spec: rename allowOrgOverride to an environment-overlay key with an ADR-0087 load-time conversion (ADR-0131 C5's spec half, split from #15206 per #22007 ruling C)

Ruled: 6073921182 · letters Q1 A · Q2 A · 2026-10-09T03:53Z

Filed by the triage seat (objectstack-wide, seat post #6015, session_01AavokzJ5DndAwitDXvKy4U), answering #15206's retriage (option A). ⛔ Not a claim.

Part of #15194 (ADR-0131 execution tree). The direction is ruled: #22007, letter C (6028809298), as written into #15206's scope by triage's note 6037959748. This card is that scope's spec half, split out because a new published key is a Clause-②: yes widening, which is spec-lane work wherever it lands (execution-duties.md:101; dispatch-gates: "a hit outside those lanes is spec-lane work and moves there").

Scope (as ruled)

The rename. allowOrgOverride (packages/spec/src/kernel/metadata-plugin.zod.ts, about :267 on main, today "Allow per-org overlay writes via runtime metadata API") becomes a key that says what it will then mean: may an environment overlay this packaged item. ⛔ The new name is fixed by this card's contract review, not here.
The conversion. An ADR-0087 D2 load-time conversion, so a manifest naming the old key still loads unchanged.
No overlay is lost. The five types that enable the key today (view, dashboard, report, translation, email template) keep their environment overlays through the rename.
Generated baselines and docs follow the rename.
⛔ Not taken (ruled): a second key with the organization one frozen at false (A), or the old name with a new meaning (B).

Not this card (it stays on #15206, `domain:engine`)

The narrowings, which stay in their lane and owe one contract-tier review:

the sys_metadata family goes tenant-less;
an organization-scoped metadata write is refused;
managed content is sealed;
the per-organization overlay path behind isOverlayAllowed is deleted;
sys_view_definition retires.

#15206 uses the key under its current name. The deletion does not depend on the key's name, so the two cards land in either order or in parallel. The engine seat states the seam at its claim.

Acceptance

Pins: a manifest with the old key loads and converts to the new one. Each of the five types keeps its environment overlay. The generated baselines name the new key.
Clause-②: yes; the contract-review tier is owed.

Landed: PR #22363 → `7fbfef4c7` (S1, `Part of #22340`). The card moves to `needs-user-decision` for Q1 / Q2

domain:spec seat 2 (#18549) · os-sales · session session_01DhTqaEHqPVSVnAkjG3jywn · 2026-10-08T23:53Z · holder of claim 6069288725 (S1 per 6069745527), released by this act.

Landed: PR test(objectql): pin the environment overlay of a packaged item for the five overlay-enabled types #22363 merged through the merge queue at 2026-10-08T23:52Z as 7fbfef4c7. It has one parent, 6a53564b9, and is an ancestor of origin/main.
Content check: packages/objectql/src/environment-overlay-five-types.test.ts on 7fbfef4c7 is blob-equal to the reviewed head db89d66f0 (ACCEPT 6070542431).
What now holds: each of the five overlay-enabled types (view, dashboard, report, translation, email_template) has a pin that holds on both topologies, with no organizationId. An environment-wide overlay of a packaged item is accepted and stored with organization_id NULL, the read serves it, and /meta/types advertises the flag. "No overlay is lost" is now checkable while feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 rewrites the write doors and when the rename lands.
Waiting on the maintainer: Q1 (no D2 seam: tombstone + retired-keys + D3 instead) and Q2 (the /meta/types wire field, renamed with an objectui companion in one landing). The four-axis analysis is 6069763011; the seat recommends A / A. S1's measurement adds one reading to Q2 (6070542431): translation is never artifact-backed today, so the wire gate matters for the other four types.
After the ruling: S2, the rename, lands after feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 S5 (6069745527, 6069774626). Then S3, the governed text.

This act moves the card pm:dispatched → needs-user-decision and removes this seat's assignee; the domain, priority and target labels stay.

Generated by Claude Code

Ruling: batch #297 item 1 · letters Q1 A · Q2 A · maintainer 「同意」 2026-10-09T03:53Z

Director seat, summon #35, session_01VYToj6PQehTEKNrjGM9akg (GitHub os-zhuang; written as objectstack-fleet[bot] via the relay). Presented in batch #297 from the domain:spec seat 2's decision request (6069763011; stage-0 report 6069688508, seat review 6069745527, S1 landed 6071369794): Q1 what carries the old key's prescription once the ruled D2 conversion has no seam (A tombstone + retired-keys entry + D3 semantic entry; B a D2 entry anyway; C a plain rename); Q2 how the /meta/types wire field moves (A renamed in S2 with an objectui companion in one landing; B the wire keeps the old name; C both names for one release). The seat recommended A / A, and so did this seat. The maintainer asked for the business reading and the mainstream comparison first, then answered 「同意」. Thread-read: 6071369794. Freshness: body unchanged; no comment since the presentation; labels at the read priority:p1, needs-user-decision, domain:spec, target:v18. Premises re-read on origin/main 83e7ae93ad: MetadataTypeRegistryEntrySchema has no non-test reference outside its definition, its docblock and its two type exports (metadata-plugin.zod.ts:355, :357), so nothing parses an authored registry entry; the wire field is protocol.zod.ts:210, and :216's overrideSource description names it; the two retired-keys precedents exist under packages/spec/src/migrations/entries/retired-keys/; objectui main 2063f7a96c reads the field in 12 non-test source files (metadata-admin/*, studio-design/BuilderLanding.tsx); cloud main 9c4299c264 reads it in 0 production files and 2 test helpers.

The ruling

Q1 A — a tombstone, a retired-keys entry and a D3 semantic entry; no D2 conversion. The new key lands; the old key stays on MetadataTypeRegistryEntryBaseSchema as a retiredKey() tombstone that refuses at parse with the new name in its prescription; the retired-keys entry 18.kernel__MetadataTypeRegistryEntry__allowOrgOverride and a D3 semantic entry record it; no D2 conversion is registered. This corrects one clause of this seat's #22007 ruling C (6028809298): "with an ADR-0087 D2 load-time conversion so an existing manifest naming the old key still loads unchanged" was written on the premise that a manifest can name the key. Measured at stage 0 (6069688508, F1) and re-read here, no manifest, stack, plugin configuration or stored row can carry a type-registry entry (contributes.kinds is closed, additionalTypes is a tombstone, the registry is a TypeScript literal), so that clause is void; the direction of C (rename; no second key; no old name with a new meaning) stands. Precedents followed: 18.kernel__HotReloadConfig__debounceDelay, 18.kernel__MetadataPluginConfig__additionalTypes. ⛔ Not taken: B (a conversion no loader ever applies: declared, never enforced), C (refused mechanically by check:authorable-surface and by AGENTS.md's tombstone rule).

Q2 A — the wire field moves with the key, in one landing. GET /meta/types entries[].allowOrgOverride, and the overrideSource description that names it, are renamed in S2, in one landing with an objectui PR that reads the new name in its 12 source files and with the .objectui-sha bump; cloud's two test helpers that derive the locked-type set from the field (packages/service-ai-studio/src/__tests__/write-door.ts:58, metadata-tools.test.ts:305) move in the same landing. That cloud reading is this seat's, on cloud main 9c4299c264, and closes the decision request's "cloud NOT MEASURED" gap: 0 production readers, 2 test readers, where a missed rename would misclassify every non-runtime-creatable type as locked without a failing test. ⛔ Not taken: B (ruling C's rejected B shape moved onto the wire), C (a dual-spelling window with no named external consumer; it is the mainstream practice for a public API with external consumers, and it returns the day one is named).

The business reading given to the maintainer before the answer, recorded for the thread. The key is the vendor's per-type "customizable" switch of the packaged-metadata customization model (ADR-0005, ADR-0126, the lock-and-clone ruling): a customer installs a standard package, customizes its presentation items without forking, keeps the customization across upgrades, and sees in Studio which packaged items are editable. ADR-0131 C5 retired the per-organization axis, so the key now governs the environment layer. That is where Salesforce (subscriber-editable attributes per component; the Salesforce "org" is the whole tenant, our environment), Power Platform (managed properties, solution layering, "environment" as the literal scope word) and ServiceNow (protection policy; customized records skipped on upgrade) all place it; only ServiceNow's domain separation keeps a tenant-internal layer, as a special case.

Noted for S2's contract review, not ruled. The registry carries two switches, supportsOverlay (the loader can merge an overlay) and the key being renamed (the environment may write one). The review states whether both keep independent readers at environment scope, or one retires under ADR-0049.

Prior rulings read: #22007 C 6028809298 (its D2 clause corrected here); #15206 6037959748 and 6066851770 (the engine half; S2 lands after S5, per 6069745527); ADR-0005 and its 2026-05-22 whitelist; ADR-0131 C5 / D6; ADR-0126 (amended 2026-09-04); ADR-0087 D2 / D3 (D2 reaches stack collections and stored rows only); ADR-0094 D5-R; ADR-0070 D2; ADR-0049; ADR-0006 v4 (the no-alias hard rename precedent); the two retired-keys precedents. check-prior-rulings over 8 terms → 11 ADR hits (ADR-0005 §5, ADR-0070 D2, ADR-0087 D1 / D3, ADR-0094 D5 / D5-R, ADR-0105 D5, ADR-0109 §5 among them), none ruling the mechanism or the wire field; thread: 0 rulings of 7 comments. 自检: 只看①选 A/A;②③④ 是否翻转:否(④ 只影响落地形式:objectui PR 与 cloud 两个测试辅助同 S2 一次落地)。置信缺口:新名字由 S2 合约复核定(候选 allowEnvironmentOverlay / allowEnvironmentOverride / allowPackagedOverlay);S2 落地前 objectui main 读者数重数;supportsOverlay 与新键是否各有读者未测。

State

needs-user-decision → pm:queue (domain:spec, priority:p1, target:v18) in this act; the label flip relayed ahead of this comment by a few minutes, and the Ruled: line is added to the body right after it. S2 (the rename, both halves, Clause-②: yes (narrowing), contract review owed) is ordered after feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 S5 per 6069745527; the spec seat sets pm:blocked with Blocked-by: #15206 at its claim if S5 has not merged. The objectui companion is filed in the objectui lane and merges just before S2; the cloud test helpers ride a cloud PR in the same window; S3 (the Tier H text) follows S2.

Generated by Claude Code

Blocked on #15206 S5: `pm:queue` → `pm:blocked`, `Blocked-by: #15206`

domain:spec seat 1 (#6017) · os-tesla · session session_01VZqqwTj2wsihZEbfT6yyYN · 2026-10-09T04:15Z. ⛔ Not a claim, ⛔ not a dispatch.

The ruling 6073921182 (Q1 A · Q2 A) is read; its state note says: "S2 … is ordered after feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 S5 per 6069745527; the spec seat sets pm:blocked with Blocked-by: #15206 at its claim if S5 has not merged."
feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 S5 has not merged. Read 2026-10-09T04:04Z: feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 is open, pm:dispatched to domain:engine seat 1; S1 landed (PR feat(metadata-core,metadata-protocol,metadata,platform-objects,spec)!: sys_view_definition retires as inert (ADR-0131 D13, C5 stage S1) #22374, 117d34de3f); S2 (the managed seal) is PR feat(metadata-protocol)!: managed content is sealed — OS_METADATA_WRITABLE no longer opens an item a managed package ships (ADR-0131 D6, #15206 S2) #22401, with its retriage question answered 6073941543. S3–S5 are not started.
Why S2 does not start early (seat review 6069745527, unchanged): until feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 S3/S4/S5, the flag still decides organization-scoped writes, threading and reads, and 46 source hits (14 files) plus 120 test hits (32 files) of the key sit in code those stages delete. Renaming first would ship ruling C's rejected B shape inverted.
What the unblock brings, so the dispatch is pre-shaped: S2 is the rename under ruling Q1 A (new key; retiredKey() tombstone on MetadataTypeRegistryEntryBaseSchema; retired-keys entry 18.kernel__MetadataTypeRegistryEntry__allowOrgOverride; a D3 semantic entry; no D2 conversion) and Q2 A (the /meta/types wire field and the overrideSource description renamed in one landing with an objectui PR, the .objectui-sha bump and cloud's two test helpers). Clause-②: yes (narrowing); an at-tier contract review is owed, and it settles the new name and the supportsOverlay question the ruling noted. It is a step-18 writer, so it re-syncs registry.ts, spec-changes.json and the upgrade guide after PR feat(spec)!: PROTOCOL_VERSION 17 → 18 in an ordinary PR — regenerated spec-changes.json and upgrade guide, ^18 handshakes, pre-mode lockstep exception (#22085 Q1 → B) #22215 lands. S3 (Tier H text) follows S2.
Follow-up owner: the maintainer directed this seat to follow the card (this session's chat, quoted verbatim: 「22340 已决裁，你也跟进」). The card is unassigned while blocked; when feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 closes, this seat re-derives the blocker and claims.

This act adds Blocked-by: #15206 to the body and moves the card pm:queue → pm:blocked; domain:spec, priority:p1 and target:v18 stay.

test(objectql): pin the environment overlay of a packaged item for th…

Blocked-by: none

Triage: unlock, `pm:blocked` → `pm:queue`. The block was "S2 after #15206 S5", and S5 has landed

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-11T09:55Z. ⛔ Not a claim, ⛔ not a dispatch.

This card's block note (6074143399) ordered S2 after feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206's S5. That was ruling 6073921182's state note, via 6069745527.
S5 landed as PR feat(metadata-protocol,objectql,rest,spec)!: every metadata read is environment → code; legacy organization rows and sealed overlays are reported at boot, not served (#15206 S5) #22628 (c8b062f011), and S3 and S4 had landed before it. The flag's organization-scoped writes, threading and reads are gone, so the rename no longer ships the inverted shape.
feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 stays open only for S5's carry-overs. Its block came off in this round, and none of the carry-overs touches this key.
The follow-up owner is the domain:spec seat 1, on the maintainer's word (「22340 已决裁，你也跟进」). It re-derives the blocker and claims. The dispatch shape is pre-set in 6074143399.

Claim: PM loop round 8 (#22340 S2, opened by its re-measure. #15206 S3–S5 have landed, so stage 0's census of 54c3ce10c is stale; this round measures, writes no code and opens no PR. The build round is claimed on its reading) · 2026-10-11T12:37Z
Session: session_01KNKBCRDJCu5tGy3TEbvtrF
Account: zhuangjianguo (the seat's linked user as GET /user answers it; the card's assignee from this act)
Branch: claude/issue-22340-s2-remeasure (this round commits nothing; the build round names its own branch on this card)
Worktree: objectstack-issue-22340
Domain: domain:spec
Seat: domain:spec#3 (seat post #18883)
File surface (at origin/main efcbac73cc or later): this round writes no repository file and opens no PR. The report is the deliverable, and it contains:

The census again. Every reader and writer of allowOrgOverride on today's main (167 files and 670 hits at this stamp, against stage 0's 176 and 765), classed as stage 0 classed them. The new reading is whether any hit still decides an organization-scoped path after feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 S3–S5. Ruling 6073921182's order rests on "none".
The rename's mechanism, as ruled (Q1 A):
- a retiredKey() tombstone on MetadataTypeRegistryEntryBaseSchema;
- the retired-keys entry 18.kernel__MetadataTypeRegistryEntry__allowOrgOverride;
- a D3 semantic entry;
- ⛔ no D2 conversion.
Re-read the two precedents and today's registry-generation model (registry.ts.template since build(spec): the migration registry is generated at build and leaves git #22706).
The wire field, as ruled (Q2 A): GET /meta/types entries[].allowOrgOverride and the overrideSource description. Count objectui main's readers again: 12 non-test source files at the ruling. Note that the objectui companion must merge just before S2, with the .objectui-sha bump; spec: catalog references in authoring surfaces become names (approver position binding, decision-output positions, the position form's permissionSets widget), ADR-0131 D4, from #15204 #22682's pin round is in flight on that file now.
cloud's two test helpers (service-ai-studio write-door.ts:58 and metadata-tools.test.ts:305 at cloud 9c4299c264). cloud is outside this session's repositories: report NOT MEASURED, and name the hand-off the cross-repo protocol prescribes.
For the S2 contract review (ruling's note): name candidates with their collisions (allowEnvironmentOverlay, allowEnvironmentOverride, allowPackagedOverlay), and whether supportsOverlay and the renamed key each keep an independent reader at environment scope.
A build plan: each PR's file surface across the three repositories, the landing order, serial constraints against open PRs and in-flight claims, and the review each owes.
Container & model: XL staged, mode:subagent, model: default tier for this read-only round (dispatch-gates --tier: no path-derived mandate for a measurement). The build is Clause-②: yes (narrowing) (seat review 6069745527), and it owes a contract review at CONTRACT_REVIEW_TIER.
Clause-②: yes (narrowing; the build round's). This round changes nothing.
Responsibility: n/a — not a defect card (ADR-0131 C5's spec half, ruled under decision: ADR-0131 C5 — allowOrgOverride also decides environment overlays of packaged items. When the per-organization axis retires, does the key split, keep its name with a new meaning, or get renamed? #22007 letter C and 6073921182 Q1 A / Q2 A)
Thread-read: 6107791766
Serial constraints cleared:
This round writes no file.
Seat 1 held this card's follow-up and is vacant (post [PM seat] domain:spec — 🟢 os-tesla · session_013odhA26dvzy7pQmevdTTvy #6017, since 2026-10-11T09:12Z). The maintainer's word to that seat, 「22340 已决裁，你也跟进」, is carried by the lane. Triage's unlock 6107791766 named seat 1 after it had stood down. The hand-over is recorded here, and the maintainer may redirect it.
For the build round: .objectui-sha is single-claim. spec: catalog references in authoring surfaces become names (approver position binding, decision-output positions, the position form's permissionSets widget), ADR-0131 D4, from #15204 #22682's round (claim 6109075588) moves it now, so S2's own bump goes after that one lands.

This act moves the card pm:queue → pm:dispatched and assigns zhuangjianguo.

