feat(spec,metadata-protocol)!: rename the type registry's allowOrgOverride to allowEnvironmentOverlay, on the registry and on GET /meta/types

[objectstack-fleet]

Part of #22340
Clause-②: yes (narrowing)

Correction: an earlier line here said this PR was held out of the merge queue on #22949. It was never ejected: it merged through the queue at 2026-10-12T06:14Z as e23eccb164 (landing record on #22340).

ADR-0131 C5's spec half (stage S2): the metadata type registry's allowOrgOverride is renamed to allowEnvironmentOverlay, on DEFAULT_METADATA_TYPE_REGISTRY and on the GET /meta/types wire field, under ruling C on #22007 (6028809298), ruling 6073921182 (Q1 A, Q2 A) and the pre-build contract review 6109457426, which fixed the name. #22340 stays open for S3, the governed text.

The console pin moves with the rename, in this PR. .objectui-sha is objectui e5311165a8d6, the merge of objectstack-ai/objectui#12168, which carries objectstack-ai/objectui#12141: from that commit on, objectui's metadata admin reads the wire field under its new name only, with no dual read. The two halves land together. Any other pin bump past e5311165a8 before this PR lands would show the five overlay-enabled types read-only in Studio. The landing record is the contract review on this post-pin head.

What changes

• The key. MetadataTypeRegistryEntry.allowEnvironmentOverlay (default false) with the contract review's describe and TSDoc. allowOrgOverride is a retiredKey() tombstone on MetadataTypeRegistryEntryBaseSchema whose prescription names the new key: the old key fails tsc and fails the parse (invalid_type at allowOrgOverride). The prescription reads "was renamed to allowEnvironmentOverlay (ADR-0131 D6)" and names no version: the changeset ships this as major on the 18.0.0-next line, and the TSDoc's "in 18" names the protocol major. All 28 built-in rows spell the new key; every value is unchanged (the true set is view, dashboard, report, translation, email_template).
• The ledger (ADR-0087). Retired-keys entry 18.kernel__MetadataTypeRegistryEntry__allowOrgOverride; D3 semantic entry metadata-type-registry-allow-org-override-renamed, covering the registry key AND the wire field; its STEP18_RATIONALE fragment (order 94). No D2 conversion, as ruled: no manifest, stack or stored row can carry a registry entry. No registry.ts, spec-changes.json or upgrade guide is committed (git-ignored, generated).
• The wire, one spelling. getMetaTypes writes the OS_METADATA_WRITABLE elevation onto allowEnvironmentOverlay on BOTH arms: the registry arm (the ...base spread already carries the new key, and the elevated value overwrites it) and the synthesised arm of a runtime type with no registry row. No entry carries allowOrgOverride. The field's describe says the elevation opens only items no managed package ships; overrideSource keeps registry / env and its describe names the new field.
• The read-side trap, hand-renamed. A truthiness reader of the old key compiles against the tombstone and reads undefined, which closes all five types. The readers moved by hand: protocol.ts getMetaTypes (both arms) and OVERLAY_ALLOWED_TYPES, and sys-metadata-repository.ts's OVERLAY_ALLOWED_TYPES. Every test reader moved with them.
• supportsOverlay keeps its name and both keys stay (contract review item 2: ADR-0049 retires neither). Its TSDoc and its three describes (registry, GetMetaTypesResponse, MetadataTypeInfoResponse) and the stale read claims in protocol.ts and sys-metadata-repository.ts now say what it gates: the delete carve-out, no save and no read. Wording used: PR fix(metadata-protocol): S5 carry-overs — per-term boot report isolation, one naming of a code-datasource row, seal TSDoc wordings, two changeset rows #22833's, which landed (8c105e3d67) before this branch merged main: the removal "removes no managed definition, and changes what is served for permission alone".
• Prose that tied the flag to organization scope is rewritten, not mechanically renamed: the key's TSDoc and describe, email-template.zod.ts, kernel/index.ts, the customizationPolicies prescription (and its pin), the unreleased D3 metadata-customization-protocol-retired and its fragment, and the comments in protocol.ts, rest-server.ts, runtime packages.ts / mcp.ts and sys-flow-credential.object.ts. A comment that records history keeps the name of its time: sys-metadata-repository.ts still says commit ee58392e1 rolled allowOrgOverride back.
• The refusal sentences that named the flag name the new key; codes and statuses are unchanged.
• Tests. The 74 files that named the key move to the new key. The 20 files that pin the RETIRED per-organization path label their specimens as the five overlay-enabled types (the set those doors once scoped to an organization), so no label reads as "org-overridable = allowEnvironmentOverlay"; their ORG_OVERRIDABLE identifiers are now PRE_D6_ORG_SCOPED. The two plugin-security doubles throw the sentence the producer emits today.
• Docs and tooling. metadata-lifecycle.mdx's whitelist table header moves with check-overlay-whitelist-table.mjs's COL_FLAG and its self-test fixtures, in one change; 10 more content/docs pages; 8 platform-checklist files, both metadata-plugin.zod.ts#allowOrgOverride anchors re-pointed to #allowEnvironmentOverlay (revision-history change entries keep the old name); 3 liveness notes; 2 ADR anchors; the regenerated references.
• The changeset (major on the v18 pre-mode line, the 22572 precedent): BREAKING, the FROM / TO table for registry entries and /meta/types entries, Clause-②: yes (narrowing) and the ADR-0087 registered marker.

