@@ -0,0 +1,20 @@
+---
+'@objectstack/cloud-connection': minor
+---
+
+fix(cloud-connection)!: a runtime holding the environment service key is platform-managed, so it registers no Cloud Connection Setup page and refuses to disconnect; everywhere else the Cloud Connection entry moves to Setup's Integrations group
+
+A runtime whose control-plane credential is the environment service key (`controlPlaneApiKey`, or `OS_CLOUD_API_KEY`, which the cloud sets on the environments it hosts) is connected by the platform, not by anyone on the runtime. It still registered the Cloud Connection page in Setup's Apps group, which read "Connected" and offered Disconnect. Disconnecting there cleared the runtime's stored device credential while the service key stayed in use, so the page went on reading "Connected", and the control plane was asked to revoke a connection the platform had made.
+
+Such a runtime now registers neither the page nor its navigation entry, and says so once at boot. A request to disconnect it is refused with `409` and `RESOURCE_CONFLICT`, after the sign-in and Setup Access checks and before anything is revoked or cleared. The message says the platform manages the connection.
+
+A self-hosted or local runtime, connected through the device-code flow, keeps the page and its disconnect unchanged. Its Cloud Connection entry moves from the Apps group to the Integrations group, after Webhooks, Datasources and Connect an Agent. That group requires `manage_platform_settings`, so a user who holds Setup Access without it, such as an organization administrator, no longer sees the entry. The connect and disconnect requests still take Setup Access alone.
+
+Clause-②: no (narrowing)
+
+<!-- adr-0087: not-required (no-migration-prescription) No metadata moves: no spec key, authorable spelling, object definition or stored shape is added, removed, renamed or re-shaped, and no exported declaration is removed or narrowed, so there is nothing for `objectstack migrate meta` to rewrite. What changes is what a runtime holding the environment service key serves: it no longer registers the Cloud Connection page or its navigation entry, and it refuses a disconnect it used to carry out. The navigation entry's new group is a value inside an exported constant whose type is unchanged. The other categories are closed on facts: the package publishes (not unpublished); no ADR-0087 id is named or touched (not registered or already-registered); and nothing exported is removed or narrowed (not runtime-interface-only, type-surface-only or runtime-export-retired). -->
+
+**BREAKING** (on a runtime holding the environment service key, a disconnect request it carried out is now refused, and the Cloud Connection page and its navigation entry are no longer served), shipped as `minor` under the launch-window convention for breaking changes.
+
+- **Unchanged:** a runtime without the service key, apart from the entry's group. The connection status answer is unchanged on every runtime.
+- **Nothing to rewrite:** a cloud-hosted environment's connection is the platform's to manage. A self-hosted server leaves `OS_CLOUD_API_KEY` unset, as the deployment guide says; one that sets it is platform-managed by this rule.
@@ -751,46 +751,68 @@ jobs:
             1. It releases something
                -> run 'pnpm changeset' and name the packages it releases.
 
-               WHICH LEVEL: A purely additive widening of a published package's
-               public surface (a new exported symbol on an `index`, a new accepted
-               key or value) takes at least `minor`. The commit type may raise a
-               bump but never lower it below what the act requires; a `fix(` that
-               widens an index is therefore `minor`, and a `fix(` that changes no
-               public surface stays `patch`. During the launch window `major` stays
-               refused by `check-changeset-no-major` and breaking-ness is carried by
-               the BREAKING banner plus the ADR-0087 disposition, not by the level.
-               Ruled by the maintainer on 2026-09-04 (decision batch #35) on #15294,
-               which recorded two contract reviews reading the repo's own history to
-               OPPOSITE bumps for the same additive act. The commit type is not the
-               discriminator it looked like: it correlates with the act, and when
-               they disagree the act wins. The 64 historical `patch` precedents are
-               pre-rule and nothing is retro-fixed.
+               WHICH LEVEL: the level follows the METADATA PROTOCOL alone -- the
+               change to what a metadata author can write -- and the commit type
+               never decides it (maintainer ruling A, 2026-10-21, on #25105; it
+               amends the 2026-09-04 rule of decision batch #35 on #15294, under
+               which nearly every release was a minor: of 95 pending changesets
+               about half were `minor` and about a dozen moved the protocol).
+               Declare the kind on a line of its own, in the PR body AND in the
+               changeset body, beside the `Clause-②:` line:
+
+                 Metadata-protocol: added     a new authorable key, a new accepted
+                                              value or enum member, a new metadata
+                                              type                       -> `minor`
+                 Metadata-protocol: narrowed  a key removed or tombstoned, a value
+                                              refused, a requirement tightened
+                                              (declare the `(narrowing)` arm too)
+                                                                         -> `minor`
+                 Metadata-protocol: semantic  the meaning or default of an
+                                              authorable key changes     -> `minor`
+                 Metadata-protocol: none      everything else: description or
+                                              error text, non-authorable internal
+                                              types, REST, drivers, services, the
+                                              console, `feat:` and `fix!:` alike
+                                                                         -> `patch`
+
+               `added` takes `minor` because spec schemas are not `.strict()`: an
+               older runtime silently strips a key it does not know, so an app
+               that writes a new key must be able to name a minor floor. Where
+               several kinds apply, name the one highest in breaking-ness:
+               `narrowed` over `semantic` over `added`. A non-protocol breaking
+               change ships `patch` and KEEPS its carriers: the BREAKING banner
+               and the ADR-0087 disposition are unchanged. `major` stays refused
+               by `check-changeset-no-major` during the launch window. The
+               GitHub Release body is grouped from these declarations by what the
+               reader must do: 需手动处理 / 自动迁移 / 新增能力 / 语义变化 / 其他修复.
 
