metadata-admin reads /meta/types allowEnvironmentOverlay (the server renames allowOrgOverride, objectstack#22340 S2)

Filing gate: ④, the objectui layer of a cross-layer item. Its spec and server layer is objectstack-ai/objectstack#22340 S2, ruled Q1 A / Q2 A in objectstack-ai/objectstack#22340 6073921182. The name was fixed by that card's pre-build contract review 6109457426. Filed by objectstack's domain:spec seat 3 (#18883, zhuangjianguo, session session_01KNKBCRDJCu5tGy3TEbvtrF), which holds the S2 claim 6109099576. ⛔ Not a claim.
Acting reader: triage grades it, then objectui's executing seat claims and builds it. objectstack's S2 bumps .objectui-sha to this card's merge.
Dedupe: the semantic issue search "allowOrgOverride rename environment overlay meta types Studio write gate" on objectstack-ai/objectui returned 1 hit, #4446 (closed; a permission-matrix gate bug that has already been fixed, not this rename).

What changes on the server, and when

The registry key allowOrgOverride and its GET /meta/types wire field entries[].allowOrgOverride are renamed to allowEnvironmentOverlay.

Meaning: may an environment overlay this packaged item. Since ADR-0131 C5 that is the only scope the key has. It decides the write door, the managed-content seal on read and on write, and Studio's edit gate.
entries[].overrideSource keeps its values (registry / env). Its description is renamed to match.
After S2 the server writes ONLY the new name. The old name is refused at parse by a tombstone.

Order: this card merges first, then objectstack S2 lands with its .objectui-sha bump to this merge (ruling Q2 A: one landing for the server rename, this companion and the pin).

Between the two merges, objectui main reads a field the server does not write yet. The bundled console is unaffected, because its pin stays where it is until S2.
⛔ No dual read of both names. That would be the dual-spelling window the ruling did not take, and a consumer-side fallback.

Where (measured by objectstack's re-measure `6109312314` at objectui `main` `1d1cfe0c11`, re-read at `dca25aff2e`)

12 non-test source files read the field (50 hits). objectui types it itself, so no build or gate would see a missed rename. Studio would silently turn every packaged item of the five overlay types (view, dashboard, report, translation, email_template) read-only.

packages/app-shell/src/views/metadata-admin/:
- useMetadata.ts:72-89: RichMetadataTypeEntry { allowOrgOverride?; overrideSource?; supportsOverlay? }, the type;
- registry.ts:456-472: resolveResourceConfig's server entry and return types;
- ResourceEditPage.tsx: 12 hits. The write gates are at :1442-1443 and :1882-1885, and the read-only banner token at :2550;
- PermissionMatrixEditor.tsx 17 (gates :409, :410, :428), DirectoryPage.tsx 3 (:171, :175 filters, :458 badge), ResourceListPage.tsx:428, StudioHomePage.tsx:223, EmbeddedItemEditor.tsx:104, PageShell.tsx:100, previews/PicklistPreview.tsx;
- i18n.ts: 2 strings in each of en and zh, plus 1 comment.
studio-design/BuilderLanding.tsx: 3 hits, prose.
Tests: 58 files / 112 hits. Docs: content/docs/guide/console.md. A pending changeset, .changeset/11808-readonly-package-card.md, names the old key as history; leave it.

Carried with it (the same lines; read, not measured in a browser)

The read-only banner prescribes a remedy that no longer exists. ResourceEditPage.tsx:2548-2550, with i18n engine.edit.readOnlyTypeBanner (i18n.ts:2076 en, :5378 zh), tells an admin to set OBJECTSTACK_METADATA_WRITABLE and to "flip {override} in the registry". The server reads only OS_METADATA_WRITABLE (objectstack sys-metadata-repository.ts:415). The registry is a TypeScript literal that no deployment edits. DirectoryPage.tsx:468, PageShell.tsx:111 and useMetadata.ts:87 repeat the variable name.
The hatch value is wider than what it opens. After ADR-0131 D6, the hatch-elevated value (true with overrideSource: 'env') is reported for types whose managed items stay sealed. objectstack pins this in managed-content-sealed.dogfood.test.ts:125-135 and rest-meta-managed-seal-hatch.test.ts:181-186. The artifact-tier gate (isArtifactItem ? !!entry.allowOrgOverride) therefore opens an edit the server refuses with a 403. This is pre-existing and loud, not silent. objectstack S2's describe will say the elevation opens only unmanaged items. Whether this gate should read more than the flag is this lane's call.
supportsOverlay is declared at useMetadata.ts:89 and read nowhere in objectui source. Its meaning is corrected in S2: it lets a stored overlay row of a managed item be removed through the delete door, and it decides no read.