Generated by Claude Code

os-dev-report

{
  "issue": 22340,
  "status": "done",
  "branch": "claude/issue-22340-s2-remeasure",
  "pr": null,
  "session": "session_01KNKBCRDJCu5tGy3TEbvtrF (subagent of the PM session; the same id the claim's Session line carries). Identity: all 11 card comments re-read through REST; the newest Claim: is 6109099576 and it names branch claude/issue-22340-s2-remeasure.",
  "premise_still_valid": true,
  "summary": "Re-measured on origin/main efcbac73cc (worktree ../objectstack-issue-22340, read-only: no install, build, test, commit or push), and re-read at d8c7d38648 after main moved during the run. The census reproduces the PM's numbers: 670 hits in 167 files, against stage 0's 765 / 176 (-95 hits, -9 files). No code path decides an organization-scoped write, read or threading any more; the ruling's order rests on that 'none', and it holds. Three code readers of the flag remain: protocol.ts:15693, sys-metadata-repository.ts:352, and the wire writer getMetaTypes at protocol.ts:7762/:7763/:7832. None of them branches on an organization. What survives of the per-organization meaning is prose: 9 source hits in 6 files, plus labels and premises in 20 test files. One reading is new: since #15206 S5 the flag also decides the served read. declinesStoredRow → isUnservedSealedOverlay → isSealedManagedItem → registryAllowsOverlay withholds an environment overlay of a packaged item when the type lacks the flag, with permission excepted. So the key is now the single decider of 'may an environment overlay this packaged item', on write, on read and in Studio, which is ruling C's meaning. Every ruled premise re-reads true. No author-reachable parse site exists for a registry entry. The retired-keys spelling matches authorable-surface/kernel.json:347. objectui main 1d1cfe0c11 still reads the wire field in 12 non-test source files (50 hits). It types the field itself (RichMetadataTypeEntry, useMetadata.ts:77), so no gate would see a missed rename. The registry-generation model changed since stage 0: registry.ts, spec-changes.json and the upgrade guide are no longer committed, so S2 regenerates none of them. The plan is 4 PRs: objectstack S2 with the pin bump (estimated 1.7k-2.3k changed lines, under 3000), the objectui companion (merges just before S2), cloud (same window, NOT MEASURED), then S3 (Tier H). Name recommendation for the contract review: allowEnvironmentOverlay. supportsOverlay and the renamed key each keep an independent reader, so neither retires under ADR-0049. supportsOverlay's describe overstates what it gates.",
  "census": {
    "base": "origin/main efcbac73cc (efcbac73cc58510278b970949ac3b65cb9712815). main moved to d8c7d38648 during the run (3 commits). On d8c7d38648 the census still reads 670 / 167, and git diff efcbac73cc d8c7d38648 names the key on 0 lines; 2 changed files are S2 surfaces (content/docs/permissions/authorization.mdx, plugin-security security-plugin.ts), on lines other than the key's.",
    "command_and_controls": "git grep -n allowOrgOverride HEAD = 670 lines in 167 files. Glob pathspecs with non-vacuous controls: ':(glob)packages/**/src/**' key 100 files vs DEFAULT_METADATA_TYPE_REGISTRY 89 and isOverlayAllowed 10; the plain 'packages/**/src' answers 0 for the key AND 0 for the control (vacuous). ':(glob)**/*.test.ts' key 74 vs 'describe(' 5033. ':(glob)content/docs/**' key 14 vs ADR-0005 12. ':(glob)packages/**/src/**' minus tests: key 29 vs 28. ':(glob)**/CHANGELOG.md' 10 vs 'Patch Changes' 78. ':(glob)docs/adr/**' 13 vs 'Status' 139. ':(glob).claude/**' 0 vs 'pm-dispatch' 8. ':(glob)skills/**' 1 vs 'objectstack' 58.",
    "method": "I read every non-test source hit line in context, and every test hit line. Each hit is classed by what it governs or describes. protocol.ts is split by line (4 a-prime / 41 b), and so is save-meta-response-conformance.test.ts (:239 b, :309 not-a). The class totals are computed by a script over the grep output, which sums to 670.",
    "class_table": [
      "class | today hits / files | stage 0 hits / files | delta",
      "(a) code deciding an organization-scoped write, read or threading | 0 / 0 | 46 / 14 (code + its prose) | -46 / -14",
      "(a-prime) prose that still ties organization scope to the flag; no code | 9 / 6 | inside stage 0's (a), except kernel/index.ts:31 (stage 0 b) | see list",
      "(b) environment-overlay permission (code, refusal sentences, comments) | 73 / 19 | 75 / 19 | -2 / 0",
      "(c) declaration (metadata-plugin.zod.ts) | 47 / 1 | 47 / 1 | 0",
      "(c) docs (content/docs, docs/qa, docs/audits, spec liveness notes) | 64 / 23 | 64 / 23 | 0",
      "(c) generated | 9 / 6 | 16 / 8 | -7 / -2 (registry.ts -4: git-ignored since #22706; docs/protocol-upgrade-guide.md -2: a pointer stub since #22556; references/api/protocol.mdx 3 → 2)",
      "(c) ADR-0087 ledger prose | 5 / 5 | 4 / 4 | +1 / +1 (18.metadata-write-organization-scope-refused.ts)",
      "(c) tooling | 28 / 3 | 28 / 3 | 0",
      "(c) history: CHANGELOG + pending changesets | 154 / 16 | 150 / 12 | +4 / +4 (15206-meta-doors-environment-only, 15206-protocol-environment-only, 15206-reads-environment-only, 22411-hatch-legacy-spelling)",
      "(c) governed | 48 / 15 | 48 / 15 | 0",
      "(d) tests pinning (b) | 189 / 55 | 156 / 46 (+ mixed 11 / 2) | see d",
      "(d) tests pinning not-(a): the retirement of the per-organization path | 44 / 20 | 120 / 32 pinned (a) itself | see d",
      "total | 670 / 167 (protocol.ts and one test file counted in two classes) | 765 / 176 | -95 / -9"
    ],
    "raw_file_delta": "23 files gone (59 hits), 14 files new (22 hits), 25 files changed (-58 hits). Gone source files: metadata-core meta-write-org-scope.ts (6; ORG_OVERRIDABLE_TYPES, the stage-0 flag reader), meta-write-capability.ts (1), rest meta-item-read-gate.ts (1), rest-route-ledger.ts (1), runtime route-ledger.ts (1), plugin-email bootstrap-declared-email-templates.ts (1), spec security/capabilities.ts (2, manage_org_presentation), plugin-security permission-set-overlay-discard.ts (1), the git-ignored registry.ts (4), and docs/protocol-upgrade-guide.md (2). 13 test files are gone: get-meta-item-cached-etag-scope, the three org read-gate suites, both org-scoped cold-boot audits, metadata-store-outage, publish-drafts-package-scope, metadata-core meta-write-capability and meta-write-org-scope, rest meta-item-save-capability-gate and meta-write-door-capability-enumeration, and runtime meta-save-capability-gate. New: 4 pending changesets, packaged-base-regime.ts (1), plugin-security position-write-through.ts (1), the semantic entry 18.metadata-write-organization-scope-refused.ts (1), and 7 test files (S1's environment-overlay-five-types 3, protocol.sealed-remedy-kind 1, managed-content-sealed dogfood 1, execctx-consumer-census 1, rest-meta-managed-seal-hatch 3, runtime meta-read-org-scope-parity 3, meta-managed-content-seal 3).",
    "a_code_survivors": "NONE. The symbols of the stage-0 (a) path (ORG_OVERRIDABLE_TYPES, declaresOrgOverride, organizationIdForMetaWrite, organizationIdForMetaRead, reportUnhydratableOrgScopedRows, orgScopedWriteRefusal, manage_org_presentation) have 0 hits in non-test, non-CHANGELOG source. Two retirement comments remain: metadata-core index.ts:100 and meta-write-capability.ts:15. organizationScopedWriteRefusal (protocol.ts :16029) refuses every organization-scoped write and reads no flag. The flag's three remaining code readers do not branch on an organization: (1) protocol.ts:15693 OVERLAY_ALLOWED_TYPES → registryAllowsOverlay :15827 → isOverlayAllowed :15843 (save :19905, history/migrate :21365/:21549/:21955, :25396, delete :25932/:26043), and isSealedManagedItem :16130-16133 → isUnservedSealedOverlay :16637 → declinesStoredRow :16615 (served reads :8896, :8908, :9877, :10575); (2) sys-metadata-repository.ts:352 → assertAllowed :1827/:1889; (3) the wire, protocol.ts:7762/:7763/:7832.",
    "a_prime_prose_survivors": "9 hits / 6 files, each a comment that still states organization scope as depending on the flag. Carrier: S2 rewrites them; a mechanical rename is not enough. protocol.ts:11050 and :11057 (object fail-closed tiering note), :16007 (retired five-type exemption, accurate as history), :18941 ('NOT org-gated … object is allowOrgOverride false'); rest-server.ts:7069 (history of the door threading); runtime domains/packages.ts:1542 and domains/mcp.ts:385; service-automation sys-flow-credential.object.ts:34 ('flow declares allowOrgOverride false, so its stored rows are env-wide'); spec kernel/index.ts:31 ('ADR-0005's org-scoped overlay (allowOrgOverride …)' named as a live mechanism).",
    "b_files": "protocol.ts 41 (code :7762/:7763/:7832/:15693; refusal sentences :15963/:15988/:21371; comments), sys-metadata-repository.ts 11 (code :352; sentences :1896/:2008), packaged-base-regime.ts:407 (sentence), package-writability.ts:47, metadata-core types.ts:160 and contract-suite.ts:46, objectql engine.ts:3446, platform-objects sys-job.object.ts:165, plugin-security object-posture-gate.ts:15, permission-set-projection.ts 2, position-write-through.ts:47, security-plugin.ts 2, runtime domains/meta.ts:946 (the wire), lint validate-ai-agent-authoring.ts:10, examples/app-showcase coverage.ts:161, spec api/protocol.zod.ts :211/:217/:1606, metadata-create-seeds.ts:141, metadata-type-schemas.ts:142, system/email-template.zod.ts:16.",
    "c_detail": {
      "declaration": "metadata-plugin.zod.ts 47: the key :268 (describe 'Allow per-org overlay writes via runtime metadata API', TSDoc :255-267), 28 registry rows :727-:1211, the customizationPolicies tombstone prescription :514-521, and about 15 rationale comments.",
      "docs": "content/docs 11 pages / 23 hits (concepts/metadata-lifecycle.mdx 8, including the table header :111 that check:overlay-whitelist-table reads), docs/qa/platform-checklist 8 files / 35 (studio-authoring.json 18, platform-core.json 5, including the two '#allowOrgOverride' anchors :1257 and :492), docs/audits 2026-06 assessment 2 (a dated record, which stays), spec liveness README.md 2, capability.json 1, job.json 1 (notes only).",
      "generated": "authorable-surface/kernel.json:347, authorable-defaults/kernel.json:70, authorable-surface.base.json:4262 (written only by gen:authorable-surface-base, never by S2), references/kernel/metadata-plugin.mdx 3, references/api/protocol.mdx 2, references/system/email-template.mdx 1.",
      "ledger": "17.api-runtime-create-withdrawn.ts:46 and 17.field-runtime-create-withdrawn.ts:48 have shipped (spec latest 17.7.0) and stay. Two 18.* entries are unreleased (pre mode, tag next): 18.metadata-customization-protocol-retired.ts:20 (states the org-scoped overlay as live: S2 edits it) and 18.metadata-write-organization-scope-refused.ts:21 ('the five types that declared allowOrgOverride', accurate history: S2 may leave it or add the new name). The retired-keys comment is 18.kernel__MetadataPluginConfig__customizationPolicies.ts:14.",
      "tooling": "scripts/check-overlay-whitelist-table.mjs 26 (COL_FLAG :255, legs and self-test fixtures in the same file), and two adr-anchors invariants (metadata-plugin.zod.ts.json, permission-set-projection.ts.json). Prose only; no symbol is resolved.",
      "history": "10 CHANGELOGs / 147 (metadata-protocol 58, spec 33, runtime 15, rest 13, objectql 10, lint 5, plugin-security 5, metadata-core 4, platform-objects 3, metadata 1) and 6 pending changesets / 7. These are never edited by S2. The pending ones ship in 18.0 beside the rename, as history.",
      "governed": "15 files / 48: AGENTS.md:191 (Prime Directive 7), skills/objectstack-ai/SKILL.md:347, ADR-0005 12 (normative :47, :68), ADR-0010 9, and 11 more ADRs that record decisions under the name of their time (ADR-0029:386 carries an ungated '#allowOrgOverride' anchor)."
    },
    "d_tests": {
      "pins_b": "55 files / 189 hits: the registry identity and rollback pins (adr0005-org-override-rollback 8, flow-org-override-closed 8 (its organization cases name no key), code-only-types 5, delete-receipt-wording 5, save-receipt-wording 3, legacy-overlay-delete 9, delete-rewrap-envelope 3, driver-text-disclosure 3, read-lock-flags-write-door 2, recovery-doors 1, runtime-gate-stored-universe 1, marked-refusal 1, unrecognised-meta-type 1, stored-migration 1, read-verb-canonical-fold 3, diff-dead-history 1, destructive-gate 1, capability-write-door 1, sealed-remedy-kind 1, package-door-before-gates 3, packaged-base-refusal 6, repository contract 3 and package-writability 11), objectql (S1's environment-overlay-five-types 3, engine-security-catalog-package-door 9, overlay-precedence 16 (moved from a to b: its org-scoped cases were rewritten env-wide), protocol-meta 7 (moved likewise), protocol-meta-types-rich 11 (the wire), commit-history 5, object-overlay-layer 2, registry-shadow 2, sys-metadata-repository 4, delete-object-registry-heal 1, meta-effective-schema 1, writepath-object-ownership 1, publish-canonical-fold 1, meta-object-search-companion 1, save-meta-response-conformance :239), runtime (meta-field-overlay-lock 4, meta-managed-content-seal 3, meta-overlay-read-your-writes 2), rest (managed-seal-hatch 3, packaged-flow-refusal 1), plugin-security (restore-leg 1, permission-set-projection 3), platform-objects sys-job.global-unique 5, dogfood (managed-content-sealed 1, showcase-permission-projection 3, two-doors-permission 3), spec (picklist 1, capability-metadata-kind 3, metadata-create-seeds 2, metadata-customization-retirement 1, api-registration 4, field-registration 3).",
      "pins_not_a": "20 files / 44 hits: they pin that NO organization reaches a metadata write or read, for any flag value. The flag appears only as a specimen label, a five-set identity, a premise control or a test-double detector. Runtime meta-write-org-scope 10, meta-read-org-scope-parity 3 (its protocol double models the pre-D6 gate from the flag, :80/:85), packages-seed-apply-org-scope 2, package-duplicate-adopt 1; rest write-org-scope 3, read-org-scope 2, history-diff-org-scope 3, url-spelling 2, cached-etag-door-scope 2, meta-publish-package-scope 1, execctx-consumer-census 1 (§9 premise control :1073); metadata-protocol org-scoped-write-refused 4 (identity :276; stale ':245 HAS a per-org channel'), lock-org-axis-agree 1, publish-item-draft-org-scope 2 (stale ':12 the REST seam threads … organizationIdForMetaWrite'), publish-drafts-org-scope 1, publish-drafts-advisories 1; objectql protocol-org-overlay-registry-gate 2 (its own note: 're-read, not repaired' if the flag closes), publish-meta-response-conformance 1, publish-package-drafts-response-conformance 1, save-meta-response-conformance :309. Carrier: S2 renames or rewrites these labels; a mechanical rename would leave 'ORG_OVERRIDABLE = allowEnvironmentOverlay'.",
      "message_text_pins": "Live runtime sentences naming the key are pinned at protocol.packaged-base-refusal.test.ts:230/:236, sys-metadata-repository.package-writability.test.ts:1321 and rest-meta-packaged-flow-refusal.test.ts:117 (producers: packaged-base-regime.ts:407, sys-metadata-repository.ts:2008), and by the regex /allowOrgOverride/ at metadata-customization-retirement.test.ts:58 (producer metadata-plugin.zod.ts:520). Two plugin-security doubles throw a sentence no producer emits any more (restore-leg :211, projection :156)."
    },
    "five_types": "Re-parsed from source text: 28 registry entries; the flag is true on exactly view, dashboard, report, translation and email_template. supportsOverlay is true with the flag false on 8 types (page, app, dataset, book, permission, position, tool, skill); the reverse holds on 0. S1's environment-overlay-five-types.test.ts (7fbfef4c7, an ancestor of the base, exit 0) pins all five on both topologies under the current name."
  },
  "tombstone_kit": {
    "precedents": "retired-keys/18.kernel__HotReloadConfig__debounceDelay.ts: the key retired with retiredKey() because HotReloadConfigSchema is not strict; 'No D2 conversion: not a stack collection member, not a stored row'; its D3 entry is kernel-health-check-and-hot-reload-durations-unit-in-key; the prescription constant (plugin-lifecycle-advanced.zod.ts:341-348) renames with 'Rename the key to … the value … unchanged' and carries no os migrate meta sentence. retired-keys/18.kernel__MetadataPluginConfig__additionalTypes.ts: 'Registered here but NOT in src/conversions/registry.ts … a MetadataConversion here would be a transform with no seam that ever runs. The prescription reaches authors through the tombstone (tsc + the parse) and the D3 semantic entry metadata-plugin-additional-types-retired'. Both are the ruled Q1 A shape.",
    "registration_today": "One FILE per entry, sorted by id and concatenated by gen:migration-registry into packages/spec/src/migrations/registry.ts. That file is generated whole on install and as the first build step, and is git-ignored (.gitignore:68, #22706 for #22554), so the PR commits no registry.ts. (1) Retired key: entries/retired-keys/18.kernel__MetadataTypeRegistryEntry__allowOrgOverride.ts with export const entry = 'kernel/MetadataTypeRegistryEntry:allowOrgOverride', the exact string authorable-surface/kernel.json:347 carries (gate (b) of build-schemas reads it as exact set membership). The comment above it is carried into the table. (2) D3: entries/semantic/18.ID.ts exporting a SemanticMigration { id, surface, replacement, reason, acceptanceCriteria }; one family covers the registry key AND the wire field. A response-face key gets a D3 entry only (skill §3). (3) STEP18_RATIONALE: hand-edited in registry.ts.template (:1207), as one { id, order, text } fragment inserted where the D3 id sorts. Today that is 114 fragments with max order 93, so order 94; an id starting 'metadata-type-' sorts between metadata-plugin-additional-types-retired and object-grid-default-filters-retired. step18-rationale-merge.test.ts holds the sort. Step 18's conversionIds derive from CONVERSIONS_BY_MAJOR, so with no D2 there is nothing to add. (4) Not committed and not regenerated by the PR: spec-changes.json and protocol-upgrade-guide.md (gitignored; check:spec-changes and check:upgrade-guide render them in memory); docs/protocol-upgrade-guide.md is a hand-written pointer stub.",
    "surfaces_to_files": [
      "Schema → metadata-plugin.zod.ts: NEW_KEY with the rewritten TSDoc/describe; allowOrgOverride: retiredKey(PRESCRIPTION) on MetadataTypeRegistryEntryBaseSchema (:208, a plain z.object, so a bare delete would silently strip); the 28 rows; about 15 comments; the customizationPolicies prescription :514-521 (it names the key as a live mechanism).",
      "Orphan value schema → none (boolean).",
      "Conversion + chain step → none (Q1 A); the retired-keys file + the D3 file + the STEP18_RATIONALE fragment; no conversionIds; retiredFromLoadPath / retiredAfter do not apply.",
      "Retired-default residue → the key carries .default(false), so acceptRetiredDefaultResidue was considered. It is not needed: no built artifact or stored row carries a registry entry (0 non-test parse sites of MetadataTypeRegistryEntrySchema; contributes.kinds is a strictObject; additionalTypes is a tombstone). The PR should state this.",
      "Liveness ledger → no row exists for kernel/MetadataTypeRegistryEntry (no kernel ledger file), so there is no row to keep; the 3 prose notes (README.md, capability.json, job.json) follow the name.",
      "Generated baselines → gen:schema moves authorable-surface/kernel.json (old row → [RETIRED], new NEW_KEY row) and authorable-defaults/kernel.json:70; gen:docs moves references/kernel/metadata-plugin.mdx, references/api/protocol.mdx and references/system/email-template.mdx. api-surface, export-origins, declaration-map and json-schema.manifest carry no property names (stage 0, unchanged). authorable-surface.base.json is not written.",
      "Forms / i18n bundle → none (0 *.form.ts hits).",
      "CLI advisory lint → none (ledger-driven, no row); validate-ai-agent-authoring.ts:10 is a comment.",
      "Pin tests → negative: parse of the old key refused with the prescription naming NEW_KEY (code invalid_type, path ['allowOrgOverride'], in the customizationPolicies pin's shape); positive: the five rows carry NEW_KEY true and no row carries the old key; wire: entries carry NEW_KEY and not.toHaveProperty('allowOrgOverride'); flip S1's five-type file and the identity pins (org-scoped-write-refused :276, rollback :251, overlay-precedence :372). The skill's tree-scoped absence pin needs its radius declared (CROSS_PACKAGE_TEST_INPUTS + turbo.json), and it must exclude the tombstone, entries/, CHANGELOG and .changeset.",
      "Examples → coverage.ts:161 is a comment only (the registry cannot be authored).",
      "Published skills → skills/objectstack-ai/SKILL.md:347 goes to S3 (ruled).",
      "Docs → 11 content/docs pages (never content/docs/releases), with metadata-lifecycle.mdx's table header moving in the same PR as check-overlay-whitelist-table.mjs COL_FLAG and its self-test; 8 platform-checklist files, re-pointing both '#allowOrgOverride' anchors explicitly (the tombstone keeps the word at line start, so a stale anchor stays green).",
      "Changeset → @objectstack/spec minor and @objectstack/metadata-protocol minor (wire field + refusal sentences), BREAKING banner, FROM allowOrgOverride TO NEW_KEY on DEFAULT_METADATA_TYPE_REGISTRY entries and GET /meta/types entries, Clause-②: yes (narrowing), the ADR-0087 registered marker naming the retired-keys entry and the D3 id. Comment-only packages publish nothing.",
      "check:generated source audits (run as a whole set) + the qa/dogfood radius → 3 dogfood suites name the key (managed-content-sealed, showcase-permission-projection, two-doors-permission)."
    ],
    "read_side_trap": "The tombstone fails tsc for every WRITER of the old key (the 28 rows) and for strict comparisons against a boolean. A truthiness READER (if (!entry.allowOrgOverride), a filter on e.allowOrgOverride, toMatchObject) still compiles, because the tombstone output is an optional property, and silently reads undefined. A missed protocol or repository reader turns all five types non-overlayable: that is exactly what S1's ablation measured (403 NOT_OVERRIDABLE). S1's five-type pins, the identity pins and the wire pin are the net. Readers to rename by hand: protocol.ts:7762/:7763/:15693 and sys-metadata-repository.ts:352."
  },
  "wire_field": {
    "schema": "spec api/protocol.zod.ts GetMetaTypesResponseSchema :203 (a plain z.object): entries[].supportsOverlay :210 ('Loader can merge per-org overlays on top of artifact'), entries[].allowOrgOverride :211 ('Per-org overlay writes accepted at runtime (may be env-elevated)'), entries[].overrideSource :217 ('Whether allowOrgOverride is set in the static registry or via OS_METADATA_WRITABLE env var'), comment :1606. authorable-surface/api.json tracks only GetMetaTypesResponse:entries and :types, so the field rename is invisible to every spec gate except the regenerated references/api/protocol.mdx. GetMetaTypesResponseSchema has 0 runtime parse sites. @objectstack/client meta.getTypes (client/src/index.ts:1780, :7655) types the response from spec, so a typed client consumer gets a compile error.",
    "writers": "ONE server writer: protocol.ts getMetaTypes :7709. Registry arm: ...base at :7759 spreads the registry entry (after the rename it carries NEW_KEY unelevated), then :7762 writes allowOrgOverride: base.allowOrgOverride || isEnvOverridden and :7763 overrideSource. Synthesized arm (types with no registry entry): :7832 and :7838. ⚠ Renaming the spec alone leaves the wire carrying BOTH names: NEW_KEY from the spread, unelevated, and the old name from :7762, elevated. :7762/:7763 must move, with the hatch elevation applied to NEW_KEY, and the wire pin asserts the old name absent. Transports pass the payload through: REST GET /api/v1/meta (rest-server.ts:5674-5681; translateMetaTypesResponse :4210 spreads each entry), and dispatcher runtime/domains/meta.ts:952 and :1983."
  },
  "objectui": {
    "head": "objectui origin/main 1d1cfe0c11 (git fetch origin main in /home/user/objectui; no checkout, no edit). The pin 0df67f237c5a and the ruling's 2063f7a96c are both ancestors of it (merge-base --is-ancestor exit 0, which proves ancestry even on the shallow clone).",
    "recount": "12 non-test source files / 50 hits: the same file set as the ruling's 2063f7a96c (52 hits; ResourceListPage.tsx 3 → 1) and as the pin. metadata-admin: ResourceEditPage.tsx 12 (write gates :1442-1443 and :1882-1885; the read-only banner token :2550), PermissionMatrixEditor.tsx 17 (gates :409/:410/:428), DirectoryPage.tsx 3 (:171/:175 filters, :458 badge), ResourceListPage.tsx 1 (:428), StudioHomePage.tsx 1 (:223), EmbeddedItemEditor.tsx 1 (:104), PageShell.tsx 1 (:100), registry.ts 3 (:462/:464/:472), useMetadata.ts 2 (:77 type), i18n.ts 5 (2 strings × en/zh + 1 comment), previews/PicklistPreview.tsx 1; studio-design/BuilderLanding.tsx 3 (prose). Also 58 test files / 112 hits, content/docs/guide/console.md 1, pending .changeset/11808-readonly-package-card.md 1, and 3 CHANGELOGs / 10. Total 75 files / 174 hits.",
    "own_type": "YES. objectui declares the field itself: RichMetadataTypeEntry { allowOrgOverride?: boolean; overrideSource?; supportsOverlay? } (useMetadata.ts:72-89), plus resolveResourceConfig's serverEntry and return types (registry.ts:456-472). References to GetMetaTypesResponse / MetadataTypeRegistryEntry in objectui packages: 0, against a control of 347 '@objectstack/spec' import lines. A missed rename therefore compiles, passes the Console Pin Gate, and turns every packaged item of the five types read-only in Studio, silently. supportsOverlay is declared at useMetadata.ts:89 and read nowhere in objectui source."
  },
  "cloud": {
    "helpers": "NOT MEASURED. Reason: objectstack-ai/cloud is not among this session's repositories. The ruling's own reading at cloud main 9c4299c264 is 0 production readers and 2 test helpers: packages/service-ai-studio/src/__tests__/write-door.ts:58 and metadata-tools.test.ts:305. Both derive the locked-type set from the field. How cloud consumes objectstack (npm range, pin or override) is also NOT MEASURED, and that decides when 'the same window' opens for cloud.",
    "prescribed_handoff": "From .claude/skills/pm-dispatch/references/cross-repo-coordination.md: cloud is a single-lane repo (its repo:* seat triages itself; ⛔ no domain:* label). Rule 1: the card lives where the fix lands, in cloud. 'Transfers land in the other side's queue': the target repo gets a card carrying pm:queue, a provenance line and a one-line executable criterion, with the dependency as Blocked-by: objectstack-ai/objectstack#22340 (or the S2 PR). Rule 3: the executing seat that ACCEPTS the S2 PR files that follow-up in the consuming repo at once ('联动杂事立单,不靠记忆'). 'An unreachable target repo is a reading gap, not a landing point': a seat that can reach cloud files the card there, and until then the request is recorded on the seat post or a coordination card (this card). Linked cards are never in the same batch. Proposed criterion line: rename allowOrgOverride → NEW_KEY at write-door.ts:58 and metadata-tools.test.ts:305, landing with cloud's adoption of the objectstack release that carries S2, so the derived locked-type set stays every type but the five."
  },
  "contract_review_input": {
    "candidates": [
      "allowEnvironmentOverlay: exact collisions 0 (objectstack tree, spec src, objectui main; control allowRuntimeCreate -w 513 / 97). It reads like these: ADR-0131 D6's own wording ('O — overlay … an environment row of the same name replaces the managed item whole — ADR-0005's environment layer'); the wire's scope word overlayScope z.enum(['env']) (protocol.zod.ts:511); the live refusal sentences, which already say 'environment overlay' (packaged-base-regime.ts:407 'its type takes no environment overlay (allowOrgOverride=false)'; sys-metadata-repository.ts:2008 'has no environment overlay channel'), so after the rename they name concept and key with the same words; 'environment overlay' appears 73 times in prose. Pairs with supportsOverlay (capability vs permission) and with the allow* sibling allowRuntimeCreate. Confusable: 'env' meaning an environment VARIABLE in overrideSource 'env' / OS_METADATA_WRITABLE; spelling Environment in full keeps them apart.",
      "allowEnvironmentOverride: exact 0. It sits beside overrideSource 'registry'|'env' on the same wire entry, where 'env' means the OS_METADATA_WRITABLE variable, so 'environment override' reads as 'overridden by an environment variable', i.e. the hatch. It shares the stem of NOT_OVERRIDABLE (617) and the write intent override-artifact (141), and keeps the override/overlay split that ADR-0005, ADR-0126, ADR-0131 and supportsOverlay do not use. It is the smallest edit from the old name.",
      "allowPackagedOverlay: exact 0; 'packagedOverlay' 4 (a fixture builder in rest meta-object-owd-gate.test.ts, same sense). It names the object (the packaged item) but drops the scope; if a per-organization axis ever returned, one scope-less key would again govern two scopes, which is the shape ruling C closed. It also reads as 'an overlay that ships in a package' (overlay rows carry the package_id of what they customize; ADR-0070).",
      "Excluded: allowPackagedItemOverlay (the C reading with more letters); a regime enum such as customizationRegime 'overlay' (would also absorb packaged-base-regime.ts's table: a new published enum surface outside the ruled rename); overlayWritable (a retired key on MetadataManagerConfig.persistence, 19 spec hits, which would confuse two prescriptions); allowOverlay / overlayable (scope-less; 'overlayable' is already prose 10 times)."
    ],
    "four_axes_on_the_name": "实际业务需求: measured, and the same for every candidate. Writers are the 28 registry rows and test fixtures; no author can write a registry entry. Readers are the protocol write gates, the read seal (since #15206 S5), the repository put gate, the wire → objectui's 12 source files, and cloud's 2 test helpers (ruling's reading). So this axis does not separate the names; it fixes their meaning: environment overlay of a packaged item, on write, read and Studio. 项目长远合理性: allowEnvironmentOverlay uses ADR-0131 D6's, ADR-0005's and the wire's own vocabulary and states the scope, so a future second axis would get its own key; allowPackagedOverlay drops the scope (ruling C's closed shape); allowEnvironmentOverride keeps a vocabulary split. 防 AI 犯错: allowEnvironmentOverride has the strongest misreading (env-variable hatch, beside overrideSource 'env'); allowPackagedOverlay has the 'shipped overlay' misreading; allowEnvironmentOverlay leaves the env-variable reading as residue, reduced by the full word. 创业阶段不扩散: all are one rename with no new capability. Recommendation: allowEnvironmentOverlay.",
    "supportsOverlay_vs_renamed_key": "Each keeps an INDEPENDENT reader at environment scope, so ADR-0049 retires neither. The renamed key decides the save door, the managed-content seal on write AND on read (declinesStoredRow → isUnservedSealedOverlay → isSealedManagedItem, :16615/:16637/:16130), the repository put gate (:1827) and Studio (wire). supportsOverlay decides one thing: whether a stored overlay row of a sealed managed item may be REMOVED. Its readers are refusePackagedBaseRemoval :17018-17020 (mergesOverlayAtRead, called only there; :15812), deleteMetaItem's tier (:25932-25954) and the repository's assertDeleteAllowed :2086. It is also projected to the wire (via the spread) and to MetadataTypeInfoResponse (metadata-manager.ts:2620; api/metadata.zod.ts:302). The truth tables differ on 8 types (supportsOverlay true, key false); the reverse is empty. Gap: supportsOverlay's TSDoc and describes promise a READ capability ('loader can merge overlays', wire: 'per-org overlays') that no read consults. S1 measured this (6070542431), and on main the read keys on the seal, i.e. on the renamed key. Open PR #22833 rewrites the carve-out's rationale ('changes what is served for permission alone'). Reading: correct supportsOverlay's describe and TSDoc to what it gates in S2 (the wire line :210 sits beside :211, which S2 edits); no rename and no retirement."
  },
  "build_plan": {
    "prs": [
      "objectstack S2 (domain:spec; Clause-②: yes (narrowing)). Surface, about 140-160 files (ESTIMATE): spec decl + 5 other spec source + 2 unreleased 18.* entries + 2 new entry files + registry.ts.template; 5 generated (2 authorable baselines, 3 reference pages); 19 non-spec source files (67 b + 8 a-prime hits); 74 test files + a tombstone pin; 3 tooling; 19 docs files + 3 liveness notes; 1-2 changesets; the pin bump (.objectui-sha, sdui.manifest.json, scripts/sdui-manifest.record.json, plus whatever the regeneration moves: #22812 also moved packages/sdui-parser/objectui-lockstep.json, spec ui/*.zod.ts and pin-citation recounts in 6 semantic entries, with 2 changesets). Changed lines (ESTIMATE, additions + deletions, generated INCLUDED): rename and kit about 1,100-1,600 (tests about 600, b source about 150, declaration about 135, docs about 140, ledger and new entries about 90, tooling about 60, changeset about 50, a-prime rewrites about 40, generated about 20); pin bump about 590-680 (the last two measured: #22812 676 / 21 files, #22592 587 / 21). Total about 1,700-2,300, under the 3,000 human-merge threshold by an estimated 700+. NOT MEASURED until the branch exists: dispatch-gates.mjs with no paths on the built branch, and check-governed-merges.mjs --pr N at landing. The surface is not governed (S3 is split off).",
      "objectui companion (the ruling: filed in the objectui lane). Surface: the 12 source files (50 hits; the RichMetadataTypeEntry and registry.ts types, the gates, both i18n locales, BuilderLanding prose) + 58 test files (112) + content/docs/guide/console.md + a changeset. ESTIMATE about 300-450 changed lines. Merges just before S2; reads NEW_KEY only (a dual read would be the ruled-out C, a consumer-side fallback).",
      "cloud (single-lane repo:* seat; NOT MEASURED): the 2 test helpers, an ESTIMATED 4-10 lines, in the same window as the release that carries S2.",
      "objectstack S3 (governed text, Tier H): AGENTS.md:191, skills/objectstack-ai/SKILL.md:347, ADR-0005 :47/:68 + a top note in the shape of its :3 note (optionally an ADR-0010 status note). ESTIMATE 20-30 lines. dispatch-gates --tier today: MANDATORY claude-fable-5-1 (skills/**, no one-line exemption); the skills line-budget readings are owed (whole-file and whole-catalog before/after)."
    ],
    "landing_order": "1. PR #22794 (#22682, claim 6109075588) takes .objectui-sha 0df67f237c5a → 4997995022 with its manifest regeneration. Its file list today has 3 files and no pin yet; S2's bump waits behind it (single-claim path). 2. PR #22833 (#15206 S5 carry-overs, draft) lands, and S2 rebases onto it. 3. S2 is built to review-ready without the pin step, and the contract review fixes NEW_KEY (the objectui PR needs the name). 4. The objectui companion is reviewed and merges. 5. S2 bumps .objectui-sha to that merge commit (or later objectui main) with the regeneration, and lands; the Console Pin Gate builds objectui at the new pin. 6. cloud's PR lands in the same window, through its own seat. 7. S3 follows S2. The one-landing rule (ruling Q2 A; AGENTS.md Post-Task 4 authorizes the sibling fix and the bump 'as part of the same landing') keeps the bump inside S2. A separate bump PR would leave main's console reading the old name against a renamed server between the two merges.",
    "serial_constraints": "Open PRs: 9, of which 8 file lists were read (#21988 is the Version Packages PR): #22833 shares protocol.ts (doc comments around isSealedManagedItem / refusePackagedBaseRemoval, the neighbourhoods of S2's :16331/:16357/:16996 hits) and metadata-lifecycle.mdx (:144); it also edits .changeset/15206-reads-environment-only.md, which S2 never edits. #22819 shares objectql engine.ts; its hunks (:400 to :19513 range, 6 hunks) are clear of S2's :3446 comment. #22794: sequencing on .objectui-sha only. #22838, #22836, #22834, #22832, #22830: no file in common. #21988 Version Packages: CHANGELOGs only, never edited by S2. In-flight claims beyond these were not scanned (the dev does not pull the board). The card body still names a D2 conversion, 'Clause-②: yes (widening)' and 'either order or in parallel'. Ruling 6073921182 and seat review 6069745527 supersede all three, so the build claim should cite them.",
    "reviews_owed": "S2: a contract-tier review at CONTRACT_REVIEW_TIER: a '## Contract review' record with the Served-tier line and PASS on the CURRENT head, which fixes NEW_KEY and answers the supportsOverlay question, plus the seat's ACCEPT, then queue on green (Tier S path not needed: no governed surface). The pin bump changes the head after the review, and the 'pure regeneration' exception does not cover the hand-set .objectui-sha, so record the review on the post-bump head or re-review the delta. The record should name the objectui head it pairs with. objectui companion: objectui lane review on objectui's own gates. cloud: its repo:* seat. S3: Tier H (maintainer approval), fable built."
  },
  "tests": "No build, no install, no test ran; nothing was written to the repository (git status --porcelain empty throughout; branch never pushed). Read-only probes: (1) the git grep census with glob pathspecs and controls at efcbac73cc, repeated at d8c7d38648 (670 / 167 both; the diff names the key on 0 lines); every non-test source hit line read in context, every test hit line read; class totals by a script over the grep output (sum 670). (2) DEFAULT_METADATA_TYPE_REGISTRY parsed from source text (python, read-only): 28 entries, five true, 8 supportsOverlay-only, 0 reverse. (3) objectui: git fetch origin main, then git grep at 2063f7a96c, the pin 0df67f237c5a and main 1d1cfe0c11; ancestry exit 0 for both. (4) node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --tier and --commands over the 142-path S2 list (exit 0: no path mandate, clause-② suspect on 14 spec paths, 154 derived commands); --tier on the S3 paths: MANDATORY claude-fable-5-1. These are derivations, not gate runs. (5) npm view @objectstack/spec dist-tags: latest 17.7.0, so the 18.* entries are unreleased. (6) REST reads: card + 11 comments; #22682 claim 6109075588; the open-PR list (9) and 8 file lists; the #22833 patch for its 3 shared files; #22819's engine.ts hunk headers; PRs 22812 / 22592 / 22363 sizes. Ancestry: c8b062f011 (S5) and 7fbfef4c7 (S1) are ancestors of the base, exit 0 each.",
  "mcp_calls": "0 — no MCP tool called",
  "api_writes": "1 — this os-dev-report comment, through scripts/pm/post-stamped.mjs and the fleet-write relay (the target write is POST /repos/objectstack-ai/objectstack/issues/22340/comments). The card's assignee and labels were not written; there was no push and no PR.",
  "open_questions": [
    {
      "question": "For the S2 contract review (not the maintainer): which name does the renamed key take?",
      "options": [
        "A allowEnvironmentOverlay: scope + mechanism, in ADR-0131 D6's, ADR-0005's and the wire's own words; residual 'env-variable' reading.",
        "B allowEnvironmentOverride: smallest edit; reads as 'overridden by an environment variable' beside overrideSource 'env'.",
        "C allowPackagedOverlay: names the object, drops the scope (ruling C's closed shape); also reads as 'an overlay shipped in a package'."
      ],
      "recommendation": "A, on the four axes in contract_review_input: business pull is identical for all three (measured), so long-term vocabulary and the AI-misreading axis decide; A matches the refusal sentences that already say 'environment overlay'."
    },
    {
      "question": "For the S2 contract review: supportsOverlay and the renamed key: does either retire under ADR-0049?",
      "options": [
        "A Keep both (independent readers, truth tables differ on 8 types); correct supportsOverlay's describe and TSDoc to what it gates (the removal carve-out) in S2.",
        "B Retire supportsOverlay and re-key the delete carve-out on something else: moves a ruled delete asymmetry onto a new predicate, with no pull.",
        "C Rename supportsOverlay too: outside the ruled rename."
      ],
      "recommendation": "A: both are enforced, so ADR-0049 retires neither; the describe correction is a zero-code contract tightening that removes a 'loader merges' promise no read keeps."
    }
  ],
  "out_of_scope_findings": [
    "carrier: the objectui companion PR of this card's S2 · noted, not filed. Studio's read-only-type banner (objectui main 1d1cfe0c11 ResourceEditPage.tsx:2548; string engine.edit.readOnlyTypeBanner, i18n.ts:2076 en / :5378 zh) tells an admin to set OBJECTSTACK_METADATA_WRITABLE and to 'flip {override} in the registry'. DirectoryPage.tsx:468 and PageShell.tsx:111 label env-elevated types 'Writable via OBJECTSTACK_METADATA_WRITABLE env var', and useMetadata.ts:87 repeats it. objectstack main reads only OS_METADATA_WRITABLE (sys-metadata-repository.ts:415, the one reader since the #22411 change), and the registry is a TypeScript literal no deployment edits. reach: NOT MEASURED (no browser run in a read round), so this is not filable as class a. The companion edits these exact lines ({override} at :2550 renders allowOrgOverride).",
    "carrier: S2 of this card · noted, not filed. Published describes still say per-organization: the registry key's describe metadata-plugin.zod.ts:268 and TSDoc :255-267 ('end-user organizations may write per-org overlay rows'; 'only view and dashboard opt in'; lower-case not_overridable), the wire protocol.zod.ts:211 and :210 (supportsOverlay 'Loader can merge per-org overlays on top of artifact'), and system/email-template.zod.ts:16 ('tenants can override'). All are rendered into references/kernel/metadata-plugin.mdx and references/api/protocol.mdx.",
    "carrier: S2 of this card · noted, not filed. These name 'ADR-0005's org-scoped overlay (opt-in via allowOrgOverride)' as a live mechanism: the customizationPolicies tombstone prescription (metadata-plugin.zod.ts:514-521, runtime text), kernel/index.ts:30-31, the unreleased D3 18.metadata-customization-protocol-retired.ts:20 and its STEP18_RATIONALE fragment in registry.ts.template ('ADR-0005's org overlay'). The prescription is pinned by metadata-customization-retirement.test.ts:58.",
    "carrier: S2 of this card · noted, not filed. Two plugin-security test doubles throw a refusal sentence no producer emits any more ('the type has not opted into per-org overlay writes (allowOrgOverride=false)', packaged-permission-set-restore-leg.test.ts:211, permission-set-projection.test.ts:156; producer comment permission-set-projection.ts:1393).",
    "carrier: S2 (the anchors) and S3 (ADR-0029:386) · noted, not filed. docs/qa/platform-checklist/areas/platform-core.json:492 and studio-authoring.json:1257 anchor 'metadata-plugin.zod.ts#allowOrgOverride'. The tombstone keeps the word at line start, so both stay green while pointing at the retired key.",
    "carrier: PR #22833 (in flight) and S2 · noted, not filed. #22833 rewrites the #6960 carve-out rationale in protocol.ts ('changes what is served for permission alone'); S2's supportsOverlay describe correction should follow that wording."
  ],
  "deviations": [
    "Did not push the empty branch (os-dev rule 1). The dispatch forbids any push in this round and no edit happened, so there was nothing to mark or probe. The role file prevails on a conflict; this one is flagged, not chosen silently (stage 0 did the same).",
    "No pnpm install in the worktree: no edit, build or test.",
    "Ran node scripts/pm/dispatch-gates.mjs (--tier, --commands) as read-only derivations. The dispatch bars builds, installs and test runs, and this is none of them.",
    "git fetch origin main in /home/user/objectui moved that checkout's shared remote ref (FETCH_HEAD / origin/main) as the dispatch prescribes; no checkout or edit there. origin/main in objectstack also moved during the run, through another session's fetch (shared refs); the census stays anchored to efcbac73cc and was re-read at d8c7d38648.",
    "Classification is by line: protocol.ts splits a-prime / b, save-meta-response-conformance splits b / not-a, and two test files moved from stage 0's (a) to (b) because S4 rewrote their organization cases env-wide (overlay-precedence, protocol-meta).",
    "The worktree ../objectstack-issue-22340 is removed after this report (clean, never pushed)."
  ],
  "files_changed": []
}