                PART OF THIS IS A GATE, and which part is the difference between
                grading well and being refused. `check-changeset-no-major.mjs`
-               refuses `major` and says why in its header. Since #16055 the SAME
-               script also runs a LEVEL AXIS over the rule above, and that
-               script's header states its scope: "a PR that DECLARES clause ② (a
-               new key on a published payload) must grade AT LEAST ONE package
-               whose published source it moves `minor` or above". It mechanizes
-               this ruling "for exactly the PRs where the widening is already
-               DECLARED, and for no others", and its `judgeLevel` verdict table
-               spells both directions: `not-declared`, "the declaration reads
-               `no`", exits 0; `enforce`, "declared `yes`, moved packages graded
-               `patch` and NONE of them graded `minor` or above", exits 1. So on
-               a PR that declares clause ②, grading `patch` across the board is
-               refused; on every other PR the axis stands down and the two levels
-               below `major` are yours, as they always were.
+               refuses `major` and says why in its header. The SAME script runs
+               the LEVEL AXIS over the rule above, reading both lines from the PR
+               body on every `opened`, `synchronize` and `edited` event, and its
+               `judgeLevel` verdict table spells every direction: a declared kind
+               must grade at least ONE package whose published source the diff
+               moves `minor` or above (`enforce`, exit 1 otherwise); a declared
+               `none` must grade every entry it introduces `patch` (`none-minor`,
+               exit 1) and may not move a `packages/spec/authorable-surface/` or
+               `authorable-defaults/` shard (`none-baseline-moved`, exit 1);
+               `added` beside `Clause-②: no`, or `narrowed` beside a line without
+               the `(narrowing)` arm, is a `contradiction` (exit 1); and a PR that
+               introduces a changeset entry with no readable `Metadata-protocol:`
+               line is refused as NOT MEASURED (exit 1) rather than ticked -- the
+               body is re-read on `edited`, so that red clears with no push.
 
                WHAT THE AXIS DOES NOT JUDGE, in its own words: "WHICH of the
                packages above received that widening is NOT something this gate
-               can read, and it does not claim to. Clause ② is declared ONCE, FOR
-               THE PR" -- the declaration line in the PR body names no package.
-               The axis cross-checks a declaration
-               against the levels; it never reads the diff to find the act.
-               Judging the act is still yours, this paragraph is still where the
-               rule lives, and everything in it the axis does not reach is still
-               prose.
+               can read, and it does not claim to. The kind is declared ONCE, FOR
+               THE PR" -- the declaration lines in the PR body name no package. A
+               refused value, a narrowed enum or a changed meaning is invisible to
+               the baselines, so the declaration, not the diff, is the carrier.
+               The axis cross-checks the declarations against the levels; it never
+               reads the diff to find the act. Judging the act is still yours,
+               this paragraph is still where the rule lives, and everything in it
+               the axis does not reach is still prose.
 
