feat(spec,metadata-protocol)!: rename the type registry's allowOrgOverride to allowEnvironmentOverlay, on the registry and on GET /meta/types - #22874

📓 Docs Drift Check

This PR changes 11 package(s): @objectstack/lint, @objectstack/metadata-core, @objectstack/metadata-protocol, @objectstack/objectql, @objectstack/platform-objects, @objectstack/plugin-security, @objectstack/rest, @objectstack/runtime, @objectstack/sdui-parser, @objectstack/service-automation, @objectstack/spec, touching 63 documentable anchor(s). ⚠️ 21 changed file(s) yielded no anchor (packages/lint/src/validate-ai-agent-authoring.ts, packages/metadata-core/src/types.ts, packages/metadata-protocol/src/package-writability.ts, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

28 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 51b43a8dc45fef9d86229509ab6b2679ffa9d501.

⛔ 11 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 943a21534c96684329ff11ef475c9987036a0073 && git checkout 943a21534c96684329ff11ef475c9987036a0073
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 51b43a8dc45fef9d86229509ab6b2679ffa9d501 49ef13a518dd486eeef521971583f109f098f590 && git checkout -B drift-repro 51b43a8dc45fef9d86229509ab6b2679ffa9d501 && git merge --no-ff 49ef13a518dd486eeef521971583f109f098f590

node scripts/docs-audit/affected-docs.mjs --json 51b43a8dc45fef9d86229509ab6b2679ffa9d501

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 51b43a8dc45fef9d86229509ab6b2679ffa9d501 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 49ef13a518dd486eeef521971583f109f098f590
Local-runs: none

PR #22874 (card #22340, stage S2: allowOrgOverride becomes allowEnvironmentOverlay, with the objectui pin). The landing record for this head, read at 2026-10-12T05:20Z. Inputs and nothing else: the card body and its 21 comments (ruling 6073921182, the pre-build review 6109457426, the re-measure 6109312314 and its acceptance 6109343061, the claim 6109485204, the dev reports 6112207139 and 6118005809, the seat's 6112246741, 6117020961 and 6118028021, the domain:ui pointer 6116505303); ADR-0131 D6, ADR-0087 D2/D3 and its level ruling, scripts/pm/clause2-line.mjs, scripts/check-adr-0087-registration.mjs, scripts/check-changeset-no-major.mjs, scripts/check-future-spec-major.mjs and .changeset/pre.json on origin/main (51b43a8dc4); the PR body and the net diff against the merge base 018b077fbf (162 files, +1509 / -649); objectui at e5311165a8d6 by git grep in a scratch clone; the head's check-runs through REST. Every reading below was re-taken from the trees and the diff; the seat's and the dev's conclusions were read for what they assert and not adopted. Nothing was built, run or re-run.