Report written 2026-10-11T13:03Z; census base efcbac7, re-read at d8c7d38.

Generated by Claude Code

Seat review of #22340 S2's re-measure (`6109312314`): accepted. The order is set; the name is fixed by an at-tier review before the build

domain:spec seat 3 (#18883) · zhuangjianguo · session session_01KNKBCRDJCu5tGy3TEbvtrF · 2026-10-11T13:06Z · holder of claim 6109099576. Thread-read: 6109312314.

Round terms met: no repository file was written, nothing was pushed and no PR was opened. The worktree is removed.

Accepted readings (measured at efcbac73cc, re-read at d8c7d38648):

Census: 670 hits in 167 files, against stage 0's 765 / 176. No code path decides an organization-scoped write, read or threading any more, so the order in ruling 6073921182 (S2 after feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 S5) is met.
- 9 prose hits in 6 files still tie organization scope to the flag. S2 rewrites them; a mechanical rename is not enough.
- 44 test hits in 20 files label specimens that pin the retired path's absence. S2 renames or rewrites those labels.
New since stage 0: the flag also decides the served read. declinesStoredRow → isUnservedSealedOverlay → isSealedManagedItem withholds an environment overlay of a packaged item when the type lacks it, permission excepted. The key is now the single decider of "may an environment overlay this packaged item", on write, on read and in Studio. That is ruling C's meaning.
The kit, on today's model:
- the retired-keys file 18.kernel__MetadataTypeRegistryEntry__allowOrgOverride (the exact string authorable-surface/kernel.json:347 carries);
- a D3 entry file;
- a STEP18_RATIONALE fragment in registry.ts.template at order 94.
No registry.ts, spec-changes.json or upgrade guide is committed (since build(spec): the migration registry is generated at build and leaves git #22706), and no D2 conversion is registered.
The read-side trap is real: a truthiness reader of the old key still compiles against the tombstone and reads undefined, which closes all five types. The four code readers (protocol.ts:7762, :7763, :15693, sys-metadata-repository.ts:352) are renamed by hand. S1's five-type pins, the identity pins and the wire pin are the net.
The wire: there is one server writer, getMetaTypes. Renaming the spec alone would put BOTH names on the wire, so :7762 and :7763 move with the hatch elevation applied to the new key, and the wire pin asserts the old name absent.
objectui: main 1d1cfe0c11 reads the field in 12 non-test source files (50 hits), through its own RichMetadataTypeEntry type. No gate sees a missed rename there; Studio would turn the five types read-only.

Set by the seat (order and dependency, not a product question):

The name and the supportsOverlay question go to an at-tier review now, before the build (ruling: "the new name is fixed by the contract review"). The objectui companion needs the name, and building S2 on a guessed name would cost a second rename. The report recommends allowEnvironmentOverlay, and A on supportsOverlay: keep both keys, and correct supportsOverlay's describe to what it gates. The review decides; it posts its record on this card.
S2 is built after that, on the reviewed name and to review-ready, without the pin step, on a branch this card names. It lands behind PR feat(spec): the position form picks permissionSets from the permission-set registry (ref-multi:permission), with the console pin moved to 4997995022f8 #22794 (spec: catalog references in authoring surfaces become names (approver position binding, decision-output positions, the position form's permissionSets widget), ADR-0131 D4, from #15204 #22682, which moves .objectui-sha now), and after PR fix(metadata-protocol): S5 carry-overs — per-term boot report isolation, one naming of a code-datasource row, seal TSDoc wordings, two changeset rows #22833 (feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 S5's carry-overs, which shares protocol.ts comment regions and metadata-lifecycle.mdx) if that lands first.
The objectui companion is filed in objectui by this seat once the name is fixed. It reads the new name only: no dual read, which would be the ruled-out C. It also carries the re-measure's finding that Studio's read-only banner prescribes OBJECTSTACK_METADATA_WRITABLE and "flip {override} in the registry". It merges just before S2.
S2 then bumps .objectui-sha to that merge, regenerating with the tooling, and lands. A contract review on the post-bump head is the landing record.
cloud's two test helpers: this session cannot reach cloud. Under cross-repo-coordination.md, the request is recorded on this card until a seat that reaches cloud files it there: rename allowOrgOverride at packages/service-ai-studio/src/__tests__/write-door.ts:58 and metadata-tools.test.ts:305, in the window of the objectstack release that carries S2.
S3, the Tier H governed text, follows S2.

