@@ -155,6 +155,37 @@ describe('the built-in holders', () => {
     expect(await caught(() => registry.registerItem('position', body('position', 'everyone', 'Everyone'), 'name', 'com.objectstack.plugin-security'))).toBeUndefined();
   });
 
+  // An environment item under a built-in name exists only where an environment
+  // save went over the platform's name (outside the ruling), and boot hydration
+  // registers it BEFORE the platform's `start()` declares the built-ins. The
+  // declaration is the built-in holder's own registration, not a second holder:
+  // it is admitted, and the stored definition keeps answering first.
+  it('the platform\'s declaration of a built-in name is admitted over an environment item under that name, which keeps answering first', async () => {
+    const { registry } = await boot();
+    registry.registerItem('position', body('position', 'org_admin', 'stored at the door'), 'name');
+    expect(await caught(() => registry.registerItem('position', body('position', 'org_admin', 'Organization Admin'), 'name', 'com.objectstack.plugin-security'))).toBeUndefined();
+    expect(registry.getItem<{ label: string }>('position', 'org_admin')?.label).toBe('stored at the door');
+  });
+
+  it('…while a second PACKAGE registering a built-in name at the item seam is refused, in either order', async () => {
+    const first = await boot();
+    first.registry.registerItem('position', body('position', 'everyone', 'Everyone'), 'name', 'com.objectstack.plugin-security');
+    const after = await caught(() => first.registry.registerItem('position', body('position', 'everyone', 'other'), 'name', 'com.acme.other'));
+    expectRefusal(after, 'com.acme.other', { kind: 'package', packageId: 'com.objectstack.plugin-security' });
+
+    const second = await boot();
+    second.registry.registerItem('position', body('position', 'everyone', 'other'), 'name', 'com.acme.other');
+    const before = await caught(() => second.registry.registerItem('position', body('position', 'everyone', 'Everyone'), 'name', 'com.objectstack.plugin-security'));
+    expectRefusal(before, 'com.objectstack.plugin-security', { kind: 'package', packageId: 'com.acme.other' });
+  });
+
+  it('CONTROL — for a name that is NOT built in, an environment item still refuses a package-bound registration at the item seam', async () => {
+    const { registry } = await boot();
+    registry.registerItem('position', body('position', 'env_position', 'stored at the door'), 'name');
+    const err = await caught(() => registry.registerItem('position', body('position', 'env_position', 'direct'), 'name', 'com.acme.direct'));
+    expectRefusal(err, 'com.acme.direct', { kind: 'environment' });
+  });
+
   // The platform's permission sets are declared by plugin-security on its own
   // manifest, so they are held as that package's; which side the refusal stops
   // depends on which registers first, and both sides are named either way.
 
@@ -2272,15 +2272,16 @@ export class SchemaRegistry {
    * Read, in this order: a built-in (only when `builtIns` — see
    * {@link BUILT_IN_SECURITY_CATALOG_NAMES} for why the item seam does not ask);
    * the bare slot (an override a package bound to itself, else an
-   * environment-authored item); every composite `<packageId>:<name>` slot; the
-   * package claims. A package that holds the name more than one way is one
-   * holder. A disabled package is still installed, and still holds its names.
+   * environment-authored item — the latter only when `environment`); every
+   * composite `<packageId>:<name>` slot; the package claims. A package that
+   * holds the name more than one way is one holder. A disabled package is still
+   * installed, and still holds its names.
    */
   private securityCatalogHoldersOtherThan(
     type: SecurityCatalogType,
     name: string,
     exceptPackageId: string | undefined,
-    opts: { builtIns: boolean },
+    opts: { builtIns: boolean; environment: boolean },
   ): SecurityCatalogHolder[] {
     const found = new Map<string, SecurityCatalogHolder>();
     const add = (holder: SecurityCatalogHolder) => {
@@ -2292,7 +2293,8 @@ export class SchemaRegistry {
     for (const [key, item] of this.metadata.get(type) ?? []) {
       const stamped = (item as { _packageId?: unknown } | null | undefined)?._packageId;
       if (key === name) {
-        add(typeof stamped === 'string' && stamped !== '' ? { kind: 'package', packageId: stamped } : { kind: 'environment' });
+        if (typeof stamped === 'string' && stamped !== '') add({ kind: 'package', packageId: stamped });
+        else if (opts.environment) add({ kind: 'environment' });
       } else if (key.endsWith(suffix)) {
         add({
           kind: 'package',
@@ -2329,7 +2331,7 @@ export class SchemaRegistry {
       const key = `${type}|${name}`;
       if (seen.has(key)) continue;
       seen.add(key);
-      for (const existingHolder of this.securityCatalogHoldersOtherThan(type, name, selfId, { builtIns: true })) {
+      for (const existingHolder of this.securityCatalogHoldersOtherThan(type, name, selfId, { builtIns: true, environment: true })) {
         conflicts.push({ catalogType: type, name, incomingPackageId: selfId, existingHolder });
       }
     }
@@ -3755,8 +3757,26 @@ export class SchemaRegistry {
     // ⛔ A registration with no `packageId` is the bare slot — `sys_metadata`
     // hydration, the metadata write-through — and is never judged here: an
     // environment save over a package-held name is outside the ruling.
+    //
+    // A BUILT-IN name is held by the platform, and the registration of one
+    // here is the platform declaring its own name (`plugin-security`'s
+    // `registerBuiltinPositions`, in its `start()`) — the holder's own
+    // registration, never a second holder. Packages are refused built-in names
+    // at the package door, and a second package registering one here is still
+    // refused below (in either order: the other package's slot is a holder).
+    // What is NOT asked for a built-in name is the environment catalog: an
+    // environment item under a built-in name exists only because an
+    // environment save went over the platform's name — outside the ruling — and
+    // it is hydrated (`ObjectQLPlugin.start`, which every `start()` depending on
+    // the engine follows) BEFORE the platform declares, so asking it would
+    // refuse the platform's own declaration and with it the boot. The stored
+    // definition keeps answering first from the bare slot (ADR-0005); the
+    // declaration sits beside it.
     if (packageId && isSecurityCatalogType(type)) {
-      const holders = this.securityCatalogHoldersOtherThan(type, baseName, packageId, { builtIns: false });
+      const holders = this.securityCatalogHoldersOtherThan(type, baseName, packageId, {
+        builtIns: false,
+        environment: !BUILT_IN_SECURITY_CATALOG_NAMES[type].has(baseName),
+      });
       if (holders.length > 0) {
         throw new SecurityCatalogNameConflictError(
           holders.map((existingHolder) => ({ catalogType: type, name: baseName, incomingPackageId: packageId, existingHolder })),
 
@@ -91,7 +91,12 @@ const COLLECTION_KEY: Readonly<Record<SecurityCatalogType, string>> = Object.fre
  *
  * Applied at the package door ({@link declaredSecurityCatalogNames}'s caller),
  * never at the registry's own item seam: the platform declares these names to
- * the registry itself, under its own package id.
+ * the registry itself, under its own package id, and that declaration is the
+ * built-in holder's own registration — never a second holder. So the item seam
+ * asks it only whether another PACKAGE holds the name. It does not ask the
+ * environment catalog: an environment item under a built-in name exists only
+ * where an environment save went over the platform's name, which is outside
+ * the ruling, and it is hydrated before the platform declares.
  */
 export const BUILT_IN_SECURITY_CATALOG_NAMES: Readonly<Record<SecurityCatalogType, ReadonlySet<string>>> = Object.freeze({
   position: new Set<string>([...BUILTIN_IDENTITY_NAMES, ...AUDIENCE_ANCHOR_POSITIONS]),