spec: rename allowOrgOverride to an environment-overlay key with an ADR-0087 load-time conversion (ADR-0131 C5's spec half, split from #15206 per #22007 ruling C)

Ruled: 6073921182 · letters Q1 A · Q2 A · 2026-10-09T03:53Z
Blocked-by: #15206

Filed by the triage seat (objectstack-wide, seat post #6015, session_01AavokzJ5DndAwitDXvKy4U), answering #15206's retriage (option A). ⛔ Not a claim.

Part of #15194 (ADR-0131 execution tree). The direction is ruled: #22007, letter C (6028809298), as written into #15206's scope by triage's note 6037959748. This card is that scope's spec half, split out because a new published key is a Clause-②: yes widening, which is spec-lane work wherever it lands (execution-duties.md:101; dispatch-gates: "a hit outside those lanes is spec-lane work and moves there").

Scope (as ruled)

The rename. allowOrgOverride (packages/spec/src/kernel/metadata-plugin.zod.ts, about :267 on main, today "Allow per-org overlay writes via runtime metadata API") becomes a key that says what it will then mean: may an environment overlay this packaged item. ⛔ The new name is fixed by this card's contract review, not here.
The conversion. An ADR-0087 D2 load-time conversion, so a manifest naming the old key still loads unchanged.
No overlay is lost. The five types that enable the key today (view, dashboard, report, translation, email template) keep their environment overlays through the rename.
Generated baselines and docs follow the rename.
⛔ Not taken (ruled): a second key with the organization one frozen at false (A), or the old name with a new meaning (B).

Not this card (it stays on #15206, `domain:engine`)

The narrowings, which stay in their lane and owe one contract-tier review:

the sys_metadata family goes tenant-less;
an organization-scoped metadata write is refused;
managed content is sealed;
the per-organization overlay path behind isOverlayAllowed is deleted;
sys_view_definition retires.

#15206 uses the key under its current name. The deletion does not depend on the key's name, so the two cards land in either order or in parallel. The engine seat states the seam at its claim.

Acceptance

Pins: a manifest with the old key loads and converts to the new one. Each of the five types keeps its environment overlay. The generated baselines name the new key.
Clause-②: yes; the contract-review tier is owed.

Claim: PM loop round 1 (stage 0 of this card: measure first, no code, no PR) · 2026-10-08T21:20Z
Session: session_01DhTqaEHqPVSVnAkjG3jywn
Account: os-sales (the seat's linked user as GET /user answers it; the card's assignee from this act)
Branch: claude/issue-22340-stage-0 (stage 0 writes no code; each later stage names its own branch on this card)
Worktree: objectstack-issue-22340
Domain: domain:spec
Seat: domain:spec#2 (seat post #18549)
File surface (at origin/main 54c3ce10c or later): stage 0 writes no file and opens no PR. The report is the deliverable. It contains:

Census: every reader and writer of allowOrgOverride (176 files on main at this stamp, 60 hits in metadata-protocol/src/protocol.ts alone), classified by what each one means:
- (a) the per-organization overlay path that feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 stage (4) deletes (isOverlayAllowed and the organization-scoped write doors);
- (b) the environment-overlay permission that survives the rename;
- (c) declaration, docs, CHANGELOG history and governed text (docs/adr/0005, docs/adr/0010, anything under skills/**), each named for its carrier;
- (d) tests, by which of (a) / (b) they pin.
The five types that enable the key today (view, dashboard, report, translation, email template): where each one's environment overlay is read and written, so that "no overlay is lost" can be pinned per type.
The ADR-0087 D2 conversion: where a manifest that names the key enters (the type registry in packages/spec/src/kernel/metadata-plugin.zod.ts about :267, DEFAULT_METADATA_TYPE_REGISTRY, and plugin manifests). Whether migrations/registry.ts / conversions/registry.ts has a precedent for a renamed registry key. Which generated baselines name the key.
Name candidates for the contract review to fix (the card says the name is fixed there, not here). Each candidate comes with the four-axis reading, and with every existing spec key it could collide with or be confused with.
A stage plan: each stage's file surface, its serial constraints against feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206's stages (engine seat, claim 6067242116; stage 0 is reported in 6067752061) and the open PRs, and the contract-tier review each stage owes.
Container & model: XL staged, mode:subagent for stage 0 (read-only), model: opus (dispatch-gates --tier: no path-derived mandate for a measurement). The code stages are Clause-②: yes (widening), and each owes a contract review.
Clause-②: yes (widening: a new published key with an ADR-0087 load-time conversion from allowOrgOverride; stage 0 itself changes nothing)
Responsibility: n/a — not a defect card (ADR-0131 C5's spec half, ruled under decision: ADR-0131 C5 — allowOrgOverride also decides environment overlays of packaged items. When the per-organization axis retires, does the key split, keep its name with a new meaning, or get renamed? #22007 letter C, split from feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 by triage 6066851770)
Thread-read: none
Serial constraints cleared: stage 0 writes no file. feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 (engine seat 1, staged, pm:dispatched) will edit metadata-protocol protocol.ts and delete the per-organization path that reads this key. So the code stages' order against it is part of stage 0's plan, and is not assumed "in parallel".