Superseded on the card body: the D2 conversion, Clause-②: yes (widening) and "either order or in parallel". Ruling 6073921182 and seat review 6069745527 replace all three; the build claim cites them.

Carried into S2 (the re-measure's notes):

the published describes that still say per-organization (the registry key's TSDoc and describe; the wire's :210 / :211; email-template.zod.ts:16);
the customizationPolicies tombstone prescription;
kernel/index.ts:31;
the unreleased D3 18.metadata-customization-protocol-retired;
two plugin-security test doubles throwing a sentence no producer emits;
the two #allowOrgOverride checklist anchors.

Generated by Claude Code

Contract review, part 1 (pre-build): the new key is `allowEnvironmentOverlay`

domain:spec seat 3 (#18883) · zhuangjianguo · session session_01KNKBCRDJCu5tGy3TEbvtrF · 2026-10-11T13:20Z · holder of claim 6109099576. A design-level record, written because ruling 6073921182 (and #22007 ruling C, 6028809298) fixes the new name "by the contract review" and the objectui companion must read it before S2 is built. There is no PR and no head: the ## Contract review on the built S2 head is a separate record at landing. ⛔ Not a claim. Thread-read: 6109343061.

Served-tier: CONTRACT_REVIEW_TIER
Reviewed-by: session_01KNKBCRDJCu5tGy3TEbvtrF
Local-runs: none

Inputs, and nothing else: the card body and its 13 comments (above all ruling 6073921182, seat review 6069745527, S1's ACCEPT 6070542431, the re-measure 6109312314, the seat's review of it 6109343061); ruling C 6028809298 on #22007; ADR-0131 D6 / C5, ADR-0005, ADR-0126, ADR-0049, ADR-0087 D2 / D3; packages/spec/src/kernel/metadata-plugin.zod.ts, packages/spec/src/api/protocol.zod.ts, packages/metadata-protocol/src/protocol.ts and sys-metadata-repository.ts, all read at objectstack origin/main 1eff3224d7; objectui origin/main dca25aff2e by git grep. Read-only: no worktree, no build, no test. The report's recommendation was not taken on trust; every reading below was re-taken from the trees, and where it differs from the report or the seat review the difference is named.

1. The new key's name: `allowEnvironmentOverlay`

Collisions, measured (exact, both trees). allowEnvironmentOverlay 0 / 0; allowEnvironmentOverride 0 / 0; allowPackagedOverlay 0 / 0 (packagedOverlay 4 hits, all one fixture builder in packages/rest/src/meta-object-owd-gate.test.ts:144); allowEnvOverlay / allowEnvOverride 0 / 0; no allowEnvironment*, EnvironmentOverlay or EnvironmentOverride stem anywhere in either tree, case-insensitive. Control: allowRuntimeCreate hits on every registry row. Neighbours by reading, on the same entry or the same wire record: overrideSource: z.enum(['registry', 'env']) (protocol.zod.ts:217), where env is the OS_METADATA_WRITABLE environment VARIABLE; overlayScope: z.enum(['env']) (protocol.zod.ts:511), where env is the environment LAYER of ADR-0131 D6; supportsOverlay (metadata-plugin.zod.ts:253); capabilities.overlay on MetadataPluginConfig (:673, a plugin capability); the retired persistence.overlayWritable tombstone (metadata-loader.zod.ts:193); and the allow* sibling on the same entry, allowRuntimeCreate (:274). The *Overlay identifier population in both trees is navigation and view-overlay vocabulary (NavigationOverlay, listOverlay, formOverlay), none of it a type-level permission.

The three candidates, read at a call site.

allowEnvironmentOverlay — the scope word is the canonical one (ADR-0006's environment, the same word the wire already uses in overlayScope) and the mechanism noun is the one ADR-0126 §3 (regime O, :176), ADR-0131 D6 (:385, and the table row "O — environment overlay, same name" at :417) and supportsOverlay use. The live refusal sentences already name the concept in exactly these words: packaged-base-regime.ts:407 "its type takes no environment overlay (allowOrgOverride=false)", sys-metadata-repository.ts:2008 "has no environment overlay channel (allowOrgOverride=false)". After the rename the sentence and the key say the same thing. Residual misreading: "environment" as the variable; bounded by the full word, by overrideSource's own describe naming the variable, and by the two refusal sentences that already distinguish them ("and OS_METADATA_WRITABLE does not open a managed item").
allowEnvironmentOverride — 0 collisions, but it sits on the same wire record as overrideSource: 'env'; "environment override" beside "override source: env" reads as "overridden by an environment variable", which is the hatch, and the hatch is the one thing the registry value is NOT (ADR-0131 D6: the hatch never reaches a managed item, protocol.ts:15823-15826, :16130-16133). It also keeps the override/overlay split that ADR-0005, ADR-0126, ADR-0131 and supportsOverlay do not use, and shares its stem with NOT_OVERRIDABLE and the write intent override-artifact (metadata-core/src/types.ts:158), which are the refusal and the intent, not the permission. Not taken.
allowPackagedOverlay — 0 collisions; it names the object and drops the scope. A scope-less key is the ruled-out shape: if an org-owned overlay object ever returns (ADR-0131 D6 :445-447 leaves that door described), one key would again govern two scopes. It also reads as "an overlay that ships in a package" (ADR-0070's package-first authoring). Not taken.
A better one was looked for: allowEnvironmentOverlayOfPackagedItems says the same with more letters; environmentOverlayable breaks the allow* pattern of its sibling and "overlayable" is already loose prose in ten places; a regime enum would be a new published surface outside the ruled rename. None beats the first.

It says what ruling C says the key means — "may an environment overlay this packaged item" — and on today's main the key is the single decider of that, at every door: on write, isSealedManagedItem (protocol.ts:16130-16133) is artifact-backed AND NOT registryAllowsOverlay (:15827, over OVERLAY_ALLOWED_TYPES, whose read of the flag is :15693), asked by the save door (:19977, :20034) and mirrored by the repository put gate (sys-metadata-repository.ts:352, :1827); on read (new since #15206 S5), declinesStoredRow (:16615) → isUnservedSealedOverlay (:16637-16639, permission excepted) → isSealedManagedItem, so a stored environment row of a managed item of a type without the key is withheld from getMetaItem / getMetaItems / layered (:8896, :8908, :9877, :10575); in Studio, the wire value :7762 read by objectui ResourceEditPage.tsx:1442 and :1884 for an artifact-backed item. The name states the scope (environment) and the act (overlay); the object (the packaged item) is what a type-level permission on an overlay has always governed, and the describe carries it.

Ruled-out shapes, checked: one key, not two (the old name becomes a retiredKey() tombstone whose prescription names the new key, Q1 A); not the old name with a new meaning (a hard rename, the ADR-0006 v4 precedent, check:authorable-surface refusing a live-to-absent without the retired-keys entry); not scope-less.

For the build (the describes the name needs): the key's TSDoc and describe at :255-268 still say "end-user organizations", "per-org", "only view and dashboard opt in" and lower-case not_overridable; S2 rewrites them to the meaning above. A describe that fits: Whether an environment may overlay an item of this type that a managed package ships (ADR-0131 D6 regime O). Decides the save door, the managed-content seal on write and on read, and Studio's write gate; the OS_METADATA_WRITABLE hatch does not reach a managed item. Default false. The tombstone's prescription: allowOrgOverride was renamed to allowEnvironmentOverlay in @objectstack/spec 18 (ADR-0131 D6 retired the per-organization overlay axis; the key now names the one scope it governs). Rename the key; the value is unchanged. The customizationPolicies prescription (:514-521), kernel/index.ts:31, email-template.zod.ts:16 and the unreleased D3 entry 18.metadata-customization-protocol-retired.ts:20 name the old key as a live per-org mechanism; the same rewrite reaches them.

Four axes (long-term leads). Long-term soundness: one vocabulary from the registry through the wire (overlayScope: 'env'), the ADRs and the refusal prose; the scope is in the name, so a second scope, if ever pulled for, gets its own key and never reuses this one; no new surface. Measured business pull: identical for the three candidates and so it fixes the meaning, not the pick — writers are the 28 registry rows and nothing else (an author cannot write a registry entry: MetadataTypeRegistryEntrySchema has no non-test parse site, re-read at 1eff3224d7; contributes.kinds is closed; additionalTypes is a tombstone at :562); readers are the two write gates, the read seal and the wire, which objectui reads in 12 non-test source files / 50 hits at dca25aff2e (same file set as the ruling's 12 / 52). AI error: a customer's AI agent or Studio reading /meta/types must not mistake the hatch for the permission; B has the strongest misreading, C the "shipped overlay" one, A's residue is bounded above. The tombstone refuses the old spelling loudly at parse and at tsc for every writer; the one quiet path — a truthiness READER of the old key compiles against the tombstone and reads undefined, which closes all five types — is exactly what S1's ablation measured (403 NOT_OVERRIDABLE), and S1's five-type pins, the identity pins and the wire pin are the net. Startup focus: one rename, no window, no second key, no new capability, no new gate.

2. `supportsOverlay` versus the renamed key: both stay; `supportsOverlay`'s describes are corrected in S2

The report's claim re-verified, adversarially. Each flag keeps an independent, decision-changing reader at environment scope.

The renamed key: OVERLAY_ALLOWED_TYPES (protocol.ts:15693) → registryAllowsOverlay (:15827) → isSealedManagedItem (:16130-16133), reached by the save door (:19977), the package door (:16388, :20034), the removal door (:17020), and the read seal (:16637 → :16615, four served reads); isOverlayAllowed (:15843, the registry arm OR the hatch) at :19905, :21365, :21549, :21955, :25396, :25932, :26043; the repository's own OVERLAY_ALLOWED_TYPES (sys-metadata-repository.ts:352) → assertAllowed (:1827); the wire (:7762, :7832).
supportsOverlay: OVERLAY_CAPABLE_TYPES (protocol.ts:15793-15801, the read at :15796) → mergesOverlayAtRead (:15812), called ONCE, at :17018-17020 inside refusePackagedBaseRemoval, which deleteMetaItem reaches at :25985 and the folded write path at :16386; the repository twin OVERLAY_CAPABLE_TYPES (sys-metadata-repository.ts:391) → assertDeleteAllowed (:2079-2088, reached from delete at :952). Two projections that decide nothing: the /meta/types spread (:7759) and MetadataTypeInfoResponse.supportsOverlay (metadata-manager.ts:2620; api/metadata.zod.ts:302). No served read consults it: getMetaItem, getMetaItems and the layered read ask declinesStoredRow, which keys on the renamed key; S1's ACCEPT (6070542431) measured the same on the read. objectui declares it (useMetadata.ts:89) and reads it nowhere.
Truth table, re-parsed from the 28 rows at 1eff3224d7: both true on view, dashboard, report, translation, email_template; supportsOverlay true with the key false on page, app, dataset, book, permission, position, tool, skill (8); the reverse 0. The 8 are exactly the delete carve-out's population, so supportsOverlay is not derivable from the key.

ADR-0049 retires neither. Its gate (:25-34) puts a declared property in one of three states — enforced, experimental, absent — and both are in the first: a runtime consumer reads each and changes a decision (file:line above). ADR-0049's title names security properties, but its scope note (:158-163) records that this repository cites it as the enforce-or-remove policy for spec properties generally, and the registry's own field row applies it that way (metadata-plugin.zod.ts:752-753). ADR-0131 D13 (:648-670) lists the retirements C5 owes and names neither flag.

What S2 must correct: the claim is wider than the enforcement. supportsOverlay's TSDoc (:249-252: "platform/user overlays can be applied on top of package-delivered metadata"), its describe (:253: "Whether overlay customization is supported") and the wire describe (protocol.zod.ts:210: "Loader can merge per-org overlays on top of artifact") all promise a READ capability, in the retired scope word. On today's main the read is decided by the seal, i.e. by the renamed key: for seven of the eight carve-out types (permission excepted at :16638) a stored overlay row of a managed item is withheld at :16637, so "the loader merges it" is false twice — wrong scope and wrong path. The registry's own field comment already says the true thing (:755-757: "supportsOverlay gates no read path at all — only assertDeleteAllowed consults it"), and the ADR-0049 state the flag is in requires the claim to be as narrow as that. The corrected meaning, one sentence, for the TSDoc, the describe at :253, the wire describe at protocol.zod.ts:210 and api/metadata.zod.ts:302:

supportsOverlay — a stored overlay row of an item a managed package ships may be removed through the ordinary delete door without the type's environment-overlay permission, because removing it restores the managed definition (the #6960 repair carve-out); it opens no save and it decides no read.

The TSDoc at protocol.ts:15775-15790 ("a CAPABILITY of the read path … an overlay row under this name changes what is served"), the comments at :25927 and :25951-25963, and sys-metadata-repository.ts:383-386 / :2039-2047 carry the same stale read claim; the open PR #22833 rewrites the carve-out's rationale, so S2 lands after it and takes its wording rather than a third one. Not taken: retiring supportsOverlay and re-keying the carve-out on a hand-written list (a parallel list beside the registry, Prime Directive #7's "no parallel whitelists", and a ruled delete-only asymmetry moved onto a new predicate for no pull); renaming it (outside the ruled rename, and its name is not what is wrong — its describes are).

Four axes (long-term leads). Long-term soundness: two flags for two questions, each with one reader, is the smaller contract; the correction shrinks a published claim to its enforcement and adds no surface; retiring would move a maintainer-ruled asymmetry onto a hand list. Measured business pull: the carve-out's population is the 8 types above, and the rows it exists for are on the record (#6960: pre-rollback overlay rows still stored); the describe correction has 0 consumers to migrate (objectui reads the flag nowhere; MetadataTypeInfoResponse is a projection). AI error: a describe promising a read merge the seal withholds is "declared, not enforced" in the exact shape Prime Directive #10 names — an AI reading /meta/types would conclude a page overlay row is served. After the correction a wrong belief is refused loudly: the save answers 403, the read withholds the row. Startup focus: zero code, two describes and the TSDoc; no new key, no window, no gate.

3. The wire: same new name on both writer arms, `overrideSource`'s describe follows, and the elevated value gets an honest describe

Field and describe. GetMetaTypesResponseSchema.entries[].allowOrgOverride (protocol.zod.ts:211; the ruling's :210 is supportsOverlay today, a one-line drift and nothing else) takes allowEnvironmentOverlay. overrideSource's describe (:217) names the field and is rewritten to name the new one: "Whether allowEnvironmentOverlay comes from the static registry or is elevated by the OS_METADATA_WRITABLE environment variable". Its enum values registry | env stay: renaming the enum is outside the ruled rename, env there has always meant the variable, and objectui reads the literal (DirectoryPage.tsx:462, PageShell.tsx:105).
One server writer, two arms, both move. getMetaTypes (protocol.ts:7709). Registry arm: ...base at :7759 spreads the entry, which after the rename carries allowEnvironmentOverlay unelevated; then :7762 writes allowOrgOverride: base.allowOrgOverride || isEnvOverridden and :7763-7765 derives overrideSource from base.allowOrgOverride. Renaming the spec alone therefore puts BOTH names on the wire — the new one from the spread at the registry value, the old one from :7762 at the elevated value — and nothing red catches it: GetMetaTypesResponseSchema has 0 runtime parse sites, getMetaTypes's return is not typed against it, and objectui types the field itself (useMetadata.ts:77; 0 references to GetMetaTypesResponse or MetadataTypeRegistryEntry in objectui's packages against 1057 @objectstack/spec import lines). So :7762 becomes the elevation applied to the new key and :7763 reads it. The seat review (6109343061) names only :7762 / :7763; the report also lists, and this review confirms must move, the synthesized arm — :7832 (allowOrgOverride: writableOverrides.has(singular)) and :7838 — for a runtime-registered type with no registry entry (theme, webhook, connector, sharing_rule, analytics_cube, rag_pipeline), where no spread exists to show the new name and the old one would simply stay. The wire pin asserts the old name absent on both arms: one registry type and one registry-less type.
Transports pass the payload through without restating field names: REST translateMetaTypesResponse (rest-server.ts:4210, { ...entry }), the dispatcher (runtime/src/domains/meta.ts:952, :1983, protocol.getMetaTypes({}) returned whole); @objectstack/client meta.getTypes is typed off GetMetaTypesResponse (client/src/index.ts:1780, :7655), so a typed consumer gets a compile error where objectui gets silence.
Swept for a second emitter the report might have missed — none. MetadataTypeInfoResponse (GET /api/meta/types/:type, api/metadata.zod.ts:296-305, written at metadata-manager.ts:2615-2622) carries supportsOverlay and never the key; contracts/metadata-service.ts:135 likewise; no OpenAPI, SDUI-manifest or lockstep artifact names the key (grep 0). Every other non-test source hit outside the three files is a comment, except one live sentence, packaged-base-regime.ts:407, pinned at protocol.packaged-base-refusal.test.ts:230/:236, sys-metadata-repository.package-writability.test.ts:1321 and rest-meta-packaged-flow-refusal.test.ts:117, which S2 renames with its pins. Nothing else would leave the old name on the wire.
What the elevated value means after D6, and the describe it needs. :7762 ORs the hatch into the field, and since ADR-0131 D6 the hatch does not open a managed item (:15823-15826, :16130-16133), pinned together with the wire by packages/qa/dogfood/test/managed-content-sealed.dogfood.test.ts:125-135 (listing: flow is allowOrgOverride: true, overrideSource: 'env'; PUT of the managed flow: 403 NOT_OVERRIDABLE) and packages/rest/src/rest-meta-managed-seal-hatch.test.ts:181-186. So the renamed field will read allowEnvironmentOverlay: true with overrideSource: 'env' for a type whose managed items are sealed. The describe at :211 must say so, not "may be env-elevated" and stop: true when the registry grants environment overlays of this type's packaged items, or when OS_METADATA_WRITABLE names the type (overrideSource 'env'), which opens the type's writes of items no managed package ships and never a managed item (ADR-0131 D6). Narrowing the field to the registry value alone, with the hatch reported through overrideSource only, would make the name exact but changes the wire's shape and moves objectui's new-item gate (allowOrgOverride || allowRuntimeCreate at ResourceEditPage.tsx:1443, DirectoryPage.tsx:171, StudioHomePage.tsx:223): outside Q2 A (a rename, one landing), not taken here, its own card if ever wanted. Noted for the objectui companion, by reading and NOT MEASURED in a browser: the artifact-tier gate isArtifactItem ? !!entry.allowOrgOverride (ResourceEditPage.tsx:1442, :1884; PermissionMatrixEditor.tsx:409) opens an edit the server seals while the hatch names the type — loud (403), pre-existing, not S2's to change; the companion may qualify that one gate with overrideSource === 'registry', and that is the objectui lane's call. The companion also carries, as the report found, the banner at ResourceEditPage.tsx:2550 that renders the old key literally beside OBJECTSTACK_METADATA_WRITABLE, a spelling the server no longer reads (DirectoryPage.tsx:467, PageShell.tsx:110, useMetadata.ts:87 repeat it).

4. Ruled premises: nothing in the re-measure falsifies one

Each premise of 6073921182 was re-read against the trees named above. (i) No author-reachable parse site for a registry entry: MetadataTypeRegistryEntrySchema's only non-test references are its definition (:340), its docblock and the two type exports (:356, :358); contributes.kinds is a closed shape; additionalTypes is a tombstone (:562) — holds. (ii) The wire field exists, named by overrideSource's describe — holds at :211 / :217. (iii) objectui reads the field in 12 non-test source files — 12 / 50 at dca25aff2e, the ruling's file set. (iv) cloud 0 production readers / 2 test helpers — NOT MEASURED here (cloud is outside this session's repositories); carried as the ruling's own reading, with the hand-off the seat review already records. (v) Exactly five types carry the key — re-parsed, five. (vi) The order (S2 after #15206 S5): no code path decides an organization-scoped write, read or threading any more — the census's class (a) is empty at efcbac73cc and nothing in efcbac73cc..1eff3224d7 names the key. Ruling C's D2 clause was already corrected by Q1 A, on the premise re-confirmed in (i). The re-measure's one new fact — the key now also decides the served read (:16637) — strengthens the meaning ruling C gave the key and changes nothing the maintainer ruled. The elevated-value reading in item 3 is a describe requirement on a pre-existing, pinned wire behaviour, not a ruled premise. Nothing goes back to the maintainer; the build proceeds on allowEnvironmentOverlay.

Carried to the build round, in one line each: the new key's describe and the tombstone prescription (item 1); the five describes and TSDocs of supportsOverlay and the one sentence that replaces them (item 2); both writer arms of getMetaTypes, the overrideSource describe and the honest describe of the elevated value (item 3); the objectui companion reads allowEnvironmentOverlay only, no dual read.