The console pin (round 2)

The hop. objectui 4997995022f8..e5311165a8d6 (.objectui-sha was 4997995022f8 on main at the merge): 24 commits, all non-merge squashes, over 287 paths (214 modified, 69 added, 4 deleted, none renamed), +13412 / −2428. objectui 4baa8a67c4 (objectui#12170: slotsForType stops reading the retired flow-template ledger role) is INSIDE it, two commits below the new tip: git merge-base --is-ancestor 4baa8a67c4 e5311165a8 exits 0, and --is-ancestor 4baa8a67c4 4997995022f8 exits 1, read in a full (non-shallow) clone whose control leg (d32869883b, 50 commits below the old pin) answers 0. Its changeset is release-nothing, so the console changeset counts it among the 2 release-nothing changesets rather than listing it.

The Console Pin Gate's steps, run locally on this head: turbo run build --filter=@objectstack/client... exit 0; scripts/build-console.sh exit 0 at e5311165a8d6 (objectui cloned from the pin into .cache/, 8872 modules; bundle canary import/jobs present; one zod version literal; "Console bundle carries THIS tree's @objectstack/spec, and only it"); the dist and its .objectui-sha stamp in place; pnpm check:console-sha exit 0 (objectui@e5311165a8d6); pnpm check:console-injection --require-stamp exit 0. The injection's stale detector is the published spec's describe of the retired key, "Allow per-org overlay writes via runtime metadata API", and it is absent from the bundle.

Against this PR's wire. The built bundle's app code reads allowEnvironmentOverlay 15 times (metadata-admin, packagedActions and the shell; for example the read-only verdict is !u.allowEnvironmentOverlay && !u.allowRuntimeCreate). allowOrgOverride occurs only inside this tree's spec, in the tombstone and its prescription text (4 occurrences, all in the vendor-objectstack chunk); no app code reads it. Then the two together, on a booted backend: pnpm dev -- --fresh -p 38977 on this head (showcase, the console dist above, check:console-sha green at boot). The live GET /api/v1/meta/types answered 34 entries: all 34 carry allowEnvironmentOverlay, none carries allowOrgOverride, and true is exactly view, dashboard, report, translation and email_template, each with overrideSource: registry. In a headless Chromium signed in as the seeded admin, the console's Setup metadata pages read that wire: a packaged view (showcase_task.in_progress) and a packaged dashboard (showcase_chart_gallery) open with the writable badge and an editable designer, while a packaged flow (showcase_task_completed) and a packaged object (showcase_account) open create-only and "locked". No page names allowOrgOverride. The server was stopped afterwards. In process, the getMetaTypes pin (protocol-meta-types-rich.test.ts) and S1's five-type file on both topologies are green on this head.

The artefacts that travel with the pin, in the shape PR #22794 used:

• .changeset/console-e5311165a8d6.md, derived by scripts/bump-objectui.sh from the changesets objectui declared over the range (21 releasing, 4 breaking by their authors' annotation, no declared major). Its ADR-0087 disposition is not-required (no-migration-prescription), and it answers each declared-breaking objectui change: objectui#12141 is this PR's own rename, whose prescription and registered disposition live in 22340-registry-allow-environment-overlay.md; the three objectui#12130 changes move objectui's own form-field face, no ObjectStack key.
• sdui.manifest.json and scripts/sdui-manifest.record.json, regenerated from the built tree at the pin: 107 components; one input description changed (the record activity feed's showCompleted, objectui#12106), and no component, input, type or required flag moved.
• packages/sdui-parser/objectui-lockstep.json, re-recorded at the pin: the 214-line grammar region, the 25 diagnostic codes and the containment predicate are unchanged.
• .changeset/objectui-pin-citations-e5311165a8d6.md (@objectstack/spec patch, Clause-②: no) and the re-measured citations. All 55 asserting citations (49 hand-written, 6 in the generated migrations registry) were mapped through the hop. Five cited files changed (ObjectGrid.tsx, data-table.tsx, form.tsx, record-related-list.tsx, data-objectstack/src/index.ts) and every cited line in them moved or held byte-identical; each record gains a hop sentence, and the anchors that moved are re-pointed where the records cite them at this pin. The six migration entries' corpus counts were re-taken with git grep -o -F (8506 tracked files; 124 zero tokens still zero; Span 517 to 519, both new hits colSpan). check:objectui-pin-citations --verify-anchors against objectui at the pin: 55 asserting citations match, 13 anchor content assertions verified.