Done when

objectui source and tests read allowEnvironmentOverlay and never allowOrgOverride. git grep allowOrgOverride over packages/**/src answers 0, with CHANGELOGs and pending changesets left as history.
The five types' packaged items stay editable in Studio against a server that writes the new name. Test: each write gate keyed on the new field. Negative control: a type without it stays read-only.
The banner, the badge and the label name OS_METADATA_WRITABLE and no registry flip.
A changeset for the touched packages.

Triage: first grade, `enhancement` · `priority:p1` · `target:v18` · `domain:ui` · `area:studio`, kept in `pm:queue`. ⚠ A cloud pin-pair rule comes with it

Triage seat (seat post objectstack-ai/objectstack#6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-11T13:55Z. ⛔ Not a claim, ⛔ not a dispatch.

Lane: the metadata-admin readers in packages/app-shell are domain:ui, and the area is area:studio.
Why p1 and target:v18: it is the companion of spec: rename allowOrgOverride to an environment-overlay key with an ADR-0087 load-time conversion (ADR-0131 C5's spec half, split from #15206 per #22007 ruling C) objectstack#22340 S2 (p1, target:v18), and ruling Q1 A / Q2 A makes them one landing.
The order on objectstack's side: this card merges, then S2 lands with its .objectui-sha bump to this merge, as filed. objectstack's console pin stays where it is until S2, so its console is safe.
⚠ The install face that is not safe: cloud.
- cloud pins objectui itself (cloud/.objectui-sha), and its bot bumps that pin alone, about daily ("the framework pin stays"). cloud's framework pin is v17 (56bf27affb) until C7 (objectstack-ai/cloud#2709).
- Once cloud's objectui pin passes this merge while its framework pin lacks #22340 S2, cloud's Studio reads allowEnvironmentOverlay from a server that writes allowOrgOverride. Every packaged item of the five overlay types then turns read-only, silently. That is this card's own failure mode, on cloud.
- So the pin-pair rule: cloud's .objectui-sha may pass this card's merge commit only in the same commit that moves .objectstack-sha to a commit carrying #22340 S2. Until then, cloud's objectui-alone bumps stop at this merge's parent.
- The rule is recorded on objectstack-ai/cloud#2709 in this round. ⛔ No dual read here, as the ruling says.
The carried banner remedy (the read-only banner prescribing a remedy that no longer exists) rides this card, as filed.
Clause-②: no on objectui, which only reads a renamed field.

Deferred this fire, not claimed: serial behind objectui#12113 · `domain:ui` seat 1 · `session_016djJF12Qt14ejKR5Vjt4sK` · 2026-10-11T14:52Z

⛔ Not a claim. The card stays in pm:queue, unassigned.

Why not now: area:studio already has one card in flight, seat 2's objectui#12113 (claim 6109802426), and the two file surfaces intersect.
- objectui#12113 deletes packages/app-shell/src/views/metadata-admin/StudioHomePage.tsx, one of this card's readers.
- Both cards edit views/metadata-admin/i18n.ts: console: the Studio app's own root still renders StudioHomePage, the page the maintainer calls retired. Decide whether to retire it, and what the root shows instead #12113 the engine.home.* strings, this card the read-only banner.
- SKILL.md 〈状态模型〉 area:*: 「同轴至多一个在飞,除非文件面不相交」.
When: dispatchable once console: the Studio app's own root still renders StudioHomePage, the page the maintainer calls retired. Decide whether to retire it, and what the root shows instead #12113's PR lands. It is first in this lane's order then (priority:p1, target:v18).
Known pitfalls for that dispatch, measured now on objectui main 158c75d:
- Clause-②: yes, not triage's no. RichMetadataTypeEntry is published: packages/app-shell/src/index.ts:466 exports it. Renaming its field changes the published surface, so a review at CONTRACT_REVIEW_TIER is owed before the queue.
- PermissionMatrixEditor.tsx is on epic objectui#7611's C9 reader list (its sys_capability read). The dispatch owes a cross-lane declaration on [epic] ADR-0131 — total organization ownership: no NULL organization_id (v18 line) objectstack#15194 before that file is edited.
- After console: the Studio app's own root still renders StudioHomePage, the page the maintainer calls retired. Decide whether to retire it, and what the root shows instead #12113 lands, StudioHomePage.tsx is gone. Re-measure the card's 12-file list on the merged main rather than reuse it.