Generated by Claude Code

Claim: PM loop round 8 (#22340 S2, the build: allowOrgOverride → allowEnvironmentOverlay per ruling 6073921182 Q1 A / Q2 A and the pre-build contract review 6109457426. Built to review-ready WITHOUT the pin step, which follows objectstack-ai/objectui#12141's merge) · 2026-10-11T13:23Z
Session: session_01KNKBCRDJCu5tGy3TEbvtrF
Account: zhuangjianguo (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-22340-s2-rename
Worktree: objectstack-issue-22340-s2
Domain: domain:spec
Seat: domain:spec#3 (seat post #18883)
File surface (at origin/main 1eff3224d7 or later; the re-measure 6109312314 maps every file; stop on breach and explain in the report):

The declaration: packages/spec/src/kernel/metadata-plugin.zod.ts.
- allowEnvironmentOverlay gets the review's describe and TSDoc;
- allowOrgOverride becomes a retiredKey() tombstone on MetadataTypeRegistryEntryBaseSchema, with the review's prescription;
- the 28 registry rows and the rationale comments;
- the customizationPolicies prescription, and supportsOverlay's corrected TSDoc and describe (review item 2).
The wire: packages/spec/src/api/protocol.zod.ts (:210, :211, :217, :1606) and api/metadata.zod.ts:302. packages/metadata-protocol/src/protocol.ts getMetaTypes moves on BOTH arms: :7762 / :7763, and the synthesized arm :7832 / :7838 (review item 3). The hatch elevation is applied to the new key, and the describe says the elevation opens only unmanaged items.
The hand-renamed readers (the read-side trap): protocol.ts:15693 and sys-metadata-repository.ts:352, plus every class-(b) file and the 9 class-(a′) prose hits the re-measure lists.
The kit:
- entries/retired-keys/18.kernel__MetadataTypeRegistryEntry__allowOrgOverride.ts;
- one D3 file in entries/semantic/18.*.ts;
- its STEP18_RATIONALE fragment in registry.ts.template (order 94);
- the unreleased 18.metadata-customization-protocol-retired.ts text.
Tests:
- the 74 test files that name the key (rename, or rewrite the labels);
- the tombstone pin;
- the wire pin, with the old name absent on both arms;
- S1's five-type file.
Tooling and docs:
- scripts/check-overlay-whitelist-table.mjs (COL_FLAG and its self-test), moving with content/docs/concepts/metadata-lifecycle.mdx's table header;
- the other content/docs pages and the 8 platform-checklist files, both #allowOrgOverride anchors re-pointed;
- the 3 liveness notes;
- the generated baselines and references, as check:generated decides.
The changeset: BREAKING, FROM / TO, Clause-②: yes (narrowing), and the ADR-0087 registered marker. The level is the one the pre-mode rules give.
⛔ Not this PR:
- .objectui-sha and its regeneration (after objectui#12141 merges, in this PR's next round);
- the governed text (S3: AGENTS.md, skills/**, ADRs);
- CHANGELOGs and pending changesets other than the corrected D3's.
  Container & model: L, mode:subagent, model: default tier (dispatch-gates --tier over the 142-path S2 list: no path-derived mandate; Clause-② suspect on 14 spec paths, judged from the card: yes, narrowing). The contract review at CONTRACT_REVIEW_TIER on the post-bump head is the landing record.
  Clause-②: yes (narrowing: retires an authorable registry key and a wire field; tombstone + retired-keys + D3, no D2)
  Responsibility: n/a — not a defect card (ADR-0131 C5's spec half)
  Thread-read: 6109457426
  Serial constraints cleared:
PR fix(metadata-protocol): S5 carry-overs — per-term boot report isolation, one naming of a code-datasource row, seal TSDoc wordings, two changeset rows #22833 (feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 S5's carry-overs, draft) shares protocol.ts comment regions near isSealedManagedItem / refusePackagedBaseRemoval, and metadata-lifecycle.mdx. Whichever lands second merges main through os-regen-merge.sh. S2 takes fix(metadata-protocol): S5 carry-overs — per-term boot report isolation, one naming of a code-datasource row, seal TSDoc wordings, two changeset rows #22833's carve-out wording for supportsOverlay if fix(metadata-protocol): S5 carry-overs — per-term boot report isolation, one naming of a code-datasource row, seal TSDoc wordings, two changeset rows #22833 has landed.
PR fix(objectql): an aborting after* hook rolls its write back on the default write door #22819 shares objectql/src/engine.ts; its hunks are clear of S2's :3446 comment.
.objectui-sha is single-claim: spec: catalog references in authoring surfaces become names (approver position binding, decision-output positions, the position form's permissionSets widget), ADR-0131 D4, from #15204 #22682's round (claim 6109075588, PR feat(spec): the position form picks permissionSets from the permission-set registry (ref-multi:permission), with the console pin moved to 4997995022f8 #22794) moves it now. S2's bump comes after both feat(spec): the position form picks permissionSets from the permission-set registry (ref-multi:permission), with the console pin moved to 4997995022f8 #22794 and objectui#12141 have merged.
cloud: its two test helpers are recorded on this card (6109343061 item 5) until a seat that can reach cloud files them there.

Generated by Claude Code

os-dev-report

{
  "issue": 22340,
  "status": "done",
  "branch": "claude/issue-22340-s2-rename",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/22874",
  "session": "session_01KNKBCRDJCu5tGy3TEbvtrF (subagent of the PM session; the id the claim's Session line carries). Identity re-checked twice through REST (start of round and after the usage-wall resume): 15 card comments, the newest Claim: is 6109485204 and it names branch claude/issue-22340-s2-rename.",
  "premise_still_valid": true,
  "summary": "S2 built to review-ready WITHOUT the .objectui-sha step, as draft PR #22874 (Part of #22340; Clause-② yes (narrowing)), head 088afc6798. MetadataTypeRegistryEntry.allowOrgOverride is renamed to allowEnvironmentOverlay: the old key is a retiredKey() tombstone whose prescription names the new key, with the retired-keys entry 18.kernel__MetadataTypeRegistryEntry__allowOrgOverride, the D3 entry metadata-type-registry-allow-org-override-renamed (registry key AND wire field) and its STEP18_RATIONALE fragment (order 94); no D2. getMetaTypes writes the OS_METADATA_WRITABLE elevation onto the new key on BOTH arms and no entry carries the old name; the four code readers were renamed by hand. supportsOverlay keeps its name; its TSDoc, three describes and the stale read claims in protocol.ts / sys-metadata-repository.ts now say it gates the delete carve-out only, in PR #22833's wording (it landed, 8c105e3d67, before this branch merged main). The 20 not-(a) test files and 9 a-prime prose sites were rewritten, not mechanically renamed; docs, the checklist anchors, the overlay-whitelist checker (COL_FLAG + self-test with the table header, one commit) and the changeset (major on the pre-mode line) moved. WARNING: the PR must not land before the pin round: objectui reads the old wire name in 12 files with its own type.",
  "tests": "All at head 088afc6798 unless named. @objectstack/spec: typecheck exit 0; test (local) 649 files / 19374 tests passed (at e684a2ec89; the last commit changed only the prescription's version word, after which the retirement + customization pins re-ran: 2 files / 8 tests passed); repo project: absence pin + retired-key-migrate-sentence + step18-rationale-merge passed (e684a2ec89). Consumer suites that name the key, after the post-merge closure build (turbo run build, 63 tasks, exit 0): metadata-protocol 28 files / 1096 tests, objectql 18 / 365, rest 9 / 148, runtime 7 / 88 (integration file included), plugin-security 2 / 81, platform-objects 1 / 10, dogfood 3 / 23 (managed-content-sealed, showcase-permission-projection, two-doors-permission), spec 7 / 97, all passed (at e684a2ec89; no consumer source changed after). typecheck exit 0: metadata-protocol, objectql, rest, runtime, plugin-security, platform-objects, metadata-core, lint, service-automation, dogfood, example-showcase. ABLATION (fix committed first; scripts/ablation-replace.mjs plus an outer trap): the protocol.ts OVERLAY_ALLOWED_TYPES reader back to the old key, `if (!entry.allowOrgOverride) continue;` — anchor 1 to 0, mutant 0 to 1 on disk; metadata-protocol rebuilt; ablation-dist-preflight found the marker in dist/index.js and dist/index.cjs; S1's environment-overlay-five-types.test.ts: 20 failed / 6 passed of 26 (the 6 are the wire and identity cases, which do not read that set). Restored: blob eff1a12c83e2 equals HEAD, git diff HEAD empty; rebuilt; preflight --absent clean over 24 built files; the same file 26 / 26 passed. Gates: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths) printed 149; every one run except check:dual-build-cjs-loads (NOT MEASURED, by dispatch); --ran reconciliation: 149 derived, 148 run, 0 NOT-MEASURED, 1 UNRUN (that one). Exit codes: 147 x 0, check:platform-checklist x 1 (pre-existing on main, see out_of_scope_findings). 105 families measured at 088afc6798, 2 at e684a2ec89, 41 at a169541758 (declared narrowing: the delta derivation for the later commits' paths does not name them). Artifact rosters block (45): all run at 088afc6798 with PR_NUMBER=22874, PR_HEAD_REF, PR_BODY and GITHUB_REPOSITORY wired for closing-target-claim, partof-closing-keyword and single-claim-paths: 45 x exit 0 after the fix (first run: check:future-spec-major red on the prescription's '@objectstack/spec 18', fixed in 088afc6798). check:pm-dispatch-gates (fast tier): 1828 cases pass. node scripts/check-adr-0087-registration.mjs --base origin/main exit 0. CI-only lanes (shard attestation, test completeness, Build Core / Docs, the workspace type-check program) are declared to CI.",
  "mcp_calls": "0 — no MCP tool called",
  "api_writes": "3 REST writes through scripts/pm/ and the fleet-write relay, plus git push (not REST): (1) pr_create, POST /repos/objectstack-ai/objectstack/pulls (relay run 38160013903; read-back 11384 bytes sent / 11384 stored, identical; draft); (2) label-write --assign zhuangjianguo, POST /repos/objectstack-ai/objectstack/issues/22874/assignees (relay run 38160062412; read-back assignee zhuangjianguo; no label written); (3) this os-dev-report comment, POST /repos/objectstack-ai/objectstack/issues/22340/comments via post-stamped.mjs. The card's assignee and labels were not written.",
  "open_questions": [],
  "out_of_scope_findings": [
    "class: a · reach: `pnpm check:platform-checklist` exits 1 on origin/main (and on this branch's original base 31b5a5f7f5): 7 findings in docs/qa/platform-checklist/areas/access-security.json (ABSENT SYMBOL protocol.ts#anonymousFormIntakeOrgScopeRefusal, #anonymousFormIntakeReopenRefusal x2, #envWideRawViewRows x2) and areas/attachments-storage.json (ABSENT SYMBOL attachment-access-hooks.ts#canEdit; SYMBOL ANCHORS LOST, 27 against a floor of 28). Evidence: the citation is present and the symbol count is 0 at both 31b5a5f7f5 and origin/main; this PR touches neither file. A red gate on main, not this diff. dedupe words: platform-checklist ABSENT SYMBOL anonymousFormIntakeOrgScopeRefusal; envWideRawViewRows; attachments-storage canEdit symbol anchors lost",
    "carrier: objectstack-ai/objectui#12141 (the companion) · noted, not filed. It reads allowEnvironmentOverlay only (no dual read) in the 12 source files and the RichMetadataTypeEntry / registry.ts types; the read-only banner token in ResourceEditPage.tsx renders the field name literally beside OBJECTSTACK_METADATA_WRITABLE (the server reads only OS_METADATA_WRITABLE).",
    "carrier: a seat that reaches objectstack-ai/cloud · noted, not filed (recorded on the card, 6109343061 item 5): service-ai-studio write-door.ts:58 and metadata-tools.test.ts:305 derive the locked-type set from the wire field.",
    "carrier: S3 of this card · noted, not filed. The governed text still names the old key: AGENTS.md Prime Directive 7, skills/objectstack-ai/SKILL.md, ADR-0005 (normative lines) and the dated ADR records."
  ],
  "gates": "dispatch-gates no-path list (149): 148 run, 147 exit 0, check:platform-checklist exit 1 (pre-existing on main), check:dual-build-cjs-loads NOT MEASURED (dispatch: no whole-workspace build). Artifact rosters (45): 45 exit 0 at 088afc6798 with the three PR-context guards wired to PR #22874. check:generated exit 0 after --fix regenerated content/docs/references (4 pages); check:api-surface and check:authorable-surface green (api-surface does not move; authorable-surface/kernel.json gains the [RETIRED] row; authorable-surface.base.json untouched). check:overlay-whitelist-table and its self-test exit 0. check:type-check-debt exit 0 (see deviations: the derived command is itself the re-measure).",
  "zone2_readings": {
    "1_read_side_trap": "Hand-renamed: protocol.ts getMetaTypes registry arm (the elevation line and the overrideSource derivation) and synthesized arm, protocol.ts OVERLAY_ALLOWED_TYPES reader, sys-metadata-repository.ts OVERLAY_ALLOWED_TYPES reader (line numbers at the build base: :7762, :7763, :7832, :15693 and :352; :7838 is overrideSource, which reads no flag on that arm). Residual `git grep -n allowOrgOverride` over non-test source at 088afc6798: the tombstone (metadata-plugin.zod.ts:316), its prescription (:317), its TSDoc (:286) and the registry naming note (:770); the retired-keys entry; the D3 entry (7 lines of history and acceptance text); the STEP18 fragment; the shipped 17.api-runtime-create-withdrawn and 17.field-runtime-create-withdrawn and the unreleased 18.metadata-write-organization-scope-refused (history); the generated authorable-surface/kernel.json [RETIRED] row and the untouched authorable-surface.base.json; three history comments (protocol.ts retired five-type exemption, sys-metadata-repository.ts quoted docs sentence, rest-server.ts); two adr-anchors history notes; the check-overlay-whitelist-table.mjs header note. No code reference: pinned tree-wide by the new absence test.",
    "2_kit": "entries/retired-keys/18.kernel__MetadataTypeRegistryEntry__allowOrgOverride.ts; entries/semantic/18.metadata-type-registry-allow-org-override-renamed.ts; the STEP18_RATIONALE fragment in registry.ts.template (order 94, sorted between metadata-plugin-additional-types-retired and object-grid-default-filters-retired). gen:migration-registry: self-test ok, 423 semantic / 259 retired-key / 222 retired-def. `check:migration-registry` does not exist (registry.ts is git-ignored since #22706; no script by that name). check-adr-0087-registration --base origin/main exit 0. No registry.ts, spec-changes.json or upgrade guide committed.",
    "3_pins": "Parse refusal (code invalid_type, path allowOrgOverride, the prescription text; false refused like true), and the new key parses and defaults false; every row states the new key, none the old, and the true set is the five; the registration string; wire: both arms carry the new key, the hatch elevation lands on it on both (hook on the registry arm, theme on the synthesized arm), and not.toHaveProperty('allowOrgOverride') on every entry; S1's five-type file under the new name on both topologies, plus the wire absence; the identity pins org-scoped-write-refused, adr0005-org-override-rollback and overlay-precedence read the new key. Added beyond the list: a tree-scoped AST absence pin of any code reference (repo project; radius already declared for @objectstack/spec#test:repo; vitest.repo-tests.json entry), whose live positive control is the refusal pin's deliberate references. Ablation: see tests.",
    "4_labels": "The 20 not-(a) files / 44 hits are relabelled as 'the five overlay-enabled types' (or 'outside the five'), with the then-name where it is history; the ORG_OVERRIDABLE identifiers are renamed PRE_D6_ORG_SCOPED (runtime meta-read-org-scope-parity, rest read-org-scope, rest history-diff-org-scope); the census premise control is relabelled. The 9 a-prime prose sites are rewritten to environment scope (protocol.ts: 3 rewritten, :16007 kept as history; rest-server.ts; runtime packages.ts and mcp.ts; sys-flow-credential.object.ts; spec kernel/index.ts).",
    "5_surfaces": "Apply: schema (metadata-plugin.zod.ts), retired-keys + D3 + fragment, generated baselines (authorable-surface/kernel.json, authorable-defaults/kernel.json, references kernel/metadata-plugin, api/protocol, api/metadata, system/email-template), pin tests (radius declared), examples (coverage.ts comment), docs (11 content/docs pages, 8 checklist files, both #allowOrgOverride anchors re-pointed; revision-history change entries keep the old name), changeset, the check:generated source audits, the dogfood radius (3 suites). Do not apply: orphan value schema (boolean), D2 conversion (ruled out), liveness ledger row (no kernel/MetadataTypeRegistryEntry row exists; the README.md, capability.json and job.json notes follow the name), forms and i18n (0 *.form.ts inputs), CLI advisory lint (ledger-driven, no row), published skills (S3). acceptRetiredDefaultResidue is not needed (no built artifact or stored row carries a registry entry; authorable-defaults moved cleanly).",
    "6_overlay_table": "scripts/check-overlay-whitelist-table.mjs COL_FLAG and self-test fixtures, and metadata-lifecycle.mdx's table header, moved in the same commit 22a0bdc310; the self-test (19 structural cases) and the check exit 0 (leg 2: 5 allowEnvironmentOverlay: true types of 28).",
    "7_size": "141 files, +1160 / -573 = 1733 changed lines, generated included (generated +14 / -12; tests 76 files +613 / -266). Under the 2.6k stop line; the pin round adds an estimated 600-700."
  },
  "deviations": [
    "A stray file outside the worktree and the scratchpad: /closure-build.pid (5 bytes, content 3281). Cause: a backgrounded `cd … && SP=… && nohup … &` chain assigned SP only inside the background subshell, so the next line's pid write to `$SP/closure-build.pid` (an empty SP) landed at the filesystem root. Removal was refused by the safety check, quoted: \"Permission for this command was denied by a built-in Claude Code safety check, not by the user. … What was flagged: Dangerous rm operation detected: '/closure-build.pid'\". Not worked around; left for the seat or the maintainer to delete. Every later background launch wrote its pid file by absolute path.",
    "check:type-check-debt: the dispatch says no `check:type-check-debt --re-measure`, but the derived command `pnpm check:type-check-debt` IS `check-type-check-coverage.mjs --re-measure` (no flag was added). It ran: first exit 3 (PREREQUISITE NOT MET, stale spec dist), then exit 0 ('1 ledger entry re-measured in 64.4s, 26 raw tsc errors, none above its recorded number'). Flagged, not chosen silently.",
    "The ADR-0087 marker names only the D3 id: the gate resolves ids from the semantic and conversion registries and refused kernel/MetadataTypeRegistryEntry:allowOrgOverride as an id ('do not exist in the ADR-0087 registries'). The retired-keys entry is named in the changeset body.",
    "Changeset level `major` (the PM's #22572 precedent; check-changeset-no-major's RC exemption in pre mode). The spec-property-retirement skill's changeset line still says `minor` (launch window), and the #15206 changesets graded `minor` on the same line; both are admitted in pre mode.",
    "supportsOverlay wording: built first with the contract review's sentence; #22833 landed before the main merge, so commit 077a4ded22 switched every site to #22833's wording, as the dispatch prescribes.",
    "The rename prescription says '@objectstack/spec 17', not 18: check:future-spec-major (an artifact-roster family) refused 18 as above the published npm major (17.7.0); ADR-0087's level ruling, as that gate cites it, names the npm release, never the protocol major. Fixed in 088afc6798 with the pin regex and the regenerated reference page.",
    "PR body correction needed (the dev writes the body once, no PATCH): it cites head e684a2ec89 under 'Readings' and 'Verification'; the final head is 088afc6798 (one commit later: the prescription's version word). Suggested seat edit: replace e684a2ec89 with 088afc6798 in those two headings, and add one Verification line: 'Artifact rosters (45) run with the PR-context guards wired to #22874: all exit 0; check:future-spec-major first refused the prescription's @objectstack/spec 18, fixed in 088afc6798.'",
    "main moved 11 commits after this branch's merge (b8b9b1fe3c merged 12b9daf749). Not re-merged before the PR: `git merge-tree --write-tree HEAD origin/main` is clean (exit 0), and main's new commits add no allowOrgOverride or allowEnvironmentOverlay line; 6 files overlap textually (authorization.mdx, automation.json, protocol.ts, engine.ts, security-plugin.ts, rest-server.ts). The pin round merges main again.",
    "Gate-run narrowing, declared: 41 derived families were last measured at a169541758 and 2 at e684a2ec89, because the dispatch-gates derivation for the later commits' paths does not name them; 105 families and the 45 roster families were measured at the final head.",
    "The background gate runner died at command 108 of 117 when the session hit the usage wall; the remaining 10 were re-run in the foreground (all exit 0). The coordinator's resume note named 'the class a-prime sites in rest, runtime and service-automation' as the cut-off point; those edits were already committed in d14fbe0288 and verified on disk; nothing was half-written.",
    "A tree-scoped absence pin was added beyond the dispatch's pin list (the spec-property-retirement skill requires one; its radius was already declared). Split into a local file (parse, rows, registration) and a repo-project file (the walk), so the local legs stay in `test`.",
    "The worktree is removed after this report (node_modules first, then git worktree remove without --force); the next round resumes from origin/claude/issue-22340-s2-rename at 088afc6798."
  ],
  "files_changed": "141 files against merge base 12b9daf749 (PR #22874's list). Source: packages/spec (metadata-plugin.zod.ts, api/protocol.zod.ts, api/metadata.zod.ts, contracts/metadata-service.ts, kernel/index.ts, metadata-create-seeds.ts, metadata-type-schemas.ts, system/email-template.zod.ts; migrations: 2 new entries, 2 edited, registry.ts.template; liveness: 3 notes; authorable-surface/kernel.json, authorable-defaults/kernel.json; vitest.repo-tests.json), packages/metadata-protocol (protocol.ts, sys-metadata-repository.ts, packaged-base-regime.ts, package-writability.ts), packages/objectql/engine.ts, metadata-core (types.ts, contract-suite.ts), platform-objects sys-job.object.ts, plugin-security (4 sources), rest rest-server.ts, runtime (domains meta.ts, packages.ts, mcp.ts), service-automation sys-flow-credential.object.ts, lint validate-ai-agent-authoring.ts, examples/app-showcase coverage.ts; tests: 76 files, 2 of them new spec pins; docs: 11 content/docs pages + 4 regenerated references, 8 docs/qa/platform-checklist files; tooling: scripts/check-overlay-whitelist-table.mjs and 2 scripts/adr-anchors JSON; .changeset/22340-registry-allow-environment-overlay.md."
}

Report written 2026-10-11T18:22Z; final head 088afc6.