Generated by Claude Code

os-dev-report

{
  "issue": 22340,
  "status": "done",
  "branch": "claude/issue-22340-stage-0",
  "pr": null,
  "session": "session_01DhTqaEHqPVSVnAkjG3jywn (subagent of the PM session; identity = the branch named in claim 6069288725)",
  "premise_still_valid": true,
  "summary": "Stage 0 measured on origin/main 54c3ce10c (worktree ../objectstack-issue-22340, read-only, no install, no build; main moved to b7e01fbbd during the run, one commit, 0 diff lines name the key). The direction (rename, ruling C) stands, but the ruled mechanism does not: no manifest, stack, plugin config or stored row can carry a type-registry entry (contributes.kinds is a closed shape, config.additionalTypes is a tombstone, DEFAULT_METADATA_TYPE_REGISTRY is a TypeScript literal that no production code parses), so an ADR-0087 D2 conversion would have no seam; the recorded precedent for renaming a non-stack key is a retiredKey() tombstone + a retired-keys entry + a D3 semantic entry, with no D2 entry (HotReloadConfig.debounceDelay). The rename also reaches a published wire field the card does not name, GET /meta/types entries[].allowOrgOverride (protocol.zod.ts:210), which objectui reads at the pin in 11 source files as Studio's write gate for every packaged item of the five types, through its own optional field type, so by reading neither the Console Pin Gate nor api-surface/authorable-surface would see a missed sibling. Census: 176 files / 765 hits. 46 source hits (14 files) and 120 test hits (32 files) sit in the per-organization path that #15206 S3-S5 delete, so the rename should land after #15206 S5; before S3/S4 a key with an environment name would still decide organization-scoped writes. The rename's declaration is Clause-② yes (narrowing), not yes (widening). Report and translation have no environment-overlay pin today.",
  "census": {
    "base": "origin/main 54c3ce10c (54c3ce10ce8cf89290b67813c34d1f10dbab6938). Re-read at b7e01fbbd (#22342, test titles only): git diff 54c3ce10c b7e01fbbd names the key on 0 lines.",
    "command_and_controls": "git grep -n allowOrgOverride 54c3ce10c = 765 lines in 176 files (the claim's 176 files and 60 hits in protocol.ts both reproduce). Pathspec proof: ':(glob)packages/**/src/**' key 113 files, controls DEFAULT_METADATA_TYPE_REGISTRY 95 and isOverlayAllowed 13; the plain pathspec 'packages/**/src' answers 0 for the key AND 0 for the control (vacuous, no glob magic). ':(glob)**/*.test.ts' key 80, control 'describe(' 4824. ':(glob)content/docs/**' key 14, control ADR-0005 12.",
    "method": "Every hit line was read and classed by what it governs or describes; comments are classed with the code they annotate. Three source files split by line (protocol.ts 19 a / 41 b, spec api/protocol.zod.ts 1 a / 3 b, runtime domains/meta.ts 3 a / 1 b). Counts are path:hits (path:class-hits/file-hits for a split file).",
    "class_totals": "(a) per-organization path: 46 hits, 14 files (11 wholly + 3 split). (b) environment-overlay permission that survives: 75 hits, 19 files (16 wholly + 3 split). (c) declaration 47/1, docs 64/23, generated 16/8, ADR-0087 ledger prose 4/4, tooling 28/3, history (CHANGELOG 147/10 + pending changesets 3/2) 150/12, governed 48/15. (d) tests: pinning (a) 120 hits / 32 files, pinning (b) 156 / 46, mixed 11 / 2. Sum 765.",
    "a_per_org_path": {
      "files": "packages/metadata-protocol/src/protocol.ts:19/60, packages/spec/src/api/protocol.zod.ts:1/4, packages/runtime/src/domains/meta.ts:3/4, packages/metadata-core/src/meta-write-capability.ts:1, packages/metadata-core/src/meta-write-org-scope.ts:6, packages/plugins/plugin-email/src/bootstrap-declared-email-templates.ts:1, packages/rest/src/meta-item-read-gate.ts:1, packages/rest/src/rest-route-ledger.ts:1, packages/rest/src/rest-server.ts:5, packages/runtime/src/domains/mcp.ts:1, packages/runtime/src/domains/packages.ts:3, packages/runtime/src/route-ledger.ts:1, packages/services/service-automation/src/sys-flow-credential.object.ts:1, packages/spec/src/security/capabilities.ts:2",
      "by_15206_stage": "S3 (doors): meta-write-org-scope.ts 6 (ORG_OVERRIDABLE_TYPES :96-100 reads the flag; declaresOrgOverride feeds organizationIdForMetaWrite :141 and organizationIdForMetaRead :189), meta-write-capability.ts 1, spec security/capabilities.ts 2 (manage_org_presentation :47/:62), rest meta-item-read-gate.ts 1, rest-route-ledger.ts 1, rest-server.ts 5, runtime domains/meta.ts 3, runtime route-ledger.ts 1, plugin-email bootstrap-declared-email-templates.ts 1 = 21. S4 (protocol writes): protocol.ts orgScopedWriteRefusal TSDoc and sentence :16136/:16140/:16168/:16215 (its exemption is :16210 'if (this.isOverlayAllowed(type)) return null'), resolveMetaItemOrgScope note :7144, applyRegistryWriteThrough note :19222, duplicatePackage note :24793; runtime domains/packages.ts 3, domains/mcp.ts 1, service-automation sys-flow-credential.object.ts 1, spec api/protocol.zod.ts:676 (SaveMetaItem organizationId describe) = 13. S5 (reads): protocol.ts :8927, :10064, :10145, :10719, :10778, :11537, :11544, :14732 (organization read-gate notes) and reportUnhydratableOrgScopedRows :27457/:27498/:27554 (reads the flag)/:27640 (sentence) = 12."
    },
    "b_environment_overlay_permission": {
      "files": "packages/metadata-protocol/src/protocol.ts:41/60, packages/spec/src/api/protocol.zod.ts:3/4, packages/runtime/src/domains/meta.ts:1/4, examples/app-showcase/src/coverage.ts:1, packages/lint/src/validate-ai-agent-authoring.ts:1, packages/metadata-core/src/contract-suite.ts:1, packages/metadata-core/src/types.ts:1, packages/metadata-protocol/src/package-writability.ts:1, packages/metadata-protocol/src/sys-metadata-repository.ts:13, packages/objectql/src/engine.ts:1, packages/platform-objects/src/audit/sys-job.object.ts:1, packages/plugins/plugin-security/src/object-posture-gate.ts:1, packages/plugins/plugin-security/src/permission-set-overlay-discard.ts:1, packages/plugins/plugin-security/src/permission-set-projection.ts:2, packages/plugins/plugin-security/src/security-plugin.ts:2, packages/spec/src/kernel/index.ts:1, packages/spec/src/kernel/metadata-create-seeds.ts:1, packages/spec/src/kernel/metadata-type-schemas.ts:1, packages/spec/src/system/email-template.zod.ts:1",
      "code_reads": "protocol.ts:15845 (OVERLAY_ALLOWED_TYPES, read by isOverlayAllowed :15976, whose callers are refusePackagedBaseOverride :17171, refusePackagedBaseRemoval :17278, saveMetaItem :20172, migrateStoredMetadata :21644, historyMetaItem :21830, publish/promote :22266, rollbackMetaItem :26075, deleteMetaItem :26619/:26722, and orgScopedWriteRefusal :16210 which S4 deletes); sys-metadata-repository.ts:316 (its own OVERLAY_ALLOWED_TYPES, read by assertAllowed :1789/:1849); protocol.ts getMetaTypes :7883/:7884/:7953 (the wire field and its env-hatch elevation).",
      "author_facing_strings": "protocol.ts :16099 and :16118 (code-only refusals), :17247 (package-door sentence 'has not opted into per-org overlay writes (allowOrgOverride=false)'), :21650 (migrate-stored reason); sys-metadata-repository.ts :1854, :1855, :1975, :1983. All name the key and survive into the rename."
    },
    "c_declaration_docs_history_governed": {
      "declaration": "packages/spec/src/kernel/metadata-plugin.zod.ts:47 (key :267, TSDoc :253-266, 28 registry rows, the customizationPolicies tombstone prescription :513-520 that ships on 17.x and names the key, and about 15 rationale comments).",
      "docs": "packages/spec/liveness/README.md:2, packages/spec/liveness/capability.json:1, packages/spec/liveness/job.json:1, docs/qa/platform-checklist/areas/studio-authoring.json:18, content/docs/concepts/metadata-lifecycle.mdx:8, docs/qa/platform-checklist/areas/platform-core.json:5, docs/qa/platform-checklist/areas/ai.json:3, content/docs/plugins/adding-a-metadata-type.mdx:3, docs/qa/platform-checklist/areas/records-forms.json:2, docs/qa/platform-checklist/areas/integration-system.json:2, docs/qa/platform-checklist/areas/automation.json:2, docs/qa/platform-checklist/FOLLOW-UPS.md:2, docs/audits/2026-06-ask-build-agent-development-assessment.md:2, content/docs/permissions/capabilities.mdx:2, content/docs/kernel/contracts/metadata-service.mdx:2, content/docs/ai/agents.mdx:2, docs/qa/platform-checklist/RUNNER.md:1, content/docs/protocol/objectui/concept.mdx:1, content/docs/permissions/authorization.mdx:1, content/docs/deployment/environment-variables.mdx:1, content/docs/automation/jobs.mdx:1, content/docs/api/metadata-api.mdx:1, content/docs/api/declarative-endpoints.mdx:1",
      "generated": "packages/spec/src/migrations/registry.ts:4, packages/spec/authorable-defaults/kernel.json:1, packages/spec/authorable-surface.base.json:1, packages/spec/authorable-surface/kernel.json:1, content/docs/references/api/protocol.mdx:3, content/docs/references/kernel/metadata-plugin.mdx:3, content/docs/references/system/email-template.mdx:1, docs/protocol-upgrade-guide.md:2",
      "adr_0087_ledger_prose": "packages/spec/src/migrations/entries/retired-keys/18.kernel__MetadataPluginConfig__customizationPolicies.ts:1, packages/spec/src/migrations/entries/semantic/17.api-runtime-create-withdrawn.ts:1, packages/spec/src/migrations/entries/semantic/17.field-runtime-create-withdrawn.ts:1, packages/spec/src/migrations/entries/semantic/18.metadata-customization-protocol-retired.ts:1. The two 17.* entries describe the shipped v17 refusal body and stay; the two 18.* entries are unreleased (spec latest 17.7.0, pre mode 'next') and present the key as the live mechanism.",
      "tooling": "scripts/check-overlay-whitelist-table.mjs:26, scripts/adr-anchors/packages__spec__src__kernel__metadata-plugin.zod.ts.json:1, scripts/adr-anchors/packages__plugins__plugin-security__src__permission-set-projection.ts.json:1",
      "history_never_edited": ".changeset/22203-position-package-door.md:1, .changeset/22220-package-door-before-gates.md:2, packages/metadata-protocol/CHANGELOG.md:58, packages/spec/CHANGELOG.md:33, packages/runtime/CHANGELOG.md:15, packages/rest/CHANGELOG.md:13, packages/objectql/CHANGELOG.md:10, packages/plugins/plugin-security/CHANGELOG.md:5, packages/lint/CHANGELOG.md:5, packages/metadata-core/CHANGELOG.md:4, packages/platform-objects/CHANGELOG.md:3, packages/metadata/CHANGELOG.md:1. The two .changeset files are other PRs' pending release inputs.",
      "governed": "docs/adr/0005-metadata-customization-overlay.md:12, docs/adr/0010-metadata-protection-model.md:9, docs/adr/0094-sys-permission-set-pure-projection.md:5, docs/adr/0070-package-first-authoring.md:5, docs/adr/0029-kernel-object-ownership-and-platform-objects-decomposition.md:4, docs/adr/0126-packaged-metadata-customization-model.md:2, docs/adr/0086-authz-metadata-config-boundary-and-cross-package-composition.md:2, docs/adr/0046-package-docs-as-metadata.md:2, skills/objectstack-ai/SKILL.md:1, docs/adr/0131-total-organization-ownership-no-null-organization-id.md:1, docs/adr/0109-ai-tool-authoring-model.md:1, docs/adr/0063-two-kernel-agents-skills-are-the-extension-primitive.md:1, docs/adr/0027-metadata-authoring-lifecycle.md:1, docs/adr/0015-external-datasource-federation.md:1, AGENTS.md:1",
      "governed_lines_a_carrier_must_change": "AGENTS.md:190-192 (Prime Directive #7: 'Org overlay opt-in lives only in allowOrgOverride on DEFAULT_METADATA_TYPE_REGISTRY', false twice once #15206 and this card land); skills/objectstack-ai/SKILL.md:347 (published skill, 'allowOrgOverride:false' on agent); docs/adr/0005 :47 and :68 (normative current-state sentences; the file already carries the v5.0 rename note at :3 as the shape for a top note); docs/adr/0010 :19, :94, :119-122 (the L1 type-level knob). The remaining ADR hits (0015, 0027, 0029, 0046, 0063, 0070, 0086, 0094, 0109, 0126, 0131) record decisions under the name of their time and need no rewrite; 0029:386 carries an ungated '#allowOrgOverride' symbol anchor. .claude/** has 0 hits."
    },
    "d_tests": {
      "pins_a": "packages/metadata-core/src/meta-write-capability.test.ts:4, packages/metadata-core/src/meta-write-org-scope.test.ts:2, packages/metadata-protocol/src/get-meta-item-cached-etag-scope.test.ts:8, packages/metadata-protocol/src/get-meta-item-layered-org-read-gate.test.ts:4, packages/metadata-protocol/src/get-meta-item-org-read-gate.test.ts:4, packages/metadata-protocol/src/get-meta-items-org-read-gate.test.ts:3, packages/metadata-protocol/src/protocol-publish-drafts-advisories.test.ts:1, packages/metadata-protocol/src/protocol-publish-drafts-org-scope.test.ts:3, packages/metadata-protocol/src/protocol-publish-drafts-package-scope.test.ts:1, packages/metadata-protocol/src/protocol.lock-org-axis-agree.test.ts:1, packages/metadata-protocol/src/protocol.metadata-store-outage.test.ts:1, packages/metadata-protocol/src/protocol.org-scoped-cold-boot-audit-live-registry.test.ts:1, packages/metadata-protocol/src/protocol.org-scoped-cold-boot-audit.test.ts:6, packages/metadata-protocol/src/protocol.org-scoped-write-refused.test.ts:9, packages/metadata-protocol/src/protocol.publish-item-draft-org-scope.test.ts:2, packages/objectql/src/overlay-precedence.test.ts:16, packages/objectql/src/protocol-meta.test.ts:10, packages/objectql/src/protocol-org-overlay-registry-gate.test.ts:2, packages/objectql/src/publish-meta-response-conformance.test.ts:2, packages/objectql/src/publish-package-drafts-response-conformance.test.ts:1, packages/rest/src/meta-item-save-capability-gate.test.ts:1, packages/rest/src/meta-publish-package-scope.test.ts:1, packages/rest/src/meta-write-door-capability-enumeration.test.ts:2, packages/rest/src/rest-server-meta-cached-etag-door-scope.test.ts:2, packages/rest/src/rest-server-meta-history-diff-org-scope.test.ts:4, packages/rest/src/rest-server-meta-org-scope-url-spelling.test.ts:2, packages/rest/src/rest-server-meta-read-org-scope.test.ts:7, packages/rest/src/rest-server-meta-write-org-scope.test.ts:4, packages/runtime/src/domains/meta-save-capability-gate.test.ts:2, packages/runtime/src/domains/packages-seed-apply-org-scope.test.ts:3, packages/runtime/src/meta-write-org-scope.test.ts:10, packages/runtime/src/package-duplicate-adopt-org-scope.integration.test.ts:1",
      "pins_a_by_15206_stage": "S3 14 files / 45 hits (the core and runtime meta-write-org-scope tests, the capability-gate and door tests in rest and runtime, the rest org-scope read/write/history/etag/url-spelling suites, packages-seed-apply and package-duplicate-adopt); S4 9 files / 45 (protocol.org-scoped-write-refused, the identity pin, :550 lists exactly the five; publish-item-draft and publish-drafts org/package scope and advisories; objectql overlay-precedence, protocol-meta, publish-meta and publish-package-drafts conformance); S5 9 files / 30 (the four get-meta-item(s) read-gate suites incl. cached-etag, lock-org-axis-agree, metadata-store-outage, both cold-boot audits, objectql protocol-org-overlay-registry-gate).",
      "pins_b": "packages/metadata-protocol/src/protocol.adr0005-org-override-rollback.test.ts:9, packages/metadata-protocol/src/protocol.capability-write-door.test.ts:1, packages/metadata-protocol/src/protocol.code-only-types.test.ts:5, packages/metadata-protocol/src/protocol.delete-receipt-wording.test.ts:7, packages/metadata-protocol/src/protocol.delete-rewrap-envelope.test.ts:4, packages/metadata-protocol/src/protocol.destructive-gate-reachable-types.test.ts:1, packages/metadata-protocol/src/protocol.diff-dead-history-read.test.ts:1, packages/metadata-protocol/src/protocol.driver-text-disclosure.test.ts:3, packages/metadata-protocol/src/protocol.legacy-overlay-delete.test.ts:10, packages/metadata-protocol/src/protocol.marked-refusal-classification.test.ts:1, packages/metadata-protocol/src/protocol.package-door-before-gates.test.ts:3, packages/metadata-protocol/src/protocol.packaged-base-refusal.test.ts:2, packages/metadata-protocol/src/protocol.read-lock-flags-write-door.test.ts:2, packages/metadata-protocol/src/protocol.read-verb-canonical-fold.test.ts:3, packages/metadata-protocol/src/protocol.recovery-doors-emit-mutation.test.ts:1, packages/metadata-protocol/src/protocol.runtime-gate-stored-universe.test.ts:1, packages/metadata-protocol/src/protocol.save-receipt-wording.test.ts:6, packages/metadata-protocol/src/protocol.stored-migration.test.ts:2, packages/metadata-protocol/src/protocol.unrecognised-meta-type.test.ts:1, packages/metadata-protocol/src/sys-metadata-repository.contract.test.ts:3, packages/metadata-protocol/src/sys-metadata-repository.package-writability.test.ts:14, packages/objectql/src/engine-security-catalog-package-door.test.ts:9, packages/objectql/src/meta-object-search-companion-roundtrip.test.ts:1, packages/objectql/src/protocol-commit-history.test.ts:7, packages/objectql/src/protocol-delete-object-registry-heal.test.ts:1, packages/objectql/src/protocol-meta-effective-schema.test.ts:1, packages/objectql/src/protocol-meta-types-rich.test.ts:11, packages/objectql/src/protocol-object-overlay-layer.test.ts:2, packages/objectql/src/protocol-publish-canonical-fold.test.ts:1, packages/objectql/src/protocol-registry-shadow.test.ts:2, packages/objectql/src/protocol-writepath-object-ownership.test.ts:1, packages/objectql/src/sys-metadata-repository.test.ts:4, packages/platform-objects/src/audit/sys-job.global-unique.test.ts:5, packages/plugins/plugin-security/src/packaged-permission-set-restore-leg.test.ts:1, packages/plugins/plugin-security/src/permission-set-projection.test.ts:3, packages/qa/dogfood/test/showcase-permission-projection.dogfood.test.ts:3, packages/qa/dogfood/test/two-doors-permission.dogfood.test.ts:3, packages/rest/src/rest-meta-packaged-flow-refusal.test.ts:1, packages/runtime/src/meta-field-overlay-lock.test.ts:4, packages/runtime/src/meta-overlay-read-your-writes.test.ts:2, packages/spec/src/data/picklist.test.ts:1, packages/spec/src/kernel/capability-metadata-kind.test.ts:3, packages/spec/src/kernel/metadata-create-seeds.test.ts:2, packages/spec/src/kernel/metadata-customization-retirement.test.ts:1, packages/spec/src/kernel/metadata-type-api-registration.test.ts:4, packages/spec/src/kernel/metadata-type-field-registration.test.ts:3",
      "mixed": "packages/metadata-protocol/src/protocol.flow-org-override-closed.test.ts:9, packages/objectql/src/save-meta-response-conformance.test.ts:2 (flow-org-override-closed pins flow's flag false (b) and its organization-scoped refusal (a); save-meta-response-conformance :239 code-only (b), :309 organization-scoped refusal (a)).",
      "message_text_pins": "Tests that assert a runtime sentence naming the key: (b) protocol.delete-rewrap-envelope.test.ts:343, protocol.legacy-overlay-delete.test.ts:428, protocol.packaged-base-refusal.test.ts:150, sys-metadata-repository.package-writability.test.ts:1350, objectql protocol-commit-history.test.ts:667 and :865, plugin-security packaged-permission-set-restore-leg.test.ts:211 and permission-set-projection.test.ts:156, rest rest-meta-packaged-flow-refusal.test.ts:117, spec metadata-customization-retirement.test.ts:58 (regex on the 17.x tombstone prescription); (a) protocol.org-scoped-write-refused.test.ts:421."
    },
    "sibling_repos": "objectui at the .objectui-sha pin a58626c88 (commit fetched into the shared objectui object store; no checkout moved): 57 files / 154 hits = 11 source files / 49 hits (metadata-admin useMetadata.ts:77 declares its own optional 'allowOrgOverride?: boolean'; registry.ts 3, ResourceEditPage.tsx 12, PermissionMatrixEditor.tsx 17, DirectoryPage.tsx 3, ResourceListPage.tsx 3, PageShell.tsx 1, StudioHomePage.tsx 1, EmbeddedItemEditor.tsx 1, previews/PicklistPreview.tsx 1, i18n.ts 5 user-visible strings naming the key) + 43 test files / 95 + 3 CHANGELOG / 10. cloud: NOT MEASURED, reason: this session's GitHub proxy is repository-scoped (search/code answers 403) and no cloud checkout exists here."
  },
  "five_types": {
    "verified": "DEFAULT_METADATA_TYPE_REGISTRY parsed from source at 54c3ce10c: 28 entries; the flag is true on exactly view (metadata-plugin.zod.ts:855), dashboard (:857), report (:863), translation (:1070), email_template (:1071). supportsOverlay true with the flag false: page, app, dataset, book, permission, position, tool, skill. The card's list holds.",
    "write_path_all_five": "REST PUT /meta/:type/:name rest-server.ts:7050-7052 then p.saveMetaItem :7307; dispatcher runtime/src/domains/meta.ts:1287 then saveMetaItem :1464. protocol.ts saveMetaItem :20023: type gate :20172 (isOverlayAllowed :15976, OVERLAY_ALLOWED_TYPES :15842-15851, the flag read at :15845, OS_METADATA_WRITABLE hatch envWritableTypes :15865), package door :20317 into refusePackagedBaseOverride :17168 (:17171), then repo.put :21129 into SysMetadataRepository.assertAllowed sys-metadata-repository.ts:1781 (:1789, set at :314-317, flag read at :316). Reset/remove: deleteMetaItem :26576 (:26619, :26722).",
    "read_path_all_five": "No served read consults the flag; the read keys on supportsOverlay (mergesOverlayAtRead :15969). getMetaItem :10046 via findServedOverlayRow :9976 and servedOverlayRowCandidates :2032; getMetaItems :8851 via mergePackageAwareOverlay :2160 (:9120); getMetaItemLayered :10647. A server-side rename therefore cannot hide a stored overlay; the loss risks are the two write-side derivations and the Studio gate.",
    "studio_gate_all_five": "GET /meta/types: protocol.ts getMetaTypes :7830 emits the flag (:7883-7886, synthesized :7953), typed by spec api/protocol.zod.ts:210 (GetMetaTypesResponseSchema :202) and by @objectstack/client meta.getTypes (client/src/index.ts:1754, :7629). objectui pin a58626c88 ResourceEditPage.tsx:1357-1359 and :1775-1778: canWriteByType for an artifact-backed item is !!entry.allowOrgOverride. With the wire renamed and objectui unchanged, every packaged item of the five types opens read-only in Studio: the overlay is lost at the authoring door, silently.",
    "view": "Flag :855. Pins of an environment overlay of a packaged item: runtime/src/meta-field-overlay-lock.test.ts:552 (dispatcher PUT, 200, row stored), metadata-protocol/src/protocol.packaged-base-refusal.test.ts:94 (package-door verdict null for save and delete), metadata-protocol/src/sys-metadata-repository.package-writability.test.ts:325 (repository put lands); served read: qa/dogfood view-container-cross-package-default.dogfood.test.ts:113 (names no key); wire: objectql/src/protocol-meta-types-rich.test.ts:91.",
    "dashboard": "Flag :857. Pin: runtime/src/meta-field-overlay-lock.test.ts:563 (dispatcher PUT over the packaged system_overview, 200, row stored). No served-read or wire pin found.",
    "report": "Flag :863. NO pin of an environment overlay of a packaged report found. Its only pins are organization-scoped, class (a): objectql/src/overlay-precedence.test.ts:154 (organizationId org_alpha, not a packaged item) and the five-type identity pin protocol.org-scoped-write-refused.test.ts:550; #15206 S4 flips both.",
    "translation": "Flag :1070. Extra reader: core/src/fallbacks/authored-translation-sync.ts:115 readAuthoredTranslationLayer (sys_metadata type translation, every organization, :126) into the i18n authored layer; it reads no flag. NO pin of an environment overlay of a packaged translation found; only the (a) identity pin :550.",
    "email_template": "Flag :1071. Extra reader: plugin-email/src/email-plugin.ts:1325 readEffectiveTemplate (getMetaItem :1335, projected into sys_email_template); bootstrap-declared-email-templates.ts readDeclared reads the Default-Organization layer (class a, #15206 S3). Pin: objectql/src/engine-security-catalog-package-door.test.ts:262 (saveMetaItem over a packaged template on both topologies, row stored). The served-read dogfood email-template-overlay-survives-boot.dogfood.test.ts is organization-scoped by construction (orgContext: true) and names no key.",
    "search_method": "Test files naming the type literal AND an artifact marker (_packageId, getArtifactItem, packaged) AND a write (saveMetaItem, PUT), each read; plus dogfood 'PUT /meta/TYPE' scans. 'None found' is that search's reading, not a proof of absence."
  },
  "conversion": {
    "entry_points": "None carries a registry entry. (1) The type registry: MetadataTypeRegistryEntryBaseSchema metadata-plugin.zod.ts:207-267; its only writer is the TypeScript literal DEFAULT_METADATA_TYPE_REGISTRY :714 typed MetadataTypeRegistryEntryParsed[] (never parsed), installed by setTypeRegistry at packages/metadata/src/plugin.ts:411; MetadataTypeRegistryEntrySchema has 0 non-test parse sites. (2) Plugin manifest: contributes.kinds[] is a closed strictObject of id, globs (tombstone) and description (kernel/manifest.zod.ts:696-715), so the key would be an unrecognized key. (3) MetadataPluginConfig.additionalTypes is a retiredKey tombstone (:561) since 17. (4) defineStack / stack.zod.ts: no type-registry collection. (5) Stored rows: no sys_metadata type stores registry entries. The key only leaves the platform, on GET /meta/types.",
    "precedent": "conversions/registry.ts has no entry that renames a key on a registry or config entry; every rename walks a stack (objectCompactLayoutRename :225, stackRolesToPositions :264; manifestPermissionsStringListRemoved :8961 reaches stack.manifest and packages[].manifest). The non-stack rename precedent is in migrations: retired-keys/18.kernel__HotReloadConfig__debounceDelay.ts quotes 'Tombstoned with `retiredKey()`: `HotReloadConfigSchema` is not `.strict()`, so a bare deletion would silently strip the key ... No D2 conversion: not a stack collection member, not a stored row' (schema shape: debounceDelayMs plugin-lifecycle-advanced.zod.ts:380 beside 'debounceDelay: retiredKey(...)' :384; D3 entry kernel-health-check-and-hot-reload-durations-unit-in-key). The same registry's retired-keys/18.kernel__MetadataPluginConfig__additionalTypes.ts quotes 'Registered here but NOT in `src/conversions/registry.ts` ... a MetadataConversion here would be a transform with no seam that ever runs.' The converse, retired-keys/18.api__ApiEndpoint__cacheTtl.ts, gets a D2 entry only because 'apis: is a stack collection'.",
    "d2_reading": "A D2 conversion for this key would be a declared transform the loader never applies. The acceptance pin 'a manifest with the old key loads and converts to the new one' cannot be written: no manifest can carry the key. See open question 1.",
    "baselines_that_change": "packages/spec/authorable-surface/kernel.json:347 (gen:schema; the old path becomes ' [RETIRED]' under a tombstone), authorable-defaults/kernel.json:70 (the '= false' fingerprint), src/migrations/registry.ts (generated barrel, new retired-key + D3 entries), spec-changes.json and docs/protocol-upgrade-guide.md (gen:spec-changes, gen:upgrade-guide), content/docs/references/kernel/metadata-plugin.mdx:271, references/api/protocol.mdx:1422/:1428 (wire field), references/system/email-template.mdx:15 (TSDoc of system/email-template.zod.ts:16).",
    "baselines_that_do_not_change": "Measured by grep, the property name is absent from: api-surface/ (export names only: MetadataTypeRegistryEntry*, GetMetaTypesResponse*), export-origins/, json-schema.manifest/kernel.json (schema ids), declaration-map/, api-surface-signatures.json (define* factory hashes; none takes a registry entry), dropped-refinements.baseline.json (sites carry no key), liveness/ (no ledger row for kernel/MetadataTypeRegistryEntry; 3 prose notes only). authorable-surface/api.json tracks GetMetaTypesResponse:entries and :types only, so the wire rename is invisible to every spec gate except the regenerated reference page.",
    "not_written_by_the_rename_pr": "authorable-surface.base.json:4262: only gen:authorable-surface-base writes it; the deletion gate needs the RETIRED_KEYS_BY_MAJOR registration instead (packages/spec/scripts/build-schemas.ts :805-813, :954-961).",
    "gates_reached": "check:authorable-surface (live to absent refused without a retired-key registration), check:overlay-whitelist-table (scripts/check-overlay-whitelist-table.mjs COL_FLAG :255 reads the registry column and the table header content/docs/concepts/metadata-lifecycle.mdx:109; legs 1-3 plus its self-test fixtures), check:platform-checklist (anchors 'metadata-plugin.zod.ts#allowOrgOverride' at docs/qa/platform-checklist/areas/platform-core.json:492 and studio-authoring.json:1257; a tombstone keeps the word at line start, so those stale anchors would still resolve), check:docs, check:spec-changes, check:upgrade-guide, check:adr-0087-registration."
  },
  "name_candidates": [
    {
      "name": "allowEnvironmentOverlay",
      "reads_at_call_sites": "Row: { type: 'report', supportsOverlay: true, allowEnvironmentOverlay: true, allowRuntimeCreate: true }. Derivation: if (!entry.allowEnvironmentOverlay) continue. Sentence: 'the type does not allow environment overlays (allowEnvironmentOverlay=false)'. objectui: isArtifactItem ? !!entry.allowEnvironmentOverlay : ...",
      "collisions": "Exact (git grep -w, whole tree): 0. Near: supportsOverlay on the same entry (the read-path capability; the intended pair); overlayScope 'env' (api/protocol.zod.ts:537, the same scope vocabulary); capabilities.overlay on MetadataPluginConfig (metadata-plugin.zod.ts:672, a plugin capability); the retired persistence.overlayWritable (kernel/metadata-loader.zod.ts:193). Confusable: the wire entry's overrideSource 'env' and OS_METADATA_WRITABLE use 'env' for an environment VARIABLE.",
      "four_axes": "Business need (measured): writers are DEFAULT_METADATA_TYPE_REGISTRY, test fixtures and the getMetaTypes synthesis only; readers are two write-gate derivations, the wire field and 11 objectui source files. That holds for every candidate, so this axis does not separate them. Long-term: names the scope in the canonical ADR-0006 spelling and the mechanism noun ADR-0005 and supportsOverlay use; stays unambiguous if a per-organization axis returns (ADR-0131 D6 retires it 'for now'). AI error: the capability/permission pair (supportsOverlay vs allowEnvironmentOverlay) states the #6960 distinction in the names; the env-variable reading is the residual risk. Startup: one rename, no new capability."
    },
    {
      "name": "allowEnvironmentOverride",
      "reads_at_call_sites": "Row: { type: 'view', supportsOverlay: true, allowEnvironmentOverride: true }. Sentence: '(allowEnvironmentOverride=false)'. Wire entry: { allowEnvironmentOverride: true, overrideSource: 'env' }.",
      "collisions": "Exact: 0. Near: overrideSource 'registry'|'env' on the same /meta/types entry (api/protocol.zod.ts:216), where 'env' means OS_METADATA_WRITABLE; the code NOT_OVERRIDABLE and the write intent override-artifact (metadata-core/src/types.ts:158) share the stem; configOverrides (system/app-install.zod.ts:113) is unrelated.",
      "four_axes": "Business need: as above. Long-term: the smallest edit from the old name, but it keeps the override/overlay split (ADR-0005 and supportsOverlay say overlay). AI error: the most guessable old-to-new mapping; the strongest misreading of the three, since 'environment override' beside overrideSource 'env' reads as 'overridden by an environment variable'. Startup: one rename."
    },
    {
      "name": "allowPackagedOverlay",
      "reads_at_call_sites": "Row: { type: 'translation', supportsOverlay: true, allowPackagedOverlay: true }. Sentence: 'the type does not allow overlays of packaged items (allowPackagedOverlay=false)'. objectui: isArtifactItem ? !!entry.allowPackagedOverlay : ...",
      "collisions": "Exact: 0 ('packagedOverlay' appears once, in prose). Near: ADR-0126's 'packaged base' vocabulary (29 hits in packages/spec/src) reads as intended; but 'packaged overlay' also reads as an overlay that ships in a package (ADR-0070 package-first authoring; overlay rows carry the package_id of the package they customize).",
      "four_axes": "Business need: as above. Long-term: names the object (the artifact-backed item that the override-artifact intent gates) and drops the scope; if a per-organization axis returns, one scope-less key would again govern two scopes, the shape ruling C closed. AI error: free of the env-variable clash; open to the 'overlay from a package' misreading. Startup: one rename."
    }
  ],
  "name_candidates_excluded": "overlayWritable (a retired key's name on MetadataManagerConfig.persistence, metadata-loader.zod.ts:193; a live key sharing a tombstone's name confuses both prescriptions); allowOverlay / overlayable (scope- and object-less, beside capabilities.overlay). The choice is the contract review's; no pick is made here.",
  "stage_plan": [
    {
      "stage": "S0",
      "what": "This measurement. No file, no PR.",
      "clause_2": "n/a"
    },
    {
      "stage": "S1",
      "what": "Environment-overlay pins for the five types, tests only, under the current key name.",
      "files": "One new test file in packages/objectql/src on the real SchemaRegistry + protocol, both topologies (engine-security-catalog-package-door.test.ts is the harness model); optionally a dispatcher case in packages/runtime/src. Per type: PUT env-wide (no organization) over a packaged item is accepted, the row is stored with organization_id NULL, GET serves the overlay body, /meta/types advertises the flag true; identity: the true set is exactly the five.",
      "clause_2": "no (tests only; nothing in any package's files[] moves).",
      "serial": "Independent of every open PR and of #15206; must not pass organizationId so S3/S4 leave it standing. Reverse verification: commit, then flip report's flag to false, its case goes red; restore.",
      "why_now": "Report and translation have no environment-overlay pin, and #15206 S3/S4 rewrite the write doors all five pass through (organizationIdForMetaWrite, orgScopedWriteRefusal). Landing before S3 makes 'no overlay is lost' checkable during #15206, not only after it.",
      "estimate": "S"
    },
    {
      "stage": "S2",
      "what": "The rename: new key, retiredKey() tombstone on the old one, retired-keys + D3 entries (no D2 entry, per open question 1), the wire field renamed with objectui in the same landing (open question 2).",
      "files": "spec: kernel/metadata-plugin.zod.ts (key :267 + TSDoc, 28 rows, comments, the customizationPolicies prescription :513-520), api/protocol.zod.ts :210/:216/:1667, system/email-template.zod.ts:16, kernel/index.ts:31, kernel/metadata-create-seeds.ts:141, kernel/metadata-type-schemas.ts:142, new migrations/entries/retired-keys/18.kernel__MetadataTypeRegistryEntry__allowOrgOverride.ts and a semantic 18.* entry, the two unreleased 18.* prose entries, regenerated registry.ts / authorable-surface/kernel.json / authorable-defaults/kernel.json / spec-changes.json / protocol-upgrade-guide.md / 3 reference pages, 6 spec tests. Runtime: protocol.ts (the 41 class-(b) lines; code :15845, :7883/:7884/:7953; sentences :16099/:16118/:17247/:21650), sys-metadata-repository.ts (13), package-writability.ts, metadata-core types.ts/contract-suite.ts, runtime domains/meta.ts:967, objectql engine.ts, plugin-security (4 files, comments), platform-objects sys-job.object.ts, lint validate-ai-agent-authoring.ts, examples/app-showcase coverage.ts. Tooling: check-overlay-whitelist-table.mjs (+ self-test), 2 adr-anchors. Docs: 11 content/docs pages, 8 docs/qa/platform-checklist files (re-point both '#allowOrgOverride' anchors explicitly), 3 liveness notes. Tests: the 46 class-(b) files + residue of the 2 mixed; the 10 message-text pins move with their sentences. Cross-repo: an objectui PR (11 source + about 43 test files at the pin) and, in this PR, the .objectui-sha bump with the regenerated SDUI manifest.",
      "clause_2": "yes (narrowing): widens (a new authorable key and wire field), narrows (the authorable key and the GetMetaTypesResponse field are retired). BREAKING; changeset carries FROM allowOrgOverride TO NEW_KEY on MetadataTypeRegistryEntry and GET /meta/types entries, and 'adr-0087: registered' naming the two new ids. Contract-tier review owed (dispatch-gates --tier: no path mandate; clause-② suspect on both spec paths).",
      "serial_vs_15206": "After #15206 S5 (hence after S2-S4). S1 (sys_view_definition): only the migrations barrel, regenerate. S2 (seal): rewrites refusePackagedBaseOverride/Removal :17168-17290 and the repository hatch :370, the same sentence (:17247) and repository messages (:1854-1983) this stage renames. S3: deletes ORG_OVERRIDABLE_TYPES (a flag reader), the manage_org_presentation arm and capability, door threading, 14 test files. S4: deletes the :16210 exemption, the :16215 sentence and the identity pin, 9 test files. S5: removes the :27554 flag read and 9 read-gate test files.",
      "serial_vs_open_prs": "#22215 (PROTOCOL_VERSION 18; spec-changes.json, protocol-upgrade-guide.md): land after it and regenerate. #22323 (protocol.ts :22697-22778, sys-metadata-repository.ts :81-1379, api/protocol.zod.ts :1781-1800, references/api/protocol.mdx): textually disjoint from this stage's hunks, regenerate the reference page. #22322 (references/api/protocol.mdx) and #22315 (migrations/registry.ts + an 18.* semantic entry): regenerate. #22352, #22351, #22354, #22353, #22347, #22341, #22339, #22327, #22268: no file in common. #21988 (Version Packages): CHANGELOGs only, never edited here (its file list read to page 1 of 2).",
      "pins": "The five S1 cases flip to the new key and gain the served-read leg; a tombstone pin (parse of the old key is refused with a prescription naming the new key, code + path); /meta/types carries the new key true for the five and no old key; check:overlay-whitelist-table self-test on the new column. Reverse verification: flip one of the five to false, its case red.",
      "estimate": "L (about 110 files with the objectui companion; changed lines well under 5,000)"
    },
    {
      "stage": "S3",
      "what": "Governed text, Tier H, its own PR after S2 merges; fold #15206 S7 (ADR-0005 note) into it if both are cut.",
      "files": "AGENTS.md:190-192, skills/objectstack-ai/SKILL.md:347, docs/adr/0005 (top note in the shape of its :3 v5.0 note, plus :47/:68), optionally docs/adr/0010 status note.",
      "clause_2": "no. dispatch-gates --tier on this surface: MANDATORY claude-fable-5-1 (skills/**, no one-line exemption). skills line budget: one-line in-place edits, report whole-file and whole-catalog line counts.",
      "estimate": "S"
    }
  ],
  "order_recommendation": "S1 now; S2 after #15206 S5 merges; S3 after S2. Measured reasons: (1) wasted work: 166 of the 408 code and test hits (46 source hits in 14 files, 120 test hits in 32 files) are in code #15206 S3-S5 delete or rewrite. (2) Meaning: until S4, orgScopedWriteRefusal exempts organization-scoped writes of exactly the flag's types (protocol.ts:16210); until S3, organizationIdForMetaWrite/Read thread the organization only for them (meta-write-org-scope.ts:99, :141, :189); until S5, reportUnhydratableOrgScopedRows treats their organization rows as legitimate (:27554). A key renamed to an environment name before then still governs organization scope, ruling C's rejected B shape inverted. (3) Conflict: S3-S5 are L-sized PRs over protocol.ts, rest-server.ts, runtime meta.ts and the same test files. The card's 'either order or in parallel' holds for the DELETION (it never needs the new name), not for the rename.",
  "falsified_premises": [
    "F1 'An ADR-0087 D2 load-time conversion, so a manifest naming the old key still loads unchanged' / acceptance 'a manifest with the old key loads and converts': no manifest, stack, plugin config or stored row can carry a type-registry entry (conversion.entry_points), so a D2 entry has no seam. The recorded non-stack precedent is tombstone + retired-key + D3 (conversion.precedent). The ruling's intent, that no author hand-edits anything, holds vacuously: no author can write the key today.",
    "F2 'Clause-②: yes' (card) / 'yes (widening: a new published key ...)' (claim): the rename also retires an authorable key and a published wire field, so by the arm table in scripts/pm/clause2-line.mjs, where yes (narrowing) is 'a diff that widens one surface and narrows another', it is yes (narrowing), BREAKING, with a FROM/TO migration and a registered ADR-0087 disposition.",
    "F3 Scope 'generated baselines and docs follow' is incomplete: the rename also reaches GET /meta/types entries[].allowOrgOverride (spec api/protocol.zod.ts:210, @objectstack/client meta.getTypes) and objectui at the pin (11 source files, Studio's write gate for packaged items of the five types), runtime sentences naming the key (8 sites, pinned at 9 test sites in 8 files), two gates (check:overlay-whitelist-table reads the column name in code and in the docs table; check:platform-checklist resolves two symbol anchors), and the 17.x customizationPolicies tombstone prescription.",
    "F4 'The two cards land in either order or in parallel': true for #15206's deletion; for this card's rename, landing before #15206 S5 renames 166 hits of code S3-S5 delete and ships an environment-named key that still decides organization scope (order_recommendation).",
    "F5 'No overlay is lost' pins: today only view, dashboard and email_template have a pin of an environment overlay of a packaged item; report and translation have none, and their organization-scoped pins are #15206 S4's to flip (five_types).",
    "Confirmed, not falsified: the five types (28 entries, exactly five true); the key at metadata-plugin.zod.ts:267 with describe 'Allow per-org overlay writes via runtime metadata API'; the claim's 176 files and 60 protocol.ts hits; #15206 uses the key under its current name and its deletion does not depend on the name; isOverlayAllowed has no organization branch of its own (it is :15976; the per-organization path is orgScopedWriteRefusal :16203-16231 and the door helpers)."
  ],
  "open_questions": [
    {
      "question": "Q1. The ruled 'ADR-0087 D2 load-time conversion' has no seam (F1). What carries the old key's prescription instead?",
      "options": [
        "A. retiredKey() tombstone on MetadataTypeRegistryEntryBaseSchema + retired-keys entry 18.kernel__MetadataTypeRegistryEntry__allowOrgOverride + a D3 semantic entry; no D2 entry (the HotReloadConfig.debounceDelay and MetadataPluginConfig.additionalTypes precedents). Cost: two ledger files and a tombstone pin.",
        "B. Register a D2 conversion anyway to meet the ruling's letter. Cost: a conversion entry no loader ever applies; the precedent text calls it 'a transform with no seam that ever runs'.",
        "C. Plain rename with no tombstone and no ledger entry. Refused mechanically: check:authorable-surface rejects live-to-absent without a retired-key registration, and AGENTS.md requires a tombstone for a removed authorable key."
      ],
      "recommendation": "A. Business need: measured, zero manifests or stored rows can name the key, so no author needs a load-time rewrite; the readers that matter are TypeScript code and wire consumers, which the compiler and the tombstone reach. Long-term: two recorded precedents of the same shape. AI error: the tombstone refuses the old key loudly at parse and compile with the new name in the prescription; B declares a capability the runtime never exercises (declared is not enforced). Startup: no window, no dead ledger row. This replaces the ruling's mechanism, not its direction, so it needs triage or the contract review to record it."
    },
    {
      "question": "Q2. The /meta/types wire field (GetMetaTypesResponseSchema entries[].allowOrgOverride) is the same key's projection and objectui's Studio write gate. How does it move?",
      "options": [
        "A. Rename it in S2, in one landing with an objectui PR that reads the new key and the .objectui-sha bump (+ SDUI manifest regeneration). Cost: a cross-repo landing; the objectui PR merges just before S2 so objectui main does not run long against the old server.",
        "B. Keep the wire name allowOrgOverride for now and rename only the authoring key. Cost: the wire keeps a key that says 'organization' and governs environments, read by Studio and by AI clients of /meta/types.",
        "C. Emit both names for one release. Cost: a dual-spelling window and a consumer-side fallback in objectui."
      ],
      "recommendation": "A. Business need: objectui is the measured reader (11 source files at the pin; every packaged item of the five types). Long-term: one name end to end. AI error: B is ruling C's rejected B shape on the wire; and objectui's own optional field type means neither the Console Pin Gate nor api-surface would see a missed objectui side, so the same landing is the only safe form. Startup: C is a dual-spelling window, which this stage of the company does not take without named external users; none measured (cloud NOT MEASURED)."
    }
  ],
  "out_of_scope_findings": [
    "class: b (stated contract) · reach: NOT MEASURED, no public-door run · sys-metadata-repository.ts:362-363 states both write gates 'must consult the same elevated set', but the repository reads readEnvWithDeprecation('OS_METADATA_WRITABLE', []) (:370) while protocol.ts:15867 also honours the legacy OBJECTSTACK_METADATA_WRITABLE; by reading, with only the legacy variable set /meta/types advertises the type writable and the protocol gates pass, while the repository's assertAllowed would refuse the write. objectui PageShell.tsx:110 and useMetadata.ts:87 name the legacy variable to users · dedupe words: OS_METADATA_WRITABLE, OBJECTSTACK_METADATA_WRITABLE, envWritableMetadataTypes, readEnvWithDeprecation · carrier: #15206 S2 (the seal stage edits both hatch readers); noted, not filed",
    "The key's TSDoc (metadata-plugin.zod.ts:262-265) says only view and dashboard opt in and names 'not_overridable' in lower case; five opt in and the code is NOT_OVERRIDABLE · carrier: S2 of this card (it rewrites that TSDoc); noted, not filed",
    "The 17.x customizationPolicies tombstone prescription (metadata-plugin.zod.ts:513-520), the unreleased 18.metadata-customization-protocol-retired entry and kernel/index.ts:31 direct authors to 'ADR-0005's org-scoped overlay (opt-in via allowOrgOverride)', false twice once #15206 and this card land; pinned by metadata-customization-retirement.test.ts:58 · carrier: S2 of this card; noted, not filed",
    "qa/dogfood email-template-overlay-survives-boot.dogfood.test.ts pins the email-template overlay as organization-scoped by construction (orgContext: true); after #15206 S3 the save lands env-wide · carrier: #15206 S3; noted, not filed",
    "A tombstone keeps 'allowOrgOverride' at line start in metadata-plugin.zod.ts, so the two checklist anchors naming metadata-plugin.zod.ts#allowOrgOverride would keep resolving to the tombstone with check:platform-checklist green; docs/adr/0029:386 holds a third, ungated · carrier: S2 (re-point the checklist anchors) and S3 (ADR) of this card; noted, not filed"
  ],
  "tests": "No build and no test ran; stage 0 writes no file. Read-only probes in ../objectstack-issue-22340 at 54c3ce10c, git status --porcelain empty throughout: (1) git grep census with glob pathspecs and controls (census.command_and_controls); every hit line read and classed. (2) Registry entries parsed from source with a node one-liner (28 entries, five true). (3) objectui at the pin: git fetch of a58626c88 into the shared objectui object store, then git grep at that commit (no checkout change). (4) node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --tier on the S2 and S3 surfaces (no path mandate for S2, clause-② suspect on spec paths; MANDATORY fable for S3). (5) npm view @objectstack/spec dist-tags: latest 17.7.0, so 18.* entries are unreleased. (6) REST reads: card #22340 + 1 comment, #15206 + 11 comments incl. report 6067752061, #22007 + ruling 6028809298, open-PR list (14) and each PR's file list, PRs 22338/22331/22319 state, the 22323 patch hunks.",
  "mcp_calls": "0 — no MCP tool called",
  "api_writes": "1 — POST /repos/objectstack-ai/objectstack/issues/22340/comments (this os-dev-report, through scripts/pm/post-stamped.mjs and the fleet-write relay)",
  "gates": "not applicable — stage 0 writes no file. Derived: none (dispatch-gates without paths: 'this branch changes nothing against origin/main ... nothing to derive'). Run: none. Exit codes: none. --ran verdict line: not run.",
  "line_budget": "0 changed lines against merge base 54c3ce10c (git diff --stat empty); governed paths touched: 0.",
  "deviations": [
    "Did not push the empty branch (os-dev rule 1). The dispatch forbids any push in stage 0 and no edit happened, so neither the landing marker nor the write-route probe had anything to mark; os-dev says the role file prevails on conflict, so this is flagged for the seat rather than chosen silently.",
    "No pnpm install in the worktree: no edit, build or test.",
    "Classification reads each hit line by what it governs; three source files are split by line and two test files are mixed (census.method).",
    "objectui was measured at the .objectui-sha pin a58626c88, not at objectui main; cloud NOT MEASURED (repository-scoped proxy).",
    "origin/main moved to b7e01fbbd during the run (shared refs); the census stays anchored to 54c3ce10c and the one new commit names the key on 0 lines.",
    "The worktree ../objectstack-issue-22340 is removed after this report (clean, never pushed)."
  ],
  "files_changed": []
}

