(`    ${conflict.hint}`);
                         for (const field of conflict.fields || []) {
                             console.log(`    ${field.field}: local ${summarizeFieldValue(field.local)} | server ${summarizeFieldValue(field.server)}`);
                         }
@@ -8546,7 +8717,7 @@ What a push guarantees (two stages):
                 warn(`  ${label}: live state unavailable (${message}) — falling back to last-sync content hashes`);
             };
             /** Record a decision push refused to apply, with its per-field diff. */
-            const recordDeclined = (type, key, outcome, storedModifiedAt) => {
+            const recordDeclined = (type, key, outcome, storedModifiedAt, hint) => {
                 if (outcome.action === "drift") {
                     drifted.push({ type, key });
                     return;
@@ -8595,6 +8766,7 @@ What a push guarantees (two stages):
                     direction: outcome.direction,
                     fields: outcome.fields,
                     planned: false,
+                    ...(hint ? { hint } : {}),
                 });
             };
             /**
@@ -8747,6 +8919,39 @@ What a push guarantees (two stages):
             if (varsOverrideKeys && varsOverrideFile) {
                 info(varsOverrideSummaryLine(varsOverrideFile, varsOverrideKeys));
             }
+            // #4989 — a prune whose plan hard-deletes needs `admin`. A session
+            // without it is refused here, before anything below mutates, rather
+            // than having each delete refused after the rest of the push landed.
+            // A session whose scope cannot be read is refused too: assuming
+            // `admin` would let the push land halfway all the same.
+            if (options.prune) {
+                const refusal = pruneAdminScopeRefusal(await planPushPrune({
+                    specs: PUSH_PRUNE_SPECS.filter((spec) => spec.deleteNeedsAdmin),
+                    configDir,
+                    entities: syncState?.entities,
+                    includes: (label, key) => selectionIncludesKey(pushSelection, label, key),
+                    client,
+                    appId: resolvedAppId,
+                    force: !!options.force,
+                }));
+                let stop = null;
+                if (refusal) {
+                    try {
+                        if (!(await sessionHoldsAdminFor(client, resolvedAppId)))
+                            stop = refusal;
+                    }
+                    catch (err) {
+                        stop = pruneScopeUnknownRefusal(err?.message ?? String(err));
+                    }
+                }
+                if (stop && options.dryRun) {
+                    warn(stop);
+                }
+                else if (stop) {
+                    error(stop);
+                    process.exit(1);
+                }
+            }
             // Re-derived, not returned: both are one-line functions of inputs the
             // entry point already took, and widening its return type to carry them
             // would make the vars apply leg depend on the preflight's internals.
@@ -10731,9 +10936,11 @@ What a push guarantees (two stages):
                 else if (files.length > 0) {
                     warnLiveUnavailable("db3-types", "rule sets unavailable");
                 }
+                // #5025 — each file with the models it names in another file.
+                const db3Resolution = resolveDb3TypeModels(db3TypesDir);
                 for (const file of files) {
                     const filePath = join(db3TypesDir, file);
-                    const tomlData = parseTomlFile(filePath);
+                    const tomlData = db3Resolution.documents.get(file) ?? parseTomlFile(filePath);
                     const { typeConfig } = parseDb3TypeToml(tomlData);
                     const name = typeConfig.databaseType || basename(file, ".toml");
                     if (agreeingTwins.has(name))
@@ -10780,7 +10987,7 @@ What a push guarantees (two stages):
                             continue;
                         }
                         if (gate.action === "drift" || gate.action === "conflict" || gate.action === "immutable") {
-                            recordDeclined("db3-type", name, gate, entry?.modifiedAt);
+                            recordDeclined("db3-type", name, gate, entry?.modifiedAt, db3TypeDeclineHint(name, gate));
                             continue;
                         }
                     }
@@ -10828,11 +11035,18 @@ What a push guarantees (two stages):
                         else if (answer.push?.status === "not_started") {
                             warn(`    The push to the db3s of ${name} did not start: ${answer.push.error}`);
                         }
-                        record(answer.type?.modifiedAt || new Date().toISOString(), undefined, typeof answer.type?.schema === "string" && answer.type.schema.length > 0);
+                        record(answer.type?.modifiedAt || new Date().toISOString(), db3TypeWriteBaseline(answer.type, name, pushDiffMaps), typeof answer.type?.schema === "string" && answer.type.schema.length > 0);
                     }
                     catch (err) {
                         if (err instanceof ConflictError) {
-                            conflicts.push({ type: "db3-type", key: name, serverModifiedAt: err.serverModifiedAt, localModifiedAt: expectedModifiedAt || "unknown" });
+                            conflicts.push({
+                                type: "db3-type",
+                                key: name,
+                                serverModifiedAt: err.serverModifiedAt,
+                                localModifiedAt: expectedModifiedAt || "unknown",
+                                // #5025 — a create the server refused: it holds the name.
+                                ...(exists ? {} : { hint: db3TypeConflictHint(name) }),
+                            });
                             continue;
                         }
                         throw wrapEntityError(err, exists ? "update" : "create", "db3 type", name);
@@ -12426,65 +12640,25 @@ What a push guarantees (two stages):
                 const toDelete = [];
                 const alreadyAbsent = [];
                 const skipped = [];
-                for (const spec of PUSH_PRUNE_SPECS) {
-                    const priorEntities = syncState?.entities?.[spec.resourceType.stateSlot];
-                    const candidates = collectPushPruneCandidates({
-                        spec,
-                        configDir,
-                        priorEntities,
-                    }).filter(({ key }) => 
+                for (const item of await planPushPrune({
+                    specs: PUSH_PRUNE_SPECS,
+                    configDir,
+                    entities: syncState?.entities,
                     // `--only` bounds prune to the selection. Without this a
                     // single-object push with `--prune` would delete every managed
                     // entity whose file happens to be missing — objects the operator
                     // did not name and is not looking at.