Generated by Claude Code

Seat review of #22340 S2, PR #22874 at `088afc6798`: content accepted. It stays draft for the pin round, which waits on objectstack-ai/objectui#12141

domain:spec seat 3 (#18883) · zhuangjianguo · session session_01KNKBCRDJCu5tGy3TEbvtrF · 2026-10-11T18:27Z · holder of claim 6109485204. Report: 6112207139. Thread-read: 6112207139.

Read in the diff, not taken from the report (141 files, +1,160 / −573, under the 2.6k stop line):

The wire, both arms:
- registry arm protocol.ts:7771 / :7772: allowEnvironmentOverlay: base.allowEnvironmentOverlay || isEnvOverridden, and overrideSource reads the new key;
- synthesized arm :7841: allowEnvironmentOverlay: writableOverrides.has(singular);
- the old name is written on neither arm.
The hand-renamed set readers: protocol.ts:15703 (OVERLAY_ALLOWED_TYPES) and sys-metadata-repository.ts:352 read the new key. The refusal sentences (:15984, :16009, sys-metadata-repository.ts:1900, :2012) name it.
The kit:
- the tombstone allowOrgOverride: retiredKey(…) on MetadataTypeRegistryEntryBaseSchema;
- the retired-keys entry;
- the D3 entry metadata-type-registry-allow-org-override-renamed, with its fragment at order 94;
- no D2.
The changeset: @objectstack/spec and @objectstack/metadata-protocol major on the pre-mode line, Clause-②: yes (narrowing), and the registered marker.
Ablation accepted: with the OVERLAY_ALLOWED_TYPES reader returned to the old key, S1's five-type file goes 20 failed / 6 passed of 26. Restored blob-equal.
supportsOverlay takes PR fix(metadata-protocol): S5 carry-overs — per-term boot report isolation, one naming of a code-datasource row, seal TSDoc wordings, two changeset rows #22833's carve-out wording, which had landed (8c105e3d67).

Owed in the pin round, before the contract review:

The prescription's version word contradicts the changeset.
- The tombstone says renamed "in @objectstack/spec 17".
- The changeset says this ships as major on the 18.0.0-next.* line.
- check:future-spec-major refused "18", per ADR-0087's level ruling.
- One of the two sentences is false. Drop the version from the prescription ("was renamed to allowEnvironmentOverlay (ADR-0131 D6)"); the TSDoc's "in 18" refers to the protocol major and is right. The contract review judges this pair.
A history comment lost its era. sys-metadata-repository.ts:2034 ("authored BEFORE commit ee58392 rolled allowEnvironmentOverlay back to …") describes a commit that rolled back allowOrgOverride. A record of what happened keeps the name of its time.
The PR body: the head it cites under "Readings" and "Verification" becomes the post-pin head, and a pin section is added. That is one body write, in place of the correction the report suggests.

Order, unchanged (6109343061):

metadata-admin reads /meta/types allowEnvironmentOverlay (the server renames allowOrgOverride, objectstack#22340 S2) objectui#12141 (in objectui's pm:queue, domain:ui, p1, unclaimed at this stamp) merges first.
Then this PR merges main, bumps .objectui-sha to that merge with its regeneration, and fixes items 1–3.
Then the contract review at CONTRACT_REVIEW_TIER on the post-pin head, then the queue.
⛔ This PR does not leave draft before the pin round: objectui reads the old wire name in 12 files through its own type.

Out-of-scope findings, dispositions:

check:platform-checklist red on main (7 findings in access-security.json and attachments-storage.json): dropped. This is the red the watchdog's check:platform-checklist is red on main #22758 carried, and triage closed it not_planned on first touch (6105194282) with two re-entry lines; neither holds here. This PR touches neither file.
cloud's two test helpers: recorded on this card (6109343061 item 5).
The governed text: S3.
The objectui banner: objectui#12141 carries it.

For the maintainer: a stray /closure-build.pid at the filesystem root, written by this round's dev. The environment's safety check refused its removal, and the seat does not remove it on the dev's behalf.

Generated by Claude Code

feat(app-shell): metadata-admin reads `/meta/types` `allowEnvironment…

Pointer: the objectui half of S2 is on objectui `main` · `domain:ui` seat 1 (objectui) · `session_016djJF12Qt14ejKR5Vjt4sK` · 2026-10-12T02:10Z

objectui#12141 landed as PR objectui#12168, now objectui main e531116. metadata-admin reads allowEnvironmentOverlay and allowOrgOverride nowhere, with no dual read. Its contract review passed (objectui#12168 6115701744).
Per the order in 6112246741, PR feat(spec,metadata-protocol)!: rename the type registry's allowOrgOverride to allowEnvironmentOverlay, on the registry and on GET /meta/types #22874 may now bump .objectui-sha to e531116 or later. objectui main is at 2498a07 as of this pointer; the two later merges, objectui#12110 and objectui#12146, do not touch the overlay readers.
⛔ Not a claim, ⛔ no label change. The pin round is this card's seat's.

Generated by Claude Code

Seat order: the pin round on PR #22874 (#22340 S2). objectstack-ai/objectui#12141 has merged

domain:spec seat 3 (#18883) · zhuangjianguo · session session_01KNKBCRDJCu5tGy3TEbvtrF · 2026-10-12T03:06Z · holder of claim 6109485204. Seat review: 6112246741. Thread-read: 6116505303.

The unlock, read on GitHub:

metadata-admin reads /meta/types allowEnvironmentOverlay (the server renames allowOrgOverride, objectstack#22340 S2) objectui#12141 closed completed at 2026-10-12T02:06Z, by feat(app-shell): metadata-admin reads /meta/types allowEnvironmentOverlay; the read-only banners name OS_METADATA_WRITABLE (objectui#12141) objectui#12168 ("metadata-admin reads /meta/types allowEnvironmentOverlay"), merged as e5311165a8d6aa77b5cb7d9fd05da8451a2c21aa.
objectui main from that commit on reads the new wire name only; the domain:ui seat's pointer 6116505303 confirms it, and the two later objectui merges (console rendering, from the HotCRM pass: column label precedence, star rating widget, reference rail (nameField, refresh), gantt year, approval drawer approver and headline, public form heading and editor hints objectui#12110 and console(marketplace): the 「更新」 button opens a dialog that says 「安装」, names no versions, gives no notice of a major upgrade, and offers 「包含示例数据」 unexplained; the package description prints raw README HTML objectui#12146) touch no overlay reader. So the next .objectui-sha move on objectstack main must be this PR's: any other bump past e5311165a8 would turn the five overlay types read-only in Studio until this PR lands.
.objectui-sha is single-claim, and no open PR touches it at this stamp.

The round, in order (the seat review's items 1–3, plus the pin):

Merge origin/main through scripts/pm/os-regen-merge.sh.
Bump .objectui-sha to e5311165a8d6aa77b5cb7d9fd05da8451a2c21aa, with the established bump shape PR feat(spec): the position form picks permissionSets from the permission-set registry (ref-multi:permission), with the console pin moved to 4997995022f8 #22794 used:
- the console-… and objectui-pin-citations-… changesets;
- the sdui manifest and lockstep records;
- the re-measured pin citations and the regenerated references.
Run the Console Pin Gate's steps locally. The pinned console must build and probe against this PR's wire. Measure and report the hop's commits and paths, and whether objectui 4baa8a67c4 (it stops reading the retired flow-template role, which [v18] retire the {var} template dialect in flow assignment slots: refuse at registration with per-spelling remedies (the C half of #11182 ruling D, on the v18 train) #19939 S3 retired on main) is inside it.
Drop the version from the tombstone's prescription. It reads "was renamed to allowEnvironmentOverlay (ADR-0131 D6)", and the changeset ships major on the 18.0.0-next line. The TSDoc's "in 18" names the protocol major and stays.
Restore the history comment at sys-metadata-repository.ts:2034. It records a commit that rolled back allowOrgOverride, so it keeps the name of its time.
Update the PR body through the relay (one issue_patch): the post-pin head under Readings and Verification, and a pin section.
Re-verify:
- the spec and metadata-protocol suites the merge could move, S1's five-type file and the wire pin;
- check:generated, check:api-surface and check:authorable-surface, and check:future-spec-major (it refused "18" before, so show it green on the dropped version word);
- dispatch-gates.mjs --commands re-derived at the new head (no paths), run, and reconciled with --ran;
- the PR-context guards wired to PR feat(spec,metadata-protocol)!: rename the type registry's allowOrgOverride to allowEnvironmentOverlay, on the registry and on GET /meta/types #22874.
Then one os-dev-report comment on spec: rename allowOrgOverride to an environment-overlay key with an ADR-0087 load-time conversion (ADR-0131 C5's spec half, split from #15206 per #22007 ruling C) #22340.

After the report: the seat reviews the hop, then commissions the contract review at CONTRACT_REVIEW_TIER on the post-pin head, which is this PR's landing record, and then queues it. ⛔ The PR stays draft until then.

Round terms: the claim 6109485204, the branch claude/issue-22340-s2-rename and the worktree /home/user/objectstack-issue-22340-s2 (re-create it from the branch if it was removed), and the verify lock with slot issue-22340-s2. Every ⛔ of the dispatch holds. The write budget is git push, one issue_patch on PR #22874's body, and one os-dev-report comment. ⛔ No MCP GitHub write tool.

Generated by Claude Code

os-dev-report

{
  "issue": 22340,
  "status": "done",
  "branch": "claude/issue-22340-s2-rename",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/22874",
  "session": "session_01KNKBCRDJCu5tGy3TEbvtrF (subagent of the PM session; the id the claim's Session line carries). Identity re-checked through REST at the start of the round: 19 card comments, the newest Claim: is 6109485204 and it names branch claude/issue-22340-s2-rename.",
  "premise_still_valid": true,
  "summary": "The pin round on draft PR #22874, final head 49ef13a518 (6 commits over 088afc6798). (1) origin/main merged at 018b077fbf through scripts/pm/os-regen-merge.sh: two hand-written conflicts (email-template.zod.ts header, liveness/README.md adjacent rows) resolved by stacking both intents, and the deferred content/docs/references/system/email-template.mdx regenerated as the step-3 commit; step 4's check:generated found nothing else stale. (2) .objectui-sha moved 4997995022f8 -> e5311165a8d6 (the merge of objectui#12168, carrying objectui#12141) in PR #22794's shape: console-e5311165a8d6.md (bump-objectui.sh, ADR-0087 not-required with each of the 4 declared-breaking objectui changes answered), objectui-pin-citations-e5311165a8d6.md (spec patch, Clause-② no), sdui.manifest.json + record regenerated, sdui-parser lockstep re-recorded, all 55 asserting pin citations re-measured, content/docs/references/ui/view.mdx regenerated. (3) The tombstone prescription reads 'was renamed to `allowEnvironmentOverlay` (ADR-0131 D6)'; the TSDoc's 'in 18' stays. (4) sys-metadata-repository.ts:2034 names allowOrgOverride again, the key commit ee58392e1 rolled back. (5) PR body updated with one issue_patch: post-pin head under Readings and Verification, a pin section, the stale 'do not land alone' and 'Not in this PR: .objectui-sha' text replaced. (6) Re-verified, below. The Console Pin Gate's steps pass locally, and on a booted backend the pinned console reads this PR's /meta/types: packaged view and dashboard items open writable, packaged flow and object items locked.",
  "tests": "All at head 49ef13a518. @objectstack/spec: typecheck exit 0; test (local, --maxWorkers=3) 649 files / 19398 passed, 1 todo; repo project (absence pin, retired-key-migrate-sentence, step18-rationale-merge) 3 files / 26 passed. @objectstack/metadata-protocol: test 226 files passed, 3 skipped / 28171 tests passed, 19 skipped; typecheck exit 0 (first lock attempt 99 queue-timeout, retaken with the same slot). @objectstack/objectql: S1's environment-overlay-five-types.test.ts + the wire pin protocol-meta-types-rich.test.ts, 2 files / 33 passed. Built first: turbo run build --filter=@objectstack/example-showcase... (61 tasks, exit 0). check:generated exit 0 (14 artifacts up to date against that dist); check:api-surface 'public API surface + factory signatures unchanged'; check:authorable-surface exit 0 (base.json trails 018b077fbf88, information line; authorable-defaults 1123 defaults unchanged); check:future-spec-major exit 0 ('no @objectstack/spec citation names a major above 17', 29 self-test cases). Console Pin Gate, locally: turbo run build --filter=@objectstack/client... exit 0; scripts/build-console.sh exit 0 at e5311165a8d6 (OBJECTUI_ROOT = a scratch clone; bundle canary import/jobs present; one zod literal {major:4,minor:6,patch:5}; 'Console bundle carries THIS tree's @objectstack/spec, and only it', 33 of 34 injected-only describes present, all 26 published-only absent); check:console-sha exit 0; check:console-injection --require-stamp exit 0, stale detector 'Allow per-org overlay writes via runtime metadata API' (the published describe of the retired key) absent. Wire probe: pnpm dev -- --fresh -p 38977 on this head; GET /api/v1/meta/types (signed in) 200 with 34 entries, 34 carry allowEnvironmentOverlay, 0 carry allowOrgOverride, true exactly for view, dashboard, report, translation, email_template (overrideSource registry); headless Chromium (Playwright 1.63, /opt/pw-browsers/chromium) on /_console/apps/setup/metadata: view showcase_task.in_progress and dashboard showcase_chart_gallery show the 'writable' badge and an editable designer; flow showcase_task_completed and object showcase_account show 'create-only' and 'This item is locked'; no page text names allowOrgOverride; server stopped by its port, tempdir gone. Console bundle: app chunks read .allowEnvironmentOverlay 15 times (metadata-admin 10, packagedActions 2, src 3), allowOrgOverride occurs 4 times, only in vendor-objectstack (this tree's spec tombstone and prescription). Pin citations: check:objectui-pin-citations exit 0 and --verify-anchors exit 0 with OBJECTUI_ROOT at the pin: 55 asserting citations match e5311165a, 13 anchor content assertions verified, 145 historical. sdui: check:sdui-lockstep exit 0 (214 grammar lines, 25 codes, predicate unchanged); check-sdui-manifest --require-objectui exit 0. check-adr-0087-registration --base origin/main exit 0 (2 declared-breaking changesets: registered metadata-type-registry-allow-org-override-renamed; console not-required (no-migration-prescription)).",
  "mcp_calls": "0 — no MCP tool called",
  "api_writes": "2 REST writes through scripts/pm/, plus git push (not REST): (1) issue_patch on PR #22874's body through the fleet-write relay, PATCH /repos/objectstack-ai/objectstack/issues/22874 (request fw-20261012T045039Z-35f677, run 38205432499 success; read-back 18363 bytes sent / 18363 stored, identical; re-read after: draft true, head 49ef13a518, assignee zhuangjianguo unchanged); (2) this os-dev-report comment, POST /repos/objectstack-ai/objectstack/issues/22340/comments via post-stamped.mjs. git push x3, never forced: 088afc6798..fa5dcbd066, ..2e15086180, ..49ef13a518. The card's assignee and labels, and the PR's labels and assignee, were not written.",
  "open_questions": [],
  "out_of_scope_findings": [
    "class: a · reach: pnpm check:platform-checklist exits 1 on origin/main as on this head, now 8 findings; the 7 the seat dropped in 6112246741 (the #22758 family) plus a new one: docs/qa/platform-checklist/areas/search.json cites packages/metadata-protocol/src/protocol.ts#countable, and main's #22857 (55382dc02a, 'a paged search reports the counted total') removed that symbol (countable reads 0 in protocol.ts at origin/main and at 49ef13a518; 1 declaration at 12b9daf749). This PR touches neither file; both are byte-identical to main. Same family as #22758, so reported for the seat's disposition, not filed. dedupe words: platform-checklist ABSENT SYMBOL countable search.json; protocol.ts#countable; symbol anchors 22857",
    "carrier: S3 of this card · noted, not filed. The governed text still names the old key (AGENTS.md Prime Directive 7, skills/objectstack-ai/SKILL.md, ADR-0005)."
  ],
  "gates": "dispatch-gates --commands --repo objectstack-ai/objectstack (no paths) at 49ef13a518: 155 commands. 153 run, 2 NOT MEASURED (check:dual-build-cjs-loads: no whole-workspace build, by order; check:type-check-debt: the derived command is check-type-check-coverage.mjs --re-measure, which the order forbids). --ran reconciliation: '155 derived, 153 run, 2 NOT-MEASURED, 0 UNRUN' (exit 0). Exit codes: 152 x 0, check:platform-checklist x 1 (pre-existing on main, out_of_scope_findings). check:skill-examples first exited 3 (PREREQUISITE NOT MET: @objectstack/client-react unbuilt), then 0 after that package was built; the record carries the final run. check:pm-dispatch-gates (fast tier) 1828 cases pass, exit 0. Artifact rosters (41) with PR_NUMBER=22874, PR_HEAD_REF, PR_BODY, GITHUB_REPOSITORY (and NODE_USE_ENV_PROXY=1 for the guards' reads): 41 x exit 0 after two reruns (check:published-readme-exports exit 3 until 5 packages were built; check:select-shard-packages' self-test failed only on the proxy warning that variable prints, rerun without it exit 0). After the body patch, check-closing-target-claim, check-partof-closing-keyword and check-single-claim-paths re-run with the stored body: 3 x exit 0 ('PR #22874 claims .objectui-sha, and no EARLIER open PR does'). CI-only lanes (shard attestation, test completeness, Build Core / Docs, the workspace type-check program, Temporal Conformance) are declared to CI.",
  "pin_hop": "objectui 4997995022f8..e5311165a8d6: 24 commits, all non-merge squashes, linear; 287 paths (214 M, 69 A, 4 D, 0 R), +13412 / -2428. Deleted: StudioHomePage.tsx, its two tests, permission-set-clone-dispatch.ts (no spec record cites any). objectui 4baa8a67c4 (objectui#12170, slotsForType stops reading the retired flow-template ledger role) is INSIDE the hop, two commits below the tip: merge-base --is-ancestor 4baa8a67c4 e5311165a8 exit 0; --is-ancestor 4baa8a67c4 4997995022f8 exit 1; clone not shallow; control leg d32869883b (50 commits below the old pin) --is-ancestor of the old pin exit 0. Its changeset (12170-flow-template-role.md) is release-nothing, so the console changeset counts it among '2 release-nothing changesets' rather than listing it. Cited files changed on the hop: ObjectGrid.tsx (+27/-11, objectui#12110, objectui#12143), data-table.tsx (+12/-1, objectui#12124, objectui#12145), form.tsx (+228/-79, objectui#12110, objectui#12130, objectui#12155), record-related-list.tsx (+22/-3, objectui#12082), data-objectstack/src/index.ts (+59/-13, objectui#12112), and the en/zh/de packs (calendar.configRequired unchanged). Moved anchors: selection block 4981-5008 -> 4997-5024 (hash c88443302d40 both), delete verdict :1787 -> :1793, promoted params :5165-5184 -> :5181-5200 (called :5200 -> :5216), keyboardNavigation read 5615 -> 5631 (15 hit lines vs 3 control at both pins), inlineEditable :1851 -> :1857, data-table 1018/2607/3101/2257/2283 each +7, empty-state reads 6632-6633 -> 6648-6649 and 6649-6650 -> 6665-6666, spanLadderFor 274-301 -> 275-302 and its call 3258 -> 3326, related-list gate anchors 361/379/415/428/428-436 each +17, translateFilterArray arm 5051-5062 -> 5066-5077 (serializeOrderBy 869-895 held). Migration entries: corpus 8441 -> 8506 tracked files; 124 candidate zero tokens zero at both pins; Span 517 -> 519 (both new hits colSpan), SpanSchema 57; controls objectstack 18271 -> 18355, @objectstack/spec 7587 -> 7599, timeout 1704 -> 1706, useState 2648 -> 2659, RuntimeConfig 352 -> 357, window 4604 -> 4614, tenant 1362 -> 1365 (TTL 184, period 251, interval 238, metrics 456, resourceLimits 2 unchanged). Manifest: 107 components, one input description changed (record activity feed showCompleted, objectui#12106).",
  "deviations": [
    "Builds: no pnpm build, but the round built the showcase closure (61 tasks) and then eight packages outside it by name (client-react, embedder-openai, knowledge-memory, knowledge-ragflow, organizations, service-knowledge, studio, service-cluster-redis) for two gates' unmet prerequisites and for the wire boot, which together leave every workspace package built. check:dual-build-cjs-loads stays NOT MEASURED as ordered.",
    "check:type-check-debt was NOT run this round (round 1 ran it and flagged the same conflict): the derived command is itself the --re-measure the order forbids. Declared NOT-MEASURED in the --ran record.",
    "The PR body patch stored byte-identical with NO footer (the readings predict a +58 bare footer on PATCH /issues; none was appended). The old session-URL footer went with the old body, so attribution now lives in the body's last prose line (session id, claim, order).",
    "main moved 9 commits after the merge (origin/main 51b43a8dc4 at derivation); not re-merged. git merge-tree --write-tree HEAD origin/main is clean; none of those commits adds a line naming either key or an asserting pin citation. #22895 touches four files this PR touches (authorization.mdx, security-plugin.ts, rest-server.ts, runtime meta.ts), textually clean. dispatch-gates flags the tree as stale for 8 tooling files it derives from.",
    "The roster's PR_BODY was the draft body at run time; the three PR-context guards were re-run with the stored body after the patch (all exit 0).",
    "To keep the shared /home/user/objectui untouched, bump-objectui.sh and build-console.sh ran with OBJECTUI_ROOT at a temporary clone in the scratchpad (build-console.sh's own fallback would add a git worktree inside ../objectui). The clone is deleted.",
    "The stray /closure-build.pid at the filesystem root (round 1's) is still there; this round did not touch it.",
    "The worktree is removed after this report (node_modules first, then git worktree remove without --force); a next round resumes from origin/claude/issue-22340-s2-rename at 49ef13a518."
  ],
  "files_changed": "Round 2 wrote 28 files (the other PR files the merge moved carry main's changes). Pin (21): .objectui-sha; .changeset/console-e5311165a8d6.md; .changeset/objectui-pin-citations-e5311165a8d6.md; sdui.manifest.json; scripts/sdui-manifest.record.json; packages/sdui-parser/objectui-lockstep.json; content/docs/references/ui/view.mdx; six packages/spec/src/migrations/entries/semantic/18.*-unit-in-key.ts entries (kernel-health-check-and-hot-reload-durations, kernel-runtime-config-timeout, logging-durations, system-metrics-jsdoc-durations, system-tracing-otel-exporter-durations, tenant-schema-cache-ttl); packages/spec/src/data/api-methods-batch-conformance.test.ts; packages/spec/src/kernel/functional-completeness.ts; packages/spec/src/ui/action-outcome-messages.test.ts, action.zod.ts, component.test.ts, component.zod.ts, dataset.zod.ts, view.zod.ts. Items 3/4 (4): packages/spec/src/kernel/metadata-plugin.zod.ts, its retirement pin, content/docs/references/kernel/metadata-plugin.mdx, packages/metadata-protocol/src/sys-metadata-repository.ts. Merge resolution (3): packages/spec/src/system/email-template.zod.ts, packages/spec/liveness/README.md, content/docs/references/system/email-template.mdx.",
  "size": "162 files, +1509 / -649 = 2158 changed lines, generated included (GitHub's PR count at 49ef13a518 agrees: 1509 / 649 / 162). Under the 3,000 line. The pin round's own 21 files: +350 / -79."
}

Report written 2026-10-12T04:55Z; final head 49ef13a.

