@@ -21,6 +21,10 @@
  *    the deployment declares `trustProxy`. A list that includes it saves.
  *  - The recovery the refusal names: `OS_AUTH_ALLOWED_IP_RANGES` set empty
  *    opens the gate on the next boot over a stored list.
+ *  - [#30385] The rest of that recovery: while the override is in force a
+ *    clear (`null`) goes through the settings door and clears the stored
+ *    list, so removing the override does not bring it back; any other value
+ *    is still refused `409 SETTINGS_LOCKED`.
  *
  * `@objectstack/service-settings` resolves to its `src/` here (this package's
  * `vitest.config.ts`), so the routes and the service are the checkout's.
@@ -229,3 +233,36 @@ describe('#30203 the recovery the refusal names', () => {
     expect(recovered.manager.isClientIpAllowed('::1')).toBe(true);
   });
 });
+
+describe('#30385 the env recovery clears the stored list, so lifting the override does not lock the caller out again', () => {
+  it('set the override empty, sign in, clear the stored list through the settings door, remove the override: the caller is admitted', async () => {
+    const env: Record<string, string | undefined> = {};
+    const svc = new SettingsService({ env });
+    svc.registerManifest(authManifest);
+    await svc.set('auth', 'allowed_ip_ranges', OFFICE, {});
+    expect((await boot({ svc })).manager.isClientIpAllowed('::1')).toBe(false);
+
+    // Start the server with the override set empty: the gate opens.
+    env.OS_AUTH_ALLOWED_IP_RANGES = '';
+    const recovered = await boot({ svc });
+    expect(recovered.manager.isClientIpAllowed('::1')).toBe(true);
+
+    // A value is still refused while the override is in force, the empty string included.
+    const refused = await recovered.save({ allowed_ip_ranges: '' }, { remoteAddress: '::1' });
+    expect(refused.status).toBe(409);
+    expect(refused.body.error.code).toBe('SETTINGS_LOCKED');
+    expect(refused.body.error.details).toEqual({ namespace: 'auth', key: 'allowed_ip_ranges', reason: 'locked-by-env' });
+
+    // The clear goes through; the answer still reads the override, locked, and the gate stays open.
+    const cleared = await recovered.save({ allowed_ip_ranges: null }, { remoteAddress: '::1' });
+    expect(cleared.status).toBe(200);
+    expect(cleared.body.data.values.allowed_ip_ranges).toMatchObject({ value: '', source: 'env', locked: true });
+    expect(recovered.manager.isClientIpAllowed('::1')).toBe(true);
+
+    // Remove the override and restart: no stored list comes back.
+    delete env.OS_AUTH_ALLOWED_IP_RANGES;
+    expect((await svc.get('auth', 'allowed_ip_ranges', {})).source).toBe('default');
+    const restarted = await boot({ svc });
+    expect(restarted.manager.isClientIpAllowed('::1')).toBe(true);
+  });
+});
@@ -2745,3 +2745,107 @@ describe('auth lockout window is enforced again (#7169)', () => {
     }
   });
 });
+
+describe('SettingsService — a clear goes through an env pin, every other write does not (#30385)', () => {
+  // Two keys a pin can sit on: one below the global rung, one on it.
+  const PINNED = {
+    namespace: 'pinned',
+    version: 1,
+    label: 'Pinned',
+    scope: 'tenant',
+    readPermission: 'setup.access',
+    writePermission: 'setup.write',
+    specifiers: [
+      { type: 'text', key: 'motto', label: 'Motto', scope: 'tenant', default: 'none' },
+      { type: 'text', key: 'banner', label: 'Banner', scope: 'global', default: 'none' },
+    ],
+  } as any;
+  const orgAdmin = { enforced: true, permissions: ['setup.access', 'setup.write'], userId: 'usr_org_admin' };
+  const platformAdmin = {
+    enforced: true,
+    permissions: ['setup.access', 'setup.write', 'manage_platform_settings'],
+    userId: 'usr_platform_admin',
+  };
+  const refusalOf = (p: Promise<unknown>) => p.then(() => undefined, (e: any) => e);
+
+  /** A stored value under a pin that is set after it: the operator's recovery. */
+  async function pinnedOverStored() {
+    const env: Record<string, string | undefined> = {};
+    const svc = new SettingsService({ env });
+    svc.registerManifest(PINNED);
+    await svc.set('pinned', 'motto', 'Stored');
+    env.OS_PINNED_MOTTO = 'Pinned';
+    return { env, svc };
+  }
+
+  it('a clear clears the stored value beneath the pin and changes nothing in force: the answer still reads env, locked', async () => {
+    const { env, svc } = await pinnedOverStored();
+    const changes: unknown[] = [];
+    svc.subscribe('pinned', (e) => { changes.push(e); });
+
+    const answer = await svc.set('pinned', 'motto', null);
+    expect(answer).toMatchObject({ value: 'Pinned', source: 'env', locked: true });
+    expect(answer.lockedReason).toContain('OS_PINNED_MOTTO');
+    expect(await svc.get('pinned', 'motto')).toMatchObject({ value: 'Pinned', source: 'env', locked: true });
+    expect(changes).toEqual([expect.objectContaining({ key: 'motto', action: 'reset' })]);
+
+    // Lift the pin: the key falls back to its default, not to the old value.