-                    selectionIncludesKey(pushSelection, spec.resourceType.label, key));
-                    for (const { key, entry } of candidates) {
-                        const address = spec.addressOf(key, entry);
-                        // Behavior 4: skip the point read for a candidate we could not
-                        // delete anyway — no usable address (for metadata-category-configs
-                        // that includes a state key that is not a `resourceType#category`
-                        // pair, #2762), or a spec with no delete surface.
-                        if (!address || !spec.deleteEntity) {
-                            const decision = decidePushPruneCandidate({
-                                spec,
-                                address,
-                                priorModifiedAt: entry?.modifiedAt,
-                                fetch: { ok: false },
-                                force: !!options.force,
-                            });
-                            skipped.push({ spec, key, entry, address, decision });
-                            continue;
-                        }
-                        // Point read: confirm live presence + drift. Fail closed — any
-                        // non-404 error leaves the entity and its state slot untouched.
-                        let fetchOutcome;
-                        try {
-                            const detail = await spec.fetchDetail(client, resolvedAppId, address);
-                            fetchOutcome = { ok: true, detail };
-                        }
-                        catch (err) {
-                            if (err instanceof ApiError && err.statusCode === 404) {
-                                fetchOutcome = { ok: false, status: 404 };
-                            }
-                            else {
-                                fetchOutcome = { ok: false };
-                            }
-                        }
-                        const decision = decidePushPruneCandidate({
-                            spec,
-                            address,
-                            priorModifiedAt: entry?.modifiedAt,
-                            fetch: fetchOutcome,
-                            force: !!options.force,
-                        });
-                        const item = { spec, key, entry, address, decision };
-                        if (decision.action === "delete")
-                            toDelete.push(item);
-                        else if (decision.action === "drop-state")
-                            alreadyAbsent.push(item);
-                        else
-                            skipped.push(item);
-                    }
+                    includes: (label, key) => selectionIncludesKey(pushSelection, label, key),
+                    client,
+                    appId: resolvedAppId,
+                    force: !!options.force,
+                })) {
+                    if (item.decision.action === "delete")
+                        toDelete.push(item);
+                    else if (item.decision.action === "drop-state")
+                        alreadyAbsent.push(item);
+                    else
+                        skipped.push(item);
                 }
                 const totalPlanned = toDelete.length +
                     alreadyAbsent.length +
@@ -12570,6 +12744,7 @@ What a push guarantees (two stages):
                     else {
                         let prunedCount = 0;
                         let blockedCount = 0;
+                        let failedCount = 0;
                         // Entities already gone server-side: drop their stale state (2).
                         for (const item of alreadyAbsent) {
                             dropPruneState(item.spec, item.key);
@@ -12603,8 +12778,16 @@ What a push guarantees (two stages):
                                         warn(`  Blocked — ${item.spec.resourceType.label} ${item.key} is still referenced: ${message}`);
                                         break;
                                     default:
-                                        blockedCount++;
-                                        warn(`  Skipped — could not delete ${item.spec.resourceType.label} ${item.key}: ${message}`);
+                                        // #4989 — any other refusal fails the push with the
+                                        // server's error, as every other apply failure does
+                                        // (#2731 B2), and keeps the state so a re-run retries.
+                                        failedCount++;
+                                        applyFailures.push({
+                                            type: item.spec.resourceType.label,
+                                            key: item.key,
+                                            message,
+                                        });
+                                        error(`  Failed — could not delete ${item.spec.resourceType.label} ${item.key}: ${message}`);
                                 }
                             }
                         }
@@ -12621,7 +12804,7 @@ What a push guarantees (two stages):
                         });
                         prunedCount += testCasePrune.deleted + testCasePrune.deletedAttachments;
                         if (totalPlanned > 0) {
-                            info(`Prune: ${prunedCount} deleted, ${alreadyAbsent.length} already absent, ${skipped.length + blockedCount} skipped.`);
+                            info(`Prune: ${prunedCount} deleted, ${alreadyAbsent.length} already absent, ${skipped.length + blockedCount} skipped${failedCount > 0 ? `, ${failedCount} failed` : ""}.`);
                         }
                     }
                 }
@@ -12969,8 +13152,10 @@ What a push guarantees (two stages):
             }
             const db3TypesDiffDir = join(configDir, "db3-types");
             if (databaseTypeConfigsOutcomeDiff.ok && existsSync(db3TypesDiffDir)) {
+                // #5025 — compared as push sends it, with the models it names.
+                const db3DiffResolution = resolveDb3TypeModels(db3TypesDiffDir);
                 for (const file of readdirSync(db3TypesDiffDir).filter((f) => f.endsWith(".toml"))) {
-                    const tomlData = parseTomlFile(join(db3TypesDiffDir, file));
+                    const tomlData = cloneTomlValue(db3DiffResolution.documents.get(file) ?? parseTomlFile(join(db3TypesDiffDir, file)));
                     const key = tomlData.type?.name || basename(file, ".toml");
                     if (!tomlData.type)
                         tomlData.type = {};