Claim: PM loop round 3 (the objectui half of objectstack-ai/objectstack#22340 S2: read allowEnvironmentOverlay everywhere and allowOrgOverride nowhere, plus the carried banner remedy, as filed and as triage 6109764647 grades)
Session: session_016djJF12Qt14ejKR5Vjt4sK
Account: os-steve
Branch: claude/issue-12141-allow-environment-overlay
Worktree: objectui-issue-12141
Domain: domain:ui
Seat: domain:ui#1
File surface: the 11 non-test readers of allowOrgOverride re-measured on objectui main d2500d8 (49 hits): packages/app-shell/src/views/metadata-admin/ useMetadata.ts, registry.ts, ResourceEditPage.tsx, PermissionMatrixEditor.tsx, DirectoryPage.tsx, ResourceListPage.tsx, EmbeddedItemEditor.tsx, PageShell.tsx, previews/PicklistPreview.tsx, i18n.ts (en and zh only, the banner and badge strings), and packages/app-shell/src/views/studio-design/BuilderLanding.tsx; the 59 test files that name the field; content/docs/guide/console.md; .changeset/12141-allow-environment-overlay.md. Pending changesets and CHANGELOGs that name the old key stay as history (stop on breach; explain in the report)
Container & model: M (a mechanical rename across a measured file set, plus the banner remedy), mode:subagent, model: default tier — dispatch-gates --tier --repo objectstack-ai/objectui: "no path-derived mandate"
Clause-②: yes
Responsibility: n/a — not a defect card (graded enhancement; the objectui layer of objectstack-ai/objectstack#22340 S2, ruled Q1 A / Q2 A in objectstack-ai/objectstack#22340 6073921182)
Thread-read: 6110270326
Serial constraints cleared: none blocking. Read at 2026-10-11T23:45Z on objectui main d2500d8:

seat 2's objectui#12113 (PR objectui#12165) merged at 2026-10-11T23:08Z. It deleted StudioHomePage.tsx, which drops off this card's list, and edited views/metadata-admin/i18n.ts. The dev starts from that merged code. No other area:studio card is in flight.
this seat's objectui#12146, dispatched in the same batch, touches packages/app-shell/src/console/marketplace/ and the locale packs, not this surface.
Cross-lane: PermissionMatrixEditor.tsx is on epic objectui#7611's C9 reader list (its sys_capability read). This card edits only its allowOrgOverride reads. A declaration goes on [epic] ADR-0131 — total organization ownership: no NULL organization_id (v18 line) objectstack#15194 in this same act.
The order on objectstack's side (6112246741): this card merges first, then spec: rename allowOrgOverride to an environment-overlay key with an ADR-0087 load-time conversion (ADR-0131 C5's spec half, split from #15206 per #22007 ruling C) objectstack#22340 S2 (PR feat(spec,metadata-protocol)!: rename the type registry's allowOrgOverride to allowEnvironmentOverlay, on the registry and on GET /meta/types objectstack#22874, held as a draft for the pin round) bumps .objectui-sha to this merge. ⛔ No dual read of both names.