New pins

• kernel/metadata-type-registry-allow-org-override-retirement.test.ts: the parse refuses the old key with the rename (code, path, prescription text; false refused like true); the new key parses and defaults to false with no old key grown back; every built-in row states the new key, none the old, and the true set is exactly the five; the retired-keys registration.
• kernel/metadata-type-registry-allow-org-override-absence.test.ts (repo project, radius already declared for @objectstack/spec#test:repo): a tree-scoped, AST-read absence of any CODE reference to allowOrgOverride in packages/**/*.ts and examples/*/src/**/*.ts. Comments and strings are history and are not judged; the tombstone declaration is exempt by shape. The sibling refusal pin is counted apart and REQUIRED to be found, so the walk carries a live positive control.
• objectql/protocol-meta-types-rich.test.ts: both writer arms carry allowEnvironmentOverlay, the hatch elevation lands on it on both arms, and not.toHaveProperty('allowOrgOverride') on every entry.
• S1's environment-overlay-five-types.test.ts under the new name on both topologies, plus the wire absence; the identity pins (org-scoped-write-refused, adr0005-org-override-rollback, overlay-precedence) read the new key.

Ablation (round 1; committed fix first; restored blob-equal)

Dropped the hand rename of OVERLAY_ALLOWED_TYPES's reader (if (!entry.allowEnvironmentOverlay) continue; back to the old key) through scripts/ablation-replace.mjs: anchor 1 → 0, mutant 0 → 1 on disk; @objectstack/metadata-protocol rebuilt; ablation-dist-preflight found the marker in dist/index.js and dist/index.cjs. S1's five-type file: 20 failed / 6 passed of 26 (the 6 are the wire and identity cases, which do not read that set). Restored: blob eff1a12c83e2 equals HEAD, git diff HEAD empty; rebuilt; preflight --absent clean over 24 built files; the same file 26 / 26 passed.

Readings (head 49ef13a518)

• Residual allowOrgOverride in non-test source: the tombstone, its prescription and TSDoc, the registry's naming note, the retired-keys and D3 entries, the rationale fragment, two shipped protocol-17 D3 entries, 18.metadata-write-organization-scope-refused (history), the generated authorable-surface/kernel.json [RETIRED] row and the untouched authorable-surface.base.json, four history comments (protocol.ts retired exemption, a quoted docs sentence and the commit ee58392e1 record in sys-metadata-repository.ts, rest-server.ts), two ADR-anchor history notes, and the checker's header note. No code reference (the absence pin).
• Surfaces (spec-property-retirement). Apply: schema, retired-keys + D3 + fragment, generated baselines (authorable-surface/kernel.json, authorable-defaults/kernel.json, four reference pages), pin tests (radius declared), examples (one comment), docs, changeset, the check:generated source audits and the dogfood radius. Do not apply: orphan value schema (boolean), D2 conversion (ruled out), liveness ledger row (none exists for the registry entry; the three prose notes follow the name), forms and i18n (no *.form.ts input), CLI advisory lint (ledger-driven, no row), published skills (S3). api-surface, json-schema.manifest and export-origins do not move (no export renamed); authorable-surface.base.json is written only by gen:authorable-surface-base and is untouched. acceptRetiredDefaultResidue is not needed: no built artifact or stored row carries a registry entry.
• Size. 162 files, +1509 / −649 = 2158 changed lines, generated included, under the 3,000 line. The pin round's own files: 21, +350 / −79.

Not in this PR

• The governed text (S3): AGENTS.md Prime Directive 7, skills/objectstack-ai/SKILL.md, ADR-0005 (and the dated ADR records).
• cloud's two test helpers (service-ai-studio write-door.ts and metadata-tools.test.ts): recorded on the card (6109343061 item 5) for a seat that reaches cloud.
• CHANGELOGs and every other pending changeset.

Acceptance notes

• check:platform-checklist is red on this head on 8 findings in files this PR does not touch, each byte-identical to main: the 7 recorded in round 1 (areas/access-security.json, areas/attachments-storage.json) and one more, areas/search.json citing protocol.ts#countable, a symbol main's PR fix(objectql,metadata-protocol,spec): a paged search reports the counted total #22857 (55382dc02a) removed. countable reads 0 in protocol.ts on origin/main and on this head. Not this diff.
• The ADR-0087 marker names only the D3 id: the gate resolves ids from the semantic and conversion registries and refused the retired-keys string as an id. The retired-keys entry is named in the changeset body.
• pnpm --filter @objectstack/spec check:migration-registry does not exist (the registry is git-ignored and generated); gen:migration-registry ran green on this head (424 semantic, 259 retired-key, 222 retired-def).
• This branch merged main at 018b077fbf (round 2, through os-regen-merge.sh; two hand-written conflicts, email-template.zod.ts and liveness/README.md, resolved by stacking both intents). main has moved 9 commits since; git merge-tree --write-tree HEAD origin/main is clean, and none of those commits adds a line naming either key or an asserting pin citation.