+    delete env.OS_PINNED_MOTTO;
+    expect(await svc.get('pinned', 'motto')).toMatchObject({ value: 'none', source: 'default', locked: false });
+  });
+
+  it('`undefined` is a clear too, alongside an ordinary write in the same batch', async () => {
+    const { env, svc } = await pinnedOverStored();
+    await svc.setMany('pinned', { motto: undefined, banner: 'Saved' });
+    delete env.OS_PINNED_MOTTO;
+    expect((await svc.get('pinned', 'motto')).source).toBe('default');
+    expect((await svc.get('pinned', 'banner')).value).toBe('Saved');
+  });
+
+  it('every other write is refused SETTINGS_LOCKED as before, the empty string included, and the whole batch stores nothing', async () => {
+    const { env, svc } = await pinnedOverStored();
+    for (const value of ['Other', '']) {
+      const refusal = await refusalOf(svc.set('pinned', 'motto', value));
+      expect(refusal).toBeInstanceOf(SettingsLockedError);
+      expect(refusal).toMatchObject({ code: 'SETTINGS_LOCKED', reason: 'locked-by-env', key: 'motto' });
+    }
+    const batch = await refusalOf(svc.setMany('pinned', { banner: 'Saved', motto: 'Other' }));
+    expect(batch).toMatchObject({ code: 'SETTINGS_LOCKED', reason: 'locked-by-env', key: 'motto' });
+
+    delete env.OS_PINNED_MOTTO;
+    expect(await svc.get('pinned', 'motto')).toMatchObject({ value: 'Stored', source: 'tenant' });
+    expect((await svc.get('pinned', 'banner')).source).toBe('default');
+  });
+
+  it('a locked row at an upper rung still refuses a clear below it', async () => {
+    const { env, svc } = await pinnedOverStored();
+    await (svc as any).upsertRow({
+      namespace: 'pinned', key: 'motto', scope: 'global', user_id: null, value: 'Platform motto',
+      value_enc: null, encrypted: false, locked: true, locked_reason: 'Set by the platform.',
+    });
+
+    const refusal = await refusalOf(svc.set('pinned', 'motto', null));
+    expect(refusal).toBeInstanceOf(SettingsLockedError);
+    expect(refusal).toMatchObject({ code: 'SETTINGS_LOCKED', reason: 'locked-by-global', key: 'motto' });
+
+    delete env.OS_PINNED_MOTTO;
+    expect(await svc.get('pinned', 'motto')).toMatchObject({ value: 'Platform motto', source: 'global', locked: true });
+  });
+
+  it('a locked row at the write\'s own rung refuses a non-platform clear, and the platform writes through it', async () => {
+    const env: Record<string, string | undefined> = { OS_PINNED_BANNER: 'Pinned banner' };
+    const svc = new SettingsService({ env });
+    svc.registerManifest(PINNED);
+    await (svc as any).upsertRow({
+      namespace: 'pinned', key: 'banner', scope: 'global', user_id: null, value: 'Platform banner',
+      value_enc: null, encrypted: false, locked: true, locked_reason: 'Set by the platform.',
+    });
+
+    const refusal = await refusalOf(svc.setMany('pinned', { banner: null }, orgAdmin));
+    expect(refusal).toBeInstanceOf(SettingsLockedError);
+    expect(refusal).toMatchObject({ code: 'SETTINGS_LOCKED', reason: 'locked-by-global', key: 'banner' });
+
+    const answer = await svc.setMany('pinned', { banner: null }, platformAdmin);
+    expect(answer.banner).toMatchObject({ value: 'Pinned banner', source: 'env', locked: true });
+  });
+});