Generated by Claude Code

Seat review of #22340 stage 0: census accepted. Order set by the seat; the conversion mechanism goes back to the decision box (its ruled premise is falsified). Stage S1 is claimed

domain:spec seat 2 (#18549) · os-sales · session session_01DhTqaEHqPVSVnAkjG3jywn · 2026-10-08T21:51Z · holder of claim 6069288725. This amends that claim. ⛔ Not a new claim.

The stage-0 report is on this card (os-dev-report, measured at 54c3ce10c; b7e01fbbd names the key on 0 lines). The seat checked the method: the census uses glob pathspecs with non-vacuous controls, and every hit line was read and classed. The seat accepts it.

Accepted readings:

765 hits in 176 files. 46 source hits (14 files) and 120 test hits (32 files) sit in the per-organization path feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 S3–S5 delete.
The five types are confirmed (28 registry entries; the flag is true on exactly view, dashboard, report, translation, email_template).
Report and translation have no environment-overlay pin today.
The rename reaches the published wire field GET /meta/types entries[].allowOrgOverride (api/protocol.zod.ts:210). objectui reads it at the pin as Studio's write gate for every packaged item of the five types, through its own optional field type. So no spec gate and no Console Pin Gate would see a missed objectui side.
The rename is Clause-②: yes (narrowing), not (widening): it retires an authorable key and a wire field.

Set by the seat (ordering and dependency, not a product question):

S1 now, tests only. Environment-overlay pins for all five types under the current key name, each case a packaged item overlaid env-wide (no organizationId), so feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 S3/S4 leave it standing. They make "no overlay is lost" checkable while feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 rewrites the write doors.
S2, the rename, after feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 S5 merges. Until S3/S4/S5, the flag still decides organization-scoped writes, threading and reads (protocol.ts:16210, meta-write-org-scope.ts:99/:141/:189, :27554). Renaming it to an environment name first would ship ruling C's rejected B shape inverted, and it would rename 166 hits of code that is about to be deleted.
S3, governed text (Tier H), after S2: AGENTS.md:190-192, skills/objectstack-ai/SKILL.md:347, ADR-0005 :47/:68.
The card's "either order or in parallel" holds for feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206's deletion, not for this rename. The engine seat is told on feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206.

Back to the decision box: the ruling's mechanism. Ruling C (6028809298, #22007) prescribes "an ADR-0087 D2 load-time conversion so an existing manifest naming the old key still loads unchanged". Measured (F1), no manifest, stack, plugin config or stored row can carry a type-registry entry:

contributes.kinds is a closed shape;
additionalTypes is a tombstone;
the registry is a TypeScript literal that nothing parses.

So a D2 conversion has no seam. A premise of the ruling is falsified, which is the case that returns to the box; the seat does not swap the mechanism itself. The sub-question the ruling did not cover, the wire field (Q2), is put in the same act. The four-axis analysis (Chinese) is the next comment. The state moves to needs-user-decision when S1 lands.

S1 claim amendment:

Branch claude/issue-22340-s1-env-overlay-pins, worktree objectstack-issue-22340-s1.
File surface: one new test file in packages/objectql/src on the real SchemaRegistry and protocol, both topologies (harness model: engine-security-catalog-package-door.test.ts), plus optionally one dispatcher case in packages/runtime/src. No source file.
Clause-②: no (tests only). No changeset if the repo's rules exempt a test-only diff. Cross-lane on [PM seat] domain:engine — ⏳ vacant #6367 (packages/objectql, packages/runtime tests).

Noted, not filed (each with its carrier):

OS_METADATA_WRITABLE vs the legacy variable: the two write gates read different sets → feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 S2.
The key's TSDoc lists two types, and five opt in → this card's S2.
The 17.x customizationPolicies prescription and the two unreleased 18.* prose entries → S2.
The organization-scoped email-template dogfood → feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 S3.
The checklist #allowOrgOverride anchors → S2 / S3.

Generated by Claude Code

待维护者裁决：#22340 —— 改名 `allowOrgOverride` 时，「旧键照常加载」靠什么兑现；`/meta/types` 返回里的同名字段是否一起改

domain:spec seat 2 (#18549) · os-sales · session session_01DhTqaEHqPVSVnAkjG3jywn · 2026-10-08T21:53Z · 认领 6069288725 的持有席。依据：阶段 0 报告（本卡 os-dev-report，54c3ce10c 实测）与本席复核 6069745527。

一句话问题： 你在 #22007 裁的 C 是给这个键改名，并用「加载期转换」让旧写法照常加载。实测发现，没有任何作者能在 manifest 或配置里写这个键，所以那道转换没有地方可以生效。另外，这个键还以同名字段出现在 Studio 读取的接口返回里，原裁决没有提到它。

背景（实测）：

这个键只写在平台自己的类型注册表里。注册表是一段 TypeScript 字面量，没有生产代码去解析它。
插件 manifest 的 contributes.kinds 是封闭结构，写这个键会被拒；MetadataPluginConfig.additionalTypes 已经是墓碑；stack 里没有类型注册表集合；存储行里也不存注册表条目。
仓里有同类改名的先例：HotReloadConfig.debounceDelay、MetadataPluginConfig.additionalTypes。做法是旧键留墓碑（retiredKey()，解析时响亮拒绝，并提示新名字），加一条 retired-keys 记录和一条 D3 语义记录，不加 D2 转换。先例原文："a MetadataConversion here would be a transform with no seam that ever runs"。
GET /meta/types 的 entries[].allowOrgOverride（api/protocol.zod.ts:210）是同一个键投影到接口上的字段。objectui 在当前 pin 上有 11 个源文件读它，用来决定 Studio 能不能编辑这五类已打包条目。objectui 用的是自己定义的可选字段类型，所以服务端改了名、objectui 没跟上时，没有任何门禁会报错。结果是这五类条目在 Studio 里静默变成只读。

Governing text：

decision: ADR-0131 C5 — allowOrgOverride also decides environment overlays of packaged items. When the per-organization axis retires, does the key split, keep its name with a new meaning, or get renamed? #22007 裁决 C（6028809298，2026-10-07 维护者「其他同意」）："renamed to a key that says what it will then mean … with an ADR-0087 D2 load-time conversion so an existing manifest naming the old key still loads unchanged … The new name is fixed by the contract review of the C5 change"。
ADR-0087 D2 只适用于 stack 集合与存储行。不在 stack 上的键，按先例走墓碑加 D3，见 migrations/entries/retired-keys/18.kernel__HotReloadConfig__debounceDelay.ts。
AGENTS.md：删除一个可被作者编写的键时，必须留墓碑。

协议声明： 不改协议，只是落实已裁的改名方向。被证伪的是裁决中「旧 manifest 要靠转换」这一条前提。

前提（附复验方式）：

P1：注册表条目没有可被作者写入的入口 —— git grep -n "MetadataTypeRegistryEntrySchema" -- ':(glob)packages/**/src/**' ':!*.test.ts'，非测试的解析点为 0。
P2：objectui 在 pin 上读这个字段 —— 在 objectui 的 .objectui-sha 提交上 git grep -n allowOrgOverride -- 'packages/**/src/**'，命中 11 个源文件。

Q1：旧键的提示由什么承载

选项	做什么	客户/作者能感知到的后果
A 墓碑 + D3（推荐）	新键上线，旧键留墓碑，解析时响亮拒绝并给出新名字；加 retired-keys 与 D3 语义记录，不加 D2	今天没有作者能写这个键，所以没有人需要被自动改写；平台代码和接口消费方由编译器和墓碑拦住
B 照裁决原文加 D2	另外登记一个 D2 转换	账本里多一条永远不会执行的转换，等于声明了一个运行时不兑现的能力
C 直接改名，不留墓碑	—	会被机械拒绝：`check:authorable-surface` 不允许没有退役登记的删除，AGENTS.md 也要求墓碑

Q2：/meta/types 的同名字段

选项	做什么	后果
A 一起改名（推荐）	S2 改服务端字段，同一次落地配一个 objectui PR 改读新名字，并升级 `.objectui-sha`	从注册表到 Studio 用同一个名字；代价是一次跨仓协同落地
B 接口保留旧名	只改作者侧的键	接口上留下一个写着「组织」、实际管「环境」的字段，Studio 和读 `/meta/types` 的 AI 客户端都会读错。这正是裁决 C 已经否掉的 B 形态，只是换到了接口上
C 新旧两个名字同时发一个版本	—	双拼写过渡期，objectui 还要写回退逻辑。没有具名外部用户的证据，按「过渡也从紧」不荐

业务含义直译：

Q1-A ≈「门牌换了，旧门牌钉一块『已搬到 X』的牌子」。Q1-B ≈「再装一台永远不会有人按的转接电话」。
Q2-A ≈「店名和招牌同一天一起换」。Q2-B ≈「新店名开张，门口招牌还挂旧名」。

四轴论证：

长远合理性： Q1-A 与仓里两条同形先例一致，账本里不留死记录。Q2-A 从头到尾只有一个名字。
实际业务拉动： 写这个键的只有平台自己；读它的是两处写门推导、一个接口字段，以及 objectui 的 11 个源文件。所以 Q1 没有作者需要迁移，Q2 有一个实测的真实消费方（Studio）。
防 AI 犯错（出错时谁看到什么）：
- Q1-A：旧键在解析和编译时响亮报错，并给出新名字；Q1-B 声明了一个不会执行的转换。
- Q2-B / Q2-C：AI 读接口时会把「org」理解成组织。Q2 漏改 objectui 时是静默只读，所以必须同一次落地。
创业阶段不扩散： Q1-A 不新增任何长期维护面；Q2-C 是双拼写窗口，不荐。

os-decision-facets

① 项目长远合理性：Q1-A 沿用同形先例、不留死转换；Q2-A 一个名字贯穿注册表、接口和 Studio。
② 实际业务拉动：没有作者写这个键（Q1 零拉动，选最轻的 A）；Studio 是 Q2 的实测读者。
③ 防 AI 犯错：墓碑响亮拒绝优于无效转换；接口字段名必须说真话，漏改 objectui 会是静默只读。
④ 创业阶段不扩散：不留死账本行，不开双拼写窗口。
Prior rulings read: allowOrgOverride / D2 conversion registry key rename / retiredKey no D2 → decision: ADR-0131 C5 — allowOrgOverride also decides environment overlays of packaged items. When the per-organization axis retires, does the key split, keep its name with a new meaning, or get renamed? #22007 6028809298（裁决 C）；feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 6037959748、6066851770；先例 18.kernel__HotReloadConfig__debounceDelay、18.kernel__MetadataPluginConfig__additionalTypes；thread: 本卡 6069288725、6069745527。

推荐：Q1 选 A，Q2 选 A。 只看①选 A / A；②③④ 是否翻转：否（④ 只影响落地形式：Q2-A 要求 objectui PR 与 S2 同一次落地）。回退项：Q1 无（B、C 都不成立）；Q2 回退到 C 需要具名的外部用户证据。

置信缺口： cloud 仓有没有读 /meta/types 的 allowOrgOverride，未实测（本会话的 GitHub 代理按仓限定）。objectui 只测了 pin 上的提交，没测它的 main。

裁后执行：

S1（五类环境覆盖的测试 pin）不依赖这两问，本席已认领并照常推进。
S2（改名）排在 feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 S5 之后，按你的字母落实。选 Q2-A 时，本席同时请 objectui 车道开配套 PR，并在 S2 里升级 .objectui-sha。
新名字仍由 S2 的合约复核定，阶段 0 给出的候选是 allowEnvironmentOverlay、allowEnvironmentOverride、allowPackagedOverlay。