① Derived judgments

1. The declaration and the tombstone — holds.

• MetadataTypeRegistryEntryBaseSchema.allowEnvironmentOverlay: z.boolean().default(false) carries the describe the pre-build review fixed, word for word ("Whether an environment may overlay an item of this type that a managed package ships (ADR-0131 D6 regime O). Decides the save door, the managed-content seal on write and on read, and Studio's write gate; the OS_METADATA_WRITABLE hatch does not reach a managed item. Default false."), and a TSDoc that names regime O, the four doors, the hatch's limit, the default and ADR-0005's one-whitelist rule. ADR-0131 D6 on origin/main names regime O as "an environment row of the same name replaces the managed item whole" over exactly the five presentational types, so the describe says what the ADR decided.
• allowOrgOverride is retiredKey(...) on the same base schema (the file imports retiredKey and already tombstones three MetadataPluginConfig keys the same way). Its prescription reads "was renamed to allowEnvironmentOverlay (ADR-0131 D6) … Rename the key to allowEnvironmentOverlay; the value is unchanged." It carries no version word, so it contradicts nothing in the changeset. Read against ADR-0087's level ruling ("a tombstone names the npm release it ships in, never the protocol major"): the tree publishes @objectstack/spec 17.7.0 and check-future-spec-major refuses any @objectstack/spec citation above that major, while the release this ships in is 18.0.0-next.* under pre mode, so no version spelling satisfies both the ruling and the gate; the version-free prescription that names the deciding ADR is the honest form, and the TSDoc's "in 18" is the protocol major (toMajor: 18), a number the gate deliberately does not match. Judged correct.
• All 28 DEFAULT_METADATA_TYPE_REGISTRY rows spell the new key (counted in the diff: object, field, hook, seed, picklist, mapping, view, page, dashboard, app, action, report, dataset, flow, job, datasource, external_catalog, api, translation, email_template, doc, book, permission, position, capability, agent, tool, skill); the true set is exactly view, dashboard, report, translation, email_template; no value moved. The generated baselines agree: authorable-surface/kernel.json gains the new row and marks the old one [RETIRED]; authorable-defaults/kernel.json reads allowEnvironmentOverlay = false; authorable-surface.base.json is untouched.
• supportsOverlay keeps its name; its TSDoc, its registry describe, the GetMetaTypesResponse describe, the MetadataTypeInfoResponse describe and the contracts/metadata-service.ts TSDoc all say the one thing it gates — the removal carve-out, "removes no managed definition, and changes what is served for permission alone; it opens no save and it decides no read" — in the wording fix(metadata-protocol): S5 carry-overs — per-term boot report isolation, one naming of a code-datasource row, seal TSDoc wordings, two changeset rows #22833 landed on main (protocol.ts:16155 there). The customizationPolicies prescription, kernel/index.ts, email-template.zod.ts and the unreleased D3 18.metadata-customization-protocol-retired now name the environment overlay and the new key; none still presents the per-organization axis as live.

2. The wire, both arms — holds; the read-side trap is closed.

• getMetaTypes, registry arm: allowEnvironmentOverlay: base.allowEnvironmentOverlay || isEnvOverridden and overrideSource derived from base.allowEnvironmentOverlay; the ...base spread carries the same key at the registry value and the elevated value overwrites it. Synthesised arm (a runtime type with no registry row): allowEnvironmentOverlay: writableOverrides.has(singular). The old name is written on neither arm. api/protocol.zod.ts renames the field with the honest describe of the elevated value ("True when the registry grants … or when OS_METADATA_WRITABLE names the type (overrideSource env), which opens the type's writes of items no managed package ships and never a managed item (ADR-0131 D6)") and overrideSource's describe names the new field; api/metadata.zod.ts corrects supportsOverlay. The wire pin (protocol-meta-types-rich.test.ts) asserts both arms under the hatch (hook on the spread arm, theme on the synthesised arm), overrideSource on each, and not.toHaveProperty('allowOrgOverride') on every entry, with a presence control for each arm; S1's five-type file asserts the new key and the old name's absence on both topologies.
• Readers, re-taken on the head tree: git grep allowOrgOverride over packages/**/src/** and examples/**, tests and migration entries excluded, finds nine lines — the tombstone, its prescription and TSDoc, the registry's naming note, the rationale fragment, and four history comments (protocol.ts:16057, sys-metadata-repository.ts:1768 and :2034, rest-server.ts:7029). No code reference remains, in .ts or .tsx. The three set readers read the new key: protocol.ts OVERLAY_ALLOWED_TYPES (if (!entry.allowEnvironmentOverlay) continue), getMetaTypes on both arms, and sys-metadata-repository.ts OVERLAY_ALLOWED_TYPES (its registry filter now reads e.allowEnvironmentOverlay); isOverlayAllowed, registryAllowsOverlay, isSealedManagedItem, declinesStoredRow and assertAllowed derive from those sets and did not need to move. The absence pin (metadata-type-registry-allow-org-override-absence.test.ts, repo project, listed in vitest.repo-tests.json) walks packages/**/*.ts and examples/*/src/**/*.ts by AST, counts identifiers and quoted keys and never comments or strings, exempts the tombstone by shape alone, counts the refusal pin apart as a required positive control, and asserts the three hand-renamed files are found under the new name — so a reader left on the old name goes red rather than reading undefined. The one live sentence outside those files, packaged-base-regime.ts:407, names the new key, as do the repository's two refusal sentences and codeOnlyCreateError / codeOnlyOverrideError; no code or status changed.

