primitive-admin 1.2.0-alpha.3 → 1.2.0-alpha.5

package/dist/src/commands/sync.js

@@ -2,15 +2,14 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync, readdirSync, unlink
 import { join, basename } from "path";
 import { createHash } from "crypto";
 import { lookup as mimeLookup } from "mime-types";
-import { ApiClient, ApiError, ConflictError, SchemaRequiredError, OperationRefError, SchemaBreaksOpsError, SchemaHasUncheckableOpsError, TomlParseError, OpsExistError, } from "../lib/api-client.js";
+import { ApiClient, ApiError, ConflictError, TomlParseError, } from "../lib/api-client.js";
 import { retryOnStoragePending } from "../lib/storage-pending-retry.js";
-import { buildDatabaseTypeTomlData, detectExistingOperationForms, normalizeOperationFromToml, normalizeSubscriptionFromToml, SubscriptionAccessKeyConflictError, } from "../lib/toml-database-config.js";
+import { buildDatabaseTypeTomlData } from "../lib/toml-database-config.js";
 import { canEmitNative } from "../lib/toml-native-form.js";
 // #1446's `type: "json"` emission rule, shared with `serializeFunction` since
 // #3317 — see `config-json-field.ts`.
 import { serializeJsonField } from "../lib/config-json-field.js";
 import { parseMetadataCategoryToml, validateMetadataCategoryConfig, serializeMetadataCategoryConfig, parseDeclaredAccessManifestToml, validateDeclaredAccessManifest, serializeDeclaredAccessManifest, } from "../lib/toml-metadata-config.js";
-import { validateOperations, formatIssue, } from "../lib/toml-params-validator.js";
 import { isPlatformOwnedWorkflow, isPlatformOwnedWorkflowKey, } from "../lib/platform-owned.js";
 import { getCurrentAppId, getServerUrl } from "../lib/config.js";
 import { requireCurrentEnvironment } from "../lib/env-resolver.js";
@@ -35,14 +34,17 @@ import { buildWorkflowPayloadFromToml, parseWorkflowExpressionsToml, } from "../
 // payload builder so the diff normalizer and the wire cannot disagree.
 import { WORKFLOW_MODEL_DEFAULTS } from "../lib/workflow-defaults.js";
 // #2644 — the one definition per configuration object, vendored from the server.
-import { BLOB_BUCKET_TABLE, COLLECTION_TYPE_CONFIG_TABLE, CRON_TRIGGER_TABLE, DATABASE_TYPE_TABLE, EMAIL_TEMPLATE_TABLE, GROUP_TYPE_CONFIG_TABLE, INTEGRATION_TABLE, METADATA_CATEGORY_CONFIG_TABLE, PROMPT_CONFIG_TABLE, PROMPT_TABLE, RULE_SET_TABLE, SERVER_FUNCTION_TABLE, TEST_CASE_SURFACE, TEST_CASE_TABLE, WEBHOOK_TABLE, WORKFLOW_TABLE, configDeclaredTypeErrors, fieldServerDefault, findMisshapenTables, findUnknownDocumentKeys, findUnknownGroupedTomlKeys, findUnknownServerKeys, findUnknownTomlKeys, misshapenTableMessage, retiredTomlKey, spellsDecimalNumber, unrecognizedPullKeysMessage, unrecognizedPushKeysMessage, unrecognizedPushTablesMessage, warnUnrecognizedServerKeys, } from "../lib/config-surface.js";
+import { BLOB_BUCKET_TABLE, COLLECTION_TYPE_CONFIG_TABLE, CRON_TRIGGER_TABLE, DATABASE_TYPE_TABLE, EMAIL_TEMPLATE_TABLE, GROUP_TYPE_CONFIG_TABLE, INTEGRATION_TABLE, METADATA_CATEGORY_CONFIG_TABLE, PROMPT_CONFIG_TABLE, PROMPT_TABLE, RULE_SET_TABLE, SERVER_FUNCTION_TABLE, TEST_CASE_SURFACE, TEST_CASE_TABLE, WEBHOOK_TABLE, WORKFLOW_TABLE, configDeclaredTypeErrors, fieldServerDefault, findMisshapenTables, findUnknownDocumentKeys, findUnknownGroupedTomlKeys, findUnknownServerKeys, findUnknownTomlKeys, misshapenTableMessage, retiredTomlKey, retiredDocumentKey, spellsDecimalNumber, unrecognizedPullKeysMessage, unrecognizedPushKeysMessage, unrecognizedPushTablesMessage, warnUnrecognizedServerKeys, } from "../lib/config-surface.js";
 import { buildPayloadFromToml, projectEntityToPayload, projectRecordToToml, tomlOwned, } from "../lib/config-payload.js";
 import { CONFIG_SURFACES, isEmptyForEmit, tomlGroupsOf, } from "../lib/generated-config-surfaces.js";
 // #3626 — the prompt KIND rule, vendored with the definitions so the CLI's
 // preflight refuses exactly what the admin routes refuse.
 import { promptKindOf, resolvePromptKind, } from "../lib/generated-config-surfaces.js";
 // #3798 — the `[prompt.agent]` declaration rule, vendored the same way.
-import { agentDeclarationFunctionKeys, agentTestCaseRefusal, resolveAgentDeclaration, } from "../lib/generated-config-surfaces.js";
+import { agentDeclarationFunctionKeys, resolveAgentDeclaration, } from "../lib/generated-config-surfaces.js";
+// #4262 — the agent test case's shape rule (`[test.agent]`), vendored the same
+// way, so the preflight refuses exactly the sidecars the admin routes refuse.
+import { AGENT_TEST_CASE_FIELDS, resolveAgentTestCase, } from "../lib/generated-config-surfaces.js";
 // #3799 — the meaning-preserving schema translation, vendored the same way, so
 // the preflight refuses exactly the schemas the admin routes refuse.
 import { agentSchemaTranslationRefusals } from "../lib/generated-config-surfaces.js";
@@ -51,7 +53,7 @@ import { agentSchemaTranslationRefusals } from "../lib/generated-config-surfaces
 import { resolvePromptStrictOutput } from "../lib/generated-config-surfaces.js";
 // #3179 — the function's two halves: the header payloads and the envelope
 // `config push` sends, and the bytes `config pull` writes back.
-import { applyFunctionPull, buildFunctionConfigPush, createDocumentSchemaDropWarner, documentSchemaRetentionFailure, buildFunctionCreatePayload, buildFunctionUpdatePayload, functionDiffEntity, functionTomlIgnoredKeyWarnings, functionTomlPreflightErrors, planDocumentSchemaPull, planFunctionPull, serializeFunction, } from "../lib/function-sync.js";
+import { applyFunctionPull, buildFunctionConfigPush, createDocumentSchemaDropWarner, documentSchemaRetentionFailure, buildFunctionCreatePayload, buildFunctionUpdatePayload, functionDiffEntity, functionTomlPreflightErrors, planDocumentSchemaPull, planFunctionPull, serializeFunction, } from "../lib/function-sync.js";
 import { newerVersionLine, pullNewerVersionLine, rollbackDiffHint, } from "../lib/function-versions.js";
 import { FunctionBuildError } from "../lib/function-bundle.js";
 // #3182 — the local half of capability validation. The grammar is the vendored
@@ -1672,9 +1674,9 @@ export function serializeBlobBucket(bucket, ruleSetIdToName = new Map(), logger)
  * `config push` builds its bodies from and `config diff` compares.
  *
  * Read in CREATE mode, so the immutable `ttlTier` stays nameable. The rule set
- * is left as `_ruleSetName` for `resolveRuleSetReference`; the deprecated
- * `ruleSetId` spelling is forwarded as the id it already is. A file carrying
- * both is refused by the preflight (`blobBucketFileErrors`) before this runs.
+ * is left as `_ruleSetName` for `resolveRuleSetReference`. The id spelling
+ * `ruleSetId` is a retired key (#4283): the preflight refuses a file carrying
+ * it, and this parse never reads it.
  *
  * An omitted `name` stays omitted: the update leaves the server's name alone,
  * and only the create body falls back to the key.
@@ -1697,43 +1699,8 @@ export function parseBlobBucketToml(doc) {
         // Trimmed, as `applyRuleSetReference` does for the type configs.
         entity._ruleSetName = section.ruleSetName.trim();
     }
-    else if (typeof section.ruleSetId === "string" && section.ruleSetId !== "") {
-        entity.ruleSetId = section.ruleSetId;
-    }
     return entity;
 }
-/**
- * The advisory `config push` prints for a bucket file still naming its rule set
- * by id (#4116). The key is deprecated, not retired: the file pushes.
- */
-export function blobBucketDeprecatedKeyWarning(filePath, tomlData) {
-    const bucket = tomlData?.bucket;
-    if (!bucket || bucket.ruleSetId === undefined)
-        return null;
-    // Beside `ruleSetName` it is a refusal instead (`blobBucketFileErrors`).
-    if (bucket.ruleSetName !== undefined)
-        return null;
-    return (`${filePath}: bucket.ruleSetId is deprecated — a rule-set id belongs to one app, ` +
-        `so a copied tree cannot resolve it; write ruleSetName = "<name>" ` +
-        "(config pull rewrites the file). Retiring the key is a later change.");
-}
-/** A bucket file's own refusals, decided from the file alone (#4116). */
-export function blobBucketFileErrors(filePath, tomlData) {
-    const bucket = tomlData?.bucket;
-    if (bucket && bucket.ruleSetId !== undefined && bucket.ruleSetName !== undefined) {
-        return [`${filePath}: bucket.ruleSetId is set beside bucket.ruleSetName; keep ruleSetName`];
-    }
-    // The deprecated spelling is a TOML-only key, so the declared-type check
-    // reads only `ruleSetName`; the old key keeps the field's type under its
-    // own name, or a mistyped id would be dropped from the body unreported.
-    const field = BLOB_BUCKET_TABLE.fields.find((f) => f.field === "ruleSetId");
-    if (!field)
-        return [];
-    return configDeclaredTypeErrors(filePath, tomlData, {
-        ...BLOB_BUCKET_TABLE,
-        fields: [{ ...field, tomlKey: "ruleSetId" }],
-    });
-}
 /**
  * Build the PATCH payload for a blob-bucket update from local TOML.
  *
@@ -1947,33 +1914,33 @@ export function serializePrompt(prompt, logger) {
     return stringifyConfigToml(data);
 }
 /**
- * The `config push` warning for a resource pushed with no `accessRule` (#2652).
+ * The `config push` warning for a caller workflow pushed with no `accessRule`
+ * (#2652).
  *
  * Returns `null` when a rule is declared — and for a `runAs = "system"`
  * workflow, which rejects any rule and cannot be started by a member at all.
- * Otherwise it names the resource, the consequence, and the one-line restore,
- * because after the #2652 flip a ruleless prompt or caller workflow denies
- * every non-admin caller from the deploy onward.
+ * Otherwise it names the workflow, the consequence, and the one-line restore,
+ * because after the #2652 flip a ruleless caller workflow denies every
+ * non-admin caller from the deploy onward.
+ *
+ * A prompt gets no warning (#4368): a server function runs it on its
+ * `prompt:<key>` grant, which never consults the rule, so a ruleless prompt is
+ * the ordinary case, not a lockout.
  *
- * Both kinds now push `accessRule` as value-or-`null` — the prompt since #1567,
- * the workflow since #2743's always-send conversion — so for either one an
- * omitted key really does leave the resource ruleless on the server. The
- * workflow wording says so explicitly, because it used to say the opposite
- * (the update path preserved a stored rule) and an operator who learned that
- * caveat needs to see it retracted.
+ * The workflow pushes `accessRule` as value-or-`null` since #2743's
+ * always-send conversion, so an omitted key really does leave it ruleless on
+ * the server. The wording says so explicitly, because it used to say the
+ * opposite (the update path preserved a stored rule) and an operator who
+ * learned that caveat needs to see it retracted.
  */
 export function missingAccessRuleWarning(opts) {
     if (typeof opts.accessRule === "string" && opts.accessRule.trim() !== "") {
         return null;
     }
-    if (opts.kind === "workflow" && opts.runAs === "system")
+    if (opts.runAs === "system")
         return null;
     const restore = `Add accessRule = "true" to allow any app member, or a CEL rule ` +
         `naming who may call it.`;
-    if (opts.kind === "prompt") {
-        return (`prompt '${opts.key}' has no accessRule — all non-admin executions are ` +
-            `denied. ${restore}`);
-    }
     return (`workflow '${opts.key}' declares no accessRule — pushing this file clears ` +
         `any rule stored server-side, and a workflow with no stored rule denies ` +
         `all non-admin starts. ${restore}`);
@@ -2360,7 +2327,16 @@ export function configUnknownKeyError(filePath, tomlData, table) {
  */
 export function configDocumentShapeErrors(filePath, tomlData, surface) {
     const errors = [];
-    const unknown = findUnknownDocumentKeys(tomlData, surface);
+    const found = findUnknownDocumentKeys(tomlData, surface);
+    // #3189 — a table this file type retired on purpose gets its own sentence,
+    // stated once beside the definitions, not the "check the spelling, or
+    // upgrade the CLI" hint, which is backwards for it.
+    for (const key of found) {
+        const retired = retiredDocumentKey(surface.label, key);
+        if (retired)
+            errors.push(`${filePath}: [${key}] — ${retired.toml}`);
+    }
+    const unknown = found.filter((key) => !retiredDocumentKey(surface.label, key));
     if (unknown.length > 0) {
         errors.push(unrecognizedPushTablesMessage(filePath, unknown));
     }
@@ -2595,77 +2571,22 @@ export async function runConfigPushPreflight(input) {
             }
         }
     }
-    // Validate all database-type TOMLs (issue #803 subscription
-    // access/accessRule conflict + issue #752 $params references).