状态： S1 落地后，本卡转入 needs-user-decision。请在本卡回两个字母，例如「Q1 A，Q2 A」。

Generated by Claude Code

os-dev-report

{
  "issue": 22340,
  "status": "done",
  "branch": "claude/issue-22340-s1-env-overlay-pins",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/22363",
  "session": "session_01DhTqaEHqPVSVnAkjG3jywn (subagent of the PM session; identity = the S1 branch named by the seat amendment 6069745527, verified against the newest Claim: 6069288725, which names stage 0's branch; no second claim posted)",
  "premise_still_valid": true,
  "summary": "S1 landed as one new test file, packages/objectql/src/environment-overlay-five-types.test.ts (tests only, no source file). It runs on the real ObjectQL engine, SchemaRegistry and ObjectStackProtocolImplementation on both topologies, and no organizationId reaches any call. For each of view, dashboard, report, translation and email_template it pins three things. (1) saveMetaItem over the packaged item is accepted, stores exactly one row with organization_id NULL, and the read serves the written body. (2) A stored env-wide row put straight into the store is what getMetaItem serves, with a control that the read serves the packaged item before the row exists. (3) getMetaTypes advertises allowOrgOverride true with overrideSource registry, with OS_METADATA_WRITABLE cleared. One more case pins the identity: the flag is true on exactly these five. On origin/main 1cb0edb82, all five env-wide overlays are accepted on both topologies, so no stop condition fired. Two of the dispatch's premises were measured and corrected; neither changes the stage. (a) The served read getMetaItem keys on neither the flag nor supportsOverlay. Its only skip is declinesStoredRow (shipped flows and code datasources), and supportsOverlay's sole protocol reader, mergesOverlayAtRead, is called only by the delete door. So the pin claims only that the read consults no flag, and the ablation shows it. (b) No in-repo producer puts a packaged translation into the SchemaRegistry, so the translation case registers its packaged item through registerItem(type, item, 'name', packageId), the entry isArtifactBacked reads. Existing pins are listed per type in the file header and the PR body. No runtime dispatcher case was added: for an env-wide write the dispatcher reads the flag nowhere.",
  "tests": "All runs at head db89d66f0. New file: pnpm --filter @objectstack/objectql exec vitest run --project local src/environment-overlay-five-types.test.ts gives 26 passed (26): 1 identity, 2 topologies x 5 types x write/read = 20, 5 wire. Package: pnpm --filter @objectstack/objectql exec vitest run --project local --maxWorkers=2 gives Test Files 388 passed (388), Tests 7633 passed (7633). Typecheck: pnpm --filter @objectstack/objectql run typecheck exits 0, with 'check:test-typecheck: OK ... 40 file(s) / 234 error(s) / 65 pinned signature(s) held'; the new file is unledgered, so it compiles with zero errors. ABLATION, report flag true to false in DEFAULT_METADATA_TYPE_REGISTRY via scripts/ablation-replace.mjs: anchor x1 to x0, replacement x0 to x1, blob 47f68e76cb5c to 01bfde907a81. @objectstack/spec was rebuilt (exit 0), and ablation-dist-preflight found the marker in 4 built files: dist/kernel/index.js, dist/kernel/index.mjs, dist/browser/kernel/index.js, dist/browser/kernel/index.mjs. Predicted before running: 4 red / 22 green, with report's read cases staying green. Measured 'Tests 4 failed | 22 passed (26)', exactly the predicted four. Identity received [dashboard, email_template, translation, view]. Report write on both topologies received refused { code NOT_OVERRIDABLE, status 403 }. Report wire received allowOrgOverride false, overrideSource registry. RESTORE: by the tool, blob == HEAD 47f68e76cb5c, git diff HEAD empty. Spec was rebuilt (exit 0), ablation-dist-preflight --absent reported the marker absent from all 232 built files and the whole tree clean, and the re-run gave 26 passed (26). Lint, a declared narrowing: eslint --no-inline-config --format json on the one file reports 1 file, 0 errors, 0 warnings. The file is in eslint's population (--print-config returns a config with 5 rules for it). The invariance holds because type-aware linting is not enabled (no parserOptions.project, no typed rules; eslint.config.mjs states the same), so a new file cannot change another file's result. Changeset measurement: objectql was built (exit 0). The test file's fixture strings appear 0 times in files[] (dist, README.md, CHANGELOG.md), against a positive control of registerMetadataCollections in 6 dist files.",
  "mcp_calls": "0 (no MCP tool used)",
  "api_writes": "3 from this session, all POST /repos/objectstack-ai/objectstack/dispatches (the fleet-write relay). The relay executed 4 writes as objectstack-fleet[bot]: (1) pr_create, POST /repos/objectstack-ai/objectstack/pulls, giving #22363 draft, with the read-back reporting 9933 bytes sent and 9933 stored, identical; (2) labels_add, POST /repos/objectstack-ai/objectstack/issues/22363/labels [skip-changeset]; (3) assign, POST /repos/objectstack-ai/objectstack/issues/22363/assignees [os-sales]; (4) this os-dev-report comment, POST /repos/objectstack-ai/objectstack/issues/22340/comments via post-stamped.mjs. Separately, 2 git pushes of the branch (the empty branch probe and db89d66f0), which are not REST writes. The card's assignee was not written.",
  "gates": {
    "derived": "node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack, with no paths, at db89d66f0. Change set: 1 path vs merge base 1cb0edb82. 56 commands, byte-identical after sort to the dispatch file g22340s1.txt (derived at b7e01fbbd), so nothing was added.",
    "run": "56 run, unlocked and in the foreground (nohup plus a tail --pid wait), at head db89d66f0. 55 exit 0. pnpm check:dual-build-cjs-loads exit 3: PREREQUISITE NOT MET, 65 packages have no dist. It needs every workspace package built and is NOT MEASURED; the diff adds a test file that no build emits (measured, 0 hits in objectql dist), and CI builds the workspace.",
    "notable_exit_0": "check:nul-bytes 'OK (scanned 10343 text file(s) ... no raw ASCII control bytes)'; check:engine-double-contract 'OK — 990 pinned, 129 in the DEBT ledger, 3 exempt'; check:objectql-double-limit '... none new'; check:test-source-alias OK; check:driver-memory-census OK; check:type-check-debt OK; check-issue-citations '0 file(s) read' (test files are a DEFERRED surface of that gate).",
    "ran_verdict": "✓ dispatch-gates --ran: 56 derived famil(ies) accounted for — 55 run, 1 NOT-MEASURED (1 DERIVED from a recorded exit 3).",
    "ci_at_report": "in_progress (12 of 30 check runs completed at report time, none failed; Check Changeset skipped by the skip-changeset label). CI convergence is the PM's."
  },
  "line_budget": "+359 / -0 in 1 file vs merge base 1cb0edb82 (dispatch-gates: 359 changed lines, under the 5000 human-merge threshold). Governed paths touched: 0.",
  "deviations": [
    "Read leg: the dispatch said the served read keys on supportsOverlay, not on the flag. Measured: getMetaItem consults neither, so the pin asserts only that the read consults no flag. The ablation shows this: report's read cases stay green while its write and wire cases go red.",
    "Translation: no stack collection carries a packaged translation, so its packaged item is registered through SchemaRegistry.registerItem(type, item, 'name', packageId) instead of the manifest; the other four go through the manifest's own stack collections.",
    "The read leg seeds the env-wide row directly into the store, with the shape the repository writes: type, name, organization_id null, package_id null, metadata as JSON, state active, version 1. This asks the read alone, with no write door in front of it. The write leg also reads back through the protocol, which ties what the door stores to what the read serves.",
    "organization_id is asserted as (row.organization_id ?? null) toBeNull. It is NULL today, and the form stays standing if #15206 makes the family tenant-less and drops the column.",
    "email_template's packaged save on both topologies already exists as the control in engine-security-catalog-package-door.test.ts. Here it is the first step of a round trip that goes on to read the stored row's organization, the served body and the wire flag, so it is not a duplicate single-fact case. No other existing pin was restated.",
    "Commit trailers use AGENTS.md's model-free pair (Claude-Session plus Co-authored-by: Claude). The harness reminder's model-named Co-Authored-By trailer was not used because the pre-push hook refuses a model identifier; the PR footer uses AGENTS.md's session-URL form.",
    "check:dual-build-cjs-loads is NOT MEASURED (exit 3, prerequisite: a whole-workspace build)."
  ],
  "files_changed": [
    "packages/objectql/src/environment-overlay-five-types.test.ts"
  ],
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: #22340 S2 contract review (the domain:spec seat) · noted, not filed · No in-repo producer puts a packaged translation into the SchemaRegistry. This is a reading of four seams at 1cb0edb82, not a boot measurement: METADATA_ARRAY_KEYS in objectql/src/engine.ts and ARTIFACT_FIELD_TO_TYPE in metadata/src/plugin.ts carry no translations collection; MetadataPlugin._loadFromFileSystem stamps _packageId but registers into MetadataManager's own map; ObjectQLPlugin.loadMetadataFromService copies only object, view, app, flow and hook. So isArtifactBacked is false for every translation, and an env-wide translation write is admitted by allowRuntimeCreate, not by the flag. The flag's live effect on translation is the per-organization path (#15206) and the Studio wire gate, which bears on what 'no overlay is lost' means for translation in S2 · dedupe words: translation packaged artifact, isArtifactBacked translation, translations METADATA_ARRAY_KEYS",
    "carrier: #22340 S2 (the domain:spec seat) · noted, not filed · Stage 0's reading 'the read keys on supportsOverlay (mergesOverlayAtRead)' does not hold for getMetaItem. That read serves any stored active row unless declinesStoredRow holds, and mergesOverlayAtRead is called only by refusePackagedBaseRemoval, the delete door. The rename still cannot hide a stored overlay from this read: it consults no flag, as pinned and as the ablation shows · dedupe words: mergesOverlayAtRead, supportsOverlay served read, declinesStoredRow",
    "Governed text: none made false by this diff (AGENTS.md:190-192, skills/objectstack-ai/SKILL.md:347 and ADR-0005 are S3's, unchanged)."
  ]
}

Generated by Claude Code

Seat review of #22340 S1, PR #22363 at `db89d66f0`: ACCEPT. Lands when green; the card then moves to `needs-user-decision` (`6069763011`)

domain:spec seat 2 (#18549) · os-sales · session session_01DhTqaEHqPVSVnAkjG3jywn · 2026-10-08T22:44Z · holder of claim 6069288725 (S1 per 6069745527).

The report is on this card. The PR adds one test file and touches no source file: packages/objectql/src/environment-overlay-five-types.test.ts, +359.

What it pins. For each of view, dashboard, report, translation and email_template, on both topologies, with no organizationId reaching any call:
- an env-wide saveMetaItem over the packaged item is accepted and stores one row with organization_id NULL, and the read serves the written body;
- a stored env-wide row is what getMetaItem serves (with a before-row control);
- getMetaTypes advertises the flag true from registry, with OS_METADATA_WRITABLE cleared.
The identity case pins that exactly these five carry the flag. 26 tests pass.
Ablation (report's flag true → false, spec dist rebuilt, marker proven in 4 built files): 4 failed | 22 passed, exactly the predicted four.
- The identity case drops report.
- Report's write is refused with 403 NOT_OVERRIDABLE on both topologies.
- Report's wire field reads false.
- Report's read cases stay green, because the read consults no flag.
It was restored to the HEAD blob, with the dist clean (marker absent from all 232 files).
Level: test-only, skip-changeset (0 fixture hits in objectql's files[]), Clause-②: no. No contract review is owed. 55 / 56 derived gates ran; check:dual-build-cjs-loads is NOT MEASURED (a whole-workspace build).

Two stage-0 readings corrected by measurement, recorded for S2 and the decision. Neither changes S1.

getMetaItem keys on neither the flag nor supportsOverlay. Its one skip is declinesStoredRow, and mergesOverlayAtRead is called only by the delete door. So a rename cannot hide a stored overlay from the served read.
No in-repo producer puts a packaged translation into the SchemaRegistry (METADATA_ARRAY_KEYS, ARTIFACT_FIELD_TO_TYPE, loadMetadataFromService carry none). So isArtifactBacked is false for every translation, and an env-wide translation write is admitted by allowRuntimeCreate, not by the flag. The flag's live effect on translation is the per-organization path (feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206) and the Studio wire gate. This bears on the decision's Q2 (6069763011): the wire field still gates Studio for the other four types, and for translation only through that gate.

Next: every check green → landing (Part of #22340) → needs-user-decision.

Generated by Claude Code

Blocked on #15206 S5: `pm:queue` → `pm:blocked`, `Blocked-by: #15206`

domain:spec seat 1 (#6017) · os-tesla · session session_01VZqqwTj2wsihZEbfT6yyYN · 2026-10-09T04:15Z. ⛔ Not a claim, ⛔ not a dispatch.

The ruling 6073921182 (Q1 A · Q2 A) is read; its state note says: "S2 … is ordered after feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 S5 per 6069745527; the spec seat sets pm:blocked with Blocked-by: #15206 at its claim if S5 has not merged."
feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 S5 has not merged. Read 2026-10-09T04:04Z: feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 is open, pm:dispatched to domain:engine seat 1; S1 landed (PR feat(metadata-core,metadata-protocol,metadata,platform-objects,spec)!: sys_view_definition retires as inert (ADR-0131 D13, C5 stage S1) #22374, 117d34de3f); S2 (the managed seal) is PR feat(metadata-protocol)!: managed content is sealed — OS_METADATA_WRITABLE no longer opens an item a managed package ships (ADR-0131 D6, #15206 S2) #22401, with its retriage question answered 6073941543. S3–S5 are not started.
Why S2 does not start early (seat review 6069745527, unchanged): until feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 S3/S4/S5, the flag still decides organization-scoped writes, threading and reads, and 46 source hits (14 files) plus 120 test hits (32 files) of the key sit in code those stages delete. Renaming first would ship ruling C's rejected B shape inverted.
What the unblock brings, so the dispatch is pre-shaped: S2 is the rename under ruling Q1 A (new key; retiredKey() tombstone on MetadataTypeRegistryEntryBaseSchema; retired-keys entry 18.kernel__MetadataTypeRegistryEntry__allowOrgOverride; a D3 semantic entry; no D2 conversion) and Q2 A (the /meta/types wire field and the overrideSource description renamed in one landing with an objectui PR, the .objectui-sha bump and cloud's two test helpers). Clause-②: yes (narrowing); an at-tier contract review is owed, and it settles the new name and the supportsOverlay question the ruling noted. It is a step-18 writer, so it re-syncs registry.ts, spec-changes.json and the upgrade guide after PR feat(spec)!: PROTOCOL_VERSION 17 → 18 in an ordinary PR — regenerated spec-changes.json and upgrade guide, ^18 handshakes, pre-mode lockstep exception (#22085 Q1 → B) #22215 lands. S3 (Tier H text) follows S2.
Follow-up owner: the maintainer directed this seat to follow the card (this session's chat, quoted verbatim: 「22340 已决裁，你也跟进」). The card is unassigned while blocked; when feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 closes, this seat re-derives the blocker and claims.

This act adds Blocked-by: #15206 to the body and moves the card pm:queue → pm:blocked; domain:spec, priority:p1 and target:v18 stay.

test(objectql): pin the environment overlay of a packaged item for th…

Blocked-by: none

Triage: unlock, `pm:blocked` → `pm:queue`. The block was "S2 after #15206 S5", and S5 has landed

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-11T09:55Z. ⛔ Not a claim, ⛔ not a dispatch.

This card's block note (6074143399) ordered S2 after feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206's S5. That was ruling 6073921182's state note, via 6069745527.
S5 landed as PR feat(metadata-protocol,objectql,rest,spec)!: every metadata read is environment → code; legacy organization rows and sealed overlays are reported at boot, not served (#15206 S5) #22628 (c8b062f011), and S3 and S4 had landed before it. The flag's organization-scoped writes, threading and reads are gone, so the rename no longer ships the inverted shape.
feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 stays open only for S5's carry-overs. Its block came off in this round, and none of the carry-overs touches this key.
The follow-up owner is the domain:spec seat 1, on the maintainer's word (「22340 已决裁，你也跟进」). It re-derives the blocker and claims. The dispatch shape is pre-set in 6074143399.

Claim: PM loop round 8 (#22340 S2, opened by its re-measure. #15206 S3–S5 have landed, so stage 0's census of 54c3ce10c is stale; this round measures, writes no code and opens no PR. The build round is claimed on its reading) · 2026-10-11T12:37Z
Session: session_01KNKBCRDJCu5tGy3TEbvtrF
Account: zhuangjianguo (the seat's linked user as GET /user answers it; the card's assignee from this act)
Branch: claude/issue-22340-s2-remeasure (this round commits nothing; the build round names its own branch on this card)
Worktree: objectstack-issue-22340
Domain: domain:spec
Seat: domain:spec#3 (seat post #18883)
File surface (at origin/main efcbac73cc or later): this round writes no repository file and opens no PR. The report is the deliverable, and it contains:

The census again. Every reader and writer of allowOrgOverride on today's main (167 files and 670 hits at this stamp, against stage 0's 176 and 765), classed as stage 0 classed them. The new reading is whether any hit still decides an organization-scoped path after feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 S3–S5. Ruling 6073921182's order rests on "none".
The rename's mechanism, as ruled (Q1 A):
- a retiredKey() tombstone on MetadataTypeRegistryEntryBaseSchema;
- the retired-keys entry 18.kernel__MetadataTypeRegistryEntry__allowOrgOverride;
- a D3 semantic entry;
- ⛔ no D2 conversion.
Re-read the two precedents and today's registry-generation model (registry.ts.template since build(spec): the migration registry is generated at build and leaves git #22706).
The wire field, as ruled (Q2 A): GET /meta/types entries[].allowOrgOverride and the overrideSource description. Count objectui main's readers again: 12 non-test source files at the ruling. Note that the objectui companion must merge just before S2, with the .objectui-sha bump; spec: catalog references in authoring surfaces become names (approver position binding, decision-output positions, the position form's permissionSets widget), ADR-0131 D4, from #15204 #22682's pin round is in flight on that file now.
cloud's two test helpers (service-ai-studio write-door.ts:58 and metadata-tools.test.ts:305 at cloud 9c4299c264). cloud is outside this session's repositories: report NOT MEASURED, and name the hand-off the cross-repo protocol prescribes.
For the S2 contract review (ruling's note): name candidates with their collisions (allowEnvironmentOverlay, allowEnvironmentOverride, allowPackagedOverlay), and whether supportsOverlay and the renamed key each keep an independent reader at environment scope.
A build plan: each PR's file surface across the three repositories, the landing order, serial constraints against open PRs and in-flight claims, and the review each owes.
Container & model: XL staged, mode:subagent, model: default tier for this read-only round (dispatch-gates --tier: no path-derived mandate for a measurement). The build is Clause-②: yes (narrowing) (seat review 6069745527), and it owes a contract review at CONTRACT_REVIEW_TIER.
Clause-②: yes (narrowing; the build round's). This round changes nothing.
Responsibility: n/a — not a defect card (ADR-0131 C5's spec half, ruled under decision: ADR-0131 C5 — allowOrgOverride also decides environment overlays of packaged items. When the per-organization axis retires, does the key split, keep its name with a new meaning, or get renamed? #22007 letter C and 6073921182 Q1 A / Q2 A)
Thread-read: 6107791766
Serial constraints cleared:
This round writes no file.
Seat 1 held this card's follow-up and is vacant (post [PM seat] domain:spec — ⏳ vacant #6017, since 2026-10-11T09:12Z). The maintainer's word to that seat, 「22340 已决裁，你也跟进」, is carried by the lane. Triage's unlock 6107791766 named seat 1 after it had stood down. The hand-over is recorded here, and the maintainer may redirect it.
For the build round: .objectui-sha is single-claim. spec: catalog references in authoring surfaces become names (approver position binding, decision-output positions, the position form's permissionSets widget), ADR-0131 D4, from #15204 #22682's round (claim 6109075588) moves it now, so S2's own bump goes after that one lands.

This act moves the card pm:queue → pm:dispatched and assigns zhuangjianguo.