Verification (head 49ef13a518)

• @objectstack/spec: typecheck exit 0; test (local) 649 files / 19398 tests passed (1 todo); repo project: the absence pin, retired-key-migrate-sentence and step18-rationale-merge, 3 files / 26 tests passed.
• @objectstack/metadata-protocol: test 226 files passed, 3 skipped (28171 tests passed, 19 skipped); typecheck exit 0.
• @objectstack/objectql: S1's environment-overlay-five-types.test.ts and the wire pin protocol-meta-types-rich.test.ts, 2 files / 33 tests passed.
• Built first: turbo run build --filter=@objectstack/example-showcase... (61 tasks, exit 0); later, eight packages outside that closure, by name, for two gates' prerequisites and the boot (client-react, the five packages check:published-readme-exports reads, studio, service-cluster-redis). No pnpm build. check:generated exit 0 (all 14 artifacts up to date against that dist); check:api-surface "unchanged"; check:authorable-surface exit 0 (authorable-surface.base.json trails 018b077fbf88, an information line); check:future-spec-major exit 0 (no citation names a major above 17, with the version word gone from the prescription).
• The Console Pin Gate's steps: see the pin section; every step exit 0.
• node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths) at this head printed 155 commands; every one run except two, and --ran reconciles: 155 derived, 153 run, 2 NOT-MEASURED (claimed), 0 UNRUN. Exit codes: 152 × 0 and check:platform-checklist × 1 (above). check:skill-examples first refused with exit 3 (@objectstack/client-react unbuilt), then exit 0 after that package was built. NOT MEASURED: check:dual-build-cjs-loads (no whole-workspace build this round) and check:type-check-debt (the derived command is the --re-measure this round does not run).
• Artifact rosters (41), with PR_NUMBER=22874, PR_HEAD_REF, PR_BODY and GITHUB_REPOSITORY wired for closing-target-claim, partof-closing-keyword and single-claim-paths: 41 × exit 0. Two needed a rerun: check:published-readme-exports refused with exit 3 until five packages outside the showcase closure were built, and check:select-shard-packages's self-test compared output that the proxy variable the PR-context guards need had polluted with a warning; rerun without it, exit 0.
• check:pm-dispatch-gates (fast tier): 1828 cases pass, exit 0. check-adr-0087-registration --base origin/main exit 0: two declared-breaking changesets, 22340-registry-allow-environment-overlay.md (registered metadata-type-registry-allow-org-override-renamed) and console-e5311165a8d6.md (not-required (no-migration-prescription)).

Round 2 (the pin round) was written by session session_01KNKBCRDJCu5tGy3TEbvtrF under claim 6109485204, on the seat's order 6117020961.

[github-actions]

📓 Docs Drift Check

This PR changes 11 package(s): @objectstack/lint, @objectstack/metadata-core, @objectstack/metadata-protocol, @objectstack/objectql, @objectstack/platform-objects, @objectstack/plugin-security, @objectstack/rest, @objectstack/runtime, @objectstack/sdui-parser, @objectstack/service-automation, @objectstack/spec, touching 63 documentable anchor(s). ⚠️ 21 changed file(s) yielded no anchor (packages/lint/src/validate-ai-agent-authoring.ts, packages/metadata-core/src/types.ts, packages/metadata-protocol/src/package-writability.ts, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

28 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 51b43a8dc45fef9d86229509ab6b2679ffa9d501.

⛔ 11 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 21 changed file(s) yielded no anchor (packages/lint/src/validate-ai-agent-authoring.ts, packages/metadata-core/src/types.ts, packages/metadata-protocol/src/package-writability.ts, …) — pages documenting those are invisible to this run
• 5 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 149 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 51b43a8dc45fef9d86229509ab6b2679ffa9d501 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 943a21534c96684329ff11ef475c9987036a0073 — the merge of head 49ef13a518dd486eeef521971583f109f098f590 into base 51b43a8dc45fef9d86229509ab6b2679ffa9d501, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 943a21534c96684329ff11ef475c9987036a0073 && git checkout 943a21534c96684329ff11ef475c9987036a0073
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 51b43a8dc45fef9d86229509ab6b2679ffa9d501 49ef13a518dd486eeef521971583f109f098f590 && git checkout -B drift-repro 51b43a8dc45fef9d86229509ab6b2679ffa9d501 && git merge --no-ff 49ef13a518dd486eeef521971583f109f098f590

node scripts/docs-audit/affected-docs.mjs --json 51b43a8dc45fef9d86229509ab6b2679ffa9d501

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 51b43a8dc45fef9d86229509ab6b2679ffa9d501 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 49ef13a518dd486eeef521971583f109f098f590
Local-runs: none

PR #22874 (card #22340, stage S2: allowOrgOverride becomes allowEnvironmentOverlay, with the objectui pin). The landing record for this head, read at 2026-10-12T05:20Z. Inputs and nothing else: the card body and its 21 comments (ruling 6073921182, the pre-build review 6109457426, the re-measure 6109312314 and its acceptance 6109343061, the claim 6109485204, the dev reports 6112207139 and 6118005809, the seat's 6112246741, 6117020961 and 6118028021, the domain:ui pointer 6116505303); ADR-0131 D6, ADR-0087 D2/D3 and its level ruling, scripts/pm/clause2-line.mjs, scripts/check-adr-0087-registration.mjs, scripts/check-changeset-no-major.mjs, scripts/check-future-spec-major.mjs and .changeset/pre.json on origin/main (51b43a8dc4); the PR body and the net diff against the merge base 018b077fbf (162 files, +1509 / -649); objectui at e5311165a8d6 by git grep in a scratch clone; the head's check-runs through REST. Every reading below was re-taken from the trees and the diff; the seat's and the dev's conclusions were read for what they assert and not adopted. Nothing was built, run or re-run.