+    // Validate all database-type TOMLs: the parse itself refuses an invalid
+    // declared-access manifest. (#3189 — the `[[operations]]` `$params` and
+    // `[[subscriptions]]` checks retired with the two tables, which the
+    // document-shape preflight now refuses by name.)
     const preflightDbTypesDir = join(configDir, "database-type-configs");
     if (existsSync(preflightDbTypesDir)) {
         for (const file of selectFiles("database-type-config", preflightDbTypesDir, readdirSync(preflightDbTypesDir).filter((f) => f.endsWith(".toml")))) {
             const filePath = join(preflightDbTypesDir, file);
-            let rawToml;
-            let tomlData;
             try {
-                rawToml = readFileSync(filePath, "utf-8");
-                tomlData = parseTomlFile(filePath);
+                parseDatabaseTypeToml(parseTomlFile(filePath));
             }
             catch (err) {
                 preflightValidationErrors.push(`  ${file}: ${err?.message || String(err)}`);
-                continue;
-            }
-            let operations = [];
-            try {
-                ({ operations } = parseDatabaseTypeToml(tomlData));
-            }
-            catch (err) {
-                if (err instanceof SubscriptionAccessKeyConflictError) {
-                    preflightValidationErrors.push(`  ${file}: ${err.message}`);
-                    continue;
-                }
-                preflightValidationErrors.push(`  ${file}: ${err?.message || String(err)}`);
-                continue;
-            }
-            const validation = validateOperations({
-                filePath,
-                rawToml,
-                operations,
-            });
-            for (const e of validation.errors) {
-                preflightValidationErrors.push(`  ${formatIssue(e)}`);
-            }
-            // Issue #1422: non-fatal deprecation notice. A `celContextAccess`
-            // / `metadataAccess` gate on a database type config is a single CEL
-            // expression that gates BOTH read and update of the database CEL
-            // context — granting read implicitly grants update. Steer operators
-            // to resource metadata categories (separate readRule/writeRule).
-            // This is advisory only: the push continues and the runtime gate is
-            // unchanged. It fires only when the deprecated key is actually
-            // present, so metadata-category-only configs never trip it.
-            const typeSection = tomlData.type || {};
-            if (typeSection.celContextAccess || typeSection.metadataAccess) {
-                const usedKey = typeSection.celContextAccess
-                    ? "celContextAccess"
-                    : "metadataAccess";
-                warn(`  ${file}: \`${usedKey}\` is deprecated — it gates database CEL context READ and WRITE with one expression (read implies update). Prefer a resource metadata category with separate readRule/writeRule (issue #1420). Sync will continue; the runtime gate is unchanged.`);
             }
         }
     }
-    // #4116 — the deprecated `ruleSetId` spelling in a bucket file. Advisory
-    // only: the file pushes. Bounded by `--only`, like the notice above.
-    const preflightBucketsDir = join(configDir, "blob-buckets");
-    if (existsSync(preflightBucketsDir)) {
-        for (const file of selectFiles("blob-bucket", preflightBucketsDir, readdirSync(preflightBucketsDir).filter((f) => f.endsWith(".toml")))) {
-            let tomlData;
-            try {
-                tomlData = parseTomlFile(join(preflightBucketsDir, file));
-            }
-            catch {
-                // A file that does not parse is reported by the collector below.
-                continue;
-            }
-            const advice = blobBucketDeprecatedKeyWarning(`blob-buckets/${file}`, tomlData);
-            if (advice)
-                warn(`  ${advice}`);
-        }
-    }
     // Validate app.toml settings up-front (issue #1033). A mistyped value
     // is a hard error that must abort BEFORE any mutation — same
     // fail-before-mutate contract as the vars preflight below. The apply
@@ -2781,7 +2702,7 @@ export async function runConfigPushPreflight(input) {
                     preflightValidationErrors.push(`  ${message}`);
                 }
                 // #3320 — and everything else the file decides on its own: the
-                // `entry`, the mode the two spellings resolve to, the trigger
+                // `entry`, the retired runtime keys it refuses (#3188), the trigger
                 // rules, and a webhook trigger's signing-secret requirement and
                 // reference shape. These used to be raised inside the apply loop,
                 // after webhooks, integrations, vars and database types had
@@ -2796,19 +2717,6 @@ export async function runConfigPushPreflight(input) {
                 })) {
                     preflightValidationErrors.push(`  ${filePath}: ${message}`);
                 }
-                // #3482 — the retired runtime keys. NOT refusals through phase 4:
-                // the file pushes with every other key applied, and the author
-                // hears which line to delete before phase 5 refuses it. On
-                // stderr, like every other advisory, so a scripted push reading
-                // stdout is unaffected. Inside this loop rather than over the
-                // whole tree, so `--only` bounds the advice as it bounds the
-                // refusals (#2645).
-                for (const message of functionTomlIgnoredKeyWarnings({
-                    functionKey,
-                    tomlData,
-                })) {
-                    warn(`  ${message}`);
-                }
             }
         }
     }
@@ -2868,8 +2776,10 @@ export async function runConfigPushPreflight(input) {
             }
         }
     }
-    // #3798 — a test case on an agent is refused by the admin routes; say so
-    // here, before any other file is applied.
+    // #3798, #4262 — a prompt's sidecar against its prompt's kind: an agent's
+    // case is checked by the agent test case's shape rule, and `[test.agent]`
+    // on a chat or decisions prompt's case is refused, before any file is
+    // applied.
     for (const message of promptAgentSidecarErrors(configDir)) {
         preflightValidationErrors.push(`  ${message}`);
     }
@@ -3239,10 +3149,74 @@ export function partitionPromptFilesForPush(promptsDir, files) {
     return { beforeFunctions, afterFunctions };
 }
 /**
- * Every `prompts/<key>.tests/*.toml` sidecar whose prompt is an agent — #3798
- * (§D1: prompt test cases are refused for the kind in v1). The admin test-case
- * routes refuse the same case with `AGENT_TEST_CASE_NOT_SUPPORTED`; this says
- * so before anything is applied.
+ * The deferred agent files `config push` can still apply — #4437. An agent
+ * that names a function this push failed to apply, and that the server does
+ * not already hold, would only be refused as naming a function the app does
+ * not have. It is held back instead, with a failure that names the function as
+ * the cause; the function's own failure row says why. A file that does not
+ * parse is left for the prompt leg to report.
+ */
+export function holdAgentPromptFilesForUnappliedFunctions(promptsDir, files, unappliedFunctionKeys) {
+    const apply = [];
+    const held = [];
+    for (const file of files) {
+        let prompt;
+        try {
+            prompt = parseTomlFile(join(promptsDir, file))?.prompt;
+        }
+        catch {
+            apply.push(file);
+            continue;
+        }
+        const failed = agentDeclarationFunctionKeys(prompt?.agent).filter((key) => unappliedFunctionKeys.has(key));
+        if (failed.length === 0) {
+            apply.push(file);
+            continue;
+        }
+        const names = failed.map((key) => `"${key}"`).join(", ");
+        held.push({
+            key: prompt?.key || basename(file, ".toml"),
+            message: `[prompt.agent] names function${failed.length > 1 ? "s" : ""} ${names}, ` +
+                "which this push could not apply (see the function's failure), so the " +
+                "agent was not pushed. Fix the function and push again.",
+        });
+    }
+    return { apply, held };
+}
+/**
+ * The kind of the prompt a `prompts/<key>.tests/` sidecar belongs to, read
+ * from the prompt's own file — `undefined` for another block type, or when the
+ * file is absent or does not parse (the prompt leg reports that).
+ */
+function testCaseOwnerPromptKind(configDir, blockType, blockKey) {
+    if (blockType !== "prompt")
+        return undefined;
+    const owner = join(configDir, "prompts", `${blockKey}.toml`);
+    if (!existsSync(owner))
+        return undefined;
+    try {
+        return promptKindOf(parseTomlFile(owner)?.prompt);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** A sidecar's agent block and `expectedJsonSubset`, in wire spelling. */
+function agentTestCaseWireFields(payload) {
+    const fields = {};
+    for (const key of AGENT_TEST_CASE_FIELDS)
+        fields[key] = payload?.[key];
+    fields.expectedJsonSubset = payload?.expectedJsonSubset;
+    return fields;
+}
+/**
+ * Every `prompts/<key>.tests/*.toml` sidecar the agent test case's rule
+ * refuses — #4262 (#3798 refused every sidecar on an agent). An agent's case
+ * is checked by the vendored shape rule (`resolveAgentTestCase`), which the
+ * admin routes run too; a `[test.agent]` block on a chat or decisions
+ * prompt's case is refused by name. One line per file, naming it. What needs
+ * the app (the input, context and event schemas, the declared names) is the
+ * routes' to decide at apply.
  */
 export function promptAgentSidecarErrors(configDir) {
     const promptsDir = join(configDir, "prompts");
@@ -3252,21 +3226,25 @@ export function promptAgentSidecarErrors(configDir) {
         if (!filePath.startsWith(promptsDir) || !parent.endsWith(".tests"))
             continue;
         const key = parent.slice(0, -".tests".length);
-        const owner = join(promptsDir, `${key}.toml`);
-        if (!existsSync(owner))
+        const kind = testCaseOwnerPromptKind(configDir, "prompt", key);
+        if (kind === undefined)
             continue;
-        let tomlData;
+        let sidecar;
         try {
-            tomlData = parseTomlFile(owner);
+            sidecar = parseTomlFile(filePath);
         }
         catch {
+            // The test-case collector reports a file that does not parse.
             continue;
         }
-        if (promptKindOf(tomlData?.prompt) !== "agent")
+        const resolved = resolveAgentTestCase({
+            kind,
+            fields: agentTestCaseWireFields(parseTestCaseToml(sidecar)),
+        });
+        if (!("refusals" in resolved))
             continue;
-        const promptKey = tomlData?.prompt?.key || key;
         errors.push(`${filePath.slice(configDir.length + 1)}: ` +
-            agentTestCaseRefusal(promptKey, "subject").message);
+            resolved.refusals.map((refusal) => refusal.message).join("; "));
     }
     return errors;
 }
@@ -3339,18 +3317,12 @@ export function configFileValidationMessages(filePath, tomlData, surface, tables
     if (surface.label === "prompt") {
         messages.push(...promptKindFileErrors(filePath, tomlData));
     }
-    // #4116 — a bucket naming its rule set both ways.
-    if (surface.label === "blob-bucket") {
-        messages.push(...blobBucketFileErrors(filePath, tomlData));
-    }
     return messages;
 }
 /**
  * Whether `config pull` must rewrite a local file whatever it says (#4160):
- * `config push` would refuse it, or it spells something in a deprecated form
- * pull exists to migrate (a bucket naming its rule set by id). Keeping such a
- * file because its VALUES match would leave the tree unpushable, or the
- * deprecation unresolved, after a pull that reported success.
+ * `config push` would refuse it. Keeping such a file because its VALUES match
+ * would leave the tree unpushable after a pull that reported success.
  */
 export function pullMustRewrite(label, tomlData) {
     // A test-case sidecar is not one of the preflight's per-directory targets;
@@ -3365,7 +3337,7 @@ export function pullMustRewrite(label, tomlData) {
             return true;
         }
     }
-    return (label === "blob-bucket" && blobBucketDeprecatedKeyWarning("", tomlData) !== null);
+    return false;
 }
 export function collectConfigFileValidationErrors(configDir) {
     const found = [];
@@ -3443,35 +3415,6 @@ export function collectFunctionTomlValidationErrors(configDir) {
     }
     return found;
 }
-/**
- * The retired runtime keys every `functions/*.toml` in the tree still carries
- * — #3482, the warning half of the collector above.
- *
- * Separate from the errors because it IS separate: a file carrying one of
- * these pushes, with every other key applied, so it is not a row `config diff`
- * calls invalid. It is a line an author reads on stderr from both commands, so
- * the two keep reading identically (the #2880 symmetry the errors collector
- * exists for, applied to advice rather than refusals).
- */
-export function collectFunctionTomlIgnoredKeyWarnings(configDir) {
-    const found = [];
-    const functionsDir = join(configDir, "functions");
-    if (!existsSync(functionsDir))
-        return found;
-    for (const file of readdirSync(functionsDir).filter(isFunctionDeclarationFile)) {
-        const filePath = join(functionsDir, file);
-        let tomlData;
-        try {
-            tomlData = parseTomlFile(filePath);
-        }
-        catch {
-            continue;
-        }
-        const key = tomlData?.function?.key || basename(file, ".toml");
-        found.push(...functionTomlIgnoredKeyWarnings({ functionKey: key, tomlData }));
-    }
-    return found;
-}
 /**
  * The collectors' rows, one per diff row (#2880 symmetry, #3320).
  *
@@ -3726,26 +3669,15 @@ export function serializeWorkflow(workflow, draft, configs, logger) {
     };
     return stringifyConfigToml(data);
 }
-// Database config serialization helpers
-//
-// Native-TOML form (issue #752): when emitting a database-type config, we
-// prefer nested `[operations.definition]` tables and `[[operations.params]]`
-// rows over JSON-strings stuffed into a single field. The form is sticky
-// per file — if the existing file uses the legacy JSON-string form, we
-// preserve it so we don't generate surprise diffs. New files default to
-// native. The round-trip serializes with `smol-toml` (TOML 1.0), so
-// heterogeneous arrays emit natively (issue #1450); only shapes that TOML
-// genuinely can't represent without data loss (null / undefined / an array
-// containing null) fall back to a JSON string per field with a log message.
-//
-// Issue #666: when the type has a stored `schema` (raw TOML of `[models.*]`
-// blocks), `buildDatabaseTypeTomlData` parses + merges it into the same TOML
-// object so the result round-trips as `[models.<Name>.fields.<field>]`.
-export function serializeDatabaseType(typeConfig, operations, ruleSetIdToName, options = {}) {
+// Serialize a database type's config file: the `[type]` table, the `[models.*]`
+// blocks re-parsed from the stored `schema` (issue #666), `[triggers]` and the
+// declared-access manifest. #3189 — no `[[operations]]` or `[[subscriptions]]`:
+// both retired.