Generated by Claude Code

os-dev-report

{
  "issue": 22340,
  "status": "done",
  "branch": "claude/issue-22340-s2-remeasure",
  "pr": null,
  "session": "session_01KNKBCRDJCu5tGy3TEbvtrF (subagent of the PM session; the same id the claim's Session line carries). Identity: all 11 card comments re-read through REST; the newest Claim: is 6109099576 and it names branch claude/issue-22340-s2-remeasure.",
  "premise_still_valid": true,
  "summary": "Re-measured on origin/main efcbac73cc (worktree ../objectstack-issue-22340, read-only: no install, build, test, commit or push), and re-read at d8c7d38648 after main moved during the run. The census reproduces the PM's numbers: 670 hits in 167 files, against stage 0's 765 / 176 (-95 hits, -9 files). No code path decides an organization-scoped write, read or threading any more; the ruling's order rests on that 'none', and it holds. Three code readers of the flag remain: protocol.ts:15693, sys-metadata-repository.ts:352, and the wire writer getMetaTypes at protocol.ts:7762/:7763/:7832. None of them branches on an organization. What survives of the per-organization meaning is prose: 9 source hits in 6 files, plus labels and premises in 20 test files. One reading is new: since #15206 S5 the flag also decides the served read. declinesStoredRow → isUnservedSealedOverlay → isSealedManagedItem → registryAllowsOverlay withholds an environment overlay of a packaged item when the type lacks the flag, with permission excepted. So the key is now the single decider of 'may an environment overlay this packaged item', on write, on read and in Studio, which is ruling C's meaning. Every ruled premise re-reads true. No author-reachable parse site exists for a registry entry. The retired-keys spelling matches authorable-surface/kernel.json:347. objectui main 1d1cfe0c11 still reads the wire field in 12 non-test source files (50 hits). It types the field itself (RichMetadataTypeEntry, useMetadata.ts:77), so no gate would see a missed rename. The registry-generation model changed since stage 0: registry.ts, spec-changes.json and the upgrade guide are no longer committed, so S2 regenerates none of them. The plan is 4 PRs: objectstack S2 with the pin bump (estimated 1.7k-2.3k changed lines, under 3000), the objectui companion (merges just before S2), cloud (same window, NOT MEASURED), then S3 (Tier H). Name recommendation for the contract review: allowEnvironmentOverlay. supportsOverlay and the renamed key each keep an independent reader, so neither retires under ADR-0049. supportsOverlay's describe overstates what it gates.",
  "census": {
    "base": "origin/main efcbac73cc (efcbac73cc58510278b970949ac3b65cb9712815). main moved to d8c7d38648 during the run (3 commits). On d8c7d38648 the census still reads 670 / 167, and git diff efcbac73cc d8c7d38648 names the key on 0 lines; 2 changed files are S2 surfaces (content/docs/permissions/authorization.mdx, plugin-security security-plugin.ts), on lines other than the key's.",
    "command_and_controls": "git grep -n allowOrgOverride HEAD = 670 lines in 167 files. Glob pathspecs with non-vacuous controls: ':(glob)packages/**/src/**' key 100 files vs DEFAULT_METADATA_TYPE_REGISTRY 89 and isOverlayAllowed 10; the plain 'packages/**/src' answers 0 for the key AND 0 for the control (vacuous). ':(glob)**/*.test.ts' key 74 vs 'describe(' 5033. ':(glob)content/docs/**' key 14 vs ADR-0005 12. ':(glob)packages/**/src/**' minus tests: key 29 vs 28. ':(glob)**/CHANGELOG.md' 10 vs 'Patch Changes' 78. ':(glob)docs/adr/**' 13 vs 'Status' 139. ':(glob).claude/**' 0 vs 'pm-dispatch' 8. ':(glob)skills/**' 1 vs 'objectstack' 58.",
    "method": "I read every non-test source hit line in context, and every test hit line. Each hit is classed by what it governs or describes. protocol.ts is split by line (4 a-prime / 41 b), and so is save-meta-response-conformance.test.ts (:239 b, :309 not-a). The class totals are computed by a script over the grep output, which sums to 670.",
    "class_table": [
      "class | today hits / files | stage 0 hits / files | delta",
      "(a) code deciding an organization-scoped write, read or threading | 0 / 0 | 46 / 14 (code + its prose) | -46 / -14",
      "(a-prime) prose that still ties organization scope to the flag; no code | 9 / 6 | inside stage 0's (a), except kernel/index.ts:31 (stage 0 b) | see list",
      "(b) environment-overlay permission (code, refusal sentences, comments) | 73 / 19 | 75 / 19 | -2 / 0",
      "(c) declaration (metadata-plugin.zod.ts) | 47 / 1 | 47 / 1 | 0",
      "(c) docs (content/docs, docs/qa, docs/audits, spec liveness notes) | 64 / 23 | 64 / 23 | 0",
      "(c) generated | 9 / 6 | 16 / 8 | -7 / -2 (registry.ts -4: git-ignored since #22706; docs/protocol-upgrade-guide.md -2: a pointer stub since #22556; references/api/protocol.mdx 3 → 2)",
      "(c) ADR-0087 ledger prose | 5 / 5 | 4 / 4 | +1 / +1 (18.metadata-write-organization-scope-refused.ts)",
      "(c) tooling | 28 / 3 | 28 / 3 | 0",
      "(c) history: CHANGELOG + pending changesets | 154 / 16 | 150 / 12 | +4 / +4 (15206-meta-doors-environment-only, 15206-protocol-environment-only, 15206-reads-environment-only, 22411-hatch-legacy-spelling)",
      "(c) governed | 48 / 15 | 48 / 15 | 0",
      "(d) tests pinning (b) | 189 / 55 | 156 / 46 (+ mixed 11 / 2) | see d",
      "(d) tests pinning not-(a): the retirement of the per-organization path | 44 / 20 | 120 / 32 pinned (a) itself | see d",
      "total | 670 / 167 (protocol.ts and one test file counted in two classes) | 765 / 176 | -95 / -9"
    ],
    "raw_file_delta": "23 files gone (59 hits), 14 files new (22 hits), 25 files changed (-58 hits). Gone source files: metadata-core meta-write-org-scope.ts (6; ORG_OVERRIDABLE_TYPES, the stage-0 flag reader), meta-write-capability.ts (1), rest meta-item-read-gate.ts (1), rest-route-ledger.ts (1), runtime route-ledger.ts (1), plugin-email bootstrap-declared-email-templates.ts (1), spec security/capabilities.ts (2, manage_org_presentation), plugin-security permission-set-overlay-discard.ts (1), the git-ignored registry.ts (4), and docs/protocol-upgrade-guide.md (2). 13 test files are gone: get-meta-item-cached-etag-scope, the three org read-gate suites, both org-scoped cold-boot audits, metadata-store-outage, publish-drafts-package-scope, metadata-core meta-write-capability and meta-write-org-scope, rest meta-item-save-capability-gate and meta-write-door-capability-enumeration, and runtime meta-save-capability-gate. New: 4 pending changesets, packaged-base-regime.ts (1), plugin-security position-write-through.ts (1), the semantic entry 18.metadata-write-organization-scope-refused.ts (1), and 7 test files (S1's environment-overlay-five-types 3, protocol.sealed-remedy-kind 1, managed-content-sealed dogfood 1, execctx-consumer-census 1, rest-meta-managed-seal-hatch 3, runtime meta-read-org-scope-parity 3, meta-managed-content-seal 3).",
    "a_code_survivors": "NONE. The symbols of the stage-0 (a) path (ORG_OVERRIDABLE_TYPES, declaresOrgOverride, organizationIdForMetaWrite, organizationIdForMetaRead, reportUnhydratableOrgScopedRows, orgScopedWriteRefusal, manage_org_presentation) have 0 hits in non-test, non-CHANGELOG source. Two retirement comments remain: metadata-core index.ts:100 and meta-write-capability.ts:15. organizationScopedWriteRefusal (protocol.ts :16029) refuses every organization-scoped write and reads no flag. The flag's three remaining code readers do not branch on an organization: (1) protocol.ts:15693 OVERLAY_ALLOWED_TYPES → registryAllowsOverlay :15827 → isOverlayAllowed :15843 (save :19905, history/migrate :21365/:21549/:21955, :25396, delete :25932/:26043), and isSealedManagedItem :16130-16133 → isUnservedSealedOverlay :16637 → declinesStoredRow :16615 (served reads :8896, :8908, :9877, :10575); (2) sys-metadata-repository.ts:352 → assertAllowed :1827/:1889; (3) the wire, protocol.ts:7762/:7763/:7832.",
    "a_prime_prose_survivors": "9 hits / 6 files, each a comment that still states organization scope as depending on the flag. Carrier: S2 rewrites them; a mechanical rename is not enough. protocol.ts:11050 and :11057 (object fail-closed tiering note), :16007 (retired five-type exemption, accurate as history), :18941 ('NOT org-gated … object is allowOrgOverride false'); rest-server.ts:7069 (history of the door threading); runtime domains/packages.ts:1542 and domains/mcp.ts:385; service-automation sys-flow-credential.object.ts:34 ('flow declares allowOrgOverride false, so its stored rows are env-wide'); spec kernel/index.ts:31 ('ADR-0005's org-scoped overlay (allowOrgOverride …)' named as a live mechanism).",
    "b_files": "protocol.ts 41 (code :7762/:7763/:7832/:15693; refusal sentences :15963/:15988/:21371; comments), sys-metadata-repository.ts 11 (code :352; sentences :1896/:2008), packaged-base-regime.ts:407 (sentence), package-writability.ts:47, metadata-core types.ts:160 and contract-suite.ts:46, objectql engine.ts:3446, platform-objects sys-job.object.ts:165, plugin-security object-posture-gate.ts:15, permission-set-projection.ts 2, position-write-through.ts:47, security-plugin.ts 2, runtime domains/meta.ts:946 (the wire), lint validate-ai-agent-authoring.ts:10, examples/app-showcase coverage.ts:161, spec api/protocol.zod.ts :211/:217/:1606, metadata-create-seeds.ts:141, metadata-type-schemas.ts:142, system/email-template.zod.ts:16.",
    "c_detail": {
      "declaration": "metadata-plugin.zod.ts 47: the key :268 (describe 'Allow per-org overlay writes via runtime metadata API', TSDoc :255-267), 28 registry rows :727-:1211, the customizationPolicies tombstone prescription :514-521, and about 15 rationale comments.",
      "docs": "content/docs 11 pages / 23 hits (concepts/metadata-lifecycle.mdx 8, including the table header :111 that check:overlay-whitelist-table reads), docs/qa/platform-checklist 8 files / 35 (studio-authoring.json 18, platform-core.json 5, including the two '#allowOrgOverride' anchors :1257 and :492), docs/audits 2026-06 assessment 2 (a dated record, which stays), spec liveness README.md 2, capability.json 1, job.json 1 (notes only).",
      "generated": "authorable-surface/kernel.json:347, authorable-defaults/kernel.json:70, authorable-surface.base.json:4262 (written only by gen:authorable-surface-base, never by S2), references/kernel/metadata-plugin.mdx 3, references/api/protocol.mdx 2, references/system/email-template.mdx 1.",
      "ledger": "17.api-runtime-create-withdrawn.ts:46 and 17.field-runtime-create-withdrawn.ts:48 have shipped (spec latest 17.7.0) and stay. Two 18.* entries are unreleased (pre mode, tag next): 18.metadata-customization-protocol-retired.ts:20 (states the org-scoped overlay as live: S2 edits it) and 18.metadata-write-organization-scope-refused.ts:21 ('the five types that declared allowOrgOverride', accurate history: S2 may leave it or add the new name). The retired-keys comment is 18.kernel__MetadataPluginConfig__customizationPolicies.ts:14.",
      "tooling": "scripts/check-overlay-whitelist-table.mjs 26 (COL_FLAG :255, legs and self-test fixtures in the same file), and two adr-anchors invariants (metadata-plugin.zod.ts.json, permission-set-projection.ts.json). Prose only; no symbol is resolved.",
      "history": "10 CHANGELOGs / 147 (metadata-protocol 58, spec 33, runtime 15, rest 13, objectql 10, lint 5, plugin-security 5, metadata-core 4, platform-objects 3, metadata 1) and 6 pending changesets / 7. These are never edited by S2. The pending ones ship in 18.0 beside the rename, as history.",
      "governed": "15 files / 48: AGENTS.md:191 (Prime Directive 7), skills/objectstack-ai/SKILL.md:347, ADR-0005 12 (normative :47, :68), ADR-0010 9, and 11 more ADRs that record decisions under the name of their time (ADR-0029:386 carries an ungated '#allowOrgOverride' anchor)."
    },
    "d_tests": {
      "pins_b": "55 files / 189 hits: the registry identity and rollback pins (adr0005-org-override-rollback 8, flow-org-override-closed 8 (its organization cases name no key), code-only-types 5, delete-receipt-wording 5, save-receipt-wording 3, legacy-overlay-delete 9, delete-rewrap-envelope 3, driver-text-disclosure 3, read-lock-flags-write-door 2, recovery-doors 1, runtime-gate-stored-universe 1, marked-refusal 1, unrecognised-meta-type 1, stored-migration 1, read-verb-canonical-fold 3, diff-dead-history 1, destructive-gate 1, capability-write-door 1, sealed-remedy-kind 1, package-door-before-gates 3, packaged-base-refusal 6, repository contract 3 and package-writability 11), objectql (S1's environment-overlay-five-types 3, engine-security-catalog-package-door 9, overlay-precedence 16 (moved from a to b: its org-scoped cases were rewritten env-wide), protocol-meta 7 (moved likewise), protocol-meta-types-rich 11 (the wire), commit-history 5, object-overlay-layer 2, registry-shadow 2, sys-metadata-repository 4, delete-object-registry-heal 1, meta-effective-schema 1, writepath-object-ownership 1, publish-canonical-fold 1, meta-object-search-companion 1, save-meta-response-conformance :239), runtime (meta-field-overlay-lock 4, meta-managed-content-seal 3, meta-overlay-read-your-writes 2), rest (managed-seal-hatch 3, packaged-flow-refusal 1), plugin-security (restore-leg 1, permission-set-projection 3), platform-objects sys-job.global-unique 5, dogfood (managed-content-sealed 1, showcase-permission-projection 3, two-doors-permission 3), spec (picklist 1, capability-metadata-kind 3, metadata-create-seeds 2, metadata-customization-retirement 1, api-registration 4, field-registration 3).",
      "pins_not_a": "20 files / 44 hits: they pin that NO organization reaches a metadata write or read, for any flag value. The flag appears only as a specimen label, a five-set identity, a premise control or a test-double detector. Runtime meta-write-org-scope 10, meta-read-org-scope-parity 3 (its protocol double models the pre-D6 gate from the flag, :80/:85), packages-seed-apply-org-scope 2, package-duplicate-adopt 1; rest write-org-scope 3, read-org-scope 2, history-diff-org-scope 3, url-spelling 2, cached-etag-door-scope 2, meta-publish-package-scope 1, execctx-consumer-census 1 (§9 premise control :1073); metadata-protocol org-scoped-write-refused 4 (identity :276; stale ':245 HAS a per-org channel'), lock-org-axis-agree 1, publish-item-draft-org-scope 2 (stale ':12 the REST seam threads … organizationIdForMetaWrite'), publish-drafts-org-scope 1, publish-drafts-advisories 1; objectql protocol-org-overlay-registry-gate 2 (its own note: 're-read, not repaired' if the flag closes), publish-meta-response-conformance 1, publish-package-drafts-response-conformance 1, save-meta-response-conformance :309. Carrier: S2 renames or rewrites these labels; a mechanical rename would leave 'ORG_OVERRIDABLE = allowEnvironmentOverlay'.",
      "message_text_pins": "Live runtime sentences naming the key are pinned at protocol.packaged-base-refusal.test.ts:230/:236, sys-metadata-repository.package-writability.test.ts:1321 and rest-meta-packaged-flow-refusal.test.ts:117 (producers: packaged-base-regime.ts:407, sys-metadata-repository.ts:2008), and by the regex /allowOrgOverride/ at metadata-customization-retirement.test.ts:58 (producer metadata-plugin.zod.ts:520). Two plugin-security doubles throw a sentence no producer emits any more (restore-leg :211, projection :156)."
    },
    "five_types": "Re-parsed from source text: 28 registry entries; the flag is true on exactly view, dashboard, report, translation and email_template. supportsOverlay is true with the flag false on 8 types (page, app, dataset, book, permission, position, tool, skill); the reverse holds on 0. S1's environment-overlay-five-types.test.ts (7fbfef4c7, an ancestor of the base, exit 0) pins all five on both topologies under the current name."
  },
  "tombstone_kit": {
    "precedents": "retired-keys/18.kernel__HotReloadConfig__debounceDelay.ts: the key retired with retiredKey() because HotReloadConfigSchema is not strict; 'No D2 conversion: not a stack collection member, not a stored row'; its D3 entry is kernel-health-check-and-hot-reload-durations-unit-in-key; the prescription constant (plugin-lifecycle-advanced.zod.ts:341-348) renames with 'Rename the key to … the value … unchanged' and carries no os migrate meta sentence. retired-keys/18.kernel__MetadataPluginConfig__additionalTypes.ts: 'Registered here but NOT in src/conversions/registry.ts … a MetadataConversion here would be a transform with no seam that ever runs. The prescription reaches authors through the tombstone (tsc + the parse) and the D3 semantic entry metadata-plugin-additional-types-retired'. Both are the ruled Q1 A shape.",
    "registration_today": "One FILE per entry, sorted by id and concatenated by gen:migration-registry into packages/spec/src/migrations/registry.ts. That file is generated whole on install and as the first build step, and is git-ignored (.gitignore:68, #22706 for #22554), so the PR commits no registry.ts. (1) Retired key: entries/retired-keys/18.kernel__MetadataTypeRegistryEntry__allowOrgOverride.ts with export const entry = 'kernel/MetadataTypeRegistryEntry:allowOrgOverride', the exact string authorable-surface/kernel.json:347 carries (gate (b) of build-schemas reads it as exact set membership). The comment above it is carried into the table. (2) D3: entries/semantic/18.ID.ts exporting a SemanticMigration { id, surface, replacement, reason, acceptanceCriteria }; one family covers the registry key AND the wire field. A response-face key gets a D3 entry only (skill §3). (3) STEP18_RATIONALE: hand-edited in registry.ts.template (:1207), as one { id, order, text } fragment inserted where the D3 id sorts. Today that is 114 fragments with max order 93, so order 94; an id starting 'metadata-type-' sorts between metadata-plugin-additional-types-retired and object-grid-default-filters-retired. step18-rationale-merge.test.ts holds the sort. Step 18's conversionIds derive from CONVERSIONS_BY_MAJOR, so with no D2 there is nothing to add. (4) Not committed and not regenerated by the PR: spec-changes.json and protocol-upgrade-guide.md (gitignored; check:spec-changes and check:upgrade-guide render them in memory); docs/protocol-upgrade-guide.md is a hand-written pointer stub.",
    "surfaces_to_files": [
      "Schema → metadata-plugin.zod.ts: NEW_KEY with the rewritten TSDoc/describe; allowOrgOverride: retiredKey(PRESCRIPTION) on MetadataTypeRegistryEntryBaseSchema (:208, a plain z.object, so a bare delete would silently strip); the 28 rows; about 15 comments; the customizationPolicies prescription :514-521 (it names the key as a live mechanism).",
      "Orphan value schema → none (boolean).",
      "Conversion + chain step → none (Q1 A); the retired-keys file + the D3 file + the STEP18_RATIONALE fragment; no conversionIds; retiredFromLoadPath / retiredAfter do not apply.",
      "Retired-default residue → the key carries .default(false), so acceptRetiredDefaultResidue was considered. It is not needed: no built artifact or stored row carries a registry entry (0 non-test parse sites of MetadataTypeRegistryEntrySchema; contributes.kinds is a strictObject; additionalTypes is a tombstone). The PR should state this.",
      "Liveness ledger → no row exists for kernel/MetadataTypeRegistryEntry (no kernel ledger file), so there is no row to keep; the 3 prose notes (README.md, capability.json, job.json) follow the name.",
      "Generated baselines → gen:schema moves authorable-surface/kernel.json (old row → [RETIRED], new NEW_KEY row) and authorable-defaults/kernel.json:70; gen:docs moves references/kernel/metadata-plugin.mdx, references/api/protocol.mdx and references/system/email-template.mdx. api-surface, export-origins, declaration-map and json-schema.manifest carry no property names (stage 0, unchanged). authorable-surface.base.json is not written.",
      "Forms / i18n bundle → none (0 *.form.ts hits).",
      "CLI advisory lint → none (ledger-driven, no row); validate-ai-agent-authoring.ts:10 is a comment.",
      "Pin tests → negative: parse of the old key refused with the prescription naming NEW_KEY (code invalid_type, path ['allowOrgOverride'], in the customizationPolicies pin's shape); positive: the five rows carry NEW_KEY true and no row carries the old key; wire: entries carry NEW_KEY and not.toHaveProperty('allowOrgOverride'); flip S1's five-type file and the identity pins (org-scoped-write-refused :276, rollback :251, overlay-precedence :372). The skill's tree-scoped absence pin needs its radius declared (CROSS_PACKAGE_TEST_INPUTS + turbo.json), and it must exclude the tombstone, entries/, CHANGELOG and .changeset.",
      "Examples → coverage.ts:161 is a comment only (the registry cannot be authored).",
      "Published skills → skills/objectstack-ai/SKILL.md:347 goes to S3 (ruled).",
      "Docs → 11 content/docs pages (never content/docs/releases), with metadata-lifecycle.mdx's table header moving in the same PR as check-overlay-whitelist-table.mjs COL_FLAG and its self-test; 8 platform-checklist files, re-pointing both '#allowOrgOverride' anchors explicitly (the tombstone keeps the word at line start, so a stale anchor stays green).",
      "Changeset → @objectstack/spec minor and @objectstack/metadata-protocol minor (wire field + refusal sentences), BREAKING banner, FROM allowOrgOverride TO NEW_KEY on DEFAULT_METADATA_TYPE_REGISTRY entries and GET /meta/types entries, Clause-②: yes (narrowing), the ADR-0087 registered marker naming the retired-keys entry and the D3 id. Comment-only packages publish nothing.",
      "check:generated source audits (run as a whole set) + the qa/dogfood radius → 3 dogfood suites name the key (managed-content-sealed, showcase-permission-projection, two-doors-permission)."
    ],
    "read_side_trap": "The tombstone fails tsc for every WRITER of the old key (the 28 rows) and for strict comparisons against a boolean. A truthiness READER (if (!entry.allowOrgOverride), a filter on e.allowOrgOverride, toMatchObject) still compiles, because the tombstone output is an optional property, and silently reads undefined. A missed protocol or repository reader turns all five types non-overlayable: that is exactly what S1's ablation measured (403 NOT_OVERRIDABLE). S1's five-type pins, the identity pins and the wire pin are the net. Readers to rename by hand: protocol.ts:7762/:7763/:15693 and sys-metadata-repository.ts:352."
  },
  "wire_field": {
    "schema": "spec api/protocol.zod.ts GetMetaTypesResponseSchema :203 (a plain z.object): entries[].supportsOverlay :210 ('Loader can merge per-org overlays on top of artifact'), entries[].allowOrgOverride :211 ('Per-org overlay writes accepted at runtime (may be env-elevated)'), entries[].overrideSource :217 ('Whether allowOrgOverride is set in the static registry or via OS_METADATA_WRITABLE env var'), comment :1606. authorable-surface/api.json tracks only GetMetaTypesResponse:entries and :types, so the field rename is invisible to every spec gate except the regenerated references/api/protocol.mdx. GetMetaTypesResponseSchema has 0 runtime parse sites. @objectstack/client meta.getTypes (client/src/index.ts:1780, :7655) types the response from spec, so a typed client consumer gets a compile error.",
    "writers": "ONE server writer: protocol.ts getMetaTypes :7709. Registry arm: ...base at :7759 spreads the registry entry (after the rename it carries NEW_KEY unelevated), then :7762 writes allowOrgOverride: base.allowOrgOverride || isEnvOverridden and :7763 overrideSource. Synthesized arm (types with no registry entry): :7832 and :7838. ⚠ Renaming the spec alone leaves the wire carrying BOTH names: NEW_KEY from the spread, unelevated, and the old name from :7762, elevated. :7762/:7763 must move, with the hatch elevation applied to NEW_KEY, and the wire pin asserts the old name absent. Transports pass the payload through: REST GET /api/v1/meta (rest-server.ts:5674-5681; translateMetaTypesResponse :4210 spreads each entry), and dispatcher runtime/domains/meta.ts:952 and :1983."
  },
  "objectui": {
    "head": "objectui origin/main 1d1cfe0c11 (git fetch origin main in /home/user/objectui; no checkout, no edit). The pin 0df67f237c5a and the ruling's 2063f7a96c are both ancestors of it (merge-base --is-ancestor exit 0, which proves ancestry even on the shallow clone).",
    "recount": "12 non-test source files / 50 hits: the same file set as the ruling's 2063f7a96c (52 hits; ResourceListPage.tsx 3 → 1) and as the pin. metadata-admin: ResourceEditPage.tsx 12 (write gates :1442-1443 and :1882-1885; the read-only banner token :2550), PermissionMatrixEditor.tsx 17 (gates :409/:410/:428), DirectoryPage.tsx 3 (:171/:175 filters, :458 badge), ResourceListPage.tsx 1 (:428), StudioHomePage.tsx 1 (:223), EmbeddedItemEditor.tsx 1 (:104), PageShell.tsx 1 (:100), registry.ts 3 (:462/:464/:472), useMetadata.ts 2 (:77 type), i18n.ts 5 (2 strings × en/zh + 1 comment), previews/PicklistPreview.tsx 1; studio-design/BuilderLanding.tsx 3 (prose). Also 58 test files / 112 hits, content/docs/guide/console.md 1, pending .changeset/11808-readonly-package-card.md 1, and 3 CHANGELOGs / 10. Total 75 files / 174 hits.",
    "own_type": "YES. objectui declares the field itself: RichMetadataTypeEntry { allowOrgOverride?: boolean; overrideSource?; supportsOverlay? } (useMetadata.ts:72-89), plus resolveResourceConfig's serverEntry and return types (registry.ts:456-472). References to GetMetaTypesResponse / MetadataTypeRegistryEntry in objectui packages: 0, against a control of 347 '@objectstack/spec' import lines. A missed rename therefore compiles, passes the Console Pin Gate, and turns every packaged item of the five types read-only in Studio, silently. supportsOverlay is declared at useMetadata.ts:89 and read nowhere in objectui source."
  },
  "cloud": {
    "helpers": "NOT MEASURED. Reason: objectstack-ai/cloud is not among this session's repositories. The ruling's own reading at cloud main 9c4299c264 is 0 production readers and 2 test helpers: packages/service-ai-studio/src/__tests__/write-door.ts:58 and metadata-tools.test.ts:305. Both derive the locked-type set from the field. How cloud consumes objectstack (npm range, pin or override) is also NOT MEASURED, and that decides when 'the same window' opens for cloud.",
    "prescribed_handoff": "From .claude/skills/pm-dispatch/references/cross-repo-coordination.md: cloud is a single-lane repo (its repo:* seat triages itself; ⛔ no domain:* label). Rule 1: the card lives where the fix lands, in cloud. 'Transfers land in the other side's queue': the target repo gets a card carrying pm:queue, a provenance line and a one-line executable criterion, with the dependency as Blocked-by: objectstack-ai/objectstack#22340 (or the S2 PR). Rule 3: the executing seat that ACCEPTS the S2 PR files that follow-up in the consuming repo at once ('联动杂事立单,不靠记忆'). 'An unreachable target repo is a reading gap, not a landing point': a seat that can reach cloud files the card there, and until then the request is recorded on the seat post or a coordination card (this card). Linked cards are never in the same batch. Proposed criterion line: rename allowOrgOverride → NEW_KEY at write-door.ts:58 and metadata-tools.test.ts:305, landing with cloud's adoption of the objectstack release that carries S2, so the derived locked-type set stays every type but the five."
  },
  "contract_review_input": {
    "candidates": [
      "allowEnvironmentOverlay: exact collisions 0 (objectstack tree, spec src, objectui main; control allowRuntimeCreate -w 513 / 97). It reads like these: ADR-0131 D6's own wording ('O — overlay … an environment row of the same name replaces the managed item whole — ADR-0005's environment layer'); the wire's scope word overlayScope z.enum(['env']) (protocol.zod.ts:511); the live refusal sentences, which already say 'environment overlay' (packaged-base-regime.ts:407 'its type takes no environment overlay (allowOrgOverride=false)'; sys-metadata-repository.ts:2008 'has no environment overlay channel'), so after the rename they name concept and key with the same words; 'environment overlay' appears 73 times in prose. Pairs with supportsOverlay (capability vs permission) and with the allow* sibling allowRuntimeCreate. Confusable: 'env' meaning an environment VARIABLE in overrideSource 'env' / OS_METADATA_WRITABLE; spelling Environment in full keeps them apart.",
      "allowEnvironmentOverride: exact 0. It sits beside overrideSource 'registry'|'env' on the same wire entry, where 'env' means the OS_METADATA_WRITABLE variable, so 'environment override' reads as 'overridden by an environment variable', i.e. the hatch. It shares the stem of NOT_OVERRIDABLE (617) and the write intent override-artifact (141), and keeps the override/overlay split that ADR-0005, ADR-0126, ADR-0131 and supportsOverlay do not use. It is the smallest edit from the old name.",
      "allowPackagedOverlay: exact 0; 'packagedOverlay' 4 (a fixture builder in rest meta-object-owd-gate.test.ts, same sense). It names the object (the packaged item) but drops the scope; if a per-organization axis ever returned, one scope-less key would again govern two scopes, which is the shape ruling C closed. It also reads as 'an overlay that ships in a package' (overlay rows carry the package_id of what they customize; ADR-0070).",
      "Excluded: allowPackagedItemOverlay (the C reading with more letters); a regime enum such as customizationRegime 'overlay' (would also absorb packaged-base-regime.ts's table: a new published enum surface outside the ruled rename); overlayWritable (a retired key on MetadataManagerConfig.persistence, 19 spec hits, which would confuse two prescriptions); allowOverlay / overlayable (scope-less; 'overlayable' is already prose 10 times)."
    ],
    "four_axes_on_the_name": "实际业务需求: measured, and the same for every candidate. Writers are the 28 registry rows and test fixtures; no author can write a registry entry. Readers are the protocol write gates, the read seal (since #15206 S5), the repository put gate, the wire → objectui's 12 source files, and cloud's 2 test helpers (ruling's reading). So this axis does not separate the names; it fixes their meaning: environment overlay of a packaged item, on write, read and Studio. 项目长远合理性: allowEnvironmentOverlay uses ADR-0131 D6's, ADR-0005's and the wire's own vocabulary and states the scope, so a future second axis would get its own key; allowPackagedOverlay drops the scope (ruling C's closed shape); allowEnvironmentOverride keeps a vocabulary split. 防 AI 犯错: allowEnvironmentOverride has the strongest misreading (env-variable hatch, beside overrideSource 'env'); allowPackagedOverlay has the 'shipped overlay' misreading; allowEnvironmentOverlay leaves the env-variable reading as residue, reduced by the full word. 创业阶段不扩散: all are one rename with no new capability. Recommendation: allowEnvironmentOverlay.",
    "supportsOverlay_vs_renamed_key": "Each keeps an INDEPENDENT reader at environment scope, so ADR-0049 retires neither. The renamed key decides the save door, the managed-content seal on write AND on read (declinesStoredRow → isUnservedSealedOverlay → isSealedManagedItem, :16615/:16637/:16130), the repository put gate (:1827) and Studio (wire). supportsOverlay decides one thing: whether a stored overlay row of a sealed managed item may be REMOVED. Its readers are refusePackagedBaseRemoval :17018-17020 (mergesOverlayAtRead, called only there; :15812), deleteMetaItem's tier (:25932-25954) and the repository's assertDeleteAllowed :2086. It is also projected to the wire (via the spread) and to MetadataTypeInfoResponse (metadata-manager.ts:2620; api/metadata.zod.ts:302). The truth tables differ on 8 types (supportsOverlay true, key false); the reverse is empty. Gap: supportsOverlay's TSDoc and describes promise a READ capability ('loader can merge overlays', wire: 'per-org overlays') that no read consults. S1 measured this (6070542431), and on main the read keys on the seal, i.e. on the renamed key. Open PR #22833 rewrites the carve-out's rationale ('changes what is served for permission alone'). Reading: correct supportsOverlay's describe and TSDoc to what it gates in S2 (the wire line :210 sits beside :211, which S2 edits); no rename and no retirement."
  },
  "build_plan": {
    "prs": [
      "objectstack S2 (domain:spec; Clause-②: yes (narrowing)). Surface, about 140-160 files (ESTIMATE): spec decl + 5 other spec source + 2 unreleased 18.* entries + 2 new entry files + registry.ts.template; 5 generated (2 authorable baselines, 3 reference pages); 19 non-spec source files (67 b + 8 a-prime hits); 74 test files + a tombstone pin; 3 tooling; 19 docs files + 3 liveness notes; 1-2 changesets; the pin bump (.objectui-sha, sdui.manifest.json, scripts/sdui-manifest.record.json, plus whatever the regeneration moves: #22812 also moved packages/sdui-parser/objectui-lockstep.json, spec ui/*.zod.ts and pin-citation recounts in 6 semantic entries, with 2 changesets). Changed lines (ESTIMATE, additions + deletions, generated INCLUDED): rename and kit about 1,100-1,600 (tests about 600, b source about 150, declaration about 135, docs about 140, ledger and new entries about 90, tooling about 60, changeset about 50, a-prime rewrites about 40, generated about 20); pin bump about 590-680 (the last two measured: #22812 676 / 21 files, #22592 587 / 21). Total about 1,700-2,300, under the 3,000 human-merge threshold by an estimated 700+. NOT MEASURED until the branch exists: dispatch-gates.mjs with no paths on the built branch, and check-governed-merges.mjs --pr N at landing. The surface is not governed (S3 is split off).",
      "objectui companion (the ruling: filed in the objectui lane). Surface: the 12 source files (50 hits; the RichMetadataTypeEntry and registry.ts types, the gates, both i18n locales, BuilderLanding prose) + 58 test files (112) + content/docs/guide/console.md + a changeset. ESTIMATE about 300-450 changed lines. Merges just before S2; reads NEW_KEY only (a dual read would be the ruled-out C, a consumer-side fallback).",
      "cloud (single-lane repo:* seat; NOT MEASURED): the 2 test helpers, an ESTIMATED 4-10 lines, in the same window as the release that carries S2.",
      "objectstack S3 (governed text, Tier H): AGENTS.md:191, skills/objectstack-ai/SKILL.md:347, ADR-0005 :47/:68 + a top note in the shape of its :3 note (optionally an ADR-0010 status note). ESTIMATE 20-30 lines. dispatch-gates --tier today: MANDATORY claude-fable-5-1 (skills/**, no one-line exemption); the skills line-budget readings are owed (whole-file and whole-catalog before/after)."
    ],
    "landing_order": "1. PR #22794 (#22682, claim 6109075588) takes .objectui-sha 0df67f237c5a → 4997995022 with its manifest regeneration. Its file list today has 3 files and no pin yet; S2's bump waits behind it (single-claim path). 2. PR #22833 (#15206 S5 carry-overs, draft) lands, and S2 rebases onto it. 3. S2 is built to review-ready without the pin step, and the contract review fixes NEW_KEY (the objectui PR needs the name). 4. The objectui companion is reviewed and merges. 5. S2 bumps .objectui-sha to that merge commit (or later objectui main) with the regeneration, and lands; the Console Pin Gate builds objectui at the new pin. 6. cloud's PR lands in the same window, through its own seat. 7. S3 follows S2. The one-landing rule (ruling Q2 A; AGENTS.md Post-Task 4 authorizes the sibling fix and the bump 'as part of the same landing') keeps the bump inside S2. A separate bump PR would leave main's console reading the old name against a renamed server between the two merges.",
    "serial_constraints": "Open PRs: 9, of which 8 file lists were read (#21988 is the Version Packages PR): #22833 shares protocol.ts (doc comments around isSealedManagedItem / refusePackagedBaseRemoval, the neighbourhoods of S2's :16331/:16357/:16996 hits) and metadata-lifecycle.mdx (:144); it also edits .changeset/15206-reads-environment-only.md, which S2 never edits. #22819 shares objectql engine.ts; its hunks (:400 to :19513 range, 6 hunks) are clear of S2's :3446 comment. #22794: sequencing on .objectui-sha only. #22838, #22836, #22834, #22832, #22830: no file in common. #21988 Version Packages: CHANGELOGs only, never edited by S2. In-flight claims beyond these were not scanned (the dev does not pull the board). The card body still names a D2 conversion, 'Clause-②: yes (widening)' and 'either order or in parallel'. Ruling 6073921182 and seat review 6069745527 supersede all three, so the build claim should cite them.",
    "reviews_owed": "S2: a contract-tier review at CONTRACT_REVIEW_TIER: a '## Contract review' record with the Served-tier line and PASS on the CURRENT head, which fixes NEW_KEY and answers the supportsOverlay question, plus the seat's ACCEPT, then queue on green (Tier S path not needed: no governed surface). The pin bump changes the head after the review, and the 'pure regeneration' exception does not cover the hand-set .objectui-sha, so record the review on the post-bump head or re-review the delta. The record should name the objectui head it pairs with. objectui companion: objectui lane review on objectui's own gates. cloud: its repo:* seat. S3: Tier H (maintainer approval), fable built."
  },
  "tests": "No build, no install, no test ran; nothing was written to the repository (git status --porcelain empty throughout; branch never pushed). Read-only probes: (1) the git grep census with glob pathspecs and controls at efcbac73cc, repeated at d8c7d38648 (670 / 167 both; the diff names the key on 0 lines); every non-test source hit line read in context, every test hit line read; class totals by a script over the grep output (sum 670). (2) DEFAULT_METADATA_TYPE_REGISTRY parsed from source text (python, read-only): 28 entries, five true, 8 supportsOverlay-only, 0 reverse. (3) objectui: git fetch origin main, then git grep at 2063f7a96c, the pin 0df67f237c5a and main 1d1cfe0c11; ancestry exit 0 for both. (4) node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --tier and --commands over the 142-path S2 list (exit 0: no path mandate, clause-② suspect on 14 spec paths, 154 derived commands); --tier on the S3 paths: MANDATORY claude-fable-5-1. These are derivations, not gate runs. (5) npm view @objectstack/spec dist-tags: latest 17.7.0, so the 18.* entries are unreleased. (6) REST reads: card + 11 comments; #22682 claim 6109075588; the open-PR list (9) and 8 file lists; the #22833 patch for its 3 shared files; #22819's engine.ts hunk headers; PRs 22812 / 22592 / 22363 sizes. Ancestry: c8b062f011 (S5) and 7fbfef4c7 (S1) are ancestors of the base, exit 0 each.",
  "mcp_calls": "0 — no MCP tool called",
  "api_writes": "1 — this os-dev-report comment, through scripts/pm/post-stamped.mjs and the fleet-write relay (the target write is POST /repos/objectstack-ai/objectstack/issues/22340/comments). The card's assignee and labels were not written; there was no push and no PR.",
  "open_questions": [
    {
      "question": "For the S2 contract review (not the maintainer): which name does the renamed key take?",
      "options": [
        "A allowEnvironmentOverlay: scope + mechanism, in ADR-0131 D6's, ADR-0005's and the wire's own words; residual 'env-variable' reading.",
        "B allowEnvironmentOverride: smallest edit; reads as 'overridden by an environment variable' beside overrideSource 'env'.",
        "C allowPackagedOverlay: names the object, drops the scope (ruling C's closed shape); also reads as 'an overlay shipped in a package'."
      ],
      "recommendation": "A, on the four axes in contract_review_input: business pull is identical for all three (measured), so long-term vocabulary and the AI-misreading axis decide; A matches the refusal sentences that already say 'environment overlay'."
    },
    {
      "question": "For the S2 contract review: supportsOverlay and the renamed key: does either retire under ADR-0049?",
      "options": [
        "A Keep both (independent readers, truth tables differ on 8 types); correct supportsOverlay's describe and TSDoc to what it gates (the removal carve-out) in S2.",
        "B Retire supportsOverlay and re-key the delete carve-out on something else: moves a ruled delete asymmetry onto a new predicate, with no pull.",
        "C Rename supportsOverlay too: outside the ruled rename."
      ],
      "recommendation": "A: both are enforced, so ADR-0049 retires neither; the describe correction is a zero-code contract tightening that removes a 'loader merges' promise no read keeps."
    }
  ],
  "out_of_scope_findings": [
    "carrier: the objectui companion PR of this card's S2 · noted, not filed. Studio's read-only-type banner (objectui main 1d1cfe0c11 ResourceEditPage.tsx:2548; string engine.edit.readOnlyTypeBanner, i18n.ts:2076 en / :5378 zh) tells an admin to set OBJECTSTACK_METADATA_WRITABLE and to 'flip {override} in the registry'. DirectoryPage.tsx:468 and PageShell.tsx:111 label env-elevated types 'Writable via OBJECTSTACK_METADATA_WRITABLE env var', and useMetadata.ts:87 repeats it. objectstack main reads only OS_METADATA_WRITABLE (sys-metadata-repository.ts:415, the one reader since the #22411 change), and the registry is a TypeScript literal no deployment edits. reach: NOT MEASURED (no browser run in a read round), so this is not filable as class a. The companion edits these exact lines ({override} at :2550 renders allowOrgOverride).",
    "carrier: S2 of this card · noted, not filed. Published describes still say per-organization: the registry key's describe metadata-plugin.zod.ts:268 and TSDoc :255-267 ('end-user organizations may write per-org overlay rows'; 'only view and dashboard opt in'; lower-case not_overridable), the wire protocol.zod.ts:211 and :210 (supportsOverlay 'Loader can merge per-org overlays on top of artifact'), and system/email-template.zod.ts:16 ('tenants can override'). All are rendered into references/kernel/metadata-plugin.mdx and references/api/protocol.mdx.",
    "carrier: S2 of this card · noted, not filed. These name 'ADR-0005's org-scoped overlay (opt-in via allowOrgOverride)' as a live mechanism: the customizationPolicies tombstone prescription (metadata-plugin.zod.ts:514-521, runtime text), kernel/index.ts:30-31, the unreleased D3 18.metadata-customization-protocol-retired.ts:20 and its STEP18_RATIONALE fragment in registry.ts.template ('ADR-0005's org overlay'). The prescription is pinned by metadata-customization-retirement.test.ts:58.",
    "carrier: S2 of this card · noted, not filed. Two plugin-security test doubles throw a refusal sentence no producer emits any more ('the type has not opted into per-org overlay writes (allowOrgOverride=false)', packaged-permission-set-restore-leg.test.ts:211, permission-set-projection.test.ts:156; producer comment permission-set-projection.ts:1393).",
    "carrier: S2 (the anchors) and S3 (ADR-0029:386) · noted, not filed. docs/qa/platform-checklist/areas/platform-core.json:492 and studio-authoring.json:1257 anchor 'metadata-plugin.zod.ts#allowOrgOverride'. The tombstone keeps the word at line start, so both stay green while pointing at the retired key.",
    "carrier: PR #22833 (in flight) and S2 · noted, not filed. #22833 rewrites the #6960 carve-out rationale in protocol.ts ('changes what is served for permission alone'); S2's supportsOverlay describe correction should follow that wording."
  ],
  "deviations": [
    "Did not push the empty branch (os-dev rule 1). The dispatch forbids any push in this round and no edit happened, so there was nothing to mark or probe. The role file prevails on a conflict; this one is flagged, not chosen silently (stage 0 did the same).",
    "No pnpm install in the worktree: no edit, build or test.",
    "Ran node scripts/pm/dispatch-gates.mjs (--tier, --commands) as read-only derivations. The dispatch bars builds, installs and test runs, and this is none of them.",
    "git fetch origin main in /home/user/objectui moved that checkout's shared remote ref (FETCH_HEAD / origin/main) as the dispatch prescribes; no checkout or edit there. origin/main in objectstack also moved during the run, through another session's fetch (shared refs); the census stays anchored to efcbac73cc and was re-read at d8c7d38648.",
    "Classification is by line: protocol.ts splits a-prime / b, save-meta-response-conformance splits b / not-a, and two test files moved from stage 0's (a) to (b) because S4 rewrote their organization cases env-wide (overlay-precedence, protocol-meta).",
    "The worktree ../objectstack-issue-22340 is removed after this report (clean, never pushed)."
  ],
  "files_changed": []
}