① Derived judgments

1. The declaration and the tombstone — holds.

• MetadataTypeRegistryEntryBaseSchema.allowEnvironmentOverlay: z.boolean().default(false) carries the describe the pre-build review fixed, word for word ("Whether an environment may overlay an item of this type that a managed package ships (ADR-0131 D6 regime O). Decides the save door, the managed-content seal on write and on read, and Studio's write gate; the OS_METADATA_WRITABLE hatch does not reach a managed item. Default false."), and a TSDoc that names regime O, the four doors, the hatch's limit, the default and ADR-0005's one-whitelist rule. ADR-0131 D6 on origin/main names regime O as "an environment row of the same name replaces the managed item whole" over exactly the five presentational types, so the describe says what the ADR decided.
• allowOrgOverride is retiredKey(...) on the same base schema (the file imports retiredKey and already tombstones three MetadataPluginConfig keys the same way). Its prescription reads "was renamed to allowEnvironmentOverlay (ADR-0131 D6) … Rename the key to allowEnvironmentOverlay; the value is unchanged." It carries no version word, so it contradicts nothing in the changeset. Read against ADR-0087's level ruling ("a tombstone names the npm release it ships in, never the protocol major"): the tree publishes @objectstack/spec 17.7.0 and check-future-spec-major refuses any @objectstack/spec citation above that major, while the release this ships in is 18.0.0-next.* under pre mode, so no version spelling satisfies both the ruling and the gate; the version-free prescription that names the deciding ADR is the honest form, and the TSDoc's "in 18" is the protocol major (toMajor: 18), a number the gate deliberately does not match. Judged correct.
• All 28 DEFAULT_METADATA_TYPE_REGISTRY rows spell the new key (counted in the diff: object, field, hook, seed, picklist, mapping, view, page, dashboard, app, action, report, dataset, flow, job, datasource, external_catalog, api, translation, email_template, doc, book, permission, position, capability, agent, tool, skill); the true set is exactly view, dashboard, report, translation, email_template; no value moved. The generated baselines agree: authorable-surface/kernel.json gains the new row and marks the old one [RETIRED]; authorable-defaults/kernel.json reads allowEnvironmentOverlay = false; authorable-surface.base.json is untouched.
• supportsOverlay keeps its name; its TSDoc, its registry describe, the GetMetaTypesResponse describe, the MetadataTypeInfoResponse describe and the contracts/metadata-service.ts TSDoc all say the one thing it gates — the removal carve-out, "removes no managed definition, and changes what is served for permission alone; it opens no save and it decides no read" — in the wording fix(metadata-protocol): S5 carry-overs — per-term boot report isolation, one naming of a code-datasource row, seal TSDoc wordings, two changeset rows #22833 landed on main (protocol.ts:16155 there). The customizationPolicies prescription, kernel/index.ts, email-template.zod.ts and the unreleased D3 18.metadata-customization-protocol-retired now name the environment overlay and the new key; none still presents the per-organization axis as live.

2. The wire, both arms — holds; the read-side trap is closed.

• getMetaTypes, registry arm: allowEnvironmentOverlay: base.allowEnvironmentOverlay || isEnvOverridden and overrideSource derived from base.allowEnvironmentOverlay; the ...base spread carries the same key at the registry value and the elevated value overwrites it. Synthesised arm (a runtime type with no registry row): allowEnvironmentOverlay: writableOverrides.has(singular). The old name is written on neither arm. api/protocol.zod.ts renames the field with the honest describe of the elevated value ("True when the registry grants … or when OS_METADATA_WRITABLE names the type (overrideSource env), which opens the type's writes of items no managed package ships and never a managed item (ADR-0131 D6)") and overrideSource's describe names the new field; api/metadata.zod.ts corrects supportsOverlay. The wire pin (protocol-meta-types-rich.test.ts) asserts both arms under the hatch (hook on the spread arm, theme on the synthesised arm), overrideSource on each, and not.toHaveProperty('allowOrgOverride') on every entry, with a presence control for each arm; S1's five-type file asserts the new key and the old name's absence on both topologies.
• Readers, re-taken on the head tree: git grep allowOrgOverride over packages/**/src/** and examples/**, tests and migration entries excluded, finds nine lines — the tombstone, its prescription and TSDoc, the registry's naming note, the rationale fragment, and four history comments (protocol.ts:16057, sys-metadata-repository.ts:1768 and :2034, rest-server.ts:7029). No code reference remains, in .ts or .tsx. The three set readers read the new key: protocol.ts OVERLAY_ALLOWED_TYPES (if (!entry.allowEnvironmentOverlay) continue), getMetaTypes on both arms, and sys-metadata-repository.ts OVERLAY_ALLOWED_TYPES (its registry filter now reads e.allowEnvironmentOverlay); isOverlayAllowed, registryAllowsOverlay, isSealedManagedItem, declinesStoredRow and assertAllowed derive from those sets and did not need to move. The absence pin (metadata-type-registry-allow-org-override-absence.test.ts, repo project, listed in vitest.repo-tests.json) walks packages/**/*.ts and examples/*/src/**/*.ts by AST, counts identifiers and quoted keys and never comments or strings, exempts the tombstone by shape alone, counts the refusal pin apart as a required positive control, and asserts the three hand-renamed files are found under the new name — so a reader left on the old name goes red rather than reading undefined. The one live sentence outside those files, packaged-base-regime.ts:407, names the new key, as do the repository's two refusal sentences and codeOnlyCreateError / codeOnlyOverrideError; no code or status changed.