+export function serializeDatabaseType(typeConfig, ruleSetIdToName, options = {}) {
     // #2644 — name any server key this CLI version does not know, rather than
     // dropping it silently on the way into the file.
     warnUnrecognizedServerKeys(typeConfig, DATABASE_TYPE_TABLE, `database-type-configs/${typeConfig?.databaseType}.toml`, options.logger);
-    const data = buildDatabaseTypeTomlData(typeConfig, operations, ruleSetIdToName, options);
+    const data = buildDatabaseTypeTomlData(typeConfig, ruleSetIdToName);
     return stringifyConfigToml(data);
 }
 /**
@@ -3965,10 +3897,9 @@ export function dbTypeOwnedScalars(table = DATABASE_TYPE_TABLE) {
     ];
 }
 export const DB_TYPE_OWNED_SCALARS = dbTypeOwnedScalars();
-// User-facing TOML key names for the "Cleared <field>" push output. The wire
-// field differs from the key the user writes for two of them.
+// User-facing TOML key names for the "Cleared <field>" push output, for the
+// field whose wire name differs from the key the user writes.
 const DB_TYPE_FIELD_LABELS = {
-    metadataAccess: "celContextAccess",
     ruleSetId: "ruleSetName",
 };
 /** The user-facing TOML key for a wire field (for push output). */
@@ -4041,13 +3972,6 @@ export function ownedScalarsBeingCleared(updateData, serverConfig) {
  * still comes from the handler that knows what is wrong with it.
  */
 function canonicalizeDatabaseTypeConfig(typeConfig) {
-    // CEL fields: trimmed by the handler, and a whitespace-only expression is
-    // stored as none at all — which the projection reads as unset either way.
-    for (const key of ["defaultAccess", "metadataAccess"]) {
-        if (typeof typeConfig[key] === "string") {
-            typeConfig[key] = typeConfig[key].trim();
-        }
-    }
     // #750 — `"user.userId"` is shorthand for `{ value: "user.userId", on:
     // ["create"] }`, and a scalar `on` for a one-element list.
     const auto = typeConfig.autoPopulatedFields;
@@ -4094,70 +4018,15 @@ function canonicalizeDatabaseTypeConfig(typeConfig) {
         }
     }
 }
-/**
- * What this push's operation set will BE, stated to the server (issues #813,
- * #1336, #2732).
- *
- * The type-config PATCH runs its gates BEFORE the same push's operation calls,
- * so without a look-ahead every gate judges the pre-push operations: a push
- * that removes a model is blocked by the very references it is deleting. The
- * file IS the target state (config-as-code), so the claims are derived from it:
- *
- *   - `finalOpNames` — the names the type ends with. Both other claims are
- *     verified against it server-side, which is what keeps them from being a
- *     gate bypass for a direct-API caller.
- *   - `pendingOpDeletes` — its complement among the ops last sync recorded, so
- *     an op this push deletes is excluded from the schema / OPS_EXIST gates.
- *   - `pendingOpUpserts` — the post-push BODY of every declared op, so the
- *     schema-edit gate lints a rewritten op as rewritten and a model removal
- *     plus its operation rewrites lands in one push (#2732).
- *   - `pendingOpUpdates` — the rule-only form (`access`/`params`) the manifest
- *     re-lint reads (#1336).
- *
- * All four are built here and sent together, on the dry-run and on the real
- * PATCH alike. They are never conditioned on the push having a deletion: a push
- * that only REWRITES operations is exactly the case #2732 exists for.
- */
-export function buildPendingOpClaims(operations, existingOpNames) {
-    const finalOpNames = operations.map((op) => op.name);
-    const declared = new Set(finalOpNames);
-    return {
-        pendingOpDeletes: existingOpNames.filter((n) => !declared.has(n)),
-        finalOpNames,
-        pendingOpUpdates: operations.map((op) => ({
-            name: op.name,
-            access: typeof op.access === "string" ? op.access : null,
-            params: op.params ?? null,
-        })),
-        // The same body the op create/update call sends, so the gate lints what
-        // this push is about to store.
-        pendingOpUpserts: operations.map((op) => ({
-            name: op.name,
-            type: op.type,
-            modelName: op.modelName,
-            access: op.access,
-            definition: op.definition,
-            params: op.params,
-        })),
-    };
-}
 export function parseDatabaseTypeToml(tomlData) {
     const typeSection = tomlData.type || {};
     // #2644 — the `[type]` field list comes from the vendored definition, so a
     // scalar added there is read off the file with no edit here. The values the
     // handler rewrites before storing — `autoPopulatedFields` (#750), its
-    // `timestamps` sibling (#748), the CEL access expressions — are canonicalized
+    // `timestamps` sibling (#748) — are canonicalized
     // below so the comparison reads the spelling the server keeps (#2731 B1).
     const typeConfig = dropUndefined(buildPayloadFromToml(DATABASE_TYPE_TABLE, typeSection, {
         mode: "create",
-        values: {
-            // Accept both `celContextAccess` (new user-facing key, the definition's
-            // tomlKey) and `metadataAccess` (legacy, declared in `tomlOnlyKeys`).
-            // The newer key wins when both appear. Issue #1567: a defined-check,
-            // not a truthy guard, so `celContextAccess = ""` is honored as an
-            // explicit clear rather than falling through to the legacy key.
-            metadataAccess: (value, _mode, section) => value !== undefined ? value : section?.metadataAccess,
-        },
     }));
     canonicalizeDatabaseTypeConfig(typeConfig);
     // The `ruleSetName` reference; it resolves to an id later.
@@ -4196,27 +4065,11 @@ export function parseDatabaseTypeToml(tomlData) {
         }
     }
     typeConfig.schema = schemaSerialized;
-    // `normalizeOperationFromToml` accepts both forms:
-    //   - legacy: `definition = '{...}'` (JSON string), `params = '{...}'`
-    //   - native: `[operations.definition]` table, `[[operations.params]]` rows
-    // and returns the JS shape the server expects.
-    const operations = (tomlData.operations || []).map((op) => {
-        const normalized = normalizeOperationFromToml(op);
-        // #2731 B1 — the handler trims `name` before storing, and the trimmed name
-        // is half the row's key (`<databaseType>#<name>`). Comparing or sending the
-        // padded spelling names a row the server never holds: the child reconcile
-        // would read it as a different operation and plan it forever.
-        if (typeof normalized.name === "string") {
-            normalized.name = normalized.name.trim();
-        }
-        return normalized;
-    });
-    // Subscriptions (issue #803): `[[subscriptions]]` array-of-tables.
-    // `normalizeSubscriptionFromToml` maps `accessRule`→`access` (throwing on a
-    // conflicting both-present declaration) and forwards `select`/`emit`/`params`
-    // in the wire shape. Until #803 this block was dropped at parse time.
-    const subscriptions = (tomlData.subscriptions || []).map((sub) => normalizeSubscriptionFromToml(sub));
-    return { typeConfig, operations, subscriptions };
+    // #3189 — `[[operations]]` and `[[subscriptions]]` retired with database
+    // operations and type-scoped subscriptions. The preflight refuses a file
+    // that still carries either (`RETIRED_DOCUMENT_KEYS`), so nothing here reads
+    // them.
+    return { typeConfig };
 }
 /**
  * The parsed shape of a rule-set TOML: the definition's fields plus the
@@ -5001,12 +4854,11 @@ const CONFIG_DIFF_SPECS = {
                 keys.push("name");
             if (!bucket.preset)
                 keys.push("preset");
-            // Either spelling manages the rule set (#4116) — read as the parse reads
-            // it, so a blank name is no reference rather than a difference the
-            // update cannot carry.
+            // A name manages the rule set (#4116) — read as the parse reads it, so a
+            // blank name is no reference rather than a difference the update cannot
+            // carry. The retired id spelling (#4283) manages nothing.
             const named = typeof bucket.ruleSetName === "string" && bucket.ruleSetName.trim() !== "";
-            const legacy = typeof bucket.ruleSetId === "string" && bucket.ruleSetId !== "";
-            if (!named && !legacy)
+            if (!named)
                 keys.push("ruleSetId");
             return keys;
         },
@@ -5045,29 +4897,17 @@ const CONFIG_DIFF_SPECS = {
     "database-type-config": {
         label: "database-type-config",
         table: DATABASE_TYPE_TABLE,
-        parse: (doc) => {
-            const { typeConfig, operations, subscriptions } = parseDatabaseTypeToml(doc);
-            // The three sub-trees ride ON the type config, so they travel with it and
-            // are pulled back out as extras below.
-            typeConfig.__operations = operations;
-            typeConfig.__subscriptions = subscriptions;
-            return typeConfig;
-        },
-        serialize: (record, maps, extra) => serializeDatabaseType(record, extra?.operations ?? [], maps.ruleSetIdToName, {
-            defaultForm: "native",
-            subscriptions: extra?.subscriptions ?? [],
-        }),
+        parse: (doc) => parseDatabaseTypeToml(doc).typeConfig,
+        serialize: (record, maps) => serializeDatabaseType(record, maps.ruleSetIdToName),
         extras: (entity) => ({
             // Structural, per the definition: the `[models.*]` schema, the
-            // `[triggers]` tree, the manifest, and the two sibling models.
+            // `[triggers]` tree and the manifest. (#3189 — the operation and
+            // subscription rows that used to ride beside them are retired.)
             schema: entity.schema ?? null,
             triggers: entity.triggers ?? null,
             metadataManifest: entity.metadataManifest ?? null,
-            operations: byKey(entity.__operations, "name"),
-            subscriptions: byKey(entity.__subscriptions, "subscriptionKey"),
             _unresolvedRuleSetName: entity._unresolvedRuleSetName,
         }),
-        childKeys: { operations: "name", subscriptions: "subscriptionKey" },
         tomlFields: ["schema"],
         ruleSetRef: true,
         describe: (entity) => `database type "${entity?.databaseType}"`,
@@ -5406,36 +5246,6 @@ export function withDerivedIdentity(doc, tomlPath, identity) {
 export function resolveExistingId(input) {
     return input.liveOk ? input.liveId : input.manifestId;
 }
-/**
- * Which CHILD rows a database type's push reconciles against (#2731 B3).
- *
- * `resolveExistingId` answers this for a whole entity; a database type's
- * operations and subscriptions are rows with the same question and the same
- * two possible answers. The manifest can name an operation the server no
- * longer has (the update PUTs a row that is gone) and be silent about one it
- * does have (the create POSTs a duplicate key) — both abort the push with a
- * server error, which is exactly the recovery `--force` is supposed to
- * perform.
- *
- * When the reconcile read the rows, they ARE the baseline: existence, the
- * timestamp each update guards with, and — as the complement of the file's own
- * list — which rows this push deletes. `undefined` means the read did not
- * happen (the degraded path, or a type live state says is absent), and the
- * manifest stays what it has always been.
- */
-export function liveChildBaseline(live, manifestChildren) {
-    if (!live)
-        return undefined;
-    const baseline = {};
-    for (const [key, row] of live) {
-        baseline[key] = {
-            // The live timestamp is the one an update guards with; the manifest's is
-            // a stand-in only for a row the listing returned without one.
-            modifiedAt: row?.modifiedAt || manifestChildren?.[key]?.modifiedAt || "",
-        };
-    }
-    return baseline;
-}
 /**
  * The app's live rule sets, indexed the three ways push reads them (#2731 B3).
  *
@@ -5974,6 +5784,17 @@ function testCaseSidecarTable(testCase, lookupMaps, unresolvedSpelling) {
         expectedOutputPattern: (record) => record.expectedOutputPattern || "",
         expectedOutputContains: (record) => jsonFieldText(record.expectedOutputContains, "[]"),
         expectedJsonSubset: (record) => jsonFieldText(record.expectedJsonSubset, "{}"),
+        // #4262 — `[test.agent]`, written only when a key is set, so a chat case's
+        // sidecar is the one it always was. The history is the text the author
+        // pushed; the two JSON fields come back parsed and are written as text.
+        agentHistory: (record) => agentJsonText(record.agentHistory),
+        agentContext: (record) => agentJsonText(record.agentContext),
+        agentTimezone: (record) => record.agentTimezone || undefined,
+        agentLocale: (record) => record.agentLocale || undefined,
+        agentExpectedToolCall: (record) => agentJsonText(record.agentExpectedToolCall),
+        agentExpectedNoToolCall: (record) => typeof record.agentExpectedNoToolCall === "boolean"
+            ? record.agentExpectedNoToolCall
+            : undefined,
     });
     return { test, unresolved };
 }
@@ -6028,6 +5849,38 @@ function jsonFieldText(value, empty) {
         return empty;
     }
 }
+/**
+ * #4262 — an agent block field as the sidecar's JSON text, or `undefined`
+ * (omitted) when unset: `[test.agent]` has no empty spellings.
+ */
+function agentJsonText(value) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (typeof value === "string")
+        return value === "" ? undefined : value;
+    try {
+        return JSON.stringify(value);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * #4262 — an agent block JSON field on the wire: parsed when the text parses,
+ * the text itself otherwise (the shape rule names it), `undefined` when unset.
+ */
+function agentJsonWireValue(value) {
+    if (value === undefined || value === null || value === "")
+        return undefined;
+    if (typeof value !== "string")
+        return value;
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return value;
+    }
+}
 export function parseTestCaseToml(tomlData) {
     const test = tomlData.test || {};
     /** A JSON-string TOML value, or `undefined` when it is absent/the default. */
@@ -6068,6 +5921,15 @@ export function parseTestCaseToml(tomlData) {
             expectedOutputPattern: (value) => (value ? value : undefined),
             expectedOutputContains: (value) => parseJsonText(value, ["[]"]),
             expectedJsonSubset: (value) => parseJsonText(value, ["{}"]),
+            // #4262 — `[test.agent]`. The history travels as the JSON text it is
+            // authored as; context and expectedToolCall travel parsed; `false` is a
+            // value, not an absence.