Report written 2026-10-11T13:03Z; census base efcbac7, re-read at d8c7d38.

Generated by Claude Code

Seat review of #22340 S2's re-measure (`6109312314`): accepted. The order is set; the name is fixed by an at-tier review before the build

domain:spec seat 3 (#18883) · zhuangjianguo · session session_01KNKBCRDJCu5tGy3TEbvtrF · 2026-10-11T13:06Z · holder of claim 6109099576. Thread-read: 6109312314.

Round terms met: no repository file was written, nothing was pushed and no PR was opened. The worktree is removed.

Accepted readings (measured at efcbac73cc, re-read at d8c7d38648):

Census: 670 hits in 167 files, against stage 0's 765 / 176. No code path decides an organization-scoped write, read or threading any more, so the order in ruling 6073921182 (S2 after feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 S5) is met.
- 9 prose hits in 6 files still tie organization scope to the flag. S2 rewrites them; a mechanical rename is not enough.
- 44 test hits in 20 files label specimens that pin the retired path's absence. S2 renames or rewrites those labels.
New since stage 0: the flag also decides the served read. declinesStoredRow → isUnservedSealedOverlay → isSealedManagedItem withholds an environment overlay of a packaged item when the type lacks it, permission excepted. The key is now the single decider of "may an environment overlay this packaged item", on write, on read and in Studio. That is ruling C's meaning.
The kit, on today's model:
- the retired-keys file 18.kernel__MetadataTypeRegistryEntry__allowOrgOverride (the exact string authorable-surface/kernel.json:347 carries);
- a D3 entry file;
- a STEP18_RATIONALE fragment in registry.ts.template at order 94.
No registry.ts, spec-changes.json or upgrade guide is committed (since build(spec): the migration registry is generated at build and leaves git #22706), and no D2 conversion is registered.
The read-side trap is real: a truthiness reader of the old key still compiles against the tombstone and reads undefined, which closes all five types. The four code readers (protocol.ts:7762, :7763, :15693, sys-metadata-repository.ts:352) are renamed by hand. S1's five-type pins, the identity pins and the wire pin are the net.
The wire: there is one server writer, getMetaTypes. Renaming the spec alone would put BOTH names on the wire, so :7762 and :7763 move with the hatch elevation applied to the new key, and the wire pin asserts the old name absent.
objectui: main 1d1cfe0c11 reads the field in 12 non-test source files (50 hits), through its own RichMetadataTypeEntry type. No gate sees a missed rename there; Studio would turn the five types read-only.

Set by the seat (order and dependency, not a product question):

The name and the supportsOverlay question go to an at-tier review now, before the build (ruling: "the new name is fixed by the contract review"). The objectui companion needs the name, and building S2 on a guessed name would cost a second rename. The report recommends allowEnvironmentOverlay, and A on supportsOverlay: keep both keys, and correct supportsOverlay's describe to what it gates. The review decides; it posts its record on this card.
S2 is built after that, on the reviewed name and to review-ready, without the pin step, on a branch this card names. It lands behind PR feat(spec): the position form picks permissionSets from the permission-set registry (ref-multi:permission), with the console pin moved to 4997995022f8 #22794 (spec: catalog references in authoring surfaces become names (approver position binding, decision-output positions, the position form's permissionSets widget), ADR-0131 D4, from #15204 #22682, which moves .objectui-sha now), and after PR fix(metadata-protocol): S5 carry-overs — per-term boot report isolation, one naming of a code-datasource row, seal TSDoc wordings, two changeset rows #22833 (feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 S5's carry-overs, which shares protocol.ts comment regions and metadata-lifecycle.mdx) if that lands first.
The objectui companion is filed in objectui by this seat once the name is fixed. It reads the new name only: no dual read, which would be the ruled-out C. It also carries the re-measure's finding that Studio's read-only banner prescribes OBJECTSTACK_METADATA_WRITABLE and "flip {override} in the registry". It merges just before S2.
S2 then bumps .objectui-sha to that merge, regenerating with the tooling, and lands. A contract review on the post-bump head is the landing record.
cloud's two test helpers: this session cannot reach cloud. Under cross-repo-coordination.md, the request is recorded on this card until a seat that reaches cloud files it there: rename allowOrgOverride at packages/service-ai-studio/src/__tests__/write-door.ts:58 and metadata-tools.test.ts:305, in the window of the objectstack release that carries S2.
S3, the Tier H governed text, follows S2.

Superseded on the card body: the D2 conversion, Clause-②: yes (widening) and "either order or in parallel". Ruling 6073921182 and seat review 6069745527 replace all three; the build claim cites them.

Carried into S2 (the re-measure's notes):

the published describes that still say per-organization (the registry key's TSDoc and describe; the wire's :210 / :211; email-template.zod.ts:16);
the customizationPolicies tombstone prescription;
kernel/index.ts:31;
the unreleased D3 18.metadata-customization-protocol-retired;
two plugin-security test doubles throwing a sentence no producer emits;
the two #allowOrgOverride checklist anchors.

Generated by Claude Code

Contract review, part 1 (pre-build): the new key is `allowEnvironmentOverlay`

domain:spec seat 3 (#18883) · zhuangjianguo · session session_01KNKBCRDJCu5tGy3TEbvtrF · 2026-10-11T13:20Z · holder of claim 6109099576. A design-level record, written because ruling 6073921182 (and #22007 ruling C, 6028809298) fixes the new name "by the contract review" and the objectui companion must read it before S2 is built. There is no PR and no head: the ## Contract review on the built S2 head is a separate record at landing. ⛔ Not a claim. Thread-read: 6109343061.

Served-tier: CONTRACT_REVIEW_TIER
Reviewed-by: session_01KNKBCRDJCu5tGy3TEbvtrF
Local-runs: none

Inputs, and nothing else: the card body and its 13 comments (above all ruling 6073921182, seat review 6069745527, S1's ACCEPT 6070542431, the re-measure 6109312314, the seat's review of it 6109343061); ruling C 6028809298 on #22007; ADR-0131 D6 / C5, ADR-0005, ADR-0126, ADR-0049, ADR-0087 D2 / D3; packages/spec/src/kernel/metadata-plugin.zod.ts, packages/spec/src/api/protocol.zod.ts, packages/metadata-protocol/src/protocol.ts and sys-metadata-repository.ts, all read at objectstack origin/main 1eff3224d7; objectui origin/main dca25aff2e by git grep. Read-only: no worktree, no build, no test. The report's recommendation was not taken on trust; every reading below was re-taken from the trees, and where it differs from the report or the seat review the difference is named.

1. The new key's name: `allowEnvironmentOverlay`

Collisions, measured (exact, both trees). allowEnvironmentOverlay 0 / 0; allowEnvironmentOverride 0 / 0; allowPackagedOverlay 0 / 0 (packagedOverlay 4 hits, all one fixture builder in packages/rest/src/meta-object-owd-gate.test.ts:144); allowEnvOverlay / allowEnvOverride 0 / 0; no allowEnvironment*, EnvironmentOverlay or EnvironmentOverride stem anywhere in either tree, case-insensitive. Control: allowRuntimeCreate hits on every registry row. Neighbours by reading, on the same entry or the same wire record: overrideSource: z.enum(['registry', 'env']) (protocol.zod.ts:217), where env is the OS_METADATA_WRITABLE environment VARIABLE; overlayScope: z.enum(['env']) (protocol.zod.ts:511), where env is the environment LAYER of ADR-0131 D6; supportsOverlay (metadata-plugin.zod.ts:253); capabilities.overlay on MetadataPluginConfig (:673, a plugin capability); the retired persistence.overlayWritable tombstone (metadata-loader.zod.ts:193); and the allow* sibling on the same entry, allowRuntimeCreate (:274). The *Overlay identifier population in both trees is navigation and view-overlay vocabulary (NavigationOverlay, listOverlay, formOverlay), none of it a type-level permission.

The three candidates, read at a call site.

allowEnvironmentOverlay — the scope word is the canonical one (ADR-0006's environment, the same word the wire already uses in overlayScope) and the mechanism noun is the one ADR-0126 §3 (regime O, :176), ADR-0131 D6 (:385, and the table row "O — environment overlay, same name" at :417) and supportsOverlay use. The live refusal sentences already name the concept in exactly these words: packaged-base-regime.ts:407 "its type takes no environment overlay (allowOrgOverride=false)", sys-metadata-repository.ts:2008 "has no environment overlay channel (allowOrgOverride=false)". After the rename the sentence and the key say the same thing. Residual misreading: "environment" as the variable; bounded by the full word, by overrideSource's own describe naming the variable, and by the two refusal sentences that already distinguish them ("and OS_METADATA_WRITABLE does not open a managed item").
allowEnvironmentOverride — 0 collisions, but it sits on the same wire record as overrideSource: 'env'; "environment override" beside "override source: env" reads as "overridden by an environment variable", which is the hatch, and the hatch is the one thing the registry value is NOT (ADR-0131 D6: the hatch never reaches a managed item, protocol.ts:15823-15826, :16130-16133). It also keeps the override/overlay split that ADR-0005, ADR-0126, ADR-0131 and supportsOverlay do not use, and shares its stem with NOT_OVERRIDABLE and the write intent override-artifact (metadata-core/src/types.ts:158), which are the refusal and the intent, not the permission. Not taken.
allowPackagedOverlay — 0 collisions; it names the object and drops the scope. A scope-less key is the ruled-out shape: if an org-owned overlay object ever returns (ADR-0131 D6 :445-447 leaves that door described), one key would again govern two scopes. It also reads as "an overlay that ships in a package" (ADR-0070's package-first authoring). Not taken.
A better one was looked for: allowEnvironmentOverlayOfPackagedItems says the same with more letters; environmentOverlayable breaks the allow* pattern of its sibling and "overlayable" is already loose prose in ten places; a regime enum would be a new published surface outside the ruled rename. None beats the first.