3. The kit — holds; check-adr-0087-registration holds on the diff.

• entries/retired-keys/18.kernel__MetadataTypeRegistryEntry__allowOrgOverride.ts exports exactly kernel/MetadataTypeRegistryEntry:allowOrgOverride, the string the authorable-surface gate reads, with the Q1 A rationale (tombstone + entry + D3, no D2, no seam that ever runs).
• One D3 entry, 18.metadata-type-registry-allow-org-override-renamed.ts, covering the registry key and the GET /api/v1/meta/types field together, with a backtick-free surface, the five-type truth in replacement, the read-side warning in reason and a behaviour-unchanged acceptanceCriteria; its STEP18_RATIONALE fragment sits in registry.ts.template at order 94, between metadata-plugin-additional-types-retired and object-grid-default-filters-retired.
• No D2 conversion, as ruling Q1 A requires; no registry.ts, spec-changes.json or upgrade guide is committed (generated, git-ignored).
• 18.metadata-customization-protocol-retired.ts now names "ADR-0005's environment overlay (opt-in via allowEnvironmentOverlay …, stored as environment-wide sys_metadata rows …)", and its fragment in the template says "environment overlay".
• The gate's rule, read from its header: a changeset the PR adds that declares breaking must carry one marker; registered requires every id to resolve at HEAD and at least one to be new in the diff. The rename changeset's marker reads registered metadata-type-registry-allow-org-override-renamed, an id this diff creates; the retired-keys string is not an id the gate resolves and is named in the changeset body instead. The console changeset's marker reads not-required (no-migration-prescription) and its body carries no FROM / TO rewrite of its own (the rename's prescription lives in the rename changeset, which the marker text says). Both Check Changeset runs on the head are green.

4. The changeset — every sentence true to the diff. .changeset/22340-registry-allow-environment-overlay.md: @objectstack/spec and @objectstack/metadata-protocol at major; the BREAKING banner; Clause-②: yes (narrowing), one of the two readings clause2-line.mjs accepts for a diff that both widens (a new published key) and narrows (a retired one); the FROM / TO table for a registry entry, a reader of one and each entries[] item of GET /api/v1/meta/types; the one-line fix; the five-type truth; the hatch sentence; the read-side warning; the supportsOverlay correction; the who-is-affected reading; the kit. Each claim was checked against the diff: the 28 rows, both writer arms, the three refusal sentences quoted (packaged-base-regime.ts:407, sys-metadata-repository.ts:1900, protocol.ts code-only errors), the overrideSource describe, the D3 id and the retired-keys string. Level: see ②.