+            agentHistory: (value) => (value === "" ? undefined : value),
+            agentContext: (value) => agentJsonWireValue(value),
+            agentTimezone: (value) => (value === "" ? undefined : value),
+            agentLocale: (value) => (value === "" ? undefined : value),
+            agentExpectedToolCall: (value) => agentJsonWireValue(value),
+            agentExpectedNoToolCall: (value) => value,
         },
     });
     // An omitted field must be absent from the body, not present-and-undefined:
@@ -7293,6 +7155,15 @@ export async function pushTestCasesForBlock(params) {
                 evaluatorPromptId: testPayload.evaluatorPromptId ?? null,
                 evaluatorConfigId: testPayload.evaluatorConfigId ?? null,
             };
+            // #4262 — an agent prompt's case carries its `[test.agent]` block as
+            // full state too: a key the file no longer sets goes as `null`, so
+            // removing an assertion clears it. A chat or decisions prompt's case
+            // sends none, so its body is the one it always was.
+            if (testCaseOwnerPromptKind(configDir, blockType, blockKey) === "agent") {
+                for (const key of AGENT_TEST_CASE_FIELDS) {
+                    updatePayload[key] = testPayload[key] ?? null;
+                }
+            }
             // #2896 — the identity travels with the content: this is the lazy
             // migration of a legacy case and the second half of a rename.
             if (pendingKey !== undefined)
@@ -8318,30 +8189,10 @@ export function registerConfigSyncCommands(sync) {
             const metadataCategoryConfigsResult = metadataCategoryConfigsOutcome.ok
                 ? metadataCategoryConfigsOutcome.value
                 : [];
-            // Fetch operations + subscriptions for each database type. Issue #803:
-            // subscriptions are pulled symmetrically with operations so a
-            // pull → push cycle round-trips `[[subscriptions]]` blocks without a
-            // spurious diff. The list endpoint already excludes archived rows.
-            //
-            // A failed operation/subscription fetch also disqualifies the type from
-            // pruning (#1659): the file we write for it is then incomplete, so the
-            // pull's picture of that type is not one to reconcile against.
-            let databaseTypeDetailsOk = true;
-            const databaseTypesWithOps = await Promise.all(selectPull("database-type-config", Array.isArray(databaseTypeConfigsResult) ? databaseTypeConfigsResult : [], (t) => t.databaseType).map(async (typeConfig) => {
-                const [opsOutcome, subsOutcome] = await Promise.all([
-                    attemptFetch(() => client.listDatabaseTypeOperations(resolvedAppId, typeConfig.databaseType)),
-                    attemptFetch(() => client.listDatabaseTypeSubscriptions(resolvedAppId, typeConfig.databaseType)),
-                ]);
-                if (!opsOutcome.ok || !subsOutcome.ok)
-                    databaseTypeDetailsOk = false;
-                const ops = opsOutcome.ok ? opsOutcome.value : [];
-                const subs = subsOutcome.ok ? subsOutcome.value : [];
-                return {
-                    typeConfig,
-                    operations: Array.isArray(ops) ? ops : [],
-                    subscriptions: Array.isArray(subs) ? subs : [],
-                };
-            }));
+            // #3189 — a database type's file is its type config alone: the
+            // operations and subscriptions that used to be fetched beside it are
+            // retired, so there is nothing more to read per type.
+            const databaseTypesToWrite = selectPull("database-type-config", Array.isArray(databaseTypeConfigsResult) ? databaseTypeConfigsResult : [], (t) => t.databaseType);
             // Snapshot the pre-pull sync tree BEFORE we touch any local file
             // (issue #578, Phase 1). All server data has been fetched and
             // validated at this point — a failed pull already threw above, so we
@@ -8937,46 +8788,16 @@ export function registerConfigSyncCommands(sync) {
             const ruleSets = selectPull("rule-set", Array.isArray(ruleSetsResult) ? ruleSetsResult : [], (rs) => ruleSetFileKey(rs));
             // Write database types
             const databaseTypeEntities = {};
-            for (const { typeConfig, operations, subscriptions } of databaseTypesWithOps) {
+            for (const typeConfig of databaseTypesToWrite) {
                 const filename = `${typeConfig.databaseType}.toml`;
                 const filePath = join(configDir, "database-type-configs", filename);
-                // Preserve the existing file's per-op form (issue #752): if the
-                // file already exists, read it raw and detect which operations
-                // currently use JSON-string vs native nested-table form.
-                const hints = existsSync(filePath)
-                    ? detectExistingOperationForms(readFileSync(filePath, "utf-8"))
-                    : undefined;
-                const content = serializeDatabaseType(typeConfig, operations, ruleSetIdToName, {
-                    hints,
-                    defaultForm: "native",
+                const content = serializeDatabaseType(typeConfig, ruleSetIdToName, {
                     logger: (msg) => info(`  ${msg}`),
-                    // Issue #803: emit `[[subscriptions]]` blocks so a pull → push
-                    // cycle round-trips subscriptions without a spurious diff.
-                    subscriptions,
                 });
                 const written = writePulledFile(filePath, content, pullWrites, sameConfigAs("database-type-config", content, filePath, pullDiffMaps));
-                const opsEntities = {};
-                for (const op of operations) {
-                    opsEntities[op.name] = {
-                        modifiedAt: op.modifiedAt || new Date().toISOString(),
-                    };
-                }
-                // Track per-subscription modifiedAt in SyncState (issue #803),
-                // exactly like operations, so the next push skips unchanged
-                // subscriptions and detects removals.
-                const subsEntities = {};
-                for (const sub of subscriptions || []) {
-                    if (!sub?.subscriptionKey)
-                        continue;
-                    subsEntities[sub.subscriptionKey] = {
-                        modifiedAt: sub.modifiedAt || new Date().toISOString(),
-                    };
-                }
                 databaseTypeEntities[typeConfig.databaseType] = {
                     databaseType: typeConfig.databaseType,
                     modifiedAt: typeConfig.modifiedAt || new Date().toISOString(),
-                    operations: Object.keys(opsEntities).length > 0 ? opsEntities : undefined,
-                    subscriptions: Object.keys(subsEntities).length > 0 ? subsEntities : undefined,
                     contentHash: computeFileHash(filePath),
                     semanticHash: pulledSemanticHash("database-type-config", content, pullDiffMaps),
                     hasSchema: typeof typeConfig.schema === "string" &&
@@ -9101,8 +8922,8 @@ export function registerConfigSyncCommands(sync) {
                 scripts: scriptPresence,
                 functions: functionPresence,
                 emailTemplates: emailTemplatePresence,
-                databaseTypes: databaseTypeConfigsOutcome.ok && databaseTypeDetailsOk
-                    ? { ok: true, serverKeys: databaseTypesWithOps.map((d) => d.typeConfig.databaseType) }
+                databaseTypes: databaseTypeConfigsOutcome.ok
+                    ? { ok: true, serverKeys: databaseTypesToWrite.map((t) => t.databaseType) }
                     : { ok: false },
                 ruleSets: ruleSetsOutcome.ok
                     ? { ok: true, serverKeys: ruleSets.map((rs) => ruleSetFileKey(rs)) }
@@ -9462,7 +9283,7 @@ export function registerConfigSyncCommands(sync) {
             if (unwrittenTestCases > 0) {
                 keyValue("Test Cases not written", unwrittenTestCases);
             }
-            keyValue("Database Types", databaseTypesWithOps.length);
+            keyValue("Database Types", databaseTypesToWrite.length);
             keyValue("Rule Sets", ruleSets.length);
             keyValue("Group Type Configs", groupTypeConfigs.length);
             keyValue("Collection Type Configs", collectionTypeConfigs.length);
@@ -11784,16 +11605,6 @@ What a push guarantees (two stages):
                     catch (err) {
                         throw new Error(`${filePath}: ${err.message}`);
                     }
-                    // #2652 — a prompt with no rule denies every non-admin execution.
-                    // Warn per file so an operator pushing an unmigrated app can see
-                    // exactly which prompts are locked down and how to open them.
-                    const promptRuleWarning = missingAccessRuleWarning({
-                        kind: "prompt",
-                        key,
-                        accessRule: prompt.accessRule,
-                    });
-                    if (promptRuleWarning)
-                        warn(`  ${promptRuleWarning}`);
                     const existingEntry = syncState?.entities?.prompts?.[key];
                     const livePromptId = livePromptIds.get(key);
                     // A detail read that fails degrades THIS prompt to the byte-hash
@@ -12808,7 +12619,6 @@ What a push guarantees (two stages):
                     // start from this release onward. A `runAs = "system"` workflow is
                     // exempt (it rejects rules and members cannot start it).
                     const workflowRuleWarning = missingAccessRuleWarning({
-                        kind: "workflow",
                         key,
                         accessRule: workflow.accessRule,
                         runAs: workflow.runAs,
@@ -13260,12 +13070,11 @@ What a push guarantees (two stages):
             const dbTypesDir = join(configDir, "database-type-configs");
             if (existsSync(dbTypesDir)) {
                 const files = selectFiles("database-type-config", dbTypesDir, readdirSync(dbTypesDir).filter((f) => f.endsWith(".toml")));
-                // #2731 B3 — live reconcile for the FILE-LEVEL gate only. The
-                // per-operation and per-subscription machinery below (the #813
-                // validate-first pass, #915 hash clearing, #803 post-ops refresh) is
-                // untouched; this just replaces the byte-hash short-circuit in front
-                // of it. Like `config diff`, the comparison also needs the rule-set
-                // id→name map, so a failed rule-set fetch degrades this type too.
+                // #2731 B3 — live reconcile for the FILE-LEVEL gate. Like `config
+                // diff`, the comparison also needs the rule-set id→name map, so a
+                // failed rule-set fetch degrades this type too. (#3189 — a type's
+                // file is its config alone; the operation and subscription rows the
+                // gate used to read beside it are retired.)
                 const databaseTypeSpec = configDiffSpec("database-type-config");
                 const liveDatabaseTypes = new Map();
                 let databaseTypesLiveOk = (await loadLiveRuleSets()).ok;
@@ -13287,28 +13096,8 @@ What a push guarantees (two stages):
                 }
                 for (const file of files) {
                     const filePath = join(dbTypesDir, file);
-                    const rawToml = readFileSync(filePath, "utf-8");
                     const tomlData = parseTomlFile(filePath);
-                    let typeConfig;
-                    let operations;
-                    let subscriptions;
-                    try {
-                        ({ typeConfig, operations, subscriptions } =
-                            parseDatabaseTypeToml(tomlData));
-                    }
-                    catch (err) {
-                        // The only structured parse error today is the
-                        // `accessRule`/`access` conflict in a `[[subscriptions]]` block
-                        // (issue #803). Surface it with the file name and abort the
-                        // push rather than crashing with an opaque stack.
-                        if (err instanceof SubscriptionAccessKeyConflictError) {
-                            // Issue #976: throw (not `process.exit`) so the save-on-failure
-                            // catch is the only exit path. Validation is also front-loaded
-                            // above, so this is defense-in-depth.
-                            throw new Error(`  ${file}: ${err.message}\nAborting push: subscription \`access\`/\`accessRule\` conflict in ${file}.`);
-                        }
-                        throw err;
-                    }
+                    const { typeConfig } = parseDatabaseTypeToml(tomlData);
                     const dbType = typeConfig.databaseType || basename(file, ".toml");
                     // The gate re-parses this document, so the name-derived identity
                     // has to be in it (see `withDerivedIdentity`).
@@ -13317,63 +13106,21 @@ What a push guarantees (two stages):
                     resolveRuleSetReference(typeConfig, ruleSetNameToId, `database type ${dbType}`, {
                         hint: ruleSetSelectionHint,
                     });
-                    // $params validator (issue #752): every `$params.X` reference
-                    // inside `definition` must correspond to a declared param in
-                    // `[[operations.params]]`. Catches typos like `$params.proectId`
-                    // at push time with the TOML file:line of the offending op block.
-                    const validation = validateOperations({
-                        filePath,
-                        rawToml,
-                        operations,
-                    });
-                    for (const w of validation.warnings) {
-                        warn(`  ${formatIssue(w)}`);
-                    }
-                    if (validation.errors.length > 0) {
-                        // Issue #976: throw (not `process.exit`) so the save-on-failure
-                        // catch is the only exit path. Validation is also front-loaded
-                        // above, so this is defense-in-depth.
-                        throw new Error(validation.errors.map((e) => `  ${formatIssue(e)}`).join("\n") +
-                            `\nAborting push: ${validation.errors.length} unresolved $params reference(s) in ${file}.`);
-                    }
                     const existingEntry = syncState?.entities?.databaseTypes?.[dbType];
                     /**
-                     * This type as the server holds it NOW — header, operations and
-                     * subscriptions, which the comparison treats as one unit.
+                     * This type as the server holds it NOW.
                      *
                      * Two callers: the baseline stamped after everything this file
                      * writes has landed (B4), and the report for a 409 that arrived
                      * after the reconcile fetch (B5).
                      */
                     const refetchLiveDatabaseType = async () => {
-                        const [record, ops, subs] = await Promise.all([
-                            client.getDatabaseTypeConfig(resolvedAppId, dbType),
-                            client.listDatabaseTypeOperations(resolvedAppId, dbType),
-                            client.listDatabaseTypeSubscriptions(resolvedAppId, dbType),
-                        ]);
-                        return record
-                            ? {
-                                record,
-                                extra: {
-                                    operations: Array.isArray(ops) ? ops : [],
-                                    subscriptions: Array.isArray(subs) ? subs : [],
-                                },
-                            }
-                            : null;
+                        const record = await client.getDatabaseTypeConfig(resolvedAppId, dbType);
+                        return record ? { record, extra: {} } : null;
                     };
-                    // Issue #915 (defect b): track whether the apply path rejected any
-                    // op for THIS file via the schema gate (OperationRefError /
-                    // SchemaRequiredError). On a non-transactional fresh-type push the
-                    // db-type lands but the bad op is blocked and the loop continues; if
-                    // we then wrote the file-level contentHash, the next push's
-                    // `shouldPushFile` would short-circuit and the missing op would be
-                    // invisible drift. When this flag is set we skip the contentHash
-                    // write so the drift stays visible and a corrected re-push converges.