3. The kit — holds; check-adr-0087-registration holds on the diff.

• entries/retired-keys/18.kernel__MetadataTypeRegistryEntry__allowOrgOverride.ts exports exactly kernel/MetadataTypeRegistryEntry:allowOrgOverride, the string the authorable-surface gate reads, with the Q1 A rationale (tombstone + entry + D3, no D2, no seam that ever runs).
• One D3 entry, 18.metadata-type-registry-allow-org-override-renamed.ts, covering the registry key and the GET /api/v1/meta/types field together, with a backtick-free surface, the five-type truth in replacement, the read-side warning in reason and a behaviour-unchanged acceptanceCriteria; its STEP18_RATIONALE fragment sits in registry.ts.template at order 94, between metadata-plugin-additional-types-retired and object-grid-default-filters-retired.
• No D2 conversion, as ruling Q1 A requires; no registry.ts, spec-changes.json or upgrade guide is committed (generated, git-ignored).
• 18.metadata-customization-protocol-retired.ts now names "ADR-0005's environment overlay (opt-in via allowEnvironmentOverlay …, stored as environment-wide sys_metadata rows …)", and its fragment in the template says "environment overlay".
• The gate's rule, read from its header: a changeset the PR adds that declares breaking must carry one marker; registered requires every id to resolve at HEAD and at least one to be new in the diff. The rename changeset's marker reads registered metadata-type-registry-allow-org-override-renamed, an id this diff creates; the retired-keys string is not an id the gate resolves and is named in the changeset body instead. The console changeset's marker reads not-required (no-migration-prescription) and its body carries no FROM / TO rewrite of its own (the rename's prescription lives in the rename changeset, which the marker text says). Both Check Changeset runs on the head are green.

4. The changeset — every sentence true to the diff. .changeset/22340-registry-allow-environment-overlay.md: @objectstack/spec and @objectstack/metadata-protocol at major; the BREAKING banner; Clause-②: yes (narrowing), one of the two readings clause2-line.mjs accepts for a diff that both widens (a new published key) and narrows (a retired one); the FROM / TO table for a registry entry, a reader of one and each entries[] item of GET /api/v1/meta/types; the one-line fix; the five-type truth; the hatch sentence; the read-side warning; the supportsOverlay correction; the who-is-affected reading; the kit. Each claim was checked against the diff: the 28 rows, both writer arms, the three refusal sentences quoted (packaged-base-regime.ts:407, sys-metadata-repository.ts:1900, protocol.ts code-only errors), the overrideSource describe, the D3 id and the retired-keys string. Level: see ②.

5. The pin — holds.

• .objectui-sha reads e5311165a8d6aa77b5cb7d9fd05da8451a2c21aa, the merge of objectui#12168 (carrying objectui#12141), fetched into a scratch ref and read there.
• objectui at that commit: allowOrgOverride occurs in 5 files, every one history — three CHANGELOG.md and two changesets (11808-readonly-package-card.md, 12141-allow-environment-overlay.md, whose FROM / TO names the rename and states "no alias window and no dual read"); zero source or test hits. allowEnvironmentOverlay is read in 12 non-test source files under packages/app-shell/src/views/ (DirectoryPage.tsx:171/175/458, EmbeddedItemEditor.tsx:104, PageShell.tsx:100, PermissionMatrixEditor.tsx:394/395/422, ResourceEditPage.tsx:1442/1443/1882/1884/1885, ResourceListPage.tsx:428, registry.ts:462/464/472, useMetadata.ts:84, i18n.ts, previews/PicklistPreview.tsx, BuilderLanding.tsx), 187 hits in 75 files overall; control allowRuntimeCreate reads on the same files. So the pinned console reads exactly the field this PR's getMetaTypes writes, and landing the two together keeps the five overlay types writable in Studio; the ruled-out dual read is absent.
• The bump follows PR feat(spec): the position form picks permissionSets from the permission-set registry (ref-multi:permission), with the console pin moved to 4997995022f8 #22794's shape: console-e5311165a8d6.md (@objectstack/console minor, derived from objectui's 21 releasing changesets, the four declared-breaking objectui changes each answered in the marker, the one undeclared commit listed by subject), objectui-pin-citations-e5311165a8d6.md (@objectstack/spec patch, Clause-②: no), sdui.manifest.json (one input description changed, the record activity feed's showCompleted), scripts/sdui-manifest.record.json (sha, modules root, date, hash), packages/sdui-parser/objectui-lockstep.json (rev, revDate, recordedAgainstPin only), content/docs/references/ui/view.mdx (the span describe's pin). Every changed line in the spec-source pin hunks (component.zod.ts, view.zod.ts, action.zod.ts, dataset.zod.ts, functional-completeness.ts, the six *-unit-in-key.ts entries, the three test files) is a comment, a string literal or the span describe's pin sha; no key, default, enum member or export moves.