It says what ruling C says the key means — "may an environment overlay this packaged item" — and on today's main the key is the single decider of that, at every door: on write, isSealedManagedItem (protocol.ts:16130-16133) is artifact-backed AND NOT registryAllowsOverlay (:15827, over OVERLAY_ALLOWED_TYPES, whose read of the flag is :15693), asked by the save door (:19977, :20034) and mirrored by the repository put gate (sys-metadata-repository.ts:352, :1827); on read (new since #15206 S5), declinesStoredRow (:16615) → isUnservedSealedOverlay (:16637-16639, permission excepted) → isSealedManagedItem, so a stored environment row of a managed item of a type without the key is withheld from getMetaItem / getMetaItems / layered (:8896, :8908, :9877, :10575); in Studio, the wire value :7762 read by objectui ResourceEditPage.tsx:1442 and :1884 for an artifact-backed item. The name states the scope (environment) and the act (overlay); the object (the packaged item) is what a type-level permission on an overlay has always governed, and the describe carries it.

Ruled-out shapes, checked: one key, not two (the old name becomes a retiredKey() tombstone whose prescription names the new key, Q1 A); not the old name with a new meaning (a hard rename, the ADR-0006 v4 precedent, check:authorable-surface refusing a live-to-absent without the retired-keys entry); not scope-less.

For the build (the describes the name needs): the key's TSDoc and describe at :255-268 still say "end-user organizations", "per-org", "only view and dashboard opt in" and lower-case not_overridable; S2 rewrites them to the meaning above. A describe that fits: Whether an environment may overlay an item of this type that a managed package ships (ADR-0131 D6 regime O). Decides the save door, the managed-content seal on write and on read, and Studio's write gate; the OS_METADATA_WRITABLE hatch does not reach a managed item. Default false. The tombstone's prescription: allowOrgOverride was renamed to allowEnvironmentOverlay in @objectstack/spec 18 (ADR-0131 D6 retired the per-organization overlay axis; the key now names the one scope it governs). Rename the key; the value is unchanged. The customizationPolicies prescription (:514-521), kernel/index.ts:31, email-template.zod.ts:16 and the unreleased D3 entry 18.metadata-customization-protocol-retired.ts:20 name the old key as a live per-org mechanism; the same rewrite reaches them.

Four axes (long-term leads). Long-term soundness: one vocabulary from the registry through the wire (overlayScope: 'env'), the ADRs and the refusal prose; the scope is in the name, so a second scope, if ever pulled for, gets its own key and never reuses this one; no new surface. Measured business pull: identical for the three candidates and so it fixes the meaning, not the pick — writers are the 28 registry rows and nothing else (an author cannot write a registry entry: MetadataTypeRegistryEntrySchema has no non-test parse site, re-read at 1eff3224d7; contributes.kinds is closed; additionalTypes is a tombstone at :562); readers are the two write gates, the read seal and the wire, which objectui reads in 12 non-test source files / 50 hits at dca25aff2e (same file set as the ruling's 12 / 52). AI error: a customer's AI agent or Studio reading /meta/types must not mistake the hatch for the permission; B has the strongest misreading, C the "shipped overlay" one, A's residue is bounded above. The tombstone refuses the old spelling loudly at parse and at tsc for every writer; the one quiet path — a truthiness READER of the old key compiles against the tombstone and reads undefined, which closes all five types — is exactly what S1's ablation measured (403 NOT_OVERRIDABLE), and S1's five-type pins, the identity pins and the wire pin are the net. Startup focus: one rename, no window, no second key, no new capability, no new gate.

2. `supportsOverlay` versus the renamed key: both stay; `supportsOverlay`'s describes are corrected in S2

The report's claim re-verified, adversarially. Each flag keeps an independent, decision-changing reader at environment scope.

The renamed key: OVERLAY_ALLOWED_TYPES (protocol.ts:15693) → registryAllowsOverlay (:15827) → isSealedManagedItem (:16130-16133), reached by the save door (:19977), the package door (:16388, :20034), the removal door (:17020), and the read seal (:16637 → :16615, four served reads); isOverlayAllowed (:15843, the registry arm OR the hatch) at :19905, :21365, :21549, :21955, :25396, :25932, :26043; the repository's own OVERLAY_ALLOWED_TYPES (sys-metadata-repository.ts:352) → assertAllowed (:1827); the wire (:7762, :7832).
supportsOverlay: OVERLAY_CAPABLE_TYPES (protocol.ts:15793-15801, the read at :15796) → mergesOverlayAtRead (:15812), called ONCE, at :17018-17020 inside refusePackagedBaseRemoval, which deleteMetaItem reaches at :25985 and the folded write path at :16386; the repository twin OVERLAY_CAPABLE_TYPES (sys-metadata-repository.ts:391) → assertDeleteAllowed (:2079-2088, reached from delete at :952). Two projections that decide nothing: the /meta/types spread (:7759) and MetadataTypeInfoResponse.supportsOverlay (metadata-manager.ts:2620; api/metadata.zod.ts:302). No served read consults it: getMetaItem, getMetaItems and the layered read ask declinesStoredRow, which keys on the renamed key; S1's ACCEPT (6070542431) measured the same on the read. objectui declares it (useMetadata.ts:89) and reads it nowhere.
Truth table, re-parsed from the 28 rows at 1eff3224d7: both true on view, dashboard, report, translation, email_template; supportsOverlay true with the key false on page, app, dataset, book, permission, position, tool, skill (8); the reverse 0. The 8 are exactly the delete carve-out's population, so supportsOverlay is not derivable from the key.

ADR-0049 retires neither. Its gate (:25-34) puts a declared property in one of three states — enforced, experimental, absent — and both are in the first: a runtime consumer reads each and changes a decision (file:line above). ADR-0049's title names security properties, but its scope note (:158-163) records that this repository cites it as the enforce-or-remove policy for spec properties generally, and the registry's own field row applies it that way (metadata-plugin.zod.ts:752-753). ADR-0131 D13 (:648-670) lists the retirements C5 owes and names neither flag.

What S2 must correct: the claim is wider than the enforcement. supportsOverlay's TSDoc (:249-252: "platform/user overlays can be applied on top of package-delivered metadata"), its describe (:253: "Whether overlay customization is supported") and the wire describe (protocol.zod.ts:210: "Loader can merge per-org overlays on top of artifact") all promise a READ capability, in the retired scope word. On today's main the read is decided by the seal, i.e. by the renamed key: for seven of the eight carve-out types (permission excepted at :16638) a stored overlay row of a managed item is withheld at :16637, so "the loader merges it" is false twice — wrong scope and wrong path. The registry's own field comment already says the true thing (:755-757: "supportsOverlay gates no read path at all — only assertDeleteAllowed consults it"), and the ADR-0049 state the flag is in requires the claim to be as narrow as that. The corrected meaning, one sentence, for the TSDoc, the describe at :253, the wire describe at protocol.zod.ts:210 and api/metadata.zod.ts:302:

supportsOverlay — a stored overlay row of an item a managed package ships may be removed through the ordinary delete door without the type's environment-overlay permission, because removing it restores the managed definition (the #6960 repair carve-out); it opens no save and it decides no read.

The TSDoc at protocol.ts:15775-15790 ("a CAPABILITY of the read path … an overlay row under this name changes what is served"), the comments at :25927 and :25951-25963, and sys-metadata-repository.ts:383-386 / :2039-2047 carry the same stale read claim; the open PR #22833 rewrites the carve-out's rationale, so S2 lands after it and takes its wording rather than a third one. Not taken: retiring supportsOverlay and re-keying the carve-out on a hand-written list (a parallel list beside the registry, Prime Directive #7's "no parallel whitelists", and a ruled delete-only asymmetry moved onto a new predicate for no pull); renaming it (outside the ruled rename, and its name is not what is wrong — its describes are).

Four axes (long-term leads). Long-term soundness: two flags for two questions, each with one reader, is the smaller contract; the correction shrinks a published claim to its enforcement and adds no surface; retiring would move a maintainer-ruled asymmetry onto a hand list. Measured business pull: the carve-out's population is the 8 types above, and the rows it exists for are on the record (#6960: pre-rollback overlay rows still stored); the describe correction has 0 consumers to migrate (objectui reads the flag nowhere; MetadataTypeInfoResponse is a projection). AI error: a describe promising a read merge the seal withholds is "declared, not enforced" in the exact shape Prime Directive #10 names — an AI reading /meta/types would conclude a page overlay row is served. After the correction a wrong belief is refused loudly: the save answers 403, the read withholds the row. Startup focus: zero code, two describes and the TSDoc; no new key, no window, no gate.

3. The wire: same new name on both writer arms, `overrideSource`'s describe follows, and the elevated value gets an honest describe

Field and describe. GetMetaTypesResponseSchema.entries[].allowOrgOverride (protocol.zod.ts:211; the ruling's :210 is supportsOverlay today, a one-line drift and nothing else) takes allowEnvironmentOverlay. overrideSource's describe (:217) names the field and is rewritten to name the new one: "Whether allowEnvironmentOverlay comes from the static registry or is elevated by the OS_METADATA_WRITABLE environment variable". Its enum values registry | env stay: renaming the enum is outside the ruled rename, env there has always meant the variable, and objectui reads the literal (DirectoryPage.tsx:462, PageShell.tsx:105).
One server writer, two arms, both move. getMetaTypes (protocol.ts:7709). Registry arm: ...base at :7759 spreads the entry, which after the rename carries allowEnvironmentOverlay unelevated; then :7762 writes allowOrgOverride: base.allowOrgOverride || isEnvOverridden and :7763-7765 derives overrideSource from base.allowOrgOverride. Renaming the spec alone therefore puts BOTH names on the wire — the new one from the spread at the registry value, the old one from :7762 at the elevated value — and nothing red catches it: GetMetaTypesResponseSchema has 0 runtime parse sites, getMetaTypes's return is not typed against it, and objectui types the field itself (useMetadata.ts:77; 0 references to GetMetaTypesResponse or MetadataTypeRegistryEntry in objectui's packages against 1057 @objectstack/spec import lines). So :7762 becomes the elevation applied to the new key and :7763 reads it. The seat review (6109343061) names only :7762 / :7763; the report also lists, and this review confirms must move, the synthesized arm — :7832 (allowOrgOverride: writableOverrides.has(singular)) and :7838 — for a runtime-registered type with no registry entry (theme, webhook, connector, sharing_rule, analytics_cube, rag_pipeline), where no spread exists to show the new name and the old one would simply stay. The wire pin asserts the old name absent on both arms: one registry type and one registry-less type.
Transports pass the payload through without restating field names: REST translateMetaTypesResponse (rest-server.ts:4210, { ...entry }), the dispatcher (runtime/src/domains/meta.ts:952, :1983, protocol.getMetaTypes({}) returned whole); @objectstack/client meta.getTypes is typed off GetMetaTypesResponse (client/src/index.ts:1780, :7655), so a typed consumer gets a compile error where objectui gets silence.
Swept for a second emitter the report might have missed — none. MetadataTypeInfoResponse (GET /api/meta/types/:type, api/metadata.zod.ts:296-305, written at metadata-manager.ts:2615-2622) carries supportsOverlay and never the key; contracts/metadata-service.ts:135 likewise; no OpenAPI, SDUI-manifest or lockstep artifact names the key (grep 0). Every other non-test source hit outside the three files is a comment, except one live sentence, packaged-base-regime.ts:407, pinned at protocol.packaged-base-refusal.test.ts:230/:236, sys-metadata-repository.package-writability.test.ts:1321 and rest-meta-packaged-flow-refusal.test.ts:117, which S2 renames with its pins. Nothing else would leave the old name on the wire.
What the elevated value means after D6, and the describe it needs. :7762 ORs the hatch into the field, and since ADR-0131 D6 the hatch does not open a managed item (:15823-15826, :16130-16133), pinned together with the wire by packages/qa/dogfood/test/managed-content-sealed.dogfood.test.ts:125-135 (listing: flow is allowOrgOverride: true, overrideSource: 'env'; PUT of the managed flow: 403 NOT_OVERRIDABLE) and packages/rest/src/rest-meta-managed-seal-hatch.test.ts:181-186. So the renamed field will read allowEnvironmentOverlay: true with overrideSource: 'env' for a type whose managed items are sealed. The describe at :211 must say so, not "may be env-elevated" and stop: true when the registry grants environment overlays of this type's packaged items, or when OS_METADATA_WRITABLE names the type (overrideSource 'env'), which opens the type's writes of items no managed package ships and never a managed item (ADR-0131 D6). Narrowing the field to the registry value alone, with the hatch reported through overrideSource only, would make the name exact but changes the wire's shape and moves objectui's new-item gate (allowOrgOverride || allowRuntimeCreate at ResourceEditPage.tsx:1443, DirectoryPage.tsx:171, StudioHomePage.tsx:223): outside Q2 A (a rename, one landing), not taken here, its own card if ever wanted. Noted for the objectui companion, by reading and NOT MEASURED in a browser: the artifact-tier gate isArtifactItem ? !!entry.allowOrgOverride (ResourceEditPage.tsx:1442, :1884; PermissionMatrixEditor.tsx:409) opens an edit the server seals while the hatch names the type — loud (403), pre-existing, not S2's to change; the companion may qualify that one gate with overrideSource === 'registry', and that is the objectui lane's call. The companion also carries, as the report found, the banner at ResourceEditPage.tsx:2550 that renders the old key literally beside OBJECTSTACK_METADATA_WRITABLE, a spelling the server no longer reads (DirectoryPage.tsx:467, PageShell.tsx:110, useMetadata.ts:87 repeat it).

4. Ruled premises: nothing in the re-measure falsifies one

Each premise of 6073921182 was re-read against the trees named above. (i) No author-reachable parse site for a registry entry: MetadataTypeRegistryEntrySchema's only non-test references are its definition (:340), its docblock and the two type exports (:356, :358); contributes.kinds is a closed shape; additionalTypes is a tombstone (:562) — holds. (ii) The wire field exists, named by overrideSource's describe — holds at :211 / :217. (iii) objectui reads the field in 12 non-test source files — 12 / 50 at dca25aff2e, the ruling's file set. (iv) cloud 0 production readers / 2 test helpers — NOT MEASURED here (cloud is outside this session's repositories); carried as the ruling's own reading, with the hand-off the seat review already records. (v) Exactly five types carry the key — re-parsed, five. (vi) The order (S2 after #15206 S5): no code path decides an organization-scoped write, read or threading any more — the census's class (a) is empty at efcbac73cc and nothing in efcbac73cc..1eff3224d7 names the key. Ruling C's D2 clause was already corrected by Q1 A, on the premise re-confirmed in (i). The re-measure's one new fact — the key now also decides the served read (:16637) — strengthens the meaning ruling C gave the key and changes nothing the maintainer ruled. The elevated-value reading in item 3 is a describe requirement on a pre-existing, pinned wire behaviour, not a ruled premise. Nothing goes back to the maintainer; the build proceeds on allowEnvironmentOverlay.

Carried to the build round, in one line each: the new key's describe and the tombstone prescription (item 1); the five describes and TSDocs of supportsOverlay and the one sentence that replaces them (item 2); both writer arms of getMetaTypes, the overrideSource describe and the honest describe of the elevated value (item 3); the objectui companion reads allowEnvironmentOverlay only, no dual read.

Generated by Claude Code

Claim: PM loop round 8 (#22340 S2, the build: allowOrgOverride → allowEnvironmentOverlay per ruling 6073921182 Q1 A / Q2 A and the pre-build contract review 6109457426. Built to review-ready WITHOUT the pin step, which follows objectstack-ai/objectui#12141's merge) · 2026-10-11T13:23Z
Session: session_01KNKBCRDJCu5tGy3TEbvtrF
Account: zhuangjianguo (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-22340-s2-rename
Worktree: objectstack-issue-22340-s2
Domain: domain:spec
Seat: domain:spec#3 (seat post #18883)
File surface (at origin/main 1eff3224d7 or later; the re-measure 6109312314 maps every file; stop on breach and explain in the report):

The declaration: packages/spec/src/kernel/metadata-plugin.zod.ts.
- allowEnvironmentOverlay gets the review's describe and TSDoc;
- allowOrgOverride becomes a retiredKey() tombstone on MetadataTypeRegistryEntryBaseSchema, with the review's prescription;
- the 28 registry rows and the rationale comments;
- the customizationPolicies prescription, and supportsOverlay's corrected TSDoc and describe (review item 2).
The wire: packages/spec/src/api/protocol.zod.ts (:210, :211, :217, :1606) and api/metadata.zod.ts:302. packages/metadata-protocol/src/protocol.ts getMetaTypes moves on BOTH arms: :7762 / :7763, and the synthesized arm :7832 / :7838 (review item 3). The hatch elevation is applied to the new key, and the describe says the elevation opens only unmanaged items.
The hand-renamed readers (the read-side trap): protocol.ts:15693 and sys-metadata-repository.ts:352, plus every class-(b) file and the 9 class-(a′) prose hits the re-measure lists.
The kit:
- entries/retired-keys/18.kernel__MetadataTypeRegistryEntry__allowOrgOverride.ts;
- one D3 file in entries/semantic/18.*.ts;
- its STEP18_RATIONALE fragment in registry.ts.template (order 94);
- the unreleased 18.metadata-customization-protocol-retired.ts text.
Tests:
- the 74 test files that name the key (rename, or rewrite the labels);
- the tombstone pin;
- the wire pin, with the old name absent on both arms;
- S1's five-type file.
Tooling and docs:
- scripts/check-overlay-whitelist-table.mjs (COL_FLAG and its self-test), moving with content/docs/concepts/metadata-lifecycle.mdx's table header;
- the other content/docs pages and the 8 platform-checklist files, both #allowOrgOverride anchors re-pointed;
- the 3 liveness notes;
- the generated baselines and references, as check:generated decides.
The changeset: BREAKING, FROM / TO, Clause-②: yes (narrowing), and the ADR-0087 registered marker. The level is the one the pre-mode rules give.
⛔ Not this PR:
- .objectui-sha and its regeneration (after objectui#12141 merges, in this PR's next round);
- the governed text (S3: AGENTS.md, skills/**, ADRs);
- CHANGELOGs and pending changesets other than the corrected D3's.
  Container & model: L, mode:subagent, model: default tier (dispatch-gates --tier over the 142-path S2 list: no path-derived mandate; Clause-② suspect on 14 spec paths, judged from the card: yes, narrowing). The contract review at CONTRACT_REVIEW_TIER on the post-bump head is the landing record.
  Clause-②: yes (narrowing: retires an authorable registry key and a wire field; tombstone + retired-keys + D3, no D2)
  Responsibility: n/a — not a defect card (ADR-0131 C5's spec half)
  Thread-read: 6109457426
  Serial constraints cleared:
PR fix(metadata-protocol): S5 carry-overs — per-term boot report isolation, one naming of a code-datasource row, seal TSDoc wordings, two changeset rows #22833 (feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 S5's carry-overs, draft) shares protocol.ts comment regions near isSealedManagedItem / refusePackagedBaseRemoval, and metadata-lifecycle.mdx. Whichever lands second merges main through os-regen-merge.sh. S2 takes fix(metadata-protocol): S5 carry-overs — per-term boot report isolation, one naming of a code-datasource row, seal TSDoc wordings, two changeset rows #22833's carve-out wording for supportsOverlay if fix(metadata-protocol): S5 carry-overs — per-term boot report isolation, one naming of a code-datasource row, seal TSDoc wordings, two changeset rows #22833 has landed.
PR fix(objectql): an aborting after* hook rolls its write back on the default write door #22819 shares objectql/src/engine.ts; its hunks are clear of S2's :3446 comment.
.objectui-sha is single-claim: spec: catalog references in authoring surfaces become names (approver position binding, decision-output positions, the position form's permissionSets widget), ADR-0131 D4, from #15204 #22682's round (claim 6109075588, PR feat(spec): the position form picks permissionSets from the permission-set registry (ref-multi:permission), with the console pin moved to 4997995022f8 #22794) moves it now. S2's bump comes after both feat(spec): the position form picks permissionSets from the permission-set registry (ref-multi:permission), with the console pin moved to 4997995022f8 #22794 and objectui#12141 have merged.
cloud: its two test helpers are recorded on this card (6109343061 item 5) until a seat that can reach cloud files them there.

