@@ -0,0 +1,16 @@
+---
+'@objectstack/metadata-protocol': patch
+---
+
+fix(metadata-protocol): the refusal of an in-place edit or removal of a packaged flow names the clone and the on/off switch, not a redeploy or `OS_METADATA_WRITABLE` (#20819)
+
+Clause-②: no
+
+A write or removal that targets a flow shipped by a code package, and does not name that package, is refused with `403 NOT_OVERRIDABLE`. That covers `PUT /api/v1/meta/flow/:name` without `?package=`, `DELETE /api/v1/meta/flow/:name`, `PUT` and `DELETE /api/v1/automation/:name`, and `POST /api/v1/automation` onto a packaged flow's name. The refusal used to say "Edit the source artifact and redeploy, or set OS_METADATA_WRITABLE to grant a runtime escape hatch", and cited ADR-0005. The administrator of an installed package can do neither.
+
+The refusal now names the two paths ADR-0126 sanctions for a packaged flow, and cites ADR-0126:
+
+- clone it under a new name to customize it: `POST /api/v1/automation/:name/clone` with `{ name, label }`;
+- or switch it off: `POST /api/v1/automation/:name/toggle` with `{ enabled: false }`. Where one install serves several organizations, only the platform operator can use the switch.
+
+The status, the code and which writes are refused are unchanged. `OS_METADATA_WRITABLE=flow` still opens the lock as before; the refusal just no longer suggests it. Every other metadata type's refusal reads exactly as before. A write that names the shipping package with `?package=` is refused with `403 ITEM_LOCKED` by a separate limb, which this change leaves as it was.
@@ -30,11 +30,15 @@ const PACKAGE_ID = 'com.example.pkg';
 const shipped = (name: string, extra: Record<string, unknown> = {}) =>
     ({ name, label: name, _packageId: PACKAGE_ID, _provenance: 'package', ...extra });
 
-/** Packaged artifacts of three regimes: behavioral (`flow`), overlay (`view`), rolled-back overlay (`page`). */
+/**
+ * Packaged artifacts of three regimes: behavioral (`flow`), overlay (`view`), rolled-back overlay (`page`) —
+ * plus `action`, which ADR-0126 §3 also puts in Regime C but whose sanctioned paths are not the flow's.
+ */
 const ARTIFACTS = new Map<string, Map<string, unknown>>([
     ['flow', new Map([['pkg_flow', shipped('pkg_flow', { type: 'autolaunched', nodes: [], edges: [] })]])],
     ['view', new Map([['pkg_view', shipped('pkg_view')]])],
     ['page', new Map([['pkg_page', shipped('pkg_page')]])],
+    ['action', new Map([['pkg_action', shipped('pkg_action')]])],
 ]);
 
 function protocolOn(environmentId: string | undefined): ObjectStackProtocolImplementation {
@@ -119,3 +123,89 @@ describe('packagedBaseRefusal — the /meta door\'s locked-base verdict, handed
         expect(p.packagedBaseRefusal({ type: 'flow', name: 'pkg_flow', operation: 'delete' })).toBeNull();
     });
 });
+
+/**
+ * [#20819, ADR-0126 §2] The refusal's SENTENCE is chosen per regime, from one
+ * table keyed on the type's declared regime. The code, the status and which
+ * writes are refused are the matrix above, unchanged.
+ *
+ * A Regime C type (`flow`) names Regime C's sanctioned paths — the clone under
+ * a new name (§7.1) and the enable/disable switch (§7.2) — cites ADR-0126, and
+ * names neither the `OS_METADATA_WRITABLE` hatch nor a redeploy an installed
+ * package's administrator cannot make. Every other type's sentence is
+ * byte-identical to what it was (the controls): `page` has no regime, and
+ * `action` is Regime C on paper but its sanctioned paths are not the flow's
+ * routes, so it keeps its sentence until its own paths are declared.