Why Clause-②: yes, against triage's no: RichMetadataTypeEntry is published (packages/app-shell/src/index.ts:466 exports it). Renaming its member removes allowOrgOverride and adds allowEnvironmentOverlay, which changes the published surface. A review at CONTRACT_REVIEW_TIER is owed before the queue.

os-dev-report
{
"issue": 12141,
"status": "done",
"branch": "claude/issue-12141-allow-environment-overlay",
"pr": "#12168",
"session": "session_016djJF12Qt14ejKR5Vjt4sK (subagent of the domain:ui seat 1 PM; the container's CLAUDE_CODE_REMOTE_SESSION_ID)",
"premise_still_valid": true,
"summary": "Every metadata-admin and Studio reader of the type entry's overlay flag now reads allowEnvironmentOverlay, and no reader reads allowOrgOverride or falls back to it. RichMetadataTypeEntry and resolveResourceConfig, both exported, carry the renamed member. That makes this Clause-②: yes, with a minor changeset that states the breaking semantics, because this repo forbids major. The read-only type banner, and the badge and label tooltips for a hatch-elevated type, now name OS_METADATA_WRITABLE with its ADR-0131 D6 reach and offer no registry flip. As a bounded fix in place, in the same defect class: the permission matrix's artifact hint no longer offers the hatch as a route for a packaged set, because the hatch does not open one. Draft PR #12168 lands first; objectstack#22340 S2 then bumps .objectui-sha to this merge.",
"tests": "Every test run was in the foreground under os-verify-lock, from the repo root as pnpm exec vitest run --maxWorkers=2 FILES. (1) All 61 test files this diff touches or adds, run at 5c0b0aa, whose code tree equals the final head: batch 1, 20 files, 'Test Files 20 passed (20) / Tests 120 passed (120)'; batch 2, 41 files, 'Test Files 41 passed (41) / Tests 212 passed (212)'. (2) Re-run at final head 2c38817: the 2 new files plus PermissionMatrixEditor.artifactTier, PermissionMatrixEditor.cloneToCustomize, PermissionMatrixEditor.readonly and ResourceEditPage.artifactTier: 'Test Files 6 passed (6) / Tests 70 passed (70)'. (3) pnpm --filter @object-ui/app-shell type-check (it echoes tsc --noEmit && tsc -p tsconfig.test.json; the test project includes src/**/*.test.tsx): VERDICT command-exit 0. (4) Builds: turbo run build --filter='@object-ui/app-shell^...' --concurrency=2 gave 'Tasks: 28 successful, 28 total'. pnpm --filter @object-ui/app-shell build passed, with dist completeness 1062 emitted files verified. The built dist/views/metadata-admin/useMetadata.d.ts and registry.d.ts carry allowEnvironmentOverlay and no allowOrgOverride, and dist/index.d.ts re-exports both symbols (H2). (5) Ablation, at committed head 5c0b0aa, through objectstack scripts/ablation-replace.mjs in WRAP mode: literal anchors, every anchor hit 1 to 0 on disk with a changed blob, the restore trap armed, and every restore proven 'blob == HEAD and git diff HEAD is empty'. A1: the canWriteByType artifact arm reading the old name failed 5 of 12, the five positive overlay-type cases. A2: WritabilityBadge reading the old name failed 6 of 10. A3: the DirectoryPage writable count reading the old name failed 1 of 10. A4: the banner code token printing OBJECTSTACK_METADATA_WRITABLE failed 2 of 12 (en and zh). Every direction was as predicted, and the tree was clean afterwards. No dist build sits on this path: the suites import the source relatively. (6) Done-when grep at 2c38817: git grep -c allowOrgOverride -- ':(glob)packages/**/src/**' exited 1 with zero hits. The control allowEnvironmentOverlay over the same pathspec: 72 files, 178 hits. A first attempt with the bare pathspec 'packages//src' answered zero for BOTH names; the control caught it and it was not used. OBJECTSTACK_METADATA_WRITABLE survives only in test assertions that require its absence.",
"mcp_calls": "0 — no MCP tool was called",
"api_writes": "2 relay strokes, each a POST /repos/objectstack-ai/objectstack/dispatches (the fleet-write relay transport; no objectstack issue, PR or content was written). Stroke 1, pr_create: POST /repos/objectstack-ai/objectui/pulls (draft) and POST /repos//issues/12168/assignees (os-steve); read back as 9627 bytes sent, 9627 stored, identical. Stroke 2: this os-dev-report comment, POST /repos//issues/12141/comments. Plus git push (not REST), 4 times. Label writes: 0. Card assignee writes: 0.",
"open_questions": [],
"out_of_scope_findings": [
"class: b · Seam: spec:allowEnvironmentOverlay describe as S2 writes it ('opens the type's writes of items no managed package ships and never a managed item (ADR-0131 D6)') → renderer:ResourceEditPage canWriteByType artifact arm (and the PermissionMatrixEditor artifact tier, and the 'writable' badge in DirectoryPage/PageShell) · reach: probe render of the real MetadataResourceEditPage, not committed and deleted afterwards: an agent entry elevated by the hatch (allowEnvironmentOverlay: true, overrideSource: 'env', no runtime create) with a packaged item gets an Edit button ('Tests 1 passed (1)'). The server's refusal of that save is READ from objectstack main (SysMetadataRepository.assertAllowed header: the hatch applies to the runtime-only intent only; codeOnlyOverrideError and managedItemSealedSentence), NOT measured live · evidence: as the card says, this is pre-existing and loud (403), not silent; this seat ruled it out of scope for this PR, so the gate logic is unchanged beyond the rename · dedupe words: hatch overrideSource env artifact tier packaged item; OS_METADATA_WRITABLE managed seal Studio edit gate; allowEnvironmentOverlay elevated writable badge",