6. The merge of main — both sides kept. main's side between the two merges (12b9daf749..018b077fbf) touched email-template.zod.ts (+6), liveness/README.md (+1) and the regenerated email-template.mdx. Line-checked on the head: every line main added to liveness/README.md is present verbatim; of the six main added to email-template.zod.ts, five are verbatim and the sixth ("… a Studio save overrides a built-in default at environment level. No") is present reflowed over two lines with the branch's parenthetical ("(allowEnvironmentOverlay: true in the metadata registry). No") inserted — #15205's registry-read sentence and S2's key reference both stand. The net diff against 018b077fbf on those two files shows only the rename and that parenthetical, so no hunk of main's side is lost. main has moved nine commits since (to 51b43a8dc4); the dev reports a clean merge-tree, not re-measured here, and the queue rebuilds the merge in any case.

7. CI — every check on the head is green or an expected skip. Read through REST at this act: 42 check-runs, 42 completed, 39 success, 3 skipped, none failed, none still running. The seven required contexts are all success: Lint & Repo Gates, TypeScript Type Check (with its source gates, consumer gates, debt ledger and workspace legs), Test Core (all six shards and the aggregate — so the suite-duration ceiling and the connector-author-shape.test.ts timeout of #22929 did not land on this head), Dogfood Regression Gate (three shards and the aggregate), Build Core, Temporal Conformance (live PG + MySQL) and Governed Surface Queue Guard. Also green: Console Pin Gate (objectui built at e5311165a8 against this tree), Dogfood Verify CLI, Build Docs, Check Documentation Links, Spec property liveness, Flag docs affected by code changes, both Check Changeset runs, and both runs of each PR-context guard (the closing-card claim, the single-writer path, the part-of keyword and the no-second-PR guard). The three skips are expected: Packed-tarball smoke (opt-in), and the Auto Label and Check PR Size jobs of the second pr-automation run (the body edit), whose first runs on this same head are success. The Vercel status is "Canceled by Ignored Build Step", reported as success.

② Semver level

major on @objectstack/spec and @objectstack/metadata-protocol, and that is the level the pre-mode rules give. .changeset/pre.json on origin/main reads mode: pre, tag: next. check-changeset-no-major.mjs's header (the authority ADR-0087's level ruling defers to) states the RC exemption: in pre mode a major only ever produces an X.0.0-tag.N pre-release and "accumulating the next major's breaking changes is precisely what an RC window is for", so the launch-window guard stands aside. The precedent the PR cites, .changeset/22572-flow-binding-name-dollar-refused.md, declares @objectstack/spec: major with the same sentence, and origin/main carries 21 changesets declaring a major. ADR-0087's "pre-GA ships minor" is the launch-window rule the exemption suspends while the window is in pre mode; the BREAKING banner and the ADR-0087 disposition, which that ruling makes the mandatory carriers, are both present. Clause-②: yes (narrowing) is consistent with major (a yes takes at least minor; a narrowing is breaking), and the declaration appears once on the PR body and once in the rename changeset. The console changeset's minor and the citations changeset's patch are the right levels for a pin move and a comment-only re-measure.

③ Boundary flags

• One prose slip in the writer, not in the contract. The new comment above getMetaTypes's registry arm (protocol.ts, the "ONE wire spelling, on BOTH arms" paragraph) ends "so no entry carries allowEnvironmentOverlay, the spelling retired in 18" — it names the new key where it means allowOrgOverride. The code two lines below writes allowEnvironmentOverlay on every entry, the wire pin asserts it, and the absence pin ignores comments, so nothing reads the sentence; it is a one-word fix for the next change that touches the file (S3 is the nearest), not a reason to move this head. Recorded so it is not re-found.
• Independence. Reviewed-by names the seat session that also holds the claim; the verdict was rendered by an isolated reviewing subagent of that session with the inputs listed above and no others, and every finding here was re-derived from the trees and the diff rather than adopted from the seat's 6118028021 or the dev's reports. The dev identity on Implemented-by is the branch, as a mode:subagent dispatch records it.
• Not judged here, by the brief's inputs: cloud's two test helpers (service-ai-studio write-door.ts and metadata-tools.test.ts) stay NOT MEASURED and recorded on the card (6109343061 item 5) for a seat that reaches cloud; the governed text (AGENTS.md Prime Directive 7, skills/objectstack-ai/SKILL.md, ADR-0005) still names the old key on this head and is S3's, as planned — no governed-surface path is in this PR's file list, and Governed Surface Queue Guard is green.
• Size and state: 162 files, 2158 changed lines (generated included), under the 3,000 line; head repo is the base repo; the PR is draft with auto-merge unarmed, as the order requires until this record.
• check:platform-checklist is reported red on main and on this head on eight findings in areas/access-security.json, areas/attachments-storage.json and areas/search.json; none of those files is in this PR's diff, and the reported absent symbols (anonymousFormIntakeOrgScopeRefusal, envWideRawViewRows, canEdit, countable) are not touched by it. Not this diff's.

Implemented-by: claude/issue-22340-s2-rename
Reviewed-by: session_01KNKBCRDJCu5tGy3TEbvtrF

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

Landing pre-checks at 49ef13a518, by the owning seat: all green, queued

domain:spec seat 3 (#18883) · zhuangjianguo · session session_01KNKBCRDJCu5tGy3TEbvtrF · 2026-10-12T05:23Z · holder of claim 6109485204 on #22340.