+ */
+describe('packagedBaseRefusal — the sentence is chosen per ADR-0126 regime', () => {
+    const CLONE = 'POST /api/v1/automation/:name/clone';
+    const TOGGLE = 'POST /api/v1/automation/:name/toggle';
+    const ADR_0126 = 'docs/adr/0126-packaged-metadata-customization-model.md';
+
+    /** The package-less sentence every regime-less type keeps (`refusePackagedBaseOverride`). */
+    const LEGACY_SAVE = (type: string, name: string) =>
+        `Metadata item '${type}/${name}' is provided by a code package `
+        + 'and the type has not opted into per-org overlay writes (allowOrgOverride=false). '
+        + 'Edit the source artifact and redeploy, or set OS_METADATA_WRITABLE to grant a runtime escape hatch. '
+        + 'See docs/adr/0005-metadata-customization-overlay.md.';
+    /** …and its removal twin (`refusePackagedBaseRemoval`). */
+    const LEGACY_DELETE = (type: string, name: string) =>
+        `Metadata item '${type}/${name}' is provided by a code package `
+        + 'and the type has not opted into per-org overlay writes. '
+        + 'See docs/adr/0005-metadata-customization-overlay.md.';
+
+    for (const environmentId of [undefined, 'env_1']) {
+        for (const operation of ['save', 'delete'] as const) {
+            it(`a packaged flow's ${operation} refusal names clone and the switch, cites ADR-0126, and names no hatch `
+                + `(${environmentId ? 'environment' : 'host-config'} kernel)`, () => {
+                const refusal: any = protocolOn(environmentId)
+                    .packagedBaseRefusal({ type: 'flow', name: 'pkg_flow', operation });
+                expect(shape(refusal)).toEqual({ code: 'NOT_OVERRIDABLE', status: 403 });
+                const message = String(refusal.message);
+                expect(message.startsWith("Metadata item 'flow/pkg_flow' is provided by a code package")).toBe(true);
+                expect(message).toContain(CLONE);
+                expect(message).toContain(TOGGLE);
+                expect(message).toContain(ADR_0126);
+                expect(message).not.toContain('OS_METADATA_WRITABLE');
+                expect(message).not.toContain('redeploy');
+                expect(message).not.toContain('0005-metadata-customization-overlay');
+                // The REST door truncates a client message at 500 characters;
+                // the whole sentence, ADR citation included, must arrive.
+                expect(message.length).toBeLessThan(500);
+            });
+        }
+    }
+
+    it('the regime is read on the canonical type — a plural spelling gets the same sentence', () => {
+        const p = protocolOn(undefined);
+        const plural: any = p.packagedBaseRefusal({ type: 'flows', name: 'pkg_flow', operation: 'save' });
+        const singular: any = p.packagedBaseRefusal({ type: 'flow', name: 'pkg_flow', operation: 'save' });
+        expect(plural.message).toBe(singular.message);
+    });
+
+    it('the /meta doors throw the same regime sentence the value carries (one emitter)', async () => {
+        const p = protocolOn('env_1');
+        const thrownBy = (run: Promise<unknown>) => run.then(() => undefined, (e: any) => e);
+        const save: any = await thrownBy(p.saveMetaItem({ type: 'flow', name: 'pkg_flow', item: { name: 'pkg_flow', label: 'x' } }));
+        const del: any = await thrownBy(p.deleteMetaItem({ type: 'flow', name: 'pkg_flow' }));
+        expect(save?.message).toContain(CLONE);
+        expect(del?.message).toContain(TOGGLE);
+    });
+
+    it('control: a type with no declared regime (`page`) keeps its sentence byte for byte', () => {
+        const p = protocolOn('env_1');
+        const refusal: any = p.packagedBaseRefusal({ type: 'page', name: 'pkg_page', operation: 'save' });
+        expect(shape(refusal)).toEqual({ code: 'NOT_OVERRIDABLE', status: 403 });
+        expect(refusal.message).toBe(LEGACY_SAVE('page', 'pkg_page'));
+    });
+
+    it('control: `action` — Regime C on paper, with sanctioned paths that are not the flow\'s — keeps both sentences byte for byte', () => {
+        const p = protocolOn('env_1');
+        const save: any = p.packagedBaseRefusal({ type: 'action', name: 'pkg_action', operation: 'save' });
+        const del: any = p.packagedBaseRefusal({ type: 'action', name: 'pkg_action', operation: 'delete' });
+        expect(shape(save)).toEqual({ code: 'NOT_OVERRIDABLE', status: 403 });
+        expect(shape(del)).toEqual({ code: 'NOT_OVERRIDABLE', status: 403 });
+        expect(save.message).toBe(LEGACY_SAVE('action', 'pkg_action'));
+        expect(del.message).toBe(LEGACY_DELETE('action', 'pkg_action'));
+    });
+});
@@ -4798,6 +4798,13 @@ function isNonCanonicalStoredType(type: string): boolean {
     return canonicalMetaType(type) !== type && (PLURAL_TO_SINGULAR[type] ?? type) === type;
 }
 
+/**
+ * [#20819] An ADR-0126 customization regime the packaged-base refusal speaks
+ * for — only the regimes it needs today (see
+ * `ObjectStackProtocolImplementation.PACKAGED_BASE_REGIME`).