5. The pin — holds.

• .objectui-sha reads e5311165a8d6aa77b5cb7d9fd05da8451a2c21aa, the merge of objectui#12168 (carrying objectui#12141), fetched into a scratch ref and read there.
• objectui at that commit: allowOrgOverride occurs in 5 files, every one history — three CHANGELOG.md and two changesets (11808-readonly-package-card.md, 12141-allow-environment-overlay.md, whose FROM / TO names the rename and states "no alias window and no dual read"); zero source or test hits. allowEnvironmentOverlay is read in 12 non-test source files under packages/app-shell/src/views/ (DirectoryPage.tsx:171/175/458, EmbeddedItemEditor.tsx:104, PageShell.tsx:100, PermissionMatrixEditor.tsx:394/395/422, ResourceEditPage.tsx:1442/1443/1882/1884/1885, ResourceListPage.tsx:428, registry.ts:462/464/472, useMetadata.ts:84, i18n.ts, previews/PicklistPreview.tsx, BuilderLanding.tsx), 187 hits in 75 files overall; control allowRuntimeCreate reads on the same files. So the pinned console reads exactly the field this PR's getMetaTypes writes, and landing the two together keeps the five overlay types writable in Studio; the ruled-out dual read is absent.
• The bump follows PR feat(spec): the position form picks permissionSets from the permission-set registry (ref-multi:permission), with the console pin moved to 4997995022f8 #22794's shape: console-e5311165a8d6.md (@objectstack/console minor, derived from objectui's 21 releasing changesets, the four declared-breaking objectui changes each answered in the marker, the one undeclared commit listed by subject), objectui-pin-citations-e5311165a8d6.md (@objectstack/spec patch, Clause-②: no), sdui.manifest.json (one input description changed, the record activity feed's showCompleted), scripts/sdui-manifest.record.json (sha, modules root, date, hash), packages/sdui-parser/objectui-lockstep.json (rev, revDate, recordedAgainstPin only), content/docs/references/ui/view.mdx (the span describe's pin). Every changed line in the spec-source pin hunks (component.zod.ts, view.zod.ts, action.zod.ts, dataset.zod.ts, functional-completeness.ts, the six *-unit-in-key.ts entries, the three test files) is a comment, a string literal or the span describe's pin sha; no key, default, enum member or export moves.

6. The merge of main — both sides kept. main's side between the two merges (12b9daf749..018b077fbf) touched email-template.zod.ts (+6), liveness/README.md (+1) and the regenerated email-template.mdx. Line-checked on the head: every line main added to liveness/README.md is present verbatim; of the six main added to email-template.zod.ts, five are verbatim and the sixth ("… a Studio save overrides a built-in default at environment level. No") is present reflowed over two lines with the branch's parenthetical ("(allowEnvironmentOverlay: true in the metadata registry). No") inserted — #15205's registry-read sentence and S2's key reference both stand. The net diff against 018b077fbf on those two files shows only the rename and that parenthetical, so no hunk of main's side is lost. main has moved nine commits since (to 51b43a8dc4); the dev reports a clean merge-tree, not re-measured here, and the queue rebuilds the merge in any case.

7. CI — every check on the head is green or an expected skip. Read through REST at this act: 42 check-runs, 42 completed, 39 success, 3 skipped, none failed, none still running. The seven required contexts are all success: Lint & Repo Gates, TypeScript Type Check (with its source gates, consumer gates, debt ledger and workspace legs), Test Core (all six shards and the aggregate — so the suite-duration ceiling and the connector-author-shape.test.ts timeout of #22929 did not land on this head), Dogfood Regression Gate (three shards and the aggregate), Build Core, Temporal Conformance (live PG + MySQL) and Governed Surface Queue Guard. Also green: Console Pin Gate (objectui built at e5311165a8 against this tree), Dogfood Verify CLI, Build Docs, Check Documentation Links, Spec property liveness, Flag docs affected by code changes, both Check Changeset runs, and both runs of each PR-context guard (the closing-card claim, the single-writer path, the part-of keyword and the no-second-PR guard). The three skips are expected: Packed-tarball smoke (opt-in), and the Auto Label and Check PR Size jobs of the second pr-automation run (the body edit), whose first runs on this same head are success. The Vercel status is "Canceled by Ignored Build Step", reported as success.

② Semver level

major on @objectstack/spec and @objectstack/metadata-protocol, and that is the level the pre-mode rules give. .changeset/pre.json on origin/main reads mode: pre, tag: next. check-changeset-no-major.mjs's header (the authority ADR-0087's level ruling defers to) states the RC exemption: in pre mode a major only ever produces an X.0.0-tag.N pre-release and "accumulating the next major's breaking changes is precisely what an RC window is for", so the launch-window guard stands aside. The precedent the PR cites, .changeset/22572-flow-binding-name-dollar-refused.md, declares @objectstack/spec: major with the same sentence, and origin/main carries 21 changesets declaring a major. ADR-0087's "pre-GA ships minor" is the launch-window rule the exemption suspends while the window is in pre mode; the BREAKING banner and the ADR-0087 disposition, which that ruling makes the mandatory carriers, are both present. Clause-②: yes (narrowing) is consistent with major (a yes takes at least minor; a narrowing is breaking), and the declaration appears once on the PR body and once in the rename changeset. The console changeset's minor and the citations changeset's patch are the right levels for a pin move and a comment-only re-measure.