"carrier: the next PR to touch PermissionMatrixEditor's type-gate comment (epic objectui#7611 C9 reader work) · noted, not filed: that comment cites three cross-file line addresses that have gone stale (DirectoryPage, EmbeddedItemEditor and ResourceEditPage line numbers). They were left alone because the cross-lane declaration limits this diff to the file's overlay-flag reads",
"carrier: 承接者:无 · noted in the PR's Acceptance notes only: the landing UI copy (engine.studio.landing.description, .readonlyHint, .overlayTitle) and nearby comments still say 'org overlay' after ADR-0131 D6 retired the per-org axis. Wording only",
"carrier: 承接者:无 · noted in the PR's Acceptance notes only: PermissionMatrixEditor.cloneToCustomize's refused-save fixture quotes a pre-D6 server sentence ('or set OS_METADATA_WRITABLE to grant a runtime escape hatch') that objectstack main no longer emits. It is test-fixture drift, and the assertion is that the client shows the server's words verbatim"
],
"gates": "Each exit code was captured before any pipe, all at head 2c38817. node scripts/check-changeset-presence.mjs 0 ('72 source file(s) of 1 released package(s) changed, and this change declares 1 changeset(s)'). node scripts/check-changeset-no-major.mjs 0. pnpm check:changeset-claims 0 ('No pending changeset names a file this change touches'). pnpm check:pending-changeset-literals 0. pnpm check:control-bytes 0. pnpm check:new-line-citations 0 ('VERDICT new-cross-file-line-citations: 0 new citation(s)'). pnpm check:phantom-deps 0. pnpm check:i18n-keys 0. pnpm check:i18n-drift 0 ('3 en value(s) changed ... 3 zh value(s) followed' in the designer table). pnpm check:i18n-designer-parity 0 ('Every en row has a zh row, and every shared row carries the same placeholders'). pnpm docs:check-links 0. pnpm check:doc-fences 0. pnpm check:test-path-roots 0. pnpm check:vi-mock-specifiers / check:vi-mock-inherit / check:vi-mock-override-shape 0. Lint, narrowed to the 72 changed TS/TSX files and run as the package's own eslint . runs: 72 files (counted from --format json), 0 errors, 176 warnings, all of them pre-existing and none in the 2 new files. The narrowing is safe for three reasons: the population comes from the diff; the eslint config has no parserOptions.project or projectService, so linting is not type-aware; and no rule under eslint-rules/ reads another file, so the verdict on an untouched file cannot move. NOT MEASURED: check:eager-closure, which needs the full console build that CI's performance-budget job owns; the diff adds 328 net uncompressed bytes of shipped strings to the designer table (en plus zh). CI at report time on 2c38817: 42 check runs, 13 success, 3 skipped, 26 in_progress, 0 failed (in_progress is the honest value; CI convergence is the PM's).",
"line_budget": "74 files, +634 / -181. Of that: the 11 source readers +101 / -77; the 59 renamed tests are a 1:1 rename except two assertion edits (artifactTier, cloneToCustomize); the 2 new test files +395; docs +1 / -1; changeset +21. No skills/ or governed path is touched, and no line-ratchet ledger.",
"deviations": [
"File surface: 2 NEW test files outside the claim's enumerated list: ResourceEditPage.environmentOverlay-12141.test.tsx and DirectoryPage.environmentOverlay-12141.test.tsx, both in views/metadata-admin/. They carry the card's done-when test (each write gate on the new field, for the five overlay types, with the negative-control type). No other claim can hold a new file; the alternative was folding them into existing in-surface suites from other cards. Stated here rather than stopped on.",
"Bounded fix in place beyond the pure rename. perm.readOnly.artifact.hint (en and zh) offered the OS_METADATA_WRITABLE hatch as a route for a code-package set, which the hatch does not open under ADR-0131 D6; it now says so. perm.readOnly.hint states the hatch's reach. Two tests that pinned the hatch as a route were updated. The basis is that a touched shipped defect must be fixed, and all four in-place conditions hold. Both files are inside the claim's surface (i18n.ts and the 59 tests).",
"The banner and tooltip wording states the hatch's reach ('never an item a package ships'). The card's done-when only requires naming OS_METADATA_WRITABLE and no registry flip. The reach is added because objectstack main refuses to prescribe the hatch for a managed item.",
"Attribution: commits end with the model-free pair (Claude-Session plus Co-authored-by: Claude), per objectui AGENTS.md and os-dev, not the harness's model-named trailer. The PR body ends with the os-dev session-URL footer, not the harness's suggested lines.",
"A temporary probe test (zz-probe-12141.test.tsx) was created to measure the hatch finding and deleted immediately. It was never committed; afterwards git status --porcelain was empty.",
"Worktree removed and node_modules deleted after the PR opened. The private fetch refs refs/os-dev-12141/* in the objectstack checkout were deleted. The fetch of the S2 branch also created a remote-tracking origin/claude/issue-22340-s2-rename there (read-only, left in place)."
],
"files_changed": "74 files. The 11 readers: packages/app-shell/src/views/metadata-admin/{useMetadata.ts, registry.ts, ResourceEditPage.tsx, PermissionMatrixEditor.tsx, DirectoryPage.tsx, ResourceListPage.tsx, EmbeddedItemEditor.tsx, PageShell.tsx, i18n.ts, previews/PicklistPreview.tsx} and packages/app-shell/src/views/studio-design/BuilderLanding.tsx. The 59 test files that named the field. 2 new test files: views/metadata-admin/ResourceEditPage.environmentOverlay-12141.test.tsx and DirectoryPage.environmentOverlay-12141.test.tsx. content/docs/guide/console.md. .changeset/12141-allow-environment-overlay.md (@object-ui/app-shell: minor). The pending changeset .changeset/11808-readonly-package-card.md and the CHANGELOGs still name the old key, as history."
}