+ */
+type PackagedBaseRegime = 'C';
+
 /**
  * Implements the per-domain contracts this class ACTUALLY provides (ADR-0076
  * D10 — the facade never implemented the other domains; those live in their
@@ -14669,6 +14676,85 @@ export class ObjectStackProtocolImplementation implements
         return status === 403 && (code === 'NOT_OVERRIDABLE' || code === 'ITEM_LOCKED');
     }
 
+    /**
+     * [#20819, ADR-0126 §2 / §3] The customization REGIME of a metadata type,
+     * declared for the types whose packaged-base refusal speaks for its regime.
+     *
+     * ADR-0126 §2 requires a Regime C refusal to name the sanctioned path —
+     * "in-place edit refused loudly at the write door, the refusal naming the
+     * sanctioned path" — and §10 gives the reason: a locked base that refuses
+     * with its sanctioned path in the message is what keeps AI-written metadata
+     * from guessing. The regime is recorded nowhere else in code (the ADR's
+     * table is prose, and the registry entries carry no regime field), so this
+     * map is its one declaration for the refusal, and
+     * {@link PACKAGED_BASE_REFUSAL_BY_REGIME} is keyed off it — never a second
+     * list of type names, and never a type branch in the emitters' prose.
+     *
+     * It carries `flow` only, deliberately, though ADR-0126 §3's Regime C row is
+     * longer — `flow`, `permission`, `action`, and pre-charted `tool` / `skill`
+     * / `position`. A type is declared here only once the Regime C sentence's
+     * paths are ITS served paths: that sentence names the `/automation` clone
+     * and switch routes, which exist for a flow alone. `action` has a switch at
+     * its own route and no clone at all (the action-clone half is not
+     * chartered, §8 item 2), and `permission` has its own clone machinery, so
+     * declaring either would advertise a route that does not exist for it —
+     * both keep the sentence they had until their own sanctioned paths are
+     * written into the table.
+     */
+    private static readonly PACKAGED_BASE_REGIME: Readonly<Record<string, PackagedBaseRegime>> = {
+        flow: 'C',
+    };
+
+    /**
+     * [#20819, ADR-0126 §2 / §7] The packaged-base refusal's sentence, chosen
+     * PER REGIME ({@link PACKAGED_BASE_REGIME}). A type with no declared regime
+     * keeps the sentence the emitters carry inline, byte for byte.
+     *
+     * Regime C (§2: behavioral — locked base, disable, clone-as-sibling) names
+     * its two sanctioned paths and cites the ADR that decided them:
+     *
+     *  - **clone under a new name** (§7.1) — `POST /automation/:name/clone`,
+     *    whose body `{ name, label }` requires both keys;
+     *  - **the enable/disable switch** (§7.2) — `POST /automation/:name/toggle`,
+     *    body `{ enabled }`, operator-gated per §5 where one install serves
+     *    several organizations (the `group` / `isolated` postures).
+     *
+     * ⛔ It does not name the `OS_METADATA_WRITABLE` hatch. The hatch still
+     * opens this lock exactly as before ({@link isOverlayAllowed}), so which
+     * writes are refused does not move — only what the refusal prescribes.
+     * ⛔ Nor does it prescribe editing the source and redeploying: the
+     * administrator of an installed package cannot do that.
+     *
+     * Kept under the REST door's 500-character client-message bound, past
+     * which the tail is truncated: 411 characters before the item's name on
+     * save and 404 on removal, so a name of up to 88 characters arrives whole.
+     */
+    private static readonly PACKAGED_BASE_REFUSAL_BY_REGIME: Readonly<
+        Record<PackagedBaseRegime, (type: string, name: string, operation: 'save' | 'delete') => string>
+    > = {
+        C: (type, name, operation) =>
+            `Metadata item '${type}/${name}' is provided by a code package, and its packaged base is locked `
+            + (operation === 'delete' ? `against removal. ` : `against in-place edits. `)
+            + `Clone it under a new name to customize it (POST /api/v1/automation/:name/clone, body {name, label}), `
+            + `or switch it off (POST /api/v1/automation/:name/toggle, body {enabled: false}; `
+            + `operator-only where one install serves several organizations). `
+            + `See docs/adr/0126-packaged-metadata-customization-model.md.`,
+    };
+
+    /**
+     * The regime-chosen refusal sentence for `(type, name, operation)`, or
+     * `undefined` when the type declares no regime and the emitter keeps its
+     * own sentence.