-                    let fileHadGateRejectedOp = false;
                     // #2731 B4: a 409 means the write was REJECTED, so this file did
-                    // not land either. Tracked like a gate-rejected op so the baseline
-                    // stamp below cannot claim convergence for content the server
-                    // refused — a baseline that lied would make the next push read the
+                    // not land. Tracked so the baseline stamp below cannot claim
+                    // convergence for content the server refused — a baseline that lied would make the next push read the
                     // still-unapplied local edit as server drift and refuse to retry.
                     let fileHadConflict = false;
                     const liveDatabaseType = databaseTypesLiveOk
@@ -13386,9 +13133,6 @@ What a push guarantees (two stages):
                     const typeExistsOnServer = databaseTypesLiveOk
                         ? !!liveDatabaseType
                         : !!existingEntry;
-                    /** Live operations/subscriptions, keyed by name, when read. */
-                    let liveOpsByName;
-                    let liveSubsByName;
                     let dbTypeGate;
                     if (databaseTypesLiveOk && !liveDatabaseType) {
                         // The listing succeeded and this type is not in it. That is a
@@ -13397,87 +13141,47 @@ What a push guarantees (two stages):
                         dbTypeGate = { action: "create" };
                     }
                     else if (databaseTypesLiveOk && liveDatabaseType) {
-                        // The file carries its operations and subscriptions, so the
-                        // comparison fetches them too — an op-only or subscription-only
-                        // edit must not read as unchanged. A failure on either degrades
-                        // this one type to the byte-hash gate.
-                        let liveOps = null;
-                        let liveSubs = null;
-                        try {
-                            [liveOps, liveSubs] = await Promise.all([
-                                client.listDatabaseTypeOperations(resolvedAppId, dbType),
-                                client.listDatabaseTypeSubscriptions(resolvedAppId, dbType),
-                            ]);
-                        }
-                        catch (err) {
-                            warnLiveUnavailable(`database-type-config ${dbType}`, err);
-                        }
-                        if (liveOps && liveSubs) {
-                            liveOpsByName = new Map((Array.isArray(liveOps) ? liveOps : [])
-                                .filter((op) => op?.name)
-                                .map((op) => [op.name, op]));
-                            liveSubsByName = new Map((Array.isArray(liveSubs) ? liveSubs : [])
-                                .filter((sub) => sub?.subscriptionKey)
-                                .map((sub) => [sub.subscriptionKey, sub]));
-                            dbTypeGate = decidePushForConfig({
-                                spec: databaseTypeSpec,
-                                maps: pushDiffMaps,
-                                localParsed: tomlData,
-                                live: {
-                                    record: liveDatabaseType,
-                                    extra: {
-                                        operations: Array.isArray(liveOps) ? liveOps : [],
-                                        subscriptions: Array.isArray(liveSubs) ? liveSubs : [],
-                                    },
-                                    modifiedAt: liveDatabaseType.modifiedAt,
-                                },
-                                entry: existingEntry,
-                                localFileHash: computeFileHash(filePath),
-                                force: options.force,
-                            });
-                            if (dbTypeGate.action === "skip") {
-                                skippedCount++;
-                                if (syncState) {
-                                    // Written even when the manifest has never seen this type:
-                                    // an adopt that records nothing is repeated on every push,
-                                    // and its next local edit would have no baseline (and no
-                                    // op/subscription rows) to reconcile against.
-                                    if (!syncState.entities.databaseTypes) {
-                                        syncState.entities.databaseTypes = {};
-                                    }
-                                    const opsEntities = {};
-                                    for (const [opName, op] of liveOpsByName ?? []) {
-                                        opsEntities[opName] = {
-                                            modifiedAt: op?.modifiedAt || new Date().toISOString(),
-                                        };
-                                    }
-                                    const subsEntities = {};
-                                    for (const [subKey, sub] of liveSubsByName ?? []) {
-                                        subsEntities[subKey] = {
-                                            modifiedAt: sub?.modifiedAt || new Date().toISOString(),
-                                        };
-                                    }
-                                    syncState.entities.databaseTypes[dbType] = {
-                                        databaseType: dbType,
-                                        modifiedAt: liveDatabaseType.modifiedAt ||
-                                            existingEntry?.modifiedAt ||
-                                            new Date().toISOString(),
-                                        operations: Object.keys(opsEntities).length > 0 ? opsEntities : undefined,
-                                        subscriptions: Object.keys(subsEntities).length > 0 ? subsEntities : undefined,
-                                        contentHash: computeFileHash(filePath),
-                                        semanticHash: dbTypeGate.remoteHash,
-                                        hasSchema: typeof liveDatabaseType.schema === "string" &&
-                                            liveDatabaseType.schema.trim().length > 0,
-                                    };
+                        dbTypeGate = decidePushForConfig({
+                            spec: databaseTypeSpec,
+                            maps: pushDiffMaps,
+                            localParsed: tomlData,
+                            live: {
+                                record: liveDatabaseType,
+                                extra: {},
+                                modifiedAt: liveDatabaseType.modifiedAt,
+                            },
+                            entry: existingEntry,
+                            localFileHash: computeFileHash(filePath),
+                            force: options.force,
+                        });
+                        if (dbTypeGate.action === "skip") {
+                            skippedCount++;
+                            if (syncState) {
+                                // Written even when the manifest has never seen this type:
+                                // an adopt that records nothing is repeated on every push,
+                                // and its next local edit would have no baseline to
+                                // reconcile against.
+                                if (!syncState.entities.databaseTypes) {
+                                    syncState.entities.databaseTypes = {};
                                 }
-                                continue;
-                            }
-                            if (dbTypeGate.action === "drift" ||
-                                dbTypeGate.action === "conflict" ||
-                                dbTypeGate.action === "immutable") {
-                                recordDeclined("database-type-config", dbType, dbTypeGate, existingEntry?.modifiedAt);
-                                continue;
+                                syncState.entities.databaseTypes[dbType] = {
+                                    databaseType: dbType,
+                                    modifiedAt: liveDatabaseType.modifiedAt ||
+                                        existingEntry?.modifiedAt ||
+                                        new Date().toISOString(),
+                                    contentHash: computeFileHash(filePath),
+                                    semanticHash: dbTypeGate.remoteHash,
+                                    hasSchema: typeof liveDatabaseType.schema === "string" &&
+                                        liveDatabaseType.schema.trim().length > 0,
+                                };
                             }
+                            continue;
+                        }
+                        if (dbTypeGate.action === "drift" ||
+                            dbTypeGate.action === "conflict" ||
+                            dbTypeGate.action === "immutable") {
+                            recordDeclined("database-type-config", dbType, dbTypeGate, existingEntry?.modifiedAt);
+                            continue;
                         }
                     }
                     // Fallback gate: the manifest byte hash — and, since #2880, a
@@ -13497,26 +13201,6 @@ What a push guarantees (two stages):
                             continue;
                         }
                     }
-                    // ── Issues #813 / #1336 / #2732: state what this push's operation
-                    // set will BE, then run a validate-first pass before any mutating
-                    // call for this type. The type-config PATCH gates run ahead of the
-                    // operation calls, so the claims are what let them judge the
-                    // post-push state (see `buildPendingOpClaims`). ──
-                    // The op rows the server holds (#2731). When the reconcile read
-                    // them, they ARE the inventory (`liveChildBaseline`): an op created
-                    // out-of-band is UPDATEd rather than POSTed into a duplicate-key
-                    // failure, and one deleted out-of-band is re-CREATEd rather than
-                    // PATCHed at a row that is gone — and the claims' delete complement
-                    // is computed against that live inventory, not the manifest's. When
-                    // live state says the TYPE is gone, its ops went with it — so the
-                    // manifest's op list is not a baseline either, and this push
-                    // creates them alongside the re-created type. Only the degraded
-                    // path still reads the manifest, where it is what the byte-hash
-                    // gate has always used.
-                    const existingOpsForType = liveChildBaseline(liveOpsByName, existingEntry?.operations) ??
-                        ((typeExistsOnServer ? existingEntry?.operations : undefined) || {});
-                    const pendingOpClaims = buildPendingOpClaims(operations, Object.keys(existingOpsForType));
-                    const { pendingOpDeletes } = pendingOpClaims;
                     // Whether the SERVER holds a schema right now. Live state answers
                     // when it was read (so an adopted type's schema is not silently
                     // preserved by an omitted key); the manifest's `hasSchema` is the
@@ -13575,8 +13259,9 @@ What a push guarantees (two stages):
                     // declares an owned scalar (matches the pre-#1567 PATCH trigger), a
                     // schema set/delete is in the payload, or an owned scalar is being
                     // cleared. When false, the type-config PATCH is skipped entirely so
-                    // an operations-only edit does not spuriously report the type as
-                    // "Updated" (issue #369 regression) and no idle clear-report fires.
+                    // an edit with no type-level effect does not spuriously report the
+                    // type as "Updated" (issue #369 regression) and no idle
+                    // clear-report fires.
                     const declaresOwnedField = DB_TYPE_OWNED_SCALARS.some((k) => k in typeConfig);
                     const schemaInUpdateData = "schema" in computeTypeUpdateData();
                     const typeLevelChange = declaresOwnedField ||
@@ -13588,19 +13273,12 @@ What a push guarantees (two stages):
                             info(`  ${prefix}${dbTypeFieldLabel(key)} on ${dbType}`);
                         }
                     };
-                    // Validate-first pass (decision 4a): run every gate for this type
-                    // BEFORE issuing any mutating call. If a gate fails, the whole
-                    // type's mutating calls (op creates/updates/deletes AND the schema
-                    // PATCH) are skipped — eliminating the gate-failure partial commit.
-                    // The same pass IS the dry-run path for `config push --dry-run`:
-                    // it runs the real server gates without persisting (Option 1A).
+                    // Validate-first pass (decision 4a): run the type's gates BEFORE
+                    // issuing any mutating call. If a gate fails, the type's mutating
+                    // calls are skipped. The same pass IS the dry-run path for
+                    // `config push --dry-run`: it runs the real server gates without
+                    // persisting (Option 1A).
                     let typeGateBlocked = false;
-                    // Issue #684 regression guard: track which op the op-edit gate is
-                    // dry-running so an unrecognized server error (e.g. a plain
-                    // validation 400 like `"limit" must be 1000 or less`) can be
-                    // attributed to that specific operation in the catch-all below,
-                    // instead of being coarsened to the db-type level.
-                    let opGateContext = null;
                     // #2731 B4 — the concurrency guard is the LIVE timestamp the
                     // reconcile fetch just read (the gate carries it), not the
                     // manifest's, which can be arbitrarily stale and 409 on a write
@@ -13612,54 +13290,28 @@ What a push guarantees (two stages):
                     const validateExpectedModifiedAt = options.force
                         ? undefined
                         : dbTypeExpectedModifiedAt;
-                    // Issue #1336 (codex round-1 P1/P2): the declared-access manifest
-                    // this push proposes (the parsed object, or null when the type
-                    // declares none / is clearing it). Forwarded as
-                    // `metadataManifestOverride` on the op dry-runs so op-access lints
-                    // run against the manifest the same push is landing, not the stale
-                    // stored one (existing type: a newly-declared key is honored; fresh
-                    // type: an undeclared ref is caught instead of skipped).
-                    const proposedManifest = typeConfig.metadataManifest ??
-                        null;
                     try {
-                        // 1. Schema-edit gate (type-config PATCH dry-run) — only when the
-                        //    type already exists on the server and we'd actually PATCH a
-                        //    type-level field. A fresh type has no ops to break, so
-                        //    there's nothing to gate yet. #2731 B3: "already exists" is
-                        //    live state's answer, so a type the manifest still names but
-                        //    the server no longer has dry-runs its CREATE, not a PATCH.
-                        //    Issue #1567: `computeTypeUpdateData` now always returns the
-                        //    owned scalars, so gate on `typeLevelChange` (a genuine
-                        //    declared/schema/clear change) rather than "payload
-                        //    non-empty" — an operations-only edit must not run the
-                        //    type-config dry-run at all.
+                        // The type-config PATCH dry-run — only when the type already
+                        // exists on the server and we'd actually PATCH a type-level
+                        // field. #2731 B3: "already exists" is live state's answer, so a
+                        // type the manifest still names but the server no longer has
+                        // dry-runs its CREATE, not a PATCH.
                         if (typeExistsOnServer && typeLevelChange) {
-                            const validateUpdateData = computeTypeUpdateData();
-                            await client.updateDatabaseTypeConfig(resolvedAppId, dbType, 
-                            // Forward the whole look-ahead (#813 / #1336 / #2732) so the
-                            // dry-run gates judge the post-push operation set — the same
-                            // payload the mutating PATCH below sends.
-                            { ...validateUpdateData, ...pendingOpClaims }, validateExpectedModifiedAt, {
+                            await client.updateDatabaseTypeConfig(resolvedAppId, dbType, computeTypeUpdateData(), validateExpectedModifiedAt, {
                                 dryRun: true,
                                 acceptWarnings: !!options.acceptWarnings,
                             });
                         }
                         else if (!typeExistsOnServer) {
                             // Fresh type: run the config CREATE dry-run (issue #1336, codex
-                            // round-1 P2). Before this, a brand-new type's inline config
-                            // rules (`defaultAccess`, `metadataAccess`, autoPopulatedFields,
-                            // triggers) and its manifest were never dry-run — a malformed
-                            // rule reported a clean `config push --dry-run` then failed only on
-                            // the real POST. Mirror the apply-path create payload below.
+                            // round-1 P2), so a malformed inline rule (autoPopulatedFields,
+                            // triggers) or manifest fails `config push --dry-run` as the
+                            // real POST would. Mirrors the apply-path create payload below.
                             const createDryRunData = { databaseType: dbType };
                             if (typeConfig.ruleSetId)
                                 createDryRunData.ruleSetId = typeConfig.ruleSetId;
                             if (typeConfig.triggers)
                                 createDryRunData.triggers = typeConfig.triggers;
-                            if (typeConfig.metadataAccess)
-                                createDryRunData.metadataAccess = typeConfig.metadataAccess;
-                            if (typeConfig.defaultAccess)
-                                createDryRunData.defaultAccess = typeConfig.defaultAccess;
                             if (typeConfig.autoPopulatedFields)
                                 createDryRunData.autoPopulatedFields =
                                     typeConfig.autoPopulatedFields;
@@ -13682,175 +13334,12 @@ What a push guarantees (two stages):
                                     throw createErr;
                             }
                         }
-                        // 2. Op-edit gate (op create/update dry-run) for every op in the
-                        //    TOML. The server runs `runSchemaGate` and short-circuits
-                        //    before persisting.