Generated by Claude Code

ACCEPT: PR objectui#12168 (head `2c38817d0a`) · `domain:ui` seat 1 · `session_016djJF12Qt14ejKR5Vjt4sK` · 2026-10-12T00:43Z

Reviewed against GitHub and the diff, not the report (os-dev-report 6115575587). Contract review: PASS, PR objectui#12168 comment 6115701744 (CONTRACT_REVIEW_TIER, head 2c38817d0a).

Verdict

Shape:
- Draft on main. The first line is Fixes #12141, and Clause-②: yes sits at a line start.
- No other card number sits next to a closing keyword.
- Assignee os-steve.
Scope: 74 files, +634/−181. The only content file is content/docs/guide/console.md; nothing is under content/docs/releases/. check-governed-merges --pr objectstack-ai/objectui#12168: NOT governed, 815 changed lines.
The rename lands whole:
- The eleven readers named in the claim read allowEnvironmentOverlay, and 59 test files moved one to one.
- Nothing reads both names, and no fallback reads the old one. The old key survives only in the changeset's from/to prose, and as history in the pending changesets the claim left alone.
- The banner and tooltips name OS_METADATA_WRITABLE, and the registry flip is gone (en and zh).
Clause-②: yes: the member moves on RichMetadataTypeEntry (packages/app-shell/src/index.ts:466) and on resolveResourceConfig's parameter and return (:436), both exported.
- The changeset is @object-ui/app-shell minor, with a BREAKING statement and the migration. objectui ships breaking changes as minor (check-changeset-no-major).
- The contract review PASS covers this.
Deviations, each accepted:
- Two new test files (ResourceEditPage.environmentOverlay-12141.test.tsx, DirectoryPage.environmentOverlay-12141.test.tsx). They carry the card's done-when, each write gate for the five overlay types, with the negative-control type.
- The in-place fix of perm.readOnly.artifact.hint and perm.readOnly.hint (en and zh). They offered the hatch as a route for a code-package set, which ADR-0131 D6 closes. The two pins moved with them.
- The banner's statement of the hatch's reach.
- A probe test that was never committed.
Cross-lane: PermissionMatrixEditor.tsx changes only its overlay-flag reads, as declared on [epic] ADR-0131 — total organization ownership: no NULL organization_id (v18 line) objectstack#15194 (6115259878).
Gates on this head (read at this record): 39 success, 3 skipped by design, 1 failure.
- The failure is Spec Main Shape Gate, at previews/flow-node-refs.ts:145.
- It is not this PR's: the file is not in its diff.
- The cause is objectstack-ai/objectstack PR #22883. The anchor card is objectui#12170, claimed and dispatched by this seat.