Generated by Claude Code

✅ ACCEPT, the pin round: PR #22874 at `49ef13a518` (#22340 S2). The contract review at `CONTRACT_REVIEW_TIER` on this post-pin head runs next, as the landing record

domain:spec seat 3 (#18883) · zhuangjianguo · session session_01KNKBCRDJCu5tGy3TEbvtrF · 2026-10-12T04:57Z · holder of claim 6109485204. Seat review of round 1: 6112246741. Order: 6117020961. Report: 6118005809. Thread-read: 6118005809.

Read on GitHub and in git, not from the report:

The pin: .objectui-sha reads e5311165a8d6aa77b5cb7d9fd05da8451a2c21aa, the merge of feat(app-shell): metadata-admin reads /meta/types allowEnvironmentOverlay; the read-only banners name OS_METADATA_WRITABLE (objectui#12141) objectui#12168, which carries objectui#12141.
- The hop is 24 objectui commits and 287 paths. objectui 4baa8a67c4 (the retired flow-template role) is inside it.
- The bump follows PR feat(spec): the position form picks permissionSets from the permission-set registry (ref-multi:permission), with the console pin moved to 4997995022f8 #22794's shape: the console and pin-citations changesets, the sdui manifest and its record, the lockstep, 55 re-measured citations, and view.mdx regenerated.
Seat review item 1: the tombstone prescription reads "was renamed to allowEnvironmentOverlay (ADR-0131 D6)". The version word is gone, and check:future-spec-major exits 0.
Item 2: sys-metadata-repository.ts's history comment names allowOrgOverride again, the key of its time.
Item 3: the PR body is rewritten for the post-pin head.
The merge of main (018b077fbf, through os-regen-merge.sh): two hand conflicts, in the email-template.zod.ts header and adjacent liveness/README.md rows, are resolved keeping both sides, and the deferred email-template.mdx is regenerated. main has since moved 9 commits, and git merge-tree against it is clean.

Evidence accepted:

spec 649 / 19,398, and metadata-protocol 226 files / 28,171 tests;
S1's five-type file and the wire pin, 33 / 33;
check:generated, check:api-surface and check:authorable-surface exit 0;
the Console Pin Gate's steps, run locally: the console builds at e5311165a8 and carries this tree's spec only, and the injection check's stale detector (the old describe) is absent from the bundle;
the wire probe on a booted showcase: all 34 /meta/types entries carry allowEnvironmentOverlay and none carries allowOrgOverride. The true set is exactly view, dashboard, report, translation and email_template. In headless Chromium, packaged view and dashboard items open writable, and packaged flow and object items open locked;
gates: 155 derived and 153 run. The two NOT MEASURED are as dispatched, and the one red is the platform-checklist (below). The rosters and PR-context guards are green;
CI at 49ef13a518: running at this act, with no failure so far;
size: 2,158 changed lines across 162 files, of which the pin round's own share is 21 files (+350 / −79). That is under the human-merge line.

Out-of-scope findings:

check:platform-checklist: dropped. Its new eighth anchor (search.json cites protocol.ts#countable, which main's fix(objectql,metadata-protocol,spec): a paged search reports the counted total #22857 removed) is the same family triage closed not_planned on check:platform-checklist is red on main #22758. This PR touches neither file.
The governed text: S3 of this card, as planned.

Order kept: with this PR the next .objectui-sha move on main is e5311165a8. Any other bump past it before this PR lands would turn the five types read-only in Studio, and no open PR touches the pin at this stamp.

Generated by Claude Code

Release: #22340 back to `pm:queue`. S2's PR #22874 is in the merge queue; following it to MERGED and S3 go to the next `domain:spec` seat

domain:spec seat 3 (#18883) · zhuangjianguo · session session_01KNKBCRDJCu5tGy3TEbvtrF · 2026-10-12T05:24Z · holder of claim 6109485204, released by this act. Thread-read: 6118028021.

The maintainer's words, in this session's chat:

「当前任务处理完，合并后就下班」;
then, with the week's usage at 3%: 「后续如果有契约复审可以交给总监。」 and 「后续的改进也可以交接给下一pm」.

S2's state: PR #22874 at 49ef13a518.

The contract review at CONTRACT_REVIEW_TIER is PASS (6118257575).
The pre-queue record is 6118279846. pr_ready and automerge_enable ran at 2026-10-12T05:24Z, and CI is green (42 / 42).

Owed by the next seat:

Follow PR feat(spec,metadata-protocol)!: rename the type registry's allowOrgOverride to allowEnvironmentOverlay, on the registry and on GET /meta/types #22874 to MERGED. If the queue ejects it, the head has to be re-read, and .objectui-sha must still be e5311165a8. No other PR may move the pin past e5311165a8 before this one lands, or Studio's five overlay types turn read-only.
After the merge:
- the content check: the PR's paths blob-equal to 49ef13a518, or each equal to a git merge-tree of the parent with that head;
- the landing note;
- the mis-close scan (the body says Part of #22340).
S3, the governed text (Tier H):
- AGENTS.md PD7, skills/objectstack-ai/SKILL.md and ADR-0005 still name allowOrgOverride;
- the contract review's comment slip in protocol.ts above getMetaTypes ("no entry carries allowEnvironmentOverlay" should name allowOrgOverride) rides the next change to that file.
cloud's two test helpers stay on this card (6109343061 item 5) until a seat that can reach cloud files them.

Release: session_01KNKBCRDJCu5tGy3TEbvtrF · why: the maintainer's stand-down and hand-over words above (this session's chat) · to: pm:queue, unassigned. Resume-from: claude/issue-22340-s2-rename@49ef13a518. This act moves the card pm:dispatched → pm:queue and removes the assignee zhuangjianguo.

Generated by Claude Code

Claim: PM loop round 1 (#22340: take over from seat 3's release 6118293260; follow S2's PR #22874 to MERGED and do its landing duties; S3, the governed text, is claimed separately when its time comes) · 2026-10-12T05:47Z
Session: session_019G5ZnRrTMiwcHG6iZM19zf
Account: os-warren (the seat's linked user as GET /user answers it; the card's assignee from this act)
Branch: claude/issue-22340-s2-rename
Worktree: objectstack-issue-22340-s2 (none created by this seat: no edit is planned)
Domain: domain:spec
Seat: domain:spec#1 (seat post #6017)
Resume-from: claude/issue-22340-s2-rename@49ef13a518
File surface: none new. PR #22874's 162 paths stand as seat 3's claim 6109485204 declared them. This seat writes nothing to the branch. If the queue ejects the PR and a head change is needed (a main merge), it goes through the relay's pr_update_branch or a dispatched dev, declared here first. ⛔ No other PR moves .objectui-sha past e5311165a8 before this one lands (release item 1).
Container & model: seat-executed landing follow-up, no dev dispatched (model: n/a). The contract review at CONTRACT_REVIEW_TIER is PASS (6118257575) on 49ef13a518.
Clause-②: yes (narrowing: retires an authorable registry key and a wire field; tombstone + retired-keys + D3, no D2)
Responsibility: n/a — not a defect card (ADR-0131 C5's spec half, split from #15206 per #22007 ruling C)
Thread-read: 6118293260
Serial constraints cleared:

PR feat(spec,metadata-protocol)!: rename the type registry's allowOrgOverride to allowEnvironmentOverlay, on the registry and on GET /meta/types #22874 is in the merge queue (added_to_merge_queue 2026-10-12T05:25Z on the PR's timeline). The queue is walled by ci: merge-queue Test Core reds on the new suite-duration ceiling — @objectstack/cloud-connection measured 177.5 s and 200.3 s vs its 163.89 s ceiling, in two groups of PRs that do not touch it (live since 1bd612bd6) #22949 (p1, needs-user-decision); if the PR is ejected on that signature, it is held out of the queue under the same rule as this seat's PR feat(spec)!: refuse a duplicate name inside one stack’s functions array (#22902) #22931 and PR fix(lint): one-line fix lines for 18 more author-time rule ids; os explain RULE_ID carries what they explained #22936.
This seat's [finding] email_template.category and email_template.isSystem have no consumer once templates resolve from the registry: retire both in the next enforce-or-remove batch #22876 batch PR waits for this PR's pin to land before its own .objectui-sha bump card (claim 6117767270).

This act moves the card pm:queue → pm:dispatched and assigns os-warren.

Correction (edited in later): the premise of this transition was wrong. PR #22874 was never ejected and merged at 2026-10-12T06:14Z as e23eccb164. See the landing record on this card.

Transition: `pm:dispatched` → `pm:blocked` on #22949. S2's PR #22874 was ejected from the merge queue by the queue-wide ceiling step

domain:spec seat 1 (#6017) · os-warren · session session_019G5ZnRrTMiwcHG6iZM19zf · 2026-10-12T06:10Z · holder of claim 6118530329.

What happened: PR feat(spec,metadata-protocol)!: rename the type registry's allowOrgOverride to allowEnvironmentOverlay, on the registry and on GET /meta/types #22874 (accepted 6118028021, contract review PASS 6118257575, queued 6118293260) left the merge queue at 2026-10-12T05:53Z: queue run 38207850018, Test Core red on "Check the per-package suite-duration ceilings" (four packages over their ceilings, three of them outside the diff) and on shard 6/6's timing-drift step. The same head's PR-time Test Core is green. The triage is on the PR.
Why blocked, not re-queued: ci: merge-queue Test Core reds on the new suite-duration ceiling — @objectstack/cloud-connection measured 177.5 s and 200.3 s vs its 163.89 s ceiling, in two groups of PRs that do not touch it (live since 1bd612bd6) #22949 is the open anchor for this red (p1, needs-user-decision). Until it is resolved a re-queue only burns another queue round.
Body: the stale Blocked-by: #15206 line (feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 closed 2026-10-11T16:41Z, completed) is replaced by Blocked-by: #22949 and Unlock-action: re-check PR #22874.
After ci: merge-queue Test Core reds on the new suite-duration ceiling — @objectstack/cloud-connection measured 177.5 s and 200.3 s vs its 163.89 s ceiling, in two groups of PRs that do not touch it (live since 1bd612bd6) #22949 resolves: re-read PR feat(spec,metadata-protocol)!: rename the type registry's allowOrgOverride to allowEnvironmentOverlay, on the registry and on GET /meta/types #22874's head, run the pre-queue checks, then pr_ready + automerge_enable and confirm the added_to_merge_queue event. A new head (a main merge) needs a green run first, and keeps the PASS only under contract-review.md's regen exception.
Knock-on: .objectui-sha stays pinned at or before objectui e5311165a8 until this PR lands. The pin-bump card for [finding] email_template.category and email_template.isSystem have no consumer once templates resolve from the registry: retire both in the next enforce-or-remove batch #22876's objectui companion waits for it.
The assignee stays: this seat follows PR feat(spec,metadata-protocol)!: rename the type registry's allowOrgOverride to allowEnvironmentOverlay, on the registry and on GET /meta/types #22874 to MERGED, then S3 (the governed text).

Landed: PR #22874 → `e23eccb164` (S2, `Part of #22340`). Correction: this seat's ejection reading and its `pm:blocked` transition were wrong. The card goes back to `pm:queue` for S3

domain:spec seat 1 (#6017) · os-warren · session session_019G5ZnRrTMiwcHG6iZM19zf · 2026-10-12T07:44Z · holder of claim 6118530329, released by this act.

Correction. PR #22874 was never ejected. It merged through the merge queue at 2026-10-12T06:14Z, about four minutes after this seat's comment 6118772668 called it ejected.

The seat read two signals: the queue-triage comment on build 38207850018, and an empty auto_merge field. It moved this card to pm:blocked on ci: merge-queue Test Core reds on the new suite-duration ceiling — @objectstack/cloud-connection measured 177.5 s and 200.3 s vs its 163.89 s ceiling, in two groups of PRs that do not touch it (live since 1bd612bd6) #22949 (6118789810).
The timeline already held the deciding reading, and it said otherwise: no removed_from_merge_queue event followed added_to_merge_queue (05:25Z). The failed build did not take it out of the queue, and the merge came at 06:14Z.
The two comments and the ci: merge-queue Test Core reds on the new suite-duration ceiling — @objectstack/cloud-connection measured 177.5 s and 200.3 s vs its 163.89 s ceiling, in two groups of PRs that do not touch it (live since 1bd612bd6) #22949 sighting 6118802485 now carry a correction line, and PR feat(spec,metadata-protocol)!: rename the type registry's allowOrgOverride to allowEnvironmentOverlay, on the registry and on GET /meta/types #22874's body no longer says "held". Nothing else acted on the wrong reading: the seat did not re-arm, convert or re-queue anything.
Lesson for this seat's record: a queue ejection is read only from a removed_from_merge_queue event. A triage comment and an empty auto_merge are not readings of it.

Landing checks:

On main: e23eccb164 is an ancestor of origin/main. It is the squash of the PR onto 21914c3fb.
Content: the reviewed head's diff and the landed commit's diff have one stable patch-id, b737e262cdc9; both are 162 files, +1,509 / −649. Four PR paths differ between 49ef13a518 and e23eccb164: authorization.mdx, security-plugin.ts, rest-server.ts and domains/meta.ts. In each, the difference is exactly main's own change from 018b077fb to 21914c3fb.
Pin: .objectui-sha on main is objectui e5311165a8, moved by this commit, so objectui's metadata admin and the renamed wire field ship together. Later pin bumps are free to move past it.
Mis-close scan: the body says Part of #22340 and has no closing keyword; neither has the squash message. No issue in this repository closed between 06:10Z and 06:25Z. spec: rename allowOrgOverride to an environment-overlay key with an ADR-0087 load-time conversion (ADR-0131 C5's spec half, split from #15206 per #22007 ruling C) #22340 stays open.
The review chain: ACCEPT 6118028021, contract review PASS 6118257575 on 49ef13a518, pre-queue record 6118279846.

What now holds (@objectstack/spec and @objectstack/metadata-protocol major in pre mode next): DEFAULT_METADATA_TYPE_REGISTRY and GET /meta/types carry allowEnvironmentOverlay, and allowOrgOverride is gone from both.

For S3 (seat 3's release 6118293260 item 3, unchanged): the governed text (Tier H). AGENTS.md PD7, skills/objectstack-ai/SKILL.md and ADR-0005 still name allowOrgOverride. The contract review's comment slip in protocol.ts above getMetaTypes rides the next change to that file. Cloud's two test helpers stay on this card (6109343061 item 5) until a seat that reaches cloud files them.

Release: session_019G5ZnRrTMiwcHG6iZM19zf · why: a partial landing (Part of #22340) · to: pm:queue, unassigned. Resume-from: none (S3 starts from main). This act removes the body lines Blocked-by: #22949 and Unlock-action: re-check PR #22874, moves the card pm:blocked → pm:queue, and removes the assignee os-warren.

`pm:retriage`: which lane takes S3? Its whole surface is governed text

domain:spec seat 1 (#6017) · os-warren · session session_019G5ZnRrTMiwcHG6iZM19zf · 2026-10-12T07:55Z. ⛔ Not a claim. This card is pm:queue, undispatched, released at S2's landing (6119966926).

S3, as seat 3's release 6118293260 item 3 states it, re-read on origin/main in this act (git grep -n allowOrgOverride):

AGENTS.md:191 ("Org overlay opt-in lives only in allowOrgOverride").
skills/objectstack-ai/SKILL.md:347 (allowOrgOverride:false). This is published skills/**, which has no one-line exemption.
docs/adr/0005-metadata-customization-overlay.md: 13 lines (:47, :68, :515–:537, :596, :704–:728).
Not on the release's list: docs/adr/0010-metadata-protection-model.md, 7 lines (:19, :31, :94, :119–:122, :190, :297).
Non-governed residue, for the record:
- packages/metadata-protocol/src/protocol.ts:16057 (the review's comment slip) and sys-metadata-repository.ts:1768 / :2034, all code comments recounting history;
- content/docs/concepts/metadata-lifecycle.mdx:107;
- four docs/qa/platform-checklist/areas/*.json files;
- test names and fixtures in metadata-protocol, objectql and rest.
- The generated metadata-plugin.mdx row already says [REMOVED].

Why ask: every S3 path is governed (Tier H). By the anchoring rule, domain:* is the landing surface's lane, and the governed surface is domain:skills'. The card is domain:spec because S1 and S2 landed in packages/spec and metadata-protocol. Seat 3 planned S3 for "the next domain:spec seat", but which lane takes a cross-domain stage is triage's call, not a seat's.

What this seat asks (one answer):

Which lane claims S3: domain:skills (the governed surface's lane), or this lane under the cross-domain exception path?
Whether the ADRs are edited in place, or carry an amendment note under their own convention. ADR-0005 and ADR-0010 record history, and several lines describe what the field was at the time.
Whether the non-governed residue rides S3 or goes to a separate PR in its own lanes.

Whichever lane takes it: the build is CONTRACT_REVIEW_TIER (clause ① for skills/**), with a net line budget for skills/**, the Tier H terminal steps (maintainer quick-read, review requests to both approvers), and no queue before an authorised approval.

Triage answers `pm:retriage` `6120116026`: S3 goes to `domain:skills`. The ADRs take a header amendment note, and the residue owes nothing

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-12T09:04Z. ⛔ Not a claim, ⛔ not a dispatch. Thread-read: 6119966926, 6120116026. Re-read on origin/main 6a40a09ed9.

1. The lane is domain:skills, not the cross-domain exception.

The anchoring rule takes domain:* from where the fix lands (pm-dispatch/SKILL.md, 域车道). S3 lands only in governed paths: AGENTS.md, skills/** and docs/adr/**. The lane table gives the governed surface to domain:skills in full.
The cross-domain exception path is for a cross-domain PR that cannot be split. S3 has one domain, so the exception does not apply.
domain:spec came from S1 and S2, which landed in packages/spec and metadata-protocol. It is replaced by domain:skills. priority:p1 and target:v18 stand: the published skills/objectstack-ai/SKILL.md:347 teaches the retired key to v18 readers.

2. The ADRs get a header amendment note. Their history lines stay as written.

ADR-0005 already has this convention: its "v5.0 update" note at the top records the project→environment rename, and the body was not rewritten.
So ADR-0005 and ADR-0010 each get:
- a note at the top saying the key is allowEnvironmentOverlay from protocol 18 (ADR-0131 C5, spec: rename allowOrgOverride to an environment-overlay key with an ADR-0087 load-time conversion (ADR-0131 C5's spec half, split from #15206 per #22007 ruling C) #22340);
- an Amended by entry naming ADR-0131.
Lines that describe what the field was at the time are not edited.
AGENTS.md:191 (rule 7) and skills/objectstack-ai/SKILL.md:347 are normative. They are edited in place.

3. The residue does not ride S3, and none of it is owed.

content/docs/concepts/metadata-lifecycle.mdx:107 already names the old spelling as history ("spelled allowOrgOverride before protocol 18").
The four docs/qa/platform-checklist/areas/*.json hits are all revision-history change notes, which record past runs.
The code comments recount history. The test names and fixtures pin the retirement and the older rollbacks.
The protocol.ts comment slip (:7762, "no entry carries allowEnvironmentOverlay") rides the next change to that file, as the contract review said.
⛔ Even if something were owed, it could not ride S3: a diff that mixes governed and other paths is judged whole at Tier H.

For the domain:skills seat: the build terms in 6120116026 stand: CONTRACT_REVIEW_TIER (clause ① for skills/**), the net line budget for skills/**, and the Tier H terminal steps. No queue before an authorised approval.

pm:retriage is removed. The card stays pm:queue, unassigned.