-                        //
-                        //    The op gate is run against the schema THIS push is landing
-                        //    (`schemaOverride`), not the stale stored schema — the real
-                        //    apply path PATCHes the schema before creating/updating ops,
-                        //    so an op that depends on a field this push adds must NOT be
-                        //    falsely rejected (plan edge case: "op create that depends on
-                        //    a schema landed earlier in the same push"). When the push
-                        //    isn't changing the schema, leave the override unset so the
-                        //    server uses the stored schema.
-                        //
-                        //    Issue #915 (defect a): this gate now runs for FRESH types too
-                        //    (previously guarded by `if (existingEntry)`). For a brand-new
-                        //    db-type the server has no stored config, so we gate the op
-                        //    against the PROPOSED local schema via `schemaOverride`. The
-                        //    server's op-create dry-run accepts a missing type when a
-                        //    `schemaOverride` is present (see
-                        //    database-type-operations-controller.ts). A fresh schemaless
-                        //    type (#666 bootstrap) sends an empty/absent override, and
-                        //    `runSchemaGate` is a no-op without a schema — so that path
-                        //    still succeeds.
-                        {
-                            const localHasSchema = typeof typeConfig.schema === "string" &&
-                                typeConfig.schema.trim().length > 0;
-                            let proposedSchema;
-                            if (typeExistsOnServer) {
-                                const validateUpdateData = computeTypeUpdateData();
-                                proposedSchema =
-                                    "schema" in validateUpdateData
-                                        ? validateUpdateData.schema
-                                        : undefined;
-                            }
-                            else {
-                                // Fresh type: the proposed schema is whatever the local TOML
-                                // declares. A schemaless fresh type (no `[models.*]`) sends an
-                                // empty-string override so the server takes the no-schema =
-                                // no-op gate path rather than falling back to a (nonexistent)
-                                // stored config — keeping the #666 bootstrap convergent.
-                                proposedSchema = localHasSchema ? typeConfig.schema : "";
-                            }
-                            for (const op of operations) {
-                                const existingOp = existingOpsForType[op.name];
-                                opGateContext = {
-                                    action: existingOp ? "update" : "create",
-                                    key: `${dbType}/${op.name}`,
-                                };
-                                if (existingOp) {
-                                    await client.updateDatabaseTypeOperation(resolvedAppId, dbType, op.name, {
-                                        type: op.type,
-                                        modelName: op.modelName,
-                                        access: op.access,
-                                        definition: op.definition,
-                                        params: op.params,
-                                    }, options.force ? undefined : existingOp.modifiedAt, {
-                                        dryRun: true,
-                                        schemaOverride: proposedSchema,
-                                        // Issue #1336 (P1/P2): gate the op-access lint against
-                                        // the manifest THIS push is landing, not the stale
-                                        // stored one.
-                                        metadataManifestOverride: proposedManifest,
-                                    });
-                                }
-                                else {
-                                    await client.createDatabaseTypeOperation(resolvedAppId, dbType, {
-                                        name: op.name,
-                                        type: op.type,
-                                        modelName: op.modelName,
-                                        access: op.access,
-                                        definition: op.definition,
-                                        params: op.params,
-                                    }, {
-                                        dryRun: true,
-                                        schemaOverride: proposedSchema,
-                                        // Issue #1336 (P1/P2): as above — a fresh-type op dry-run
-                                        // now lints against the proposed manifest instead of
-                                        // skipping the lint entirely.
-                                        metadataManifestOverride: proposedManifest,
-                                        // Issue #915 (defect a, follow-up): for a fresh type the
-                                        // server has no stored config to read `defaultAccess`
-                                        // from, so an op that omits `access` to inherit the
-                                        // TOML-declared type-level `defaultAccess` would be
-                                        // falsely rejected. Thread the proposed value so the
-                                        // fresh-type dry-run gates the same way the real push
-                                        // (which lands the type first) will.
-                                        defaultAccess: typeof typeConfig.defaultAccess === "string"
-                                            ? typeConfig.defaultAccess
-                                            : undefined,
-                                    });
-                                }
-                            }
-                            // Every op gate passed; clear the context so a later (non-op)
-                            // throw inside this try isn't misattributed to the last op.
-                            opGateContext = null;
-                        }
                     }
                     catch (err) {
-                        // A gate failure during validate aborts the whole type. Bucket it
-                        // into the same `schemaErrors` collectors used by the reporting
-                        // path so the summary renders it identically, and record a
-                        // disclosure entry. Conflicts and other errors fall through to
-                        // the apply path's handling (validate-first doesn't change
-                        // conflict semantics).
-                        if (err instanceof SchemaBreaksOpsError) {
-                            schemaErrors.schemaBreaks.push({
-                                type: "database-type-config",
-                                key: dbType,
-                                operations: err.operations,
-                                message: err.message,
-                            });
-                            blockedDatabaseTypes.push({
-                                databaseType: dbType,
-                                reason: `schema change blocked: ${err.operations.length} kept operation(s) would break under the new schema`,
-                            });
-                            typeGateBlocked = true;
-                        }
-                        else if (err instanceof SchemaHasUncheckableOpsError) {
-                            schemaErrors.uncheckableOps.push({
-                                type: "database-type-config",
-                                key: dbType,
-                                operations: err.operations,
-                                message: err.message,
-                            });
-                            blockedDatabaseTypes.push({
-                                databaseType: dbType,
-                                reason: `schema change blocked: operation(s) have dynamic refs (re-run with --accept-warnings to commit)`,
-                            });
-                            typeGateBlocked = true;
-                        }
-                        else if (err instanceof OpsExistError) {
-                            schemaErrors.opsExist.push({
-                                type: "database-type-config",
-                                key: dbType,
-                                opCount: err.opCount,
-                                message: err.message,
-                            });
-                            blockedDatabaseTypes.push({
-                                databaseType: dbType,
-                                reason: `schema deletion blocked: ${err.opCount} operation(s) still registered after this push's deletes`,
-                            });
-                            typeGateBlocked = true;
-                        }
-                        else if (err instanceof SchemaRequiredError) {
-                            schemaErrors.schemaRequired.push({
-                                type: "operation",
-                                key: `${dbType}/_`,
-                                message: err.message,
-                            });
-                            blockedDatabaseTypes.push({
-                                databaseType: dbType,
-                                reason: `operation push blocked: type has no schema set`,
-                            });
-                            typeGateBlocked = true;
-                        }
-                        else if (err instanceof OperationRefError) {
-                            schemaErrors.opRefs.push({
-                                type: "operation",
-                                key: dbType,
-                                refs: err.refs,
-                                message: err.message,
-                            });
-                            blockedDatabaseTypes.push({
-                                databaseType: dbType,
-                                reason: `operation push blocked: unresolved references in the schema`,
-                            });
-                            typeGateBlocked = true;
-                        }
-                        else if (err instanceof ConflictError) {
+                        // A gate failure during validate aborts the whole type. Conflicts
+                        // and other errors fall through to the apply path's handling
+                        // (validate-first doesn't change conflict semantics).
+                        if (err instanceof ConflictError) {
                             // Surface the conflict and skip this type (don't blow away the
                             // server with mutating calls). Mirrors the apply path.
                             conflicts.push({
@@ -13871,14 +13360,6 @@ What a push guarantees (two stages):
                             });
                             typeGateBlocked = true;
                         }
-                        else if (opGateContext) {
-                            // The op-edit gate dry-run threw a plain (non-gate) error —
-                            // e.g. an invalid op `definition` the server rejects with a
-                            // 400. The validate-first loop already knows which op failed,
-                            // so name it (issue #684) instead of coarsening to the
-                            // db-type level. Mirrors the apply path's per-op wraps.
-                            throw wrapEntityError(err, opGateContext.action, "operation", opGateContext.key);
-                        }
                         else {
                             throw wrapEntityError(err, "update", "database type", dbType);
                         }
@@ -13898,17 +13379,6 @@ What a push guarantees (two stages):
                         else {
                             changes.push({ type: "database-type-config", action: "create", key: dbType });
                         }
-                        for (const op of operations) {
-                            const existingOp = existingOpsForType[op.name];
-                            changes.push({
-                                type: "operation",
-                                action: existingOp ? "update" : "create",
-                                key: `${dbType}/${op.name}`,
-                            });
-                        }
-                        for (const delName of pendingOpDeletes) {
-                            changes.push({ type: "operation", action: "delete", key: `${dbType}/${delName}` });
-                        }
                         continue;
                     }
                     // A live type the manifest never recorded is about to be updated,
@@ -13934,9 +13404,8 @@ What a push guarantees (two stages):
                     // never recorded is updated rather than re-created.
                     if (typeExistsOnServer) {
                         // Update existing type config — only when there is a genuine
-                        // type-level change. Operations are handled separately below.
-                        // Issue #369: skipping the PATCH on an operations-only edit avoids
-                        // sending an empty body (which the server rejects with HTTP 400)
+                        // type-level change. Issue #369: skipping the PATCH on an edit
+                        // with no type-level effect avoids sending an empty body (which the server rejects with HTTP 400)
                         // and a spurious "Updated database type". Issue #1567: the owned
                         // scalars are always in `updateData` now (value-or-`null`), so the
                         // skip decision moved from "payload non-empty" to the
@@ -13953,18 +13422,7 @@ What a push guarantees (two stages):
                                 // `schema: null` clears it server-side; codex review gap on
                                 // PR #766). Built by the shared helper so the validate pass
                                 // and apply pass agree (issue #813).
-                                // The look-ahead goes on the REAL mutating PATCH exactly as it
-                                // went on the dry-run above — the gates it feeds run on this
-                                // call, and the operation creates/updates/deletes it
-                                // describes still happen in step 3 below. It is sent whole
-                                // and unconditionally: a push that only rewrites operations
-                                // has no deletes to report, and gating on that was what kept
-                                // the #2732 case (model removal + operation rewrites) from
-                                // ever reaching the server as one push.
-                                const updateData = {
-                                    ...computeTypeUpdateData(),
-                                    ...pendingOpClaims,
-                                };
+                                const updateData = computeTypeUpdateData();
                                 if (typeLevelChange) {
                                     changes.push({ type: "database-type-config", action: "update", key: dbType });
                                     const updated = await client.updateDatabaseTypeConfig(resolvedAppId, dbType, updateData, expectedModifiedAt, {
@@ -13973,8 +13431,8 @@ What a push guarantees (two stages):
                                     });
                                     info(`  Updated database type: ${dbType}`);
                                     // Issue #1567: name each owned scalar this push cleared, so
-                                    // removing an access gate (celContextAccess / defaultAccess)
-                                    // is never silent.
+                                    // removing a rule (triggers, autoPopulatedFields) is never
+                                    // silent.
                                     reportClearedFields("Cleared ");
                                     printStaleInstanceWarning(updated);
                                     if (syncState?.entities?.databaseTypes?.[dbType] && updated?.modifiedAt) {
@@ -13991,28 +13449,11 @@ What a push guarantees (two stages):
                                 if (err instanceof ConflictError) {
                                     // #2731 B5 — the server moved between the reconcile fetch
                                     // and this write, so recompute the field diff against the
-                                    // record that is there NOW (type plus its ops and
-                                    // subscriptions, which the comparison treats as one unit).
+                                    // record that is there NOW.
                                     conflicts.push(await lateConflict("database-type-config", dbType, err, expectedModifiedAt, refetchLiveDatabaseType, databaseTypeSpec, tomlData));
                                     // The PATCH was rejected: this file did not land.
                                     fileHadConflict = true;
                                 }
-                                else if (err instanceof SchemaBreaksOpsError) {
-                                    schemaErrors.schemaBreaks.push({
-                                        type: "database-type-config",
-                                        key: dbType,
-                                        operations: err.operations,
-                                        message: err.message,
-                                    });
-                                }
-                                else if (err instanceof SchemaHasUncheckableOpsError) {
-                                    schemaErrors.uncheckableOps.push({
-                                        type: "database-type-config",
-                                        key: dbType,
-                                        operations: err.operations,
-                                        message: err.message,
-                                    });
-                                }
                                 else if (err instanceof TomlParseError) {
                                     schemaErrors.tomlParse.push({
                                         type: "database-type-config",
@@ -14022,14 +13463,6 @@ What a push guarantees (two stages):
                                         message: err.message,
                                     });
                                 }
-                                else if (err instanceof OpsExistError) {
-                                    schemaErrors.opsExist.push({
-                                        type: "database-type-config",
-                                        key: dbType,
-                                        opCount: err.opCount,
-                                        message: err.message,
-                                    });
-                                }
                                 else {
                                     throw wrapEntityError(err, "update", "database type", dbType);
                                 }
@@ -14056,10 +13489,6 @@ What a push guarantees (two stages):
                                 createData.ruleSetId = typeConfig.ruleSetId;
                             if (typeConfig.triggers)
                                 createData.triggers = typeConfig.triggers;
-                            if (typeConfig.metadataAccess)
-                                createData.metadataAccess = typeConfig.metadataAccess;
-                            if (typeConfig.defaultAccess)
-                                createData.defaultAccess = typeConfig.defaultAccess;
                             if (typeConfig.autoPopulatedFields)
                                 createData.autoPopulatedFields = typeConfig.autoPopulatedFields;
                             if (typeConfig.timestamps)
@@ -14127,11 +13556,7 @@ What a push guarantees (two stages):
                                     // remote config and refuse to mutate it without a baseline:
                                     // surface it as a SKIPPED type (reusing the #813 blocked-type
                                     // disclosure + non-zero exit) so the user runs `config pull`
-                                    // first. The op sub-loop is skipped via `continue`, so no
-                                    // operations are created against the un-reconciled type.