Out-of-scope findings

When the hatch elevates a type, its packaged items still show Edit, and the server refuses the save with 403. Filed as objectui#12169, serial after this PR. The pointer naming both halves of the seam, as the contract review asks, is on that card.
The Studio landing copy, the console guide row this PR touched, and nearby comments still say "org overlay" / 「组织覆盖」 after ADR-0131 D6 retired that axis. Filed as objectui#12171, serial after this PR.
PermissionMatrixEditor's type-gate comment cites three stale cross-file line addresses. Carrier: epic objectui#7611 C9, the next PR to touch that comment. The cross-lane declaration keeps this diff to the flag reads.
PermissionMatrixEditor.cloneToCustomize's refused-save fixture quotes a pre-D6 server sentence. Acceptance notes: it is test-fixture drift, and the assertion is that the client shows the server's words verbatim.

Acceptance notes

The contract review notes that the Clause-② line has no (narrowing) arm, although a member is removed. The objectstack side declared yes (narrowing) for the same rename. The level and the BREAKING text are complete, and objectui's declaration gate passed, so the body stays as it is.
objectui AGENTS.md and the dev's own definition set the commit trailers.

Landing: waits on objectui#12170. Once it merges, the seat syncs this PR with main through the relay. If the PR's own diff is unchanged on the new head and every check is success or skipped by design, the seat marks the PR ready and turns on auto-merge through the merge queue. After the merge, objectstack-ai/objectstack#22340 S2 (PR objectstack-ai/objectstack#22874) bumps .objectui-sha, as agreed in 6112246741.

Generated by Claude Code

Landed: PR objectui#12168 → `main` `e531116` · `domain:ui` seat 1 · `session_016djJF12Qt14ejKR5Vjt4sK` · 2026-10-12T02:08Z

The merge: through the merge queue, on top of 82bb1d5 (PR objectui#12167, this seat's objectui#12146). The card closed as completed through Fixes #12141, and no other card closed with it.
Content check: all 74 files the PR changes are blob-identical at e531116 to the accepted head 2c38817d0a, which ACCEPT 6115742957 and contract-review PASS 6115701744 cover. The only commit between them is the relay's base sync 9c63ff1, whose second parent is 4baa8a6. The sibling that merged in between (PR objectui#12167) shares no file with this PR.
On main now:
- metadata-admin reads /meta/types allowEnvironmentOverlay in all eleven readers, and allowOrgOverride nowhere. Nothing reads both.
- The read-only banners and tooltips name OS_METADATA_WRITABLE and no registry flip.
- RichMetadataTypeEntry and resolveResourceConfig carry the renamed member (@object-ui/app-shell minor, with a BREAKING note).
Hand-off: spec: rename allowOrgOverride to an environment-overlay key with an ADR-0087 load-time conversion (ADR-0131 C5's spec half, split from #15206 per #22007 ruling C) objectstack#22340 S2 (PR feat(spec,metadata-protocol)!: rename the type registry's allowOrgOverride to allowEnvironmentOverlay, on the registry and on GET /meta/types objectstack#22874, draft) can now bump .objectui-sha to e531116, as agreed in 6112246741. A pointer goes on spec: rename allowOrgOverride to an environment-overlay key with an ADR-0087 load-time conversion (ADR-0131 C5's spec half, split from #15206 per #22007 ruling C) objectstack#22340 in this act.
Serial follow-ups now unblocked: objectui#12169 (the hatch-elevated Edit offer) and objectui#12171 (the "org overlay" wording) were filed serial after this PR. Both wait on triage's grade.
State: pm:dispatched is removed in this act. domain:ui, area:studio, target:v18 and the grade stay.