             2. It releases nothing (.github/, .claude/, docs/, content/,
                examples/, tests-only, and the like)
 
@@ -1081,24 +1081,24 @@ Both non-handshake shapes, and how to classify and probe your own:
    surface** (Prime Directive #14 names them — more than ADRs): push it, open the PR, and stop
    there; landing waits for its tier's record — the maintainer's word, or a seat's contract-tier
    review. For that class, a finished task = a PR left visibly awaiting that record.
-3. **Add a changeset for anything that publishes.** Feature, functional improvement or fix — run `pnpm changeset`
-   (or add a `.changeset/*.md` entry) describing it before committing. A bug fix in a released package takes a
-   **`patch`** changeset — never none, and ⛔ never `skip-changeset`: that label is for a diff that publishes
-   nothing from any released package. The declaration is `Clause-②: yes|no` plus at most one arm from the closed pair
-   `(widening)`/`(narrowing)`: `yes` takes at least **`minor`**, `(narrowing)` is BREAKING, `no (widening)` malformed.
-   **Breaking changesets must carry their migration.** If the change removes or renames anything an author can write (a
-   spec key, an export, a config field), the changeset body must state the FROM → TO mapping and the one-line fix —
-   this text ships to consumers as `CHANGELOG.md` inside the npm package and is what an upgrading agent greps after the
-   tombstone error. Removing an authorable spec key also requires a tombstone so the rejection itself carries the
-   prescription — `retiredKey()` (`packages/spec/src/shared/retired-key.ts`) on the schema whether or not it is
-   `.strict()`, and an entry in the shape's `*_RETIRED_KEY_GUIDANCE` map (see `data/mapping.zod.ts`) only for a
-   spelling the shape never declared, such as the retired key's old alias, where a tombstone has no property to
-   replace. The changeset is one of fourteen surfaces a retirement touches — follow the
-   `spec-property-retirement` skill (`.claude/skills/`) rather than reconstructing the kit, and note that a tombstone
-   keeps its liveness-ledger row while a key deleted without one loses it.
-   **A breaking changeset must also state its ADR-0087 disposition, in writing** — exactly one marker in the changeset
-   body, which also carries the PR's `Clause-②` line: `pnpm check:adr-0087-registration` reads the arm there. ⛔ The
-   categories are NOT copied here — the gate prints the full set when it fails.
+3. **Add a changeset for anything that publishes** (`pnpm changeset` before committing). A bug fix in a released
+   package takes a **`patch`** changeset — never none, and ⛔ never `skip-changeset`: that label is for a diff that
+   publishes nothing from any released package. Two line-initial declarations, in the PR body and the changeset body:
+   `Clause-②: yes|no` plus at most one arm from the closed pair `(widening)`/`(narrowing)` (`(narrowing)` is
+   BREAKING, `no (widening)` malformed), and `Metadata-protocol: added|narrowed|semantic|none`, the change to what a
+   metadata author can write — a new key, accepted value or metadata type is `added`; a key removed or tombstoned, a
+   value refused or a requirement tightened is `narrowed`; a changed meaning or default is `semantic`; all else is
+   `none`; several ⇒ `narrowed` over `semantic` over `added`. The level follows the kind alone: a kind takes at least
+   **`minor`** on a package the diff moves, `none` takes **`patch`**; a non-protocol change, widening or breaking,
+   ships `patch` and keeps its BREAKING banner and ADR-0087 disposition. **Breaking changesets must carry their
+   migration**: removing or renaming anything an author can write (a spec key, an export, a config field) puts the FROM
+   → TO mapping and the one-line fix in the body, which ships as `CHANGELOG.md` in the npm package. Removing an
+   authorable spec key also needs a tombstone (`retiredKey()`, `packages/spec/src/shared/retired-key.ts`) so the
+   rejection carries the prescription — one of fourteen retirement surfaces; follow the `spec-property-retirement`
+   skill (`.claude/skills/`), never reconstruct the kit. **A breaking changeset must also state its ADR-0087
+   disposition, in writing** — exactly one marker in the changeset body, which also carries both declaration lines
+   (`pnpm check:adr-0087-registration` reads the arm and the kind there). ⛔ The categories are NOT copied here —
+   the gate prints the full set when it fails.
 4. **A removal that breaks the pinned sibling checkout ships together with the sibling fix and the pin bump — or it
    does not ship.** The full battery's `Console Pin Gate` builds objectui at the pinned `.objectui-sha` against
    **current** `main`, so such a removal is a main-red the moment it merges; its ruling therefore authorizes the