-                                    const existingOpsRemote = await client
-                                        .listDatabaseTypeOperations(resolvedAppId, dbType)
-                                        .catch(() => []);
+                                    // first.
                                     const hasNonDefaultField = (v) => {
                                         if (v === null || v === undefined)
                                             return false;
@@ -14141,12 +13566,8 @@ What a push guarantees (two stages):
                                             return Object.keys(v).length > 0;
                                         return true;
                                     };
-                                    const isMinimalAutoCreated = (!Array.isArray(existingOpsRemote) ||
-                                        existingOpsRemote.length === 0) &&
-                                        !hasNonDefaultField(existing?.ruleSetId) &&
+                                    const isMinimalAutoCreated = !hasNonDefaultField(existing?.ruleSetId) &&
                                         !hasNonDefaultField(existing?.triggers) &&
-                                        !hasNonDefaultField(existing?.metadataAccess) &&
-                                        !hasNonDefaultField(existing?.defaultAccess) &&
                                         !hasNonDefaultField(existing?.autoPopulatedFields) &&
                                         !hasNonDefaultField(existing?.timestamps) &&
                                         !hasNonDefaultField(existing?.schema);
@@ -14180,13 +13601,6 @@ What a push guarantees (two stages):
                                             action: "update",
                                             key: dbType,
                                         });
-                                        for (const op of operations) {
-                                            changes.push({
-                                                type: "operation",
-                                                action: "create",
-                                                key: `${dbType}/${op.name}`,
-                                            });
-                                        }
                                         continue;
                                     }
                                     info(`  reconciled auto-created database type \`${dbType}\``);
@@ -14211,7 +13625,7 @@ What a push guarantees (two stages):
                                     //    "modified since last sync" CONFLICT (Q4). Subsequent
                                     //    pushes carry the baseline just seeded above. Skip the
                                     //    PATCH entirely when the TOML declares no type-level
-                                    //    fields (an ops-only file) so we don't send an empty
+                                    //    fields so we don't send an empty
                                     //    body, which the server rejects with HTTP 400 (#369).
                                     const reconcileData = computeTypeUpdateData();
                                     if (Object.keys(reconcileData).length > 0) {
@@ -14230,11 +13644,6 @@ What a push guarantees (two stages):
                                                     : syncState.entities.databaseTypes[dbType].hasSchema;
                                         }
                                     }
-                                    // Operations declared in the TOML flow through the existing
-                                    // op sub-loop below. `existingOps` is derived from
-                                    // `existingEntry` (the pre-push sync-state snapshot, which is
-                                    // empty here), so every op is CREATEd — matching the empty
-                                    // auto-created type on the server.
                                 }
                                 else {
                                     throw wrapEntityError(err, "create", "database type", dbType);
@@ -14242,315 +13651,22 @@ What a push guarantees (two stages):
                             }
                         }
                     }
-                    // Process operations for this type. The baseline is the same one
-                    // the validate pass used, so a type the server no longer has
-                    // creates its ops rather than PATCHing rows that went with it.
-                    const existingOps = existingOpsForType;
-                    const tomlOpNames = new Set(operations.map((op) => op.name));
-                    for (const op of operations) {
-                        const existingOp = existingOps[op.name];
-                        if (existingOp) {
-                            // Update existing operation
-                            changes.push({ type: "operation", action: "update", key: `${dbType}/${op.name}` });
-                            if (!options.dryRun) {
-                                // #2731 B4 — the LIVE row's timestamp when the reconcile read
-                                // it, the manifest's otherwise (degraded path).
-                                const expectedOpModifiedAt = options.force
-                                    ? undefined
-                                    : liveOpsByName?.get(op.name)?.modifiedAt ??
-                                        existingOp.modifiedAt;
-                                try {
-                                    const updated = await client.updateDatabaseTypeOperation(resolvedAppId, dbType, op.name, {
-                                        // Include `type` so the server can detect/apply
-                                        // type-in-place changes (issue #692). When the type
-                                        // matches the stored value, this is a no-op.
-                                        type: op.type,
-                                        modelName: op.modelName,
-                                        access: op.access,
-                                        definition: op.definition,
-                                        params: op.params,
-                                    }, expectedOpModifiedAt);
-                                    info(`  Updated operation: ${dbType}/${op.name}`);
-                                    // Recorded even when the manifest had never seen this row:
-                                    // the update targeted a row live state named, and a state
-                                    // that stays silent about it would send this same push
-                                    // again on the next run.
-                                    const opsEntry = syncState?.entities?.databaseTypes?.[dbType];
-                                    if (opsEntry && updated?.modifiedAt) {
-                                        if (!opsEntry.operations)
-                                            opsEntry.operations = {};
-                                        opsEntry.operations[op.name] = { modifiedAt: updated.modifiedAt };
-                                    }
-                                }
-                                catch (err) {
-                                    if (err instanceof ConflictError) {
-                                        // #2731 B5 — an operation is part of this file's compared
-                                        // surface, so its 409 is reported like the type's own:
-                                        // against the record that is there NOW, with the field
-                                        // diff (`operations` as a unit) rather than two
-                                        // timestamps the operator cannot act on.
-                                        conflicts.push({
-                                            ...(await lateConflict("operation", `${dbType}/${op.name}`, err, expectedOpModifiedAt, refetchLiveDatabaseType, databaseTypeSpec, tomlData)),
-                                        });
-                                        // The op was rejected, so this file did not fully land.
-                                        fileHadConflict = true;
-                                    }
-                                    else if (err instanceof SchemaRequiredError) {
-                                        schemaErrors.schemaRequired.push({
-                                            type: "operation",
-                                            key: `${dbType}/${op.name}`,
-                                            message: err.message,
-                                        });
-                                        // Issue #915 (defect b): a gate-rejected op means this
-                                        // file's state did NOT fully land — don't poison the
-                                        // content hash (see the contentHash write below).
-                                        fileHadGateRejectedOp = true;
-                                    }
-                                    else if (err instanceof OperationRefError) {
-                                        schemaErrors.opRefs.push({
-                                            type: "operation",
-                                            key: `${dbType}/${op.name}`,
-                                            refs: err.refs,
-                                            message: err.message,
-                                        });
-                                        fileHadGateRejectedOp = true;
-                                    }
-                                    else {
-                                        throw wrapEntityError(err, "update", "operation", `${dbType}/${op.name}`);
-                                    }
-                                }
-                            }
-                        }
-                        else {
-                            // Create new operation
-                            changes.push({ type: "operation", action: "create", key: `${dbType}/${op.name}` });
-                            if (!options.dryRun) {
-                                try {
-                                    const created = await client.createDatabaseTypeOperation(resolvedAppId, dbType, {
-                                        name: op.name,
-                                        type: op.type,
-                                        modelName: op.modelName,
-                                        access: op.access,
-                                        definition: op.definition,
-                                        params: op.params,
-                                    });
-                                    info(`  Created operation: ${dbType}/${op.name}`);
-                                    if (syncState?.entities?.databaseTypes?.[dbType]) {
-                                        if (!syncState.entities.databaseTypes[dbType].operations) {
-                                            syncState.entities.databaseTypes[dbType].operations = {};
-                                        }
-                                        syncState.entities.databaseTypes[dbType].operations[op.name] = {
-                                            modifiedAt: created?.modifiedAt || new Date().toISOString(),
-                                        };
-                                    }
-                                }
-                                catch (err) {
-                                    if (err instanceof SchemaRequiredError) {
-                                        schemaErrors.schemaRequired.push({
-                                            type: "operation",
-                                            key: `${dbType}/${op.name}`,
-                                            message: err.message,
-                                        });
-                                        // Issue #915 (defect b): a gate-rejected op means this
-                                        // file's state did NOT fully land — don't poison the
-                                        // content hash (see the contentHash write below).
-                                        fileHadGateRejectedOp = true;
-                                    }
-                                    else if (err instanceof OperationRefError) {
-                                        schemaErrors.opRefs.push({
-                                            type: "operation",
-                                            key: `${dbType}/${op.name}`,
-                                            refs: err.refs,
-                                            message: err.message,
-                                        });
-                                        fileHadGateRejectedOp = true;
-                                    }
-                                    else {
-                                        throw wrapEntityError(err, "create", "operation", `${dbType}/${op.name}`);
-                                    }
-                                }
-                            }
-                        }
-                    }
-                    // Delete operations that were removed from TOML
-                    for (const existingOpName of Object.keys(existingOps)) {
-                        if (!tomlOpNames.has(existingOpName)) {
-                            changes.push({ type: "operation", action: "delete", key: `${dbType}/${existingOpName}` });
-                            if (!options.dryRun) {
-                                try {
-                                    await client.deleteDatabaseTypeOperation(resolvedAppId, dbType, existingOpName);
-                                    info(`  Deleted operation: ${dbType}/${existingOpName}`);
-                                    if (syncState?.entities?.databaseTypes?.[dbType]?.operations) {
-                                        delete syncState.entities.databaseTypes[dbType].operations[existingOpName];
-                                    }
-                                }
-                                catch (err) {
-                                    throw wrapEntityError(err, "delete", "operation", `${dbType}/${existingOpName}`);
-                                }
-                            }
-                        }
-                    }
-                    // Process subscriptions for this type (issue #803). Mirrors the
-                    // operations reconcile above, keyed on `subscriptionKey`:
-                    // create new keys, PUT changed/existing keys, delete keys present
-                    // in SyncState but absent from the TOML. Server errors (409 key
-                    // collision, `#`-in-key 400, max-20 400, missing-required 400)
-                    // are surfaced cleanly via `wrapEntityError` — named, not a crash.
-                    const existingSubs = liveChildBaseline(liveSubsByName, syncState?.entities?.databaseTypes?.[dbType]?.subscriptions) ??
-                        ((typeExistsOnServer
-                            ? syncState?.entities?.databaseTypes?.[dbType]?.subscriptions
-                            : undefined) || {});
-                    const tomlSubKeys = new Set(subscriptions.map((sub) => sub.subscriptionKey));
-                    for (const sub of subscriptions) {
-                        const subKey = sub.subscriptionKey;
-                        const existingSub = existingSubs[subKey];
-                        if (existingSub) {
-                            // Update existing subscription (PUT — idempotent).
-                            changes.push({ type: "subscription", action: "update", key: `${dbType}/${subKey}` });
-                            if (!options.dryRun) {
-                                // #2731 B4 — the LIVE row's timestamp when the reconcile read
-                                // it, the manifest's otherwise (degraded path). Subscriptions
-                                // are part of a converted type's push units, so a concurrent
-                                // server edit has to be a 409 here too, not a silent
-                                // overwrite.
-                                const expectedSubModifiedAt = options.force
-                                    ? undefined
-                                    : liveSubsByName?.get(subKey)?.modifiedAt ??
-                                        existingSub.modifiedAt;
-                                try {
-                                    const updated = await client.updateDatabaseTypeSubscription(resolvedAppId, dbType, subKey, {
-                                        displayName: sub.displayName,
-                                        modelName: sub.modelName,
-                                        filter: sub.filter,
-                                        access: sub.access,
-                                        description: sub.description,
-                                        select: sub.select,
-                                        emit: sub.emit,
-                                        params: sub.params,
-                                        status: sub.status,
-                                    }, expectedSubModifiedAt);
-                                    info(`  Updated subscription: ${dbType}/${subKey}`);
-                                    // Gate the SyncState write on a server-returned
-                                    // `modifiedAt`, mirroring the operations precedent above
-                                    // (don't fall back to a fresh local timestamp) — and record
-                                    // a row the manifest had never seen, for the same reason.
-                                    const subsEntry = syncState?.entities?.databaseTypes?.[dbType];
-                                    if (subsEntry && updated?.modifiedAt) {
-                                        if (!subsEntry.subscriptions)
-                                            subsEntry.subscriptions = {};
-                                        subsEntry.subscriptions[subKey] = { modifiedAt: updated.modifiedAt };
-                                    }
-                                }
-                                catch (err) {
-                                    if (err instanceof ConflictError) {
-                                        conflicts.push({
-                                            ...(await lateConflict("subscription", `${dbType}/${subKey}`, err, expectedSubModifiedAt, refetchLiveDatabaseType, databaseTypeSpec, tomlData)),
-                                        });
-                                        // The subscription was rejected, so this file did not
-                                        // fully land — the baseline stamp below must not claim it
-                                        // did.
-                                        fileHadConflict = true;
-                                    }
-                                    else {
-                                        throw wrapEntityError(err, "update", "subscription", `${dbType}/${subKey}`);
-                                    }
-                                }
-                            }
-                        }
-                        else {
-                            // Create new subscription (POST).
-                            changes.push({ type: "subscription", action: "create", key: `${dbType}/${subKey}` });
-                            if (!options.dryRun) {
-                                try {
-                                    const created = await client.createDatabaseTypeSubscription(resolvedAppId, dbType, {
-                                        subscriptionKey: subKey,
-                                        displayName: sub.displayName,
-                                        modelName: sub.modelName,
-                                        filter: sub.filter,
-                                        access: sub.access,
-                                        description: sub.description,
-                                        select: sub.select,
-                                        emit: sub.emit,
-                                        params: sub.params,
-                                        status: sub.status,
-                                    });
-                                    info(`  Created subscription: ${dbType}/${subKey}`);
-                                    if (syncState?.entities?.databaseTypes?.[dbType]) {
-                                        if (!syncState.entities.databaseTypes[dbType].subscriptions) {
-                                            syncState.entities.databaseTypes[dbType].subscriptions = {};
-                                        }
-                                        syncState.entities.databaseTypes[dbType].subscriptions[subKey] = {
-                                            modifiedAt: created?.modifiedAt || new Date().toISOString(),
-                                        };
-                                    }
-                                }
-                                catch (err) {
-                                    throw wrapEntityError(err, "create", "subscription", `${dbType}/${subKey}`);
-                                }
-                            }
-                        }
-                    }
-                    // Delete subscriptions that were removed from TOML (hard-delete on
-                    // current `main`, PR #787 — frees the key for reuse). A 409 on
-                    // recreate is impossible here since we delete first; the pull-side
-                    // "active only" filter (controller `list` excludes archived)
-                    // agrees because hard-delete leaves no archived row behind.