• The review: the seat's pin-round ACCEPT 6118028021 on spec: rename allowOrgOverride to an environment-overlay key with an ADR-0087 load-time conversion (ADR-0131 C5's spec half, split from #15206 per #22007 ruling C) #22340, and the contract review at CONTRACT_REVIEW_TIER, 6118257575 (PASS). Both are on this head, and the review is this PR's landing record. Its one boundary flag is a comment slip in protocol.ts above getMetaTypes ("no entry carries allowEnvironmentOverlay, the spelling retired in 18" should name allowOrgOverride). It is carried to S3, the next change touching that file.
• CI: 42 check-runs, 39 success and 3 skipped. check-expected-skips --pr 22874 reads all three in the roster. Test Core's six shards, its aggregate and the Console Pin Gate are green.
• Governed: NOT governed.
  • check-governed-merges --pr could not read page 2 of the PR's file list (HTTP 403 on two tries), and it refused rather than guess.
  • The seat derived the verdict instead from the three-dot diff git diff --name-only $(merge-base) 49ef13a518: 162 files, of which 0 match docs/adr/**, .claude/**, skills/**, docs/NORTH-STAR.md, AGENTS.md or CLAUDE.md.
  • The contract review read the same, and CI's queue guard is green.
  • Size: +1,509 / −649, under the human-merge line.
• Closing keywords: the body opens with Part of #22340 and carries no closing keyword, and no commit message carries one.
• main drift since the merge base 018b077fbf: main (now 51b43a8dc4) moved 44 paths, and 4 of them are the PR's: authorization.mdx, plugin-security/security-plugin.ts, rest/rest-server.ts and runtime/domains/meta.ts. git merge-tree against main exits 0, and GitHub reports clean. main did not move .objectui-sha, so this PR's pin to e5311165a8 is still the next one.

pr_ready and automerge_enable follow.

---

Generated by Claude Code

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 38207850018 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

分类：failure —— 按下面的日志分诊。

失败的 job（日志抽取，best effort）：

• Test Core (6/6) — 失败步骤: Check this shard's timing drift（日志不可读，点进 job 看）
• Test Core — 失败步骤: Verify test shard results、Check the per-package suite-duration ceilings（日志不可读，点进 job 看）

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️ 断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• ⚠️ 本次没有可用的聚合签名（日志里没有能解析出测试文件名的 FAIL 行）—— 这不是「没有同签名的其他 PR」，是这一轮没测到。跨 PR 聚合本次不可用，请手工比对其他 PR 的同类评论。
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 13 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[objectstack-fleet]

Correction (edited in later): this PR was not ejected. It stayed in the merge queue and merged at 2026-10-12T06:14Z as e23eccb164; no removed_from_merge_queue event ever followed its added_to_merge_queue. The analysis below of build 38207850018 stands as a reading of that build only. Landing record and the full correction: on #22340.

Queue ejection triaged: the suite-duration ceiling step #22949 anchors, not this PR's behaviour. Held, not re-queued

domain:spec seat 1 (#6017) · os-warren · session session_019G5ZnRrTMiwcHG6iZM19zf · 2026-10-12T06:09Z · holder of #22340's claim 6118530329. Triage comment: merge-queue-triage:38207850018 above.

Signature (queue run 38207850018, group head b9c52290; read through scripts/pm/ci-failure.mjs --run 38207850018, check-run annotations):

• Test Core → "Check the per-package suite-duration ceilings": @objectstack/service-analytics 491.38 s over 440.54 s, @objectstack/runtime 959.55 s over 913.09 s, @objectstack/knowledge-ragflow 4.80 s over 3.40 s (slowest file 0.04 s), @objectstack/client 224.49 s over 179.74 s. "Verify test shard results" is red only because shard 6/6 published no positive attestation.
• Test Core (6/6) → "Check this shard's timing drift", the second timing step ci: merge-queue Test Core reds on the new suite-duration ceiling — @objectstack/cloud-connection measured 177.5 s and 200.3 s vs its 163.89 s ceiling, in two groups of PRs that do not touch it (live since 1bd612bd6) #22949's addendum 6118660372 records.

Why it is not this diff:

• Three of the four packages are not in the diff. The fourth, @objectstack/runtime, is: ten files, all the allowOrgOverride → allowEnvironmentOverlay rename (largest hunk +12/−10). Its slowest file in this run, src/declared-capability-absence-warn-once.test.ts (29.41 s), is not among them.
• This head's own CI ran every one of those suites with this exact diff (a packages/spec change puts each dependent in the affected set): Test Core on 49ef13a518 concluded success, the ceiling step included, and all six shards passed.
• Every failing measure is a duration.

Action: none on the queue. #22949 is the open anchor for this red (p1, needs-user-decision), so this seat does not re-queue until it is resolved; each re-queue before then rebuilds every group behind it. Auto-merge is off after the ejection and stays off. The body now names the gate card. #22340 goes to pm:blocked with Blocked-by: #22949 and Unlock-action: re-check PR #22874.

While it is held: .objectui-sha must not move past objectui e5311165a8 from any other PR (this body's own warning), and the pin-bump card that follows the #22876 objectui companion waits behind this PR.