Generated by Claude Code

os-dev-report

{
  "issue": 22340,
  "status": "done",
  "branch": "claude/issue-22340-s2-rename",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/22874",
  "session": "session_01KNKBCRDJCu5tGy3TEbvtrF (subagent of the PM session; the id the claim's Session line carries). Identity re-checked twice through REST (start of round and after the usage-wall resume): 15 card comments, the newest Claim: is 6109485204 and it names branch claude/issue-22340-s2-rename.",
  "premise_still_valid": true,
  "summary": "S2 built to review-ready WITHOUT the .objectui-sha step, as draft PR #22874 (Part of #22340; Clause-② yes (narrowing)), head 088afc6798. MetadataTypeRegistryEntry.allowOrgOverride is renamed to allowEnvironmentOverlay: the old key is a retiredKey() tombstone whose prescription names the new key, with the retired-keys entry 18.kernel__MetadataTypeRegistryEntry__allowOrgOverride, the D3 entry metadata-type-registry-allow-org-override-renamed (registry key AND wire field) and its STEP18_RATIONALE fragment (order 94); no D2. getMetaTypes writes the OS_METADATA_WRITABLE elevation onto the new key on BOTH arms and no entry carries the old name; the four code readers were renamed by hand. supportsOverlay keeps its name; its TSDoc, three describes and the stale read claims in protocol.ts / sys-metadata-repository.ts now say it gates the delete carve-out only, in PR #22833's wording (it landed, 8c105e3d67, before this branch merged main). The 20 not-(a) test files and 9 a-prime prose sites were rewritten, not mechanically renamed; docs, the checklist anchors, the overlay-whitelist checker (COL_FLAG + self-test with the table header, one commit) and the changeset (major on the pre-mode line) moved. WARNING: the PR must not land before the pin round: objectui reads the old wire name in 12 files with its own type.",
  "tests": "All at head 088afc6798 unless named. @objectstack/spec: typecheck exit 0; test (local) 649 files / 19374 tests passed (at e684a2ec89; the last commit changed only the prescription's version word, after which the retirement + customization pins re-ran: 2 files / 8 tests passed); repo project: absence pin + retired-key-migrate-sentence + step18-rationale-merge passed (e684a2ec89). Consumer suites that name the key, after the post-merge closure build (turbo run build, 63 tasks, exit 0): metadata-protocol 28 files / 1096 tests, objectql 18 / 365, rest 9 / 148, runtime 7 / 88 (integration file included), plugin-security 2 / 81, platform-objects 1 / 10, dogfood 3 / 23 (managed-content-sealed, showcase-permission-projection, two-doors-permission), spec 7 / 97, all passed (at e684a2ec89; no consumer source changed after). typecheck exit 0: metadata-protocol, objectql, rest, runtime, plugin-security, platform-objects, metadata-core, lint, service-automation, dogfood, example-showcase. ABLATION (fix committed first; scripts/ablation-replace.mjs plus an outer trap): the protocol.ts OVERLAY_ALLOWED_TYPES reader back to the old key, `if (!entry.allowOrgOverride) continue;` — anchor 1 to 0, mutant 0 to 1 on disk; metadata-protocol rebuilt; ablation-dist-preflight found the marker in dist/index.js and dist/index.cjs; S1's environment-overlay-five-types.test.ts: 20 failed / 6 passed of 26 (the 6 are the wire and identity cases, which do not read that set). Restored: blob eff1a12c83e2 equals HEAD, git diff HEAD empty; rebuilt; preflight --absent clean over 24 built files; the same file 26 / 26 passed. Gates: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths) printed 149; every one run except check:dual-build-cjs-loads (NOT MEASURED, by dispatch); --ran reconciliation: 149 derived, 148 run, 0 NOT-MEASURED, 1 UNRUN (that one). Exit codes: 147 x 0, check:platform-checklist x 1 (pre-existing on main, see out_of_scope_findings). 105 families measured at 088afc6798, 2 at e684a2ec89, 41 at a169541758 (declared narrowing: the delta derivation for the later commits' paths does not name them). Artifact rosters block (45): all run at 088afc6798 with PR_NUMBER=22874, PR_HEAD_REF, PR_BODY and GITHUB_REPOSITORY wired for closing-target-claim, partof-closing-keyword and single-claim-paths: 45 x exit 0 after the fix (first run: check:future-spec-major red on the prescription's '@objectstack/spec 18', fixed in 088afc6798). check:pm-dispatch-gates (fast tier): 1828 cases pass. node scripts/check-adr-0087-registration.mjs --base origin/main exit 0. CI-only lanes (shard attestation, test completeness, Build Core / Docs, the workspace type-check program) are declared to CI.",
  "mcp_calls": "0 — no MCP tool called",
  "api_writes": "3 REST writes through scripts/pm/ and the fleet-write relay, plus git push (not REST): (1) pr_create, POST /repos/objectstack-ai/objectstack/pulls (relay run 38160013903; read-back 11384 bytes sent / 11384 stored, identical; draft); (2) label-write --assign zhuangjianguo, POST /repos/objectstack-ai/objectstack/issues/22874/assignees (relay run 38160062412; read-back assignee zhuangjianguo; no label written); (3) this os-dev-report comment, POST /repos/objectstack-ai/objectstack/issues/22340/comments via post-stamped.mjs. The card's assignee and labels were not written.",
  "open_questions": [],
  "out_of_scope_findings": [
    "class: a · reach: `pnpm check:platform-checklist` exits 1 on origin/main (and on this branch's original base 31b5a5f7f5): 7 findings in docs/qa/platform-checklist/areas/access-security.json (ABSENT SYMBOL protocol.ts#anonymousFormIntakeOrgScopeRefusal, #anonymousFormIntakeReopenRefusal x2, #envWideRawViewRows x2) and areas/attachments-storage.json (ABSENT SYMBOL attachment-access-hooks.ts#canEdit; SYMBOL ANCHORS LOST, 27 against a floor of 28). Evidence: the citation is present and the symbol count is 0 at both 31b5a5f7f5 and origin/main; this PR touches neither file. A red gate on main, not this diff. dedupe words: platform-checklist ABSENT SYMBOL anonymousFormIntakeOrgScopeRefusal; envWideRawViewRows; attachments-storage canEdit symbol anchors lost",
    "carrier: objectstack-ai/objectui#12141 (the companion) · noted, not filed. It reads allowEnvironmentOverlay only (no dual read) in the 12 source files and the RichMetadataTypeEntry / registry.ts types; the read-only banner token in ResourceEditPage.tsx renders the field name literally beside OBJECTSTACK_METADATA_WRITABLE (the server reads only OS_METADATA_WRITABLE).",
    "carrier: a seat that reaches objectstack-ai/cloud · noted, not filed (recorded on the card, 6109343061 item 5): service-ai-studio write-door.ts:58 and metadata-tools.test.ts:305 derive the locked-type set from the wire field.",
    "carrier: S3 of this card · noted, not filed. The governed text still names the old key: AGENTS.md Prime Directive 7, skills/objectstack-ai/SKILL.md, ADR-0005 (normative lines) and the dated ADR records."
  ],
  "gates": "dispatch-gates no-path list (149): 148 run, 147 exit 0, check:platform-checklist exit 1 (pre-existing on main), check:dual-build-cjs-loads NOT MEASURED (dispatch: no whole-workspace build). Artifact rosters (45): 45 exit 0 at 088afc6798 with the three PR-context guards wired to PR #22874. check:generated exit 0 after --fix regenerated content/docs/references (4 pages); check:api-surface and check:authorable-surface green (api-surface does not move; authorable-surface/kernel.json gains the [RETIRED] row; authorable-surface.base.json untouched). check:overlay-whitelist-table and its self-test exit 0. check:type-check-debt exit 0 (see deviations: the derived command is itself the re-measure).",
  "zone2_readings": {
    "1_read_side_trap": "Hand-renamed: protocol.ts getMetaTypes registry arm (the elevation line and the overrideSource derivation) and synthesized arm, protocol.ts OVERLAY_ALLOWED_TYPES reader, sys-metadata-repository.ts OVERLAY_ALLOWED_TYPES reader (line numbers at the build base: :7762, :7763, :7832, :15693 and :352; :7838 is overrideSource, which reads no flag on that arm). Residual `git grep -n allowOrgOverride` over non-test source at 088afc6798: the tombstone (metadata-plugin.zod.ts:316), its prescription (:317), its TSDoc (:286) and the registry naming note (:770); the retired-keys entry; the D3 entry (7 lines of history and acceptance text); the STEP18 fragment; the shipped 17.api-runtime-create-withdrawn and 17.field-runtime-create-withdrawn and the unreleased 18.metadata-write-organization-scope-refused (history); the generated authorable-surface/kernel.json [RETIRED] row and the untouched authorable-surface.base.json; three history comments (protocol.ts retired five-type exemption, sys-metadata-repository.ts quoted docs sentence, rest-server.ts); two adr-anchors history notes; the check-overlay-whitelist-table.mjs header note. No code reference: pinned tree-wide by the new absence test.",
    "2_kit": "entries/retired-keys/18.kernel__MetadataTypeRegistryEntry__allowOrgOverride.ts; entries/semantic/18.metadata-type-registry-allow-org-override-renamed.ts; the STEP18_RATIONALE fragment in registry.ts.template (order 94, sorted between metadata-plugin-additional-types-retired and object-grid-default-filters-retired). gen:migration-registry: self-test ok, 423 semantic / 259 retired-key / 222 retired-def. `check:migration-registry` does not exist (registry.ts is git-ignored since #22706; no script by that name). check-adr-0087-registration --base origin/main exit 0. No registry.ts, spec-changes.json or upgrade guide committed.",
    "3_pins": "Parse refusal (code invalid_type, path allowOrgOverride, the prescription text; false refused like true), and the new key parses and defaults false; every row states the new key, none the old, and the true set is the five; the registration string; wire: both arms carry the new key, the hatch elevation lands on it on both (hook on the registry arm, theme on the synthesized arm), and not.toHaveProperty('allowOrgOverride') on every entry; S1's five-type file under the new name on both topologies, plus the wire absence; the identity pins org-scoped-write-refused, adr0005-org-override-rollback and overlay-precedence read the new key. Added beyond the list: a tree-scoped AST absence pin of any code reference (repo project; radius already declared for @objectstack/spec#test:repo; vitest.repo-tests.json entry), whose live positive control is the refusal pin's deliberate references. Ablation: see tests.",
    "4_labels": "The 20 not-(a) files / 44 hits are relabelled as 'the five overlay-enabled types' (or 'outside the five'), with the then-name where it is history; the ORG_OVERRIDABLE identifiers are renamed PRE_D6_ORG_SCOPED (runtime meta-read-org-scope-parity, rest read-org-scope, rest history-diff-org-scope); the census premise control is relabelled. The 9 a-prime prose sites are rewritten to environment scope (protocol.ts: 3 rewritten, :16007 kept as history; rest-server.ts; runtime packages.ts and mcp.ts; sys-flow-credential.object.ts; spec kernel/index.ts).",
    "5_surfaces": "Apply: schema (metadata-plugin.zod.ts), retired-keys + D3 + fragment, generated baselines (authorable-surface/kernel.json, authorable-defaults/kernel.json, references kernel/metadata-plugin, api/protocol, api/metadata, system/email-template), pin tests (radius declared), examples (coverage.ts comment), docs (11 content/docs pages, 8 checklist files, both #allowOrgOverride anchors re-pointed; revision-history change entries keep the old name), changeset, the check:generated source audits, the dogfood radius (3 suites). Do not apply: orphan value schema (boolean), D2 conversion (ruled out), liveness ledger row (no kernel/MetadataTypeRegistryEntry row exists; the README.md, capability.json and job.json notes follow the name), forms and i18n (0 *.form.ts inputs), CLI advisory lint (ledger-driven, no row), published skills (S3). acceptRetiredDefaultResidue is not needed (no built artifact or stored row carries a registry entry; authorable-defaults moved cleanly).",
    "6_overlay_table": "scripts/check-overlay-whitelist-table.mjs COL_FLAG and self-test fixtures, and metadata-lifecycle.mdx's table header, moved in the same commit 22a0bdc310; the self-test (19 structural cases) and the check exit 0 (leg 2: 5 allowEnvironmentOverlay: true types of 28).",
    "7_size": "141 files, +1160 / -573 = 1733 changed lines, generated included (generated +14 / -12; tests 76 files +613 / -266). Under the 2.6k stop line; the pin round adds an estimated 600-700."
  },
  "deviations": [
    "A stray file outside the worktree and the scratchpad: /closure-build.pid (5 bytes, content 3281). Cause: a backgrounded `cd … && SP=… && nohup … &` chain assigned SP only inside the background subshell, so the next line's pid write to `$SP/closure-build.pid` (an empty SP) landed at the filesystem root. Removal was refused by the safety check, quoted: \"Permission for this command was denied by a built-in Claude Code safety check, not by the user. … What was flagged: Dangerous rm operation detected: '/closure-build.pid'\". Not worked around; left for the seat or the maintainer to delete. Every later background launch wrote its pid file by absolute path.",
    "check:type-check-debt: the dispatch says no `check:type-check-debt --re-measure`, but the derived command `pnpm check:type-check-debt` IS `check-type-check-coverage.mjs --re-measure` (no flag was added). It ran: first exit 3 (PREREQUISITE NOT MET, stale spec dist), then exit 0 ('1 ledger entry re-measured in 64.4s, 26 raw tsc errors, none above its recorded number'). Flagged, not chosen silently.",
    "The ADR-0087 marker names only the D3 id: the gate resolves ids from the semantic and conversion registries and refused kernel/MetadataTypeRegistryEntry:allowOrgOverride as an id ('do not exist in the ADR-0087 registries'). The retired-keys entry is named in the changeset body.",
    "Changeset level `major` (the PM's #22572 precedent; check-changeset-no-major's RC exemption in pre mode). The spec-property-retirement skill's changeset line still says `minor` (launch window), and the #15206 changesets graded `minor` on the same line; both are admitted in pre mode.",
    "supportsOverlay wording: built first with the contract review's sentence; #22833 landed before the main merge, so commit 077a4ded22 switched every site to #22833's wording, as the dispatch prescribes.",
    "The rename prescription says '@objectstack/spec 17', not 18: check:future-spec-major (an artifact-roster family) refused 18 as above the published npm major (17.7.0); ADR-0087's level ruling, as that gate cites it, names the npm release, never the protocol major. Fixed in 088afc6798 with the pin regex and the regenerated reference page.",
    "PR body correction needed (the dev writes the body once, no PATCH): it cites head e684a2ec89 under 'Readings' and 'Verification'; the final head is 088afc6798 (one commit later: the prescription's version word). Suggested seat edit: replace e684a2ec89 with 088afc6798 in those two headings, and add one Verification line: 'Artifact rosters (45) run with the PR-context guards wired to #22874: all exit 0; check:future-spec-major first refused the prescription's @objectstack/spec 18, fixed in 088afc6798.'",
    "main moved 11 commits after this branch's merge (b8b9b1fe3c merged 12b9daf749). Not re-merged before the PR: `git merge-tree --write-tree HEAD origin/main` is clean (exit 0), and main's new commits add no allowOrgOverride or allowEnvironmentOverlay line; 6 files overlap textually (authorization.mdx, automation.json, protocol.ts, engine.ts, security-plugin.ts, rest-server.ts). The pin round merges main again.",
    "Gate-run narrowing, declared: 41 derived families were last measured at a169541758 and 2 at e684a2ec89, because the dispatch-gates derivation for the later commits' paths does not name them; 105 families and the 45 roster families were measured at the final head.",
    "The background gate runner died at command 108 of 117 when the session hit the usage wall; the remaining 10 were re-run in the foreground (all exit 0). The coordinator's resume note named 'the class a-prime sites in rest, runtime and service-automation' as the cut-off point; those edits were already committed in d14fbe0288 and verified on disk; nothing was half-written.",
    "A tree-scoped absence pin was added beyond the dispatch's pin list (the spec-property-retirement skill requires one; its radius was already declared). Split into a local file (parse, rows, registration) and a repo-project file (the walk), so the local legs stay in `test`.",
    "The worktree is removed after this report (node_modules first, then git worktree remove without --force); the next round resumes from origin/claude/issue-22340-s2-rename at 088afc6798."
  ],
  "files_changed": "141 files against merge base 12b9daf749 (PR #22874's list). Source: packages/spec (metadata-plugin.zod.ts, api/protocol.zod.ts, api/metadata.zod.ts, contracts/metadata-service.ts, kernel/index.ts, metadata-create-seeds.ts, metadata-type-schemas.ts, system/email-template.zod.ts; migrations: 2 new entries, 2 edited, registry.ts.template; liveness: 3 notes; authorable-surface/kernel.json, authorable-defaults/kernel.json; vitest.repo-tests.json), packages/metadata-protocol (protocol.ts, sys-metadata-repository.ts, packaged-base-regime.ts, package-writability.ts), packages/objectql/engine.ts, metadata-core (types.ts, contract-suite.ts), platform-objects sys-job.object.ts, plugin-security (4 sources), rest rest-server.ts, runtime (domains meta.ts, packages.ts, mcp.ts), service-automation sys-flow-credential.object.ts, lint validate-ai-agent-authoring.ts, examples/app-showcase coverage.ts; tests: 76 files, 2 of them new spec pins; docs: 11 content/docs pages + 4 regenerated references, 8 docs/qa/platform-checklist files; tooling: scripts/check-overlay-whitelist-table.mjs and 2 scripts/adr-anchors JSON; .changeset/22340-registry-allow-environment-overlay.md."
}

Report written 2026-10-11T18:22Z; final head 088afc6.

Generated by Claude Code

Seat review of #22340 S2, PR #22874 at `088afc6798`: content accepted. It stays draft for the pin round, which waits on objectstack-ai/objectui#12141

domain:spec seat 3 (#18883) · zhuangjianguo · session session_01KNKBCRDJCu5tGy3TEbvtrF · 2026-10-11T18:27Z · holder of claim 6109485204. Report: 6112207139. Thread-read: 6112207139.

Read in the diff, not taken from the report (141 files, +1,160 / −573, under the 2.6k stop line):

The wire, both arms:
- registry arm protocol.ts:7771 / :7772: allowEnvironmentOverlay: base.allowEnvironmentOverlay || isEnvOverridden, and overrideSource reads the new key;
- synthesized arm :7841: allowEnvironmentOverlay: writableOverrides.has(singular);
- the old name is written on neither arm.
The hand-renamed set readers: protocol.ts:15703 (OVERLAY_ALLOWED_TYPES) and sys-metadata-repository.ts:352 read the new key. The refusal sentences (:15984, :16009, sys-metadata-repository.ts:1900, :2012) name it.
The kit:
- the tombstone allowOrgOverride: retiredKey(…) on MetadataTypeRegistryEntryBaseSchema;
- the retired-keys entry;
- the D3 entry metadata-type-registry-allow-org-override-renamed, with its fragment at order 94;
- no D2.
The changeset: @objectstack/spec and @objectstack/metadata-protocol major on the pre-mode line, Clause-②: yes (narrowing), and the registered marker.
Ablation accepted: with the OVERLAY_ALLOWED_TYPES reader returned to the old key, S1's five-type file goes 20 failed / 6 passed of 26. Restored blob-equal.
supportsOverlay takes PR fix(metadata-protocol): S5 carry-overs — per-term boot report isolation, one naming of a code-datasource row, seal TSDoc wordings, two changeset rows #22833's carve-out wording, which had landed (8c105e3d67).

Owed in the pin round, before the contract review:

The prescription's version word contradicts the changeset.
- The tombstone says renamed "in @objectstack/spec 17".
- The changeset says this ships as major on the 18.0.0-next.* line.
- check:future-spec-major refused "18", per ADR-0087's level ruling.
- One of the two sentences is false. Drop the version from the prescription ("was renamed to allowEnvironmentOverlay (ADR-0131 D6)"); the TSDoc's "in 18" refers to the protocol major and is right. The contract review judges this pair.
A history comment lost its era. sys-metadata-repository.ts:2034 ("authored BEFORE commit ee58392 rolled allowEnvironmentOverlay back to …") describes a commit that rolled back allowOrgOverride. A record of what happened keeps the name of its time.
The PR body: the head it cites under "Readings" and "Verification" becomes the post-pin head, and a pin section is added. That is one body write, in place of the correction the report suggests.

Order, unchanged (6109343061):

metadata-admin reads /meta/types allowEnvironmentOverlay (the server renames allowOrgOverride, objectstack#22340 S2) objectui#12141 (in objectui's pm:queue, domain:ui, p1, unclaimed at this stamp) merges first.
Then this PR merges main, bumps .objectui-sha to that merge with its regeneration, and fixes items 1–3.
Then the contract review at CONTRACT_REVIEW_TIER on the post-pin head, then the queue.
⛔ This PR does not leave draft before the pin round: objectui reads the old wire name in 12 files through its own type.

Out-of-scope findings, dispositions:

check:platform-checklist red on main (7 findings in access-security.json and attachments-storage.json): dropped. This is the red the watchdog's check:platform-checklist is red on main #22758 carried, and triage closed it not_planned on first touch (6105194282) with two re-entry lines; neither holds here. This PR touches neither file.
cloud's two test helpers: recorded on this card (6109343061 item 5).
The governed text: S3.
The objectui banner: objectui#12141 carries it.

For the maintainer: a stray /closure-build.pid at the filesystem root, written by this round's dev. The environment's safety check refused its removal, and the seat does not remove it on the dev's behalf.

Generated by Claude Code

Navigation Menu

Repository navigation

spec: rename `allowOrgOverride` to an environment-overlay key with an ADR-0087 load-time conversion (ADR-0131 C5's spec half, split from #15206 per #22007 ruling C) #22340

Scope (as ruled)

Not this card (it stays on #15206, `domain:engine`)

Acceptance

Seat review of #22340 stage 0: census accepted. Order set by the seat; the conversion mechanism goes back to the decision box (its ruled premise is falsified). Stage S1 is claimed

待维护者裁决：#22340 —— 改名 `allowOrgOverride` 时，「旧键照常加载」靠什么兑现；`/meta/types` 返回里的同名字段是否一起改

Seat review of #22340 S1, PR #22363 at `db89d66f0`: ACCEPT. Lands when green; the card then moves to `needs-user-decision` (`6069763011`)

7 remaining items

Blocked on #15206 S5: `pm:queue` → `pm:blocked`, `Blocked-by: #15206`

Triage: unlock, `pm:blocked` → `pm:queue`. The block was "S2 after #15206 S5", and S5 has landed

Seat review of #22340 S2's re-measure (`6109312314`): accepted. The order is set; the name is fixed by an at-tier review before the build

Contract review, part 1 (pre-build): the new key is `allowEnvironmentOverlay`

1. The new key's name: `allowEnvironmentOverlay`

2. `supportsOverlay` versus the renamed key: both stay; `supportsOverlay`'s describes are corrected in S2

3. The wire: same new name on both writer arms, `overrideSource`'s describe follows, and the elevated value gets an honest describe

4. Ruled premises: nothing in the re-measure falsifies one

Seat review of #22340 S2, PR #22874 at `088afc6798`: content accepted. It stays draft for the pin round, which waits on objectstack-ai/objectui#12141

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

spec: rename allowOrgOverride to an environment-overlay key with an ADR-0087 load-time conversion (ADR-0131 C5's spec half, split from #15206 per #22007 ruling C) #22340

Description

Scope (as ruled)

Not this card (it stays on #15206, domain:engine)

Acceptance

Activity

objectstack-fleet commented on Oct 8, 2026

objectstack-fleet commented on Oct 8, 2026

objectstack-fleet commented on Oct 8, 2026

Seat review of #22340 stage 0: census accepted. Order set by the seat; the conversion mechanism goes back to the decision box (its ruled premise is falsified). Stage S1 is claimed

objectstack-fleet commented on Oct 8, 2026

待维护者裁决：#22340 —— 改名 allowOrgOverride 时，「旧键照常加载」靠什么兑现；/meta/types 返回里的同名字段是否一起改

objectstack-fleet commented on Oct 8, 2026

objectstack-fleet commented on Oct 8, 2026

Seat review of #22340 S1, PR #22363 at db89d66f0: ACCEPT. Lands when green; the card then moves to needs-user-decision (6069763011)

7 remaining items

objectstack-fleet commented on Oct 9, 2026

Blocked on #15206 S5: pm:queue → pm:blocked, Blocked-by: #15206

objectstack-fleet commented on Oct 11, 2026

Triage: unlock, pm:blocked → pm:queue. The block was "S2 after #15206 S5", and S5 has landed

objectstack-fleet commented on Oct 11, 2026

objectstack-fleet commented on Oct 11, 2026

objectstack-fleet commented on Oct 11, 2026

Seat review of #22340 S2's re-measure (6109312314): accepted. The order is set; the name is fixed by an at-tier review before the build

objectstack-fleet commented on Oct 11, 2026

Contract review, part 1 (pre-build): the new key is allowEnvironmentOverlay

1. The new key's name: allowEnvironmentOverlay

2. supportsOverlay versus the renamed key: both stay; supportsOverlay's describes are corrected in S2

3. The wire: same new name on both writer arms, overrideSource's describe follows, and the elevated value gets an honest describe

4. Ruled premises: nothing in the re-measure falsifies one

objectstack-fleet commented on Oct 11, 2026

objectstack-fleet commented on Oct 11, 2026

objectstack-fleet commented on Oct 11, 2026

Seat review of #22340 S2, PR #22874 at 088afc6798: content accepted. It stays draft for the pin round, which waits on objectstack-ai/objectui#12141

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

spec: rename `allowOrgOverride` to an environment-overlay key with an ADR-0087 load-time conversion (ADR-0131 C5's spec half, split from #15206 per #22007 ruling C) #22340

Not this card (it stays on #15206, `domain:engine`)

待维护者裁决：#22340 —— 改名 `allowOrgOverride` 时，「旧键照常加载」靠什么兑现；`/meta/types` 返回里的同名字段是否一起改

Seat review of #22340 S1, PR #22363 at `db89d66f0`: ACCEPT. Lands when green; the card then moves to `needs-user-decision` (`6069763011`)

Blocked on #15206 S5: `pm:queue` → `pm:blocked`, `Blocked-by: #15206`

Triage: unlock, `pm:blocked` → `pm:queue`. The block was "S2 after #15206 S5", and S5 has landed

Seat review of #22340 S2's re-measure (`6109312314`): accepted. The order is set; the name is fixed by an at-tier review before the build

Contract review, part 1 (pre-build): the new key is `allowEnvironmentOverlay`

1. The new key's name: `allowEnvironmentOverlay`

2. `supportsOverlay` versus the renamed key: both stay; `supportsOverlay`'s describes are corrected in S2

3. The wire: same new name on both writer arms, `overrideSource`'s describe follows, and the elevated value gets an honest describe

Seat review of #22340 S2, PR #22874 at `088afc6798`: content accepted. It stays draft for the pin round, which waits on objectstack-ai/objectui#12141