-                    for (const existingSubKey of Object.keys(existingSubs)) {
-                        if (!tomlSubKeys.has(existingSubKey)) {
-                            changes.push({ type: "subscription", action: "delete", key: `${dbType}/${existingSubKey}` });
-                            if (!options.dryRun) {
-                                try {
-                                    await client.deleteDatabaseTypeSubscription(resolvedAppId, dbType, existingSubKey);
-                                    info(`  Deleted subscription: ${dbType}/${existingSubKey}`);
-                                    if (syncState?.entities?.databaseTypes?.[dbType]?.subscriptions) {
-                                        delete syncState.entities.databaseTypes[dbType].subscriptions[existingSubKey];
-                                    }
-                                }
-                                catch (err) {
-                                    throw wrapEntityError(err, "delete", "subscription", `${dbType}/${existingSubKey}`);
-                                }
-                            }
-                        }
-                    }
-                    // Refresh the file's content hash after processing operations +
-                    // subscriptions (issue #803, behavior g). The type-config update
-                    // block only refreshes the hash when a type-level field changed
-                    // (its `updateData` was non-empty); an operations- or
-                    // subscriptions-only edit left a stale hash, so the next push
-                    // would re-PUT every op/sub instead of skipping the unchanged
-                    // file. Recompute here so a truly-unchanged subsequent push skips
-                    // the whole file via `shouldPushFile`. `--force` bypasses that
-                    // skip, so forced re-pushes are unaffected.
-                    //
-                    // Issue #915 (defect b): when the gate rejected an op for this
-                    // file, do NOT record a matching content hash. The db-type itself
-                    // may have been created (the push is non-transactional), but the
-                    // blocked op never landed — a matching hash would make
-                    // `shouldPushFile` short-circuit the next push and hide the missing
-                    // op as "in sync". Clear the hash instead of writing it: an empty
-                    // hash forces `shouldPushFile` to re-evaluate the file, so a
-                    // subsequent `config push --dry-run` still surfaces the op as drift
-                    // and a corrected re-push converges without manual file edits. We
-                    // clear (rather than merely skip) so the fresh-type create path's
-                    // earlier optimistic hash write (see `createDatabaseTypeConfig`
-                    // above) is also invalidated.
-                    //
-                    // #2731 B4: the semantic baseline is refreshed here too, and
-                    // cleared alongside the byte hash when an op was gate-rejected —
-                    // a baseline claiming convergence would make the next run read the
-                    // missing op as server drift rather than as work still to do. A
-                    // 409 on the type or one of its ops means the same thing: the
-                    // server refused the write, so this file did not land either.
+                    // Refresh the file's content hash and semantic baseline (#2731 B4)
+                    // after the type's writes. The type-config update block only
+                    // refreshes the hash when a type-level field changed; recomputing
+                    // here lets a truly-unchanged next push skip the file. A 409 means
+                    // the server refused the write, so this file did not land: clear
+                    // both rather than claim convergence.
                     if (!options.dryRun && syncState?.entities?.databaseTypes?.[dbType]) {
-                        if (fileHadGateRejectedOp || fileHadConflict) {
+                        if (fileHadConflict) {
                             syncState.entities.databaseTypes[dbType].contentHash = "";
                             syncState.entities.databaseTypes[dbType].semanticHash = undefined;
                         }
                         else {
                             syncState.entities.databaseTypes[dbType].contentHash =
                                 computeFileHash(filePath);
-                            // B4 — the baseline reads back what the server now holds, type
-                            // and children together. Taking it from the local file would
+                            // B4 — the baseline reads back what the server now holds.
+                            // Taking it from the local file would
                             // stamp a value the handlers normalized as the state both sides
                             // agreed on, and the next local edit would report a conflict
                             // against a difference this push itself created. A read that
@@ -14582,6 +13698,9 @@ What a push guarantees (two stages):
             // import that escapes the config tree aborts this function before
             // anything is sent for it (behavior 12).
             const functionsPushDir = join(configDir, "functions");
+            // #4437 — functions this push failed to apply that the server does not
+            // hold either, so the deferred agent leg can name them as the cause.
+            const unappliedFunctionKeys = new Set();
             if (existsSync(functionsPushDir)) {
                 // #3182 — the typed handle. Written BEFORE the bundles are built, so
                 // an author who runs `config push` after editing a schema gets the
@@ -14676,6 +13795,15 @@ What a push guarantees (two stages):
                     withDerivedIdentity(tomlData, "function", { key });
                     const existingEntry = syncState?.entities?.functions?.[key];
                     const liveFunction = liveFunctions.get(key);
+                    // An archived row is a tombstone: the server refuses an agent
+                    // naming it exactly as it refuses one naming no function at all.
+                    const serverHoldsFunction = liveFunction
+                        ? String(liveFunction.status ?? "active") !== "archived"
+                        : !functionsLiveOk && !!existingEntry?.id;
+                    const markUnapplied = () => {
+                        if (!serverHoldsFunction)
+                            unappliedFunctionKeys.add(key);
+                    };
                     // Build first: nothing is sent for a function whose code does not
                     // compile or whose imports leave the tree.
                     let push;
@@ -14695,6 +13823,7 @@ What a push guarantees (two stages):
                             key,
                             message: err.message,
                         });
+                        markUnapplied();
                         continue;
                     }
                     // #3455 (D3455-004) — the project declares a document schema this
@@ -14721,6 +13850,7 @@ What a push guarantees (two stages):
                                 key,
                                 message: failure.message,
                             });
+                            markUnapplied();
                             continue;
                         }
                     }
@@ -14838,6 +13968,7 @@ What a push guarantees (two stages):
                     // the same contract `applyFailures` gives every other type; a throw
                     // here would let one refusal block a whole repository.
                     let functionId = liveFunction?.functionId ?? existingEntry?.id;
+                    let createdThisPush = false;
                     let pushedVersion;
                     try {
                         if (!functionId) {
@@ -14862,6 +13993,7 @@ What a push guarantees (two stages):
                                 return existing;
                             });
                             functionId = created.functionId;
+                            createdThisPush = true;
                             info(`  Created function: ${key}`);
                         }
                         else if (headerAction !== "skip") {
@@ -14884,6 +14016,11 @@ What a push guarantees (two stages):
                             key,
                             message: String(err?.message ?? err),
                         });
+                        // A refused create, or a refused push to a row the server does
+                        // not hold live (an archived tombstone). A row this push created
+                        // is held even when its version was refused.
+                        if (!createdThisPush)
+                            markUnapplied();
                         continue;
                     }
                     // #3455 (D3455-010) — did the server keep the document schema it
@@ -14946,8 +14083,15 @@ What a push guarantees (two stages):
             }
             // #3798 — the agent prompts, now that every function they name that
             // this push applies is on the server (see `pushPromptFiles`).
+            // #4437 — except an agent naming a function that failed above and that
+            // the server does not hold: the server would refuse it as naming a
+            // function the app does not have, hiding the function's own failure.
             if (deferredAgentPromptFiles.length > 0) {
-                await pushPromptFiles(deferredAgentPromptFiles);
+                const { apply, held } = holdAgentPromptFilesForUnappliedFunctions(promptsDir, deferredAgentPromptFiles, unappliedFunctionKeys);
+                for (const { key, message } of held) {
+                    applyFailures.push({ type: "prompt", key, message });
+                }
+                await pushPromptFiles(apply);
             }
             // Process group type configs
             const groupTypeConfigsDir = join(configDir, "group-type-configs");
@@ -17288,12 +16432,9 @@ What a push guarantees (two stages):
             // Blob buckets — #2880: the list row is the record. #4116: a bucket
             // names its rule set, so its rows take the type configs' gate.
             compareByDefinition("blob-bucket", "blobBuckets", localBlobBucketsParsed, new Map((blobBucketsDiffResult.items || []).map((b) => [b.bucketKey, b])), blobBucketsOutcomeDiff.ok && ruleSetsOk);
-            // database-type-configs: the list carries only the type header, so operations
-            // and subscriptions are fetched per type (mirroring pull) before the
-            // content comparison. A per-type fetch failure degrades that one row to
-            // "content not compared" rather than aborting the whole diff (#1485
-            // edge case). Both operations AND subscriptions are included so an
-            // op-only or subscription-only change is not falsely reported as Synced.
+            // database-type-configs: the listing carries the whole type, so each
+            // row compares on its own. (#3189 — the operations and subscriptions
+            // that used to be fetched per type beside it are retired.)
             for (const [key, parsed] of localDatabaseTypesParsed) {
                 const remote = remoteDatabaseTypes.get(key);
                 if (!remote) {
@@ -17306,23 +16447,10 @@ What a push guarantees (two stages):
                     hint = "content not compared (rule sets unavailable)";
                 }
                 else {
-                    const [opsOutcome, subsOutcome] = await Promise.all([
-                        attemptFetch(() => client.listDatabaseTypeOperations(resolvedAppId, key)),
-                        attemptFetch(() => client.listDatabaseTypeSubscriptions(resolvedAppId, key)),
-                    ]);
-                    if (!opsOutcome.ok || !subsOutcome.ok) {
-                        hint = "content not compared (fetch failed)";
-                    }
-                    else {
-                        const operations = Array.isArray(opsOutcome.value) ? opsOutcome.value : [];
-                        const subscriptions = Array.isArray(subsOutcome.value) ? subsOutcome.value : [];
-                        // The shared verdict (#3267): a Modified row names the
-                        // operation, subscription, model field or `[type]` scalar it
-                        // differs in, and a comparison that throws degrades this one
-                        // row to "not compared". The ops/subscriptions are the remote
-                        // side's extra only — the file already carries its own.
-                        ({ status, hint } = compareLocalToRemote(configDiffSpec("database-type-config"), parsed, remote, diffMaps, { operations, subscriptions }));
-                    }
+                    // The shared verdict (#3267): a Modified row names the model field
+                    // or `[type]` scalar it differs in, and a comparison that throws
+                    // degrades this one row to "not compared".
+                    ({ status, hint } = compareLocalToRemote(configDiffSpec("database-type-config"), parsed, remote, diffMaps, {}));
                 }
                 differences.push({ type: "database-type-config", key, status, hint });
             }
@@ -17467,18 +16595,11 @@ What a push guarantees (two stages):
             // verbatim, so the two commands read identically — replaces whatever
             // the comparison had to say about the file.
             // #3320 — the function checks join them. Same posture, same messages:
-            // a function file whose `entry`, mode, triggers or webhook
-            // signing-secret the push preflight refuses is not a row this command
-            // calls Synced, Modified or "local only — new".
+            // a function file whose `entry`, retired runtime keys (#3188),
+            // triggers or webhook signing-secret the push preflight refuses is not
+            // a row this command calls Synced, Modified or "local only — new".
             // Merged first: a file both collectors reject keeps every message push
             // prints, rather than one collector's hint overwriting the other's.
-            // #3482 — the same advisory `config push` prints, so an author sees
-            // the retired key before they push rather than only during it. Not a
-            // row status: the file is pushable, and saying otherwise would make
-            // `config diff` disagree with the push it predicts.
-            for (const message of collectFunctionTomlIgnoredKeyWarnings(configDir)) {
-                warn(`  ${message}`);
-            }
             for (const rejected of mergeConfigFileValidationErrors([
                 ...collectConfigFileValidationErrors(configDir),
                 ...collectFunctionTomlValidationErrors(configDir),
@@ -17777,8 +16898,13 @@ What a push guarantees (two stages):
             // next, so an in-loop abort would leave earlier files rewritten. Every
             // offending file is reported, so the author fixes the tree once.
             const retiredKeyErrors = [];
+            const databaseTypeSurface = CONFIG_SURFACES.find((surface) => surface.label === "database-type-config");
             for (const file of dbFiles) {
-                const message = configUnknownKeyError(`database-type-configs/${file}`, parseTomlFile(join(dbTypesDir, file)), DATABASE_TYPE_TABLE);
+                const tomlData = parseTomlFile(join(dbTypesDir, file));
+                // #3189 — a retired TABLE too (`[[operations]]`, `[[subscriptions]]`):
+                // the rewrite below would otherwise drop it without a word.
+                retiredKeyErrors.push(...configDocumentShapeErrors(`database-type-configs/${file}`, tomlData, databaseTypeSurface));
+                const message = configUnknownKeyError(`database-type-configs/${file}`, tomlData, DATABASE_TYPE_TABLE);
                 if (message)
                     retiredKeyErrors.push(message);
             }
@@ -17796,30 +16922,9 @@ What a push guarantees (two stages):
                 const filePath = join(dbTypesDir, file);
                 const rawBefore = readFileSync(filePath, "utf-8");
                 const tomlData = parseTomlFile(filePath);
-                // `accessRule`/`access` conflicts surface as a clear error here too,
-                // rather than silently dropping the field during a migrate rewrite.
-                let typeConfig;
-                let operations;
-                let subscriptions;
-                try {
-                    ({ typeConfig, operations, subscriptions } =
-                        parseDatabaseTypeToml(tomlData));
-                }
-                catch (err) {
-                    if (err instanceof SubscriptionAccessKeyConflictError) {
-                        error(`  ${file}: ${err.message}`);
-                        error(`Aborting migrate-toml: subscription \`access\`/\`accessRule\` conflict in ${file}.`);
-                        process.exit(1);
-                    }
-                    throw err;
-                }
-                // Force-native: ignore existing hints so every TOMLable field
-                // ends up in nested-table form. Subscriptions are preserved on the
-                // rewrite (issue #803) so migrate-toml never drops them.
-                const rewritten = serializeDatabaseType(typeConfig, operations, ruleSetIdToName, {
-                    defaultForm: "native",
+                const { typeConfig } = parseDatabaseTypeToml(tomlData);
+                const rewritten = serializeDatabaseType(typeConfig, ruleSetIdToName, {
                     logger: (msg) => info(`  ${msg}`),
-                    subscriptions,
                 });
                 if (rewritten === rawBefore) {
                     unchangedCount++;