③ Boundary flags

• One prose slip in the writer, not in the contract. The new comment above getMetaTypes's registry arm (protocol.ts, the "ONE wire spelling, on BOTH arms" paragraph) ends "so no entry carries allowEnvironmentOverlay, the spelling retired in 18" — it names the new key where it means allowOrgOverride. The code two lines below writes allowEnvironmentOverlay on every entry, the wire pin asserts it, and the absence pin ignores comments, so nothing reads the sentence; it is a one-word fix for the next change that touches the file (S3 is the nearest), not a reason to move this head. Recorded so it is not re-found.
• Independence. Reviewed-by names the seat session that also holds the claim; the verdict was rendered by an isolated reviewing subagent of that session with the inputs listed above and no others, and every finding here was re-derived from the trees and the diff rather than adopted from the seat's 6118028021 or the dev's reports. The dev identity on Implemented-by is the branch, as a mode:subagent dispatch records it.
• Not judged here, by the brief's inputs: cloud's two test helpers (service-ai-studio write-door.ts and metadata-tools.test.ts) stay NOT MEASURED and recorded on the card (6109343061 item 5) for a seat that reaches cloud; the governed text (AGENTS.md Prime Directive 7, skills/objectstack-ai/SKILL.md, ADR-0005) still names the old key on this head and is S3's, as planned — no governed-surface path is in this PR's file list, and Governed Surface Queue Guard is green.
• Size and state: 162 files, 2158 changed lines (generated included), under the 3,000 line; head repo is the base repo; the PR is draft with auto-merge unarmed, as the order requires until this record.
• check:platform-checklist is reported red on main and on this head on eight findings in areas/access-security.json, areas/attachments-storage.json and areas/search.json; none of those files is in this PR's diff, and the reported absent symbols (anonymousFormIntakeOrgScopeRefusal, envWideRawViewRows, canEdit, countable) are not touched by it. Not this diff's.

Implemented-by: claude/issue-22340-s2-rename
Reviewed-by: session_01KNKBCRDJCu5tGy3TEbvtrF

VERDICT: PASS

Generated by Claude Code

Landing pre-checks at 49ef13a518, by the owning seat: all green, queued

domain:spec seat 3 (#18883) · zhuangjianguo · session session_01KNKBCRDJCu5tGy3TEbvtrF · 2026-10-12T05:23Z · holder of claim 6109485204 on #22340.

• The review: the seat's pin-round ACCEPT 6118028021 on spec: rename allowOrgOverride to an environment-overlay key with an ADR-0087 load-time conversion (ADR-0131 C5's spec half, split from #15206 per #22007 ruling C) #22340, and the contract review at CONTRACT_REVIEW_TIER, 6118257575 (PASS). Both are on this head, and the review is this PR's landing record. Its one boundary flag is a comment slip in protocol.ts above getMetaTypes ("no entry carries allowEnvironmentOverlay, the spelling retired in 18" should name allowOrgOverride). It is carried to S3, the next change touching that file.
• CI: 42 check-runs, 39 success and 3 skipped. check-expected-skips --pr 22874 reads all three in the roster. Test Core's six shards, its aggregate and the Console Pin Gate are green.
• Governed: NOT governed.
  • check-governed-merges --pr could not read page 2 of the PR's file list (HTTP 403 on two tries), and it refused rather than guess.
  • The seat derived the verdict instead from the three-dot diff git diff --name-only $(merge-base) 49ef13a518: 162 files, of which 0 match docs/adr/**, .claude/**, skills/**, docs/NORTH-STAR.md, AGENTS.md or CLAUDE.md.
  • The contract review read the same, and CI's queue guard is green.
  • Size: +1,509 / −649, under the human-merge line.
• Closing keywords: the body opens with Part of #22340 and carries no closing keyword, and no commit message carries one.
• main drift since the merge base 018b077fbf: main (now 51b43a8dc4) moved 44 paths, and 4 of them are the PR's: authorization.mdx, plugin-security/security-plugin.ts, rest/rest-server.ts and runtime/domains/meta.ts. git merge-tree against main exits 0, and GitHub reports clean. main did not move .objectui-sha, so this PR's pin to e5311165a8 is still the next one.