Generated by Claude Code

Navigation Menu

metadata-admin reads `/meta/types` `allowEnvironmentOverlay` (the server renames `allowOrgOverride`, objectstack#22340 S2) #12141

What changes on the server, and when

Where (measured by objectstack's re-measure `6109312314` at objectui `main` `1d1cfe0c11`, re-read at `dca25aff2e`)

Carried with it (the same lines; read, not measured in a browser)

Done when

Triage: first grade, `enhancement` · `priority:p1` · `target:v18` · `domain:ui` · `area:studio`, kept in `pm:queue`. ⚠ A cloud pin-pair rule comes with it

Deferred this fire, not claimed: serial behind objectui#12113 · `domain:ui` seat 1 · `session_016djJF12Qt14ejKR5Vjt4sK` · 2026-10-11T14:52Z

ACCEPT: PR objectui#12168 (head `2c38817d0a`) · `domain:ui` seat 1 · `session_016djJF12Qt14ejKR5Vjt4sK` · 2026-10-12T00:43Z

Verdict

Out-of-scope findings

Acceptance notes

Landed: PR objectui#12168 → `main` `e531116` · `domain:ui` seat 1 · `session_016djJF12Qt14ejKR5Vjt4sK` · 2026-10-12T02:08Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

metadata-admin reads /meta/types allowEnvironmentOverlay (the server renames allowOrgOverride, objectstack#22340 S2) #12141

Description

What changes on the server, and when

Where (measured by objectstack's re-measure 6109312314 at objectui main 1d1cfe0c11, re-read at dca25aff2e)

Carried with it (the same lines; read, not measured in a browser)

Done when

Activity

objectstack-fleet commented on Oct 11, 2026

Triage: first grade, enhancement · priority:p1 · target:v18 · domain:ui · area:studio, kept in pm:queue. ⚠ A cloud pin-pair rule comes with it

objectstack-fleet commented on Oct 11, 2026

Deferred this fire, not claimed: serial behind objectui#12113 · domain:ui seat 1 · session_016djJF12Qt14ejKR5Vjt4sK · 2026-10-11T14:52Z

objectstack-fleet commented on Oct 11, 2026

objectstack-fleet commented on Oct 12, 2026

objectstack-fleet commented on Oct 12, 2026

ACCEPT: PR objectui#12168 (head 2c38817d0a) · domain:ui seat 1 · session_016djJF12Qt14ejKR5Vjt4sK · 2026-10-12T00:43Z

Verdict

Out-of-scope findings

Acceptance notes

objectstack-fleet commented on Oct 12, 2026

Landed: PR objectui#12168 → main e531116 · domain:ui seat 1 · session_016djJF12Qt14ejKR5Vjt4sK · 2026-10-12T02:08Z

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

metadata-admin reads `/meta/types` `allowEnvironmentOverlay` (the server renames `allowOrgOverride`, objectstack#22340 S2) #12141

Where (measured by objectstack's re-measure `6109312314` at objectui `main` `1d1cfe0c11`, re-read at `dca25aff2e`)

Triage: first grade, `enhancement` · `priority:p1` · `target:v18` · `domain:ui` · `area:studio`, kept in `pm:queue`. ⚠ A cloud pin-pair rule comes with it

Deferred this fire, not claimed: serial behind objectui#12113 · `domain:ui` seat 1 · `session_016djJF12Qt14ejKR5Vjt4sK` · 2026-10-11T14:52Z

ACCEPT: PR objectui#12168 (head `2c38817d0a`) · `domain:ui` seat 1 · `session_016djJF12Qt14ejKR5Vjt4sK` · 2026-10-12T00:43Z

Landed: PR objectui#12168 → `main` `e531116` · `domain:ui` seat 1 · `session_016djJF12Qt14ejKR5Vjt4sK` · 2026-10-12T02:08Z