@@ -28,7 +28,20 @@ export async function prepareForcedPush(sql: Sql): Promise<void> {
 }
 
 /** Retires trigger dependencies that Drizzle cannot discover inside PL/pgSQL bodies. */
-async function prepareKeywordProjectionRemoval(sql: Sql): Promise<void> {
+async function prepareKeywordProjectionRemoval(sql: Sql, force: boolean): Promise<void> {
+  if (!force) {
+    const [writers] = await sql<{ present: boolean }[]>`
+      SELECT EXISTS (
+        SELECT 1 FROM pg_trigger
+        WHERE (tgrelid = to_regclass('public.embedding') AND tgname = 'embedding_keyword_search_sync')
+          OR (tgrelid = to_regclass('public.knowledge_base') AND tgname = 'knowledge_base_keyword_search_sync')
+      ) AS present
+    `
+    if (writers.present) {
+      throw new Error('Keyword writer retirement requires --force; no changes were applied')
+    }
+    return
+  }
   await sql.begin(async (tx) => {
     await tx`SET LOCAL lock_timeout = '100ms'`
     await tx`SET LOCAL statement_timeout = '5s'`
@@ -53,8 +66,9 @@ if (import.meta.main) {
   if (!url) throw new Error('Missing DATABASE_URL')
   const sql = postgres(url, { max: 1, connect_timeout: 10 })
   try {
-    if (process.argv.includes('--force')) await prepareForcedPush(sql)
-    await prepareKeywordProjectionRemoval(sql)
+    const force = process.argv.includes('--force')
+    if (force) await prepareForcedPush(sql)
+    await prepareKeywordProjectionRemoval(sql, force)
     createLogger('DatabasePush').info('Schema push compatibility preparation completed')
   } finally {
     await sql.end()
 
@@ -94,7 +94,7 @@ ${source}`
 })`)
   }
 
-  it('keeps chunk and KB updates working after a push drops the keyword table and reconciliation fails', async () => {
+  it('requires approval to retire keyword writers and preserves updates when later reconciliation fails', async () => {
     await sql`CREATE TABLE knowledge_base (id text PRIMARY KEY, is_search_index boolean NOT NULL DEFAULT false)`
     await sql`CREATE TABLE embedding (id text PRIMARY KEY, content text NOT NULL)`
     await sql`CREATE TABLE embedding_keyword_search (id text PRIMARY KEY, content text NOT NULL)`
@@ -121,16 +121,28 @@ ${source}`
 export const knowledgeBases = pgTable('knowledge_base', {
       id: text('id').primaryKey(), isSearchIndex: boolean('is_search_index').notNull().default(false),
     })`)
-    const result = spawnSync(
-      'bun',
-      ['--no-env-file', fileURLToPath(new URL('./push.ts', import.meta.url)), '--force'],
-      {
-        cwd: directory,
-        env: { ...process.env, DATABASE_URL: fixtureUrl, MIGRATION_DATABASE_URL: fixtureUrl },
-        encoding: 'utf8',
-        timeout: 30_000,
-      }
-    )
+    function runPush(args: string[]) {
+      return spawnSync(
+        'bun',
+        ['--no-env-file', fileURLToPath(new URL('./push.ts', import.meta.url)), ...args],
+        {
+          cwd: directory,
+          env: { ...process.env, DATABASE_URL: fixtureUrl, MIGRATION_DATABASE_URL: fixtureUrl },
+          encoding: 'utf8',
+          timeout: 30_000,
+        }
+      )
+    }
+    const denied = runPush([])
+    expect(denied.error).toBeUndefined()
+    expect(denied.status, denied.stdout + denied.stderr).toBe(1)
+    await sql`UPDATE embedding SET content = 'unapproved push retained writer' WHERE id = 'chunk'`
+    expect(await sql`SELECT id FROM embedding_keyword_search`).toEqual([])
+    const emptyDenied = runPush([])
+    expect(emptyDenied.error).toBeUndefined()
+    expect(emptyDenied.status, emptyDenied.stdout + emptyDenied.stderr).toBe(1)
+    await sql`UPDATE knowledge_base SET is_search_index = false WHERE id = 'kb'`
+    const result = runPush(['--force'])
     expect(result.error).toBeUndefined()
     expect(result.status, result.stdout + result.stderr).not.toBe(0)
     expect(await sql`SELECT to_regclass('embedding_keyword_search') AS projection`).toEqual([