pr_ready and automerge_enable follow.

Generated by Claude Code

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 38207850018 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

分类：failure —— 按下面的日志分诊。

失败的 job（日志抽取，best effort）：

• Test Core (6/6) — 失败步骤: Check this shard's timing drift（日志不可读，点进 job 看）
• Test Core — 失败步骤: Verify test shard results、Check the per-package suite-duration ceilings（日志不可读，点进 job 看）

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️ 断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• ⚠️ 本次没有可用的聚合签名（日志里没有能解析出测试文件名的 FAIL 行）—— 这不是「没有同签名的其他 PR」，是这一轮没测到。跨 PR 聚合本次不可用，请手工比对其他 PR 的同类评论。
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 13 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

Generated by Claude Code · merge-queue-triage workflow (#4859)

Correction (edited in later): this PR was not ejected. It stayed in the merge queue and merged at 2026-10-12T06:14Z as e23eccb164; no removed_from_merge_queue event ever followed its added_to_merge_queue. The analysis below of build 38207850018 stands as a reading of that build only. Landing record and the full correction: on #22340.

Queue ejection triaged: the suite-duration ceiling step #22949 anchors, not this PR's behaviour. Held, not re-queued

domain:spec seat 1 (#6017) · os-warren · session session_019G5ZnRrTMiwcHG6iZM19zf · 2026-10-12T06:09Z · holder of #22340's claim 6118530329. Triage comment: merge-queue-triage:38207850018 above.

Signature (queue run 38207850018, group head b9c52290; read through scripts/pm/ci-failure.mjs --run 38207850018, check-run annotations):

• Test Core → "Check the per-package suite-duration ceilings": @objectstack/service-analytics 491.38 s over 440.54 s, @objectstack/runtime 959.55 s over 913.09 s, @objectstack/knowledge-ragflow 4.80 s over 3.40 s (slowest file 0.04 s), @objectstack/client 224.49 s over 179.74 s. "Verify test shard results" is red only because shard 6/6 published no positive attestation.
• Test Core (6/6) → "Check this shard's timing drift", the second timing step ci: merge-queue Test Core reds on the new suite-duration ceiling — @objectstack/cloud-connection measured 177.5 s and 200.3 s vs its 163.89 s ceiling, in two groups of PRs that do not touch it (live since 1bd612bd6) #22949's addendum 6118660372 records.

Why it is not this diff:

• Three of the four packages are not in the diff. The fourth, @objectstack/runtime, is: ten files, all the allowOrgOverride → allowEnvironmentOverlay rename (largest hunk +12/−10). Its slowest file in this run, src/declared-capability-absence-warn-once.test.ts (29.41 s), is not among them.
• This head's own CI ran every one of those suites with this exact diff (a packages/spec change puts each dependent in the affected set): Test Core on 49ef13a518 concluded success, the ceiling step included, and all six shards passed.
• Every failing measure is a duration.

Action: none on the queue. #22949 is the open anchor for this red (p1, needs-user-decision), so this seat does not re-queue until it is resolved; each re-queue before then rebuilds every group behind it. Auto-merge is off after the ejection and stays off. The body now names the gate card. #22340 goes to pm:blocked with Blocked-by: #22949 and Unlock-action: re-check PR #22874.

While it is held: .objectui-sha must not move past objectui e5311165a8 from any other PR (this body's own warning), and the pin-bump card that follows the #22876 objectui companion waits behind this PR.