Claim: PM loop round 1 (#22340 S3 — the governed-text half of the allowOrgOverride → allowEnvironmentOverlay rename, routed to this lane by triage 6121122315) · 2026-10-12T09:10Z
Session: session_01CinRQcE6T8SvMbhH8D3NhS
Account: huangyiirene (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-22340-s3-governed-text-rename
Worktree: objectstack-issue-22340
Domain: domain:skills
Seat: domain:skills#1
File surface: AGENTS.md (rule 7, line 191 on origin/main 74c4b3435, edited in place), skills/objectstack-ai/SKILL.md (line 347, in place; published catalog, token ratchet), docs/adr/0005-metadata-customization-overlay.md and docs/adr/0010-metadata-protection-model.md (a header amendment note each plus an Amended by entry naming ADR-0131; history lines untouched) (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: ceiling — this run's --tier on the four paths printed 「Model tier — MANDATORY: … (derived from the file surface, not recalled)」 for skills/objectstack-ai/SKILL.mdunder clause ① (the 2026-09-10 ruling 「必须 fable的还包括对外发布的skills」); the ceiling is CONTRACT_REVIEW_TIER; no one-line exit exists forskills/**Clause-②: no — S3 changes governed text only (AGENTS.md, one published skill line, two ADR headers); the published-surface widening of this card (the new key and the renamed wire field) landed in S2, PR #22874, under its own contract review PASS6118257575Responsibility:n/a — not a defect card(the governed-text half of a ruled rename) Thread-read: 6121122315 Ruling-ref:6073921182 (batch #297 item 1, Q1 A · Q2 A, maintainer 「同意」; fetched in this act) on the direction of #22007 letter C (6028809298); the S3 shape is triage's routing 6121122315(header amendment notes, in-place edits of the two normative lines, no residue) Resume-from: none (S3 starts frommain; S2 is e23eccb) Serial constraints cleared: AGENTS.md is shared with #22998 (os-zhuang, in flight; its claim names the merge-queue required-set paragraph and the gates section, not rule 7) — region-disjoint, so parallel under the four-point discipline: merge mainbefore the PR opens and again after that sibling lands; no otherpm:dispatched claim names these four files (claim threads grepped 2026-10-12T09:10Z: #22991, #15953, #15213 hit only in prose); none of the open PRs changes them (files lists read); #22978 (pm:blocked) will later touch other ADRs, not 0005/0010; newest touches 7873a05(AGENTS.md, 2026-10-11) andbf515e7(the skill, 2026-10-11), both merged Delivery shape:Part of #22340 (S3), ⛔ not Fixes — cloud's two test helpers (6109343061` item 5) stay on the card for a seat that reaches cloud

Generated by Claude Code

docs(governed): record the allowOrgOverride → allowEnvironmentOverlay…

os-dev-report

{
  "issue": 22340,
  "status": "done",
  "branch": "claude/issue-22340-s3-governed-text-rename",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/23011",
  "session": "session_01CinRQcE6T8SvMbhH8D3NhS",
  "premise_still_valid": true,
  "summary": "S3 of the allowOrgOverride → allowEnvironmentOverlay rename — governed text only — is in draft PR #23011 (head 7362ce1 = 5963d2cf6 merged with origin/main 6a7eca686; 5 files, +18/−4). AGENTS.md rule 7 and skills/objectstack-ai/SKILL.md:347 name the new key in place at the same line count (AGENTS.md 1109 lines under its 1116 ceiling, unchanged; the skill 5540 → 5541 tokens under its 6806 ceiling, no deletion needed). ADR-0005 and ADR-0010 each gain a 'Protocol 18 update (2026-10-12, ADR-0131 C5, #22340)' blockquote note at the top, written in ADR-0005's own v5.0-note voice and copied verbatim to ADR-0010, plus an Amended-by entry naming ADR-0131 C5 / D6 (ADR-0010's header block gains the line); their 12 + 9 history lines naming the old key are untouched. A '@objectstack/skills': patch changeset carries the published skill line (the package is in the fixed group; pre mode next; precedent PR #22846). Premises held on origin/main 74c4b3435 with one count corrected: ADR-0005 has 12 matching lines, not 13. #22998 had not landed at the merge and main touched none of the four files. Tier H: draft only, maintainer speed-read section in the body, no ready flip, no label write; the claim 6121201470 names this branch and no second claim was posted.",
  "tests": "No package source touched, so no package test or typecheck is owed and no ablation applies (no mechanism changed). node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 53 commands (41 at claim time; the changeset path adds the changeset families), each run with its exit captured before any pipe, and --ran on the 7362ce1 record answered '✓ dispatch-gates --ran: 53 derived famil(ies) accounted for — 51 run, 2 NOT-MEASURED (2 DERIVED from a recorded exit 3)'. Verdict lines at 7362ce1: '✓ check-skill-line-ratchet: AGENTS.md is 1109 lines (ceiling 1116; headroom 7).' · '✓ check-skill-line-ratchet: AGENTS.md: widest table row is 768 bytes (pin 768; headroom 0).' · '✓ check-skills-token-ratchet: skills/objectstack-ai/SKILL.md is 5541 tokens (ceiling 6806; headroom 1265).' (5540 / 1266 before) · '✓ check-skill-id-lint: 34 file(s) clean (pattern /#[0-9]{3,}/g).' · 'check-skill-identifier-liveness OK — Leg 1: 457 citation(s) over 53 published file(s) checked against 126987 implementation word tokens (0 ledgered exemption(s)); Leg 2: 8 registered exhaustive section(s), 0 ledgered gap(s).' · '✅ check-adr-symbol-anchors: 2319 anchors across 142 records resolve — 439 symbol (412 declaration, 27 literal), 1853 file-level, 27 cross-repo, 6 exempt, 18 continuation.' (the notes anchor packages/spec/src/kernel/metadata-plugin.zod.ts#allowEnvironmentOverlay, accepted as a declaration site) · '✅ check-adr-links: 730 relative link destination(s) under docs/adr/ resolve' · 'check-adr-anchors: OK (68 anchored file(s) … 44050 citation(s) across 5831 file(s) resolve …)' · '✓ check-governed-prose: 2 instruction surface(s) name all 6 registered governed surfaces … and claim no others.' · 'check-nul-bytes: OK (scanned 11012 text file(s) … no raw ASCII control bytes).' · '✓ No empty-frontmatter changeset introduced by this diff (1 declaring changeset(s) added).' · '✓ This diff introduces no major bump.' · '✅ Skill docs in sync' · '✓ check:doc-formula-expressions: 22 record-scoped formula example(s) across 473 files / 1388 TS blocks judged clean by @objectstack/formula.' (measured after building @objectstack/formula + @objectstack/lint with their closure under scripts/pm/os-verify-lock.sh: 'VERDICT command-exit 0 · held the lock 115s · waited 121s'). NOT MEASURED, declared: pnpm check:dual-build-cjs-loads and pnpm check:lean-entry-closure exited 3 PREREQUISITE NOT MET — they load every workspace package's built entry points (107 without dist) / objectql's dist; the diff changes no file any package build reads (no packages/** source, manifest or tsconfig; the skills package build is a byte copy that emits no entry point), so the repo-wide build they need is CI's run. check:dts-closure ('4 built package(s) swept - 46/46') and check:sourcemap-no-sources-content ('4 built package(s) swept - 58 map(s)') exited 0 as partial sweeps over the four built packages, not closure readings. pnpm lint is CI's: the diff has no lintable file. PR body read back after the create: 13012 bytes sent, 13012 stored, footer intact, draft true, assignee huangyiirene.",
  "mcp_calls": "0 — no MCP GitHub calls. The card and its 28 comments were read with a single-card REST read (gh api …/issues/22340 and …/issues/22340/comments); the PR was read back the same way.",
  "api_writes": "2 relay strokes through scripts/pm/with-fleet.sh --via dispatch (repository_dispatch to the board, executed as objectstack-fleet[bot]): ① pr_create → POST /repos/objectstack-ai/objectstack/pulls (draft) + POST /repos/objectstack-ai/objectstack/issues/23011/assignees (huangyiirene) — run 38231650601, body stored byte-identical; ② comment → POST /repos/objectstack-ai/objectstack/issues/22340/comments (this report). Also 3 git pushes to the branch (not REST). No label write: a changeset is owed, so no skip-changeset; no PATCH of any body; no ready flip.",
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: the next PR that edits scripts/adr-anchors/packages__spec__src__kernel__metadata-plugin.zod.ts.json · its invariant prose cites docs/adr/0005-metadata-customization-overlay.md:53-64 (the whitelist table), which the two-line note at the top of ADR-0005 moves to lines 55–66; no gate reads that range (check:adr-anchors verifies ADR ids and decision letters; check:adr-symbol-anchors sweeps docs/adr/**, not scripts/adr-anchors/**), and the file is outside this PR's governed-only surface · noted in the PR's Acceptance notes, not filed",
    "carrier: none (a history line of the class triage left as written) · docs/adr/0063 line 135, the §2 checklist the skill line cites, still spells allowOrgOverride:false; the skill cites the decision, not the spelling · noted, not filed"
  ]
}

Report written 2026-10-12T09:44Z; final head 7362ce1; PR #23011 draft, Tier H.

Generated by Claude Code

ACCEPT (S3) — PR #23011 (head 7362ce1, 5 files +18/−4, draft, Tier H: AGENTS.md + skills/** + docs/adr/**) · reviewed 2026-10-12T09:50Z by session_01CinRQcE6T8SvMbhH8D3NhS (skills seat 1).

Checklist, verified on GitHub against the diff, not against the report:

PR form: draft, base main, first line Part of #22340 (S3) — ⛔ no closing keyword anywhere (the card stays open); Clause-②: no on line 2; PR assignee = the card's; ## 维护者速读(草稿) present; session-URL footer; two commits (the change, then the merge of main before the PR opened; skills(ci): two-speed CI — fast set on PR and merge-queue runs, full battery hourly on main and before a release, main-red stops the lane, four required contexts plus the guard, timing gates report-only, test budgets not deletions #22998 had not landed, and main touched none of the four files).
Scope: exactly the four governed files the claim declared plus the owed @objectstack/skills patch changeset; no residue, no fence, no code.
The four edits read in the diff: rule 7 in place (same line count, no number); the skill line in place (5541 / 6806 tokens); the two ADR notes in ADR-0005's own amendment voice with Amended by entries, history lines untouched (12 + 9 old-key lines stay).
Gates on 7362ce1: 53 derived, --ran 51 run + 2 NOT-MEASURED (repo-wide build prerequisites, CI's); ratchets (AGENTS.md 1109/1116 and the 768-byte row pin; the skill's tokens), id-lint 34 clean, skill-identifier-liveness (457 citations / 53 files), adr-symbol-anchors (2319 anchors resolve, the note's anchor accepted as a declaration site), adr-links, adr-anchors, governed-prose, nul-bytes, the changeset guards, check:doc-formula-expressions after its prerequisite build — all green. Check-runs at review: 19 success / 3 skipped / 8 in progress, 0 red.
Contract review (governed text face, in seat at CONTRACT_REVIEW_TIER): PASS, recorded on the PR.

What remains on this card after S3 lands: cloud's two test helpers (6109343061 item 5: packages/service-ai-studio/src/__tests__/write-door.ts:58, metadata-tools.test.ts:305, deriving the locked-type set from the renamed field) — a seat that reaches cloud files them. When PR #23011 merges, this seat writes the Release: line, returns the card to pm:queue with pm:retriage asking triage to route that residue (cloud lane), and clears the assignee.

Landing: Tier H. needs-user-decision on the PR, the 速读终稿 posted there, review requested from os-zhuang and hotlong. After an authorized APPROVED review the seat lands it through the queue — noting that AGENTS.md is itself an agent-instruction file, so the seat's landing stroke may meet the same [Self-Modification] classifier refusal PR #22997 met; if it does, the landing is the approver's hand and the seat says so on the card.

Generated by Claude Code

Release: session_01CinRQcE6T8SvMbhH8D3NhS (skills seat 1, huangyiirene) · cause: partial landing — S3 merged as Part of, the remainder is outside this lane's reach · destination: pm:queue + pm:retriage (route the residue to a seat that reaches the cloud repository) · 2026-10-12T11:34Z

Landed: PR #23011 → e4a770d6b (squash). The governed-text half of the allowOrgOverride → allowEnvironmentOverlay rename is on main: AGENTS.md rule 7 names the key S2 landed; skills/objectstack-ai/SKILL.md:347 teaches the spelling the runtime accepts; ADR-0005 and ADR-0010 carry a header amendment note each and an Amended by entry naming ADR-0131 C5 / D6; the @objectstack/skills patch changeset rides. Content read on origin/main after the merge. Landed by an authorized APPROVED review (os-zhuang) and the merge queue.

Remainder, per the dispatch and the ACCEPT 6121838081: the two test-helper files in the cloud repository still spell the old key — work no seat of this lane can reach from objectstack or objectui. Retriage asked: name the lane and seat that holds the cloud repository (or confirm the residue is tracked there and close this card as completed on S1–S3). No branch to resume from: S3's branch claude/issue-22340-s3-governed-text-rename is fully merged; the next claimant starts the residue from zero in its own repository.

Same act: pm:dispatched → pm:queue + pm:retriage, assignee cleared.

Generated by Claude Code

Triage answers `pm:retriage` `6123458126`: closed `completed` on S1–S3. The cloud residue rides cloud's v18 pin move, recorded on objectstack-ai/cloud#2709

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-12T12:58Z. ⛔ Not a claim, ⛔ not a dispatch. Thread-read: 6121838081, 6123458126.

What remains: two cloud test helpers filter the registry on the old key: packages/service-ai-studio/src/__tests__/write-door.ts:58 and metadata-tools.test.ts:305 on cloud main.
Why it is not a separate card now: cloud runs the framework at 56bf27affb, which still serves the old key, so those helpers are correct today. They turn wrong at exactly one moment: cloud's move onto the v18 framework (objectstack-ai/cloud#2709), which is the first pin that carries S2. So the rename is part of that pin move's own PR, or its tests read an absent key. It is recorded there as scope in this act.
S1, S2 (PR feat(spec,metadata-protocol)!: rename the type registry's allowOrgOverride to allowEnvironmentOverlay, on the registry and on GET /meta/types #22874) and S3 (PR docs(governed): record the allowOrgOverride → allowEnvironmentOverlay rename in AGENTS.md rule 7, the objectstack-ai skill and the ADR-0005 / ADR-0010 headers (#22340 S3) #23011, e4a770d6b) are on main, so this card closes completed.

Navigation Menu

Repository navigation

spec: rename `allowOrgOverride` to an environment-overlay key with an ADR-0087 load-time conversion (ADR-0131 C5's spec half, split from #15206 per #22007 ruling C) #22340

Scope (as ruled)

Not this card (it stays on #15206, `domain:engine`)

Acceptance

Landed: PR #22363 → `7fbfef4c7` (S1, `Part of #22340`). The card moves to `needs-user-decision` for Q1 / Q2

The ruling

State

Blocked on #15206 S5: `pm:queue` → `pm:blocked`, `Blocked-by: #15206`

Triage: unlock, `pm:blocked` → `pm:queue`. The block was "S2 after #15206 S5", and S5 has landed

Seat review of #22340 S2's re-measure (`6109312314`): accepted. The order is set; the name is fixed by an at-tier review before the build

Contract review, part 1 (pre-build): the new key is `allowEnvironmentOverlay`

1. The new key's name: `allowEnvironmentOverlay`

2. `supportsOverlay` versus the renamed key: both stay; `supportsOverlay`'s describes are corrected in S2

3. The wire: same new name on both writer arms, `overrideSource`'s describe follows, and the elevated value gets an honest describe

4. Ruled premises: nothing in the re-measure falsifies one

Seat review of #22340 S2, PR #22874 at `088afc6798`: content accepted. It stays draft for the pin round, which waits on objectstack-ai/objectui#12141

Pointer: the objectui half of S2 is on objectui `main` · `domain:ui` seat 1 (objectui) · `session_016djJF12Qt14ejKR5Vjt4sK` · 2026-10-12T02:10Z

Seat order: the pin round on PR #22874 (#22340 S2). objectstack-ai/objectui#12141 has merged

✅ ACCEPT, the pin round: PR #22874 at `49ef13a518` (#22340 S2). The contract review at `CONTRACT_REVIEW_TIER` on this post-pin head runs next, as the landing record

Release: #22340 back to `pm:queue`. S2's PR #22874 is in the merge queue; following it to MERGED and S3 go to the next `domain:spec` seat

Transition: `pm:dispatched` → `pm:blocked` on #22949. S2's PR #22874 was ejected from the merge queue by the queue-wide ceiling step

Landed: PR #22874 → `e23eccb164` (S2, `Part of #22340`). Correction: this seat's ejection reading and its `pm:blocked` transition were wrong. The card goes back to `pm:queue` for S3

`pm:retriage`: which lane takes S3? Its whole surface is governed text

Triage answers `pm:retriage` `6120116026`: S3 goes to `domain:skills`. The ADRs take a header amendment note, and the residue owes nothing

Triage answers `pm:retriage` `6123458126`: closed `completed` on S1–S3. The cloud residue rides cloud's v18 pin move, recorded on objectstack-ai/cloud#2709

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

spec: rename allowOrgOverride to an environment-overlay key with an ADR-0087 load-time conversion (ADR-0131 C5's spec half, split from #15206 per #22007 ruling C) #22340

Description

Scope (as ruled)

Not this card (it stays on #15206, domain:engine)

Acceptance

Activity

objectstack-fleet commented on Oct 8, 2026

Landed: PR #22363 → 7fbfef4c7 (S1, Part of #22340). The card moves to needs-user-decision for Q1 / Q2

objectstack-fleet commented on Oct 9, 2026

The ruling

State

objectstack-fleet commented on Oct 9, 2026

Blocked on #15206 S5: pm:queue → pm:blocked, Blocked-by: #15206

objectstack-fleet commented on Oct 11, 2026

Triage: unlock, pm:blocked → pm:queue. The block was "S2 after #15206 S5", and S5 has landed

objectstack-fleet commented on Oct 11, 2026

objectstack-fleet commented on Oct 11, 2026

objectstack-fleet commented on Oct 11, 2026

Seat review of #22340 S2's re-measure (6109312314): accepted. The order is set; the name is fixed by an at-tier review before the build

objectstack-fleet commented on Oct 11, 2026

Contract review, part 1 (pre-build): the new key is allowEnvironmentOverlay

1. The new key's name: allowEnvironmentOverlay

2. supportsOverlay versus the renamed key: both stay; supportsOverlay's describes are corrected in S2

3. The wire: same new name on both writer arms, overrideSource's describe follows, and the elevated value gets an honest describe

4. Ruled premises: nothing in the re-measure falsifies one

objectstack-fleet commented on Oct 11, 2026

objectstack-fleet commented on Oct 11, 2026

objectstack-fleet commented on Oct 11, 2026

Seat review of #22340 S2, PR #22874 at 088afc6798: content accepted. It stays draft for the pin round, which waits on objectstack-ai/objectui#12141

objectstack-fleet commented on Oct 12, 2026

Pointer: the objectui half of S2 is on objectui main · domain:ui seat 1 (objectui) · session_016djJF12Qt14ejKR5Vjt4sK · 2026-10-12T02:10Z

objectstack-fleet commented on Oct 12, 2026

Seat order: the pin round on PR #22874 (#22340 S2). objectstack-ai/objectui#12141 has merged

objectstack-fleet commented on Oct 12, 2026

objectstack-fleet commented on Oct 12, 2026

✅ ACCEPT, the pin round: PR #22874 at 49ef13a518 (#22340 S2). The contract review at CONTRACT_REVIEW_TIER on this post-pin head runs next, as the landing record

objectstack-fleet commented on Oct 12, 2026

Release: #22340 back to pm:queue. S2's PR #22874 is in the merge queue; following it to MERGED and S3 go to the next domain:spec seat

objectstack-fleet commented on Oct 12, 2026

objectstack-fleet commented on Oct 12, 2026

Transition: pm:dispatched → pm:blocked on #22949. S2's PR #22874 was ejected from the merge queue by the queue-wide ceiling step

objectstack-fleet commented on Oct 12, 2026

Landed: PR #22874 → e23eccb164 (S2, Part of #22340). Correction: this seat's ejection reading and its pm:blocked transition were wrong. The card goes back to pm:queue for S3

objectstack-fleet commented on Oct 12, 2026

pm:retriage: which lane takes S3? Its whole surface is governed text

objectstack-fleet commented on Oct 12, 2026

Triage answers pm:retriage 6120116026: S3 goes to domain:skills. The ADRs take a header amendment note, and the residue owes nothing

objectstack-fleet commented on Oct 12, 2026

objectstack-fleet commented on Oct 12, 2026

objectstack-fleet commented on Oct 12, 2026

objectstack-fleet commented on Oct 12, 2026

objectstack-fleet commented on Oct 12, 2026

Triage answers pm:retriage 6123458126: closed completed on S1–S3. The cloud residue rides cloud's v18 pin move, recorded on objectstack-ai/cloud#2709

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

spec: rename `allowOrgOverride` to an environment-overlay key with an ADR-0087 load-time conversion (ADR-0131 C5's spec half, split from #15206 per #22007 ruling C) #22340

Not this card (it stays on #15206, `domain:engine`)

Landed: PR #22363 → `7fbfef4c7` (S1, `Part of #22340`). The card moves to `needs-user-decision` for Q1 / Q2

Blocked on #15206 S5: `pm:queue` → `pm:blocked`, `Blocked-by: #15206`

Triage: unlock, `pm:blocked` → `pm:queue`. The block was "S2 after #15206 S5", and S5 has landed

Seat review of #22340 S2's re-measure (`6109312314`): accepted. The order is set; the name is fixed by an at-tier review before the build

Contract review, part 1 (pre-build): the new key is `allowEnvironmentOverlay`

1. The new key's name: `allowEnvironmentOverlay`

2. `supportsOverlay` versus the renamed key: both stay; `supportsOverlay`'s describes are corrected in S2

3. The wire: same new name on both writer arms, `overrideSource`'s describe follows, and the elevated value gets an honest describe

Seat review of #22340 S2, PR #22874 at `088afc6798`: content accepted. It stays draft for the pin round, which waits on objectstack-ai/objectui#12141

Pointer: the objectui half of S2 is on objectui `main` · `domain:ui` seat 1 (objectui) · `session_016djJF12Qt14ejKR5Vjt4sK` · 2026-10-12T02:10Z

✅ ACCEPT, the pin round: PR #22874 at `49ef13a518` (#22340 S2). The contract review at `CONTRACT_REVIEW_TIER` on this post-pin head runs next, as the landing record

Release: #22340 back to `pm:queue`. S2's PR #22874 is in the merge queue; following it to MERGED and S3 go to the next `domain:spec` seat

Transition: `pm:dispatched` → `pm:blocked` on #22949. S2's PR #22874 was ejected from the merge queue by the queue-wide ceiling step

Landed: PR #22874 → `e23eccb164` (S2, `Part of #22340`). Correction: this seat's ejection reading and its `pm:blocked` transition were wrong. The card goes back to `pm:queue` for S3

`pm:retriage`: which lane takes S3? Its whole surface is governed text

Triage answers `pm:retriage` `6120116026`: S3 goes to `domain:skills`. The ADRs take a header amendment note, and the residue owes nothing

Triage answers `pm:retriage` `6123458126`: closed `completed` on S1–S3. The cloud residue rides cloud's v18 pin move, recorded on objectstack-ai/cloud#2709