+     */
+    private static packagedBaseRegimeSentence(
+        type: string, name: string, operation: 'save' | 'delete',
+    ): string | undefined {
+        const singular = PLURAL_TO_SINGULAR[type] ?? type;
+        const regimes = ObjectStackProtocolImplementation.PACKAGED_BASE_REGIME;
+        if (!Object.prototype.hasOwnProperty.call(regimes, singular)) return undefined;
+        return ObjectStackProtocolImplementation.PACKAGED_BASE_REFUSAL_BY_REGIME[regimes[singular]](singular, name, operation);
+    }
+
     /**
      * [#8184] THE PACKAGE DOOR — `saveMetaItem`'s refusal of a write onto an
      * item a code package ships, on a type with no per-org overlay channel.
@@ -14682,6 +14768,10 @@ export class ObjectStackProtocolImplementation implements
      * refusals, above the ADR-0010 `_lock` check). The one added line computes
      * `overlayAllowed` the way `saveMetaItem` computes it at its top. In the
      * record, "the block comment above" and "this method" mean `saveMetaItem`.
+     *
+     * [#20819] Since lifted, the package-less `NOT_OVERRIDABLE` SENTENCE is
+     * chosen per ADR-0126 regime ({@link packagedBaseRegimeSentence}); the
+     * predicate, the code, the status and the named-base limb are unchanged.
      */
     private refusePackagedBaseOverride(
         request: { type: string; name: string; packageId?: string | null },
@@ -14757,11 +14847,14 @@ export class ObjectStackProtocolImplementation implements
                     request.type, request.packageId as string, false,
                 );
             }
+            // [#20819] The SENTENCE is chosen per ADR-0126 regime; the code,
+            // the status and this branch's predicate are unchanged.
             const err = new Error(
-                `Metadata item '${request.type}/${request.name}' is provided by a code package `
+                ObjectStackProtocolImplementation.packagedBaseRegimeSentence(request.type, request.name, 'save')
+                ?? (`Metadata item '${request.type}/${request.name}' is provided by a code package `
                 + `and the type has not opted into per-org overlay writes (allowOrgOverride=false). `
                 + `Edit the source artifact and redeploy, or set OS_METADATA_WRITABLE to grant a runtime escape hatch. `
-                + `See docs/adr/0005-metadata-customization-overlay.md.`
+                + `See docs/adr/0005-metadata-customization-overlay.md.`)
             );
             (err as any).code = 'NOT_OVERRIDABLE';
             (err as any).status = 403;
@@ -14784,17 +14877,23 @@ export class ObjectStackProtocolImplementation implements
      * lines, byte for byte apart from indentation. The two added lines compute
      * `overlayAllowed` and `artifactBacked` the way `deleteMetaItem` computes
      * them, where both still stand for its `NOT_CREATABLE` check.
+     *
+     * [#20819] Since lifted, the SENTENCE is chosen per ADR-0126 regime
+     * ({@link packagedBaseRegimeSentence}); the predicate, the code and the
+     * status are unchanged.
      */
     private refusePackagedBaseRemoval(request: { type: string; name: string }): void {
         const overlayAllowed = ObjectStackProtocolImplementation.isOverlayAllowed(request.type);
         const artifactBacked = this.isArtifactBacked(request.type, request.name);
         const legacyOverlayRemoval = ObjectStackProtocolImplementation
             .mergesOverlayAtRead(request.type);
         if (artifactBacked && !overlayAllowed && !legacyOverlayRemoval) {
+            // [#20819] Sentence per ADR-0126 regime, as in the save door.
             const err = new Error(
-                `Metadata item '${request.type}/${request.name}' is provided by a code package `
+                ObjectStackProtocolImplementation.packagedBaseRegimeSentence(request.type, request.name, 'delete')
+                ?? (`Metadata item '${request.type}/${request.name}' is provided by a code package `
                 + `and the type has not opted into per-org overlay writes. `
-                + `See docs/adr/0005-metadata-customization-overlay.md.`
+                + `See docs/adr/0005-metadata-customization-overlay.md.`)
             );
             (err as any).code = 'NOT_OVERRIDABLE';
             (err as any).status = 403;