DR-095 — Long-lived Supabase project config is declared in `[remotes.<env>]` blocks that mirror live values; `config push` only at refs with a matching block

supabase config push --project-ref <ref> selects the [remotes.<name>] block whose project_id matches (proven S496 on a throwaway preview branch), so [remotes.staging] and [remotes.prod] carry each environment’s auth/MFA values, mirroring the live project so a push is a no-op until a value deliberately changes. Never push at a ref with no matching block (base config is local-dev-shaped), and only on CLI >= 2.109.1 — 2.108.0 applies auth then dies at the storage leg, and a non-tty push auto-applies with no confirmation and no dry-run. Read-back is the Management API, not the CLI.

Version-pin trap: discharged (S504 F2) — ci.yml:391 pins 2.109.1, the ruling’s floor, with a DR-095-citing comment.